@poe-platform/safe-bash 0.1.802 → 0.1.804

package/dist/remote-execution/uploads.js

@@ -1,324 +0,0 @@
-import { parseWireJson } from './wire-json.js';
-import { digestHeader, uploadRouteId, uploadByteLength, UploadError, uploadInteger, validateUploadRequest, validateUploadState } from './upload-protocol.js';
-async function control(response, kind, signal, expectedId) {
-    const reader = response.body?.getReader();
-    const abort = () => { void reader?.cancel(signal?.reason).catch(() => { }); };
-    signal?.addEventListener('abort', abort, { once: true });
-    try {
-        if (!reader)
-            throw new Error('Missing control body');
-        const bytes = new Uint8Array(2048);
-        let length = 0;
-        for (;;) {
-            signal?.throwIfAborted();
-            const part = await reader.read();
-            signal?.throwIfAborted();
-            if (part.done)
-                break;
-            if (!(part.value instanceof Uint8Array))
-                throw new Error('Binary control response required');
-            if (uploadByteLength(part.value) > bytes.length - length)
-                throw new Error('Control body limit');
-            bytes.set(part.value, length);
-            length += uploadByteLength(part.value);
-        }
-        const value = parseWireJson(new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, length)));
-        if (!value || typeof value !== 'object' || Array.isArray(value))
-            throw new Error('Invalid control record');
-        const keys = kind === 'blob' ? ['blobId', 'size', 'digest'] : ['uploadId', 'size', 'digest', 'committedOffset', 'state', 'blobId'];
-        if (Object.keys(value).some(k => !keys.includes(k)))
-            throw new Error('Unknown control field');
-        validateUploadRequest({ size: value.size, digest: value.digest });
-        const id = kind === 'blob' ? value.blobId : value.uploadId;
-        if (typeof id !== 'string' || !id.length || id.length > 256)
-            throw new Error('Invalid resource ID');
-        uploadRouteId(id);
-        if (expectedId !== undefined && id !== expectedId)
-            throw new Error('Resource ID mismatch');
-        if (kind === 'upload') {
-            if (!['open', 'committed', 'aborted', 'expired'].includes(value.state))
-                throw new Error('Invalid upload state');
-            if (value.blobId !== undefined && (typeof value.blobId !== 'string' || !value.blobId.length || value.blobId.length > 256))
-                throw new Error('Invalid blob ID');
-            validateUploadState(value);
-        }
-        return value;
-    }
-    catch {
-        signal?.throwIfAborted();
-        throw new UploadError(502, 'Invalid or oversized v1 upload control response');
-    }
-    finally {
-        signal?.removeEventListener('abort', abort);
-        await reader?.cancel().catch(() => { });
-        reader?.releaseLock();
-    }
-}
-export function createUploadClient(options) {
-    // Bind scope and allocation limits once; credential renewal uses the supplier.
-    options = { ...options };
-    const base = new URL(options.baseUrl);
-    if (base.protocol !== 'https:' || base.username || base.password || base.search || base.hash)
-        throw new TypeError('An authenticated HTTPS origin is required');
-    if (!Number.isSafeInteger(options.maxChunkBytes) || options.maxChunkBytes < 1)
-        throw new TypeError('Invalid chunk limit');
-    const concurrency = options.maxConcurrentUploads ?? 1;
-    if (!Number.isSafeInteger(concurrency) || concurrency < 1)
-        throw new TypeError('Invalid upload concurrency bound');
-    let activeUploads = 0;
-    let activeSources = 0;
-    let authenticating = 0;
-    let activeControls = 0;
-    let activeRetirements = 0;
-    const root = new URL(`/v1/sessions/${uploadRouteId(options.sessionId)}/`, base);
-    const transport = options.fetch ?? globalThis.fetch;
-    async function request(path, init = {}, key) {
-        init.signal?.throwIfAborted();
-        if (authenticating >= concurrency)
-            throw new UploadError(429, 'Upload client credential concurrency bound');
-        const headers = new Headers(init.headers);
-        // Credential renewal may outlive the caller. Abort this admission without
-        // allowing a late credential to launch a canceled mutation. Pending host
-        // work retains its separate credential slot until it actually settles.
