@red-hat-developer-hub/cli-module-install-dynamic-plugins 0.2.0

package/dist/oci-key.cjs.js

@@ -0,0 +1,102 @@
+'use strict';
+
+var errors = require('./errors.cjs.js');
+var log = require('./log.cjs.js');
+var types = require('./types.cjs.js');
+
+const OCI_PATTERN = [
+  "^(",
+  escape(types.OCI_PROTO),
+  String.raw`[^\s/:@]+`,
+  // registry host
+  String.raw`(?::\d+)?`,
+  // optional port
+  String.raw`(?:/[^\s:@]+)+`,
+  // at least one path segment
+  ")",
+  String.raw`(?::([^\s!@:]+)`,
+  // tag
+  "|",
+  String.raw`@((?:sha256|sha512|blake3):[^\s!@:]+))`,
+  // or digest
+  String.raw`(?:!([^\s]+))?$`
+  // optional !<plugin-path>
+].join("");
+const OCI_REGEX = new RegExp(OCI_PATTERN);
+async function ociPluginKey(pkg, imageCache) {
+  const m = OCI_REGEX.exec(pkg);
+  if (!m) {
+    throw new errors.InstallException(
+      `oci package '${pkg}' is not in the expected format '${types.OCI_PROTO}<registry>:<tag>' or '${types.OCI_PROTO}<registry>@<algo>:<digest>' (optionally followed by '!<path>') where <registry> may include a port (e.g. host:5000/path) and <algo> is one of ${types.RECOGNIZED_ALGORITHMS.join(", ")}`
+    );
+  }
+  const registry = m[1];
+  const tag = m[2];
+  const digest = m[3];
+  let path = m[4] ?? null;
+  const version = tag ?? digest;
+  const inherit = tag === "{{inherit}}" && digest === void 0;
+  if (inherit && !path) {
+    return { pluginKey: registry, version, inherit, resolvedPath: null };
+  }
+  if (!path) {
+    path = await autoDetectPluginPath(
+      pkg,
+      registry,
+      version,
+      tag !== void 0,
+      imageCache
+    );
+  }
+  return {
+    pluginKey: `${registry}:!${path}`,
+    version,
+    inherit,
+    resolvedPath: path
+  };
+}
+async function autoDetectPluginPath(pkg, registry, version, isTag, imageCache) {
+  if (!imageCache) {
+    throw new errors.InstallException(
+      `Cannot auto-detect plugin path for ${pkg}: no image cache provided`
+    );
+  }
+  const fullImage = isTag ? `${registry}:${version}` : `${registry}@${version}`;
+  log.log(
+    `
+======= No plugin path specified for ${fullImage}, auto-detecting from OCI manifest`
+  );
+  const paths = await imageCache.getPluginPaths(fullImage);
+  if (paths.length === 0) {
+    throw new errors.InstallException(
+      `No plugins found in OCI image ${fullImage}. The image might not contain the 'io.backstage.dynamic-packages' annotation. Please ensure it was packaged using the @red-hat-developer-hub/cli plugin package command.`
+    );
+  }
+  if (paths.length > 1) {
+    const formatted = paths.map((p) => `  - ${p}`).join("\n");
+    throw new errors.InstallException(
+      `Multiple plugins found in OCI image ${fullImage}:
+${formatted}
+Please specify which plugin to install using the syntax: ${fullImage}!<plugin-name>`
+    );
+  }
+  const resolved = paths[0];
+  log.log(
+    `
+======= Auto-resolving OCI package ${fullImage} to use plugin path: ${resolved}`
+  );
+  return resolved;
+}
+function tryParseOciRegistryAndPath(pkg) {
+  const m = OCI_REGEX.exec(pkg);
+  if (!m) return null;
+  return { registry: m[1], path: m[4] ?? null };
+}
+function escape(s) {
+  return s.replaceAll(/[.*+?^${}()|[\]\\/]/g, String.raw`\$&`);
+}
+
+exports.OCI_REGEX = OCI_REGEX;
+exports.ociPluginKey = ociPluginKey;
+exports.tryParseOciRegistryAndPath = tryParseOciRegistryAndPath;
+//# sourceMappingURL=oci-key.cjs.js.map

