@push.rocks/smartlinuxrepo 0.0.0-stage → 0.1.0

package/dist_ts/debian/reader.d.ts

@@ -0,0 +1,30 @@
+import { type ILinuxPackageLimits } from '../shared/limits.js';
+import type { IDebianPackageRecord } from '../shared/types.js';
+/**
+ * Reads a `.deb` package in one pass into Gitea 28.2.0's record
+ * (`modules/packages/debian/metadata.go:92-163`).
+ *
+ * - The `ar` members are walked in order; `debian-binary` is not required.
+ *   The first member whose name starts with `control.tar` (a trailing `/`
+ *   stripped from the suffix) is decompressed: `control.tar`, `.gz`, `.xz` or
+ *   `.zst`; any other suffix is `unsupported-compression`.
+ * - In it, the first regular entry whose base name is `control` is parsed. A
+ *   control archive without one moves on to the next `ar` member, as Gitea
+ *   does; none at all is `missing-field` (`control`).
+ * - The control member is decoded to the decoder's end on both paths, after
+ *   the control file is parsed and when it holds none: a cut or corrupt
+ *   control member is `truncated` or `malformed-archive` in every form, where
+ *   Gitea, which stops at the control entry, accepts it. For a plain
+ *   `control.tar` the end is the end of its `ar` member; the bytes after the
+ *   tar end marker are read, not parsed.
+ * - Once the control file is parsed the `ar` archive is not walked further:
+ *   the rest of the input is only hashed (`metadata.go:155-156`).
+ * - Bounds: the control member's compressed size by `maxMetadataBytes`, its
+ *   decompressed bytes by `maxDecompressedMetadataBytes` (Gitea's 32 MiB),
+ *   tar entries and `ar` members by `maxEntries`, tar header chains and
+ *   control lines by `maxHeaderBytes`, the whole input by `maxPackageBytes`.
+ *   A control member that decompresses past `maxDecompressedMetadataBytes` is
+ *   `limit-exceeded` even when `control` comes first, where Gitea cuts the
+ *   stream at 32 MiB and keeps a `control` found before the cut.
+ */
+export declare function readDebianPackage(source: AsyncIterable<Uint8Array>, limits?: Partial<ILinuxPackageLimits>): Promise<IDebianPackageRecord>;

