@push.rocks/smartlinuxrepo 0.0.0-stage → 0.1.0

package/dist_ts/readers/bytesource.js

@@ -0,0 +1,154 @@
+import * as plugins from '../plugins.js';
+import { LinuxRepoError, limitExceeded } from '../shared/errors.js';
+import { takeFront } from './bytes.js';
+/**
+ * The digest tee: pulls the caller's package bytes once, counts them against
+ * `maxPackageBytes`, and feeds every byte exactly once into MD5, SHA-1,
+ * SHA-256 and SHA-512 at the moment it is pulled.
+ *
+ * - It pulls with `next()` only. It never calls `return()` or `throw()` on the
+ *   caller's iterator, so a web `ReadableStream` is never cancelled.
+ * - An error from the caller's iterator propagates unchanged. After any error
+ *   the source stops pulling for good.
+ * - `drain()` reads the rest of the input so the digests cover the whole file;
+ *   `digests()` is available only after the input has ended.
+ */
+export class PackageByteSource {
+    source;
+    maxPackageBytes;
+    iterator = null;
+    pushedBack = [];
+    hashes = {
+        md5: plugins.crypto.createHash('md5'),
+        sha1: plugins.crypto.createHash('sha1'),
+        sha256: plugins.crypto.createHash('sha256'),
+        sha512: plugins.crypto.createHash('sha512'),
+    };
+    pulledBytes = 0;
+    deliveredBytes = 0;
+    ended = false;
+    failure = undefined;
+    failed = false;
+    finalDigests = null;
+    constructor(sourceArg, maxPackageBytesArg) {
+        if (sourceArg === null ||
+            typeof sourceArg !== 'object' ||
+            typeof sourceArg[Symbol.asyncIterator] !== 'function') {
+            throw new LinuxRepoError('invalid-input', 'source must be an AsyncIterable<Uint8Array>', {
+                field: 'source',
+            });
+        }
+        this.source = sourceArg;
+        this.maxPackageBytes = maxPackageBytesArg;
+    }
+    /** Offset of the next byte `read` returns, counted from the start of the file. */
+    get position() {
+        return this.deliveredBytes;
+    }
+    /** Bytes pulled from the caller so far. */
+    get pulled() {
+        return this.pulledBytes;
+    }
+    async read(maxArg) {
+        const pushed = this.pushedBack.pop();
+        if (pushed !== undefined) {
+            const chunk = takeFront(pushed, maxArg, this.pushedBack);
+            this.deliveredBytes += chunk.length;
+            return chunk;
+        }
+        const pulled = await this.pull();
+        if (pulled === null) {
+            return null;
+        }
+        const chunk = takeFront(pulled, maxArg, this.pushedBack);
+        this.deliveredBytes += chunk.length;
+        return chunk;
+    }
+    unread(bytesArg) {
+        if (bytesArg.length === 0) {
+            return;
+        }
+        this.pushedBack.push(bytesArg);
+        this.deliveredBytes -= bytesArg.length;
+    }
+    /** Reads and discards the rest of the input. */
+    async drain() {
+        this.deliveredBytes += this.pushedBack.reduce((sum, chunk) => sum + chunk.length, 0);
+        this.pushedBack.length = 0;
+        while ((await this.pull()) !== null) {
+            // every pulled chunk is hashed and counted inside pull()
+        }
+        this.deliveredBytes = this.pulledBytes;
+    }
+    /** Size and digests of the whole input; only after the input has ended. */
+    digests() {
+        if (!this.ended || this.failed) {
+            throw new Error('PackageByteSource.digests() called before the input ended');
+        }
+        if (this.finalDigests === null) {
+            this.finalDigests = {
+                size: this.pulledBytes,
+                md5: this.hashes.md5.digest('hex'),
+                sha1: this.hashes.sha1.digest('hex'),
+                sha256: this.hashes.sha256.digest('hex'),
+                sha512: this.hashes.sha512.digest('hex'),
+            };
+        }
+        return { ...this.finalDigests };
+    }
+    async pull() {
+        if (this.failed) {
+            throw this.failure;
+        }
+        if (this.ended) {
+            return null;
+        }
+        try {
+            this.iterator ??= this.source[Symbol.asyncIterator]();
+            for (;;) {
+                let result;
+                try {
+                    result = await this.iterator.next();
+                }
+                catch (error) {
+                    // the caller's error, unchanged
