@moewolf/moe-icons-cli 0.0.2 → 0.0.4

package/dist/core/free-download.d.ts

@@ -56,6 +56,7 @@ export type FreeDownloadSuccess = {
     readonly descriptor: ReleaseDescriptor;
     readonly descriptorSha256: string;
     readonly artifactBytes: Uint8Array;
+    readonly archiveFiles?: Readonly<Record<string, Uint8Array>>;
     readonly selected?: SelectedResourceDownload;
     readonly downloadNote?: string;
     readonly catalogJson: string;

package/dist/core/free-download.js

@@ -6,7 +6,7 @@ import { validateConfigDocument, } from "../project/config.js";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
 import { downloadArtifact, verifyArtifact } from "../project/install.js";
-import { decodeUtf8, extractTarGz, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES, } from "../project/tar-gz.js";
+import { decodeUtf8, extractTarGzAsync, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES, } from "../project/tar-gz.js";
 import { catalog as bundledCatalog } from "../catalog/catalog.js";
 import { cacheArtifact } from "./cache.js";
 import { extractAndVerifyMetadataArchive } from "../metadata/archive.js";
@@ -65,6 +65,8 @@ function mapDownloadError(code, message) {
     if (code === "HTTP_ERROR" && / 404$/.test(message)) {
         return { ok: false, reason: "not-found", message };
     }
+    if (code === "CANCELLED")
+        return { ok: false, reason: "cancelled", message };
     if (code === "NETWORK_ERROR")
         return { ok: false, reason: "network", message };
     return { ok: false, reason: "validation", message };
@@ -148,12 +150,14 @@ async function loadBytes(io, filename, limits, tag) {
         message: `download failed after ${MAX_DOWNLOAD_ATTEMPTS} attempts`,
     };
 }
-function catalogFromArchive(artifactBytes, catalogFilename, expectedSha) {
-    const unpacked = extractTarGz(artifactBytes, {
+async function catalogFromArchive(artifactBytes, catalogFilename, expectedSha, signal) {
+    const unpacked = await extractTarGzAsync(artifactBytes, {
         maxEntries: ICON_ARCHIVE_MAX_ENTRIES,
         maxExpandedBytes: ICON_ARCHIVE_MAX_EXPANDED_BYTES,
-    });
+    }, signal);
     if (unpacked.errors.length > 0) {
+        if (signal?.aborted)
+            return { ok: false, reason: "cancelled", message: "archive extraction cancelled" };
         return { ok: false, reason: "validation", message: unpacked.errors[0] ?? "extract failed" };
     }
     const catalogBytes = unpacked.files[catalogFilename] ?? unpacked.files[`./${catalogFilename}`];
@@ -168,7 +172,7 @@ function catalogFromArchive(artifactBytes, catalogFilename, expectedSha) {
             message: `catalog SHA-256 mismatch: expected ${expectedSha}, got ${actual}`,
         };
     }
-    return { ok: true, json: decodeUtf8(catalogBytes) };
+    return { ok: true, json: decodeUtf8(catalogBytes), files: unpacked.files };
 }
 /**
  * Download the small metadata archive, verify the whole-archive SHA-256 plus
@@ -489,7 +493,7 @@ export async function downloadFreeRelease(io, sourceVersion, selection) {
         const cached = io.readFileSync(artifactCache);
         const verified = verifyArtifact(cached, descriptor.free.sha256);
         if (verified.ok) {
-            const catalog = catalogFromArchive(cached, descriptor.catalog.filename, descriptor.catalog.sha256);
+            const catalog = await catalogFromArchive(cached, descriptor.catalog.filename, descriptor.catalog.sha256, io.signal);
             if (!catalog.ok)
                 return catalog;
             const metadata = preflightMetadata
@@ -503,6 +507,7 @@ export async function downloadFreeRelease(io, sourceVersion, selection) {
                 descriptorSha256,
                 artifactBytes: cached,
                 catalogJson: catalog.json,
+                archiveFiles: catalog.files,
                 cacheHit: true,
                 tag,
                 metadataSha256: metadata.value.metadataSha256,
@@ -533,7 +538,7 @@ export async function downloadFreeRelease(io, sourceVersion, selection) {
             message: `free artifact SHA-256 mismatch: expected ${descriptor.free.sha256}, got ${verified.actual}`,
         };
     }
-    const catalog = catalogFromArchive(artifact.bytes, descriptor.catalog.filename, descriptor.catalog.sha256);
+    const catalog = await catalogFromArchive(artifact.bytes, descriptor.catalog.filename, descriptor.catalog.sha256, io.signal);
     if (!catalog.ok)
         return catalog;
     const metadata = preflightMetadata
@@ -553,6 +558,7 @@ export async function downloadFreeRelease(io, sourceVersion, selection) {
         descriptorSha256,
         artifactBytes: artifact.bytes,
         catalogJson: catalog.json,
+        archiveFiles: catalog.files,
         cacheHit: false,
         tag,
         metadataSha256: metadata.value.metadataSha256,

