@push.rocks/smartlinuxrepo 0.0.0-stage → 0.1.0

package/dist_ts/shared/architecture.js

@@ -0,0 +1,17 @@
+/**
+ * Whether an architecture can name an index path segment. Readers record any
+ * architecture a package states (Gitea accepts them); builders refuse an entry
+ * whose architecture fails this rule with `invalid-input`, and never skip it
+ * silently. Refused: the empty string, `.` and `..`, and any value containing
+ * `/`, whitespace or a control character.
+ */
+export function isIndexableArchitecture(architectureArg) {
+    if (typeof architectureArg !== 'string') {
+        return false;
+    }
+    if (architectureArg === '' || architectureArg === '.' || architectureArg === '..') {
+        return false;
+    }
+    return !/[/\s\p{Cc}]/u.test(architectureArg);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXJjaGl0ZWN0dXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvc2hhcmVkL2FyY2hpdGVjdHVyZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7O0dBTUc7QUFDSCxNQUFNLFVBQVUsdUJBQXVCLENBQUMsZUFBdUI7SUFDN0QsSUFBSSxPQUFPLGVBQWUsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN4QyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLGVBQWUsS0FBSyxFQUFFLElBQUksZUFBZSxLQUFLLEdBQUcsSUFBSSxlQUFlLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDbEYsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsT0FBTyxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLENBQUM7QUFDL0MsQ0FBQyJ9

package/dist_ts/shared/errors.d.ts

@@ -0,0 +1,38 @@
+import type { ILinuxPackageLimits } from './limits.js';
+/**
+ * Stable error codes.
+ * - `limit-exceeded`: an `ILinuxPackageLimits` bound was crossed (`detail.limit` names it).
+ * - `unsupported-compression`: a compression the format does not allow.
+ * - `malformed-archive`: broken container structure (ar, tar, gzip, xz, zstd framing or data).
+ * - `malformed-header`: a broken package header (RPM lead and headers).
+ * - `missing-field` / `invalid-field`: package metadata that is absent or not acceptable.
+ * - `unsupported-package-format`: input that is not the expected package format, or uses a form of it
+ *   the codec does not read (the data of a sparse tar entry).
+ * - `truncated`: only a clean early end of input.
+ * - `digest-mismatch`: a digest the package carries does not match its bytes.
+ * - `invalid-input`: a bad argument from the caller.
+ * - `invalid-key`: a key the codec cannot use.
+ * - `signing-failed`: a codec signer failed, or a signer returned something that is not signature bytes.
+ *
+ * The codec never wraps an error it did not raise: an error from the caller's
+ * source or from a caller-supplied signer propagates unchanged. An underlying
+ * error the codec reacts to is kept in the standard `cause`.
+ */
+export type TLinuxRepoErrorCode = 'limit-exceeded' | 'unsupported-compression' | 'malformed-archive' | 'malformed-header' | 'missing-field' | 'invalid-field' | 'unsupported-package-format' | 'truncated' | 'digest-mismatch' | 'invalid-input' | 'invalid-key' | 'signing-failed';
+/** Names the field, structure or limit an error is about. */
+export interface ILinuxRepoErrorDetail {
+    field?: string;
+    limit?: keyof ILinuxPackageLimits;
+    value?: number | string;
+}
+export declare class LinuxRepoError extends Error {
+    readonly code: TLinuxRepoErrorCode;
+    readonly detail: Readonly<ILinuxRepoErrorDetail>;
+    constructor(codeArg: TLinuxRepoErrorCode, messageArg: string, detailArg?: ILinuxRepoErrorDetail, optionsArg?: {
+        cause?: unknown;
+    });
+}
+/** Builds the `limit-exceeded` error for one limit. */
+export declare function limitExceeded(limitArg: keyof ILinuxPackageLimits, maximumArg: number, whatArg: string): LinuxRepoError;
+/** Builds the `truncated` error for a structure the input ended inside. */
+export declare function truncated(whatArg: string): LinuxRepoError;