+                    this.fail(error);
+                    throw error;
+                }
+                if (result.done) {
+                    this.ended = true;
+                    return null;
+                }
+                const value = result.value;
+                if (!(value instanceof Uint8Array)) {
+                    throw new LinuxRepoError('invalid-input', 'source yielded a chunk that is not a Uint8Array', {
+                        field: 'source',
+                    });
+                }
+                if (value.length === 0) {
+                    continue;
+                }
+                if (this.pulledBytes + value.length > this.maxPackageBytes) {
+                    throw limitExceeded('maxPackageBytes', this.maxPackageBytes, 'package input');
+                }
+                this.pulledBytes += value.length;
+                this.hashes.md5.update(value);
+                this.hashes.sha1.update(value);
+                this.hashes.sha256.update(value);
+                this.hashes.sha512.update(value);
+                return value;
+            }
+        }
+        catch (error) {
+            this.fail(error);
+            throw error;
+        }
+    }
+    fail(errorArg) {
+        if (!this.failed) {
+            this.failed = true;
+            this.failure = errorArg;
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnl0ZXNvdXJjZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3JlYWRlcnMvYnl0ZXNvdXJjZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUN6QyxPQUFPLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBRXBFLE9BQU8sRUFBRSxTQUFTLEVBQW9CLE1BQU0sWUFBWSxDQUFDO0FBRXpEOzs7Ozs7Ozs7OztHQVdHO0FBQ0gsTUFBTSxPQUFPLGlCQUFpQjtJQUNYLE1BQU0sQ0FBNEI7SUFDbEMsZUFBZSxDQUFTO0lBQ2pDLFFBQVEsR0FBcUMsSUFBSSxDQUFDO0lBQ3pDLFVBQVUsR0FBaUIsRUFBRSxDQUFDO0lBQzlCLE1BQU0sR0FBRztRQUN4QixHQUFHLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1FBQ3JDLElBQUksRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7UUFDdkMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQztRQUMzQyxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDO0tBQzVDLENBQUM7SUFDTSxXQUFXLEdBQUcsQ0FBQyxDQUFDO0lBQ2hCLGNBQWMsR0FBRyxDQUFDLENBQUM7SUFDbkIsS0FBSyxHQUFHLEtBQUssQ0FBQztJQUNkLE9BQU8sR0FBWSxTQUFTLENBQUM7SUFDN0IsTUFBTSxHQUFHLEtBQUssQ0FBQztJQUNmLFlBQVksR0FBZ0MsSUFBSSxDQUFDO0lBRXpELFlBQVksU0FBb0MsRUFBRSxrQkFBMEI7UUFDMUUsSUFDRSxTQUFTLEtBQUssSUFBSTtZQUNsQixPQUFPLFNBQVMsS0FBSyxRQUFRO1lBQzdCLE9BQVEsU0FBZ0QsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssVUFBVSxFQUM3RixDQUFDO1lBQ0QsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsNkNBQTZDLEVBQUU7Z0JBQ3ZGLEtBQUssRUFBRSxRQUFRO2FBQ2hCLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztRQUN4QixJQUFJLENBQUMsZUFBZSxHQUFHLGtCQUFrQixDQUFDO0lBQzVDLENBQUM7SUFFRCxrRkFBa0Y7SUFDbEYsSUFBVyxRQUFRO1FBQ2pCLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQztJQUM3QixDQUFDO0lBRUQsMkNBQTJDO0lBQzNDLElBQVcsTUFBTTtRQUNmLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQztJQUMxQixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFjO1FBQzlCLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDckMsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDekIsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ3pELElBQUksQ0FBQyxjQUFjLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQztZQUNwQyxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNqQyxJQUFJLE1BQU0sS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNwQixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLGNBQWMsSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQ3BDLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUVNLE1BQU0sQ0FBQyxRQUFvQjtRQUNoQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDMUIsT0FBTztRQUNULENBQUM7UUFDRCxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMvQixJQUFJLENBQUMsY0FBYyxJQUFJLFFBQVEsQ0FBQyxNQUFNLENBQUM7SUFDekMsQ0FBQztJQUVELGdEQUFnRDtJQUN6QyxLQUFLLENBQUMsS0FBSztRQUNoQixJQUFJLENBQUMsY0FBYyxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsR0FBRyxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDckYsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO1FBQzNCLE9BQU8sQ0FBQyxNQUFNLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3BDLHlEQUF5RDtRQUMzRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLGNBQWMsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDO0lBQ3pDLENBQUM7SUFFRCwyRUFBMkU7SUFDcEUsT0FBTztRQUNaLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUMvQixNQUFNLElBQUksS0FBSyxDQUFDLDJEQUEyRCxDQUFDLENBQUM7UUFDL0UsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLFlBQVksS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUMvQixJQUFJLENBQUMsWUFBWSxHQUFHO2dCQUNsQixJQUFJLEVBQUUsSUFBSSxDQUFDLFdBQVc7Z0JBQ3RCLEdBQUcsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2dCQUNsQyxJQUFJLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQztnQkFDcEMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7Z0JBQ3hDLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2FBQ3pDLENBQUM7UUFDSixDQUFDO1FBQ0QsT0FBTyxFQUFFLEdBQUcsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO0lBQ2xDLENBQUM7SUFFTyxLQUFLLENBQUMsSUFBSTtRQUNoQixJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoQixNQUFNLElBQUksQ0FBQyxPQUFPLENBQUM7UUFDckIsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ2YsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsSUFBSSxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1lBQ3RELFNBQVMsQ0FBQztnQkFDUixJQUFJLE1BQWtDLENBQUM7Z0JBQ3ZDLElBQUksQ0FBQztvQkFDSCxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUN0QyxDQUFDO2dCQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7b0JBQ2YsZ0NBQWdDO29CQUNoQyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUNqQixNQUFNLEtBQUssQ0FBQztnQkFDZCxDQUFDO2dCQUNELElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO29CQUNoQixJQUFJLENBQUMsS0FBSyxHQUFHLElBQUksQ0FBQztvQkFDbEIsT0FBTyxJQUFJLENBQUM7Z0JBQ2QsQ0FBQztnQkFDRCxNQUFNLEtBQUssR0FBWSxNQUFNLENBQUMsS0FBSyxDQUFDO2dCQUNwQyxJQUFJLENBQUMsQ0FBQyxLQUFLLFlBQVksVUFBVSxDQUFDLEVBQUUsQ0FBQztvQkFDbkMsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsaURBQWlELEVBQUU7d0JBQzNGLEtBQUssRUFBRSxRQUFRO3FCQUNoQixDQUFDLENBQUM7Z0JBQ0wsQ0FBQztnQkFDRCxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7b0JBQ3ZCLFNBQVM7Z0JBQ1gsQ0FBQztnQkFDRCxJQUFJLElBQUksQ0FBQyxXQUFXLEdBQUcsS0FBSyxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7b0JBQzNELE1BQU0sYUFBYSxDQUFDLGlCQUFpQixFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUUsZUFBZSxDQUFDLENBQUM7Z0JBQ2hGLENBQUM7Z0JBQ0QsSUFBSSxDQUFDLFdBQVcsSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDO2dCQUNqQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQzlCLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDL0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNqQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQ2pDLE9BQU8sS0FBSyxDQUFDO1lBQ2YsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNqQixNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRU8sSUFBSSxDQUFDLFFBQWlCO1FBQzVCLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDakIsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUM7WUFDbkIsSUFBSSxDQUFDLE9BQU8sR0FBRyxRQUFRLENBQUM7UUFDMUIsQ0FBQztJQUNILENBQUM7Q0FDRiJ9

package/dist_ts/readers/decompress.d.ts

@@ -0,0 +1,43 @@
+import type { ILinuxPackageLimits } from '../shared/limits.js';
+import { type IByteReader } from './bytes.js';
+/** The stream compressions the readers decode. */
+export type TLinuxCompression = 'none' | 'gzip' | 'xz' | 'zstd';
+export interface IDecompressOptions {
+    /** Bound on the decompressed bytes delivered. */
+    maxOutputBytes: number;
+    outputLimit: keyof ILinuxPackageLimits;
+}
+/**
+ * A reader over the decompressed bytes of an inner reader. Pulling is lazy
+ * and bounded: decompressed output past `maxOutputBytes` fails with
+ * `limit-exceeded` and stops the decoder. `close()` releases the decoder and
+ * must be called (see `withDecompressingReader`).
+ *
+ * - gzip (multi-member) and zstd come from `node:zlib`, xz from
+ *   `@napi-rs/lzma` `xz.decompressStream` (64 KiB chunks, cancellable).
+ * - An error from the inner reader (the caller's source, or a codec limit on
+ *   it) propagates unchanged.
+ * - A compressed stream that ends early is `truncated`; corrupt data is
+ *   `malformed-archive` with the decoder error as `cause`.
+ * - The decoder reads the inner reader ahead and never hands bytes back, so
+ *   the compressed stream must run to the end of the inner reader (a whole
+ *   package, or a `LimitedReader` over one archive member).
+ * - Opening a zstd decoder on a Node.js without nodejs/node#64593 throws a
+ *   plain `Error` (see `isZstdDecodingSafe`): a server fault, not a verdict
+ *   on the package.
