@longzai-intelligence-npm-registry/core 0.0.1

package/dist/index.d.ts

@@ -0,0 +1,791 @@
+import "./rolldown-runtime-BqT_7tdF.js";
+import * as z from "zod";
+import { DomainError } from "@longzai-intelligence-error/core";
+//#region src/contracts/package.schema.d.ts
+/**
+ * 本地包摘要 DTO（引擎 listPackages 条目；`GET /api/packages` 数据）
+ */
+declare const PackageSummarySchema: z.ZodObject<{
+  name: z.ZodString;
+  versionCount: z.ZodNumber;
+  latest: z.ZodOptional<z.ZodString>;
+  modified: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * 本地包详情 DTO（`GET /api/packages/:name` 数据）
+ */
+declare const PackageDetailSchema: z.ZodObject<{
+  name: z.ZodString;
+  versionCount: z.ZodNumber;
+  latest: z.ZodOptional<z.ZodString>;
+  modified: z.ZodOptional<z.ZodString>;
+  distTags: z.ZodRecord<z.ZodString, z.ZodString>;
+  versions: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * 本地包详情 DTO 形态
+ */
+type PackageDetail = z.infer<typeof PackageDetailSchema>;
+/**
+ * 本地包摘要 DTO 形态
+ */
+type PackageSummary = z.infer<typeof PackageSummarySchema>;
+//#endregion
+//#region src/contracts/protocol.schema.d.ts
+/**
+ * npm 包名合法形态（scoped `@scope/name` 或 unscoped；小写字母开头，允许 . _ - 与数字）
+ */
+declare const PACKAGE_NAME_PATTERN: RegExp;
+/**
+ * 语义化版本（宽松形态：允许 prerelease/build 后缀，npm publish 全量接受）
+ */
+declare const SEMVER_PATTERN: RegExp;
+/**
+ * dist-tag 合法形态（npm 限制：不可含 ~'(){} 与 URL 不安全字符；此处取宽松子集）
+ */
+declare const DIST_TAG_PATTERN: RegExp;
+/**
+ * couchdb 用户文档 id 前缀（npm login/adduser 协议约定）
+ */
+declare const COUCHDB_USER_ID_PREFIX = "org.couchdb.user:";
+/**
+ * 包名标识（scoped 形态 `%2F` 转义在路由层解码后进入本契约）
+ */
+declare const PackageIdentifierSchema: z.ZodString;
+/**
+ * 语义化版本字符串
+ */
+declare const SemverSchema: z.ZodString;
+/**
+ * 版本 dist 元数据（tarball 为服务时动态注入的 wire 字段，落盘不持久化）
+ */
+declare const DistMetaSchema: z.ZodObject<{
+  shasum: z.ZodOptional<z.ZodString>;
+  integrity: z.ZodOptional<z.ZodString>;
+  tarball: z.ZodOptional<z.ZodString>;
+  fileCount: z.ZodOptional<z.ZodNumber>;
+  unpackedSize: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * 单版本 manifest（npm packument `versions[v]` 条目；客户端 manifest 字段全量透传，此处只约束必需键）
+ */
+declare const VersionManifestSchema: z.ZodObject<{
+  name: z.ZodString;
+  version: z.ZodString;
+  dist: z.ZodObject<{
+    shasum: z.ZodOptional<z.ZodString>;
+    integrity: z.ZodOptional<z.ZodString>;
+    tarball: z.ZodOptional<z.ZodString>;
+    fileCount: z.ZodOptional<z.ZodNumber>;
+    unpackedSize: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>;
+}, z.core.$loose>;
+/**
+ * dist-tag 映射（tag → 版本号）
+ */
+declare const DistTagMapSchema: z.ZodRecord<z.ZodString, z.ZodString>;
+/**
+ * packument（`GET /:package` 响应/落盘形状；落盘不含 dist.tarball 绝对地址）
+ */
+declare const PackumentSchema: z.ZodObject<{
+  _id: z.ZodString;
+  _rev: z.ZodOptional<z.ZodString>;
+  name: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+  'dist-tags': z.ZodRecord<z.ZodString, z.ZodString>;
+  versions: z.ZodRecord<z.ZodString, z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    dist: z.ZodObject<{
+      shasum: z.ZodOptional<z.ZodString>;
+      integrity: z.ZodOptional<z.ZodString>;
+      tarball: z.ZodOptional<z.ZodString>;
+      fileCount: z.ZodOptional<z.ZodNumber>;
+      unpackedSize: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+  }, z.core.$loose>>;
+  time: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  maintainers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+  }, z.core.$loose>>>;
+  readme: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+/**
+ * publish 附件（`_attachments` 条目；data 为 base64 tarball）
+ */
+declare const PublishAttachmentSchema: z.ZodObject<{
+  content_type: z.ZodString;
+  data: z.ZodString;
+  length: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * publish 请求载荷（`PUT /:package` 请求体；versions 仅含本次新版本）
+ */
+declare const PublishPayloadSchema: z.ZodObject<{
+  _id: z.ZodOptional<z.ZodString>;
+  name: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+  'dist-tags': z.ZodRecord<z.ZodString, z.ZodString>;
+  versions: z.ZodRecord<z.ZodString, z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    dist: z.ZodObject<{
+      shasum: z.ZodOptional<z.ZodString>;
+      integrity: z.ZodOptional<z.ZodString>;
+      tarball: z.ZodOptional<z.ZodString>;
+      fileCount: z.ZodOptional<z.ZodNumber>;