package/dist_ts/shared/errors.js

@@ -0,0 +1,22 @@
+export class LinuxRepoError extends Error {
+    code;
+    detail;
+    constructor(codeArg, messageArg, detailArg = {}, optionsArg) {
+        super(messageArg, optionsArg !== undefined && 'cause' in optionsArg ? { cause: optionsArg.cause } : undefined);
+        this.name = 'LinuxRepoError';
+        this.code = codeArg;
+        this.detail = Object.freeze({ ...detailArg });
+    }
+}
+/** Builds the `limit-exceeded` error for one limit. */
+export function limitExceeded(limitArg, maximumArg, whatArg) {
+    return new LinuxRepoError('limit-exceeded', `${whatArg} exceeds ${limitArg} (${maximumArg})`, {
+        limit: limitArg,
+        value: maximumArg,
+    });
+}
+/** Builds the `truncated` error for a structure the input ended inside. */
+export function truncated(whatArg) {
+    return new LinuxRepoError('truncated', `input ended inside ${whatArg}`, { field: whatArg });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvc2hhcmVkL2Vycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUEwQ0EsTUFBTSxPQUFPLGNBQWUsU0FBUSxLQUFLO0lBQ3ZCLElBQUksQ0FBc0I7SUFDMUIsTUFBTSxDQUFrQztJQUV4RCxZQUNFLE9BQTRCLEVBQzVCLFVBQWtCLEVBQ2xCLFNBQVMsR0FBMEIsRUFBRSxFQUNyQyxVQUFnQztRQUVoQyxLQUFLLENBQ0gsVUFBVSxFQUNWLFVBQVUsS0FBSyxTQUFTLElBQUksT0FBTyxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQzVGLENBQUM7UUFDRixJQUFJLENBQUMsSUFBSSxHQUFHLGdCQUFnQixDQUFDO1FBQzdCLElBQUksQ0FBQyxJQUFJLEdBQUcsT0FBTyxDQUFDO1FBQ3BCLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEdBQUcsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNoRCxDQUFDO0NBQ0Y7QUFFRCx1REFBdUQ7QUFDdkQsTUFBTSxVQUFVLGFBQWEsQ0FDM0IsUUFBbUMsRUFDbkMsVUFBa0IsRUFDbEIsT0FBZTtJQUVmLE9BQU8sSUFBSSxjQUFjLENBQUMsZ0JBQWdCLEVBQUUsR0FBRyxPQUFPLFlBQVksUUFBUSxLQUFLLFVBQVUsR0FBRyxFQUFFO1FBQzVGLEtBQUssRUFBRSxRQUFRO1FBQ2YsS0FBSyxFQUFFLFVBQVU7S0FDbEIsQ0FBQyxDQUFDO0FBQ0wsQ0FBQztBQUVELDJFQUEyRTtBQUMzRSxNQUFNLFVBQVUsU0FBUyxDQUFDLE9BQWU7SUFDdkMsT0FBTyxJQUFJLGNBQWMsQ0FBQyxXQUFXLEVBQUUsc0JBQXNCLE9BQU8sRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7QUFDOUYsQ0FBQyJ9

package/dist_ts/shared/gopath.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Go 1.27 `path` semantics (slash-separated paths) the codec mirrors where
+ * Gitea 28.2.0 output depends on them.
+ */
+/** Go `path.Clean` (`src/path/path.go:72`). */
+export declare function goPathClean(pathArg: string): string;
+/**
+ * Go `path.Join` (`src/path/path.go:155`): empty elements are ignored, the
+ * result is cleaned, and all-empty input gives `''`.
+ */
+export declare function goPathJoin(elementsArg: string[]): string;
+/** Go `path.Base` (`src/path/path.go:192`). */
+export declare function goPathBase(pathArg: string): string;