package/dist/oci-key.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-key.cjs.js","sources":["../src/oci-key.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { InstallException } from './errors';\nimport { log } from './log';\nimport { type OciImageCache } from './image-cache';\nimport { OCI_PROTO, RECOGNIZED_ALGORITHMS } from './types';\n\nconst OCI_PATTERN = [\n  '^(',\n  escape(OCI_PROTO),\n  String.raw`[^\\s/:@]+`, // registry host\n  String.raw`(?::\\d+)?`, // optional port\n  String.raw`(?:/[^\\s:@]+)+`, // at least one path segment\n  ')',\n  String.raw`(?::([^\\s!@:]+)`, // tag\n  '|',\n  String.raw`@((?:sha256|sha512|blake3):[^\\s!@:]+))`, // or digest\n  String.raw`(?:!([^\\s]+))?$`, // optional !<plugin-path>\n].join('');\n\nexport const OCI_REGEX = new RegExp(OCI_PATTERN);\n\nexport type ParsedOciKey = {\n  /** `oci://registry/image:!plugin_path` — version-stripped identifier. */\n  pluginKey: string;\n  /** Tag (e.g. `1.2.3`) or digest (`sha256:...`). */\n  version: string;\n  /** True when tag was `{{inherit}}` (version to be resolved from an included config). */\n  inherit: boolean;\n  /**\n   * Resolved plugin path — explicit `!<path>`, auto-detected from the image's\n   * `io.backstage.dynamic-packages` annotation, or `null` when `{{inherit}}`\n   * is used without a path (the merger resolves it later).\n   */\n  resolvedPath: string | null;\n};\n\n/**\n * Parse an `oci://...` package spec. Matches fast.py and the original\n * `OciPackageMerger.parse_plugin_key`. Calls into `imageCache.getPluginPaths`\n * to auto-detect single-plugin images when the `!path` suffix is omitted.\n */\nexport async function ociPluginKey(\n  pkg: string,\n  imageCache?: OciImageCache,\n): Promise<ParsedOciKey> {\n  const m = OCI_REGEX.exec(pkg);\n  if (!m) {\n    throw new InstallException(\n      `oci package '${pkg}' is not in the expected format '${OCI_PROTO}<registry>:<tag>' ` +\n        `or '${OCI_PROTO}<registry>@<algo>:<digest>' (optionally followed by '!<path>') ` +\n        `where <registry> may include a port (e.g. host:5000/path) ` +\n        `and <algo> is one of ${RECOGNIZED_ALGORITHMS.join(', ')}`,\n    );\n  }\n\n  const registry = m[1] as string;\n  const tag = m[2];\n  const digest = m[3];\n  let path = m[4] ?? null;\n\n  const version = (tag ?? digest) as string;\n  const inherit = tag === '{{inherit}}' && digest === undefined;\n\n  if (inherit && !path) {\n    // The merger will match against an earlier included plugin from the same image.\n    return { pluginKey: registry, version, inherit, resolvedPath: null };\n  }\n\n  if (!path) {\n    path = await autoDetectPluginPath(\n      pkg,\n      registry,\n      version,\n      tag !== undefined,\n      imageCache,\n    );\n  }\n\n  return {\n    pluginKey: `${registry}:!${path}`,\n    version,\n    inherit,\n    resolvedPath: path,\n  };\n}\n\nasync function autoDetectPluginPath(\n  pkg: string,\n  registry: string,\n  version: string,\n  isTag: boolean,\n  imageCache: OciImageCache | undefined,\n): Promise<string> {\n  if (!imageCache) {\n    throw new InstallException(\n      `Cannot auto-detect plugin path for ${pkg}: no image cache provided`,\n    );\n  }\n  const fullImage = isTag ? `${registry}:${version}` : `${registry}@${version}`;\n  log(\n    `\\n======= No plugin path specified for ${fullImage}, auto-detecting from OCI manifest`,\n  );\n  const paths = await imageCache.getPluginPaths(fullImage);\n  if (paths.length === 0) {\n    throw new InstallException(\n      `No plugins found in OCI image ${fullImage}. ` +\n        `The image might not contain the 'io.backstage.dynamic-packages' annotation. ` +\n        `Please ensure it was packaged using the @red-hat-developer-hub/cli plugin package command.`,\n    );\n  }\n  if (paths.length > 1) {\n    const formatted = paths.map(p => `  - ${p}`).join('\\n');\n    throw new InstallException(\n      `Multiple plugins found in OCI image ${fullImage}:\\n${formatted}\\n` +\n        `Please specify which plugin to install using the syntax: ${fullImage}!<plugin-name>`,\n    );\n  }\n  const resolved = paths[0] as string;\n  log(\n    `\\n======= Auto-resolving OCI package ${fullImage} to use plugin path: ${resolved}`,\n  );\n  return resolved;\n}\n\n/**\n * Synchronous parse for the disable-pre-merge pass. Returns `null` when the\n * package does not match the expected OCI grammar — callers decide how to\n * react (warn-and-skip when the entry is disabled, throw when it is enabled).\n * Mirrors the `match.group(1)` / `match.group(4)` access pattern used by\n * `pre_merge_oci_disabled_state` in the Python implementation.\n */\nexport function tryParseOciRegistryAndPath(\n  pkg: string,\n): { registry: string; path: string | null } | null {\n  const m = OCI_REGEX.exec(pkg);\n  if (!m) return null;\n  return { registry: m[1] as string, path: m[4] ?? null };\n}\n\nfunction escape(s: string): string {\n  return s.replaceAll(/[.*+?^${}()|[\\]\\\\/]/g, String.raw`\\$&`);\n}\n"],"names":["OCI_PROTO","InstallException","RECOGNIZED_ALGORITHMS","log"],"mappings":";;;;;;AAoBA,MAAM,WAAA,GAAc;AAAA,EAClB,IAAA;AAAA,EACA,OAAOA,eAAS,CAAA;AAAA,EAChB,MAAA,CAAO,GAAA,CAAA,SAAA,CAAA;AAAA;AAAA,EACP,MAAA,CAAO,GAAA,CAAA,SAAA,CAAA;AAAA;AAAA,EACP,MAAA,CAAO,GAAA,CAAA,cAAA,CAAA;AAAA;AAAA,EACP,GAAA;AAAA,EACA,MAAA,CAAO,GAAA,CAAA,eAAA,CAAA;AAAA;AAAA,EACP,GAAA;AAAA,EACA,MAAA,CAAO,GAAA,CAAA,sCAAA,CAAA;AAAA;AAAA,EACP,MAAA,CAAO,GAAA,CAAA,eAAA;AAAA;AACT,CAAA,CAAE,KAAK,EAAE,CAAA;AAEF,MAAM,SAAA,GAAY,IAAI,MAAA,CAAO,WAAW;AAsB/C,eAAsB,YAAA,CACpB,KACA,UAAA,EACuB;AACvB,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,IAAA,CAAK,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAC,CAAA,EAAG;AACN,IAAA,MAAM,IAAIC,uBAAA;AAAA,MACR,CAAA,aAAA,EAAgB,GAAG,CAAA,iCAAA,EAAoCD,eAAS,CAAA,sBAAA,EACvDA,eAAS,CAAA,8IAAA,EAEQE,2BAAA,CAAsB,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAC5D;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,EAAE,CAAC,CAAA;AACpB,EAAA,MAAM,GAAA,GAAM,EAAE,CAAC,CAAA;AACf,EAAA,MAAM,MAAA,GAAS,EAAE,CAAC,CAAA;AAClB,EAAA,IAAI,IAAA,GAAO,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AAEnB,EAAA,MAAM,UAAW,GAAA,IAAO,MAAA;AACxB,EAAA,MAAM,OAAA,GAAU,GAAA,KAAQ,aAAA,IAAiB,MAAA,KAAW,MAAA;AAEpD,EAAA,IAAI,OAAA,IAAW,CAAC,IAAA,EAAM;AAEpB,IAAA,OAAO,EAAE,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,OAAA,EAAS,cAAc,IAAA,EAAK;AAAA,EACrE;AAEA,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,IAAA,GAAO,MAAM,oBAAA;AAAA,MACX,GAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA;AAAA,MACA,GAAA,KAAQ,MAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA;AAAA,IAC/B,OAAA;AAAA,IACA,OAAA;AAAA,IACA,YAAA,EAAc;AAAA,GAChB;AACF;AAEA,eAAe,oBAAA,CACb,GAAA,EACA,QAAA,EACA,OAAA,EACA,OACA,UAAA,EACiB;AACjB,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAID,uBAAA;AAAA,MACR,sCAAsC,GAAG,CAAA,yBAAA;AAAA,KAC3C;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAY,KAAA,GAAQ,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAC3E,EAAAE,OAAA;AAAA,IACE;AAAA,qCAAA,EAA0C,SAAS,CAAA,kCAAA;AAAA,GACrD;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,cAAA,CAAe,SAAS,CAAA;AACvD,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAIF,uBAAA;AAAA,MACR,iCAAiC,SAAS,CAAA,wKAAA;AAAA,KAG5C;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,SAAA,GAAY,MAAM,GAAA,CAAI,CAAA,CAAA,KAAK,OAAO,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA,MAAM,IAAIA,uBAAA;AAAA,MACR,uCAAuC,SAAS,CAAA;AAAA,EAAM,SAAS;AAAA,yDAAA,EACD,SAAS,CAAA,cAAA;AAAA,KACzE;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,CAAC,CAAA;AACxB,EAAAE,OAAA;AAAA,IACE;AAAA,mCAAA,EAAwC,SAAS,wBAAwB,QAAQ,CAAA;AAAA,GACnF;AACA,EAAA,OAAO,QAAA;AACT;AASO,SAAS,2BACd,GAAA,EACkD;AAClD,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,IAAA,CAAK,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AACf,EAAA,OAAO,EAAE,UAAU,CAAA,CAAE,CAAC,GAAa,IAAA,EAAM,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA,EAAK;AACxD;AAEA,SAAS,OAAO,CAAA,EAAmB;AACjC,EAAA,OAAO,CAAA,CAAE,UAAA,CAAW,sBAAA,EAAwB,MAAA,CAAO,GAAA,CAAA,GAAA,CAAQ,CAAA;AAC7D;;;;;;"}