package/dist_ts/debian/reader.js

@@ -0,0 +1,110 @@
+import { LinuxRepoError, limitExceeded } from '../shared/errors.js';
+import { resolveLinuxPackageLimits } from '../shared/limits.js';
+import { goPathBase } from '../shared/gopath.js';
+import { ArReader } from '../readers/ar.js';
+import { skipToEnd } from '../readers/bytes.js';
+import { PackageByteSource } from '../readers/bytesource.js';
+import { withDecompressingReader } from '../readers/decompress.js';
+import { readTarEntryData, TarReader } from '../readers/tar.js';
+import { parseDebianControlFile } from './control.js';
+const CONTROL_TAR = 'control.tar';
+/** The control archive forms Gitea 28.2.0 reads (`metadata.go:108-136`). */
+const CONTROL_COMPRESSIONS = {
+    '': 'none',
+    '.gz': 'gzip',
+    '.xz': 'xz',
+    '.zst': 'zstd',
+};
+/**
+ * Reads a `.deb` package in one pass into Gitea 28.2.0's record
+ * (`modules/packages/debian/metadata.go:92-163`).
+ *
+ * - The `ar` members are walked in order; `debian-binary` is not required.
+ *   The first member whose name starts with `control.tar` (a trailing `/`
+ *   stripped from the suffix) is decompressed: `control.tar`, `.gz`, `.xz` or
+ *   `.zst`; any other suffix is `unsupported-compression`.
+ * - In it, the first regular entry whose base name is `control` is parsed. A
+ *   control archive without one moves on to the next `ar` member, as Gitea
+ *   does; none at all is `missing-field` (`control`).
+ * - The control member is decoded to the decoder's end on both paths, after
+ *   the control file is parsed and when it holds none: a cut or corrupt
+ *   control member is `truncated` or `malformed-archive` in every form, where
+ *   Gitea, which stops at the control entry, accepts it. For a plain
+ *   `control.tar` the end is the end of its `ar` member; the bytes after the
+ *   tar end marker are read, not parsed.
+ * - Once the control file is parsed the `ar` archive is not walked further:
+ *   the rest of the input is only hashed (`metadata.go:155-156`).
+ * - Bounds: the control member's compressed size by `maxMetadataBytes`, its
+ *   decompressed bytes by `maxDecompressedMetadataBytes` (Gitea's 32 MiB),
+ *   tar entries and `ar` members by `maxEntries`, tar header chains and
+ *   control lines by `maxHeaderBytes`, the whole input by `maxPackageBytes`.
+ *   A control member that decompresses past `maxDecompressedMetadataBytes` is
+ *   `limit-exceeded` even when `control` comes first, where Gitea cuts the
+ *   stream at 32 MiB and keeps a `control` found before the cut.
+ */
+export async function readDebianPackage(source, limits) {
+    const resolved = resolveLinuxPackageLimits(limits);
+    const input = new PackageByteSource(source, resolved.maxPackageBytes);
+    const control = await readControl(input, resolved);
+    await input.drain();
+    return {
+        format: 'debian',
+        name: control.name,
+        version: control.version,
+        architecture: control.architecture,
+        fileName: `${control.name}_${control.version}_${control.architecture}.deb`,
+        digests: input.digests(),
+        metadata: control.metadata,
+    };
+}
+async function readControl(inputArg, limitsArg) {
+    const archive = new ArReader(inputArg, limitsArg.maxEntries);
+    for (;;) {
+        const member = await archive.next();
+        if (member === null) {
+            throw new LinuxRepoError('missing-field', 'the package has no control file', { field: 'control' });
+        }
+        if (!member.name.startsWith(CONTROL_TAR)) {
+            continue;
+        }
+        const suffix = member.name.slice(CONTROL_TAR.length).replace(/\/$/, '');
+        const compression = Object.hasOwn(CONTROL_COMPRESSIONS, suffix) ? CONTROL_COMPRESSIONS[suffix] : undefined;
+        if (compression === undefined) {
+            throw new LinuxRepoError('unsupported-compression', `unsupported control archive "${member.name}"`, {
+                field: 'control.tar',
+                value: member.name,
+            });
+        }
+        if (member.size > limitsArg.maxMetadataBytes) {
+            throw limitExceeded('maxMetadataBytes', limitsArg.maxMetadataBytes, `control member ${member.name}`);
+        }
+        const control = await withDecompressingReader(member.body, compression, { maxOutputBytes: limitsArg.maxDecompressedMetadataBytes, outputLimit: 'maxDecompressedMetadataBytes' }, async (decompressed) => {
+            const tar = new TarReader(decompressed, {
+                maxEntries: limitsArg.maxEntries,
+                maxHeaderBytes: limitsArg.maxHeaderBytes,
+            });
+            let parsed = null;
+            for (;;) {
+                const entry = await tar.next();
+                if (entry === null) {
+                    break;
+                }
+                if (entry.typeflag !== '0' || goPathBase(entry.name) !== 'control') {
+                    continue;
+                }
+                const bytes = await readTarEntryData(entry, limitsArg.maxDecompressedMetadataBytes, 'maxDecompressedMetadataBytes');
+                parsed = parseDebianControlFile(bytes, limitsArg.maxHeaderBytes);
+                break;
+            }
+            // Gitea stops at the control entry; the codec decodes the member to
+            // the decoder's end, so a cut or corrupt control member is refused in
+            // every form (a plain control.tar ends with its ar member)
+            await skipToEnd(decompressed);
+            return parsed;
+        });
+        if (control !== null) {
+            return control;
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVhZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGViaWFuL3JlYWRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ3BFLE9BQU8sRUFBRSx5QkFBeUIsRUFBNEIsTUFBTSxxQkFBcUIsQ0FBQztBQUMxRixPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFakQsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQzVDLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNoRCxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQUM3RCxPQUFPLEVBQUUsdUJBQXVCLEVBQTBCLE1BQU0sMEJBQTBCLENBQUM7QUFDM0YsT0FBTyxFQUFFLGdCQUFnQixFQUFFLFNBQVMsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQ2hFLE9BQU8sRUFBRSxzQkFBc0IsRUFBdUIsTUFBTSxjQUFjLENBQUM7QUFFM0UsTUFBTSxXQUFXLEdBQUcsYUFBYSxDQUFDO0FBRWxDLDRFQUE0RTtBQUM1RSxNQUFNLG9CQUFvQixHQUFzQztJQUM5RCxFQUFFLEVBQUUsTUFBTTtJQUNWLEtBQUssRUFBRSxNQUFNO0lBQ2IsS0FBSyxFQUFFLElBQUk7SUFDWCxNQUFNLEVBQUUsTUFBTTtDQUNmLENBQUM7QUFFRjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0EwQkc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGlCQUFpQixDQUNyQyxNQUFpQyxFQUNqQyxNQUFxQztJQUVyQyxNQUFNLFFBQVEsR0FBRyx5QkFBeUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNuRCxNQUFNLEtBQUssR0FBRyxJQUFJLGlCQUFpQixDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDdEUsTUFBTSxPQUFPLEdBQUcsTUFBTSxXQUFXLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ25ELE1BQU0sS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3BCLE9BQU87UUFDTCxNQUFNLEVBQUUsUUFBUTtRQUNoQixJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUk7UUFDbEIsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPO1FBQ3hCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtRQUNsQyxRQUFRLEVBQUUsR0FBRyxPQUFPLENBQUMsSUFBSSxJQUFJLE9BQU8sQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLFlBQVksTUFBTTtRQUMxRSxPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRTtRQUN4QixRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7S0FDM0IsQ0FBQztBQUNKLENBQUM7QUFFRCxLQUFLLFVBQVUsV0FBVyxDQUFDLFFBQTJCLEVBQUUsU0FBd0M7SUFDOUYsTUFBTSxPQUFPLEdBQUcsSUFBSSxRQUFRLENBQUMsUUFBUSxFQUFFLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUM3RCxTQUFTLENBQUM7UUFDUixNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNwQyxJQUFJLE1BQU0sS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNwQixNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxpQ0FBaUMsRUFBRSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO1FBQ3JHLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUN6QyxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3hFLE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsb0JBQW9CLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDM0csSUFBSSxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDOUIsTUFBTSxJQUFJLGNBQWMsQ0FBQyx5QkFBeUIsRUFBRSxnQ0FBZ0MsTUFBTSxDQUFDLElBQUksR0FBRyxFQUFFO2dCQUNsRyxLQUFLLEVBQUUsYUFBYTtnQkFDcEIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJO2FBQ25CLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxJQUFJLEdBQUcsU0FBUyxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDN0MsTUFBTSxhQUFhLENBQUMsa0JBQWtCLEVBQUUsU0FBUyxDQUFDLGdCQUFnQixFQUFFLGtCQUFrQixNQUFNLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN2RyxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSx1QkFBdUIsQ0FDM0MsTUFBTSxDQUFDLElBQUksRUFDWCxXQUFXLEVBQ1gsRUFBRSxjQUFjLEVBQUUsU0FBUyxDQUFDLDRCQUE0QixFQUFFLFdBQVcsRUFBRSw4QkFBOEIsRUFBRSxFQUN2RyxLQUFLLEVBQUUsWUFBWSxFQUFFLEVBQUU7WUFDckIsTUFBTSxHQUFHLEdBQUcsSUFBSSxTQUFTLENBQUMsWUFBWSxFQUFFO2dCQUN0QyxVQUFVLEVBQUUsU0FBUyxDQUFDLFVBQVU7Z0JBQ2hDLGNBQWMsRUFBRSxTQUFTLENBQUMsY0FBYzthQUN6QyxDQUFDLENBQUM7WUFDSCxJQUFJLE1BQU0sR0FBMEIsSUFBSSxDQUFDO1lBQ3pDLFNBQVMsQ0FBQztnQkFDUixNQUFNLEtBQUssR0FBRyxNQUFNLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDL0IsSUFBSSxLQUFLLEtBQUssSUFBSSxFQUFFLENBQUM7b0JBQ25CLE1BQU07Z0JBQ1IsQ0FBQztnQkFDRCxJQUFJLEtBQUssQ0FBQyxRQUFRLEtBQUssR0FBRyxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssU0FBUyxFQUFFLENBQUM7b0JBQ25FLFNBQVM7Z0JBQ1gsQ0FBQztnQkFDRCxNQUFNLEtBQUssR0FBRyxNQUFNLGdCQUFnQixDQUNsQyxLQUFLLEVBQ0wsU0FBUyxDQUFDLDRCQUE0QixFQUN0Qyw4QkFBOEIsQ0FDL0IsQ0FBQztnQkFDRixNQUFNLEdBQUcsc0JBQXNCLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxjQUFjLENBQUMsQ0FBQztnQkFDakUsTUFBTTtZQUNSLENBQUM7WUFDRCxvRUFBb0U7WUFDcEUsc0VBQXNFO1lBQ3RFLDJEQUEyRDtZQUMzRCxNQUFNLFNBQVMsQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUM5QixPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDLENBQ0YsQ0FBQztRQUNGLElBQUksT0FBTyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3JCLE9BQU8sT0FBTyxDQUFDO1FBQ2pCLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist_ts/index.d.ts