package/dist_ts/shared/gopath.js

@@ -0,0 +1,53 @@
+/**
+ * Go 1.27 `path` semantics (slash-separated paths) the codec mirrors where
+ * Gitea 28.2.0 output depends on them.
+ */
+/** Go `path.Clean` (`src/path/path.go:72`). */
+export function goPathClean(pathArg) {
+    if (pathArg === '') {
+        return '.';
+    }
+    const rooted = pathArg.startsWith('/');
+    const parts = [];
+    for (const element of pathArg.split('/')) {
+        if (element === '' || element === '.') {
+            continue;
+        }
+        if (element === '..') {
+            if (parts.length > 0 && parts[parts.length - 1] !== '..') {
+                parts.pop();
+            }
+            else if (!rooted) {
+                parts.push('..');
+            }
+            continue;
+        }
+        parts.push(element);
+    }
+    const joined = parts.join('/');
+    if (rooted) {
+        return `/${joined}`;
+    }
+    return joined === '' ? '.' : joined;
+}
+/**
+ * Go `path.Join` (`src/path/path.go:155`): empty elements are ignored, the
+ * result is cleaned, and all-empty input gives `''`.
+ */
+export function goPathJoin(elementsArg) {
+    const joined = elementsArg.filter((element) => element !== '').join('/');
+    return joined === '' ? '' : goPathClean(joined);
+}
+/** Go `path.Base` (`src/path/path.go:192`). */
+export function goPathBase(pathArg) {
+    if (pathArg === '') {
+        return '.';
+    }
+    let path = pathArg.replace(/\/+$/, '');
+    const slash = path.lastIndexOf('/');
+    if (slash >= 0) {
+        path = path.slice(slash + 1);
+    }
+    return path === '' ? '/' : path;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ29wYXRoLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvc2hhcmVkL2dvcGF0aC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFFSCwrQ0FBK0M7QUFDL0MsTUFBTSxVQUFVLFdBQVcsQ0FBQyxPQUFlO0lBQ3pDLElBQUksT0FBTyxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ25CLE9BQU8sR0FBRyxDQUFDO0lBQ2IsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDdkMsTUFBTSxLQUFLLEdBQWEsRUFBRSxDQUFDO0lBQzNCLEtBQUssTUFBTSxPQUFPLElBQUksT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pDLElBQUksT0FBTyxLQUFLLEVBQUUsSUFBSSxPQUFPLEtBQUssR0FBRyxFQUFFLENBQUM7WUFDdEMsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNyQixJQUFJLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO2dCQUN6RCxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDZCxDQUFDO2lCQUFNLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDbkIsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUNuQixDQUFDO1lBQ0QsU0FBUztRQUNYLENBQUM7UUFDRCxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3RCLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQy9CLElBQUksTUFBTSxFQUFFLENBQUM7UUFDWCxPQUFPLElBQUksTUFBTSxFQUFFLENBQUM7SUFDdEIsQ0FBQztJQUNELE9BQU8sTUFBTSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7QUFDdEMsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sVUFBVSxVQUFVLENBQUMsV0FBcUI7SUFDOUMsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN6RSxPQUFPLE1BQU0sS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBQ2xELENBQUM7QUFFRCwrQ0FBK0M7QUFDL0MsTUFBTSxVQUFVLFVBQVUsQ0FBQyxPQUFlO0lBQ3hDLElBQUksT0FBTyxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ25CLE9BQU8sR0FBRyxDQUFDO0lBQ2IsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZDLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDcEMsSUFBSSxLQUFLLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDZixJQUFJLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDL0IsQ0FBQztJQUNELE9BQU8sSUFBSSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7QUFDbEMsQ0FBQyJ9

package/dist_ts/shared/gostrings.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Go standard-library string semantics the Arch and Alpine readers mirror, so
+ * derived values match Gitea 28.2.0 (`modules/packages/{arch,alpine}/metadata.go`).
+ */
+/**
+ * Go `strings.TrimSpace`: trims Unicode `White_Space` (Go `unicode.IsSpace`).
+ * Unlike `String.prototype.trim` it keeps U+FEFF and trims U+0085.
+ */
+export declare function goTrimSpace(valueArg: string): string;
+/**
+ * Go `strconv.ParseInt(value, 10, 64)`: an optional sign and ASCII digits,
+ * within int64. Returns `null` where Go returns an error.
+ */
+export declare function goParseInt64(valueArg: string): bigint | null;

