@package-broker/runtime-node 0.0.0-stage → 2.0.0-rc.2

package/dist/sources/dns-guard.js

@@ -0,0 +1,202 @@
+import { lookup as systemLookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { classifyAddress, parseAllowlist, } from '@package-broker/core/sources/url-policy';
+export class DnsGuardError extends Error {
+    reason;
+    name = 'DnsGuardError';
+    constructor(reason) {
+        super(`outbound host refused: ${reason}`);
+        this.reason = reason;
+    }
+}
+const DEFAULT_TIMEOUT_MS = 5000;
+const DEFAULT_MAX_IN_FLIGHT = 16;
+const HTTPS_PORT = 443;
+const systemResolver = async (host) => (await systemLookup(host, { all: true, verbatim: true })).map((entry) => ({
+    address: entry.address,
+    family: entry.family === 6 ? 6 : 4,
+}));
+function canonicalIpv6(text) {
+    if (isIP(text) !== 6 || text.includes('%'))
+        return null;
+    try {
+        return new URL(`http://[${text}]/`).hostname.slice(1, -1);
+    }
+    catch {
+        return null;
+    }
+}
+function stripBrackets(host) {
+    return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+}
+function comparableHost(host) {
+    const bare = stripBrackets(host.toLowerCase());
+    return canonicalIpv6(bare) ?? bare.replace(/\.$/, '');
+}
+function isAllowlisted(host, port, scheme, allowlist) {
+    if (scheme !== 'https' && scheme !== 'ssh')
+        return false;
+    const wanted = comparableHost(host);
+    return allowlist.some((entry) => {
+        const match = /^(\[[^\]]+\]|[^:]+)(?::(\d{1,5}))?$/.exec(entry);
+        if (!match?.[1] || comparableHost(match[1]) !== wanted)
+            return false;
+        if (match[2] !== undefined)
+            return Number(match[2]) === port;
+        return scheme === 'https' && port === HTTPS_PORT;
+    });
+}
+function normalizeAddress(raw) {
+    if (raw.includes('%'))
+        throw new DnsGuardError('zone_id');
+    const kind = isIP(raw);
+    if (kind === 4)
+        return { address: raw, family: 4 };
+    const canonical = kind === 6 ? canonicalIpv6(raw) : null;
+    if (!canonical)
+        throw new DnsGuardError('invalid_address');
+    const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(canonical);
+    if (mapped?.[1] && mapped[2]) {
+        const high = Number.parseInt(mapped[1], 16);
+        const low = Number.parseInt(mapped[2], 16);
+        return { address: `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`, family: 4 };
+    }
+    return { address: canonical, family: 6 };
+}
+function ipv6Groups(canonical) {
+    const [head = '', tail] = canonical.split('::');
+    const left = head === '' ? [] : head.split(':');
+    const right = tail === undefined || tail === '' ? [] : tail.split(':');
+    const fill = tail === undefined ? [] : Array(8 - left.length - right.length).fill('0');
+    return [...left, ...fill, ...right].map((group) => Number.parseInt(group, 16));
+}
+function embeddedIpv4(high, low) {
+    return { address: `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`, family: 4 };
+}
+function isNeverAllowed({ address, family }) {
+    if (family === 4) {
+        const octets = address.split('.').map(Number);
+        const [first = 0, second = 0] = octets;
+        return first === 0 || first >= 224 || (first === 169 && second === 254);
+    }
+    if (address === '::' || address === 'fd00:ec2::254')
+        return true;
+    const g = ipv6Groups(address);
+    const [g0 = 0, g1 = 0, g2 = 0, g3 = 0, g4 = 0, g5 = 0, g6 = 0, g7 = 0] = g;
+    if (g0 >= 0xff00 || (g0 & 0xffc0) === 0xfe80)
+        return true;
+    if (g0 === 0x2002)
+        return isNeverAllowed(embeddedIpv4(g1, g2));
+    const zeroPrefix = g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0;
+    const nat64 = g0 === 0x64 && g1 === 0xff9b && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0;
+    const siit = zeroPrefix && g4 === 0xffff && g5 === 0;
+    const compat = zeroPrefix && g4 === 0 && g5 === 0 && g6 !== 0;
+    return (nat64 || siit || compat) && isNeverAllowed(embeddedIpv4(g6, g7));
+}
+function wantedFamily(family) {
+    if (family === 4 || family === 'IPv4')
+        return 4;
+    if (family === 6 || family === 'IPv6')
+        return 6;
+    return undefined;
+}
+function withDeadline(work, timeoutMs, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(new DnsGuardError('aborted'));
+            return;
+        }
+        const onAbort = () => finish(() => reject(new DnsGuardError('aborted')));
+        const timer = setTimeout(() => finish(() => reject(new DnsGuardError('resolution_timeout'))), timeoutMs);