-        let abort;
-        const canceled = new Promise((_, reject) => {
-            abort = () => reject(init.signal.reason);
-            init.signal?.addEventListener('abort', abort, { once: true });
-        });
-        try {
-            authenticating++;
-            const credentials = (async () => {
-                try {
-                    return await options.token();
-                }
-                finally {
-                    authenticating--;
-                }
-            })();
-            headers.set('Authorization', `Bearer ${await Promise.race([credentials, canceled])}`);
-        }
-        finally {
-            init.signal?.removeEventListener('abort', abort);
-        }
-        init.signal?.throwIfAborted();
-        headers.set('Execution-Epoch', options.epoch);
-        headers.set('Execution-Protocol', '1');
-        if (init.method && init.method !== 'GET')
-            headers.set('Idempotency-Key', key ?? crypto.randomUUID());
-        let response;
-        try {
-            response = await transport(new URL(path, root), { ...init, headers, redirect: 'error' });
-        }
-        catch (error) {
-            init.signal?.throwIfAborted();
-            throw error;
-        }
-        if (init.signal?.aborted) {
-            await response.body?.cancel(init.signal.reason).catch(() => { });
-            init.signal.throwIfAborted();
-        }
-        if (!response.ok) {
-            await response.body?.cancel().catch(() => { });
-            throw new UploadError(response.status, `Upload request failed (${response.status}); inspect before retrying mutations`);
-        }
-        if (response.headers.get('Execution-Epoch') !== options.epoch) {
-            await response.body?.cancel().catch(() => { });
-            throw new UploadError(410, 'Upload epoch changed; recovery outcome unknown');
-        }
-        return response;
-    }
-    async function metadata(kind, path, init = {}, key, expectedId) {
-        init.signal?.throwIfAborted();
-        const retirement = init.method === 'DELETE';
-        if ((retirement ? activeRetirements : activeControls) >= concurrency)
-            throw new UploadError(429, 'Upload client metadata concurrency bound');
-        if (retirement)
-            activeRetirements++;
-        else
-            activeControls++;
-        try {
-            const response = await request(path, init, key);
-            const receipt = kind === 'upload'
-                ? await control(response, 'upload', init.signal ?? undefined, expectedId)
-                : await control(response, 'blob', init.signal ?? undefined, expectedId);
-            if (kind === 'upload' && init.method === 'POST') {
-                const replay = response.headers.get('Upload-Replayed');
-                if (replay !== 'true' && replay !== 'false')
-                    throw new UploadError(502, 'Missing or invalid upload creation replay receipt; inspect before recovery');
-                validateUploadState(receipt, replay === 'true');
-            }
-            return receipt;
-        }
-        finally {
-            if (retirement)
-                activeRetirements--;
-            else
-                activeControls--;
-        }
-    }
-    const client = {
-        async beginUpload(input, signal, key) {
-            signal?.throwIfAborted();
-            if (!input || typeof input !== 'object' || Array.isArray(input))
-                throw new UploadError(400, 'Invalid upload request');
-            const declaration = { ...input };
-            validateUploadRequest(declaration);
-            const receipt = await metadata('upload', 'uploads', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(declaration), signal }, key);
-            if (receipt.size !== declaration.size || receipt.digest !== declaration.digest)
-                throw new UploadError(502, 'Upload receipt declaration mismatch');
-            return receipt;
-        },
-        async inspectUpload(id, signal) {
-            return metadata('upload', `uploads/${uploadRouteId(id)}`, { signal }, undefined, id);
-        },
-        async uploadChunk(id, offset, data, signal, key) {
-            signal?.throwIfAborted();
-            const start = uploadInteger(offset);
-            if (!(data instanceof Uint8Array))
-                throw new TypeError('Binary upload chunk required');
-            if (uploadByteLength(data) > options.maxChunkBytes)
-                throw new UploadError(413, 'Chunk limit exceeded');
-            if (!uploadByteLength(data))
-                throw new UploadError(400, 'Empty chunk; commit zero-length uploads directly');
-            const end = uploadInteger(String(start + BigInt(uploadByteLength(data))));
-            if (activeUploads >= concurrency)
-                throw new UploadError(429, 'Upload client concurrency bound');
-            activeUploads++;
-            try {
-                // Snapshot before asynchronous hashing; producers may reuse their buffers.
-                // The typed-array constructor copies actual octets without consulting
-                // a producer's replaceable iterator or allocating its yielded values.