package/dist/package.json.cjs.js

@@ -0,0 +1,104 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var name = "@red-hat-developer-hub/cli-module-install-dynamic-plugins";
+var version = "0.2.0";
+var description = "Backstage CLI module that installs RHDH dynamic plugins from a dynamic-plugins.yaml config (OCI, NPM, local).";
+var license = "Apache-2.0";
+var backstage = {
+	role: "cli-module"
+};
+var homepage = "https://github.com/redhat-developer/rhdh-plugins/tree/main/workspaces/install-dynamic-plugins#readme";
+var repository = {
+	type: "git",
+	url: "https://github.com/redhat-developer/rhdh-plugins",
+	directory: "workspaces/install-dynamic-plugins/packages/install-dynamic-plugins"
+};
+var bugs = "https://github.com/redhat-developer/rhdh-plugins/issues";
+var keywords = [
+	"rhdh",
+	"backstage",
+	"dynamic-plugins",
+	"cli",
+	"cli-module",
+	"init-container"
+];
+var engines = {
+	node: "22 || 24"
+};
+var main = "src/index.ts";
+var types = "src/index.ts";
+var bin = "bin/install-dynamic-plugins";
+var files = [
+	"bin",
+	"dist"
+];
+var publishConfig = {
+	access: "public",
+	main: "dist/index.cjs.js",
+	types: "dist/index.d.ts"
+};
+var scripts = {
+	build: "backstage-cli package build",
+	clean: "backstage-cli package clean",
+	lint: "backstage-cli package lint",
+	prepack: "backstage-cli package prepack",
+	postpack: "backstage-cli package postpack",
+	test: "backstage-cli package test",
+	tsc: "tsc"
+};
+var dependencies = {
+	"@backstage/cli-node": "^0.3.2",
+	cleye: "^2.6.0",
+	tar: "^7.5.13",
+	yaml: "^2.8.2"
+};
+var devDependencies = {
+	"@backstage/cli": "^0.36.0",
+	"@types/jest": "^30.0.0",
+	"@types/node": "^22.10.0",
+	"@types/tar": "^6.1.13",
+	typescript: "~5.8.0"
+};
+var packageJson = {
+	name: name,
+	version: version,
+	description: description,
+	license: license,
+	backstage: backstage,
+	homepage: homepage,
+	repository: repository,
+	bugs: bugs,
+	keywords: keywords,
+	engines: engines,
+	main: main,
+	types: types,
+	bin: bin,
+	files: files,
+	publishConfig: publishConfig,
+	scripts: scripts,
+	dependencies: dependencies,
+	devDependencies: devDependencies
+};
+
+exports.backstage = backstage;
+exports.bin = bin;
+exports.bugs = bugs;
+exports.default = packageJson;
+exports.dependencies = dependencies;
+exports.description = description;
+exports.devDependencies = devDependencies;
+exports.engines = engines;
+exports.files = files;
+exports.homepage = homepage;
+exports.keywords = keywords;
+exports.license = license;
+exports.main = main;
+exports.name = name;
+exports.publishConfig = publishConfig;
+exports.repository = repository;
+exports.scripts = scripts;
+exports.types = types;
+exports.version = version;
+//# sourceMappingURL=package.json.cjs.js.map

package/dist/package.json.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.json.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/plugin-hash.cjs.js

@@ -0,0 +1,85 @@
+'use strict';
+
+var node_crypto = require('node:crypto');
+var node_fs = require('node:fs');
+var path = require('node:path');
+
+function _interopNamespaceCompat(e) {
+  if (e && typeof e === 'object' && 'default' in e) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var path__namespace = /*#__PURE__*/_interopNamespaceCompat(path);
+
+function computePluginHash(plugin) {
+  const copy = {};
+  for (const [k, v] of Object.entries(plugin)) {
+    if (k === "pluginConfig" || k === "version" || k === "plugin_hash")
+      continue;
+    copy[k] = v;
+  }
+  if (plugin.package.startsWith("./")) {
+    copy._local_package_info = localPackageInfo(plugin.package);
+  }
+  const serialized = stableStringify(copy);
+  return node_crypto.createHash("sha256").update(serialized).digest("hex");
+}
+function localPackageInfo(pkgPath) {
+  const absPath = path__namespace.isAbsolute(pkgPath) ? pkgPath : path__namespace.join(process.cwd(), pkgPath.slice(2));
+  const pj = path__namespace.join(absPath, "package.json");
+  if (!node_fs.existsSync(pj)) {
+    try {
+      return { _directory_mtime: toSeconds(node_fs.statSync(absPath).mtimeMs) };
+    } catch {
+      return { _not_found: true };
+    }
+  }
+  try {
+    const info = {
+      _package_json: JSON.parse(node_fs.readFileSync(pj, "utf8")),
+      _package_json_mtime: toSeconds(node_fs.statSync(pj).mtimeMs)
+    };
+    for (const lockFile of ["package-lock.json", "yarn.lock"]) {
+      const lockPath = path__namespace.join(absPath, lockFile);
+      if (node_fs.existsSync(lockPath)) {
+        info[`_${lockFile}_mtime`] = toSeconds(node_fs.statSync(lockPath).mtimeMs);
+      }
+    }
+    return info;
+  } catch (err) {
+    return { _error: err.message };
+  }
+}
+function toSeconds(mtimeMs) {
+  return mtimeMs / 1e3;
+}
+function compareCodePoint(a, b) {
+  if (a < b) return -1;
+  if (a > b) return 1;
+  return 0;
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(", ")}]`;
+  }
+  const obj = value;
+  const entries = Object.keys(obj).sort(compareCodePoint).map((k) => `${JSON.stringify(k)}: ${stableStringify(obj[k])}`);
+  return `{${entries.join(", ")}}`;
+}
+
+exports.computePluginHash = computePluginHash;
+//# sourceMappingURL=plugin-hash.cjs.js.map

