@push.rocks/smartlinuxrepo 0.0.0-stage → 0.1.0

package/dist_ts/alpine/reader.js

@@ -0,0 +1,89 @@
+import { LinuxRepoError, truncated } from '../shared/errors.js';
+import { resolveLinuxPackageLimits } from '../shared/limits.js';
+import { BufferReader, readUpTo } from '../readers/bytes.js';
+import { PackageByteSource } from '../readers/bytesource.js';
+import { readGzipMember } from '../readers/gzipmember.js';
+import { readTarEntryData, TarReader } from '../readers/tar.js';
+import { parseAlpinePackageInfo } from './pkginfo.js';
+const PKGINFO = '.PKGINFO';
+/**
+ * Reads an apk v2 package (concatenated gzip members: usually the signature,
+ * the control segment holding `.PKGINFO`, and the data) into a record, as
+ * Gitea 28.2.0's `ParsePackage` does (`modules/packages/alpine/metadata.go:77-134`):
+ * - gzip members are read one at a time; the first member whose tar holds an
+ *   entry named exactly `.PKGINFO` is the control segment. Unsigned packages
+ *   (no signature member) are accepted;
+ * - `digests.controlSha1` is the SHA-1 of exactly that member's bytes (the
+ *   APKINDEX `C:` value is `Q1` plus its base64);
+ * - the rest of the input is hashed, never decompressed;
+ * - the record's `fileName` is Gitea's `{name}-{version}.apk`.
+ *
+ * Each member read before the control segment is buffered and bounded by
+ * `maxMetadataBytes` (member bytes) and `maxDecompressedMetadataBytes` (its
+ * tar). An apk v3 (ADB) package is `unsupported-package-format`, as Gitea
+ * refuses it too. On failure the reader stops pulling and returns no record.
+ */
+export async function readAlpinePackage(sourceArg, limitsArg) {
+    const limits = resolveLinuxPackageLimits(limitsArg);
+    const input = new PackageByteSource(sourceArg, limits.maxPackageBytes);
+    const head = await readUpTo(input, 3);
+    if (head.length === 0) {
+        throw truncated('apk package');
+    }
+    if (head.length === 3 && head[0] === 0x41 && head[1] === 0x44 && head[2] === 0x42) {
+        throw new LinuxRepoError('unsupported-package-format', 'apk v3 (ADB) packages are not supported', {
+            field: 'apk package',
+        });
+    }
+    input.unread(head);
+    for (;;) {
+        const member = await readGzipMember(input, {
+            maxMemberBytes: limits.maxMetadataBytes,
+            memberLimit: 'maxMetadataBytes',
+            maxOutputBytes: limits.maxDecompressedMetadataBytes,
+            outputLimit: 'maxDecompressedMetadataBytes',
+            maxHeaderBytes: limits.maxHeaderBytes,
+        });
+        if (member === null) {
+            throw new LinuxRepoError('missing-field', 'the package has no .PKGINFO', { field: PKGINFO });
+        }
+        const tar = new TarReader(new BufferReader(member.output), {
+            maxEntries: limits.maxEntries,
+            maxHeaderBytes: limits.maxHeaderBytes,
+        });
+        for (let entry = await tar.next(); entry !== null; entry = await tar.next()) {
+            if (entry.name !== PKGINFO) {
+                continue;
+            }
+            // Gitea stops at the first .PKGINFO and ignores the rest of the member's tar
+            const pkginfo = await readTarEntryData(entry, limits.maxDecompressedMetadataBytes, 'maxDecompressedMetadataBytes');
+            const info = parseAlpinePackageInfo(pkginfo, limits);
+            await input.drain();
+            const digests = input.digests();
+            return {
+                format: 'alpine',
+                name: info.name,
+                version: info.version,
+                architecture: info.architecture,
+                fileName: `${info.name}-${info.version}.apk`,
+                digests: { ...digests, controlSha1: member.memberSha1 },
+                metadata: {
+                    description: info.description,
+                    license: info.license,
+                    projectUrl: info.projectUrl,
+                    maintainer: info.maintainer,
+                    packager: info.packager,
+                    buildDate: info.buildDate,
+                    installedSize: info.installedSize,
+                    origin: info.origin,
+                    commit: info.commit,
+                    installIf: info.installIf,
+                    provides: info.provides,
+                    dependencies: info.dependencies,
+                    providerPriority: info.providerPriority,
+                },
+            };