package/dist/core/generate.d.ts

@@ -46,13 +46,13 @@ export declare function loadInstalledCatalog(projectRoot: string, fs_: Pick<Tran
  * Vanilla (and bitmap themes on react/vue) need the full cached archive so
  * `assets/` is available — the installed package subtree alone is not enough.
  */
-export declare function loadArchiveFiles(projectRoot: string, env: Readonly<Record<string, string | undefined>>, fs_: Pick<TransactionalFsWithCopy, "readFileSync" | "existsSync" | "readdirSync">, injected?: Readonly<Record<string, Uint8Array>>): {
+export declare function loadArchiveFiles(projectRoot: string, env: Readonly<Record<string, string | undefined>>, fs_: Pick<TransactionalFsWithCopy, "readFileSync" | "existsSync" | "readdirSync">, injected?: Readonly<Record<string, Uint8Array>>, signal?: AbortSignal): Promise<{
     readonly ok: true;
     readonly files: Readonly<Record<string, Uint8Array>>;
 } | {
     readonly ok: false;
     readonly reason: string;
-};
+}>;
 export declare function runGenerateUseCase(context: CommandContext, fs_: TransactionalFsWithCopy, options?: {
     readonly noTailwind?: boolean;
     readonly target?: Target;

package/dist/core/generate.js

@@ -8,7 +8,7 @@ import { toProxyName } from "./icon-names.js";
 import { planGeneratedFiles } from "../generator/generate.js";
 import { ensureClassMergeDependencies, planTailwindIntegration } from "../project/tailwind.js";
 import { isCliError } from "../errors/index.js";
-import { extractTarGz, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES, } from "../project/tar-gz.js";
+import { extractTarGzAsync, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES, } from "../project/tar-gz.js";
 import { artifactCachePath } from "./free-download.js";
 import { resolveThemes } from "../generator/theme-resolve.js";
 import { loadPinnedBitmapShardAssets } from "./bitmap-shard-resolver.js";
@@ -238,7 +238,7 @@ function mergePinnedBitmapShardAssets(archiveFiles, effectiveConfig, sourceCatal
  * Vanilla (and bitmap themes on react/vue) need the full cached archive so
  * `assets/` is available — the installed package subtree alone is not enough.
  */
-export function loadArchiveFiles(projectRoot, env, fs_, injected) {
+export async function loadArchiveFiles(projectRoot, env, fs_, injected, signal) {
     if (injected)
         return { ok: true, files: injected };
     const fixtureTgz = env.MOEICONS_BITMAP_ARCHIVE;
@@ -249,10 +249,10 @@ export function loadArchiveFiles(projectRoot, env, fs_, injected) {
         return { ok: false, reason: "MOEICONS_BITMAP_ARCHIVE is only honored in a local-test context" };
     }
     if (fixtureTgz && fs_.existsSync(fixtureTgz)) {
-        const unpacked = extractTarGz(readBinaryFile(fs_, fixtureTgz), {
+        const unpacked = await extractTarGzAsync(readBinaryFile(fs_, fixtureTgz), {
             maxEntries: ICON_ARCHIVE_MAX_ENTRIES,
             maxExpandedBytes: ICON_ARCHIVE_MAX_EXPANDED_BYTES,
-        });
+        }, signal);
         if (unpacked.errors.length > 0)
             return { ok: false, reason: unpacked.errors[0] ?? "invalid bitmap archive fixture" };
         return { ok: true, files: unpacked.files };
@@ -320,10 +320,10 @@ export function loadArchiveFiles(projectRoot, env, fs_, injected) {
     if (meta?.artifactVersion && meta.artifactSha256) {
         const cached = artifactCachePath(cacheDir, meta.artifactVersion, meta.artifactSha256);
         if (fs_.existsSync(cached)) {
-            const unpacked = extractTarGz(readBinaryFile(fs_, cached), {
+            const unpacked = await extractTarGzAsync(readBinaryFile(fs_, cached), {
                 maxEntries: ICON_ARCHIVE_MAX_ENTRIES,
                 maxExpandedBytes: ICON_ARCHIVE_MAX_EXPANDED_BYTES,
-            });
+            }, signal);
             if (unpacked.errors.length > 0)
                 return { ok: false, reason: unpacked.errors[0] ?? "invalid cached artifact" };
             return { ok: true, files: unpacked.files };
@@ -371,7 +371,7 @@ export async function runGenerateUseCase(context, fs_, options = {}) {
     }
     let archiveFiles = options.archiveFiles;
     if (needsArchiveFiles(effectiveConfig, sourceCatalog) && archiveFiles === undefined) {
-        const loadedArchive = loadArchiveFiles(project.root, context.env, fs_, undefined);
+        const loadedArchive = await loadArchiveFiles(project.root, context.env, fs_, undefined, context.signal);
         if (!loadedArchive.ok) {
             return {
                 ok: false,