+        function finish(settle) {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+            settle();
+        }
+        signal?.addEventListener('abort', onAbort, { once: true });
+        work.then((value) => finish(() => resolve(value)), (error) => finish(() => reject(error instanceof DnsGuardError ? error : new DnsGuardError('resolution_failed'))));
+    });
+}
+export function createDnsGuard(policy, options = {}) {
+    const resolver = options.resolver ?? systemResolver;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxInFlight = options.maxInFlight ?? DEFAULT_MAX_IN_FLIGHT;
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+        throw new RangeError('timeoutMs must be a positive finite number');
+    }
+    if (!Number.isInteger(maxInFlight) || maxInFlight <= 0) {
+        throw new RangeError('maxInFlight must be a positive integer');
+    }
+    const allowlist = parseAllowlist(policy.allowPrivateHosts, policy.runtime);
+    let inFlight = 0;
+    function startResolution(target) {
+        if (inFlight >= maxInFlight)
+            return Promise.reject(new DnsGuardError('resolution_timeout'));
+        inFlight += 1;
+        const work = Promise.resolve().then(() => resolver(target));
+        const release = () => {
+            inFlight -= 1;
+        };
+        work.then(release, release);
+        return work;
+    }
+    async function resolveTarget(host, port, scheme) {
+        if (scheme !== 'https' && scheme !== 'http' && scheme !== 'ssh') {
+            throw new DnsGuardError('scheme');
+        }
+        if (scheme === 'http' &&
+            (port === HTTPS_PORT || isAllowlisted(host, port, 'https', allowlist))) {
+            throw new DnsGuardError('scheme');
+        }
+        const literal = canonicalIpv6(stripBrackets(host.toLowerCase()));
+        const target = literal ?? host;
+        const resolved = await withDeadline(startResolution(target), timeoutMs, options.signal);
+        if (resolved.length === 0)
+            throw new DnsGuardError('no_address');
+        const allowed = isAllowlisted(host, port, scheme, allowlist);
+        const addresses = resolved.map((entry) => {
+            const normalized = normalizeAddress(entry.address);
+            if (isNeverAllowed(normalized))
+                throw new DnsGuardError('blocked_address');
+            if (!allowed) {
+                const verdict = classifyAddress(normalized.address);
+                if (!verdict.ok)
+                    throw new DnsGuardError(verdict.reason);
+            }
+            return normalized;
+        });
+        return { host: target, addresses };
+    }
+    return {
+        forTarget(host, port, scheme) {
+            const bound = comparableHost(host);
+            const lookup = (requested, lookupOptions, callback) => {
+                const wanted = wantedFamily(lookupOptions.family);
+                const all = lookupOptions.all === true;
+                const fail = (error) => {
+                    process.nextTick(() => callback(error, all ? [] : '', 4));
+                };
+                if (comparableHost(requested) !== bound) {
+                    fail(new DnsGuardError('blocked_host'));
+                    return;
+                }
+                resolveTarget(host, port, scheme).then(({ addresses }) => {
+                    const matching = addresses.filter((entry) => wanted === undefined || entry.family === wanted);
+                    const first = matching[0];
+                    if (!first) {
+                        fail(new DnsGuardError('no_address'));
+                        return;
+                    }
+                    process.nextTick(() => {
+                        if (all)
+                            callback(null, matching.map((entry) => ({ ...entry })));
+                        else
+                            callback(null, first.address, first.family);
+                    });
+                }, (error) => fail(error instanceof DnsGuardError ? error : new DnsGuardError('resolution_failed')));
+            };
+            return { resolve: () => resolveTarget(host, port, scheme), lookup };
+        },
+    };
+}
+//# sourceMappingURL=dns-guard.js.map