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVhZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvYWxwaW5lL3JlYWRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ2hFLE9BQU8sRUFBRSx5QkFBeUIsRUFBNEIsTUFBTSxxQkFBcUIsQ0FBQztBQUUxRixPQUFPLEVBQUUsWUFBWSxFQUFFLFFBQVEsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQzdELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQzdELE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQUMxRCxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsU0FBUyxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDaEUsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBRXRELE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQztBQUUzQjs7Ozs7Ozs7Ozs7Ozs7OztHQWdCRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsaUJBQWlCLENBQ3JDLFNBQW9DLEVBQ3BDLFNBQXdDO0lBRXhDLE1BQU0sTUFBTSxHQUFHLHlCQUF5QixDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3BELE1BQU0sS0FBSyxHQUFHLElBQUksaUJBQWlCLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxlQUFlLENBQUMsQ0FBQztJQUV2RSxNQUFNLElBQUksR0FBRyxNQUFNLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDdEMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3RCLE1BQU0sU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ2pDLENBQUM7SUFDRCxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsS0FBSyxJQUFJLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDbEYsTUFBTSxJQUFJLGNBQWMsQ0FBQyw0QkFBNEIsRUFBRSx5Q0FBeUMsRUFBRTtZQUNoRyxLQUFLLEVBQUUsYUFBYTtTQUNyQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUVuQixTQUFTLENBQUM7UUFDUixNQUFNLE1BQU0sR0FBRyxNQUFNLGNBQWMsQ0FBQyxLQUFLLEVBQUU7WUFDekMsY0FBYyxFQUFFLE1BQU0sQ0FBQyxnQkFBZ0I7WUFDdkMsV0FBVyxFQUFFLGtCQUFrQjtZQUMvQixjQUFjLEVBQUUsTUFBTSxDQUFDLDRCQUE0QjtZQUNuRCxXQUFXLEVBQUUsOEJBQThCO1lBQzNDLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYztTQUN0QyxDQUFDLENBQUM7UUFDSCxJQUFJLE1BQU0sS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNwQixNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSw2QkFBNkIsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQy9GLENBQUM7UUFDRCxNQUFNLEdBQUcsR0FBRyxJQUFJLFNBQVMsQ0FBQyxJQUFJLFlBQVksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUU7WUFDekQsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO1lBQzdCLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYztTQUN0QyxDQUFDLENBQUM7UUFDSCxLQUFLLElBQUksS0FBSyxHQUFHLE1BQU0sR0FBRyxDQUFDLElBQUksRUFBRSxFQUFFLEtBQUssS0FBSyxJQUFJLEVBQUUsS0FBSyxHQUFHLE1BQU0sR0FBRyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDNUUsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLE9BQU8sRUFBRSxDQUFDO2dCQUMzQixTQUFTO1lBQ1gsQ0FBQztZQUNELDZFQUE2RTtZQUM3RSxNQUFNLE9BQU8sR0FBRyxNQUFNLGdCQUFnQixDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsNEJBQTRCLEVBQUUsOEJBQThCLENBQUMsQ0FBQztZQUNuSCxNQUFNLElBQUksR0FBRyxzQkFBc0IsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDckQsTUFBTSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDcEIsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2hDLE9BQU87Z0JBQ0wsTUFBTSxFQUFFLFFBQVE7Z0JBQ2hCLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtnQkFDZixPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU87Z0JBQ3JCLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtnQkFDL0IsUUFBUSxFQUFFLEdBQUcsSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsT0FBTyxNQUFNO2dCQUM1QyxPQUFPLEVBQUUsRUFBRSxHQUFHLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRTtnQkFDdkQsUUFBUSxFQUFFO29CQUNSLFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVztvQkFDN0IsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO29CQUNyQixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7b0JBQzNCLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVTtvQkFDM0IsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO29CQUN2QixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7b0JBQ3pCLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYTtvQkFDakMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO29CQUNuQixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07b0JBQ25CLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztvQkFDekIsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO29CQUN2QixZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7b0JBQy9CLGdCQUFnQixFQUFFLElBQUksQ0FBQyxnQkFBZ0I7aUJBQ3hDO2FBQ0YsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist_ts/arch/builder.d.ts

@@ -0,0 +1,41 @@
+import type { IArchPackageRecord, ILinuxIndexFile } from '../shared/types.js';
+import { type IOpenPgpSigner } from '../signing/signers.js';
+/** One package of an Arch repository index. */
+export interface IArchIndexEntry {
+    record: IArchPackageRecord;
+    /**
+     * The package's detached signature (the `.sig` file's bytes) as stored at
+     * upload time; written as `%PGPSIG%`. Without it the entry has no
+     * `%PGPSIG%` and pacman fetches `<file>.sig`. The builder never signs a package.
