@sakajunquality/bunko 0.1.0-rc.5 → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/PROVENANCE.jsonl +1 -1
  2. package/README.md +4 -4
  3. package/SHA256SUMS +1 -1
  4. package/bunko.js +1 -1
  5. package/package.json +2 -2
package/PROVENANCE.jsonl CHANGED
@@ -1 +1 @@
1
- {"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHMzCCBrigAwIBAgIUEeLCSb5QKyMp4HeEeCnVwQUPJ3IwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTA5MDM0MTU4WhcNMjYwOTA5MDM1MTU4WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfd08I5jgHkGX6n0/98wOPmMTL1PbGD8VqIWYpRnrz5weFA4gqFdNW0zSyTMF/NJ2NOc0k2U2z/lW5/mOMl1BlaOCBdcwggXTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUEz6ZL8MeANXdMssZhG/Ut1UQI4YwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8waQYDVR0RAQH/BF8wXYZbaHR0cHM6Ly9naXRodWIuY29tL3Nha2FqdW5xdWFsaXR5L2J1bmtvLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvdGFncy92MC4xLjAtcmMuNTA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMBIGCisGAQQBg78wAQIEBHB1c2gwNgYKKwYBBAGDvzABAwQoY2FjYTA2NzE1MWQyZDRlMGQxODM5N2RjZjU4NDZhMGIwOWRjN2ZkODAVBgorBgEEAYO/MAEEBAdSZWxlYXNlMCIGCisGAQQBg78wAQUEFHNha2FqdW5xdWFsaXR5L2J1bmtvMCMGCisGAQQBg78wAQYEFXJlZnMvdGFncy92MC4xLjAtcmMuNTA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wawYKKwYBBAGDvzABCQRdDFtodHRwczovL2dpdGh1Yi5jb20vc2FrYWp1bnF1YWxpdHkvYnVua28vLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy90YWdzL3YwLjEuMC1yYy41MDgGCisGAQQBg78wAQoEKgwoY2FjYTA2NzE1MWQyZDRlMGQxODM5N2RjZjU4NDZhMGIwOWRjN2ZkODAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwNwYKKwYBBAGDvzABDAQpDCdodHRwczovL2dpdGh1Yi5jb20vc2FrYWp1bnF1YWxpdHkvYnVua28wOAYKKwYBBAGDvzABDQQqDChjYWNhMDY3MTUxZDJkNGUwZDE4Mzk3ZGNmNTg0NmEwYjA5ZGM3ZmQ4MCUGCisGAQQBg78wAQ4EFwwVcmVmcy90YWdzL3YwLjEuMC1yYy41MBoGCisGAQQBg78wAQ8EDAwKMTM1OTgxNTg0MDAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9zYWthanVucXVhbGl0eTAXBgorBgEEAYO/MAERBAkMBzI3MTUzMjQwawYKKwYBBAGDvzABEgRdDFtodHRwczovL2dpdGh1Yi5jb20vc2FrYWp1bnF1YWxpdHkvYnVua28vLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy90YWdzL3YwLjEuMC1yYy41MDgGCisGAQQBg78wARMEKgwoY2FjYTA2NzE1MWQyZDRlMGQxODM5N2RjZjU4NDZhMGIwOWRjN2ZkODAUBgorBgEEAYO/MAEUBAYMBHB1c2gwWwYKKwYBBAGDvzABFQRNDEtodHRwczovL2dpdGh1Yi5jb20vc2FrYWp1bnF1YWxpdHkvYnVua28vYWN0aW9ucy9ydW5zLzM0MzA3OTk3ODgzL2F0dGVtcHRzLzEwFgYKKwYBBAGDvzABFgQIDAZwdWJsaWMwVgYKKwYBBAGDvzABGARIDEZyZXBvOnNha2FqdW5xdWFsaXR5QDI3MTUzMjQvYnVua29AMTM1OTgxNTg0MDpyZWY6cmVmcy90YWdzL3YwLjEuMC1yYy41MIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGghEIVTQAABAMARzBFAiEAxuaPoA5c4PO7zEA9K/V5f7aP0cV8kFHtuZH1MNAKYYICIAmj47v3kG2hWf/Xe30pyYUKFWu+yd80tFJCdbKOAsxCMAoGCCqGSM49BAMDA2kAMGYCMQDR5vb9+b1BwKG6PQ2EKoF2lRD+IkF2XlELsT02iZ84Lsp7yacOO4WOeZ8MI2kuoHUCMQDjM5WbDOmiajuQrxdJ9Fwfdb5e4gC+nHqxzgAp03iSM83JCwJtscPhvQqoRH1M+eE="},"tlogEntries":[{"logIndex":"2764931298","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1788925318","inclusionPromise":{"signedEntryTimestamp":"MEYCIQDl2VobEHNi7GqeUBHEGL7Rz7Uad6NQOrSCVD+ORK5lRQIhAMF9Oib9uYgc8KQhVXb35PaU+uDS7gd88eGNRfhGsBmL"},"inclusionProof":{"logIndex":"2643027036","rootHash":"g3GwGavrFGkWUlV903hEpaVHjbOD63bYPYVO7TokFno=","treeSize":"2643027039","hashes":["zhfcTaHsjXV+GnTUZH0aHjm2Ktq9xj5vFTKfG79mHrY=","vDtAFAeOFRXFaupz3yYrAJ78Q3gLZN+xLUxJPS9IYao=","J6XW/8iQ1fvMYpBE1FIFyI75+qXIyqQK46gBLu1/eqI=","gOCUF+KDEialxzUWDOKXdF/6FskWQ0DUZHH67c/1WwI=","D3Ju2u8lfniQAaeknOPCTrUu+ByRvNmbIhPXnwRFKbA=","Gns64Xkvd1bnwJPDGYR9aMRS6E2PlC2iYiY6DuOe++A=","VTuxYaYRA1ubHyoO84oyXjM6mDMSc2/Y/IoJt8uNvvc=","YDNxCg7fEUoNZhXIDML7nnCvKs/yZ8CtCmx+x1NA234=","NotpWZxN2m+XgFkC+ECZPwqvN3sVLMcuK9REMcCgpfc=","DUDQH7X4mvl2U6wz8MybTRqatFuHquAN/04/J5kid1w=","dWm6l8XtUrFMJ3P4GXEDpiKc9JD3M/Iq09fjrTXBvlg=","OKWN1G4oUgX0vOPSRhdtVujvqRsR08JAhf19wutm310=","THpoooyT1aJDLntbZCAv/Nb81xZdlvET7nd2UZvhUIo=","7tD2K8mAqGTMENrP2YXWz71BeTWQPCiYd3CESAgQLz8=","eXSLrLqKSxRTixSP/k4YimriB2lufao6trqTrsxxlyg=","SndbMKVtcTenAkwi2JBfGzD+mhexp1qJbRIY+A1JRIU=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2643027039\ng3GwGavrFGkWUlV903hEpaVHjbOD63bYPYVO7TokFno=\n\n— rekor.sigstore.dev