package/dist/plugin-hash.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-hash.cjs.js","sources":["../src/plugin-hash.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createHash } from 'node:crypto';\nimport { statSync, existsSync, readFileSync } from 'node:fs';\nimport * as path from 'node:path';\nimport { type Plugin } from './types';\n\n/**\n * Compute the config-hash for a plugin, used to detect \"already installed\".\n *\n * The hash is byte-compatible with the Python implementation\n * (`install-dynamic-plugins.py`): both versions\n *   - strip `pluginConfig` and `version` before hashing,\n *   - keep `last_modified_level` (the include-file precedence) inside the hash,\n *   - serialize via stable, sort-keyed JSON,\n *   - and use the same field names for local-package metadata\n *     (`_local_package_info`, `_package_json`, `_package_json_mtime`,\n *     `_directory_mtime`, `_not_found`, `_error`, `_<lockfile>_mtime`).\n *\n * Cross-compat matters because an in-place upgrade from the Python script\n * to this TS port should not trigger a full reinstall of every plugin on\n * the first run.\n */\nexport function computePluginHash(plugin: Plugin): string {\n  const copy: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(plugin)) {\n    if (k === 'pluginConfig' || k === 'version' || k === 'plugin_hash')\n      continue;\n    copy[k] = v;\n  }\n  if (plugin.package.startsWith('./')) {\n    copy._local_package_info = localPackageInfo(plugin.package);\n  }\n  const serialized = stableStringify(copy);\n  return createHash('sha256').update(serialized).digest('hex');\n}\n\ntype LocalPackageInfo = {\n  _package_json?: unknown;\n  _package_json_mtime?: number;\n  _directory_mtime?: number;\n  _not_found?: boolean;\n  _error?: string;\n  [key: string]: unknown;\n};\n\n/**\n * Inspect a local package path and return the metadata included in the\n * install hash. Field names and value formats match the Python helper\n * `get_local_package_info` so the resulting hash is identical.\n *\n * Mtime is stored in seconds-since-epoch as a float — Python's\n * `os.path.getmtime` returns float seconds, so we divide Node's\n * millisecond value by 1000.\n */\nfunction localPackageInfo(pkgPath: string): LocalPackageInfo {\n  const absPath = path.isAbsolute(pkgPath)\n    ? pkgPath\n    : path.join(process.cwd(), pkgPath.slice(2));\n  const pj = path.join(absPath, 'package.json');\n  if (!existsSync(pj)) {\n    try {\n      return { _directory_mtime: toSeconds(statSync(absPath).mtimeMs) };\n    } catch {\n      return { _not_found: true };\n    }\n  }\n  try {\n    const info: LocalPackageInfo = {\n      _package_json: JSON.parse(readFileSync(pj, 'utf8')),\n      _package_json_mtime: toSeconds(statSync(pj).mtimeMs),\n    };\n    for (const lockFile of ['package-lock.json', 'yarn.lock']) {\n      const lockPath = path.join(absPath, lockFile);\n      if (existsSync(lockPath)) {\n        info[`_${lockFile}_mtime`] = toSeconds(statSync(lockPath).mtimeMs);\n      }\n    }\n    return info;\n  } catch (err) {\n    return { _error: (err as Error).message };\n  }\n}\n\nfunction toSeconds(mtimeMs: number): number {\n  return mtimeMs / 1000;\n}\n\n/**\n * Deterministic JSON stringification — sorts keys at every level and emits\n * Python-style separators (`, ` between elements, `: ` between key/value)\n * so the resulting string is byte-identical to Python's\n * `json.dumps(..., sort_keys=True)`. Required for hash compatibility with\n * the previous Python implementation.\n *\n * Uses an explicit code-point comparator (locale-independent, matches\n * Python's default `sorted()` ordering on str keys).\n */\nfunction compareCodePoint(a: string, b: string): number {\n  if (a < b) return -1;\n  if (a > b) return 1;\n  return 0;\n}\n\nfunction stableStringify(value: unknown): string {\n  if (value === null || typeof value !== 'object') return JSON.stringify(value);\n  if (Array.isArray(value)) {\n    return `[${value.map(stableStringify).join(', ')}]`;\n  }\n  const obj = value as Record<string, unknown>;\n  const entries = Object.keys(obj)\n    .sort(compareCodePoint)\n    .map(k => `${JSON.stringify(k)}: ${stableStringify(obj[k])}`);\n  return `{${entries.join(', ')}}`;\n}\n"],"names":["createHash","path","existsSync","statSync","readFileSync"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAoCO,SAAS,kBAAkB,MAAA,EAAwB;AACxD,EAAA,MAAM,OAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC3C,IAAA,IAAI,CAAA,KAAM,cAAA,IAAkB,CAAA,KAAM,SAAA,IAAa,CAAA,KAAM,aAAA;AACnD,MAAA;AACF,IAAA,IAAA,CAAK,CAAC,CAAA,GAAI,CAAA;AAAA,EACZ;AACA,EAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAA,EAAG;AACnC,IAAA,IAAA,CAAK,mBAAA,GAAsB,gBAAA,CAAiB,MAAA,CAAO,OAAO,CAAA;AAAA,EAC5D;AACA,EAAA,MAAM,UAAA,GAAa,gBAAgB,IAAI,CAAA;AACvC,EAAA,OAAOA,uBAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AAC7D;AAoBA,SAAS,iBAAiB,OAAA,EAAmC;AAC3D,EAAA,MAAM,OAAA,GAAUC,eAAA,CAAK,UAAA,CAAW,OAAO,IACnC,OAAA,GACAA,eAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAI,EAAG,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7C,EAAA,MAAM,EAAA,GAAKA,eAAA,CAAK,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAC5C,EAAA,IAAI,CAACC,kBAAA,CAAW,EAAE,CAAA,EAAG;AACnB,IAAA,IAAI;AACF,MAAA,OAAO,EAAE,gBAAA,EAAkB,SAAA,CAAUC,iBAAS,OAAO,CAAA,CAAE,OAAO,CAAA,EAAE;AAAA,IAClE,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,YAAY,IAAA,EAAK;AAAA,IAC5B;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAyB;AAAA,MAC7B,eAAe,IAAA,CAAK,KAAA,CAAMC,oBAAA,CAAa,EAAA,EAAI,MAAM,CAAC,CAAA;AAAA,MAClD,mBAAA,EAAqB,SAAA,CAAUD,gBAAA,CAAS,EAAE,EAAE,OAAO;AAAA,KACrD;AACA,IAAA,KAAA,MAAW,QAAA,IAAY,CAAC,mBAAA,EAAqB,WAAW,CAAA,EAAG;AACzD,MAAA,MAAM,QAAA,GAAWF,eAAA,CAAK,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AAC5C,MAAA,IAAIC,kBAAA,CAAW,QAAQ,CAAA,EAAG;AACxB,QAAA,IAAA,CAAK,CAAA,CAAA,EAAI,QAAQ,CAAA,MAAA,CAAQ,CAAA,GAAI,UAAUC,gBAAA,CAAS,QAAQ,EAAE,OAAO,CAAA;AAAA,MACnE;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO,EAAE,MAAA,EAAS,GAAA,CAAc,OAAA,EAAQ;AAAA,EAC1C;AACF;AAEA,SAAS,UAAU,OAAA,EAAyB;AAC1C,EAAA,OAAO,OAAA,GAAU,GAAA;AACnB;AAYA,SAAS,gBAAA,CAAiB,GAAW,CAAA,EAAmB;AACtD,EAAA,IAAI,CAAA,GAAI,GAAG,OAAO,EAAA;AAClB,EAAA,IAAI,CAAA,GAAI,GAAG,OAAO,CAAA;AAClB,EAAA,OAAO,CAAA;AACT;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAC5E,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,IAAI,KAAA,CAAM,GAAA,CAAI,eAAe,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,EAClD;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,GAAG,EAC5B,IAAA,CAAK,gBAAgB,EACrB,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,CAAA,EAAA,EAAK,gBAAgB,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,CAAE,CAAA;AAC9D,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAC/B;;;;"}

package/dist/run.cjs.js

@@ -0,0 +1,37 @@
+'use strict';
+
+var node_child_process = require('node:child_process');
+var errors = require('./errors.cjs.js');
+
+async function run(cmd, errMsg, options = {}) {
+  if (cmd.length === 0) {
+    throw new errors.InstallException(`${errMsg}: empty command`);
+  }
+  const [bin, ...args] = cmd;
+  return new Promise((resolve, reject) => {
+    const child = node_child_process.spawn(bin, args, {
+      ...options,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => stdout += chunk.toString());
+    child.stderr?.on("data", (chunk) => stderr += chunk.toString());
+    child.on(
+      "error",
+      (err) => reject(new errors.InstallException(`${errMsg}: ${err.message}`))
+    );
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve({ stdout, stderr });
+      } else {
+        const parts = [`${errMsg}: exit code ${code}`, `cmd: ${cmd.join(" ")}`];
+        if (stderr.trim()) parts.push(`stderr: ${stderr.trim()}`);
+        reject(new errors.InstallException(parts.join("\n")));
+      }
+    });
+  });
+}
+
+exports.run = run;
+//# sourceMappingURL=run.cjs.js.map

package/dist/run.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.cjs.js","sources":["../src/run.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { spawn, type SpawnOptions } from 'node:child_process';\nimport { InstallException } from './errors';\n\nexport type RunResult = {\n  stdout: string;\n  stderr: string;\n};\n\n/**\n * Execute a command, capturing stdout/stderr. Throws InstallException with full\n * context (exit code, stderr) on non-zero exit. Matches the Python `run()` contract.\n */\nexport async function run(\n  cmd: string[],\n  errMsg: string,\n  options: SpawnOptions = {},\n): Promise<RunResult> {\n  if (cmd.length === 0) {\n    throw new InstallException(`${errMsg}: empty command`);\n  }\n  const [bin, ...args] = cmd as [string, ...string[]];\n  return new Promise<RunResult>((resolve, reject) => {\n    const child = spawn(bin, args, {\n      ...options,\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    let stdout = '';\n    let stderr = '';\n    child.stdout?.on('data', (chunk: Buffer) => (stdout += chunk.toString()));\n    child.stderr?.on('data', (chunk: Buffer) => (stderr += chunk.toString()));\n    child.on('error', err =>\n      reject(new InstallException(`${errMsg}: ${err.message}`)),\n    );\n    child.on('close', code => {\n      if (code === 0) {\n        resolve({ stdout, stderr });\n      } else {\n        const parts = [`${errMsg}: exit code ${code}`, `cmd: ${cmd.join(' ')}`];\n        if (stderr.trim()) parts.push(`stderr: ${stderr.trim()}`);\n        reject(new InstallException(parts.join('\\n')));\n      }\n    });\n  });\n}\n"],"names":["InstallException","spawn"],"mappings":";;;;;AA2BA,eAAsB,GAAA,CACpB,GAAA,EACA,MAAA,EACA,OAAA,GAAwB,EAAC,EACL;AACpB,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAIA,uBAAA,CAAiB,CAAA,EAAG,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,EACvD;AACA,EAAA,MAAM,CAAC,GAAA,EAAK,GAAG,IAAI,CAAA,GAAI,GAAA;AACvB,EAAA,OAAO,IAAI,OAAA,CAAmB,CAAC,OAAA,EAAS,MAAA,KAAW;AACjD,IAAA,MAAM,KAAA,GAAQC,wBAAA,CAAM,GAAA,EAAK,IAAA,EAAM;AAAA,MAC7B,GAAG,OAAA;AAAA,MACH,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,KACjC,CAAA;AACD,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,KAAA,CAAM,MAAA,EAAQ,GAAG,MAAA,EAAQ,CAAC,UAAmB,MAAA,IAAU,KAAA,CAAM,UAAW,CAAA;AACxE,IAAA,KAAA,CAAM,MAAA,EAAQ,GAAG,MAAA,EAAQ,CAAC,UAAmB,MAAA,IAAU,KAAA,CAAM,UAAW,CAAA;AACxE,IAAA,KAAA,CAAM,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAA,GAAA,KAChB,MAAA,CAAO,IAAID,uBAAA,CAAiB,CAAA,EAAG,MAAM,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAE,CAAC;AAAA,KAC1D;AACA,IAAA,KAAA,CAAM,EAAA,CAAG,SAAS,CAAA,IAAA,KAAQ;AACxB,MAAA,IAAI,SAAS,CAAA,EAAG;AACd,QAAA,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,CAAA;AAAA,MAC5B,CAAA,MAAO;AACL,QAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,MAAM,CAAA,YAAA,EAAe,IAAI,CAAA,CAAA,EAAI,CAAA,KAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,GAAG,CAAC,CAAA,CAAE,CAAA;AACtE,QAAA,IAAI,MAAA,CAAO,MAAK,EAAG,KAAA,CAAM,KAAK,CAAA,QAAA,EAAW,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACxD,QAAA,MAAA,CAAO,IAAIA,uBAAA,CAAiB,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AAAA,MAC/C;AAAA,IACF,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;;;;"}