package/dist/core/install.js

@@ -6,7 +6,7 @@ import { CliError, isCliError } from "../errors/index.js";
 import { bundledSourceVersion, downloadFreeRelease } from "./free-download.js";
 import { serializeInstallMetadata, sha256Bytes } from "../project/install-metadata.js";
 import { withProjectLock } from "../project/project-lock.js";
-import { configuredComponentFiles, selectTargetSubtree, computeSubtreeHash, } from "./target-subtree.js";
+import { configuredComponentFiles, selectTargetSubtreeAsync, selectTargetSubtreeFromFiles, computeSubtreeHash, } from "./target-subtree.js";
 import { parseCatalog } from "../catalog/catalog.js";
 import { posix } from "node:path";
 /**
@@ -118,7 +118,9 @@ export async function runInstallUseCase(context, deps, options) {
         : undefined;
     const subtree = selectedTarget
         ? { ok: true, target, files: selectedTarget, ...computeSubtreeHash(selectedTarget) }
-        : selectTargetSubtree(downloaded.artifactBytes, downloaded.descriptor.free, target);
+        : downloaded.archiveFiles
+            ? selectTargetSubtreeFromFiles(downloaded.archiveFiles, downloaded.descriptor.free, target)
+            : await selectTargetSubtreeAsync(downloaded.artifactBytes, downloaded.descriptor.free, target, context.signal);
     if (!subtree.ok) {
         return subtree.reason === "checksum-mismatch"
             ? { ok: false, reason: "checksum-mismatch", message: subtree.message }