@@ -0,0 +1,23 @@
+export type { TLinuxPackageFormat, ILinuxPackageDigests, IAlpinePackageDigests, ILinuxPackageRecordBase, IAlpinePackageMetadata, IAlpinePackageRecord, IDebianPackageMetadata, IDebianPackageRecord, IRpmDependency, IRpmFile, IRpmChangelog, IRpmPackageMetadata, IRpmPackageRecord, IRpmUpdate, IRpmUpdateReference, IRpmUpdateCollection, IRpmUpdatePackage, IArchPackageMetadata, IArchPackageRecord, TLinuxPackageRecord, TLinuxIndexFileStage, ILinuxIndexFile, } from './shared/types.js';
+export { DEFAULT_LINUX_PACKAGE_LIMITS } from './shared/limits.js';
+export type { ILinuxPackageLimits } from './shared/limits.js';
+export { LinuxRepoError } from './shared/errors.js';
+export type { TLinuxRepoErrorCode, ILinuxRepoErrorDetail } from './shared/errors.js';
+export { isIndexableArchitecture } from './shared/architecture.js';
+export { createAlpineSigner, createOpenPgpSigner } from './signing/signers.js';
+export type { IAlpineSigner, IOpenPgpSigner } from './signing/signers.js';
+export { generateAlpineKeyPair, generateOpenPgpKeyPair, giteaAlpineKeyName } from './signing/keys.js';
+export type { IAlpineKeyPair, IOpenPgpKeyPair } from './signing/keys.js';
+export { readDebianPackage } from './debian/reader.js';
+export { buildDebianIndex } from './debian/indexbuilder.js';
+export { readRpmPackage } from './rpm/reader.js';
+export { signRpmPackage } from './rpm/sign.js';
+export { buildRpmIndex } from './rpm/builder.js';
+export { mergeRpmUpdates } from './rpm/updates.js';
+export { renderRpmRepoConfig } from './rpm/repoconfig.js';
+export { readArchPackage } from './arch/reader.js';
+export { buildArchIndex } from './arch/builder.js';
+export type { IArchIndexEntry } from './arch/builder.js';
+export { signArchPackage } from './arch/signer.js';
+export { readAlpinePackage } from './alpine/reader.js';
+export { buildAlpineIndex } from './alpine/apkindex.js';