package/dist/skopeo.cjs.js

@@ -0,0 +1,87 @@
+'use strict';
+
+var node_child_process = require('node:child_process');
+var errors = require('./errors.cjs.js');
+var run = require('./run.cjs.js');
+var which = require('./which.cjs.js');
+
+class Skopeo {
+  path;
+  inspectRawCache = /* @__PURE__ */ new Map();
+  inspectCache = /* @__PURE__ */ new Map();
+  existsCache = /* @__PURE__ */ new Map();
+  constructor(skopeoPath) {
+    const resolved = skopeoPath ?? which.which("skopeo");
+    if (!resolved) throw new errors.InstallException("skopeo not found in PATH");
+    this.path = resolved;
+  }
+  async copy(src, dst) {
+    await run.run(
+      [
+        this.path,
+        "copy",
+        "--override-os=linux",
+        "--override-arch=amd64",
+        src,
+        dst
+      ],
+      `skopeo copy failed: ${src}`
+    );
+  }
+  async inspectRaw(url) {
+    const cached = this.inspectRawCache.get(url);
+    if (cached) return cached;
+    const pending = this.runInspect(url, true);
+    this.inspectRawCache.set(url, pending);
+    try {
+      return await pending;
+    } catch (err) {
+      this.inspectRawCache.delete(url);
+      throw err;
+    }
+  }
+  async inspect(url) {
+    const cached = this.inspectCache.get(url);
+    if (cached) return cached;
+    const pending = this.runInspect(url, false);
+    this.inspectCache.set(url, pending);
+    try {
+      return await pending;
+    } catch (err) {
+      this.inspectCache.delete(url);
+      throw err;
+    }
+  }
+  /**
+   * Returns true iff `skopeo inspect` succeeds; never throws. Result is
+   * memoized — subsequent calls for the same URL reuse the in-flight or
+   * resolved promise. This dedups the `resolveImage` registry probe across
+   * the many plugins that share the same OCI image (common for the RHDH
+   * plugin catalog).
+   */
+  async exists(url) {
+    const cached = this.existsCache.get(url);
+    if (cached) return cached;
+    const pending = new Promise((resolve) => {
+      const child = node_child_process.spawn(this.path, ["inspect", "--no-tags", url], {
+        stdio: "ignore"
+      });
+      child.on("error", () => resolve(false));
+      child.on("close", (code) => resolve(code === 0));
+    });
+    this.existsCache.set(url, pending);
+    return pending;
+  }
+  async runInspect(url, raw) {
+    const args = ["inspect", "--no-tags", url];
+    if (raw) args.splice(1, 0, "--raw");
+    const { stdout } = await run.run(
+      [this.path, ...args],
+      `skopeo inspect failed: ${url}`
+    );
+    return JSON.parse(stdout);
+  }
+}
+
+exports.Skopeo = Skopeo;
+//# sourceMappingURL=skopeo.cjs.js.map

package/dist/skopeo.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skopeo.cjs.js","sources":["../src/skopeo.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { spawn } from 'node:child_process';\nimport { InstallException } from './errors';\nimport { run } from './run';\nimport { which } from './which';\n\n/**\n * Wrapper around the `skopeo` CLI with in-memory caching for `inspect` results.\n *\n * JS is single-threaded so the caches don't need locks, unlike the Python\n * version. Multiple concurrent callers inspecting the same image still share\n * the one in-flight request because we cache the promise, not just the value.\n */\nexport class Skopeo {\n  private readonly path: string;\n  private readonly inspectRawCache = new Map<string, Promise<unknown>>();\n  private readonly inspectCache = new Map<string, Promise<SkopeoInspect>>();\n  private readonly existsCache = new Map<string, Promise<boolean>>();\n\n  constructor(skopeoPath?: string) {\n    const resolved = skopeoPath ?? which('skopeo');\n    if (!resolved) throw new InstallException('skopeo not found in PATH');\n    this.path = resolved;\n  }\n\n  async copy(src: string, dst: string): Promise<void> {\n    await run(\n      [\n        this.path,\n        'copy',\n        '--override-os=linux',\n        '--override-arch=amd64',\n        src,\n        dst,\n      ],\n      `skopeo copy failed: ${src}`,\n    );\n  }\n\n  async inspectRaw(url: string): Promise<unknown> {\n    const cached = this.inspectRawCache.get(url);\n    if (cached) return cached;\n    const pending = this.runInspect(url, true);\n    this.inspectRawCache.set(url, pending);\n    try {\n      return await pending;\n    } catch (err) {\n      this.inspectRawCache.delete(url);\n      throw err;\n    }\n  }\n\n  async inspect(url: string): Promise<SkopeoInspect> {\n    const cached = this.inspectCache.get(url);\n    if (cached) return cached;\n    const pending = this.runInspect(url, false) as Promise<SkopeoInspect>;\n    this.inspectCache.set(url, pending);\n    try {\n      return await pending;\n    } catch (err) {\n      this.inspectCache.delete(url);\n      throw err;\n    }\n  }\n\n  /**\n   * Returns true iff `skopeo inspect` succeeds; never throws. Result is\n   * memoized — subsequent calls for the same URL reuse the in-flight or\n   * resolved promise. This dedups the `resolveImage` registry probe across\n   * the many plugins that share the same OCI image (common for the RHDH\n   * plugin catalog).\n   */\n  async exists(url: string): Promise<boolean> {\n    const cached = this.existsCache.get(url);\n    if (cached) return cached;\n    const pending = new Promise<boolean>(resolve => {\n      const child = spawn(this.path, ['inspect', '--no-tags', url], {\n        stdio: 'ignore',\n      });\n      child.on('error', () => resolve(false));\n      child.on('close', code => resolve(code === 0));\n    });\n    this.existsCache.set(url, pending);\n    return pending;\n  }\n\n  private async runInspect(url: string, raw: boolean): Promise<unknown> {\n    const args = ['inspect', '--no-tags', url];\n    if (raw) args.splice(1, 0, '--raw'); // inspect --raw --no-tags <url>\n    const { stdout } = await run(\n      [this.path, ...args],\n      `skopeo inspect failed: ${url}`,\n    );\n    return JSON.parse(stdout);\n  }\n}\n\nexport type SkopeoInspect = {\n  Name?: string;\n  Digest?: string;\n  Labels?: Record<string, string>;\n  [key: string]: unknown;\n};\n"],"names":["which","InstallException","run","spawn"],"mappings":";;;;;;;AA2BO,MAAM,MAAA,CAAO;AAAA,EACD,IAAA;AAAA,EACA,eAAA,uBAAsB,GAAA,EAA8B;AAAA,EACpD,YAAA,uBAAmB,GAAA,EAAoC;AAAA,EACvD,WAAA,uBAAkB,GAAA,EAA8B;AAAA,EAEjE,YAAY,UAAA,EAAqB;AAC/B,IAAA,MAAM,QAAA,GAAW,UAAA,IAAcA,WAAA,CAAM,QAAQ,CAAA;AAC7C,IAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAIC,wBAAiB,0BAA0B,CAAA;AACpE,IAAA,IAAA,CAAK,IAAA,GAAO,QAAA;AAAA,EACd;AAAA,EAEA,MAAM,IAAA,CAAK,GAAA,EAAa,GAAA,EAA4B;AAClD,IAAA,MAAMC,OAAA;AAAA,MACJ;AAAA,QACE,IAAA,CAAK,IAAA;AAAA,QACL,MAAA;AAAA,QACA,qBAAA;AAAA,QACA,uBAAA;AAAA,QACA,GAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,uBAAuB,GAAG,CAAA;AAAA,KAC5B;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,GAAA,EAA+B;AAC9C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,GAAG,CAAA;AAC3C,IAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,GAAA,EAAK,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AACrC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,OAAA;AAAA,IACf,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,GAAG,CAAA;AAC/B,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,GAAA,EAAqC;AACjD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AACxC,IAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,GAAA,EAAK,KAAK,CAAA;AAC1C,IAAA,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAClC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,OAAA;AAAA,IACf,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,YAAA,CAAa,OAAO,GAAG,CAAA;AAC5B,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAO,GAAA,EAA+B;AAC1C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA;AACvC,IAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAiB,CAAA,OAAA,KAAW;AAC9C,MAAA,MAAM,KAAA,GAAQC,yBAAM,IAAA,CAAK,IAAA,EAAM,CAAC,SAAA,EAAW,WAAA,EAAa,GAAG,CAAA,EAAG;AAAA,QAC5D,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAK,CAAC,CAAA;AACtC,MAAA,KAAA,CAAM,GAAG,OAAA,EAAS,CAAA,IAAA,KAAQ,OAAA,CAAQ,IAAA,KAAS,CAAC,CAAC,CAAA;AAAA,IAC/C,CAAC,CAAA;AACD,IAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AACjC,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAc,UAAA,CAAW,GAAA,EAAa,GAAA,EAAgC;AACpE,IAAA,MAAM,IAAA,GAAO,CAAC,SAAA,EAAW,WAAA,EAAa,GAAG,CAAA;AACzC,IAAA,IAAI,GAAA,EAAK,IAAA,CAAK,MAAA,CAAO,CAAA,EAAG,GAAG,OAAO,CAAA;AAClC,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAMD,OAAA;AAAA,MACvB,CAAC,IAAA,CAAK,IAAA,EAAM,GAAG,IAAI,CAAA;AAAA,MACnB,0BAA0B,GAAG,CAAA;AAAA,KAC/B;AACA,IAAA,OAAO,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC1B;AACF;;;;"}