package/dist/core/library-update.js

@@ -10,14 +10,14 @@ import { executeManagedReconcile } from "../project/install.js";
 import { parseInstallMetadata, serializeInstallMetadata, sha256Bytes, } from "../project/install-metadata.js";
 import { withProjectLock } from "../project/project-lock.js";
 import { ensureClassMergeDependencies, planTailwindIntegration } from "../project/tailwind.js";
-import { extractTarGz, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES, } from "../project/tar-gz.js";
+import { extractTarGzAsync, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES, } from "../project/tar-gz.js";
 import { artifactCachePath, downloadFreeRelease, metadataCachePath, } from "./free-download.js";
 import { downloadProArtifact } from "./pro-download.js";
 import { PRO_DOWNLOAD_HOSTS, resolveProDescriptorEndpoint } from "./pro-download.js";
 import { runAccessTokenUseCase } from "./auth.js";
 import { resolveBitmapTuples, resolveConfiguredBitmapShards } from "./bitmap-shard-resolver.js";
 import { mergeBitmapShardCacheManifest, readBitmapShardCacheManifest, writeBitmapShardCacheManifest, } from "./bitmap-shard-cache.js";
-import { configuredComponentFiles, selectTargetSubtree, computeSubtreeHash, } from "./target-subtree.js";
+import { configuredComponentFiles, selectTargetSubtreeFromFiles, computeSubtreeHash, } from "./target-subtree.js";
 export async function runLibraryUpdateUseCase(context, deps, expected) {
     const project = detectProject(context.cwd);
     if (!project)
@@ -31,6 +31,7 @@ export async function runLibraryUpdateUseCase(context, deps, expected) {
     assertDownloadSelection(bootstrap.config);
     let selected;
     let catalogJson;
+    let fullArchiveFiles;
     let archiveBytes;
     let artifactSha256;
     let catalogSha256;
@@ -58,6 +59,7 @@ export async function runLibraryUpdateUseCase(context, deps, expected) {
         selected = downloaded.selected;
         catalogJson = downloaded.catalogJson;
         archiveBytes = downloaded.artifactBytes;
+        fullArchiveFiles = downloaded.archiveFiles;
         artifactSha256 = downloaded.descriptor.free.sha256;
         catalogSha256 = downloaded.descriptor.catalog.sha256;
         manifestJson = downloaded.manifestJson;
@@ -74,6 +76,7 @@ export async function runLibraryUpdateUseCase(context, deps, expected) {
         selected = downloaded.selected;
         catalogJson = downloaded.catalogJson;
         archiveBytes = downloaded.artifactBytes;
+        fullArchiveFiles = downloaded.archiveFiles;
         artifactSha256 = downloaded.descriptor.sha256;
         catalogSha256 = downloaded.descriptor.catalogSha256;
         manifestJson = downloaded.manifestJson;
@@ -114,10 +117,10 @@ export async function runLibraryUpdateUseCase(context, deps, expected) {
         : undefined;
     const unpacked = selected
         ? { files: selected.files, errors: [] }
-        : extractTarGz(archiveBytes, {
+        : fullArchiveFiles ? { files: fullArchiveFiles, errors: [] } : await extractTarGzAsync(archiveBytes, {
             maxEntries: ICON_ARCHIVE_MAX_ENTRIES,
             maxExpandedBytes: ICON_ARCHIVE_MAX_EXPANDED_BYTES,
-        });
+        }, context.signal);
     if (unpacked.errors.length)
         throw new CliError("VALIDATION_ERROR", unpacked.errors[0] ?? "invalid artifact");
     const target = loaded.config.target;
@@ -128,7 +131,7 @@ export async function runLibraryUpdateUseCase(context, deps, expected) {
         : undefined;
     const subtree = selectedTarget
         ? { ok: true, target, files: selectedTarget, ...computeSubtreeHash(selectedTarget) }
-        : selectTargetSubtree(archiveBytes, tierSource, target);
+        : selectTargetSubtreeFromFiles(unpacked.files, tierSource, target);
     if (!subtree.ok)
         throw new CliError("VALIDATION_ERROR", subtree.message);
     const archiveFiles = { ...unpacked.files };

package/dist/core/pro-download.d.ts

@@ -83,6 +83,7 @@ export declare function downloadProArtifact(context: CommandContext, auth: AuthU
 }): Promise<{
     readonly descriptor: ProArtifactDescriptor;
     readonly artifactBytes: Uint8Array;
+    readonly archiveFiles?: Readonly<Record<string, Uint8Array>>;
     readonly catalogJson: string;
     readonly manifestJson: string;
     readonly manualMd: string;

package/dist/core/pro-download.js

@@ -3,7 +3,7 @@ import { downloadProSelected } from "./pro-selected-download.js";
 import { validateConfigDocument, } from "../project/config.js";
 import { parseCatalog } from "../catalog/catalog.js";
 import { CliError } from "../errors/index.js";
-import { extractTarGz, decodeUtf8, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES, } from "../project/tar-gz.js";
+import { extractTarGzAsync, decodeUtf8, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES, } from "../project/tar-gz.js";
 import { sha256Bytes } from "../project/install-metadata.js";
 import { downloadSignedArtifact, parseSignedDescriptor, } from "./signed-artifact.js";
 import { runAccessTokenUseCase } from "./auth.js";
@@ -310,10 +310,12 @@ export async function downloadProArtifact(context, auth, expected, deps = {}) {
         size: descriptor.size,
         sha256: descriptor.sha256,
     }, downloadOptions);
-    const extracted = extractTarGz(artifactBytes, {
+    const extracted = await extractTarGzAsync(artifactBytes, {
         maxEntries: ICON_ARCHIVE_MAX_ENTRIES,
         maxExpandedBytes: ICON_ARCHIVE_MAX_EXPANDED_BYTES,
-    });
+    }, context.signal);
+    if (context.signal.aborted)
+        throw new CliError("CANCELLED", "archive extraction cancelled");
     if (extracted.errors.length > 0)
         throw new CliError("VALIDATION_ERROR", extracted.errors[0] ?? "invalid pro archive");
     const catalog = extracted.files[descriptor.catalogFilename] ??
@@ -323,6 +325,7 @@ export async function downloadProArtifact(context, auth, expected, deps = {}) {
     return {
         descriptor,
         artifactBytes,
+        archiveFiles: extracted.files,
         catalogJson: decodeUtf8(catalog),
         manifestJson: metadata.manifestJson,
         manualMd: metadata.manualMd,