+      unpackedSize: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+  }, z.core.$loose>>;
+  access: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+    public: "public";
+    restricted: "restricted";
+  }>>>;
+  readme: z.ZodOptional<z.ZodString>;
+  _attachments: z.ZodRecord<z.ZodString, z.ZodObject<{
+    content_type: z.ZodString;
+    data: z.ZodString;
+    length: z.ZodNumber;
+  }, z.core.$strip>>;
+  maintainers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+  }, z.core.$loose>>>;
+}, z.core.$loose>;
+/**
+ * publish 成功响应（npm 约定形状）
+ */
+declare const PublishResponseSchema: z.ZodObject<{
+  ok: z.ZodLiteral<true>;
+  rev: z.ZodString;
+  id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * whoami 响应（`GET /-/whoami`）
+ */
+declare const WhoamiResponseSchema: z.ZodObject<{
+  username: z.ZodString;
+}, z.core.$strip>;
+/**
+ * couchdb 用户文档载荷（`PUT /-/user/org.couchdb.user::username` 请求体，npm adduser/login）
+ */
+declare const CouchUserPayloadSchema: z.ZodObject<{
+  _id: z.ZodOptional<z.ZodString>;
+  name: z.ZodString;
+  password: z.ZodString;
+  email: z.ZodOptional<z.ZodEmail>;
+  type: z.ZodOptional<z.ZodLiteral<"user">>;
+  roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  date: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+/**
+ * npm 协议错误响应（`{"error":"…"}` 裸形状）
+ */
+declare const NpmErrorResponseSchema: z.ZodObject<{
+  error: z.ZodString;
+}, z.core.$strip>;
+/**
+ * couchdb 用户文档载荷形态
+ */
+type CouchUserPayload = z.infer<typeof CouchUserPayloadSchema>;
+/**
+ * 版本 dist 元数据形态
+ */
+type DistMeta = z.infer<typeof DistMetaSchema>;
+/**
+ * dist-tag 映射形态
+ */
+type DistTagMap = z.infer<typeof DistTagMapSchema>;
+/**
+ * npm 协议错误响应形态
+ */
+type NpmErrorResponse = z.infer<typeof NpmErrorResponseSchema>;
+/**
+ * packument 形态
+ */
+type Packument = z.infer<typeof PackumentSchema>;
+/**
+ * 包名标识形态
+ */
+type PackageIdentifier = z.infer<typeof PackageIdentifierSchema>;
+/**
+ * publish 附件形态
+ */
+type PublishAttachment = z.infer<typeof PublishAttachmentSchema>;
+/**
+ * publish 载荷形态
+ */
+type PublishPayload = z.infer<typeof PublishPayloadSchema>;
+/**
+ * publish 成功响应形态
+ */
+type PublishResponse = z.infer<typeof PublishResponseSchema>;
+/**
+ * 语义化版本形态
+ */
+type Semver = z.infer<typeof SemverSchema>;
+/**
+ * 版本 manifest 形态
+ */
+type VersionManifest = z.infer<typeof VersionManifestSchema>;
+/**
+ * whoami 响应形态
+ */
+type WhoamiResponse = z.infer<typeof WhoamiResponseSchema>;
+//#endregion
+//#region src/contracts/store.schema.d.ts
+/**
+ * 本地 token 前缀（签发明文形态 `lzi_local_<随机>`；存储只落 sha256 哈希）
+ */
+declare const TOKEN_PREFIX = "lzi_local_";
+/**
+ * auth store 结构版本（结构不兼容演进时递增并迁移）
+ */
+declare const AUTH_STORE_VERSION = 1;
+/**
+ * 口令哈希记录（sha256(salt + password) 盐渍单轮——本机回环单用户威胁模型下的务实取舍）
+ */
+declare const PasswordRecordSchema: z.ZodObject<{
+  salt: z.ZodString;
+  hash: z.ZodString;
+}, z.core.$strip>;
+/**
+ * token 记录（明文永不落盘；id 为独立随机 8 位十六进制供人识别与吊销定位）
+ */
+declare const TokenRecordSchema: z.ZodObject<{
+  id: z.ZodString;
+  username: z.ZodString;
+  tokenHash: z.ZodString;
+  note: z.ZodOptional<z.ZodString>;
+  createdAt: z.ZodString;
+  revokedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * auth store（`<DATA_ROOT>/auth.json` 落盘形状）
+ */
+declare const AuthStoreSchema: z.ZodObject<{
+  version: z.ZodLiteral<1>;
+  users: z.ZodRecord<z.ZodString, z.ZodObject<{
+    password: z.ZodObject<{
+      salt: z.ZodString;
+      hash: z.ZodString;
+    }, z.core.$strip>;
+  }, z.core.$strip>>;
+  tokens: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    username: z.ZodString;
+    tokenHash: z.ZodString;
+    note: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodString;
+    revokedAt: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * token 签发结果 DTO（明文仅此一次返回）
+ */
+declare const TokenCreateInfoSchema: z.ZodObject<{
+  id: z.ZodString;
+  token: z.ZodString;
+  note: z.ZodOptional<z.ZodString>;
+  createdAt: z.ZodString;
+}, z.core.$strip>;
+/**
+ * token 信息 DTO（不含明文）
+ */
+declare const TokenInfoSchema: z.ZodObject<{
+  id: z.ZodString;
+  note: z.ZodOptional<z.ZodString>;
+  createdAt: z.ZodString;
+  revoked: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * auth store 形态
+ */
+type AuthStore = z.infer<typeof AuthStoreSchema>;
+/**
+ * 口令哈希记录形态
+ */
+type PasswordRecord = z.infer<typeof PasswordRecordSchema>;
+/**
+ * token 签发结果 DTO 形态
+ */
+type TokenCreateInfo = z.infer<typeof TokenCreateInfoSchema>;