package/dist/tar-extract.cjs.js

@@ -0,0 +1,155 @@
+'use strict';
+
+var fs = require('node:fs/promises');
+var path = require('node:path');
+var tar = require('tar');
+var errors = require('./errors.cjs.js');
+var log = require('./log.cjs.js');
+var types = require('./types.cjs.js');
+var util = require('./util.cjs.js');
+
+function _interopNamespaceCompat(e) {
+  if (e && typeof e === 'object' && 'default' in e) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var fs__namespace = /*#__PURE__*/_interopNamespaceCompat(fs);
+var path__namespace = /*#__PURE__*/_interopNamespaceCompat(path);
+var tar__namespace = /*#__PURE__*/_interopNamespaceCompat(tar);
+
+const PACKAGE_PREFIX = "package/";
+async function extractOciPlugin(tarball, pluginPath, destination) {
+  assertSafePluginPath(pluginPath);
+  const destAbs = path__namespace.resolve(destination);
+  const pluginDir = path__namespace.join(destAbs, pluginPath);
+  await fs__namespace.rm(pluginDir, { recursive: true, force: true });
+  await fs__namespace.mkdir(destAbs, { recursive: true });
+  const pluginPathBoundary = pluginPath.endsWith("/") ? pluginPath : `${pluginPath}/`;
+  let pending = null;
+  await tar__namespace.x({
+    file: tarball,
+    cwd: destAbs,
+    preservePaths: false,
+    filter: (filePath, entry) => {
+      if (pending) return false;
+      const stat = entry;
+      if (filePath !== pluginPath && !filePath.startsWith(pluginPathBoundary))
+        return false;
+      if (stat.size > types.MAX_ENTRY_SIZE) {
+        pending = new errors.InstallException(`Zip bomb detected in ${filePath}`);
+        return false;
+      }
+      if (stat.type === "SymbolicLink" || stat.type === "Link") {
+        const linkName = stat.linkpath ?? "";
+        const linkTarget = path__namespace.resolve(destAbs, linkName);
+        if (!util.isInside(linkTarget, destAbs)) {
+          log.log(
+            `	==> WARNING: skipping file containing link outside of the archive: ${filePath} -> ${linkName}`
+          );
+          return false;
+        }
+      }
+      if (!util.isAllowedEntryType(stat.type)) {
+        pending = new errors.InstallException(
+          `Disallowed tar entry type ${stat.type} for ${filePath}`
+        );
+        return false;
+      }
+      return true;
+    }
+  });
+  if (pending) throw pending;
+}
+async function extractNpmPackage(archive) {
+  if (!archive.endsWith(".tgz")) {
+    throw new errors.InstallException(`Expected .tgz archive, got ${archive}`);
+  }
+  const pkgDir = archive.slice(0, -".tgz".length);
+  const pkgDirReal = path__namespace.resolve(pkgDir);
+  await fs__namespace.rm(pkgDir, { recursive: true, force: true });
+  await fs__namespace.mkdir(pkgDir, { recursive: true });
+  let pending = null;
+  await tar__namespace.x({
+    file: archive,
+    cwd: pkgDir,
+    preservePaths: false,
+    filter: (filePath, entry) => {
+      if (pending) return false;
+      const stat = entry;
+      if (stat.type === "Directory") return false;
+      if (stat.type === "File") {
+        if (!filePath.startsWith(PACKAGE_PREFIX)) {
+          pending = new errors.InstallException(
+            `NPM package archive does not start with 'package/' as it should: ${filePath}`
+          );
+          return false;
+        }
+        if (stat.size > types.MAX_ENTRY_SIZE) {
+          pending = new errors.InstallException(`Zip bomb detected in ${filePath}`);
+          return false;
+        }
+        stat.path = filePath.slice(PACKAGE_PREFIX.length);
+        return true;
+      }
+      if (stat.type === "SymbolicLink" || stat.type === "Link") {
+        const linkPath = stat.linkpath ?? "";
+        if (!linkPath.startsWith(PACKAGE_PREFIX)) {
+          pending = new errors.InstallException(
+            `NPM package archive contains a link outside of the archive: ${filePath} -> ${linkPath}`
+          );
+          return false;
+        }
+        stat.path = filePath.slice(PACKAGE_PREFIX.length);
+        stat.linkpath = linkPath.slice(PACKAGE_PREFIX.length);
+        const linkTarget = path__namespace.resolve(pkgDir, stat.linkpath);
+        if (!util.isInside(linkTarget, pkgDirReal)) {
+          pending = new errors.InstallException(
+            `NPM package archive contains a link outside of the archive: ${stat.path} -> ${stat.linkpath}`
+          );
+          return false;
+        }
+        return true;
+      }
+      pending = new errors.InstallException(
+        `NPM package archive contains a non-regular file: ${filePath}`
+      );
+      return false;
+    }
+  });
+  if (pending) throw pending;
+  await fs__namespace.rm(archive, { force: true });
+  return path__namespace.basename(pkgDirReal);
+}
+function assertSafePluginPath(pluginPath) {
+  if (path__namespace.isAbsolute(pluginPath)) {
+    throw new errors.InstallException(`Invalid plugin path (absolute): ${pluginPath}`);
+  }
+  if (pluginPath.length === 0) {
+    throw new errors.InstallException("Invalid plugin path (empty)");
+  }
+  const segments = pluginPath.split(/[/\\]/);
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..") {
+      throw new errors.InstallException(
+        `Invalid plugin path (path traversal detected): ${pluginPath}`
+      );
+    }
+  }
+}
+
+exports.extractNpmPackage = extractNpmPackage;
+exports.extractOciPlugin = extractOciPlugin;
+//# sourceMappingURL=tar-extract.cjs.js.map