package/dist/sources/dns-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-guard.js","sourceRoot":"","sources":["../../src/sources/dns-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,IAAI,EAAuB,MAAM,UAAU,CAAC;AACrD,OAAO,EACL,eAAe,EACf,cAAc,GAGf,MAAM,yCAAyC,CAAC;AAwCjD,MAAM,OAAO,aAAc,SAAQ,KAAK;IAEjB;IADH,IAAI,GAAG,eAAe,CAAC;IACzC,YAAqB,MAAsB;QACzC,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QADvB,WAAM,GAAN,MAAM,CAAgB;IAE3C,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,cAAc,GAAa,KAAK,EAAE,IAAI,EAAE,EAAE,CAC9C,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC,CAAC;AAEN,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,IAAY,EACZ,MAAqB,EACrB,SAA4B;IAE5B,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACrE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAC7D,OAAO,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,UAAU,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,0CAA0C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1E,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB;IACnC,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAS,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAmB;IAC1D,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;QACvC,OAAO,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,EAAE,IAAI,MAAM,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,UAAU,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,CAAC,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,cAAc,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B;IACnD,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,IAAgB,EAChB,SAAiB,EACjB,MAA+B;IAE/B,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,EACnE,SAAS,CACV,CAAC;QACF,SAAS,MAAM,CAAC,MAAkB;YAChC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,EAAE,CAAC;QACX,CAAC;QACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CACP,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EACvC,CAAC,KAAc,EAAE,EAAE,CACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,mBAAmB,CAAC,CAAC,CACxF,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAsB,EAAE,UAA2B,EAAE;IAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,SAAS,eAAe,CAAC,MAAc;QACrC,IAAI,QAAQ,IAAI,WAAW;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC5F,QAAQ,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,IAAY,EACZ,MAAqB;QAErB,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAChE,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,IACE,MAAM,KAAK,MAAM;YACjB,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EACtE,CAAC;YACD,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,OAAO,IAAI,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,cAAc,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpD,IAAI,CAAC,OAAO,CAAC,EAAE;oBAAE,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrC,CAAC;IAED,OAAO;QACL,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM;YAC1B,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,GAAmB,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE;gBACpE,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAClD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,KAAK,IAAI,CAAC;gBACvC,MAAM,IAAI,GAAG,CAAC,KAAoB,EAAQ,EAAE;oBAC1C,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC5D,CAAC,CAAC;gBACF,IAAI,cAAc,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;oBACxC,IAAI,CAAC,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;oBACxC,OAAO;gBACT,CAAC;gBACD,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CACpC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;oBAChB,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAC3D,CAAC;oBACF,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;oBAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,IAAI,CAAC,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;wBACtC,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;wBACpB,IAAI,GAAG;4BACL,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAiB,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CACvD,CAAC;;4BACC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;oBACnD,CAAC,CAAC,CAAC;gBACL,CAAC,EACD,CAAC,KAAc,EAAE,EAAE,CACjB,IAAI,CAAC,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,mBAAmB,CAAC,CAAC,CACxF,CAAC;YACJ,CAAC,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sources/git-provider.d.ts

@@ -0,0 +1,30 @@
+import type { ArchiveStaging } from '@package-broker/core/sources/git/archive';
+import { type SourceProvider } from '@package-broker/core/sources/provider';
+export interface NodeGitProviderOptions {
+    readonly staging: ArchiveStaging;
+    /** How long a built archive stays staged for the second read of a two-pass store. */
+    readonly reuseMs?: number;
+    readonly maxStaged?: number;
+    /** Archive builds running at once across all organizations; more answer busy. */
+    readonly maxConcurrentBuilds?: number;
+}
+/**
+ * Opens the git archive staging directory. Partial archives older than an hour are removed; a
+ * newer one may belong to another process sharing the volume.