wNI9ajBEAiBRMfcSxWwDGXpJn6cScpezuxbyypMbtHEIsrRY1i8bPQIgFFA3g8PcGkjtlh2AcUdYV9K8m+G5vzNYGAB3jbTEz/k=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZjQ3MWM3N2QxOGI1ZGQ2YWEyNDQyY2FhZWNkMmE5YTZlOTBmYzA3ZWNhMjZiMGRhM2M2MzYwNjNmNmE3NjdmMyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjBiYjBkMDdmY2Y1ZjM3ZjZhNWExOTc5MjM4NzUyNThkOTNmZWMzNTUyZWViMTBkNGVkNjBiMWRmNzBmMTJkMjMifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRQ3pOb2RqMnczQ3A5cjVQM2wyb1ZyN2tpWXhKRURvNXFWd0diM0w2NGo3aEFJaEFLeW40eTJQeUw4VGhWcXQrWDRxOXFyRXA0SEgxZDErMUtlR2lOWndSYzNFIiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VoTmVrTkRRbkpwWjBGM1NVSkJaMGxWUldWTVExTmlOVkZMZVUxd05FaGxSV1ZEYmxaM1VWVlFTak5KZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVRVFZOUkUwd1RWUlZORmRvWTA1TmFsbDNUMVJCTlUxRVRURk5WRlUwVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVm1aREE0U1RWcVowaHJSMWcyYmpBdk9UaDNUMUJ0VFZSTU1WQmlSMFE0Vm5GSlYxa0tjRkp1Y25vMWQyVkdRVFJuY1Vaa1RsY3dlbE41VkUxR0wwNUtNazVQWXpCck1sVXllaTlzVnpVdmJVOU5iREZDYkdGUFEwSmtZM2RuWjFoVVRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVkZlalphQ2t3NFRXVkJUbGhrVFhOeldtaEhMMVYwTVZWUlNUUlpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMkZSV1VSV1VqQlNRVkZJTDBKR09IZFlXVnBpWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBURE5PYUdFeVJuRmtWelY0WkZkR2N3cGhXRkkxVERKS01XSnRkSFpNZVRWdVlWaFNiMlJYU1haa01qbDVZVEphYzJJelpIcE1NMHBzWWtkV2FHTXlWWFZsVnpGelVVaEtiRnB1VFhaa1IwWnVDbU41T1RKTlF6UjRUR3BCZEdOdFRYVk9WRUUxUW1kdmNrSm5SVVZCV1U4dlRVRkZRa0pEZEc5a1NGSjNZM3B2ZGt3elVuWmhNbFoxVEcxR2FtUkhiSFlLWW01TmRWb3liREJoU0ZacFpGaE9iR050VG5aaWJsSnNZbTVSZFZreU9YUk5Ra2xIUTJselIwRlJVVUpuTnpoM1FWRkpSVUpJUWpGak1tZDNUbWRaU3dwTGQxbENRa0ZIUkhaNlFVSkJkMUZ2V1RKR2FsbFVRVEpPZWtVeFRWZFJlVnBFVW14TlIxRjRUMFJOTlU0eVVtcGFhbFUwVGtSYWFFMUhTWGRQVjFKcUNrNHlXbXRQUkVGV1FtZHZja0puUlVWQldVOHZUVUZGUlVKQlpGTmFWM2hzV1ZoT2JFMURTVWREYVhOSFFWRlJRbWMzT0hkQlVWVkZSa2hPYUdFeVJuRUtaRmMxZUdSWFJuTmhXRkkxVERKS01XSnRkSFpOUTAxSFEybHpSMEZSVVVKbk56aDNRVkZaUlVaWVNteGFiazEyWkVkR2JtTjVPVEpOUXpSNFRHcEJkQXBqYlUxMVRsUkJOMEpuYjNKQ1owVkZRVmxQTDAxQlJVbENRekJOU3pKb01HUklRbnBQYVRoMlpFYzVjbHBYTkhWWlYwNHdZVmM1ZFdONU5XNWhXRkp2Q21SWFNqRmpNbFo1V1RJNWRXUkhWblZrUXpWcVlqSXdkMkYzV1V0TGQxbENRa0ZIUkhaNlFVSkRVVkprUkVaMGIyUklVbmRqZW05MlRESmtjR1JIYURFS1dXazFhbUl5TUhaak1rWnlXVmR3TVdKdVJqRlpWM2h3WkVocmRsbHVWblZoTWpoMlRHMWtjR1JIYURGWmFUa3pZak5LY2xwdGVIWmtNMDEyWTIxV2N3cGFWMFo2V2xNMU5XSlhlRUZqYlZadFkzazVNRmxYWkhwTU0xbDNUR3BGZFUxRE1YbFplVFF4VFVSblIwTnBjMGRCVVZGQ1p6YzRkMEZSYjBWTFozZHZDbGt5Um1wWlZFRXlUbnBGTVUxWFVYbGFSRkpzVFVkUmVFOUVUVFZPTWxKcVdtcFZORTVFV21oTlIwbDNUMWRTYWs0eVdtdFBSRUZrUW1kdmNrSm5SVVVLUVZsUEwwMUJSVXhDUVRoTlJGZGtjR1JIYURGWmFURnZZak5PTUZwWFVYZE9kMWxMUzNkWlFrSkJSMFIyZWtGQ1JFRlJjRVJEWkc5a1NGSjNZM3B2ZGdwTU1tUndaRWRvTVZscE5XcGlNakIyWXpKR2NsbFhjREZpYmtZeFdWZDRjR1JJYTNaWmJsWjFZVEk0ZDA5QldVdExkMWxDUWtGSFJIWjZRVUpFVVZGeENrUkRhR3BaVjA1b1RVUlpNMDFVVlhoYVJFcHJUa2RWZDFwRVJUUk5lbXN6V2tkT2JVNVVaekJPYlVWM1dXcEJOVnBIVFROYWJWRTBUVU5WUjBOcGMwY0tRVkZSUW1jM09IZEJVVFJGUm5kM1ZtTnRWbTFqZVRrd1dWZGtla3d6V1hkTWFrVjFUVU14ZVZsNU5ERk5RbTlIUTJselIwRlJVVUpuTnpoM1FWRTRSUXBFUVhkTFRWUk5NVTlVWjNoT1ZHY3dUVVJCZUVKbmIzSkNaMFZGUVZsUEwwMUJSVkZDUTAxTlNWZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyQ21KVE9YcFpWM1JvWVc1V2RXTllWbWhpUjJ3d1pWUkJXRUpuYjNKQ1owVkZRVmxQTDAxQlJWSkNRV3ROUW5wSk0wMVVWWHBOYWxGM1lYZFpTMHQzV1VJS1FrRkhSSFo2UVVKRloxSmtSRVowYjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbU15Um5KWlYzQXhZbTVHTVZsWGVIQmtTR3QyV1c1V2RRcGhNamgyVEcxa2NHUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJZMjFXYzFwWFJucGFVelUxWWxkNFFXTnRWbTFqZVRrd1dWZGtla3d6V1hkTWFrVjFDazFETVhsWmVUUXhUVVJuUjBOcGMwZEJVVkZDWnpjNGQwRlNUVVZMWjNkdldUSkdhbGxVUVRKT2VrVXhUVmRSZVZwRVVteE5SMUY0VDBSTk5VNHlVbW9LV21wVk5FNUVXbWhOUjBsM1QxZFNhazR5V210UFJFRlZRbWR2Y2tKblJVVkJXVTh2VFVGRlZVSkJXVTFDU0VJeFl6Sm5kMWQzV1V0TGQxbENRa0ZIUkFwMmVrRkNSbEZTVGtSRmRHOWtTRkozWTNwdmRrd3laSEJrUjJneFdXazFhbUl5TUhaak1rWnlXVmR3TVdKdVJqRlpWM2h3WkVocmRsbHVWblZoTWpoMkNsbFhUakJoVnpsMVkzazVlV1JYTlhwTWVrMHdUWHBCTTA5VWF6TlBSR2Q2VERKR01HUkhWblJqU0ZKNlRIcEZkMFpuV1V0TGQxbENRa0ZIUkhaNlFVSUtSbWRSU1VSQlduZGtWMHB6WVZkTmQxWm5XVXRMZDFsQ1FrRkhSSFo2UVVKSFFWSkpSRVZhZVZwWVFuWlBiazVvWVRKR2NXUlhOWGhrVjBaellWaFNOUXBSUkVrelRWUlZlazFxVVhaWmJsWjFZVEk1UVUxVVRURlBWR2Q0VGxSbk1FMUVjSGxhVjFrMlkyMVdiV041T1RCWlYyUjZURE5aZDB4cVJYVk5RekY1Q2xsNU5ERk5TVWRMUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJZDBWbFowSTBRVWhaUVROVU1IZGhjMkpJUlZSS2FrZFNOR050VjJNelFYRktTMWh5YW1VS1VFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIyZG9SVWxXVkZGQlFVSkJUVUZTZWtKR1FXbEZRWGgxWVZCdlFUVmpORkJQTjNwRlFUbExMMVkxWmpkaFVBb3dZMVk0YTBaSWRIVmFTREZOVGtGTFdWbEpRMGxCYldvME4zWXphMGN5YUZkbUwxaGxNekJ3ZVZsVlMwWlhkU3Q1WkRnd2RFWktRMlJpUzA5QmMzaERDazFCYjBkRFEzRkhVMDAwT1VKQlRVUkJNbXRCVFVkWlEwMVJSRkkxZG1JNUsySXhRbmRMUnpaUVVUSkZTMjlHTW14U1JDdEphMFl5V0d4RlRITlVNRElLYVZvNE5FeHpjRGQ1WVdOUFR6UlhUMlZhT0UxSk1tdDFiMGhWUTAxUlJHcE5OVmRpUkU5dGFXRnFkVkZ5ZUdSS09VWjNabVJpTldVMFowTXJia2h4ZUFwNlowRndNRE5wVTAwNE0wcERkMHAwYzJOUWFIWlJjVzlTU0RGTksyVkZQUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In1dfX0="}],"timestampVerificationData":{}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYnVua28uanMiLCJkaWdlc3QiOnsic2hhMjU2IjoiNTZlNGMyZWY1N2ViZGIxYjJhYzBmMGM0YzZlN2NjZWU2MzgzYzlkZjhhODY2NDNhZTliNTIwZWFlMTQyN2Q4MyJ9fSx7Im5hbWUiOiJTSEEyNTZTVU1TIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjM1NGJlYWVlOTMyNjJkODI1MzJjYmYyZmM5YmViM2U0ODM0OWEwOTZmZWUxOWFmMzg1NGVkNGNkZTU5ZDdlNDgifX0seyJuYW1lIjoiTElDRU5TRSIsImRpZ2VzdCI6eyJzaGEyNTYiOiJiNzY2M2E5YzE1N2RlNDc3NzAwN2VhZDQyMTVjNDI3NDIwZjhlYmZiODlhMjQzNTk4NDU0YzdhNmU5MWE5MjNkIn19LHsibmFtZSI6IlRISVJEX1BBUlRZX05PVElDRVMubWQiLCJkaWdlc3QiOnsic2hhMjU2IjoiODQzNzljZWM4ZGM1YjkzYmMyYWQzM2I2ZDJiMmIzNzEzZDRiMjAxZWI1MGNhNGNiNTFiMjcxZDY2Y2JlYjI3MCJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vYWN0aW9ucy5naXRodWIuaW8vYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL3RhZ3MvdjAuMS4wLXJjLjUiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL3Nha2FqdW5xdWFsaXR5L2J1bmtvIiwicGF0aCI6Ii5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sIn19LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJwdXNoIiwicmVwb3NpdG9yeV9pZCI6IjEzNTk4MTU4NDAiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjcxNTMyNCIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL3Nha2FqdW5xdWFsaXR5L2J1bmtvQHJlZnMvdGFncy92MC4xLjAtcmMuNSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJjYWNhMDY3MTUxZDJkNGUwZDE4Mzk3ZGNmNTg0NmEwYjA5ZGM3ZmQ4In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zYWthanVucXVhbGl0eS9idW5rby8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjAuMS4wLXJjLjUifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL3Nha2FqdW5xdWFsaXR5L2J1bmtvL2FjdGlvbnMvcnVucy8zNDMwNzk5Nzg4My9hdHRlbXB0cy8xIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEYCIQCzNodj2w3Cp9r5P3l2oVr7kiYxJEDo5qVwGb3L64j7hAIhAKyn4y2PyL8ThVqt+X4q9qrEp4HH1d1+1KeGiNZwRc3E"}]}}
1