package/dist_ts/shared/gostrings.js

@@ -0,0 +1,29 @@
+/**
+ * Go standard-library string semantics the Arch and Alpine readers mirror, so
+ * derived values match Gitea 28.2.0 (`modules/packages/{arch,alpine}/metadata.go`).
+ */
+/**
+ * Go `strings.TrimSpace`: trims Unicode `White_Space` (Go `unicode.IsSpace`).
+ * Unlike `String.prototype.trim` it keeps U+FEFF and trims U+0085.
+ */
+export function goTrimSpace(valueArg) {
+    return valueArg.replace(GO_SPACE_START, '').replace(GO_SPACE_END, '');
+}
+const GO_SPACE_CLASS = '[\\t\\n\\v\\f\\r \\u0085\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000]';
+const GO_SPACE_START = new RegExp(`^${GO_SPACE_CLASS}+`);
+const GO_SPACE_END = new RegExp(`${GO_SPACE_CLASS}+$`);
+/**
+ * Go `strconv.ParseInt(value, 10, 64)`: an optional sign and ASCII digits,
+ * within int64. Returns `null` where Go returns an error.
+ */
+export function goParseInt64(valueArg) {
+    if (!/^[+-]?[0-9]+$/.test(valueArg)) {
+        return null;
+    }
+    const value = BigInt(valueArg);
+    if (value > 0x7fffffffffffffffn || value < -0x8000000000000000n) {
+        return null;
+    }
+    return value;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ29zdHJpbmdzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvc2hhcmVkL2dvc3RyaW5ncy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFFSDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsV0FBVyxDQUFDLFFBQWdCO0lBQzFDLE9BQU8sUUFBUSxDQUFDLE9BQU8sQ0FBQyxjQUFjLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsQ0FBQztBQUN4RSxDQUFDO0FBRUQsTUFBTSxjQUFjLEdBQUcsMkZBQTJGLENBQUM7QUFDbkgsTUFBTSxjQUFjLEdBQUcsSUFBSSxNQUFNLENBQUMsSUFBSSxjQUFjLEdBQUcsQ0FBQyxDQUFDO0FBQ3pELE1BQU0sWUFBWSxHQUFHLElBQUksTUFBTSxDQUFDLEdBQUcsY0FBYyxJQUFJLENBQUMsQ0FBQztBQUV2RDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsWUFBWSxDQUFDLFFBQWdCO0lBQzNDLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDcEMsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQy9CLElBQUksS0FBSyxHQUFHLG1CQUFtQixJQUFJLEtBQUssR0FBRyxDQUFDLG1CQUFtQixFQUFFLENBQUM7UUFDaEUsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDIn0=