+ */
+export declare function openGitArchiveStaging(directory: string, now?: () => number): Promise<ArchiveStaging>;
+/**
+ * The generic Git provider with dists built on demand: `openDist` builds the zip of the requested
+ * commit once and serves it to every reader, including both passes of the blob store.
+ */
+export declare function createNodeGitProvider(options: NodeGitProviderOptions): SourceProvider;
+/**
+ * The generic Git provider for a staging root, or null when the root cannot be used; the failure is
+ * logged once and the provider stays unregistered, so the broker neither reports nor accepts it.
+ */
+export declare function nodeGitProviderFor(root: string, log: (record: {
+    level: 'error';
+    event: string;
+    error_name: string;
+}) => void, options?: Omit<NodeGitProviderOptions, 'staging'>): Promise<SourceProvider | null>;
+//# sourceMappingURL=git-provider.d.ts.map

package/dist/sources/git-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-provider.d.ts","sourceRoot":"","sources":["../../src/sources/git-provider.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,0CAA0C,CAAC;AAC7F,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,uCAAuC,CAAC;AAG/C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,qFAAqF;IACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAqED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAWzB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,CAmHrF;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,EAC5E,OAAO,GAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,CAAM,GACpD,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAahC"}

package/dist/sources/git-provider.js

@@ -0,0 +1,213 @@
+import { lstat, mkdir, readdir, unlink } from 'node:fs/promises';
+import { open } from 'node:fs/promises';
+import { isAbsolute, join } from 'node:path';
+import { Readable } from 'node:stream';
+import { GitProviderError, createGitProvider, } from '@package-broker/core/ingest/vcs/git-provider';
+import { ProviderBusyError, } from '@package-broker/core/sources/provider';
+import { ArchiveStagingDirectoryError, createNodeArchiveStaging } from '../blob/archive-staging.js';
+const COMMIT = /^[a-f0-9]{40}$/;
+const STAGED_PART = /^archive-[0-9a-f]{32}\.zip\.part$/;
+const STALE_PART_MS = 60 * 60_000;
+const REUSE_MS = 60_000;
+const MAX_STAGED = 32;
+const MAX_CONCURRENT_BUILDS = 2;
+function repositoryOf(source) {
+    if (source.type !== 'vcs' || source.config.provider !== 'git') {
+        throw new GitProviderError('invalid_request');
+    }
+    return source.config.repository;
+}
+function untilAborted(work, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+        work.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(error);
+        });
+    });
+}
+async function requireOwnedDirectory(directory) {
+    if (!isAbsolute(directory))
+        throw new ArchiveStagingDirectoryError();
+    try {
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+    }
+    catch {
+        throw new ArchiveStagingDirectoryError();
+    }
+    let stats;
+    try {
+        stats = await lstat(directory);
+    }
+    catch {
+        throw new ArchiveStagingDirectoryError();
+    }
+    if (stats.isSymbolicLink() ||
+        !stats.isDirectory() ||
+        stats.uid !== process.getuid() ||
+        (stats.mode & 0o022) !== 0) {
+        throw new ArchiveStagingDirectoryError();
+    }
+}
+/**
+ * Opens the git archive staging directory. Partial archives older than an hour are removed; a
+ * newer one may belong to another process sharing the volume.
+ */
+export async function openGitArchiveStaging(directory, now = Date.now) {
+    await requireOwnedDirectory(directory);
+    for (const name of await readdir(directory)) {
+        if (!STAGED_PART.test(name))
+            continue;
+        const path = join(directory, name);
+        const stats = await lstat(path).catch(() => null);
+        if (stats?.isFile() === true && now() - stats.mtimeMs > STALE_PART_MS) {
+            await unlink(path).catch(() => undefined);
+        }
+    }
+    return createNodeArchiveStaging({ directory });
+}
+/**
+ * The generic Git provider with dists built on demand: `openDist` builds the zip of the requested
+ * commit once and serves it to every reader, including both passes of the blob store.