+ {"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHFDCCBpqgAwIBAgIUG6ighqbllxn9ZhLaE2b1piswDkMwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTA5MDYxNTQ2WhcNMjYwOTA5MDYyNTQ2WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQ3ziGOsN7fnZRkOo4AcRN0QSqo0i6skgHc5ifU3KxFT8QMXBClGeokRuv5m8rgKUvqaLRgVTCMKGRxT64Qpf1qOCBbkwggW1MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU9AYbsn2WGZCro5Oz3s50AWY8rcYwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wZAYDVR0RAQH/BFowWIZWaHR0cHM6Ly9naXRodWIuY29tL3Nha2FqdW5xdWFsaXR5L2J1bmtvLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvdGFncy92MC4xLjAwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTASBgorBgEEAYO/MAECBARwdXNoMDYGCisGAQQBg78wAQMEKDllYTY1ODBiNzE5MDQ5ZjRhZmEzZmNjOGNmM2FlMmYyMWI4Y2M3MjIwFQYKKwYBBAGDvzABBAQHUmVsZWFzZTAiBgorBgEEAYO/MAEFBBRzYWthanVucXVhbGl0eS9idW5rbzAeBgorBgEEAYO/MAEGBBByZWZzL3RhZ3MvdjAuMS4wMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTBmBgorBgEEAYO/MAEJBFgMVmh0dHBzOi8vZ2l0aHViLmNvbS9zYWthanVucXVhbGl0eS9idW5rby8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjAuMS4wMDgGCisGAQQBg78wAQoEKgwoOWVhNjU4MGI3MTkwNDlmNGFmYTNmY2M4Y2YzYWUyZjIxYjhjYzcyMjAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwNwYKKwYBBAGDvzABDAQpDCdodHRwczovL2dpdGh1Yi5jb20vc2FrYWp1bnF1YWxpdHkvYnVua28wOAYKKwYBBAGDvzABDQQqDCg5ZWE2NTgwYjcxOTA0OWY0YWZhM2ZjYzhjZjNhZTJmMjFiOGNjNzIyMCAGCisGAQQBg78wAQ4EEgwQcmVmcy90YWdzL3YwLjEuMDAaBgorBgEEAYO/MAEPBAwMCjEzNTk4MTU4NDAwMQYKKwYBBAGDvzABEAQjDCFodHRwczovL2dpdGh1Yi5jb20vc2FrYWp1bnF1YWxpdHkwFwYKKwYBBAGDvzABEQQJDAcyNzE1MzI0MGYGCisGAQQBg78wARIEWAxWaHR0cHM6Ly9naXRodWIuY29tL3Nha2FqdW5xdWFsaXR5L2J1bmtvLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvdGFncy92MC4xLjAwOAYKKwYBBAGDvzABEwQqDCg5ZWE2NTgwYjcxOTA0OWY0YWZhM2ZjYzhjZjNhZTJmMjFiOGNjNzIyMBQGCisGAQQBg78wARQEBgwEcHVzaDBbBgorBgEEAYO/MAEVBE0MS2h0dHBzOi8vZ2l0aHViLmNvbS9zYWthanVucXVhbGl0eS9idW5rby9hY3Rpb25zL3J1bnMvMzQzMTc1NzMyNzcvYXR0ZW1wdHMvMjAWBgorBgEEAYO/MAEWBAgMBnB1YmxpYzBRBgorBgEEAYO/MAEYBEMMQXJlcG86c2FrYWp1bnF1YWxpdHlAMjcxNTMyNC9idW5rb0AxMzU5ODE1ODQwOnJlZjpyZWZzL3RhZ3MvdjAuMS4wMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGghM7kdgAABAMARzBFAiEAlAenK1QATXM9lLFWGk3fTqZHiQ5iMx/YSXUsZG+dafACIEA6QkuteKaEhNx5yIDdMFGEBRNZYx2JNUlcaBvtPmZgMAoGCCqGSM49BAMDA2gAMGUCMCHWB1B59wJKDpAqc5CDy5rerVe0M1dsnCjO4dIKkuUOa7Vub59pRnSy0hGVvb7WNgIxAMv4rG7wWC25jR+KRtyD8yHsJxk8djRvAAAXDBddVjA2hxa8CoZx+/s8FnfB0nM2UA=="},"tlogEntries":[{"logIndex":"2765794610","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1788934546","inclusionPromise":{"signedEntryTimestamp":"MEUCIA0wEFIsj4Wx2ptpt8SF3/P8nca2SOHIMO6IlP3TAjYAAiEAuh5q7XW2yRIiWlfEZAeHOKdfks5UJEIRvxGiJTF1Qco="},"inclusionProof":{"logIndex":"2643890348","rootHash":"zg8Jg3aojnyIt6lqU+5Xr+bB+JEVc5+v2Q7VVIZSQtw=","treeSize":"2643890356","hashes":["M7R3BY1my+hm4Xf6AwQpPQbreYO6TQlg0x4zhuZwozs=","g/dBc+jYrmEDxY4ln+sPcXDW1nXudFw/lFww7wL2aZw=","KuacNSOavuzaLINj/3GY+zUX/xYxOe/AQmmRq6W3Ij4=","Ahoy5ceAur2znU4U2hb+TlMIVHvxBKrcmhrjklXQDyY=","K0N6Grsr+UG+YuEkLl837omQf4d5VvJDF0ffXxqyIwg=","d858YE/qIOI0an+MsuRNhcYApMpITyXYItK3BFC/sy8=","7CBQVxZZftPR3kZLPayUHqnkgFNADq3n7xVrc6vS8RI=","2w1mxDEijKXpAyMFI5yNYEFgrjprh8laDTX7etXnMys=","ssTyTIrAQoDfC3nvc7r381yJG7UNF+GdEPdpGVG0JqQ=","KKR5dQAl0vCH4XXuqBjp2XMnL3mKFXDzRdoQV2l7KXM=","+GiOs2TvF+MIDlIr0QjlPaBuk/gTRBKOzuej+ULDDjE=","hwH2eXZmLVMlVOoZzxRRUNX1xAIOI+jrGKQy19vQmDo=","OKWN1G4oUgX0vOPSRhdtVujvqRsR08JAhf19wutm310=","THpoooyT1aJDLntbZCAv/Nb81xZdlvET7nd2UZvhUIo=","7tD2K8mAqGTMENrP2YXWz71BeTWQPCiYd3CESAgQLz8=","eXSLrLqKSxRTixSP/k4YimriB2lufao6trqTrsxxlyg=","SndbMKVtcTenAkwi2JBfGzD+mhexp1qJbRIY+A1JRIU=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2643890356\nzg8Jg3aojnyIt6lqU+5Xr+bB+JEVc5+v2Q7VVIZSQtw=\n\n— rekor.sigstore.dev