package/dist_ts/shared/limits.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Hard bounds for reading a package. Callers override them per call with a
+ * `Partial`; every value is a positive safe integer. The defaults accept
+ * everything a stock Gitea 28.2.0 stores except a deb control member that
+ * decompresses past 32 MiB (see `DEFAULT_LINUX_PACKAGE_LIMITS`); an override
+ * below a default may refuse packages Gitea accepts.
+ */
+export interface ILinuxPackageLimits {
+    /** The whole package input, in bytes. */
+    maxPackageBytes: number;
+    /**
+     * One buffered metadata unit, in bytes: the apk control gzip member, the deb
+     * control member, or the RPM signature header plus main header.
+     */
+    maxMetadataBytes: number;
+    /** The decompressed deb `control.tar`, the apk control tar, or Arch's `.PKGINFO`, in bytes. */
+    maxDecompressedMetadataBytes: number;
+    /** The decompressed Arch payload walked for the file list, in bytes. */
+    maxPayloadBytes: number;
+    /** Tar or ar entries per archive, and values per multi-valued metadata field. */
+    maxEntries: number;
+    /** Total bytes of Arch file names. */
+    maxFileListBytes: number;
+    /**
+     * One tar header chain (the header blocks plus PAX records and GNU long
+     * names), or one metadata line, in bytes. RPM headers count under
+     * `maxMetadataBytes`, not here.
+     */
+    maxHeaderBytes: number;
+}
+/**
+ * The default limits. They accept anything a stock Gitea 28.2.0 stores in
+ * practice (Gitea has no package size cap), with one exception:
+ * - `maxDecompressedMetadataBytes` is Gitea's 32 MiB deb control bound, but
+ *   Gitea cuts the decompressed stream there and keeps a `control` found
+ *   before the cut, where the codec refuses the member with `limit-exceeded`;
+ * - `maxEntries` and `maxFileListBytes` are Gitea's Arch file-list caps
+ *   (Alpine's 1024 `.PKGINFO` values fold into `maxEntries`);
+ * - `maxHeaderBytes` covers a full PAX + GNU long name + GNU long link chain at
+ *   Go `archive/tar`'s 1 MiB per special record, and Gitea's 64 KiB line limit.
+ */
+export declare const DEFAULT_LINUX_PACKAGE_LIMITS: Readonly<ILinuxPackageLimits>;
+/**
+ * Merges per-call overrides over the defaults. Unknown keys and values that
+ * are not positive safe integers are refused with `invalid-input`.
+ */
+export declare function resolveLinuxPackageLimits(overrides?: Partial<ILinuxPackageLimits>): Readonly<ILinuxPackageLimits>;

package/dist_ts/shared/limits.js

@@ -0,0 +1,57 @@
+import { LinuxRepoError } from './errors.js';
+const KiB = 1024;
+const MiB = 1024 * KiB;
+const GiB = 1024 * MiB;
+/**
+ * The default limits. They accept anything a stock Gitea 28.2.0 stores in
+ * practice (Gitea has no package size cap), with one exception:
+ * - `maxDecompressedMetadataBytes` is Gitea's 32 MiB deb control bound, but
+ *   Gitea cuts the decompressed stream there and keeps a `control` found
+ *   before the cut, where the codec refuses the member with `limit-exceeded`;
+ * - `maxEntries` and `maxFileListBytes` are Gitea's Arch file-list caps
+ *   (Alpine's 1024 `.PKGINFO` values fold into `maxEntries`);
+ * - `maxHeaderBytes` covers a full PAX + GNU long name + GNU long link chain at
+ *   Go `archive/tar`'s 1 MiB per special record, and Gitea's 64 KiB line limit.
+ */
+export const DEFAULT_LINUX_PACKAGE_LIMITS = Object.freeze({
+    maxPackageBytes: 8 * GiB,
+    maxMetadataBytes: 64 * MiB,
+    maxDecompressedMetadataBytes: 32 * MiB,
+    maxPayloadBytes: 16 * GiB,
+    maxEntries: 100_000,