+ */
+export interface IDecompressingReader extends IByteReader {
+    readonly outputBytes: number;
+    close(): Promise<void>;
+}
+export declare function openDecompressingReader(inputArg: IByteReader, compressionArg: TLinuxCompression, optionsArg: IDecompressOptions): IDecompressingReader;
+/**
+ * True when Node.js `versionArg` (a `process.versions.node` string) carries
+ * nodejs/node#64593, so node:zlib reports a zstd frame that ends early as
+ * `Z_BUF_ERROR` instead of returning a prefix: 24.x from 24.20.0, 26.x from
+ * 26.6.0, and every major from 27 on. Anything else, including all of 22.x,
+ * 23.x and 25.x, is false.
+ */
+export declare function isZstdDecodingSafe(versionArg: string): boolean;
+/** Runs `bodyArg` with a decompressing reader and always closes it. */
+export declare function withDecompressingReader<T>(inputArg: IByteReader, compressionArg: TLinuxCompression, optionsArg: IDecompressOptions, bodyArg: (readerArg: IDecompressingReader) => Promise<T>): Promise<T>;

package/dist_ts/readers/decompress.js

@@ -0,0 +1,269 @@
+import * as plugins from '../plugins.js';
+import { LinuxRepoError, limitExceeded, truncated } from '../shared/errors.js';
+import { READ_CHUNK_BYTES, takeFront } from './bytes.js';
+export function openDecompressingReader(inputArg, compressionArg, optionsArg) {
+    let source;
+    switch (compressionArg) {
+        case 'none':
+            source = new PassThroughSource(inputArg);
+            break;
+        case 'gzip':
+            source = new ZlibSource(inputArg, 'gzip');
+            break;
+        case 'zstd':
+            if (!isZstdDecodingSafe(process.versions.node)) {
+                throw new Error(`zstd decoding needs Node.js ${ZSTD_NODE_FLOOR} (nodejs/node#64593 reports a zstd frame that ends early); ` +
+                    `this process runs Node.js ${process.versions.node}`);
+            }
+            source = new ZlibSource(inputArg, 'zstd');
+            break;
+        case 'xz':
+            source = new XzSource(inputArg);
+            break;
+        default:
+            throw new LinuxRepoError('unsupported-compression', `unknown compression "${String(compressionArg)}"`, {
+                field: 'compression',
+            });
+    }
+    return new BoundedOutputReader(source, optionsArg);
+}
+/** The Node.js releases whose node:zlib reports a truncated zstd frame. */
+const ZSTD_NODE_FLOOR = '^24.20.0 || >=26.6.0';
+/**
+ * True when Node.js `versionArg` (a `process.versions.node` string) carries
+ * nodejs/node#64593, so node:zlib reports a zstd frame that ends early as
+ * `Z_BUF_ERROR` instead of returning a prefix: 24.x from 24.20.0, 26.x from
+ * 26.6.0, and every major from 27 on. Anything else, including all of 22.x,
+ * 23.x and 25.x, is false.
+ */
+export function isZstdDecodingSafe(versionArg) {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:$|[-+])/.exec(versionArg);
+    if (match === null) {
+        return false;
+    }
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    if (major === 24) {
+        return minor >= 20;
+    }
+    if (major === 26) {
+        return minor >= 6;
+    }
+    return major >= 27;
+}
+/** Runs `bodyArg` with a decompressing reader and always closes it. */
+export async function withDecompressingReader(inputArg, compressionArg, optionsArg, bodyArg) {
+    const reader = openDecompressingReader(inputArg, compressionArg, optionsArg);
+    try {
+        return await bodyArg(reader);
+    }
+    finally {
+        await reader.close();
+    }
+}
+class BoundedOutputReader {
+    source;
+    options;
+    delivered = 0;
+    pushedBack = [];
+    closed = false;
+    constructor(source, options) {
+        this.source = source;
+        this.options = options;
+    }
+    get outputBytes() {
+        return this.delivered;
+    }
+    async read(maxArg) {
+        const pushed = this.pushedBack.pop();
+        if (pushed !== undefined) {
+            return takeFront(pushed, maxArg, this.pushedBack);
+        }
+        if (this.closed) {
+            return null;
+        }
+        const chunk = await this.source.next();
+        if (chunk === null) {
+            return null;
+        }
+        this.delivered += chunk.length;
+        if (this.delivered > this.options.maxOutputBytes) {
+            await this.close();
+            throw limitExceeded(this.options.outputLimit, this.options.maxOutputBytes, 'decompressed data');