wNI9ajBFAiBVJ6jPsMbbO5P1h9c1MUcDR496Z/Lf6P88nEMuHIVRZgIhAJLf/azojwrdp6H+0IqErfZ5niosTAazB8XvF9nnV5S3\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZDAyYzhmZTU5ZTExMzMxOTNhNzIzNWQ1Yjg0ZmVmOTFhYmM2ZmVkNzhkYTYzMTUyNzlmNWZlMGVjZDcxZmRmYSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjNiYTVhOTQxZGE0ZDVjNmFjM2U0NWJhOWJkNWEyY2IwM2QzMzkwMzRkMTE1M2I3MTQwNGYwMjMzZTQ1YTkwMTgifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVRQ0lGdzZ0cjZOT05BVy9yQWc1TEI5V1p4M1RLSnpvRlFPcUZoUjFTMkFNWGNtQWlBM2Y2QTBpZjRSZXlML0ticHgzY0xnMUNxKzJPTTh6Q3lBM3Q2VWdCVC8zZz09IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VoR1JFTkRRbkJ4WjBGM1NVSkJaMGxWUnpacFoyaHhZbXhzZUc0NVdtaE1ZVVV5WWpGd2FYTjNSR3ROZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVRVFZOUkZsNFRsUlJNbGRvWTA1TmFsbDNUMVJCTlUxRVdYbE9WRkV5VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVlJNM3BwUjA5elRqZG1ibHBTYTA5dk5FRmpVazR3VVZOeGJ6QnBObk5yWjBoak5Xa0tabFV6UzNoR1ZEaFJUVmhDUTJ4SFpXOXJVblYyTlcwNGNtZExWWFp4WVV4U1oxWlVRMDFMUjFKNFZEWTBVWEJtTVhGUFEwSmlhM2RuWjFjeFRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVTVRVmxpQ25OdU1sZEhXa055YnpWUGVqTnpOVEJCVjFrNGNtTlpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMXBCV1VSV1VqQlNRVkZJTDBKR2IzZFhTVnBYWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBURE5PYUdFeVJuRmtWelY0WkZkR2N3cGhXRkkxVERKS01XSnRkSFpNZVRWdVlWaFNiMlJYU1haa01qbDVZVEphYzJJelpIcE1NMHBzWWtkV2FHTXlWWFZsVnpGelVVaEtiRnB1VFhaa1IwWnVDbU41T1RKTlF6UjRUR3BCZDA5UldVdExkMWxDUWtGSFJIWjZRVUpCVVZGeVlVaFNNR05JVFRaTWVUa3dZakowYkdKcE5XaFpNMUp3WWpJMWVreHRaSEFLWkVkb01WbHVWbnBhV0VwcVlqSTFNRnBYTlRCTWJVNTJZbFJCVTBKbmIzSkNaMFZGUVZsUEwwMUJSVU5DUVZKM1pGaE9iMDFFV1VkRGFYTkhRVkZSUWdwbk56aDNRVkZOUlV0RWJHeFpWRmt4VDBSQ2FVNTZSVFZOUkZFMVdtcFNhRnB0UlhwYWJVNXFUMGRPYlUweVJteE5iVmw1VFZkSk5Ga3lUVE5OYWtsM0NrWlJXVXRMZDFsQ1FrRkhSSFo2UVVKQ1FWRklWVzFXYzFwWFJucGFWRUZwUW1kdmNrSm5SVVZCV1U4dlRVRkZSa0pDVW5wWlYzUm9ZVzVXZFdOWVZtZ0tZa2RzTUdWVE9XbGtWelZ5WW5wQlpVSm5iM0pDWjBWRlFWbFBMMDFCUlVkQ1FrSjVXbGRhZWt3elVtaGFNMDEyWkdwQmRVMVROSGROUkhOSFEybHpSd3BCVVZGQ1p6YzRkMEZSWjBWTVVYZHlZVWhTTUdOSVRUWk1lVGt3WWpKMGJHSnBOV2haTTFKd1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3Q2xwWE5UQk1iVTUyWWxSQ2JVSm5iM0pDWjBWRlFWbFBMMDFCUlVwQ1JtZE5WbTFvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVlbGxYZEdnS1lXNVdkV05ZVm1oaVIyd3daVk01YVdSWE5YSmllVGgxV2pKc01HRklWbWxNTTJSMlkyMTBiV0pIT1ROamVUbDVXbGQ0YkZsWVRteE1ibXgwWWtWQ2VRcGFWMXA2VEROU2FGb3pUWFprYWtGMVRWTTBkMDFFWjBkRGFYTkhRVkZSUW1jM09IZEJVVzlGUzJkM2IwOVhWbWhPYWxVMFRVZEpNMDFVYTNkT1JHeHRDazVIUm0xWlZFNXRXVEpOTkZreVdYcFpWMVY1V21wSmVGbHFhR3BaZW1ONVRXcEJaRUpuYjNKQ1owVkZRVmxQTDAxQlJVeENRVGhOUkZka2NHUkhhREVLV1dreGIySXpUakJhVjFGM1RuZFpTMHQzV1VKQ1FVZEVkbnBCUWtSQlVYQkVRMlJ2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJZekpHY2dwWlYzQXhZbTVHTVZsWGVIQmtTR3QyV1c1V2RXRXlPSGRQUVZsTFMzZFpRa0pCUjBSMmVrRkNSRkZSY1VSRFp6VmFWMFV5VGxSbmQxbHFZM2hQVkVFd0NrOVhXVEJaVjFwb1RUSmFhbGw2YUdwYWFrNW9XbFJLYlUxcVJtbFBSMDVxVG5wSmVVMURRVWREYVhOSFFWRlJRbWMzT0hkQlVUUkZSV2QzVVdOdFZtMEtZM2s1TUZsWFpIcE1NMWwzVEdwRmRVMUVRV0ZDWjI5eVFtZEZSVUZaVHk5TlFVVlFRa0YzVFVOcVJYcE9WR3MwVFZSVk5FNUVRWGROVVZsTFMzZFpRZ3BDUVVkRWRucEJRa1ZCVVdwRVEwWnZaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMll6SkdjbGxYY0RGaWJrWXhXVmQ0Y0dSSWEzZEdkMWxMQ2t0M1dVSkNRVWRFZG5wQlFrVlJVVXBFUVdONVRucEZNVTE2U1RCTlIxbEhRMmx6UjBGUlVVSm5OemgzUVZKSlJWZEJlRmRoU0ZJd1kwaE5Oa3g1T1c0S1lWaFNiMlJYU1hWWk1qbDBURE5PYUdFeVJuRmtWelY0WkZkR2MyRllValZNTWtveFltMTBka3g1Tlc1aFdGSnZaRmRKZG1ReU9YbGhNbHB6WWpOa2VncE1NMHBzWWtkV2FHTXlWWFZsVnpGelVVaEtiRnB1VFhaa1IwWnVZM2s1TWsxRE5IaE1ha0YzVDBGWlMwdDNXVUpDUVVkRWRucEJRa1YzVVhGRVEyYzFDbHBYUlRKT