+/**
+ * token 信息 DTO 形态
+ */
+type TokenInfo = z.infer<typeof TokenInfoSchema>;
+/**
+ * token 记录形态
+ */
+type TokenRecord = z.infer<typeof TokenRecordSchema>;
+//#endregion
+//#region src/auth.store.d.ts
+/**
+ * auth store 工厂参数
+ */
+type AuthStoreOptions = {
+  /**
+   * 集中数据根（auth.json 所在）
+   */
+  dataRoot: string;
+};
+/**
+ * auth store 句柄
+ */
+type AuthStoreHandle = {
+  /**
+   * 建户（单本地用户语义：已有任一用户即拒绝）
+   *
+   * @param username - 用户名
+   * @param password - 口令明文（仅此刻参与运算，绝不落盘）
+   * @throws {@link UserAlreadyExistsError} 已存在本地用户时
+   */
+  createUser(username: string, password: string): void;
+  /**
+   * 校验口令
+   *
+   * @param username - 用户名
+   * @param password - 口令明文
+   * @throws {@link InvalidCredentialsError} 用户不存在或口令不符时
+   */
+  verifyPassword(username: string, password: string): void;
+  /**
+   * 读取本地用户名（无用户返回 null——首启未 adduser 状态）
+   *
+   * @returns 用户名或 null
+   */
+  getUserName(): string | null;
+  /**
+   * 签发 token（绑定既有用户）
+   *
+   * @param username - 绑定用户名（须已建户）
+   * @param note - 用途备注（可空）
+   * @returns 签发结果（明文仅此一次）
+   * @throws {@link InvalidCredentialsError} 用户不存在时
+   */
+  issueToken(username: string, note?: string): TokenCreateInfo;
+  /**
+   * token 列表（不含明文）
+   *
+   * @returns token 信息数组
+   */
+  listTokens(): TokenInfo[];
+  /**
+   * 按 id 吊销 token
+   *
+   * @param id - token 短标识
+   * @returns 命中并吊销返回 true
+   */
+  revokeToken(id: string): boolean;
+  /**
+   * 校验 Bearer token（已吊销/未知均拒）
+   *
+   * @param token - token 明文
+   * @returns 绑定用户名
+   * @throws {@link TokenInvalidError} 无效或已吊销时
+   */
+  verifyToken(token: string): string;
+};
+/**
+ * 创建 auth store（惰性读、变更即原子写回）
+ *
+ * @param options - 工厂参数
+ * @returns auth store 句柄
+ */
+declare function createAuthStore(options: AuthStoreOptions): AuthStoreHandle;
+//#endregion
+//#region src/errors.d.ts
+/**
+ * 包不存在（→ 404）
+ */
+declare class PackageNotFoundError extends DomainError {
+  /**
+   * 创建包不存在错误
+   *
+   * @param name - 包名
+   */
+  constructor(name: string);
+}
+/**
+ * 包版本不存在（→ 404）
+ */
+declare class PackageVersionNotFoundError extends DomainError {
+  /**
+   * 创建包版本不存在错误
+   *
+   * @param name - 包名
+   * @param version - 版本号
+   */
+  constructor(name: string, version: string);
+}
+/**
+ * 版本已存在——publish 不可变纪律（→ 409）
+ */
+declare class VersionExistsError extends DomainError {
+  /**
+   * 创建版本已存在错误
+   *
+   * @param name - 包名
+   * @param version - 版本号
+   */
+  constructor(name: string, version: string);
+}
+/**
+ * 修订号不匹配——unpublish 乐观并发守卫（→ 409）
+ */
+declare class RevisionMismatchError extends DomainError {
+  /**
+   * 创建修订号不匹配错误
+   *
+   * @param name - 包名
+   * @param expected - 客户端携带的 _rev
+   * @param actual - 存储当前 _rev
+   */
+  constructor(name: string, expected: string, actual: string);
+}
+/**
+ * publish 载荷不合法（→ 400）
+ */
+declare class PublishPayloadError extends DomainError {
+  /**
+   * 创建 publish 载荷错误
+   *
+   * @param reason - 具体原因（人读中文）
+   */
+  constructor(reason: string);
+}
+/**
+ * npm 协议请求载荷不合法（非 publish 场景，如 adduser/dist-tags，→ 400）
+ */
+declare class ProtocolPayloadError extends DomainError {
+  /**
+   * 创建协议载荷错误
+   *
+   * @param kind - 载荷场景（如 adduser / dist-tags）
+   * @param reason - 具体原因（人读中文）
+   */
+  constructor(kind: string, reason: string);
+}
+/**
+ * 附件 shasum 与声明不符（→ 400）
+ */
+declare class ShasumMismatchError extends DomainError {
+  /**
+   * 创建 shasum 不符错误
+   *
+   * @param name - 包名
+   * @param version - 版本号
+   * @param declared - 载荷声明值
+   * @param actual - 附件实测值
+   */
+  constructor(name: string, version: string, declared: string, actual: string);
+}
+/**
+ * 包名不在允许 scope 内（→ 403，防误当通用 registry）
+ */
+declare class ScopeNotAllowedError extends DomainError {
+  /**
+   * 创建 scope 不允许错误
+   *
+   * @param name - 包名
+   */
+  constructor(name: string);
+}
+/**
+ * token 无效或已吊销（→ 401）
+ */
+declare class TokenInvalidError extends DomainError {
+  /**
+   * 创建 token 无效错误
+   */
+  constructor();
+}
+/**
+ * 本地用户已存在（单本地用户语义，→ 409）
+ */
+declare class UserAlreadyExistsError extends DomainError {
+  /**
+   * 创建用户已存在错误
+   *
+   * @param name - 已存在的用户名
+   */
+  constructor(name: string);
+}
+/**
+ * 用户名或口令错误（→ 401）
+ */
+declare class InvalidCredentialsError extends DomainError {
+  /**
+   * 创建凭据错误
+   */
+  constructor();
+}
+//#endregion
+//#region src/package.operations.d.ts
+/**
+ * publish 结果
+ */
+type PublishResult = {