+ */
+export function createNodeGitProvider(options) {
+    const git = createGitProvider({ runtime: 'docker', staging: options.staging });
+    const reuseMs = options.reuseMs ?? REUSE_MS;
+    const maxStaged = options.maxStaged ?? MAX_STAGED;
+    const maxConcurrentBuilds = options.maxConcurrentBuilds ?? MAX_CONCURRENT_BUILDS;
+    const staged = new Map();
+    let building = 0;
+    function cleanup(entry) {
+        if (!entry.dead || entry.holders > 0 || !entry.settled)
+            return;
+        clearTimeout(entry.timer);
+        if (entry.archive !== undefined)
+            void unlink(entry.archive.path).catch(() => undefined);
+    }
+    function retire(key, entry) {
+        if (staged.get(key) === entry)
+            staged.delete(key);
+        entry.dead = true;
+        cleanup(entry);
+    }
+    function evictSettled() {
+        if (staged.size < maxStaged)
+            return;
+        for (const [key, entry] of staged) {
+            if (entry.settled) {
+                retire(key, entry);
+                return;
+            }
+        }
+    }
+    function start(key, ctx, source, commit) {
+        if (building >= maxConcurrentBuilds)
+            throw new ProviderBusyError();
+        evictSettled();
+        const controller = new AbortController();
+        building += 1;
+        const built = git.buildArchive({ ...ctx, signal: controller.signal }, source, commit);
+        const entry = {
+            key,
+            built,
+            controller,
+            waiting: 0,
+            holders: 0,
+            settled: false,
+            dead: false,
+        };
+        staged.set(key, entry);
+        built.then((archive) => {
+            building -= 1;
+            entry.archive = archive;
+            entry.settled = true;
+            if (entry.dead) {
+                cleanup(entry);
+                return;
+            }
+            entry.timer = setTimeout(() => retire(key, entry), reuseMs);
+            entry.timer.unref();
+        }, () => {
+            building -= 1;
+            entry.settled = true;
+            retire(key, entry);
+        });
+        return entry;
+    }
+    async function read(entry, signal) {
+        entry.holders += 1;
+        entry.waiting += 1;
+        let handle;
+        let released = false;
+        const release = () => {
+            if (released)
+                return;
+            released = true;
+            entry.holders -= 1;
+            cleanup(entry);
+        };
+        try {
+            const archive = await untilAborted(entry.built, signal).finally(() => {
+                entry.waiting -= 1;
+                if (entry.waiting === 0 && !entry.settled) {
+                    retire(entry.key, entry);
+                    entry.controller.abort(signal.reason);
+                }
+            });
+            handle = await open(archive.path, 'r');
+            const stream = handle.createReadStream();
+            stream.once('close', release);
+            return {
+                body: Readable.toWeb(stream),
+                size: archive.size,
+            };
+        }
+        catch (error) {
+            await handle?.close().catch(() => undefined);
+            release();
+            throw error;
+        }
+    }
+    return {
+        id: git.id,
+        sourceTypes: git.sourceTypes,
+        ecosystems: git.ecosystems,
+        listPackages: git.listPackages.bind(git),
+        describe: git.describe.bind(git),
+        async openDist(ctx, source, target) {
+            const repository = repositoryOf(source);
+            const commit = target.sourceRef;
+            if (commit === null || !COMMIT.test(commit))
+                throw new GitProviderError('invalid_request');
+            const key = JSON.stringify([ctx.org.orgId, source.id, repository, commit]);
+            const entry = staged.get(key) ?? start(key, ctx, source, commit);
+            return read(entry, ctx.signal);
+        },
+    };
+}
+/**
+ * The generic Git provider for a staging root, or null when the root cannot be used; the failure is
+ * logged once and the provider stays unregistered, so the broker neither reports nor accepts it.