+     */
+    packageSignature?: Uint8Array;
+}
+/**
+ * Builds the Arch index files of one repository: for every architecture that
+ * has packages, the gzip tar `packages.db` and its detached signature, as
+ * Gitea 28.2.0 `buildPackagesIndex` builds them.
+ *
+ * - `any` packages also go into every other architecture's index.
+ * - Each index lists one version per package (Gitea's identity: the
+ *   lower-cased name), the newest by pacman's version comparison; versions
+ *   that compare equal are ordered by architecture (the index's own before
+ *   `any`), then bytewise by version and file name, so input order never decides.
+ * - Entries are written sorted bytewise by `<name>-<version>`, each as
+ *   `<name>-<version>/files` then `<name>-<version>/desc`.
+ * - Only the index is signed (binary detached signature over the gzip bytes).
+ *
+ * Paths are `<repository>/<architecture>/packages.db` and `packages.db.sig`
+ * (no repository prefix when `repository` is `''`), without aliases: the
+ * request names Gitea maps onto them (`<repo>.db`, `.files`, the `any`
+ * fallback) are the consumer's route, documented in the readme.
+ */
+export declare function buildArchIndex(inputArg: {
+    repository: string;
+    entries: IArchIndexEntry[];
+    signer: IOpenPgpSigner;
+    timestamp: Date;
+}): Promise<ILinuxIndexFile[]>;
+/** The `desc` member of one entry (`repository.go:353-379`). */
+export declare function renderArchDesc(entryArg: IArchIndexEntry): string;
+/** The `files` member of one entry (`repository.go:346-350`). */
+export declare function renderArchFiles(recordArg: IArchPackageRecord): string;

package/dist_ts/arch/builder.js

@@ -0,0 +1,234 @@
+import * as plugins from '../plugins.js';
+import { isIndexableArchitecture } from '../shared/architecture.js';
+import { LinuxRepoError } from '../shared/errors.js';
+import { assertBytes, assertSegmentName, assertTimestamp, hasControlCharacter } from '../shared/validation.js';
+import { createDetachedBinarySignature } from '../signing/openpgpframing.js';
+import { singleChunk } from '../signing/signers.js';
+import { writeGoTar } from '../writers/gotar.js';
+import { ARCH_NAME_PATTERN, ARCH_VERSION_PATTERN } from './reader.js';
+import { compareArchVersions } from './vercmp.js';
+/** Gitea's stored name of the index archive (`services/packages/arch/repository.go:37`). */
+const INDEX_ARCHIVE_NAME = 'packages.db';
+const ANY_ARCHITECTURE = 'any';
+/** `int64(os.ModePerm)` (`repository.go:393`). */
+const ENTRY_MODE = 0o777;
+/**
+ * Builds the Arch index files of one repository: for every architecture that
+ * has packages, the gzip tar `packages.db` and its detached signature, as
+ * Gitea 28.2.0 `buildPackagesIndex` builds them.
+ *
+ * - `any` packages also go into every other architecture's index.
+ * - Each index lists one version per package (Gitea's identity: the
+ *   lower-cased name), the newest by pacman's version comparison; versions
+ *   that compare equal are ordered by architecture (the index's own before
+ *   `any`), then bytewise by version and file name, so input order never decides.
+ * - Entries are written sorted bytewise by `<name>-<version>`, each as
+ *   `<name>-<version>/files` then `<name>-<version>/desc`.
+ * - Only the index is signed (binary detached signature over the gzip bytes).
+ *
+ * Paths are `<repository>/<architecture>/packages.db` and `packages.db.sig`
+ * (no repository prefix when `repository` is `''`), without aliases: the
+ * request names Gitea maps onto them (`<repo>.db`, `.files`, the `any`
+ * fallback) are the consumer's route, documented in the readme.