package/dist_ts/index.js

@@ -0,0 +1,18 @@
+export { DEFAULT_LINUX_PACKAGE_LIMITS } from './shared/limits.js';
+export { LinuxRepoError } from './shared/errors.js';
+export { isIndexableArchitecture } from './shared/architecture.js';
+export { createAlpineSigner, createOpenPgpSigner } from './signing/signers.js';
+export { generateAlpineKeyPair, generateOpenPgpKeyPair, giteaAlpineKeyName } from './signing/keys.js';
+export { readDebianPackage } from './debian/reader.js';
+export { buildDebianIndex } from './debian/indexbuilder.js';
+export { readRpmPackage } from './rpm/reader.js';
+export { signRpmPackage } from './rpm/sign.js';
+export { buildRpmIndex } from './rpm/builder.js';
+export { mergeRpmUpdates } from './rpm/updates.js';
+export { renderRpmRepoConfig } from './rpm/repoconfig.js';
+export { readArchPackage } from './arch/reader.js';
+export { buildArchIndex } from './arch/builder.js';
+export { signArchPackage } from './arch/signer.js';
+export { readAlpinePackage } from './alpine/reader.js';
+export { buildAlpineIndex } from './alpine/apkindex.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUF3QkEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFbEUsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBRXBELE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQ25FLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBRS9FLE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxzQkFBc0IsRUFBRSxrQkFBa0IsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBRXRHLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ3ZELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQzVELE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUNqRCxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sZUFBZSxDQUFDO0FBQy9DLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUNqRCxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDbkQsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDMUQsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ25ELE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUVuRCxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDbkQsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDdkQsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sc0JBQXNCLENBQUMifQ==

package/dist_ts/plugins.d.ts

@@ -0,0 +1,8 @@
+import * as crypto from 'node:crypto';
+import * as stream from 'node:stream';
+import * as streamWeb from 'node:stream/web';
+import * as zlib from 'node:zlib';
+export { crypto, stream, streamWeb, zlib };
+import * as lzma from '@napi-rs/lzma';
+import * as openpgp from 'openpgp';
+export { lzma, openpgp };

package/dist_ts/plugins.js

@@ -0,0 +1,11 @@
+// node native scope
+import * as crypto from 'node:crypto';
+import * as stream from 'node:stream';
+import * as streamWeb from 'node:stream/web';
+import * as zlib from 'node:zlib';
+export { crypto, stream, streamWeb, zlib };
+// third party scope
+import * as lzma from '@napi-rs/lzma';
+import * as openpgp from 'openpgp';
+export { lzma, openpgp };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxTQUFTLE1BQU0saUJBQWlCLENBQUM7QUFDN0MsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFFbEMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDO0FBRTNDLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssSUFBSSxNQUFNLGVBQWUsQ0FBQztBQUN0QyxPQUFPLEtBQUssT0FBTyxNQUFNLFNBQVMsQ0FBQztBQUVuQyxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDIn0=

package/dist_ts/readers/ar.d.ts

@@ -0,0 +1,31 @@
+import { LimitedReader, type IByteReader } from './bytes.js';
+export interface IArMember {
+    /**
+     * The header name with trailing spaces removed. Nothing else is resolved: a
+     * GNU trailing `/` stays, and GNU (`//`) or BSD (`#1/`) long-name forms are
+     * ordinary member names, as Gitea's `blakesmith/ar` reports them.
+     */
+    name: string;
+    size: number;
+    /** Exactly `size` bytes; reading past the input's end fails with `truncated`. */
+    body: LimitedReader;
+}
+/**
+ * A bounded reader for `ar` archives (the `.deb` container). It checks the
+ * `!<arch>\n` magic, the header terminator and the decimal size, which
+ * `blakesmith/ar` does not; every real `ar` writer produces them. A missing
+ * padding byte at the very end of the input ends the archive cleanly, as in
+ * `blakesmith/ar`.
+ */
+export declare class ArReader {
+    private readonly input;
+    private readonly maxEntries;
+    private started;
+    private done;
+    private current;
+    private pad;
+    private members;
+    constructor(input: IByteReader, maxEntries: number);
+    next(): Promise<IArMember | null>;
+    private readMagic;
+}