+  /**
+   * 发布后修订号
+   */
+  rev: string;
+  /**
+   * 本次发布版本号
+   */
+  version: string;
+};
+/**
+ * unpublish 结果
+ */
+type UnpublishResult = {
+  /**
+   * 操作后修订号（整包移除时为末次修订号）
+   */
+  rev: string;
+};
+//#endregion
+//#region src/registry.engine.d.ts
+/**
+ * 引擎工厂参数
+ */
+type LocalNpmRegistryOptions = {
+  /**
+   * 集中数据根
+   */
+  dataRoot: string;
+  /**
+   * 允许发布的包名正则（null = 不设防；缺省 null）
+   */
+  allowPublish?: RegExp | null;
+};
+/**
+ * 引擎句柄
+ */
+type LocalNpmRegistry = {
+  /**
+   * 初始化目录布局（幂等：store/ + run/）
+   */
+  ensureLayout(): void;
+  /**
+   * 读取落盘 packument（不含 tarball 注入；未托管返回 null）
+   *
+   * @param name - 包名
+   * @returns packument 或 null
+   */
+  readPackument(name: string): Packument | null;
+  /**
+   * 读取单版本 manifest（versionOrTag 可为版本号或 dist-tag 名）
+   *
+   * @param name - 包名
+   * @param versionOrTag - 版本号或 tag
+   * @returns manifest 或 null
+   */
+  readManifest(name: string, versionOrTag: string): VersionManifest | null;
+  /**
+   * 读取 tarball 字节
+   *
+   * @param name - 包名
+   * @param version - 版本号
+   * @returns 字节内容或 null
+   */
+  readTarball(name: string, version: string): Uint8Array | null;
+  /**
+   * 读取 dist-tag 映射
+   *
+   * @param name - 包名
+   * @returns 映射或 null
+   */
+  readDistTags(name: string): DistTagMap | null;
+  /**
+   * 发布新版本（载荷校验 / shasum 实测 / 附件落盘 / packument 合并）
+   *
+   * @param payload - npm publish 请求体
+   * @param actor - 发布者身份（maintainers 缺省来源）
+   * @returns 发布结果
+   * @throws {@link PublishPayloadError} 载荷不合法（400）
+   * @throws {@link ScopeNotAllowedError} 包名不在允许 scope（403）
+   * @throws {@link ShasumMismatchError} 附件哈希不符（400）
+   * @throws {@link VersionExistsError} 版本已存在（409）
+   */
+  publish(payload: unknown, actor: string): PublishResult;
+  /**
+   * 下线单版本（rev 乐观并发校验；最后一个版本下线即整包移除）
+   *
+   * @param name - 包名
+   * @param version - 版本号
+   * @param rev - 客户端携带的 _rev
+   * @returns 操作结果
+   * @throws {@link PackageNotFoundError} 包不存在（404）
+   * @throws {@link RevisionMismatchError} 修订号不匹配（409）
+   * @throws {@link PackageVersionNotFoundError} 版本不存在（404）
+   */
+  unpublishVersion(name: string, version: string, rev: string): UnpublishResult;
+  /**
+   * 整包下线（rev 校验后移除目录）
+   *
+   * @param name - 包名
+   * @param rev - 客户端携带的 _rev
+   * @returns 操作结果（末次修订号）
+   * @throws {@link PackageNotFoundError} 包不存在（404）
+   * @throws {@link RevisionMismatchError} 修订号不匹配（409）
+   */
+  unpublishPackage(name: string, rev: string): UnpublishResult;
+  /**
+   * 整体替换 dist-tags（PUT 语义；指向的版本必须存在）
+   *
+   * @param name - 包名
+   * @param tags - 新映射
+   * @throws {@link PackageNotFoundError} 包不存在（404）
+   * @throws {@link PackageVersionNotFoundError} 指向版本不存在（404）
+   */
+  replaceDistTags(name: string, tags: DistTagMap): void;
+  /**
+   * 增改单个 dist-tag（POST 语义）
+   *
+   * @param name - 包名
+   * @param tag - tag 名
+   * @param version - 指向版本
+   * @throws {@link PackageNotFoundError} 包不存在（404）
+   * @throws {@link PackageVersionNotFoundError} 指向版本不存在（404）
+   */
+  addDistTag(name: string, tag: string, version: string): void;
+  /**
+   * 删除单个 dist-tag（DELETE 语义）
+   *
+   * @param name - 包名
+   * @param tag - tag 名
+   * @returns 命中删除返回 true
+   */
+  removeDistTag(name: string, tag: string): boolean;
+  /**
+   * 本地包摘要列表（按名排序）
+   *
+   * @returns 摘要数组
+   */
+  listPackages(): PackageSummary[];
+  /**
+   * 本地包计数
+   *
+   * @returns 包数
+   */
+  countPackages(): number;
+};
+/**
+ * 创建本地 registry 引擎
+ *
+ * @param options - 工厂参数
+ * @returns 引擎句柄
+ */
+declare function createLocalNpmRegistry(options: LocalNpmRegistryOptions): LocalNpmRegistry;
+//#endregion
+//#region src/store.utils.d.ts
+/**
+ * 存储布局与基础工具：目录布局 / 转义命名 / 原子写 / 哈希 / 语义化版本比较 / 修订号。
+ *
+ * 布局（<DATA_ROOT>）：
+ *   store/<escaped>/{index.json, tarballs/<basename>-<version>.tgz}
+ *   auth.json
+ *   run/（daemon 运行态）
+ *
+ * 原子写沿用工作区惯例：tmp（pid 后缀）+ rename。
+ */
+/**
+ * 构造包存储目录路径
+ *
+ * @param dataRoot - 集中数据根
+ * @param name - 包名（原始形态，含 scope）
+ * @returns store/<escaped> 绝对路径
+ */
+declare function packageDirPath(dataRoot: string, name: string): string;
+/**
+ * 构造 packument 落盘路径
+ *
+ * @param dataRoot - 集中数据根
+ * @param name - 包名
+ * @returns index.json 绝对路径
+ */
+declare function packumentPath(dataRoot: string, name: string): string;
+/**
+ * 构造 tarball 落盘路径
+ *
+ * @param dataRoot - 集中数据根
+ * @param name - 包名
+ * @param version - 版本号
+ * @returns tarball 绝对路径