1ZHZDNXV3BqZUU5VVFUQlBWMWt3V1ZkYWFFMHlXbXBaZW1ocVdtcE9hRnBVU20xTmFrWnBUMGRPYWs1NlNYbE5RbEZIUTJselIwRlJVVUlLWnpjNGQwRlNVVVZDWjNkRlkwaFdlbUZFUW1KQ1oyOXlRbWRGUlVGWlR5OU5RVVZXUWtVd1RWTXlhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZGdwaVV6bDZXVmQwYUdGdVZuVmpXRlpvWWtkc01HVlRPV2xrVnpWeVluazVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5lbEY2VFZSak1VNTZUWGxPZW1OMkNsbFlVakJhVnpGM1pFaE5kazFxUVZkQ1oyOXlRbWRGUlVGWlR5OU5RVVZYUWtGblRVSnVRakZaYlhod1dYcENVa0puYjNKQ1owVkZRVmxQTDAxQlJWa0tRa1ZOVFZGWVNteGpSemcyWXpKR2NsbFhjREZpYmtZeFdWZDRjR1JJYkVGTmFtTjRUbFJOZVU1RE9XbGtWelZ5WWpCQmVFMTZWVFZQUkVVeFQwUlJkd3BQYmtwc1dtcHdlVnBYV25wTU0xSm9Xak5OZG1ScVFYVk5VelIzVFVsSFMwSm5iM0pDWjBWRlFXUmFOVUZuVVVOQ1NIZEZaV2RDTkVGSVdVRXpWREIzQ21GellraEZWRXBxUjFJMFkyMVhZek5CY1VwTFdISnFaVkJMTXk5b05IQjVaME00Y0Rkdk5FRkJRVWRuYUUwM2EyUm5RVUZDUVUxQlVucENSa0ZwUlVFS2JFRmxia3N4VVVGVVdFMDViRXhHVjBkck0yWlVjVnBJYVZFMWFVMTRMMWxUV0ZWeldrY3JaR0ZtUVVOSlJVRTJVV3QxZEdWTFlVVm9UbmcxZVVsRVpBcE5Sa2RGUWxKT1dsbDRNa3BPVld4allVSjJkRkJ0V21kTlFXOUhRME54UjFOTk5EbENRVTFFUVRKblFVMUhWVU5OUTBoWFFqRkNOVGwzU2t0RWNFRnhDbU0xUTBSNU5YSmxjbFpsTUUweFpITnVRMnBQTkdSSlMydDFWVTloTjFaMVlqVTVjRkp1VTNrd2FFZFdkbUkzVjA1blNYaEJUWFkwY2tjM2QxZERNalVLYWxJclMxSjBlVVE0ZVVoelNuaHJPR1JxVW5aQlFVRllSRUprWkZacVFUSm9lR0U0UTI5YWVDc3ZjemhHYm1aQ01HNU5NbFZCUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19"}],"timestampVerificationData":{}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYnVua28uanMiLCJkaWdlc3QiOnsic2hhMjU2IjoiYzk4MzlmOWUwNzU2YWU0M2JhOTIxZDc1NGNkZDQyOWY4NTgyNGVlOGU1MzI5ODQ3MzQyZjZmZDBkZGVlNGQwOCJ9fSx7Im5hbWUiOiJTSEEyNTZTVU1TIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImE1N2I4ODUzOGE2YTExOWE1NDNlNmZiNTEzYWQxMDA2ZDkyNjBiNTYwOTRhNDQzZDE0NmYxZjg5NTFiMDc2ZmMifX0seyJuYW1lIjoiTElDRU5TRSIsImRpZ2VzdCI6eyJzaGEyNTYiOiJiNzY2M2E5YzE1N2RlNDc3NzAwN2VhZDQyMTVjNDI3NDIwZjhlYmZiODlhMjQzNTk4NDU0YzdhNmU5MWE5MjNkIn19LHsibmFtZSI6IlRISVJEX1BBUlRZX05PVElDRVMubWQiLCJkaWdlc3QiOnsic2hhMjU2IjoiODQzNzljZWM4ZGM1YjkzYmMyYWQzM2I2ZDJiMmIzNzEzZDRiMjAxZWI1MGNhNGNiNTFiMjcxZDY2Y2JlYjI3MCJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vYWN0aW9ucy5naXRodWIuaW8vYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL3RhZ3MvdjAuMS4wIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zYWthanVucXVhbGl0eS9idW5rbyIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbCJ9fSwiaW50ZXJuYWxQYXJhbWV0ZXJzIjp7ImdpdGh1YiI6eyJldmVudF9uYW1lIjoicHVzaCIsInJlcG9zaXRvcnlfaWQiOiIxMzU5ODE1ODQwIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjI3MTUzMjQiLCJydW5uZXJfZW52aXJvbm1lbnQiOiJnaXRodWItaG9zdGVkIn19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9zYWthanVucXVhbGl0eS9idW5rb0ByZWZzL3RhZ3MvdjAuMS4wIiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6IjllYTY1ODBiNzE5MDQ5ZjRhZmEzZmNjOGNmM2FlMmYyMWI4Y2M3MjIifX1dfSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL3Nha2FqdW5xdWFsaXR5L2J1bmtvLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvdGFncy92MC4xLjAifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL3Nha2FqdW5xdWFsaXR5L2J1bmtvL2FjdGlvbnMvcnVucy8zNDMxNzU3MzI3Ny9hdHRlbXB0cy8yIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEQCIFw6tr6NONAW/rAg5LB9WZx3TKJzoFQOqFhR1S2AMXcmAiA3f6A0if4ReyL/Kbpx3cLg1Cq+2OM8zCyA3t6UgBT/3g=="}]}}
package/README.md CHANGED
@@ -3,13 +3,13 @@
3
3
  Build OCI images from Bun applications without Dockerfiles. Requires Bun >=1.3.11 <1.5 on Linux or macOS (x64 or arm64). npm installation does not install Bun.
4
4
 
5
5
  ```sh
6
- bunx @sakajunquality/bunko@0.1.0-rc.5 version
7
- bunx @sakajunquality/bunko@0.1.0-rc.5 build .
6
+ bunx @sakajunquality/bunko@0.1.0 version
7
+ bunx @sakajunquality/bunko@0.1.0 build .