+ */
+export async function buildArchIndex(inputArg) {
+    if (inputArg === null || typeof inputArg !== 'object') {
+        throw new LinuxRepoError('invalid-input', 'input must be an object', { field: 'input' });
+    }
+    assertRepository(inputArg.repository);
+    assertTimestamp(inputArg.timestamp);
+    if (inputArg.signer === null || typeof inputArg.signer !== 'object' || typeof inputArg.signer.signBinary !== 'function') {
+        throw new LinuxRepoError('invalid-input', 'signer must be an IOpenPgpSigner', { field: 'signer' });
+    }
+    if (!Array.isArray(inputArg.entries)) {
+        throw new LinuxRepoError('invalid-input', 'entries must be an array', { field: 'entries' });
+    }
+    const fileNames = new Set();
+    for (const entry of inputArg.entries) {
+        assertEntry(entry);
+        if (fileNames.has(entry.record.fileName)) {
+            throw new LinuxRepoError('invalid-input', `duplicate package file ${entry.record.fileName}`, {
+                field: 'entries',
+                value: entry.record.fileName,
+            });
+        }
+        fileNames.add(entry.record.fileName);
+    }
+    if (inputArg.entries.length === 0) {
+        return [];
+    }
+    const architectures = [...new Set(inputArg.entries.map((entry) => entry.record.architecture))].sort(compareText);
+    const files = [];
+    for (const architecture of architectures) {
+        const candidates = inputArg.entries.filter((entry) => entry.record.architecture === architecture ||
+            (architecture !== ANY_ARCHITECTURE && entry.record.architecture === ANY_ARCHITECTURE));
+        const selected = selectLatest(candidates, architecture);
+        const tarFiles = selected.flatMap((entry) => {
+            const directory = `${entry.record.name}-${entry.record.version}`;
+            return [
+                { name: `${directory}/files`, mode: ENTRY_MODE, data: encodeText(renderArchFiles(entry.record)) },
+                { name: `${directory}/desc`, mode: ENTRY_MODE, data: encodeText(renderArchDesc(entry)) },
+            ];
+        });
+        const archive = toUint8Array(plugins.zlib.gzipSync(writeGoTar(tarFiles)));
+        const signature = await createDetachedBinarySignature({
+            data: singleChunk(archive),
+            signer: inputArg.signer,
+            timestamp: inputArg.timestamp,
+        });
+        const directory = inputArg.repository === '' ? architecture : `${inputArg.repository}/${architecture}`;
+        files.push(indexFile(`${directory}/${INDEX_ARCHIVE_NAME}`, archive, 'application/gzip'), indexFile(`${directory}/${INDEX_ARCHIVE_NAME}.sig`, signature, 'application/pgp-signature'));
+    }
+    return files.sort((a, b) => compareText(a.path, b.path));
+}
+/** The `desc` member of one entry (`repository.go:353-379`). */
+export function renderArchDesc(entryArg) {
+    const record = entryArg.record;
+    const metadata = record.metadata;
+    const signature = entryArg.packageSignature === undefined ? '' : toBuffer(entryArg.packageSignature).toString('base64');
+    return renderFields([
+        ['FILENAME', record.fileName],
+        ['MD5SUM', record.digests.md5],
+        ['SHA256SUM', record.digests.sha256],
+        ['PGPSIG', signature],
+        ['CSIZE', String(record.digests.size)],
+        ['ISIZE', String(metadata.installedSize)],
+        ['NAME', record.name],
+        ['BASE', metadata.base],
+        ['ARCH', record.architecture],
+        ['VERSION', record.version],
+        ['DESC', metadata.description],
+        ['URL', metadata.projectUrl],
+        ['LICENSE', joinFields(metadata.licenses)],
+        ['GROUPS', joinFields(metadata.groups)],
+        ['BUILDDATE', String(metadata.buildDate)],
+        ['PACKAGER', metadata.packager],
+        ['PROVIDES', joinFields(metadata.provides)],
+        ['REPLACES', joinFields(metadata.replaces)],
+        ['CONFLICTS', joinFields(metadata.conflicts)],
+        ['DEPENDS', joinFields(metadata.depends)],
+        ['OPTDEPENDS', joinFields(metadata.optDepends)],
+        ['MAKEDEPENDS', joinFields(metadata.makeDepends)],
+        ['CHECKDEPENDS', joinFields(metadata.checkDepends)],
+    ]);
+}
+/** The `files` member of one entry (`repository.go:346-350`). */
+export function renderArchFiles(recordArg) {
+    return renderFields([['FILES', joinFields(recordArg.metadata.files)]]);
+}
+/** `writeFields`: `%KEY%\nvalue\n\n` per non-empty value. */
+function renderFields(fieldsArg) {
+    let text = '';
+    for (const [key, value] of fieldsArg) {
