@hasna/skills 0.5.3 → 0.5.4

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join6 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.3",
+  version: "0.5.4",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -461,40 +461,7 @@ function publicPrincipal(partial = {}) {
 // src/server/rows.ts
 import { randomUUID } from "crypto";
 
-// src/lib/skill-entry-path.ts
-class SkillEntryPaths {
-  files = new Set;
-  directories = new Set;
-  add(path, maxBytes, invalid, limit) {
-    if (path.length > maxBytes)
-      limit();
-    const encoded = new TextEncoder().encode(path);
-    if (encoded.byteLength > maxBytes)
-      limit();
-    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
-      invalid("Invalid UTF-8 entry path");
-    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
-      invalid("Unsafe entry path");
-    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
-      invalid("Unsafe entry path segment");
-    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
-    if (this.files.has(key) || this.directories.has(key))
-      invalid("Duplicate or conflicting entry path");
-    const parents = key.split("/");
-    parents.pop();
-    while (parents.length) {
-      const parent = parents.join("/");
-      if (this.files.has(parent))
-        invalid("Conflicting entry file ancestor");
-      this.directories.add(parent);
-      parents.pop();
-    }
-    this.files.add(key);
-  }
-}
-
 // src/lib/skill-bundle.ts
-var BLOCK = 512;
 var ANY_SEGMENT_EXCLUDES = new Set([
   ".git",
   ".ds_store",
@@ -631,136 +598,6 @@ var SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
   timeoutMs: 5000
 });
 
-class SkillBundleInspectionError extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "SkillBundleInspectionError";
-  }
-}
-function invalidBundle(message) {
-  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
-}
-class BoundedTarReader {
-  limits;
-  check;
-  header = new Uint8Array(BLOCK);
-  headerOffset = 0;
-  pending;
-  bodyOffset = 0;
-  padding = 0;
-  zeroBlocks = 0;
-  entries = [];
-  paths = new SkillEntryPaths;
-  fileBytes = 0;
-  constructor(limits, check) {
-    this.limits = limits;
-    this.check = check;
-  }
-  push(chunk) {
-    let offset = 0;
-    while (offset < chunk.byteLength) {
-      this.check();
-      if (this.pending) {
-        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk.byteLength - offset);
-        this.pending.bytes.set(chunk.subarray(offset, offset + count), this.bodyOffset);
-        offset += count;
-        this.bodyOffset += count;
-        if (this.bodyOffset === this.pending.bytes.byteLength) {
-          this.entries.push(this.pending);
-          this.pending = undefined;
-        }
-      } else if (this.padding) {
-        const count = Math.min(this.padding, chunk.byteLength - offset);
-        if (chunk.subarray(offset, offset + count).some((byte) => byte !== 0))
-          invalidBundle("Nonzero tar body padding");
-        offset += count;
-        this.padding -= count;
-      } else {
-        const count = Math.min(BLOCK - this.headerOffset, chunk.byteLength - offset);
-        this.header.set(chunk.subarray(offset, offset + count), this.headerOffset);
-        offset += count;
-        this.headerOffset += count;
-        if (this.headerOffset === BLOCK) {
-          this.readHeader();
-          this.headerOffset = 0;
-        }
-      }
-    }
-  }
-  finish() {
-    this.check();
-    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
-      invalidBundle("Truncated tar bundle");
-    return this.entries;
-  }
-  readHeader() {
-    this.check();
-    const h = this.header;
-    if (h.every((byte) => byte === 0)) {
-      this.zeroBlocks++;
-      return;
-    }
-    if (this.zeroBlocks)
-      invalidBundle("Nonzero tar data after terminator");
-    if (this.entries.length >= this.limits.entries)
-      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
-    let checksum = 0;
-    for (let i = 0;i < BLOCK; i++)
-      checksum += i >= 148 && i < 156 ? 32 : h[i];
-    if (tarOctal(h.subarray(148, 156)) !== checksum)
-      invalidBundle("Invalid tar header checksum");
-    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
-      invalidBundle("Unsupported tar format");
-    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
-      invalidBundle("Unsupported tar entry or path prefix");
-    const mode = tarOctal(h.subarray(100, 108));
-    if (mode > 511)
-      invalidBundle("Unsupported tar permission bits");
-    tarOctal(h.subarray(108, 116));
-    tarOctal(h.subarray(116, 124));
-    tarOctal(h.subarray(136, 148));
-    const size = tarOctal(h.subarray(124, 136));
-    if (size > this.limits.fileBytes || this.fileBytes + size > this.limits.decompressedBytes) {
-      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
-    }
-    const name = h.subarray(0, 100);
-    const end = name.indexOf(0);
-    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
-      invalidBundle("Invalid tar path padding");
-    const raw = end === -1 ? name : name.subarray(0, end);
-    if (raw.byteLength > this.limits.pathBytes)
-      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
-    let path;
-    try {
-      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
-    } catch {
-      return invalidBundle("Invalid UTF-8 bundle path");
-    }
-    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
-      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
-    });
-    this.fileBytes += size;
-    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size)) };
-    this.bodyOffset = 0;
-    this.padding = (BLOCK - size % BLOCK) % BLOCK;
-    if (!size) {
-      this.entries.push(this.pending);
-      this.pending = undefined;
-    }
-  }
-}
-function tarOctal(field) {
-  const text = new TextDecoder().decode(field);
-  if (!/^[0-7]+[\0 ]*$/.test(text))
-    invalidBundle("Invalid tar octal field");
-  const value = Number.parseInt(text, 8);
-  if (!Number.isSafeInteger(value))
-    invalidBundle("Tar integer is out of range");
-  return value;
-}
-
 // src/server/rows.ts
 function nowIso() {
   return new Date().toISOString();