+    maxFileListBytes: 16 * MiB,
+    maxHeaderBytes: 4 * MiB,
+});
+const LIMIT_KEYS = Object.keys(DEFAULT_LINUX_PACKAGE_LIMITS);
+/**
+ * Merges per-call overrides over the defaults. Unknown keys and values that
+ * are not positive safe integers are refused with `invalid-input`.
+ */
+export function resolveLinuxPackageLimits(overrides) {
+    if (overrides === undefined) {
+        return DEFAULT_LINUX_PACKAGE_LIMITS;
+    }
+    if (overrides === null || typeof overrides !== 'object' || Array.isArray(overrides)) {
+        throw new LinuxRepoError('invalid-input', 'limits must be an object', { field: 'limits' });
+    }
+    const resolved = { ...DEFAULT_LINUX_PACKAGE_LIMITS };
+    for (const key of Object.keys(overrides)) {
+        if (!LIMIT_KEYS.includes(key)) {
+            throw new LinuxRepoError('invalid-input', `unknown limit "${key}"`, { field: 'limits', value: key });
+        }
+        const limitKey = key;
+        const value = overrides[limitKey];
+        if (value === undefined) {
+            continue;
+        }
+        if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
+            throw new LinuxRepoError('invalid-input', `limit ${limitKey} must be a positive safe integer`, {
+                field: 'limits',
+                limit: limitKey,
+            });
+        }
+        resolved[limitKey] = value;
+    }
+    return Object.freeze(resolved);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGltaXRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvc2hhcmVkL2xpbWl0cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBaUM3QyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUM7QUFDakIsTUFBTSxHQUFHLEdBQUcsSUFBSSxHQUFHLEdBQUcsQ0FBQztBQUN2QixNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsR0FBRyxDQUFDO0FBRXZCOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBa0MsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RixlQUFlLEVBQUUsQ0FBQyxHQUFHLEdBQUc7SUFDeEIsZ0JBQWdCLEVBQUUsRUFBRSxHQUFHLEdBQUc7SUFDMUIsNEJBQTRCLEVBQUUsRUFBRSxHQUFHLEdBQUc7SUFDdEMsZUFBZSxFQUFFLEVBQUUsR0FBRyxHQUFHO0lBQ3pCLFVBQVUsRUFBRSxPQUFPO0lBQ25CLGdCQUFnQixFQUFFLEVBQUUsR0FBRyxHQUFHO0lBQzFCLGNBQWMsRUFBRSxDQUFDLEdBQUcsR0FBRztDQUN4QixDQUFDLENBQUM7QUFFSCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLDRCQUE0QixDQUFxQyxDQUFDO0FBRWpHOzs7R0FHRztBQUNILE1BQU0sVUFBVSx5QkFBeUIsQ0FDdkMsU0FBd0M7SUFFeEMsSUFBSSxTQUFTLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDNUIsT0FBTyw0QkFBNEIsQ0FBQztJQUN0QyxDQUFDO0lBQ0QsSUFBSSxTQUFTLEtBQUssSUFBSSxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDcEYsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsMEJBQTBCLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM3RixDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQXdCLEVBQUUsR0FBRyw0QkFBNEIsRUFBRSxDQUFDO0lBQzFFLEtBQUssTUFBTSxHQUFHLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBRSxVQUF1QixDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzVDLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLGtCQUFrQixHQUFHLEdBQUcsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDdkcsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLEdBQWdDLENBQUM7UUFDbEQsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2xDLElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3hCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUM1RSxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxTQUFTLFFBQVEsa0NBQWtDLEVBQUU7Z0JBQzdGLEtBQUssRUFBRSxRQUFRO2dCQUNmLEtBQUssRUFBRSxRQUFRO2FBQ2hCLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsS0FBSyxDQUFDO0lBQzdCLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDakMsQ0FBQyJ9

package/dist_ts/shared/types.d.ts

@@ -0,0 +1,213 @@
+/**
+ * The persisted record shapes of `@push.rocks/smartlinuxrepo`.
+ *
+ * Records are public API: every field is plain JSON (strings,
+ * integers within `Number.MAX_SAFE_INTEGER`, booleans, arrays and objects; no
+ * `Date`, no `Uint8Array`). Hashes are lowercase hex. Every 1.0.0 key is
+ * required and always present, using Gitea's zero values (`''`, `0`, `[]`);
+ * keys added in a later minor are optional because older persisted records lack
+ * them. Changing a shape needs a major release. The union is not closed: a
+ * later minor may add a fifth format.
+ */
+/** The package formats the codec reads and indexes. */
+export type TLinuxPackageFormat = 'alpine' | 'debian' | 'rpm' | 'arch';
+/** Size and digests over the whole package file. */
+export interface ILinuxPackageDigests {
+    /** Byte count of the whole file. */
+    size: number;
+    md5: string;
+    sha1: string;
+    sha256: string;
+    sha512: string;
+}
+export interface IAlpinePackageDigests extends ILinuxPackageDigests {
+    /**
+     * SHA-1 of the exact bytes of the gzip member holding `.PKGINFO`. The
+     * APKINDEX `C:` value is `'Q1'` plus the base64 of these 20 bytes.
+     */
+    controlSha1: string;
+}
+export interface ILinuxPackageRecordBase {
+    format: TLinuxPackageFormat;
+    name: string;
+    /** Gitea's version string (RPM: `V-R`, or `E-V-R` with a dash when the epoch is not `0`). */
+    version: string;
+    /** The architecture as the package states it (`''` is possible for Alpine). */
+    architecture: string;
+    /** Gitea's stored file name for the package. */
+    fileName: string;
+    digests: ILinuxPackageDigests;
+}
+export interface IAlpinePackageMetadata {
+    description: string;
+    license: string;
+    /** The `.PKGINFO` url when Gitea's URL validation accepts it, else `''`. */
+    projectUrl: string;
+    maintainer: string;
+    packager: string;
+    buildDate: number;
+    installedSize: number;
+    origin: string;
+    commit: string;
+    installIf: string;
+    provides: string[];
+    dependencies: string[];
+    providerPriority: number;
+}
+export interface IAlpinePackageRecord extends ILinuxPackageRecordBase {
+    format: 'alpine';
+    digests: IAlpinePackageDigests;
+    metadata: IAlpinePackageMetadata;
+}
+export interface IDebianPackageMetadata {
+    /**
+     * Gitea's trimmed control stanza, exactly as Gitea 28.2.0 derives it. It is
+     * the source of truth for the `Packages` stanza. Index-owned fields a crafted
+     * control file carries (`Filename`, `Size`, `MD5sum`, `SHA1`, `SHA256`,
+     * `SHA512`) stay in this text; `renderDebianPackagesStanza` strips them
+     * because it writes those fields itself.
+     */
+    control: string;
+    /** The name part of the `Maintainer` field, as Gitea derives it. */
+    maintainer: string;
+    /** The `Homepage` field when Gitea's URL validation accepts it, else `''`. */
+    projectUrl: string;
+    description: string;
+    dependencies: string[];
+}
+export interface IDebianPackageRecord extends ILinuxPackageRecordBase {
+    format: 'debian';
+    metadata: IDebianPackageMetadata;
+}
+export interface IRpmDependency {
+    name: string;
+    flags: '' | 'EQ' | 'LT' | 'GT' | 'LE' | 'GE';
+    epoch: string;
+    version: string;
+    release: string;
+}
+export interface IRpmFile {
+    path: string;
+    type: '' | 'dir' | 'ghost';
+    isExecutable: boolean;
+}
+export interface IRpmChangelog {
+    author: string;
+    date: number;
+    text: string;
+}
+export interface IRpmPackageMetadata {
+    epoch: string;
+    upstreamVersion: string;
+    release: string;
+    /** True for a source RPM (lead type). `architecture` stays the ARCH tag, Gitea's identity and path segment. */
+    isSourcePackage: boolean;
+    summary: string;
+    description: string;
+    license: string;
+    /** The URL tag when Gitea's URL validation accepts it, else `''`. */
+    projectUrl: string;
+    vendor: string;
+    group: string;
+    packager: string;
+    sourceRpm: string;
+    buildHost: string;
+    buildTime: number;
+    fileTime: number;
+    installedSize: number;
+    archiveSize: number;
+    provides: IRpmDependency[];
+    requires: IRpmDependency[];
+    conflicts: IRpmDependency[];
+    obsoletes: IRpmDependency[];
+    files: IRpmFile[];
+    changelogs: IRpmChangelog[];
+}
+export interface IRpmPackageRecord extends ILinuxPackageRecordBase {
+    format: 'rpm';
+    metadata: IRpmPackageMetadata;
+}
+/**
+ * One RPM errata update (updateinfo `<update>`), plain JSON. Ported from Gitea
+ * 28.2.0 `modules/packages/rpm/metadata.go`. Dates are `YYYY-MM-DD HH:MM:SS`
+ * (UTC when the codec writes them) or `null`.
+ */
+export interface IRpmUpdate {
+    id: string;
+    from: string;
+    status: string;
+    type: string;
+    version: string;
+    title: string;
+    severity: string;
+    description: string;
+    issued: string | null;
+    updated: string | null;
+    references: IRpmUpdateReference[];
+    collections: IRpmUpdateCollection[];
+}
+export interface IRpmUpdateReference {
+    href: string;
+    id: string;
+    title: string;
+    type: string;
+}
+export interface IRpmUpdateCollection {
+    short: string;
+    packages: IRpmUpdatePackage[];
+}
+export interface IRpmUpdatePackage {
+    name: string;
+    version: string;
+    release: string;
+    arch: string;
+    src: string;
+    fileName: string;
+}
+export interface IArchPackageMetadata {
+    compression: 'zst' | 'xz' | 'gz';
+    base: string;
+    description: string;
+    /** The `.PKGINFO` url when Gitea's URL validation accepts it, else `''`. */
+    projectUrl: string;
+    licenses: string[];
+    installedSize: number;
+    buildDate: number;
+    packager: string;
+    groups: string[];
+    provides: string[];
+    replaces: string[];
+    depends: string[];
+    optDepends: string[];
+    makeDepends: string[];
+    checkDepends: string[];
+    conflicts: string[];
+    xdata: string[];
+    backup: string[];
+    files: string[];
+}
+export interface IArchPackageRecord extends ILinuxPackageRecordBase {
+    format: 'arch';
+    metadata: IArchPackageMetadata;
+}
+export type TLinuxPackageRecord = IAlpinePackageRecord | IDebianPackageRecord | IRpmPackageRecord | IArchPackageRecord;
+/**
+ * Write order of an index file: every `content` file is written before any
+ * `pointer` file (the signed top-level documents that name the content files).
+ */
+export type TLinuxIndexFileStage = 'content' | 'pointer';
+/**
+ * One file of a built index set. A builder returns the complete set of files
+ * that should exist; any previously written file not in the set is stale.
+ */
+export interface ILinuxIndexFile {
+    /** Path relative to the format root, in Gitea's layout. */
+    path: string;
+    bytes: Uint8Array;
+    /** Lowercase hex SHA-256 of `bytes`. */
+    sha256: string;
+    mediaType: string;
+    stage: TLinuxIndexFileStage;
+    /** Other paths serving the same bytes (Debian `by-hash/<ALGO>/<hex>` for every listed hash). */
+    aliases: string[];
+}