+        if (value !== '') {
+            text += `%${key}%\n${value}\n\n`;
+        }
+    }
+    return text;
+}
+/** `joinFields`: LF-joined, dropping values that contain CR or LF (they would forge index lines). */
+function joinFields(valuesArg) {
+    return valuesArg.filter((value) => !/[\n\r]/.test(value)).join('\n');
+}
+function selectLatest(entriesArg, architectureArg) {
+    const latest = new Map();
+    for (const entry of entriesArg) {
+        const key = entry.record.name.toLowerCase();
+        const current = latest.get(key);
+        if (current === undefined || isPreferred(entry, current, architectureArg)) {
+            latest.set(key, entry);
+        }
+    }
+    return [...latest.values()].sort((a, b) => compareText(`${a.record.name}-${a.record.version}`, `${b.record.name}-${b.record.version}`));
+}
+/** True when `candidateArg` wins over `currentArg`: newer by alpm, then the tie order. */
+function isPreferred(candidateArg, currentArg, architectureArg) {
+    const byVersion = compareArchVersions(candidateArg.record.version, currentArg.record.version);
+    if (byVersion !== 0) {
+        return byVersion > 0;
+    }
+    const ownArchitecture = (entryArg) => (entryArg.record.architecture === architectureArg ? 0 : 1);
+    const byArchitecture = ownArchitecture(candidateArg) - ownArchitecture(currentArg);
+    if (byArchitecture !== 0) {
+        return byArchitecture < 0;
+    }
+    const byVersionText = compareText(candidateArg.record.version, currentArg.record.version);
+    if (byVersionText !== 0) {
+        return byVersionText < 0;
+    }
+    return compareText(candidateArg.record.fileName, currentArg.record.fileName) < 0;
+}
+function indexFile(pathArg, bytesArg, mediaTypeArg) {
+    return {
+        path: pathArg,
+        bytes: bytesArg,
+        sha256: plugins.crypto.createHash('sha256').update(bytesArg).digest('hex'),
+        mediaType: mediaTypeArg,
+        stage: 'pointer',
+        aliases: [],
+    };
+}
+/** `''`, or `/`-separated segments that are non-empty, not `.` or `..`, and free of control characters. */
+function assertRepository(valueArg) {
+    if (typeof valueArg !== 'string') {
+        throw new LinuxRepoError('invalid-input', 'repository must be a string', { field: 'repository' });
+    }
+    if (valueArg === '') {
+        return;
+    }
+    for (const segment of valueArg.split('/')) {
+        if (segment === '' || segment === '.' || segment === '..' || hasControlCharacter(segment)) {
+            throw new LinuxRepoError('invalid-input', 'repository segments must be non-empty, not "." or "..", and free of control characters', { field: 'repository' });
+        }
+    }
+}
+/**
+ * The record values that become index paths and lines must be what the
+ * reader produces: Gitea's name and version patterns, an indexable
+ * architecture, a file name that is one path segment.
+ */
+function assertEntry(entryArg) {
+    if (entryArg === null || typeof entryArg !== 'object') {
+        throw new LinuxRepoError('invalid-input', 'each entry must be an object', { field: 'entries' });
+    }
+    const entry = entryArg;
+    const record = entry.record;
+    if (record === null || typeof record !== 'object' || record.format !== 'arch') {
+        throw new LinuxRepoError('invalid-input', 'each entry needs an Arch package record', { field: 'entries' });
+    }
+    if (typeof record.fileName !== 'string') {
+        throw new LinuxRepoError('invalid-input', 'record.fileName must be a string', { field: 'record.fileName' });
+    }
+    if (typeof record.name !== 'string' || !ARCH_NAME_PATTERN.test(record.name)) {
+        throw new LinuxRepoError('invalid-input', `package ${record.fileName} has an invalid name`, {
+            field: 'record.name',
+            value: record.fileName,
+        });
+    }
+    if (typeof record.version !== 'string' || !ARCH_VERSION_PATTERN.test(record.version)) {
+        throw new LinuxRepoError('invalid-input', `package ${record.fileName} has an invalid version`, {
+            field: 'record.version',
+            value: record.fileName,
+        });
+    }
+    if (!isIndexableArchitecture(record.architecture)) {
+        throw new LinuxRepoError('invalid-input', `package ${record.fileName} has an architecture that cannot name an index path`, { field: 'record.architecture', value: record.fileName });
+    }
+    assertSegmentName(record.fileName, 'record.fileName');
+    if (entry.packageSignature !== undefined) {