8
8
  # Or install globally (Bun must be on PATH):
9
- npm install -g @sakajunquality/bunko@0.1.0-rc.5
9
+ npm install -g @sakajunquality/bunko@0.1.0
10
10
  bunko version
11
11
  ```
12
12
 
13
- This package contains the unchanged JavaScript CLI and license files from [v0.1.0-rc.5](https://github.com/sakajunquality/bunko/releases/tag/v0.1.0-rc.5), plus its checksums and GitHub release provenance bundle. It has no install scripts or runtime npm dependencies. The release provenance authenticates the enclosed release assets; npm package provenance is a separate attestation of the packaging workflow.
13
+ This package contains the unchanged JavaScript CLI and license files from [v0.1.0](https://github.com/sakajunquality/bunko/releases/tag/v0.1.0), plus its checksums and GitHub release provenance bundle. It has no install scripts or runtime npm dependencies. The release provenance authenticates the enclosed release assets; npm package provenance is a separate attestation of the packaging workflow.
14
14
 
15
15
  See the [documentation](https://github.com/sakajunquality/bunko#readme), [trust boundaries](https://github.com/sakajunquality/bunko/blob/main/docs/CONFIGURATION.md), and [MIT license](LICENSE).
package/SHA256SUMS CHANGED
@@ -1,3 +1,3 @@
1
- 56e4c2ef57ebdb1b2ac0f0c4c6e7ccee6383c9df8a86643ae9b520eae1427d83 bunko.js
1
+ c9839f9e0756ae43ba921d754cdd429f85824ee8e5329847342f6fd0ddee4d08 bunko.js
2
2
  b7663a9c157de4777007ead4215c427420f8ebfb89a243598454c7a6e91a923d LICENSE
3
3
  84379cec8dc5b93bc2ad33b6d2b2b3713d4b201eb50ca4cb51b271d66cbeb270 THIRD_PARTY_NOTICES.md
package/bunko.js CHANGED
@@ -586,7 +586,7 @@ ${H.comment}`:H.comment}this.doc.range[2]=H.offset;break}default:this.errors.pus
586
586
  `)+1;while(H!==0)this.onNewLine(this.offset+H),H=this.source.indexOf(`
587
587
  `,H)+1}return{type:X,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(X){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken]}]};case"explicit-key-ind":{this.onKeyLine=!0;let H=tw0(X),O=Tg(H);return O.push(this.sourceToken),{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:O,explicitKey:!0}]}}case"map-value-ind":{this.onKeyLine=!0;let H=tw0(X),O=Tg(H);return{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:O,key:null,sep:[this.sourceToken]}]}}}return null}atIndentedComment(X,H){if(this.type!=="comment")return!1;if(this.indent<=H)return!1;return X.every((O)=>O.type==="newline"||O.type==="space")}*documentEnd(X){if(this.type!=="doc-mode"){if(X.end)X.end.push(this.sourceToken);else X.end=[this.sourceToken];if(this.type==="newline")yield*this.pop()}}*lineEnd(X){switch(this.type){case"comma":case"doc-start":case"doc-end":case"flow-seq-end":case"flow-map-end":case"map-value-ind":yield*this.pop(),yield*this.step();break;case"newline":this.onKeyLine=!1;case"space":case"comment":default:if(X.end)X.end.push(this.sourceToken);else X.end=[this.sourceToken];if(this.type==="newline")yield*this.pop()}}}Bjw.Parser=Oi0});var Ei0=c4((Wjw)=>{var Pi0=fZ0(),Tjw=jm(),fm=gm(),Gjw=sQ0(),Ujw=P3(),bjw=sZ0(),Ai0=rZ0();function zi0(X){let H=X.prettyErrors!==!1;return{lineCounter:X.lineCounter||H&&new bjw.LineCounter||null,prettyErrors:H}}function Djw(X,H={}){let{lineCounter:O,prettyErrors:E}=zi0(H),C=new Ai0.Parser(O?.addNewLine),k=new Pi0.Composer(H),d=Array.from(k.compose(C.parse(X)));if(E&&O)for(let _0 of d)_0.errors.forEach(fm.prettifyError(X,O)),_0.warnings.forEach(fm.prettifyError(X,O));if(d.length>0)return d;return Object.assign([],{empty:!0},k.streamInfo())}function Ki0(X,H={}){let{lineCounter:O,prettyErrors:E}=zi0(H),C=new Ai0.Parser(O?.addNewLine),k=new Pi0.Composer(H),d=null;for(let _0 of k.compose(C.parse(X),!0,X.length))if(!d)d=_0;else if(d.options.logLevel!=="silent"){d.errors.push(new fm.YAMLParseError(_0.range.slice(0,2),"MULTIPLE_DOCS","Source contains multiple documents; please use YAML.parseAllDocuments()"));break}if(E&&O)d.errors.forEach(fm.prettifyError(X,O)),d.warnings.forEach(fm.prettifyError(X,O));return d}function Jjw(X,H,O){let E=void 0;if(typeof H==="function")E=H;else if(O===void 0&&H&&typeof H==="object")O=H;let C=Ki0(X,O);if(!C)return null;if(C.warnings.forEach((k)=>Gjw.warn(C.options.logLevel,k)),C.errors.length>0)if(C.options.logLevel!=="silent")throw C.errors[0];else C.errors=[];return C.toJS(Object.assign({reviver:E},O))}function Xjw(X,H,O){let E=null;if(typeof H==="function"||Array.isArray(H))E=H;else if(O===void 0&&H)O=H;if(typeof O==="string")O=O.length;if(typeof O==="number"){let C=Math.round(O);O=C<1?void 0:C>8?{indent:8}:{indent:C}}if(X===void 0){let{keepUndefined:C}=O??H??{};if(!C)return}if(Ujw.isDocument(X)&&!E)return X.toString(O);return new Tjw.Document(X,E,O).toString(O)}Wjw.parse=Jjw;Wjw.parseAllDocuments=Djw;Wjw.parseDocument=Ki0;Wjw.stringify=Xjw});import{mkdtemp as XVw,rm as WVw}from"fs/promises";import{tmpdir as QVw}from"os";import{join as ZVw}from"path";import{createHash as rHw,randomUUID as aHw}from"crypto";import{createReadStream as oHw,createWriteStream as tHw}from"fs";import{mkdir as eHw,rename as wLw,rm as $Lw,stat as _Lw}from"fs/promises";import{join as GW0}from"path";import{Readable as Iv0}from"stream";import{pipeline as BLw}from"stream/promises";import{createHash as sHw}from"crypto";function c9(X){return`sha256:${sHw("sha256").update(X).digest("hex")}`}function Vj(X){if(typeof X!=="string"||!