package/dist/core/pro-install.js

@@ -7,7 +7,7 @@ import { withProjectLock } from "../project/project-lock.js";
 import { runAccessTokenUseCase } from "./auth.js";
 import { downloadProArtifact, PRO_DOWNLOAD_HOSTS, resolveProDescriptorEndpoint, } from "./pro-download.js";
 import { artifactCachePath, metadataCachePath } from "./free-download.js";
-import { configuredComponentFiles, selectTargetSubtree, computeSubtreeHash, } from "./target-subtree.js";
+import { configuredComponentFiles, selectTargetSubtreeAsync, selectTargetSubtreeFromFiles, computeSubtreeHash, } from "./target-subtree.js";
 import { typesReexport } from "./install.js";
 import { CliError } from "../errors/index.js";
 import { catalog as bundledCatalog, parseCatalog } from "../catalog/catalog.js";
@@ -81,7 +81,9 @@ export async function runProInstallUseCase(context, deps, expected) {
         : undefined;
     const subtree = selectedTarget
         ? { ok: true, target, files: selectedTarget, ...computeSubtreeHash(selectedTarget) }
-        : selectTargetSubtree(downloaded.artifactBytes, downloaded.descriptor, target);
+        : downloaded.archiveFiles
+            ? selectTargetSubtreeFromFiles(downloaded.archiveFiles, downloaded.descriptor, target)
+            : await selectTargetSubtreeAsync(downloaded.artifactBytes, downloaded.descriptor, target, context.signal);
     if (!subtree.ok) {
         throw new CliError("VALIDATION_ERROR", subtree.message);
     }

package/dist/core/target-subtree.d.ts

@@ -55,3 +55,6 @@ export declare function computeSubtreeHash(files: Readonly<Record<string, Uint8A
  * verification for backward compatibility but still reject an empty subtree.
  */
 export declare function selectTargetSubtree(archiveBytes: Uint8Array, source: TargetSubtreeSource, target: Target): TargetSubtreeResult;
+export declare function selectTargetSubtreeAsync(archiveBytes: Uint8Array, source: TargetSubtreeSource, target: Target, signal?: AbortSignal): Promise<TargetSubtreeResult>;
+/** Reuse the same verified archive rather than inflating it again per target. */
+export declare function selectTargetSubtreeFromFiles(archiveFiles: Readonly<Record<string, Uint8Array>>, source: TargetSubtreeSource, target: Target): TargetSubtreeResult;

package/dist/core/target-subtree.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { extractTarGz, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES } from "../project/tar-gz.js";
+import { extractTarGz, extractTarGzAsync, ICON_ARCHIVE_MAX_ENTRIES, ICON_ARCHIVE_MAX_EXPANDED_BYTES } from "../project/tar-gz.js";
 import { posix } from "node:path";
 import { toProxyName } from "./icon-names.js";
 import { findCatalogStyleGroup } from "../catalog/catalog.js";
@@ -122,7 +122,17 @@ export function selectTargetSubtree(archiveBytes, source, target) {
     if (extracted.errors.length > 0) {
         return { ok: false, reason: "validation", message: extracted.errors[0] ?? "invalid archive" };
     }
-    const files = subtreeFilesOf(extracted.files, target);
+    return selectTargetSubtreeFromFiles(extracted.files, source, target);
+}
+export async function selectTargetSubtreeAsync(archiveBytes, source, target, signal) {
+    const extracted = await extractTarGzAsync(archiveBytes, { maxEntries: ICON_ARCHIVE_MAX_ENTRIES, maxExpandedBytes: ICON_ARCHIVE_MAX_EXPANDED_BYTES }, signal);
+    if (extracted.errors.length)
+        return { ok: false, reason: "validation", message: extracted.errors[0] ?? "invalid archive" };
+    return selectTargetSubtreeFromFiles(extracted.files, source, target);
+}
+/** Reuse the same verified archive rather than inflating it again per target. */
+export function selectTargetSubtreeFromFiles(archiveFiles, source, target) {
+    const files = subtreeFilesOf(archiveFiles, target);
     const computed = computeSubtreeHash(files);
     const modern = hasModernTargetContract(source);
     if (modern) {