package/dist/tar-extract.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar-extract.cjs.js","sources":["../src/tar-extract.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as tar from 'tar';\nimport { InstallException } from './errors';\nimport { log } from './log';\nimport { MAX_ENTRY_SIZE } from './types';\nimport { isAllowedEntryType, isInside } from './util';\n\nconst PACKAGE_PREFIX = 'package/';\n\n/**\n * Extract a slice of an OCI layer tarball into `destination/pluginPath`.\n *\n * Mirrors the Python `extract_oci_plugin` with the same security guards:\n *   - reject absolute or `..`-containing plugin paths\n *   - enforce per-entry size limit (MAX_ENTRY_SIZE) against zip bombs\n *   - skip sym/hard links whose targets would escape `destination`\n *   - reject device files / FIFOs (`tar` `filter` only emits regular types)\n *\n * Uses streaming via `node-tar` — no full-archive read into memory.\n */\nexport async function extractOciPlugin(\n  tarball: string,\n  pluginPath: string,\n  destination: string,\n): Promise<void> {\n  assertSafePluginPath(pluginPath);\n\n  const destAbs = path.resolve(destination);\n  const pluginDir = path.join(destAbs, pluginPath);\n  await fs.rm(pluginDir, { recursive: true, force: true });\n  await fs.mkdir(destAbs, { recursive: true });\n\n  // Boundary-safe path prefix — prevents `plugin-one` from matching sibling\n  // directories with the same prefix (e.g., `plugin-one-evil/`). Uses POSIX\n  // semantics because `node-tar` always emits forward-slash entry paths\n  // regardless of host OS.\n  const pluginPathBoundary = pluginPath.endsWith('/')\n    ? pluginPath\n    : `${pluginPath}/`;\n\n  // Errors thrown inside `tar` filter callbacks are sometimes swallowed by the\n  // parser; capture them in a closure and re-throw after extraction completes.\n  let pending: InstallException | null = null;\n\n  await tar.x({\n    file: tarball,\n    cwd: destAbs,\n    preservePaths: false,\n    filter: (filePath, entry) => {\n      if (pending) return false;\n      const stat = entry as tar.ReadEntry;\n      if (filePath !== pluginPath && !filePath.startsWith(pluginPathBoundary))\n        return false;\n\n      if (stat.size > MAX_ENTRY_SIZE) {\n        pending = new InstallException(`Zip bomb detected in ${filePath}`);\n        return false;\n      }\n      if (stat.type === 'SymbolicLink' || stat.type === 'Link') {\n        const linkName = stat.linkpath ?? '';\n        const linkTarget = path.resolve(destAbs, linkName);\n        if (!isInside(linkTarget, destAbs)) {\n          log(\n            `\\t==> WARNING: skipping file containing link outside of the archive: ${filePath} -> ${linkName}`,\n          );\n          return false;\n        }\n      }\n      if (!isAllowedEntryType(stat.type)) {\n        pending = new InstallException(\n          `Disallowed tar entry type ${stat.type} for ${filePath}`,\n        );\n        return false;\n      }\n      return true;\n    },\n  });\n\n  if (pending) throw pending;\n}\n\n/**\n * Extract an NPM tarball (`npm pack` output). Entries all start with `package/`\n * which is stripped. Matches `extract_npm_package` in fast.py, including the\n * realpath-based escape check for symlinks inside the archive.\n *\n * Returns the directory name (basename) the package was extracted into.\n */\nexport async function extractNpmPackage(archive: string): Promise<string> {\n  if (!archive.endsWith('.tgz')) {\n    throw new InstallException(`Expected .tgz archive, got ${archive}`);\n  }\n  const pkgDir = archive.slice(0, -'.tgz'.length);\n  const pkgDirReal = path.resolve(pkgDir);\n  await fs.rm(pkgDir, { recursive: true, force: true });\n  await fs.mkdir(pkgDir, { recursive: true });\n\n  let pending: InstallException | null = null;\n\n  await tar.x({\n    file: archive,\n    cwd: pkgDir,\n    preservePaths: false,\n    filter: (filePath, entry) => {\n      if (pending) return false;\n      const stat = entry as tar.ReadEntry;\n      if (stat.type === 'Directory') return false;\n\n      if (stat.type === 'File') {\n        if (!filePath.startsWith(PACKAGE_PREFIX)) {\n          pending = new InstallException(\n            `NPM package archive does not start with 'package/' as it should: ${filePath}`,\n          );\n          return false;\n        }\n        if (stat.size > MAX_ENTRY_SIZE) {\n          pending = new InstallException(`Zip bomb detected in ${filePath}`);\n          return false;\n        }\n        stat.path = filePath.slice(PACKAGE_PREFIX.length);\n        return true;\n      }\n\n      if (stat.type === 'SymbolicLink' || stat.type === 'Link') {\n        const linkPath = stat.linkpath ?? '';\n        if (!linkPath.startsWith(PACKAGE_PREFIX)) {\n          pending = new InstallException(\n            `NPM package archive contains a link outside of the archive: ${filePath} -> ${linkPath}`,\n          );\n          return false;\n        }\n        stat.path = filePath.slice(PACKAGE_PREFIX.length);\n        stat.linkpath = linkPath.slice(PACKAGE_PREFIX.length);\n        const linkTarget = path.resolve(pkgDir, stat.linkpath);\n        if (!isInside(linkTarget, pkgDirReal)) {\n          pending = new InstallException(\n            `NPM package archive contains a link outside of the archive: ${stat.path} -> ${stat.linkpath}`,\n          );\n          return false;\n        }\n        return true;\n      }\n\n      pending = new InstallException(\n        `NPM package archive contains a non-regular file: ${filePath}`,\n      );\n      return false;\n    },\n  });\n\n  if (pending) throw pending;\n\n  await fs.rm(archive, { force: true });\n  return path.basename(pkgDirReal);\n}\n\n/**\n * Validate a plugin path against traversal attempts. Segment-based — a bare\n * `..