+ */
+declare function tarballPath(dataRoot: string, name: string, version: string): string;
+/**
+ * 包名 → 目录名转义（scoped 的 `/` → `%2f`，对齐 npm 生态惯例）
+ *
+ * @param name - 包名
+ * @returns 转义后的目录名
+ */
+declare function escapePackageName(name: string): string;
+/**
+ * 目录名 → 包名还原
+ *
+ * @param escaped - 转义后的目录名
+ * @returns 原始包名
+ */
+declare function unescapePackageName(escaped: string): string;
+/**
+ * tarball 文件名（scoped 取 basename；`<basename>-<version>.tgz`）
+ *
+ * @param name - 包名
+ * @param version - 版本号
+ * @returns tarball 文件名
+ */
+declare function tarballFileName(name: string, version: string): string;
+/**
+ * 原子写 JSON（tmp + rename；tmp 带 pid 后缀防并发碰撞）
+ *
+ * @param filePath - 目标路径
+ * @param value - 可 JSON 序列化的值
+ */
+declare function atomicWriteJson(filePath: string, value: unknown): void;
+/**
+ * 原子写二进制（tmp + rename；tmp 带 pid 后缀防并发碰撞）
+ *
+ * @param filePath - 目标路径
+ * @param bytes - 字节内容
+ */
+declare function atomicWriteBytes(filePath: string, bytes: Uint8Array): void;
+/**
+ * sha1 十六进制（tarball shasum 校验/生成）
+ *
+ * @param bytes - 输入字节
+ * @returns 40 位十六进制摘要
+ */
+declare function sha1Hex(bytes: Uint8Array): string;
+/**
+ * sha256 十六进制（口令/token 哈希）
+ *
+ * @param input - 输入文本
+ * @returns 64 位十六进制摘要
+ */
+declare function sha256Hex(input: string): string;
+/**
+ * 当前时刻 ISO 文本
+ *
+ * @returns ISO 8601 文本
+ */
+declare function nowIso(): string;
+/**
+ * 语义化版本比较（忽略 build 后缀；prerelease 按点分段数值/词典序，无 prerelease > 有）
+ *
+ * @param a - 版本甲
+ * @param b - 版本乙
+ * @returns 负数甲旧 / 0 相等 / 正数甲新
+ */
+declare function compareSemver(a: string, b: string): number;
+/**
+ * 下一修订号（`N-hash`：计数 +1，hash 取随机 8 位十六进制；缺省计数按 0 起）
+ *
+ * @param current - 当前修订号（可选——透传可选语义下可能缺省）
+ * @returns 新修订号
+ */
+declare function nextRevision(current: string | undefined): string;
+//#endregion
+export { AUTH_STORE_VERSION, type AuthStore, type AuthStoreHandle, type AuthStoreOptions, AuthStoreSchema, COUCHDB_USER_ID_PREFIX, type CouchUserPayload, CouchUserPayloadSchema, DIST_TAG_PATTERN, type DistMeta, DistMetaSchema, type DistTagMap, DistTagMapSchema, InvalidCredentialsError, type LocalNpmRegistry, type LocalNpmRegistryOptions, type NpmErrorResponse, NpmErrorResponseSchema, PACKAGE_NAME_PATTERN, type PackageDetail, PackageDetailSchema, type PackageIdentifier, PackageIdentifierSchema, PackageNotFoundError, type PackageSummary, PackageSummarySchema, PackageVersionNotFoundError, type Packument, PackumentSchema, type PasswordRecord, PasswordRecordSchema, ProtocolPayloadError, type PublishAttachment, PublishAttachmentSchema, type PublishPayload, PublishPayloadError, PublishPayloadSchema, type PublishResponse, PublishResponseSchema, type PublishResult, RevisionMismatchError, SEMVER_PATTERN, ScopeNotAllowedError, type Semver, SemverSchema, ShasumMismatchError, TOKEN_PREFIX, type TokenCreateInfo, TokenCreateInfoSchema, type TokenInfo, TokenInfoSchema, TokenInvalidError, type TokenRecord, TokenRecordSchema, type UnpublishResult, UserAlreadyExistsError, VersionExistsError, type VersionManifest, VersionManifestSchema, type WhoamiResponse, WhoamiResponseSchema, atomicWriteBytes, atomicWriteJson, compareSemver, createAuthStore, createLocalNpmRegistry, escapePackageName, nextRevision, nowIso, packageDirPath, packumentPath, sha1Hex, sha256Hex, tarballFileName, tarballPath, unescapePackageName };

package/dist/index.js

@@ -0,0 +1 @@
+import"./rolldown-runtime-BqT_7tdF.js";import*as e from"zod";import{existsSync as t,mkdirSync as n,readFileSync as r,readdirSync as i,renameSync as a,rmSync as o,unlinkSync as s,writeFileSync as c}from"node:fs";import{join as l}from"node:path";import{DomainError as u}from"@longzai-intelligence-error/core";import{createHash as d,randomBytes as f}from"node:crypto";const p=/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/,m=/^\d+\.\d+\.\d+(-[0-9A-Za-z-.+]+)?(\+[0-9A-Za-z-.]+)?