package/dist/project/anchors/application.js

@@ -109,13 +109,13 @@ function planViteReact(source, rel, specifier) {
             fixes: [],
         };
     }
-    const { childStart, childEnd } = root;
+    const { childStart, childEnd, jsx } = root;
     const child = source.slice(childStart, childEnd);
     if (binding && new RegExp(`^\\s*<${escapeRegExp(binding)}(?:\\s|>)`).test(child)) {
         return { kind: "application", status: "ok", path: rel, candidates: [rel], evidence: ["render root is wrapped in the generated Provider"], fixes: [] };
     }
     const providerName = binding ?? "MoeiconsProvider";
-    const after = source.slice(0, childStart) + `<${providerName}>${child}</${providerName}>` + source.slice(childEnd);
+    const after = source.slice(0, childStart) + `<${providerName}>${jsx ? child : `{${child}}`}</${providerName}>` + source.slice(childEnd);
     const imported = binding ? after : insertImport(after, `import { MoeiconsProvider } from "${specifier}";`, rel);
     const valid = parseSource(imported, rel);
     if (!valid.ok)
@@ -151,7 +151,7 @@ function findUniqueRender(ast) {
             node.arguments.length === 1) {
             const child = node.arguments[0];
             if (child && typeof child.start === "number" && typeof child.end === "number") {
-                renders.push({ start: child.start, end: child.end });
+                renders.push({ start: child.start, end: child.end, jsx: child.type === "JSXElement" || child.type === "JSXFragment" });
             }
         }
         for (const value of Object.values(node)) {
@@ -168,7 +168,7 @@ function findUniqueRender(ast) {
     if (renders.length > 1)
         return "multiple";
     const only = renders[0];
-    return only ? { childStart: only.start, childEnd: only.end } : undefined;
+    return only ? { childStart: only.start, childEnd: only.end, jsx: only.jsx } : undefined;
 }
 function insertImport(source, line, rel = "src/main.tsx") {
     if (source.includes(line))

package/dist/project/download.d.ts

@@ -0,0 +1,41 @@
+export interface DownloadLimits {
+    readonly maxBytes: number;
+    readonly timeoutMs: number;
+    readonly maxRedirects: number;
+    readonly allowedHosts?: readonly string[];
+    readonly userAgent?: string;
+    readonly onProgress?: (event: {
+        readonly downloadedBytes: number;
+        readonly totalBytes?: number;
+    }) => void;
+    readonly allowHttpLoopback?: boolean;
+}
+export type DownloadResult = {
+    readonly ok: true;
+    readonly bytes: Uint8Array;
+    readonly finalUrl: string;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+/**
+ * Download an artifact. HTTPS only, optional host allowlist, bounded redirects,
+ * timeout, byte limit. Abort and temporary-file cleanup are handled by the
+ * caller via the injected fetch/signal.
+ *
+ * Redirect policy: unlike the API descriptor handshake (which uses
+ * `redirect: "error"`), payload downloads intentionally follow a bounded number
+ * of redirects because code/metadata archives are served from CDNs that 3xx to
+ * a signed object host; the destination host is re-checked against the
+ * allowlist on every hop.
+ */
+export declare function downloadArtifact(url: string, limits: DownloadLimits, deps?: {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<DownloadResult>;
+/** Verify a downloaded artifact against an expected SHA-256 (and optional signature). */
+export declare function verifyArtifact(bytes: Uint8Array, expectedSha256: string): {
+    ok: boolean;
+    actual: string;
+};