package/dist_ts/readers/ar.js

@@ -0,0 +1,87 @@
+import { LinuxRepoError, limitExceeded, truncated } from '../shared/errors.js';
+import { LimitedReader, readUpTo } from './bytes.js';
+import { decodeGoUtf8, decodeLatin1 } from './text.js';
+const AR_MAGIC = '!<arch>\n';
+const AR_HEADER_BYTES = 60;
+/**
+ * A bounded reader for `ar` archives (the `.deb` container). It checks the
+ * `!<arch>\n` magic, the header terminator and the decimal size, which
+ * `blakesmith/ar` does not; every real `ar` writer produces them. A missing
+ * padding byte at the very end of the input ends the archive cleanly, as in
+ * `blakesmith/ar`.
+ */
+export class ArReader {
+    input;
+    maxEntries;
+    started = false;
+    done = false;
+    current = null;
+    pad = 0;
+    members = 0;
+    constructor(input, maxEntries) {
+        this.input = input;
+        this.maxEntries = maxEntries;
+    }
+    async next() {
+        if (this.done) {
+            return null;
+        }
+        if (!this.started) {
+            await this.readMagic();
+            this.started = true;
+        }
+        if (this.current !== null) {
+            await this.current.skipRest();
+            this.current = null;
+        }
+        if (this.pad > 0) {
+            this.pad = 0;
+            const padding = await readUpTo(this.input, 1);
+            if (padding.length === 0) {
+                this.done = true;
+                return null;
+            }
+        }
+        const header = await readUpTo(this.input, AR_HEADER_BYTES);
+        if (header.length === 0) {
+            this.done = true;
+            return null;
+        }
+        if (header.length < AR_HEADER_BYTES) {
+            throw truncated('ar member header');
+        }
+        if (header[58] !== 0x60 || header[59] !== 0x0a) {
+            throw malformed('ar member header has no "`\\n" terminator');
+        }
+        const name = decodeGoUtf8(header.subarray(0, 16)).replace(/ +$/, '');
+        const sizeText = decodeLatin1(header.subarray(48, 58)).replace(/ +$/, '');
+        if (!/^[0-9]+$/.test(sizeText)) {
+            throw malformed('ar member size is not a decimal number');
+        }
+        const size = Number(sizeText);
+        if (!Number.isSafeInteger(size)) {
+            throw malformed('ar member size is out of range');
+        }
+        this.members += 1;
+        if (this.members > this.maxEntries) {
+            throw limitExceeded('maxEntries', this.maxEntries, 'ar member count');
+        }
+        this.current = new LimitedReader(this.input, size, 'ar member data');
+        this.pad = size % 2;
+        return { name, size, body: this.current };
+    }
+    async readMagic() {
+        const magic = await readUpTo(this.input, AR_MAGIC.length);
+        const text = decodeLatin1(magic);
+        if (!AR_MAGIC.startsWith(text)) {
+            throw new LinuxRepoError('malformed-archive', 'input is not an ar archive', { field: 'ar magic' });
+        }
+        if (magic.length < AR_MAGIC.length) {
+            throw truncated('ar magic');
+        }
+    }
+}
+function malformed(messageArg) {
+    return new LinuxRepoError('malformed-archive', messageArg, { field: 'ar member header' });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZWFkZXJzL2FyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLFNBQVMsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQy9FLE9BQU8sRUFBRSxhQUFhLEVBQUUsUUFBUSxFQUFvQixNQUFNLFlBQVksQ0FBQztBQUN2RSxPQUFPLEVBQUUsWUFBWSxFQUFFLFlBQVksRUFBRSxNQUFNLFdBQVcsQ0FBQztBQUV2RCxNQUFNLFFBQVEsR0FBRyxXQUFXLENBQUM7QUFDN0IsTUFBTSxlQUFlLEdBQUcsRUFBRSxDQUFDO0FBYzNCOzs7Ozs7R0FNRztBQUNILE1BQU0sT0FBTyxRQUFRO0lBUUEsS0FBSztJQUNMLFVBQVU7SUFSckIsT0FBTyxHQUFHLEtBQUssQ0FBQztJQUNoQixJQUFJLEdBQUcsS0FBSyxDQUFDO0lBQ2IsT0FBTyxHQUF5QixJQUFJLENBQUM7SUFDckMsR0FBRyxHQUFHLENBQUMsQ0FBQztJQUNSLE9BQU8sR0FBRyxDQUFDLENBQUM7SUFFcEIsWUFDbUIsS0FBa0IsRUFDbEIsVUFBa0I7cUJBRGxCLEtBQUs7MEJBQ0wsVUFBVTtJQUMxQixDQUFDO0lBRUcsS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNkLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDbEIsTUFBTSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDdkIsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7UUFDdEIsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUMxQixNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7UUFDdEIsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLEdBQUcsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNqQixJQUFJLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQztZQUNiLE1BQU0sT0FBTyxHQUFHLE1BQU0sUUFBUSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDOUMsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUN6QixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztnQkFDakIsT0FBTyxJQUFJLENBQUM7WUFDZCxDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsZUFBZSxDQUFDLENBQUM7UUFDM0QsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3hCLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDO1lBQ2pCLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxlQUFlLEVBQUUsQ0FBQztZQUNwQyxNQUFNLFNBQVMsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3RDLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxFQUFFLENBQUMsS0FBSyxJQUFJLElBQUksTUFBTSxDQUFDLEVBQUUsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQy9DLE1BQU0sU0FBUyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUNELE1BQU0sSUFBSSxHQUFHLFlBQVksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDckUsTUFBTSxRQUFRLEdBQUcsWUFBWSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUMxRSxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQy9CLE1BQU0sU0FBUyxDQUFDLHdDQUF3QyxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUNELE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM5QixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2hDLE1BQU0sU0FBUyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUNELElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxDQUFDO1FBQ2xCLElBQUksSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDbkMsTUFBTSxhQUFhLENBQUMsWUFBWSxFQUFFLElBQUksQ0FBQyxVQUFVLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztRQUN4RSxDQUFDO1FBQ0QsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLGFBQWEsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ3JFLElBQUksQ0FBQyxHQUFHLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQztRQUNwQixPQUFPLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQzVDLENBQUM7SUFFTyxLQUFLLENBQUMsU0FBUztRQUNyQixNQUFNLEtBQUssR0FBRyxNQUFNLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMxRCxNQUFNLElBQUksR0FBRyxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDakMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUMvQixNQUFNLElBQUksY0FBYyxDQUFDLG1CQUFtQixFQUFFLDRCQUE0QixFQUFFLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDckcsQ0FBQztRQUNELElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbkMsTUFBTSxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDOUIsQ0FBQztJQUNILENBQUM7Q0FDRjtBQUVELFNBQVMsU0FBUyxDQUFDLFVBQWtCO0lBQ25DLE9BQU8sSUFBSSxjQUFjLENBQUMsbUJBQW1CLEVBQUUsVUFBVSxFQUFFLEVBQUUsS0FBSyxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQztBQUM1RixDQUFDIn0=