$/,h=/^[a-z][a-z0-9-._]*$/i,g=`org.couchdb.user:`,_=e.string().regex(p),v=e.string().regex(m),y=e.object({shasum:e.string().regex(/^[0-9a-f]{40}$/).optional(),integrity:e.string().optional(),tarball:e.string().url().optional(),fileCount:e.number().int().nonnegative().optional(),unpackedSize:e.number().int().nonnegative().optional()}),b=e.looseObject({name:_,version:v,dist:y}),x=e.record(e.string().regex(h),v),S=e.looseObject({_id:_,_rev:e.string().regex(/^\d+-[0-9a-f]+$/).optional(),name:_,description:e.string().optional(),"dist-tags":x,versions:e.record(v,b),time:e.record(e.string(),e.string()).optional(),maintainers:e.array(e.looseObject({name:e.string(),email:e.string().optional()})).optional(),readme:e.string().optional()}),C=e.object({content_type:e.string(),data:e.string(),length:e.number().int().nonnegative()}),w=e.looseObject({_id:_.optional(),name:_,description:e.string().optional(),"dist-tags":x,versions:e.record(v,b).refine(e=>Object.keys(e).length>=1,{error:`publish 载荷 versions 至少含一个新版本`}),access:e.enum([`public`,`restricted`]).nullish(),readme:e.string().optional(),_attachments:e.record(e.string(),C).refine(e=>Object.keys(e).length>=1,{error:`publish 载荷 _attachments 至少含一个 tarball`}),maintainers:e.array(e.looseObject({name:e.string(),email:e.string().optional()})).optional()}).refine(e=>e._id===void 0||e._id===e.name,{error:`publish 载荷 _id 与 name 不一致`,path:[`_id`]}),ee=e.object({ok:e.literal(!0),rev:e.string(),id:e.string().optional()}),te=e.object({username:e.string().min(1)}),ne=e.looseObject({_id:e.string().optional(),name:e.string().min(1).regex(/^[a-z][a-z0-9-]*$/i,{error:`用户名仅允许字母数字与中划线`}),password:e.string().min(1),email:e.email().optional(),type:e.literal(`user`).optional(),roles:e.array(e.string()).optional(),date:e.string().optional()}),re=e.object({error:e.string()}),ie=e.object({name:_,versionCount:e.number().int().positive(),latest:v.optional(),modified:e.string().datetime().optional()}),ae=e.object({name:_,versionCount:e.number().int().positive(),latest:v.optional(),modified:e.string().datetime().optional(),distTags:x,versions:e.array(v)}),T=`lzi_local_`,oe=1,E=e.object({salt:e.string().regex(/^[0-9a-f]{32}$/),hash:e.string().regex(/^[0-9a-f]{64}$/)}),D=e.object({id:e.string().regex(/^[0-9a-f]{8}$/),username:e.string().min(1),tokenHash:e.string().regex(/^[0-9a-f]{64}$/),note:e.string().optional(),createdAt:e.string().datetime(),revokedAt:e.string().datetime().optional()}),O=e.object({version:e.literal(1),users:e.record(e.string(),e.object({password:E})),tokens:e.array(D)}),se=e.object({id:e.string().regex(/^[0-9a-f]{8}$/),token:e.string(),note:e.string().optional(),createdAt:e.string().datetime()}),ce=e.object({id:e.string().regex(/^[0-9a-f]{8}$/),note:e.string().optional(),createdAt:e.string().datetime(),revoked:e.boolean()});var k=class extends u{constructor(e){super(`包不存在: ${e}`,`NPM_REGISTRY_PACKAGE_NOT_FOUND`,{name:e}),this.name=`PackageNotFoundError`}},A=class extends u{constructor(e,t){super(`包版本不存在: ${e}@${t}`,`NPM_REGISTRY_PACKAGE_VERSION_NOT_FOUND`,{name:e,version:t}),this.name=`PackageVersionNotFoundError`}},j=class extends u{constructor(e,t){super(`版本已存在，npm 版本不可变: ${e}@${t}`,`NPM_REGISTRY_VERSION_EXISTS`,{name:e,version:t}),this.name=`VersionExistsError`}},M=class extends u{constructor(e,t,n){super(`修订号不匹配（携带 ${t}，当前 ${n}），请重新获取 packument`,`NPM_REGISTRY_REVISION_MISMATCH`,{name:e,expected:t,actual:n}),this.name=`RevisionMismatchError`}},N=class extends u{constructor(e){super(`publish 载荷不合法: ${e}`,`NPM_REGISTRY_PUBLISH_PAYLOAD_INVALID`,{reason:e}),this.name=`PublishPayloadError`}},le=class extends u{constructor(e,t){super(`${e} 载荷不合法: ${t}`,`NPM_REGISTRY_PROTOCOL_PAYLOAD_INVALID`,{kind:e,reason:t}),this.name=`ProtocolPayloadError`}},P=class extends u{constructor(e,t,n,r){super(`tarball shasum 不符（声明 ${n}，实测 ${r}）: ${e}@${t}`,`NPM_REGISTRY_SHASUM_MISMATCH`,{name:e,version:t,declared:n,actual:r}),this.name=`ShasumMismatchError`}},F=class extends u{constructor(e){super(`包名不在允许发布的 scope 内: ${e}`,`NPM_REGISTRY_SCOPE_NOT_ALLOWED`,{name:e}),this.name=`ScopeNotAllowedError`}},I=class extends u{constructor(){super(`token 无效或已吊销`,`NPM_REGISTRY_TOKEN_INVALID`,{}),this.name=`TokenInvalidError`}},L=class extends u{constructor(e){super(`本地用户已存在: ${e}`,`NPM_REGISTRY_USER_ALREADY_EXISTS`,{name:e}),this.name=`UserAlreadyExistsError`}},R=class extends u{constructor(){super(`用户名或口令错误`,`NPM_REGISTRY_INVALID_CREDENTIALS`,{}),this.name=`InvalidCredentialsError`}};function z(e,t){return l(e,`store`,H(t))}function B(e,t){return l(z(e,t),`index.json`)}function V(e,t,n){return l(z(e,t),`tarballs`,U(t,n))}function H(e){return e.replace(/\//g,`%2f`)}function ue(e){return e.replace(/%2f/g,`/`)}function U(e,t){return`${e.split(`/`).at(-1)??e}-${t}.tgz`}function W(e,t){let n=`${e}.${process.pid}.tmp`;c(n,`${JSON.stringify(t,null,2)}\n`,`utf8`),a(n,e)}function G(e,t){let n=`${e}.