package/dist_ts/shared/types.js

@@ -0,0 +1,13 @@
+/**
+ * The persisted record shapes of `@push.rocks/smartlinuxrepo`.
+ *
+ * Records are public API: every field is plain JSON (strings,
+ * integers within `Number.MAX_SAFE_INTEGER`, booleans, arrays and objects; no
+ * `Date`, no `Uint8Array`). Hashes are lowercase hex. Every 1.0.0 key is
+ * required and always present, using Gitea's zero values (`''`, `0`, `[]`);
+ * keys added in a later minor are optional because older persisted records lack
+ * them. Changing a shape needs a major release. The union is not closed: a
+ * later minor may add a fifth format.
+ */
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9zaGFyZWQvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7Ozs7R0FVRyJ9

package/dist_ts/shared/url.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Gitea 28.2.0's URL check for package metadata (`validation.IsValidURL`,
+ * `modules/validation/helpers.go:42-50`): Go 1.27's `url.ParseRequestURI`
+ * succeeds, the scheme is `http` or `https` (case-insensitive), and the host's
+ * port part holds only digits (`portOnly`/`validPort`,
+ * `modules/validation/binding.go:131-152`; no range check, an empty port
+ * passes). Readers keep a URL field only when this returns true.
+ *
+ * The port follows Go's `net/url` byte for byte on the UTF-8 encoding of the
+ * value, including its quirks: `http:x` is an opaque URL and passes,
+ * `http://` (empty host) passes, a query or fragment is never validated, and a
+ * `#` before the first `/` is part of the host and fails. Only the parts of the
+ * parser that can change the result for `http`/`https` are ported. Expected
+ * values come from Go: `test/fixtures/url/isvalidurl.gitea.json`.
+ *
+ * Internal: not exported from the package entry.
+ */
+export declare function isValidUrl(valueArg: string): boolean;