-                const owned = new Uint8Array(data);
-                const hash = new Uint8Array(await crypto.subtle.digest('SHA-256', owned));
-                const response = await request(`uploads/${uploadRouteId(id)}/bytes`, { method: 'PUT', signal, body: owned,
-                    headers: { 'Content-Type': 'application/octet-stream', 'Content-Length': String(owned.length),
-                        'Upload-Offset': offset, 'Content-Digest': digestHeader(hash) } }, key);
-                const receipt = await control(response, 'upload', signal, id);
-                const replay = response.headers.get('Upload-Replayed');
-                const acknowledged = uploadInteger(receipt.committedOffset);
-                if (receipt.state !== 'open'
-                    || (replay !== 'true' && replay !== 'false')
-                    || acknowledged < end || (replay === 'false' && acknowledged !== end)) {
-                    throw new UploadError(502, 'Upload chunk acknowledgement mismatch; inspect before retrying');
-                }
-                return { ...receipt, replayed: replay === 'true' };
-            }
-            finally {
-                activeUploads--;
-            }
-        },
-        /** Source begins at the acknowledged offset. On cancellation, return() must
-         * settle any pending next(); opaque uncooperative producers cannot be stopped.
-         * No automatic mutation retries. */
-        async upload(id, source, input = {}) {
-            const { signal } = input;
-            signal?.throwIfAborted();
-            let offset = uploadInteger(input.offset ?? '0');
-            if (activeSources >= concurrency)
-                throw new UploadError(429, 'Upload client source concurrency bound');
-            activeSources++;
-            try {
-                // Borrowed source callbacks may replace public client methods. Retain
-                // this transfer's authenticated operations before acquiring its iterator.
-                const uploadChunk = client.uploadChunk.bind(client);
-                const inspectUpload = client.inspectUpload.bind(client);
-                let acknowledged = offset;
-                let declaration;
-                const iterator = source[Symbol.asyncIterator]();
-                let pending;
-                try {
-                    for (;;) {
-                        signal?.throwIfAborted();
-                        let abort;
-                        const canceled = new Promise((_, reject) => {
-                            abort = () => reject(signal.reason);
-                            signal?.addEventListener('abort', abort, { once: true });
-                        });
-                        let part;
-                        try {
-                            pending = Promise.resolve(iterator.next());
-                            part = await Promise.race([pending, canceled]);
-                            pending = undefined;
-                        }
-                        finally {
-                            signal?.removeEventListener('abort', abort);
-                        }
-                        signal?.throwIfAborted();
-                        if (part.done)
-                            break;
-                        const data = part.value;
-                        if (!(data instanceof Uint8Array))
-                            throw new TypeError('Binary upload source required');
-                        for (let i = 0; i < uploadByteLength(data); i += options.maxChunkBytes) {
-                            // Producer methods and typed-array species may allocate or replace
-                            // bytes. Copy only this admitted fragment using indexed octets.
-                            const chunk = new Uint8Array(Math.min(options.maxChunkBytes, uploadByteLength(data) - i));
-                            for (let j = 0; j < chunk.length; j++)
-                                chunk[j] = data[i + j];
-                            const receipt = await uploadChunk(id, String(offset), chunk, signal);
-                            if (declaration && (receipt.size !== declaration.size || receipt.digest !== declaration.digest)) {
-                                throw new UploadError(502, 'Upload declaration changed; inspect before recovery');
-                            }
-                            declaration ??= { size: receipt.size, digest: receipt.digest };
-                            const committed = uploadInteger(receipt.committedOffset);
-                            if (committed < acknowledged) {
-                                throw new UploadError(502, 'Upload progress lost; inspect before recovery');
-                            }
-                            if (committed > acknowledged)
-                                acknowledged = committed;
-                            offset += BigInt(chunk.length);
-                        }
-                    }
-                }
-                catch (error) {
-                    // Cleanup must drain the producer without replacing the local cause.