package/dist/project/download.js

@@ -0,0 +1,162 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, open, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/**
+ * Download an artifact. HTTPS only, optional host allowlist, bounded redirects,
+ * timeout, byte limit. Abort and temporary-file cleanup are handled by the
+ * caller via the injected fetch/signal.
+ *
+ * Redirect policy: unlike the API descriptor handshake (which uses
+ * `redirect: "error"`), payload downloads intentionally follow a bounded number
+ * of redirects because code/metadata archives are served from CDNs that 3xx to
+ * a signed object host; the destination host is re-checked against the
+ * allowlist on every hop.
+ */
+export async function downloadArtifact(url, limits, deps = {}) {
+    if (deps.signal?.aborted)
+        return { ok: false, code: "CANCELLED", message: "download cancelled" };
+    const parsed = new URL(url);
+    const loopbackHttp = limits.allowHttpLoopback === true && parsed.protocol === "http:" && (parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost" || parsed.hostname === "::1");
+    if (parsed.protocol !== "https:" && !loopbackHttp) {
+        return { ok: false, code: "NON_HTTPS", message: "artifact URLs must use https" };
+    }
+    if (limits.allowedHosts && !limits.allowedHosts.includes(parsed.host)) {
+        return { ok: false, code: "HOST_NOT_ALLOWED", message: `host ${parsed.host} not in allowlist` };
+    }
+    const fetchFn = deps.fetchFn ?? globalThis.fetch;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), limits.timeoutMs);
+    const abortHandler = () => controller.abort();
+    deps.signal?.addEventListener("abort", abortHandler, { once: true });
+    let response;
+    let temporary;
+    let file;
+    let reader;
+    try {
+        let currentUrl = url;
+        let redirects = 0;
+        for (;;) {
+            response = await fetchFn(currentUrl, {
+                method: "GET",
+                redirect: "manual",
+                signal: controller.signal,
+                ...(limits.userAgent ? { headers: { "user-agent": limits.userAgent } } : {}),
+            });
+            if (response.status >= 300 && response.status < 400) {
+                await response.body?.cancel();
+                redirects += 1;
+                if (redirects > limits.maxRedirects) {
+                    return { ok: false, code: "TOO_MANY_REDIRECTS", message: `exceeded ${limits.maxRedirects} redirects` };
+                }
+                const location = response.headers.get("location");
+                if (!location) {
+                    return { ok: false, code: "REDIRECT_NO_LOCATION", message: "redirect without location header" };
+                }
+                currentUrl = new URL(location, currentUrl).toString();
+                const next = new URL(currentUrl);
+                const nextLoopback = limits.allowHttpLoopback === true && next.protocol === "http:" && (next.hostname === "127.0.0.1" || next.hostname === "localhost" || next.hostname === "::1");
+                if (next.protocol !== "https:" && !nextLoopback) {
+                    return { ok: false, code: "NON_HTTPS", message: "redirect to non-https url" };
+                }
+                if (limits.allowedHosts && !limits.allowedHosts.includes(next.host)) {
+                    return { ok: false, code: "HOST_NOT_ALLOWED", message: `redirect host ${next.host} not in allowlist` };
+                }
+                continue;
+            }
+            break;
+        }
+        if (!response || response.status >= 400) {
+            return { ok: false, code: "HTTP_ERROR", message: `request failed with ${response.status ?? "unknown"}` };
+        }
+        const rawLength = response.headers.get("content-length");
+        const contentLength = rawLength !== null && /^\d+$/.test(rawLength) ? Number(rawLength) : undefined;
+        if (contentLength !== undefined && contentLength > limits.maxBytes) {
+            return { ok: false, code: "TOO_LARGE", message: `content-length ${contentLength} exceeds limit` };
+        }
+        const chunks = [];
+        let downloadedBytes = 0;
+        if (response.body) {
+            reader = response.body.getReader();
+            for (;;) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                const value = chunk.value;
+                downloadedBytes += value.byteLength;
+                if (downloadedBytes > limits.maxBytes) {
+                    await reader.cancel();
+                    return { ok: false, code: "TOO_LARGE", message: `body exceeds byte limit ${limits.maxBytes}` };
+                }
+                if (!file && downloadedBytes > 8 * 1024 * 1024) {
+                    temporary = await mkdtemp(join(tmpdir(), "moeicons-download-"));
+                    file = await open(join(temporary, "bytes"), "wx", 0o600);
+                    for (const previous of chunks)
+                        await file.writeFile(previous);
+                    chunks.length = 0;
+                }
+                if (file)
+                    await file.writeFile(value);
+                else
+                    chunks.push(value);
+                limits.onProgress?.({ downloadedBytes, ...(contentLength !== undefined ? { totalBytes: contentLength } : {}) });
+            }
+        }
+        else {
+            const buffer = await response.arrayBuffer();
+            downloadedBytes = buffer.byteLength;
+            if (downloadedBytes > limits.maxBytes)
+                return { ok: false, code: "TOO_LARGE", message: `body exceeds byte limit ${limits.maxBytes}` };
+            chunks.push(new Uint8Array(buffer));
+            limits.onProgress?.({ downloadedBytes, ...(contentLength !== undefined ? { totalBytes: contentLength } : {}) });
+        }
+        if (file) {
+            await file.close();
+            file = undefined;
+            const bytes = await readFile(join(temporary, "bytes"));
+            if (controller.signal.aborted)
+                return { ok: false, code: deps.signal?.aborted ? "CANCELLED" : "NETWORK_ERROR", message: "download aborted" };
+            return { ok: true, bytes, finalUrl: currentUrl };
+        }
+        const bytes = new Uint8Array(downloadedBytes);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return { ok: true, bytes, finalUrl: currentUrl };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            code: controller.signal.aborted ? (deps.signal?.aborted ? "CANCELLED" : "NETWORK_ERROR") : "NETWORK_ERROR",
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+    finally {
+        if (reader) {
+            try {
+                await reader.cancel();
+            }
+            catch { /* Stream may already be closed. */ }
+            reader.releaseLock();
+        }
+        else {
+            try {
+                await response?.body?.cancel();
+            }
+            catch { /* Redirect or error response. */ }
+        }
+        if (file)
+            await file.close().catch(() => undefined);
+        clearTimeout(timer);
+        deps.signal?.removeEventListener("abort", abortHandler);
+        if (temporary)
+            await rm(temporary, { recursive: true, force: true });
+    }
+}
+/** Verify a downloaded artifact against an expected SHA-256 (and optional signature). */
+export function verifyArtifact(bytes, expectedSha256) {
+    const actual = createHash("sha256").update(bytes).digest("hex");
+    return { ok: actual.toLowerCase() === expectedSha256.toLowerCase(), actual };
+}