${process.pid}.tmp`;c(n,t),a(n,e)}function K(e){t(e)||n(e,{recursive:!0})}function q(e){return d(`sha1`).update(e).digest(`hex`)}function J(e){return d(`sha256`).update(e).digest(`hex`)}function Y(e){return f(e).toString(`hex`)}function X(){return(/* @__PURE__ */ new Date()).toISOString()}function Z(e){let[t=``]=e.split(`+`),[n=``,r]=t.split(`-`),[i=0,a=0,o=0]=n.split(`.`).map(e=>Number.parseInt(e,10));return{core:[i,a,o],pre:r===void 0?null:r.split(`.`)}}function Q(e,t){let n=Z(e),r=Z(t);for(let e=0;e<3;e++){let t=n.core[e]??0,i=r.core[e]??0;if(t!==i)return t-i}return n.pre===null&&r.pre===null?0:n.pre===null?1:r.pre===null?-1:de(n.pre,r.pre)}function de(e,t){let n=Math.min(e.length,t.length);for(let r=0;r<n;r++){let n=e[r]??``,i=t[r]??``,a=/^\d+$/.test(n),o=/^\d+$/.test(i);if(a&&o){let e=Number.parseInt(n,10)-Number.parseInt(i,10);if(e!==0)return e;continue}if(a)return-1;if(o)return 1;if(n!==i)return n<i?-1:1}return e.length-t.length}function $(e){return`${Number.parseInt(e?.split(`-`)[0]??`0`,10)+1}-${Y(4)}`}function fe(e){let n=l(e.dataRoot,`auth.json`),i=()=>{if(!t(n))return{version:1,users:{},tokens:[]};let e=O.safeParse(JSON.parse(r(n,`utf8`)));if(!e.success)throw Error(`[core] auth.json 不合法：${e.error.issues.map(e=>`${e.path.join(`.`)}: ${e.message}`).join(`; `)}`);return e.data},a=e=>{W(n,e)};return{createUser:(e,t)=>{let n=i(),r=Object.keys(n.users)[0];if(r!==void 0)throw new L(r);let o=Y(16);n.users[e]={password:{salt:o,hash:J(o+t)}},a(n)},verifyPassword:(e,t)=>{let n=i().users[e];if(n===void 0||J(n.password.salt+t)!==n.password.hash)throw new R},getUserName:()=>{let e=i(),t=Object.keys(e.users)[0];return t===void 0?null:t},issueToken:(e,t)=>{let n=i();if(n.users[e]===void 0)throw new R;let r=`${T}${Y(24)}`,o={id:Y(4),username:e,tokenHash:J(r),createdAt:X(),...t!==void 0&&t!==``?{note:t}:{}};return n.tokens.push(o),a(n),{id:o.id,token:r,createdAt:o.createdAt,...o.note===void 0?{}:{note:o.note}}},listTokens:()=>i().tokens.map(e=>({id:e.id,createdAt:e.createdAt,revoked:e.revokedAt!==void 0,...e.note===void 0?{}:{note:e.note}})),revokeToken:e=>{let t=i(),n=t.tokens.find(t=>t.id===e);return n===void 0||n.revokedAt!==void 0?!1:(n.revokedAt=X(),a(t),!0)},verifyToken:e=>{let t=i(),n=J(e),r=t.tokens.find(e=>e.tokenHash===n&&e.revokedAt===void 0);if(r===void 0)throw new I;return r.username}}}function pe(e,t,n){let r=w.safeParse(t);if(!r.success)throw new N(r.error.issues.map(e=>`${e.path.join(`.`)}: ${e.message}`).join(`; `));let i=r.data;if(e.allowPublish!==null&&!e.allowPublish.test(i.name))throw new F(i.name);let a=Object.keys(i.versions);if(a.length!==1)throw new N(`仅支持单版本发布，收到 ${a.length} 个`);let o=Object.keys(i._attachments);if(o.length!==1)throw new N(`仅支持单附件发布，收到 ${o.length} 个`);let s=a[0];if(s===void 0)throw new N(`versions 键缺失`);let c=i.versions[s];if(c===void 0)throw new N(`versions[${s}] manifest 缺失`);let u=o[0];if(u===void 0)throw new N(`_attachments 键缺失`);let d=i._attachments[u];if(d===void 0)throw new N(`_attachments[${u}] 附件缺失`);let f;try{f=new Uint8Array(Buffer.from(d.data,`base64`))}catch{throw new N(`附件 base64 解码失败`)}if(f.length!==d.length)throw new N(`附件长度不符（声明 ${d.length}，实测 ${f.length}）`);let p=q(f);if(c.dist.shasum!==void 0&&c.dist.shasum!==p)throw new P(i.name,s,c.dist.shasum,p);let m=e.readPackument(i.name)??{_id:i.name,_rev:`0-0`,name:i.name,"dist-tags":{},versions:{},time:{}};if(m.versions[s]!==void 0)throw new j(i.name,s);K(l(z(e.dataRoot,i.name),`tarballs`)),G(V(e.dataRoot,i.name,s),f);let h={...c,dist:{...c.dist,shasum:p}};delete h.dist.tarball,m.time??={};let g=X();m.versions[s]=h;for(let[e,t]of Object.entries(i[`dist-tags`]))m[`dist-tags`][e]=t;return m.time[s]=g,m.time.created??=g,m.time.modified=g,m.maintainers??=i.maintainers??[{name:n}],m.description=i.description??m.description,i.readme!==void 0&&(m.readme=i.readme),m._rev=$(m._rev),e.writePackument(m),{rev:m._rev??`0-0`,version:s}}function me(e,n,r,i){if(i.versions[r]===void 0)throw new A(n,r);let a=V(e.dataRoot,n,r);t(a)&&s(a),delete i.versions[r],i.time!==void 0&&delete i.time[r];for(let[e,t]of Object.entries(i[`dist-tags`]))t===r&&delete i[`dist-tags`][e];let c=Object.keys(i.versions);if(c.length===0){let t=$(i._rev);return o(z(e.dataRoot,n),{recursive:!0,force:!0}),{rev:t}}if(i[`dist-tags`].latest===void 0){let e=c[0];if(e!==void 0){let t=c.reduce((e,t)=>Q(t,e)>0?t:e,e);i[`dist-tags`].latest=t}}return i.time??={},i.time.modified=X(),i._rev=$(i._rev),e.writePackument(i),{rev:i._rev??