-                    try {
-                        await iterator.return?.();
-                    }
-                    catch { /* Preserve transfer failure. */ }
-                    await pending?.catch(() => { });
-                    signal?.throwIfAborted();
-                    throw error;
-                }
-                signal?.throwIfAborted();
-                const receipt = await inspectUpload(id, signal);
-                if (declaration && (receipt.size !== declaration.size || receipt.digest !== declaration.digest)) {
-                    throw new UploadError(502, 'Upload declaration changed; inspect before recovery');
-                }
-                if (!['open', 'committed'].includes(receipt.state) || uploadInteger(receipt.committedOffset) < acknowledged) {
-                    throw new UploadError(502, 'Upload progress lost or retired; inspect before recovery');
-                }
-                return receipt;
-            }
-            finally {
-                activeSources--;
-            }
-        },
-        async commitUpload(id, signal, key) {
-            return metadata('blob', `uploads/${uploadRouteId(id)}/commit`, { method: 'POST', signal }, key);
-        },
-        async abortUpload(id, signal, key) {
-            const receipt = await metadata('upload', `uploads/${uploadRouteId(id)}`, { method: 'DELETE', signal }, key, id);
-            if (receipt.state !== 'aborted')
-                throw new UploadError(502, 'Upload abort acknowledgement mismatch; inspect before retrying');
-            return receipt;
-        },
-        async inspectBlob(id, signal) {
-            return metadata('blob', `blobs/${uploadRouteId(id)}`, { signal }, undefined, id);
-        },
-        async readBlob(id, input = undefined, signal) {
-            const headers = new Headers();
-            if (input) {
-                // Bind the same exact positions for admission and transmission. Caller
-                // accessors must not replace a checked range before its header is built.
-                const { start: declaredStart, end: declaredEnd } = input;
-                const start = uploadInteger(declaredStart);
-                if (declaredEnd !== undefined && uploadInteger(declaredEnd) < start)
-                    throw new UploadError(400, 'Invalid blob range');
-                headers.set('Range', `bytes=${declaredStart}-${declaredEnd ?? ''}`);
-            }
-            return request(`blobs/${uploadRouteId(id)}/bytes`, { headers, signal });
-        },
-    };
-    return client;
-}

package/dist/remote-execution/wire-json.d.ts

@@ -1,4 +0,0 @@
-/** Parse bounded wire documents without duplicate-key ambiguity. Callers admit
- * byte length first. Container depth is checked before allocating decoded values;
- * JSON.parse remains authoritative for JSON syntax and primitive semantics. */
-export declare function parseWireJson(text: string): unknown;

package/dist/remote-execution/wire-json.js

@@ -1,44 +0,0 @@
-/** Parse bounded wire documents without duplicate-key ambiguity. Callers admit
- * byte length first. Container depth is checked before allocating decoded values;
- * JSON.parse remains authoritative for JSON syntax and primitive semantics. */
-export function parseWireJson(text) {
-    const stack = [];
-    for (let i = 0; i < text.length; i++) {
-        const token = text[i];
-        if (token === '"') {
-            const start = i;
-            for (i++; i < text.length; i++) {
-                if (text[i] === '\\') {
-                    i++;
-                    continue;
-                }
-                if (text[i] === '"')
-                    break;
-            }
-            if (i >= text.length)
-                throw new SyntaxError('Unterminated wire JSON string');
-            const container = stack.at(-1);
-            if (container?.object && container.key) {
-                const name = JSON.parse(text.slice(start, i + 1));
-                if (container.names.has(name))
-                    throw new SyntaxError('Duplicate wire JSON key');
-                container.names.add(name);
-                container.key = false;
-            }
-        }
-        else if (token === '{' || token === '[') {
-            if (stack.length >= 64)
-                throw new SyntaxError('Wire JSON nesting bound');
-            stack.push({ object: token === '{', key: token === '{', names: new Set() });
-        }
-        else if (token === '}' || token === ']') {
-            const container = stack.pop();
-            if (!container || container.object !== (token === '}'))
-                throw new SyntaxError('Invalid wire JSON container');
-        }
-        else if (token === ',' && stack.at(-1)?.object) {
-            stack.at(-1).key = true;
-        }
-    }
-    return JSON.parse(text);
-}

package/dist/remote-execution/wire-validation.js

@@ -1,131 +0,0 @@
-import { wireDefinitions } from './wire.generated.js';
-function invalid() { throw new TypeError('Invalid v1 wire record'); }
-function decimal(value, signed) {
-    const digits = signed && value.startsWith('-') ? value.slice(1) : value;