package/dist/project/install.d.ts

@@ -92,44 +92,5 @@ export declare function executeGeneratedFilesDir(files: readonly {
 }[], projectRoot: string, outputDir: string, fs_: TransactionalFsWithCopy): void;
 /** Atomically create a new file without replacing an existing user file. */
 export declare function createFileIfAbsent(target: string, content: string, fs_: TransactionalFs): boolean;
-export interface DownloadLimits {
-    readonly maxBytes: number;
-    readonly timeoutMs: number;
-    readonly maxRedirects: number;
-    readonly allowedHosts?: readonly string[];
-    readonly userAgent?: string;
-    readonly onProgress?: (event: {
-        readonly downloadedBytes: number;
-        readonly totalBytes?: number;
-    }) => void;
-    readonly allowHttpLoopback?: boolean;
-}
-export type DownloadResult = {
-    readonly ok: true;
-    readonly bytes: Uint8Array;
-    readonly finalUrl: string;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-};
-/**
- * Download an artifact. HTTPS only, optional host allowlist, bounded redirects,
- * timeout, byte limit. Abort and temporary-file cleanup are handled by the
- * caller via the injected fetch/signal.
- *
- * Redirect policy: unlike the API descriptor handshake (which uses
- * `redirect: "error"`), payload downloads intentionally follow a bounded number
- * of redirects because code/metadata archives are served from CDNs that 3xx to
- * a signed object host; the destination host is re-checked against the
- * allowlist on every hop.
- */
-export declare function downloadArtifact(url: string, limits: DownloadLimits, deps?: {
-    fetchFn?: typeof fetch;
-    signal?: AbortSignal;
-}): Promise<DownloadResult>;
-/** Verify a downloaded artifact against an expected SHA-256 (and optional signature). */
-export declare function verifyArtifact(bytes: Uint8Array, expectedSha256: string): {
-    ok: boolean;
-    actual: string;
-};
+export { downloadArtifact, verifyArtifact } from "./download.js";
+export type { DownloadLimits, DownloadResult } from "./download.js";