+        assertBytes(entry.packageSignature, 'packageSignature');
+    }
+}
+function compareText(aArg, bArg) {
+    return Buffer.compare(Buffer.from(aArg, 'utf8'), Buffer.from(bArg, 'utf8'));
+}
+function encodeText(textArg) {
+    return new TextEncoder().encode(textArg);
+}
+function toBuffer(bytesArg) {
+    return Buffer.from(bytesArg.buffer, bytesArg.byteOffset, bytesArg.byteLength);
+}
+function toUint8Array(bufferArg) {
+    return new Uint8Array(bufferArg.buffer, bufferArg.byteOffset, bufferArg.byteLength);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGRlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2FyY2gvYnVpbGRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUN6QyxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUNwRSxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFckQsT0FBTyxFQUFFLFdBQVcsRUFBRSxpQkFBaUIsRUFBRSxlQUFlLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUMvRyxPQUFPLEVBQUUsNkJBQTZCLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUM3RSxPQUFPLEVBQUUsV0FBVyxFQUF1QixNQUFNLHVCQUF1QixDQUFDO0FBQ3pFLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNqRCxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDdEUsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBYWxELDRGQUE0RjtBQUM1RixNQUFNLGtCQUFrQixHQUFHLGFBQWEsQ0FBQztBQUN6QyxNQUFNLGdCQUFnQixHQUFHLEtBQUssQ0FBQztBQUMvQixrREFBa0Q7QUFDbEQsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDO0FBRXpCOzs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FrQkc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGNBQWMsQ0FBQyxRQUtwQztJQUNDLElBQUksUUFBUSxLQUFLLElBQUksSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN0RCxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSx5QkFBeUIsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzNGLENBQUM7SUFDRCxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDdEMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNwQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssSUFBSSxJQUFJLE9BQU8sUUFBUSxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksT0FBTyxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUN4SCxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxrQ0FBa0MsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3JHLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNyQyxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSwwQkFBMEIsRUFBRSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3BDLEtBQUssTUFBTSxLQUFLLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3JDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuQixJQUFJLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ3pDLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLDBCQUEwQixLQUFLLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxFQUFFO2dCQUMzRixLQUFLLEVBQUUsU0FBUztnQkFDaEIsS0FBSyxFQUFFLEtBQUssQ0FBQyxNQUFNLENBQUMsUUFBUTthQUM3QixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZDLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUVELE1BQU0sYUFBYSxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ2pILE1BQU0sS0FBSyxHQUFzQixFQUFFLENBQUM7SUFDcEMsS0FBSyxNQUFNLFlBQVksSUFBSSxhQUFhLEVBQUUsQ0FBQztRQUN6QyxNQUFNLFVBQVUsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FDeEMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUNSLEtBQUssQ0FBQyxNQUFNLENBQUMsWUFBWSxLQUFLLFlBQVk7WUFDMUMsQ0FBQyxZQUFZLEtBQUssZ0JBQWdCLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxZQUFZLEtBQUssZ0JBQWdCLENBQUMsQ0FDeEYsQ0FBQztRQUNGLE1BQU0sUUFBUSxHQUFHLFlBQVksQ0FBQyxVQUFVLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDeEQsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1lBQzFDLE1BQU0sU0FBUyxHQUFHLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNqRSxPQUFPO2dCQUNMLEVBQUUsSUFBSSxFQUFFLEdBQUcsU0FBUyxRQUFRLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsVUFBVSxDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRTtnQkFDakcsRUFBRSxJQUFJLEVBQUUsR0FBRyxTQUFTLE9BQU8sRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxVQUFVLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUU7YUFDekYsQ0FBQztRQUNKLENBQUMsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDMUUsTUFBTSxTQUFTLEdBQUcsTUFBTSw2QkFBNkIsQ0FBQztZQUNwRCxJQUFJLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQztZQUMxQixNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU07WUFDdkIsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTO1NBQzlCLENBQUMsQ0FBQztRQUNILE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxVQUFVLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLEdBQUcsUUFBUSxDQUFDLFVBQVUsSUFBSSxZQUFZLEVBQUUsQ0FBQztRQUN2RyxLQUFLLENBQUMsSUFBSSxDQUNSLFNBQVMsQ0FBQyxHQUFHLFNBQVMsSUFBSSxrQkFBa0IsRUFBRSxFQUFFLE9BQU8sRUFBRSxrQkFBa0IsQ0FBQyxFQUM1RSxTQUFTLENBQUMsR0FBRyxTQUFTLElBQUksa0JBQWtCLE1BQU0sRUFBRSxTQUFTLEVBQUUsMkJBQTJCLENBQUMsQ0FDNUYsQ0FBQztJQUNKLENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztBQUMzRCxDQUFDO0FBRUQsZ0VBQWdFO0FBQ2hFLE1BQU0sVUFBVSxjQUFjLENBQUMsUUFBeUI7SUFDdEQsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQztJQUMvQixNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDO0lBQ2pDLE1BQU0sU0FBUyxHQUNiLFFBQVEsQ0FBQyxnQkFBZ0IsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4RyxPQUFPLFlBQVksQ0FBQztRQUNsQixDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDO1FBQzdCLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDO1FBQzlCLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQ3BDLENBQUMsUUFBUSxFQUFFLFNBQVMsQ0FBQztRQUNyQixDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN0QyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ3pDLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUM7UUFDckIsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLElBQUksQ0FBQztRQUN2QixDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDO1FBQzdCLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUM7UUFDM0IsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLFdBQVcsQ0FBQztRQUM5QixDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsVUFBVSxDQUFDO1FBQzVCLENBQUMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN2QyxDQUFDLFdBQVcsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3pDLENBQUMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUM7UUFDL0IsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMzQyxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzNDLENBQUMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDN0MsQ0FBQyxTQUFTLEVBQUUsVUFBVSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN6QyxDQUFDLFlBQVksRUFBRSxVQUFVLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQy9DLENBQUMsYUFBYSxFQUFFLFVBQVUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDakQsQ0FBQyxjQUFjLEVBQUUsVUFBVSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQztLQUNwRCxDQUFDLENBQUM7QUFDTCxDQUFDO0FBRUQsaUVBQWlFO0FBQ2pFLE1BQU0sVUFBVSxlQUFlLENBQUMsU0FBNkI7SUFDM0QsT0FBTyxZQUFZLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN6RSxDQUFDO0FBRUQsNkRBQTZEO0FBQzdELFNBQVMsWUFBWSxDQUFDLFNBQWtDO0lBQ3RELElBQUksSUFBSSxHQUFHLEVBQUUsQ0FBQztJQUNkLEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUNyQyxJQUFJLEtBQUssS0FBSyxFQUFFLEVBQUUsQ0FBQztZQUNqQixJQUFJLElBQUksSUFBSSxHQUFHLE1BQU0sS0FBSyxNQUFNLENBQUM7UUFDbkMsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUM7QUFFRCxxR0FBcUc7QUFDckcsU0FBUyxVQUFVLENBQUMsU0FBbUI7SUFDckMsT0FBTyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDdkUsQ0FBQztBQUVELFNBQVMsWUFBWSxDQUFDLFVBQTZCLEVBQUUsZUFBdUI7SUFDMUUsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLEVBQTJCLENBQUM7SUFDbEQsS0FBSyxNQUFNLEtBQUssSUFBSSxVQUFVLEVBQUUsQ0FBQztRQUMvQixNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUM1QyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2hDLElBQUksT0FBTyxLQUFLLFNBQVMsSUFBSSxXQUFXLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxlQUFlLENBQUMsRUFBRSxDQUFDO1lBQzFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3pCLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQ3hDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxJQUFJLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLEVBQUUsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQzVGLENBQUM7QUFDSixDQUFDO0FBRUQsMEZBQTBGO0FBQzFGLFNBQVMsV0FBVyxDQUFDLFlBQTZCLEVBQUUsVUFBMkIsRUFBRSxlQUF1QjtJQUN0RyxNQUFNLFNBQVMsR0FBRyxtQkFBbUIsQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzlGLElBQUksU0FBUyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3BCLE9BQU8sU0FBUyxHQUFHLENBQUMsQ0FBQztJQUN2QixDQUFDO0lBQ0QsTUFBTSxlQUFlLEdBQUcsQ0FBQyxRQUF5QixFQUFFLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsWUFBWSxLQUFLLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNsSCxNQUFNLGNBQWMsR0FBRyxlQUFlLENBQUMsWUFBWSxDQUFDLEdBQUcsZUFBZSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ25GLElBQUksY0FBYyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE9BQU8sY0FBYyxHQUFHLENBQUMsQ0FBQztJQUM1QixDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQUcsV0FBVyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDMUYsSUFBSSxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDeEIsT0FBTyxhQUFhLEdBQUcsQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFDRCxPQUFPLFdBQVcsQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUNuRixDQUFDO0FBRUQsU0