package/dist_ts/readers/bytes.d.ts

@@ -0,0 +1,58 @@
+/**
+ * A pull-based byte reader. `read` returns between 1 and `max` bytes, or
+ * `null` at the end of input. `unread` pushes bytes back so the next `read`
+ * returns them first (used where a decoder consumed less than it was given).
+ */
+export interface IByteReader {
+    read(maxArg: number): Promise<Uint8Array | null>;
+    unread(bytesArg: Uint8Array): void;
+}
+/** The read size the readers use when they pull without a structural bound. */
+export declare const READ_CHUNK_BYTES: number;
+export declare function concatBytes(chunksArg: Uint8Array[], totalArg?: number): Uint8Array;
+/**
+ * Reads up to `lengthArg` bytes; returns fewer only when the input ends.
+ */
+export declare function readUpTo(readerArg: IByteReader, lengthArg: number): Promise<Uint8Array>;
+/**
+ * Reads exactly `lengthArg` bytes, or fails with `truncated` naming `whatArg`.
+ */
+export declare function readExact(readerArg: IByteReader, lengthArg: number, whatArg: string): Promise<Uint8Array>;
+/**
+ * Skips exactly `lengthArg` bytes, or fails with `truncated` naming `whatArg`.
+ */
+export declare function skipExact(readerArg: IByteReader, lengthArg: number, whatArg: string): Promise<void>;
+/**
+ * Reads and discards `readerArg` until it reports its end. The reader's own
+ * bounds apply: a decompressing reader counts the output against its
+ * `maxOutputBytes` and reports a cut or corrupt stream when its decoder does.
+ */
+export declare function skipToEnd(readerArg: IByteReader): Promise<void>;
+/** A reader over bytes already in memory. */
+export declare class BufferReader implements IByteReader {
+    private bytes;
+    private offset;
+    private pushedBack;
+    constructor(bytesArg: Uint8Array);
+    read(maxArg: number): Promise<Uint8Array | null>;
+    unread(bytesArg: Uint8Array): void;
+}
+/**
+ * Exposes exactly `lengthArg` bytes of an inner reader. Reading past the inner
+ * end fails with `truncated` naming `whatArg`; `skipRest` consumes what the
+ * consumer left.
+ */
+export declare class LimitedReader implements IByteReader {
+    private readonly inner;
+    private readonly what;
+    private remaining;
+    private pushedBack;
+    constructor(inner: IByteReader, lengthArg: number, what: string);
+    /** Bytes of the window the consumer has not read yet. */
+    get unreadBytes(): number;
+    read(maxArg: number): Promise<Uint8Array | null>;
+    unread(bytesArg: Uint8Array): void;
+    skipRest(): Promise<void>;
+}
+/** Splits `chunkArg` at `maxArg`, pushing the tail back onto `stackArg`. */
+export declare function takeFront(chunkArg: Uint8Array, maxArg: number, stackArg: Uint8Array[]): Uint8Array;