-    if (!digits.length || digits.length > 20 || (digits.length > 1 && digits[0] === '0') || value === '-0' || Array.from(digits).some(c => c < '0' || c > '9'))
-        invalid();
-    const n = BigInt(value);
-    if (n < (signed ? -9223372036854775808n : 0n) || n > (signed ? 9223372036854775807n : 18446744073709551615n))
-        invalid();
-}
-function visit(schema, value) {
-    if (schema.$ref)
-        return validateWire(schema.$ref.split('/').at(-1), value);
-    if (schema.if) {
-        let matches = false;
-        try {
-            visit(schema.if, value);
-            matches = true;
-        }
-        catch { /* condition does not match */ }
-        const branch = matches ? schema.then : schema.else;
-        if (branch)
-            visit(branch, value);
-    }
-    if (schema.not) {
-        let matches = false;
-        try {
-            visit(schema.not, value);
-            matches = true;
-        }
-        catch { /* excluded shape */ }
-        if (matches)
-            invalid();
-    }
-    for (const branch of schema.allOf ?? [])
-        visit(branch, value);
-    if (schema.oneOf || schema.anyOf) {
-        let matches = 0;
-        for (const branch of schema.oneOf ?? schema.anyOf) {
-            try {
-                visit(branch, value);
-                matches++;
-            }
-            catch { /* alternative */ }
-        }
-        if (matches < 1 || (schema.oneOf && matches !== 1))
-            invalid();
-    }
-    if (Object.hasOwn(schema, 'const') && value !== schema.const)
-        invalid();
-    if (schema.enum && !schema.enum.includes(value))
-        invalid();
-    if (schema.required && (!value || typeof value !== 'object' || schema.required.some(key => !Object.hasOwn(value, key))))
-        invalid();
-    switch (schema.type) {
-        case 'null':
-            if (value !== null)
-                invalid();
-            break;
-        case 'boolean':
-            if (typeof value !== 'boolean')
-                invalid();
-            break;
-        case 'integer':
-        case 'number':
-            if (typeof value !== 'number' || !Number.isFinite(value) || (schema.type === 'integer' && !Number.isSafeInteger(value)) || value < (schema.minimum ?? -Infinity) || value > (schema.maximum ?? Infinity))
-                invalid();
-            break;
-        case 'string':
-            if (typeof value !== 'string' || value.length < (schema.minLength ?? 0) || value.length > (schema.maxLength ?? Infinity))
-                invalid();
-            // These are the schema's three lexical domains, checked without regexes.
-            if (schema.pattern) {
-                if (schema.pattern.includes('a-f')) {
-                    if (value.length !== 64 || Array.from(value).some(c => !'0123456789abcdef'.includes(c)))
-                        invalid();
-                }
-                else if (schema.pattern.includes('[0-9]'))
-                    decimal(value, schema.pattern.includes('-?'));
-                else
-                    invalid();
-            }
-            if (schema.format === 'date-time' && !Number.isFinite(Date.parse(value)))
-                invalid();
-            break;
-        case 'array':
-            if (!Array.isArray(value) || value.length < (schema.minItems ?? 0) || value.length > (schema.maxItems ?? Infinity))
-                invalid();
-            if (schema.uniqueItems && new Set(value.map(v => JSON.stringify(v))).size !== value.length)
-                invalid();
-            for (let index = 0; index < value.length; index++) {
-                if (!Object.hasOwn(value, index))
-                    invalid();
-                visit(schema.items ?? {}, value[index]);
-            }
-            break;
-        case 'object':
-            if (!value || typeof value !== 'object' || Array.isArray(value))
-                invalid();
-            break;
-    }
-    // JSON Schema object constraints also apply when a conditional omits type.
-    if (value && typeof value === 'object' && !Array.isArray(value)) {
-        const record = value;
-        if (schema.required?.some(key => !Object.hasOwn(record, key)))
-            invalid();
-        for (const [key, v] of Object.entries(record)) {
-            const property = schema.properties && Object.hasOwn(schema.properties, key) ? schema.properties[key] : undefined;
-            if (property)
-                visit(property, v);
-            else if (schema.additionalProperties === false)
-                invalid();
-            else if (typeof schema.additionalProperties === 'object')
-                visit(schema.additionalProperties, v);
-        }
-    }
-}
-/** Schema validation grants no file or process authority. Call only after bounding
- * input bytes; admission must additionally check grants, capabilities and sizes. */
-export function validateWire(name, value) {
-    if (!Object.hasOwn(wireDefinitions, name))
-        invalid();
-    visit(wireDefinitions[name], value);
-    if (name === 'FileOffset' || name === 'Timestamp') {
-        if (typeof value !== 'string')
-            invalid();
-        decimal(value, name === 'Timestamp');
-        if (name === 'FileOffset' && BigInt(value) > 9223372036854775807n)
-            invalid();
-    }
-}