+ */
+export async function nodeGitProviderFor(root, log, options = {}) {
+    let staging;
+    try {
+        staging = await openGitArchiveStaging(root);
+    }
+    catch (error) {
+        log({
+            level: 'error',
+            event: 'startup.git_archive_staging_failed',
+            error_name: error instanceof Error ? error.name : 'Error',
+        });
+        return null;
+    }
+    return createNodeGitProvider({ ...options, staging });
+}
+//# sourceMappingURL=git-provider.js.map

package/dist/sources/git-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-provider.js","sourceRoot":"","sources":["../../src/sources/git-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,iBAAiB,GAIlB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAWpG,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,WAAW,GAAG,mCAAmC,CAAC;AACxD,MAAM,aAAa,GAAG,EAAE,GAAG,MAAM,CAAC;AAClC,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAchC,SAAS,YAAY,CAAC,MAAsB;IAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9D,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAI,IAAgB,EAAE,MAAmB;IAC5D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,CACP,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IACpD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,4BAA4B,EAAE,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC3C,CAAC;IACD,IACE,KAAK,CAAC,cAAc,EAAE;QACtB,CAAC,KAAK,CAAC,WAAW,EAAE;QACpB,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,MAAO,EAAE;QAC/B,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,MAAoB,IAAI,CAAC,GAAG;IAE5B,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;YACtE,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,wBAAwB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,GAAG,GAAgB,iBAAiB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;IAClD,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,qBAAqB,CAAC;IACjF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,SAAS,OAAO,CAAC,KAAa;QAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO;QAC/D,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1F,CAAC;IAED,SAAS,MAAM,CAAC,GAAW,EAAE,KAAa;QACxC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED,SAAS,YAAY;QACnB,IAAI,MAAM,CAAC,IAAI,GAAG,SAAS;YAAE,OAAO;QACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,KAAK,CAAC,GAAW,EAAE,GAAoB,EAAE,MAAsB,EAAE,MAAc;QACtF,IAAI,QAAQ,IAAI,mBAAmB;YAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACnE,YAAY,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,QAAQ,IAAI,CAAC,CAAC;QACd,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACtF,MAAM,KAAK,GAAW;YACpB,GAAG;YACH,KAAK;YACL,UAAU;YACV,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,KAAK;SACZ,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,CAAC,OAAO,EAAE,EAAE;YACV,QAAQ,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;YACxB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACrB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YACD,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YAC5D,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,EACD,GAAG,EAAE;YACH,QAAQ,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,MAAmB;QACpD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACnB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACnB,IAAI,MAA8B,CAAC;QACnC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACnE,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACnB,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACzB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,OAAO;gBACL,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAA+B;gBAC1D,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EAAE,GAAG,CAAC,YAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM;YAChC,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC;YAChC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;YAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,GAA4E,EAC5E,UAAmD,EAAE;IAErD,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC;YACF,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,oCAAoC;YAC3C,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;SAC1D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qBAAqB,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/sources/guarded-fetch.d.ts

@@ -0,0 +1,15 @@
+import type { FetchLike } from '@package-broker/core/platform/tracing';
+import type { OutboundPolicy } from '@package-broker/core/sources/url-policy';
+import { type DnsGuardOptions } from './dns-guard.js';
+export interface GuardedFetchOptions extends DnsGuardOptions {
+    readonly tls?: {
+        readonly ca?: string | Buffer;
+    };
+}
+/**
+ * Redirects are never followed, whatever init.redirect or a Request default says;
+ * 3xx responses are returned as-is for the caller to vet. An explicit
+ * redirect: 'follow' is rejected.
+ */
+export declare function createGuardedFetch(policy: OutboundPolicy, options?: GuardedFetchOptions): FetchLike;
+//# sourceMappingURL=guarded-fetch.d.ts.map

package/dist/sources/guarded-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guarded-fetch.d.ts","sourceRoot":"","sources":["../../src/sources/guarded-fetch.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAErF,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;CAClD;AAwHD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,mBAAwB,GAChC,SAAS,CA4FX"}