package/dist_ts/readers/bytes.js

@@ -0,0 +1,147 @@
+import { truncated } from '../shared/errors.js';
+/** The read size the readers use when they pull without a structural bound. */
+export const READ_CHUNK_BYTES = 64 * 1024;
+export function concatBytes(chunksArg, totalArg) {
+    if (chunksArg.length === 1) {
+        return chunksArg[0];
+    }
+    const total = totalArg ?? chunksArg.reduce((sum, chunk) => sum + chunk.length, 0);
+    const result = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunksArg) {
+        result.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return result;
+}
+/**
+ * Reads up to `lengthArg` bytes; returns fewer only when the input ends.
+ */
+export async function readUpTo(readerArg, lengthArg) {
+    const chunks = [];
+    let total = 0;
+    while (total < lengthArg) {
+        const chunk = await readerArg.read(lengthArg - total);
+        if (chunk === null) {
+            break;
+        }
+        chunks.push(chunk);
+        total += chunk.length;
+    }
+    return chunks.length === 0 ? new Uint8Array(0) : concatBytes(chunks, total);
+}
+/**
+ * Reads exactly `lengthArg` bytes, or fails with `truncated` naming `whatArg`.
+ */
+export async function readExact(readerArg, lengthArg, whatArg) {
+    const bytes = await readUpTo(readerArg, lengthArg);
+    if (bytes.length !== lengthArg) {
+        throw truncated(whatArg);
+    }
+    return bytes;
+}
+/**
+ * Skips exactly `lengthArg` bytes, or fails with `truncated` naming `whatArg`.
+ */
+export async function skipExact(readerArg, lengthArg, whatArg) {
+    let remaining = lengthArg;
+    while (remaining > 0) {
+        const chunk = await readerArg.read(Math.min(remaining, READ_CHUNK_BYTES));
+        if (chunk === null) {
+            throw truncated(whatArg);
+        }
+        remaining -= chunk.length;
+    }
+}
+/**
+ * Reads and discards `readerArg` until it reports its end. The reader's own
+ * bounds apply: a decompressing reader counts the output against its
+ * `maxOutputBytes` and reports a cut or corrupt stream when its decoder does.
+ */
+export async function skipToEnd(readerArg) {
+    while ((await readerArg.read(READ_CHUNK_BYTES)) !== null) {
+        // the bytes are discarded; the reader counts and checks them
+    }
+}
+/** A reader over bytes already in memory. */
+export class BufferReader {
+    bytes;
+    offset = 0;
+    pushedBack = [];
+    constructor(bytesArg) {
+        this.bytes = bytesArg;
+    }
+    async read(maxArg) {
+        const pushed = this.pushedBack.pop();
+        if (pushed !== undefined) {
+            return takeFront(pushed, maxArg, this.pushedBack);
+        }
+        if (this.offset >= this.bytes.length) {
+            return null;
+        }
+        const end = Math.min(this.bytes.length, this.offset + Math.max(1, maxArg));
+        const chunk = this.bytes.subarray(this.offset, end);
+        this.offset = end;
+        return chunk;
+    }
+    unread(bytesArg) {
+        if (bytesArg.length > 0) {
+            this.pushedBack.push(bytesArg);
+        }
+    }
+}
+/**
+ * Exposes exactly `lengthArg` bytes of an inner reader. Reading past the inner
+ * end fails with `truncated` naming `whatArg`; `skipRest` consumes what the
+ * consumer left.
+ */
+export class LimitedReader {
+    inner;
+    what;
+    remaining;
+    pushedBack = [];
+    constructor(inner, lengthArg, what) {
+        this.inner = inner;
+        this.what = what;
+        this.remaining = lengthArg;
+    }
+    /** Bytes of the window the consumer has not read yet. */
+    get unreadBytes() {
+        return this.remaining + this.pushedBack.reduce((sum, chunk) => sum + chunk.length, 0);
+    }
+    async read(maxArg) {
+        const pushed = this.pushedBack.pop();
+        if (pushed !== undefined) {
+            return takeFront(pushed, maxArg, this.pushedBack);
+        }
+        if (this.remaining === 0) {
+            return null;
+        }
+        const chunk = await this.inner.read(Math.min(Math.max(1, maxArg), this.remaining));
+        if (chunk === null) {
+            throw truncated(this.what);
+        }
+        this.remaining -= chunk.length;
+        return chunk;
+    }
+    unread(bytesArg) {
+        if (bytesArg.length > 0) {
+            this.pushedBack.push(bytesArg);
+        }
+    }
+    async skipRest() {
+        this.pushedBack = [];
+        await skipExact(this.inner, this.remaining, this.what);
+        this.remaining = 0;
+    }
+}
+/** Splits `chunkArg` at `maxArg`, pushing the tail back onto `stackArg`. */
+export function takeFront(chunkArg, maxArg, stackArg) {
+    const max = Math.max(1, maxArg);
+    if (chunkArg.length <= max) {
+        return chunkArg;
+    }
+    stackArg.push(chunkArg.subarray(max));
+    return chunkArg.subarray(0, max);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnl0ZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZWFkZXJzL2J5dGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQVloRCwrRUFBK0U7QUFDL0UsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQUUxQyxNQUFNLFVBQVUsV0FBVyxDQUFDLFNBQXVCLEVBQUUsUUFBaUI7SUFDcEUsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzNCLE9BQU8sU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3RCLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxRQUFRLElBQUksU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLEdBQUcsR0FBRyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ2xGLE1BQU0sTUFBTSxHQUFHLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3JDLElBQUksTUFBTSxHQUFHLENBQUMsQ0FBQztJQUNmLEtBQUssTUFBTSxLQUFLLElBQUksU0FBUyxFQUFFLENBQUM7UUFDOUIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUM7SUFDekIsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsUUFBUSxDQUFDLFNBQXNCLEVBQUUsU0FBaUI7SUFDdEUsTUFBTSxNQUFNLEdBQWlCLEVBQUUsQ0FBQztJQUNoQyxJQUFJLEtBQUssR0FBRyxDQUFDLENBQUM7SUFDZCxPQUFPLEtBQUssR0FBRyxTQUFTLEVBQUUsQ0FBQztRQUN6QixNQUFNLEtBQUssR0FBRyxNQUFNLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxHQUFHLEtBQUssQ0FBQyxDQUFDO1FBQ3RELElBQUksS0FBSyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ25CLE1BQU07UUFDUixDQUFDO1FBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuQixLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQztJQUN4QixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUM7QUFDOUUsQ0FBQztBQUVEOztHQUVHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxTQUFTLENBQzdCLFNBQXNCLEVBQ3RCLFNBQWlCLEVBQ2pCLE9BQWU7SUFFZixNQUFNLEtBQUssR0FBRyxNQUFNLFFBQVEsQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDbkQsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQy9CLE1BQU0sU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsU0FBUyxDQUM3QixTQUFzQixFQUN0QixTQUFpQixFQUNqQixPQUFlO0lBRWYsSUFBSSxTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQzFCLE9BQU8sU0FBUyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sS0FBSyxHQUFHLE1BQU0sU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFDMUUsSUFBSSxLQUFLLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDbkIsTUFBTSxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDM0IsQ0FBQztRQUNELFNBQVMsSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDO0lBQzVCLENBQUM7QUFDSCxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsU0FBUyxDQUFDLFNBQXNCO0lBQ3BELE9BQU8sQ0FBQyxNQUFNLFNBQVMsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3pELDZEQUE2RDtJQUMvRCxDQUFDO0FBQ0gsQ0FBQztBQUVELDZDQUE2QztBQUM3QyxNQUFNLE9BQU8sWUFBWTtJQUNmLEtBQUssQ0FBYTtJQUNsQixNQUFNLEdBQUcsQ0FBQyxDQUFDO0lBQ1gsVUFBVSxHQUFpQixFQUFFLENBQUM7SUFFdEMsWUFBWSxRQUFvQjtRQUM5QixJQUFJLENBQUMsS0FBSyxHQUFHLFFBQVEsQ0FBQztJQUN4QixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFjO1FBQzlCLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDckMsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDekIsT0FBTyxTQUFTLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3JDLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQzNFLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7UUFDbEIsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRU0sTUFBTSxDQUFDLFFBQW9CO1FBQ2hDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN4QixJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNqQyxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sT0FBTyxhQUFhO0lBS0wsS0FBSztJQUVMLElBQUk7SUFOZixTQUFTLENBQVM7SUFDbEIsVUFBVSxHQUFpQixFQUFFLENBQUM7SUFFdEMsWUFDbUIsS0FBa0IsRUFDbkMsU0FBaUIsRUFDQSxJQUFZO3FCQUZaLEtBQUs7b0JBRUwsSUFBSTtRQUVyQixJQUFJLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQztJQUM3QixDQUFDO0lBRUQseURBQXlEO0lBQ3pELElBQVcsV0FBVztRQUNwQixPQUFPLElBQUksQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxHQUFHLEdBQUcsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFjO1FBQzlCLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDckMsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDekIsT0FBTyxTQUFTLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLFNBQVMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6QixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsTUFBTSxDQUFDLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDbkYsSUFBSSxLQUFLLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDbkIsTUFBTSxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzdCLENBQUM7UUFDRCxJQUFJLENBQUMsU0FBUyxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDL0IsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRU0sTUFBTSxDQUFDLFFBQW9CO1FBQ2hDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN4QixJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNqQyxDQUFDO0lBQ0gsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRO1FBQ25CLElBQUksQ0FBQyxVQUFVLEdBQUcsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sU0FBUyxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDdkQsSUFBSSxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUM7SUFDckIsQ0FBQztDQUNGO0FBRUQsNEVBQTRFO0FBQzVFLE1BQU0sVUFBVSxTQUFTLENBQUMsUUFBb0IsRUFBRSxNQUFjLEVBQUUsUUFBc0I7SUFDcEYsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDaEMsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLEdBQUcsRUFBRSxDQUFDO1FBQzNCLE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxRQUFRLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUN0QyxPQUFPLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0FBQ25DLENBQUMifQ==