`0-0`}}function he(e,t,n){let r=$(n._rev);return o(z(e.dataRoot,t),{recursive:!0,force:!0}),{rev:r}}function ge(e){let n=l(e.dataRoot,`store`),a=e.allowPublish??null,o=n=>{let i=B(e.dataRoot,n);if(!t(i))return null;let a=S.safeParse(JSON.parse(r(i,`utf8`)));return a.success?a.data:null},s=(e,t)=>{let n=o(e);if(n===null)throw new k(e);if(n._rev!==t)throw new M(e,t,n._rev??`0-0`);return n},c=t=>{K(z(e.dataRoot,t.name)),W(B(e.dataRoot,t.name),t)},u={dataRoot:e.dataRoot,allowPublish:a,readPackument:o,writePackument:c},d=()=>{K(n),K(l(e.dataRoot,`run`))},f=e=>o(e),p=(e,t)=>{let n=o(e);if(n===null)return null;let r=n[`dist-tags`][t]??t;return n.versions[r]??null},m=(n,i)=>{let a=V(e.dataRoot,n,i);return t(a)?new Uint8Array(r(a)):null},h=e=>{let t=o(e);return t===null?null:t[`dist-tags`]},g=(e,t)=>pe(u,e,t),_=(e,t,n)=>me(u,e,t,s(e,n)),v=(e,t)=>he(u,e,s(e,t)),y=(e,t)=>{let n=o(e);if(n===null)throw new k(e);for(let r of Object.values(t))if(n.versions[r]===void 0)throw new A(e,r);n[`dist-tags`]={...t},n.time??={},n.time.modified=X(),n._rev=$(n._rev),c(n)},b=(e,t,n)=>{let r=o(e);if(r===null)throw new k(e);if(r.versions[n]===void 0)throw new A(e,n);r[`dist-tags`][t]=n,r.time??={},r.time.modified=X(),r._rev=$(r._rev),c(r)},x=(e,t)=>{let n=o(e);return n===null||n[`dist-tags`][t]===void 0?!1:(delete n[`dist-tags`][t],n.time??={},n.time.modified=X(),n._rev=$(n._rev),c(n),!0)},C=()=>{if(!t(n))return[];let e=[];for(let t of i(n,{withFileTypes:!0})){if(!t.isDirectory())continue;let n=t.name.replace(/%2f/g,`/`),r=o(n);r!==null&&e.push({name:n,versionCount:Object.keys(r.versions).length,...r[`dist-tags`].latest===void 0?{}:{latest:r[`dist-tags`].latest},...r.time?.modified===void 0?{}:{modified:r.time.modified}})}return e.sort((e,t)=>e.name<t.name?-1:+(e.name>t.name))};return{ensureLayout:d,readPackument:f,readManifest:p,readTarball:m,readDistTags:h,publish:g,unpublishVersion:_,unpublishPackage:v,replaceDistTags:y,addDistTag:b,removeDistTag:x,listPackages:C,countPackages:()=>C().length}}export{oe as AUTH_STORE_VERSION,O as AuthStoreSchema,g as COUCHDB_USER_ID_PREFIX,ne as CouchUserPayloadSchema,h as DIST_TAG_PATTERN,y as DistMetaSchema,x as DistTagMapSchema,R as InvalidCredentialsError,re as NpmErrorResponseSchema,p as PACKAGE_NAME_PATTERN,ae as PackageDetailSchema,_ as PackageIdentifierSchema,k as PackageNotFoundError,ie as PackageSummarySchema,A as PackageVersionNotFoundError,S as PackumentSchema,E as PasswordRecordSchema,le as ProtocolPayloadError,C as PublishAttachmentSchema,N as PublishPayloadError,w as PublishPayloadSchema,ee as PublishResponseSchema,M as RevisionMismatchError,m as SEMVER_PATTERN,F as ScopeNotAllowedError,v as SemverSchema,P as ShasumMismatchError,T as TOKEN_PREFIX,se as TokenCreateInfoSchema,ce as TokenInfoSchema,I as TokenInvalidError,D as TokenRecordSchema,L as UserAlreadyExistsError,j as VersionExistsError,b as VersionManifestSchema,te as WhoamiResponseSchema,G as atomicWriteBytes,W as atomicWriteJson,Q as compareSemver,fe as createAuthStore,ge as createLocalNpmRegistry,H as escapePackageName,$ as nextRevision,X as nowIso,z as packageDirPath,B as packumentPath,q as sha1Hex,J as sha256Hex,U as tarballFileName,V as tarballPath,ue as unescapePackageName};

package/dist/rolldown-runtime-BqT_7tdF.js

@@ -0,0 +1 @@
+import"node:module";export{};

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@longzai-intelligence-npm-registry/core",
+  "version": "0.0.1",
+  "description": "Longzai Intelligence 本地 npm registry 存储引擎与数据契约：npm 协议载荷 / publish 校验落盘 / dist-tags / unpublish / 单用户鉴权（零 HTTP、零上游感知）",
+  "license": "UNLICENSED",
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "lzi-builder",
+    "build:prod": "NODE_ENV=production bun run build",
+    "prepublishOnly": "bun run build:prod",
+    "typecheck": "bun run typecheck:app && bun run typecheck:node && bun run typecheck:test",
+    "typecheck:app": "lzi-tsgo typecheck tsconfig/app.json",
+    "typecheck:node": "lzi-tsgo typecheck tsconfig/node.json",
+    "typecheck:test": "lzi-tsgo typecheck tsconfig/test.json",
+    "lint": "oxlint && oxfmt --check",
+    "lint:fix": "oxlint --fix && oxfmt",
+    "test": "bun test",
+    "test:watch": "bun test --watch",
+    "test:coverage": "bun test --coverage",
+    "clean": "lzi-dev-cli clean"
+  },
+  "dependencies": {
+    "@longzai-intelligence-error/core": "^0.1.0",
+    "zod": "^4.4.3"
+  }
+}