` substring in a filename (`my..plugin`) is allowed; a `..` path segment\n * (`foo/../bar`) is not. Absolute paths, empty segments, and `.` segments are\n * also rejected.\n */\nfunction assertSafePluginPath(pluginPath: string): void {\n  if (path.isAbsolute(pluginPath)) {\n    throw new InstallException(`Invalid plugin path (absolute): ${pluginPath}`);\n  }\n  if (pluginPath.length === 0) {\n    throw new InstallException('Invalid plugin path (empty)');\n  }\n  const segments = pluginPath.split(/[/\\\\]/);\n  for (const segment of segments) {\n    if (segment === '' || segment === '.' || segment === '..') {\n      throw new InstallException(\n        `Invalid plugin path (path traversal detected): ${pluginPath}`,\n      );\n    }\n  }\n}\n"],"names":["path","fs","tar","MAX_ENTRY_SIZE","InstallException","isInside","log","isAllowedEntryType"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,cAAA,GAAiB,UAAA;AAavB,eAAsB,gBAAA,CACpB,OAAA,EACA,UAAA,EACA,WAAA,EACe;AACf,EAAA,oBAAA,CAAqB,UAAU,CAAA;AAE/B,EAAA,MAAM,OAAA,GAAUA,eAAA,CAAK,OAAA,CAAQ,WAAW,CAAA;AACxC,EAAA,MAAM,SAAA,GAAYA,eAAA,CAAK,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAC/C,EAAA,MAAMC,aAAA,CAAG,GAAG,SAAA,EAAW,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACvD,EAAA,MAAMA,cAAG,KAAA,CAAM,OAAA,EAAS,EAAE,SAAA,EAAW,MAAM,CAAA;AAM3C,EAAA,MAAM,qBAAqB,UAAA,CAAW,QAAA,CAAS,GAAG,CAAA,GAC9C,UAAA,GACA,GAAG,UAAU,CAAA,CAAA,CAAA;AAIjB,EAAA,IAAI,OAAA,GAAmC,IAAA;AAEvC,EAAA,MAAMC,eAAI,CAAA,CAAE;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,GAAA,EAAK,OAAA;AAAA,IACL,aAAA,EAAe,KAAA;AAAA,IACf,MAAA,EAAQ,CAAC,QAAA,EAAU,KAAA,KAAU;AAC3B,MAAA,IAAI,SAAS,OAAO,KAAA;AACpB,MAAA,MAAM,IAAA,GAAO,KAAA;AACb,MAAA,IAAI,QAAA,KAAa,UAAA,IAAc,CAAC,QAAA,CAAS,WAAW,kBAAkB,CAAA;AACpE,QAAA,OAAO,KAAA;AAET,MAAA,IAAI,IAAA,CAAK,OAAOC,oBAAA,EAAgB;AAC9B,QAAA,OAAA,GAAU,IAAIC,uBAAA,CAAiB,CAAA,qBAAA,EAAwB,QAAQ,CAAA,CAAE,CAAA;AACjE,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,IAAI,IAAA,CAAK,IAAA,KAAS,cAAA,IAAkB,IAAA,CAAK,SAAS,MAAA,EAAQ;AACxD,QAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,EAAA;AAClC,QAAA,MAAM,UAAA,GAAaJ,eAAA,CAAK,OAAA,CAAQ,OAAA,EAAS,QAAQ,CAAA;AACjD,QAAA,IAAI,CAACK,aAAA,CAAS,UAAA,EAAY,OAAO,CAAA,EAAG;AAClC,UAAAC,OAAA;AAAA,YACE,CAAA,oEAAA,EAAwE,QAAQ,CAAA,IAAA,EAAO,QAAQ,CAAA;AAAA,WACjG;AACA,UAAA,OAAO,KAAA;AAAA,QACT;AAAA,MACF;AACA,MAAA,IAAI,CAACC,uBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA,EAAG;AAClC,QAAA,OAAA,GAAU,IAAIH,uBAAA;AAAA,UACZ,CAAA,0BAAA,EAA6B,IAAA,CAAK,IAAI,CAAA,KAAA,EAAQ,QAAQ,CAAA;AAAA,SACxD;AACA,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,GACD,CAAA;AAED,EAAA,IAAI,SAAS,MAAM,OAAA;AACrB;AASA,eAAsB,kBAAkB,OAAA,EAAkC;AACxE,EAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAIA,uBAAA,CAAiB,CAAA,2BAAA,EAA8B,OAAO,CAAA,CAAE,CAAA;AAAA,EACpE;AACA,EAAA,MAAM,SAAS,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,OAAO,MAAM,CAAA;AAC9C,EAAA,MAAM,UAAA,GAAaJ,eAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AACtC,EAAA,MAAMC,aAAA,CAAG,GAAG,MAAA,EAAQ,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACpD,EAAA,MAAMA,cAAG,KAAA,CAAM,MAAA,EAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAE1C,EAAA,IAAI,OAAA,GAAmC,IAAA;AAEvC,EAAA,MAAMC,eAAI,CAAA,CAAE;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,GAAA,EAAK,MAAA;AAAA,IACL,aAAA,EAAe,KAAA;AAAA,IACf,MAAA,EAAQ,CAAC,QAAA,EAAU,KAAA,KAAU;AAC3B,MAAA,IAAI,SAAS,OAAO,KAAA;AACpB,MAAA,MAAM,IAAA,GAAO,KAAA;AACb,MAAA,IAAI,IAAA,CAAK,IAAA,KAAS,WAAA,EAAa,OAAO,KAAA;AAEtC,MAAA,IAAI,IAAA,CAAK,SAAS,MAAA,EAAQ;AACxB,QAAA,IAAI,CAAC,QAAA,CAAS,UAAA,CAAW,cAAc,CAAA,EAAG;AACxC,UAAA,OAAA,GAAU,IAAIE,uBAAA;AAAA,YACZ,oEAAoE,QAAQ,CAAA;AAAA,WAC9E;AACA,UAAA,OAAO,KAAA;AAAA,QACT;AACA,QAAA,IAAI,IAAA,CAAK,OAAOD,oBAAA,EAAgB;AAC9B,UAAA,OAAA,GAAU,IAAIC,uBAAA,CAAiB,CAAA,qBAAA,EAAwB,QAAQ,CAAA,CAAE,CAAA;AACjE,UAAA,OAAO,KAAA;AAAA,QACT;AACA,QAAA,IAAA,CAAK,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,cAAA,CAAe,MAAM,CAAA;AAChD,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,IAAI,IAAA,CAAK,IAAA,KAAS,cAAA,IAAkB,IAAA,CAAK,SAAS,MAAA,EAAQ;AACxD,QAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,EAAA;AAClC,QAAA,IAAI,CAAC,QAAA,CAAS,UAAA,CAAW,cAAc,CAAA,EAAG;AACxC,UAAA,OAAA,GAAU,IAAIA,uBAAA;AAAA,YACZ,CAAA,4DAAA,EAA+D,QAAQ,CAAA,IAAA,EAAO,QAAQ,CAAA;AAAA,WACxF;AACA,UAAA,OAAO,KAAA;AAAA,QACT;AACA,QAAA,IAAA,CAAK,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,cAAA,CAAe,MAAM,CAAA;AAChD,QAAA,IAAA,CAAK,QAAA,GAAW,QAAA,CAAS,KAAA,CAAM,cAAA,CAAe,MAAM,CAAA;AACpD,QAAA,MAAM,UAAA,GAAaJ,eAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,KAAK,QAAQ,CAAA;AACrD,QAAA,IAAI,CAACK,aAAA,CAAS,UAAA,EAAY,UAAU,CAAA,EAAG;AACrC,UAAA,OAAA,GAAU,IAAID,uBAAA;AAAA,YACZ,CAAA,4DAAA,EAA+D,IAAA,CAAK,IAAI,CAAA,IAAA,EAAO,KAAK,QAAQ,CAAA;AAAA,WAC9F;AACA,UAAA,OAAO,KAAA;AAAA,QACT;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAA,GAAU,IAAIA,uBAAA;AAAA,QACZ,oDAAoD,QAAQ,CAAA;AAAA,OAC9D;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,GACD,CAAA;AAED,EAAA,IAAI,SAAS,MAAM,OAAA;AAEnB,EAAA,MAAMH,cAAG,EAAA,CAAG,OAAA,EAAS,EAAE,KAAA,EAAO,MAAM,CAAA;AACpC,EAAA,OAAOD,eAAA,CAAK,SAAS,UAAU,CAAA;AACjC;AAQA,SAAS,qBAAqB,UAAA,EAA0B;AACtD,EAAA,IAAIA,eAAA,CAAK,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAII,uBAAA,CAAiB,CAAA,gCAAA,EAAmC,UAAU,CAAA,CAAE,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAIA,wBAAiB,6BAA6B,CAAA;AAAA,EAC1D;AACA,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACzC,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,OAAA,KAAY,EAAA,IAAM,OAAA,KAAY,GAAA,IAAO,YAAY,IAAA,EAAM;AACzD,MAAA,MAAM,IAAIA,uBAAA;AAAA,QACR,kDAAkD,UAAU,CAAA;AAAA,OAC9D;AAAA,IACF;AAAA,EACF;AACF;;;;;"}