+        }
+        return takeFront(chunk, maxArg, this.pushedBack);
+    }
+    unread(bytesArg) {
+        if (bytesArg.length > 0) {
+            this.pushedBack.push(bytesArg);
+        }
+    }
+    async close() {
+        this.pushedBack.length = 0;
+        if (this.closed) {
+            return;
+        }
+        this.closed = true;
+        await this.source.close();
+    }
+}
+class PassThroughSource {
+    input;
+    constructor(input) {
+        this.input = input;
+    }
+    next() {
+        return this.input.read(READ_CHUNK_BYTES);
+    }
+    async close() { }
+}
+/** gzip (multi-member, like Go's default) and zstd through `node:zlib`, with stream backpressure. */
+class ZlibSource {
+    kind;
+    feeder;
+    decoder;
+    iterator;
+    inputFailed = false;
+    inputError = undefined;
+    finished = false;
+    constructor(inputArg, kindArg) {
+        this.kind = kindArg;
+        const pump = async function* () {
+            for (;;) {
+                let chunk;
+                try {
+                    chunk = await inputArg.read(READ_CHUNK_BYTES);
+                }
+                catch (error) {
+                    this.inputFailed = true;
+                    this.inputError = error;
+                    throw error;
+                }
+                if (chunk === null) {
+                    return;
+                }
+                yield chunk;
+            }
+        };
+        this.feeder = plugins.stream.Readable.from(pump.call(this), { objectMode: false });
+        this.decoder = kindArg === 'gzip' ? plugins.zlib.createGunzip() : plugins.zlib.createZstdDecompress();
+        // errors surface through the iterator below; the callback only completes the pipeline
+        plugins.stream.pipeline(this.feeder, this.decoder, () => { });
+        this.iterator = this.decoder[Symbol.asyncIterator]();
+    }
+    async next() {
+        if (this.finished) {
+            return null;
+        }
+        try {
+            const result = await this.iterator.next();
+            if (result.done) {
+                this.finished = true;
+                return null;
+            }
+            return result.value;
+        }
+        catch (error) {
+            this.finished = true;
+            if (this.inputFailed) {
+                throw this.inputError;
+            }
+            throw mapZlibError(error, this.kind);
+        }
+    }
+    async close() {
+        this.finished = true;
+        this.feeder.destroy();
+        this.decoder.destroy();
+    }
+}
+function mapZlibError(errorArg, kindArg) {
+    const code = errorArg?.code;
+    // gunzip, and zstd on the Node.js floor, report an input that ended inside the stream as Z_BUF_ERROR
+    if (code === 'Z_BUF_ERROR') {
+        const error = truncated(`${kindArg} stream`);
+        return new LinuxRepoError(error.code, error.message, error.detail, { cause: errorArg });
+    }
+    return new LinuxRepoError('malformed-archive', `corrupt ${kindArg} data`, { field: `${kindArg} stream` }, {
+        cause: errorArg,
+    });
+}
+/**
+ * xz through `@napi-rs/lzma` `xz.decompressStream`, the one bounded decoder of
+ * that package (its class API buffers whole outputs). The input is a
+ * pull-based web stream that never reads ahead; cancelling the output stops it.
+ */
+class XzSource {
+    reader;
+    inputFailed = false;
+    inputError = undefined;
+    inputEnded = false;
+    finished = false;
+    stopped = false;
+    constructor(inputArg) {
+        const input = new ReadableStream({
+            pull: async (controller) => {
+                if (this.stopped) {
+                    controller.close();
+                    return;
+                }
+                let chunk;
+                try {
+                    chunk = await inputArg.read(READ_CHUNK_BYTES);
+                }
+                catch (error) {
+                    this.inputFailed = true;
+                    this.inputError = error;
+                    controller.error(error);
+                    return;
+                }
+                if (chunk === null) {
+                    this.inputEnded = true;
+                    controller.close();
+                }
+                else {
+                    controller.enqueue(chunk);
+                }
+            },
+            cancel: () => {