FBUyxTQUFTLENBQUMsT0FBZSxFQUFFLFFBQW9CLEVBQUUsWUFBb0I7SUFDNUUsT0FBTztRQUNMLElBQUksRUFBRSxPQUFPO1FBQ2IsS0FBSyxFQUFFLFFBQVE7UUFDZixNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7UUFDMUUsU0FBUyxFQUFFLFlBQVk7UUFDdkIsS0FBSyxFQUFFLFNBQVM7UUFDaEIsT0FBTyxFQUFFLEVBQUU7S0FDWixDQUFDO0FBQ0osQ0FBQztBQUVELDJHQUEyRztBQUMzRyxTQUFTLGdCQUFnQixDQUFDLFFBQWlCO0lBQ3pDLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDakMsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsNkJBQTZCLEVBQUUsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQztJQUNwRyxDQUFDO0lBQ0QsSUFBSSxRQUFRLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDcEIsT0FBTztJQUNULENBQUM7SUFDRCxLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMxQyxJQUFJLE9BQU8sS0FBSyxFQUFFLElBQUksT0FBTyxLQUFLLEdBQUcsSUFBSSxPQUFPLEtBQUssSUFBSSxJQUFJLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDMUYsTUFBTSxJQUFJLGNBQWMsQ0FDdEIsZUFBZSxFQUNmLHdGQUF3RixFQUN4RixFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsQ0FDeEIsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxTQUFTLFdBQVcsQ0FBQyxRQUFpQjtJQUNwQyxJQUFJLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDdEQsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsOEJBQThCLEVBQUUsRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsUUFBb0MsQ0FBQztJQUNuRCxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDO0lBQzVCLElBQUksTUFBTSxLQUFLLElBQUksSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztRQUM5RSxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSx5Q0FBeUMsRUFBRSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzdHLENBQUM7SUFDRCxJQUFJLE9BQU8sTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN4QyxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxrQ0FBa0MsRUFBRSxFQUFFLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxDQUFDLENBQUM7SUFDOUcsQ0FBQztJQUNELElBQUksT0FBTyxNQUFNLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUM1RSxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxXQUFXLE1BQU0sQ0FBQyxRQUFRLHNCQUFzQixFQUFFO1lBQzFGLEtBQUssRUFBRSxhQUFhO1lBQ3BCLEtBQUssRUFBRSxNQUFNLENBQUMsUUFBUTtTQUN2QixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsSUFBSSxPQUFPLE1BQU0sQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ3JGLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLFdBQVcsTUFBTSxDQUFDLFFBQVEseUJBQXlCLEVBQUU7WUFDN0YsS0FBSyxFQUFFLGdCQUFnQjtZQUN2QixLQUFLLEVBQUUsTUFBTSxDQUFDLFFBQVE7U0FDdkIsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUNsRCxNQUFNLElBQUksY0FBYyxDQUN0QixlQUFlLEVBQ2YsV0FBVyxNQUFNLENBQUMsUUFBUSxxREFBcUQsRUFDL0UsRUFBRSxLQUFLLEVBQUUscUJBQXFCLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FDekQsQ0FBQztJQUNKLENBQUM7SUFDRCxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDdEQsSUFBSSxLQUFLLENBQUMsZ0JBQWdCLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDekMsV0FBVyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO0lBQzFELENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxXQUFXLENBQUMsSUFBWSxFQUFFLElBQVk7SUFDN0MsT0FBTyxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7QUFDOUUsQ0FBQztBQUVELFNBQVMsVUFBVSxDQUFDLE9BQWU7SUFDakMsT0FBTyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUMzQyxDQUFDO0FBRUQsU0FBUyxRQUFRLENBQUMsUUFBb0I7SUFDcEMsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7QUFDaEYsQ0FBQztBQUVELFNBQVMsWUFBWSxDQUFDLFNBQWlCO0lBQ3JDLE9BQU8sSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUN0RixDQUFDIn0=

package/dist_ts/arch/reader.d.ts

@@ -0,0 +1,16 @@
+import { type ILinuxPackageLimits } from '../shared/limits.js';
+import type { IArchPackageRecord } from '../shared/types.js';
+/** Gitea `namePattern` (`modules/packages/arch/metadata.go:47`). */
+export declare const ARCH_NAME_PATTERN: RegExp;
+/** Gitea `versionPattern` (`metadata.go:49`); Go's `\d` and `\w` are ASCII, as in a JS RegExp without `u`. */
+export declare const ARCH_VERSION_PATTERN: RegExp;
+/**
+ * Reads an Arch package (`.pkg.tar.zst`, `.xz` or `.gz`, chosen by magic as
+ * Gitea 28.2.0 does) into a record: `.PKGINFO` metadata and the file list,
+ * derived exactly as Gitea's `arch.ParsePackage`, plus the size and digests of
+ * the whole file. The whole payload is decompressed (bounded by
+ * `maxPayloadBytes`) because the file list needs every tar entry, and to the
+ * end of the compressed stream, so a cut or corrupt container is refused
+ * even where it lies past the tar end marker (Go stops reading there).
+ */
+export declare function readArchPackage(sourceArg: AsyncIterable<Uint8Array>, limitsArg?: Partial<ILinuxPackageLimits>): Promise<IArchPackageRecord>;