package/dist_ts/readers/bytesource.d.ts

@@ -0,0 +1,40 @@
+import type { ILinuxPackageDigests } from '../shared/types.js';
+import { type IByteReader } from './bytes.js';
+/**
+ * The digest tee: pulls the caller's package bytes once, counts them against
+ * `maxPackageBytes`, and feeds every byte exactly once into MD5, SHA-1,
+ * SHA-256 and SHA-512 at the moment it is pulled.
+ *
+ * - It pulls with `next()` only. It never calls `return()` or `throw()` on the
+ *   caller's iterator, so a web `ReadableStream` is never cancelled.
+ * - An error from the caller's iterator propagates unchanged. After any error
+ *   the source stops pulling for good.
+ * - `drain()` reads the rest of the input so the digests cover the whole file;
+ *   `digests()` is available only after the input has ended.
+ */
+export declare class PackageByteSource implements IByteReader {
+    private readonly source;
+    private readonly maxPackageBytes;
+    private iterator;
+    private readonly pushedBack;
+    private readonly hashes;
+    private pulledBytes;
+    private deliveredBytes;
+    private ended;
+    private failure;
+    private failed;
+    private finalDigests;
+    constructor(sourceArg: AsyncIterable<Uint8Array>, maxPackageBytesArg: number);
+    /** Offset of the next byte `read` returns, counted from the start of the file. */
+    get position(): number;
+    /** Bytes pulled from the caller so far. */
+    get pulled(): number;
+    read(maxArg: number): Promise<Uint8Array | null>;
+    unread(bytesArg: Uint8Array): void;
+    /** Reads and discards the rest of the input. */
+    drain(): Promise<void>;
+    /** Size and digests of the whole input; only after the input has ended. */
+    digests(): ILinuxPackageDigests;
+    private pull;
+    private fail;
+}