+                this.stopped = true;
+            },
+        }, { highWaterMark: 0 });
+        this.reader = plugins.lzma.xz.decompressStream(input).getReader();
+    }
+    async next() {
+        if (this.finished) {
+            return null;
+        }
+        try {
+            const result = await this.reader.read();
+            if (result.done) {
+                this.finished = true;
+                return null;
+            }
+            return result.value;
+        }
+        catch (error) {
+            this.finished = true;
+            if (this.inputFailed) {
+                throw this.inputError;
+            }
+            // @napi-rs/lzma 1.5.3 reports a decoder that ran out of input as Rust's
+            // read_exact error; with the input at its end that is a truncated stream
+            const message = error instanceof Error ? error.message : '';
+            if (this.inputEnded && message.includes('failed to fill whole buffer')) {
+                const base = truncated('xz stream');
+                throw new LinuxRepoError(base.code, base.message, base.detail, { cause: error });
+            }
+            throw new LinuxRepoError('malformed-archive', 'corrupt xz data', { field: 'xz stream' }, { cause: error });
+        }
+    }
+    async close() {
+        this.stopped = true;
+        if (!this.finished) {
+            this.finished = true;
+            await this.reader.cancel();
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVjb21wcmVzcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3JlYWRlcnMvZGVjb21wcmVzcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUN6QyxPQUFPLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxTQUFTLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUUvRSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsU0FBUyxFQUFvQixNQUFNLFlBQVksQ0FBQztBQXdDM0UsTUFBTSxVQUFVLHVCQUF1QixDQUNyQyxRQUFxQixFQUNyQixjQUFpQyxFQUNqQyxVQUE4QjtJQUU5QixJQUFJLE1BQW9CLENBQUM7SUFDekIsUUFBUSxjQUFjLEVBQUUsQ0FBQztRQUN2QixLQUFLLE1BQU07WUFDVCxNQUFNLEdBQUcsSUFBSSxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUN6QyxNQUFNO1FBQ1IsS0FBSyxNQUFNO1lBQ1QsTUFBTSxHQUFHLElBQUksVUFBVSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUMxQyxNQUFNO1FBQ1IsS0FBSyxNQUFNO1lBQ1QsSUFBSSxDQUFDLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFDL0MsTUFBTSxJQUFJLEtBQUssQ0FDYiwrQkFBK0IsZUFBZSw2REFBNkQ7b0JBQ3pHLDZCQUE2QixPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUN2RCxDQUFDO1lBQ0osQ0FBQztZQUNELE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDMUMsTUFBTTtRQUNSLEtBQUssSUFBSTtZQUNQLE1BQU0sR0FBRyxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNoQyxNQUFNO1FBQ1I7WUFDRSxNQUFNLElBQUksY0FBYyxDQUFDLHlCQUF5QixFQUFFLHdCQUF3QixNQUFNLENBQUMsY0FBYyxDQUFDLEdBQUcsRUFBRTtnQkFDckcsS0FBSyxFQUFFLGFBQWE7YUFDckIsQ0FBQyxDQUFDO0lBQ1AsQ0FBQztJQUNELE9BQU8sSUFBSSxtQkFBbUIsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUM7QUFDckQsQ0FBQztBQUVELDJFQUEyRTtBQUMzRSxNQUFNLGVBQWUsR0FBRyxzQkFBc0IsQ0FBQztBQUUvQzs7Ozs7O0dBTUc7QUFDSCxNQUFNLFVBQVUsa0JBQWtCLENBQUMsVUFBa0I7SUFDbkQsTUFBTSxLQUFLLEdBQUcsZ0NBQWdDLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ2hFLElBQUksS0FBSyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ25CLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMvQixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDL0IsSUFBSSxLQUFLLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDakIsT0FBTyxLQUFLLElBQUksRUFBRSxDQUFDO0lBQ3JCLENBQUM7SUFDRCxJQUFJLEtBQUssS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUNqQixPQUFPLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDcEIsQ0FBQztJQUNELE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztBQUNyQixDQUFDO0FBRUQsdUVBQXVFO0FBQ3ZFLE1BQU0sQ0FBQyxLQUFLLFVBQVUsdUJBQXVCLENBQzNDLFFBQXFCLEVBQ3JCLGNBQWlDLEVBQ2pDLFVBQThCLEVBQzlCLE9BQXdEO0lBRXhELE1BQU0sTUFBTSxHQUFHLHVCQUF1QixDQUFDLFFBQVEsRUFBRSxjQUFjLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDN0UsSUFBSSxDQUFDO1FBQ0gsT0FBTyxNQUFNLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMvQixDQUFDO1lBQVMsQ0FBQztRQUNULE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3ZCLENBQUM7QUFDSCxDQUFDO0FBRUQsTUFBTSxtQkFBbUI7SUFNSixNQUFNO0lBQ04sT0FBTztJQU5sQixTQUFTLEdBQUcsQ0FBQyxDQUFDO0lBQ0wsVUFBVSxHQUFpQixFQUFFLENBQUM7SUFDdkMsTUFBTSxHQUFHLEtBQUssQ0FBQztJQUV2QixZQUNtQixNQUFvQixFQUNwQixPQUEyQjtzQkFEM0IsTUFBTTt1QkFDTixPQUFPO0lBQ3ZCLENBQUM7SUFFSixJQUFXLFdBQVc7UUFDcEIsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDO0lBQ3hCLENBQUM7SUFFTSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQWM7UUFDOUIsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNyQyxJQUFJLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN6QixPQUFPLFNBQVMsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDaEIsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3ZDLElBQUksS0FBSyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ25CLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELElBQUksQ0FBQyxTQUFTLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUMvQixJQUFJLElBQUksQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUNqRCxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNuQixNQUFNLGFBQWEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGNBQWMsRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO1FBQ2xHLENBQUM7UUFDRCxPQUFPLFNBQVMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRU0sTUFBTSxDQUFDLFFBQW9CO1FBQ2hDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN4QixJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNqQyxDQUFDO0lBQ0gsQ0FBQztJQUVNLEtBQUssQ0FBQyxLQUFLO1FBQ2hCLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztRQUMzQixJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoQixPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO1FBQ25CLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUM1QixDQUFDO0NBQ0Y7QUFFRCxNQUFNLGlCQUFpQjtJQUNRLEtBQUs7SUFBbEMsWUFBNkIsS0FBa0I7cUJBQWxCLEtBQUs7SUFBZ0IsQ0FBQztJQUU1QyxJQUFJO1FBQ1QsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzNDLENBQUM7SUFFTSxLQUFLLENBQUMsS0FBSyxLQUFtQixDQUFDO0NBQ3ZDO0FBRUQscUdBQXFHO0FBQ3JHLE1BQU0sVUFBVTtJQUNHLElBQUksQ0FBa0I7SUFDdEIsTUFBTSxDQUEwQjtJQUNoQyxPQUFPLENBQW9EO0lBQzNELFFBQVEsQ0FBd0I7SUFDekMsV0FBVyxHQUFHLEtBQUssQ0FBQztJQUNwQixVQUFVLEdBQVksU0FBUyxDQUFDO0lBQ2hDLFFBQVEsR0FBRyxLQUFLLENBQUM7SUFFekIsWUFBWSxRQUFxQixFQUFFLE9BQXdCO1FBQ3pELElBQUksQ0FBQyxJQUFJLEdBQUcsT0FBTyxDQUFDO1FBQ3BCLE1BQU0sSUFBSSxHQUFHLEtBQUssU0FBUyxDQUFDO1lBQzFCLFNBQVMsQ0FBQztnQkFDUixJQUFJLEtBQXdCLENBQUM7Z0JBQzdCLElBQUksQ0FBQztvQkFDSCxLQUFLLEdBQUcsTUFBTSxRQUFRLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7Z0JBQ2hELENBQUM7Z0JBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztvQkFDZixJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksQ0FBQztvQkFDeEIsSUFBSSxDQUFDLFVBQVUsR0FBRyxLQUFLLENBQUM7b0JBQ3hCLE1BQU0sS0FBSyxDQUFDO2dCQUNkLENBQUM7Z0JBQ0QsSUFBSSxLQUFLLEtBQUssSUFBSSxFQUFFLENBQUM7b0JBQ25CLE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7UUFDSCxDQUFDLENBQUM7UUFDRixJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDbkYsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLG9CQUFvQixFQUFFLENBQUM7UUFDdEcsc0ZBQXNGO1FBQ3RGLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRSxDQUFDLENBQUMsQ0FBQztRQUM3RCxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7SUFDdkQsQ0FBQztJQUVNLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDbEIsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzFDLElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUNoQixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQztnQkFDckIsT0FBTyxJQUFJLENBQUM7WUFDZCxDQUFDO1lBQ0QsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDO1FBQ3RCLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUM7WUFDckIsSUFBSSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQ3JCLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQztZQUN4QixDQUFDO1lBQ0QsTUFBTSxZQUFZLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN2QyxDQUFDO0lBQ0gsQ0FBQztJQUVNLEtBQUssQ0FBQyxLQUFLO1FBQ2hCLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO1FBQ3JCLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDdEIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUN6QixDQUFDO0NBQ0Y7QUFFRCxTQUFTLFlBQVksQ0FBQyxRQUFpQixFQUFFLE9BQXdCO0lBQy9ELE1BQU0sSUFBSSxHQUFJLFFBQXNDLEVBQUUsSUFBSSxDQUFDO0lBQzNELHFHQUFxRztJQUNyRyxJQUFJLElBQUksS0FBSyxhQUFhLEVBQUUsQ0FBQztRQUMzQixNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsR0FBRyxPQUFPLFNBQVMsQ0FBQyxDQUFDO1FBQzdDLE9BQU8sSUFBSSxjQUFjLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBQ0QsT0FBTyxJQUFJLGNBQWMsQ0FBQyxtQkFBbUIsRUFBRSxXQUFXLE9BQU8sT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLEdBQUcsT0FBTyxTQUFTLEVBQUUsRUFBRTtRQUN4RyxLQUFLLEVBQUUsUUFBUTtLQUNoQixDQUFDLENBQUM7QUFDTCxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sUUFBUTtJQUNLLE1BQU0sQ0FBMEM7SUFDekQsV0FBVyxHQUFHLEtBQUssQ0FBQztJQUNwQixVQUFVLEdBQVksU0FBUyxDQUFDO0lBQ2hDLFVBQVUsR0FBRyxLQUFLLENBQUM7SUFDbkIsUUFBUSxHQUFHLEtBQUssQ0FBQztJQUNqQixPQUFPLEdBQUcsS0FBSyxDQUFDO0lBRXhCLFlBQVksUUFBcUI7UUFDL0IsTUFBTSxLQUFLLEdBQUcsSUFBSSxjQUFjLENBQzlCO1lBQ0UsSUFBSSxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsRUFBRTtnQkFDekIsSUFBSSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7b0JBQ2pCLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztvQkFDbkIsT0FBTztnQkFDVCxDQUFDO2dCQUNELElBQUksS0FBd0IsQ0FBQztnQkFDN0IsSUFBSSxDQUFDO29CQUNILEtBQUssR0FBRyxNQUFNLFFBQVEsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztnQkFDaEQsQ0FBQztnQkFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO29CQUNmLElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDO29CQUN4QixJQUFJLENBQUMsVUFBVSxHQUFHLEtBQUssQ0FBQztvQkFDeEIsVUFBVSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztvQkFDeEIsT0FBTztnQkFDVCxDQUFDO2dCQUNELElBQUksS0FBSyxLQUFLLElBQUksRUFBRSxDQUFDO29CQUNuQixJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQztvQkFDdkIsVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUNyQixDQUFDO3FCQUFNLENBQUM7b0JBQ04sVUFBVSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDNUIsQ0FBQztZQUNILENBQUM7WUFDRCxNQUFNLEVBQUUsR0FBRyxFQUFFO2dCQUNYLElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQ3RCLENBQUM7U0FDRixFQUNELEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxDQUNyQixDQUFDO1FBQ0YsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUNwRSxDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsQixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDeEMsSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ2hCLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO2dCQUNyQixPQUFPLElBQUksQ0FBQztZQUNkLENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQyxLQUFLLENBQUM7UUFDdEIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQztZQUNyQixJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztnQkFDckIsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDO1lBQ3hCLENBQUM7WUFDRCx3RUFBd0U7WUFDeEUseUVBQXlFO1lBQ3pFLE1BQU0sT0FBTyxHQUFHLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM1RCxJQUFJLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyw2QkFBNkIsQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZFLE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxXQUFXLENBQUMsQ0FBQztnQkFDcEMsTUFBTSxJQUFJLGNBQWMsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1lBQ25GLENBQUM7WUFDRCxNQUFNLElBQUksY0FBYyxDQUFDLG1CQUFtQixFQUFFLGlCQUFpQixFQUFFLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDN0csQ0FBQztJQUNILENBQUM7SUFFTSxLQUFLLENBQUMsS0FBSztRQUNoQixJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQztRQUNwQixJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ25CLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO1lBQ3JCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUM3QixDQUFDO0lBQ0gsQ0FBQztDQUNGIn0=

package/dist_ts/readers/gzipmember.d.ts

@@ -0,0 +1,32 @@
+import type { ILinuxPackageLimits } from '../shared/limits.js';
+import { type IByteReader } from './bytes.js';
+export interface IGzipMemberOptions {
+    /** Bound on the member's own bytes (header, deflate data and trailer). */
+    maxMemberBytes: number;
+    memberLimit: keyof ILinuxPackageLimits;
+    /** Bound on the member's decompressed bytes. */
+    maxOutputBytes: number;
+    outputLimit: keyof ILinuxPackageLimits;
+    /** Bound on the header's FNAME and FCOMMENT strings. */
+    maxHeaderBytes: number;
+}
+export interface IGzipMember {
+    /** The decompressed member. */
+    output: Uint8Array;
+    /** The member's own byte count: header, deflate data and trailer. */
+    memberBytes: number;
+    /** Lowercase hex SHA-1 of exactly the member's bytes. */
+    memberSha1: string;
+}
+/**
+ * Reads exactly one gzip member (RFC 1952) from `inputArg` and leaves the
+ * reader positioned at the first byte after it, so concatenated members (an
+ * apk v2 package) can be read one at a time with their exact boundaries.
+ *
+ * The header is parsed here; the deflate data is inflated with
+ * `zlib.createInflateRaw()`, whose `bytesWritten` counts only the bytes the
+ * deflate stream consumed, and the bytes past the stream's end are pushed back
+ * with `unread`. The trailer's CRC-32 and ISIZE are checked. Returns `null`
+ * when the input ends exactly where a member would start.
+ */
+export declare function readGzipMember(inputArg: IByteReader, optionsArg: IGzipMemberOptions): Promise<IGzipMember | null>;