/^sha256:[a-f0-9]{64}$/.test(X))throw Error(`Unsupported or invalid digest: ${String(X)}`)}function f1(X,H){if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`${H} must be an object`);return X}function e5(X){let H=f1(X,"Descriptor");if(Vj(H.digest),typeof H.mediaType!=="string"||!Number.isSafeInteger(H.size)||H.size<0)throw Error("Descriptor requires a mediaType and a non-negative integer size");if(H.annotations!==void 0){let O=f1(H.annotations,"Descriptor annotations");if(Object.values(O).some((E)=>typeof E!=="string"))throw Error("Descriptor annotation values must be strings")}return H}function u8(X){function H(O){if(Array.isArray(O))return O.map(H);if(O&&typeof O==="object")return Object.fromEntries(Object.entries(O).filter(([,E])=>E!==void 0).sort(([E],[C])=>Buffer.compare(Buffer.from(E),Buffer.from(C))).map(([E,C])=>[E,H(C)]));if(typeof O==="number"&&!Number.isFinite(O))throw Error("Non-finite JSON number");return O}return Buffer.from(JSON.stringify(H(X)))}class AM{root;onMaterialize;constructor(X,H){this.root=X;this.onMaterialize=H}origins=new Map;pending=new Map;inflight=new Map;defer(X,H,O){if(this.pending.set(X.digest,H),O)this.origins.set(X.digest,O)}async ensure(X){let H=this.pending.get(X.digest);if(!H)return;let O=this.inflight.get(X.digest);if(!O){let E=async()=>{await this.putStream(await H(),X.mediaType,X),this.pending.delete(X.digest)};O=this.onMaterialize?this.onMaterialize(X,E):E(),this.inflight.set(X.digest,O)}try{await O}finally{this.inflight.delete(X.digest)}}path(X){return Vj(X),GW0(this.root,"blobs","sha256",X.slice(7))}async put(X,H){return this.putStream(Iv0.from([X]),H,{digest:c9(X),size:X.byteLength,mediaType:H})}async putStream(X,H,O){await eHw(GW0(this.root,"blobs","sha256"),{recursive:!0});let E=GW0(this.root,"blobs",`.tmp-${aHw()}`),C=rHw("sha256"),k=0;async function*d(){for await(let _0 of X){if(k+=_0.byteLength,O&&k>O.size)throw Error(`Blob size mismatch: ${O.digest}`);C.update(_0),yield _0}}try{await BLw(Iv0.from(d()),tHw(E,{flags:"wx"}));let _0=`sha256:${C.digest("hex")}`;if(O&&(_0!==O.digest||k!==O.size))throw Error(`Blob digest/size mismatch: expected ${O.digest}, received ${_0}`);return await wLw(E,this.path(_0)),{mediaType:H,digest:_0,size:k}}finally{await $Lw(E,{force:!0})}}async read(X,H=8388608){if(X.size>H)throw Error(`Metadata exceeds ${H} bytes: ${X.digest}`);await this.ensure(X);let O=new Uint8Array(await Bun.file(this.path(X.digest)).arrayBuffer());if(O.byteLength!==X.size||c9(O)!==X.digest)throw Error(`Blob digest/size mismatch: ${X.digest}`);return O}async copyFrom(X,H){if(await X.ensure(H),(await _Lw(X.path(H.digest))).size!==H.size)throw Error(`Blob size mismatch: ${H.digest}`);await this.putStream(oHw(X.path(H.digest)),H.mediaType,H)}}import{lstat as MLw,mkdir as TLw,mkdtemp as GLw,readdir as ULw,realpath as bLw,rename as DLw,rm as JLw,writeFile as Yv0}from"fs/promises";import{basename as Hv0,dirname as Sv,join as B00,resolve as Lv0}from"path";var l4={index:"application/vnd.oci.image.index.v1+json",manifest:"application/vnd.oci.image.manifest.v1+json",config:"application/vnd.oci.image.config.v1+json",tar:"application/vnd.oci.image.layer.v1.tar",zstd:"application/vnd.oci.image.layer.v1.tar+zstd",gzip:"application/vnd.oci.image.layer.v1.tar+gzip",dockerIndex:"application/vnd.docker.distribution.manifest.list.v2+json",dockerManifest:"application/vnd.docker.distribution.manifest.v2+json",dockerConfig:"application/vnd.docker.container.image.v1+json",dockerGzip:"application/vnd.docker.image.rootfs.diff.tar.gzip"};async function v7(X){let H=Lv0(X),O=Sv(H),E=[Hv0(H)];while(!0)try{return B00(await bLw(O),...E)}catch(C){if(C.code!=="ENOENT"||Sv(O)===O)throw C;E.unshift(Hv0(O)),O=Sv(O)}}async function EQ(X){try{let H=await MLw(X);if(!H.isDirectory()||H.isSymbolicLink()||(await ULw(X)).length)throw Error(`Output already exists or is not an empty directory: ${X}`)}catch(H){if(H.code!=="ENOENT")throw H}}async function M00(X,H,O,E,C){return jv(H,[{source:X,root:O,all:E,refName:C}])}async function jv(X,H){X=Lv0(X),await EQ(X),await TLw(Sv(X),{recursive:!0});let O=await GLw(B00(Sv(X),".bunko-layout-"));try{let E=new AM(O),C=new Set;for(let{source:k,root:d,all:_0}of H)for(let X0 of[..._0,d]){if(C.has(X0.digest))continue;await E.copyFrom(k,X0),C.add(X0.digest)}await Yv0(B00(O,"oci-layout"),u8({imageLayoutVersion:"1.0.0"})),await Yv0(B00(O,"index.json"),u8({schemaVersion:2,mediaType:l4.index,manifests:H.flatMap(({root:k,refName:d,all:_0})=>[{...k,annotations:{...k.annotations,"org.opencontainers.image.ref.name":d}},..._0.filter((X0)=>X0.artifactType)])})),await EQ(X),await DLw(O,X)}finally{await JLw(O,{force:!0,recursive:!0})}}function Hb(X,H=!1){if(typeof X!=="string"||!/^(?:[a-zA-Z0-9.-]+|\[[a-fA-F0-9:.]+\])(?::[0-9]+)?$/.test(X))throw Error("Registry endpoints must be hosts with optional ports");let O;try{O=new URL(`https://${X}`).host.toLowerCase()}catch{throw Error("Invalid registry endpoint")}let E=H?O:X.toLowerCase();return["docker.io","index.docker.io"].includes(E)?"registry-1.docker.io":E}import{readFile as XLw}from"fs/promises";import{homedir as WLw}from"os";import{join as qv0}from"path";function Vv0(X){let H=X.replace(/^https?:\/\//,"").replace(/\/.*$/,"").toLowerCase();return["docker.io","index.docker.io"].includes(H)?"registry-1.docker.io":H}async function QLw(X,H){if(!/^[a-zA-Z0-9_.-]+$/.test(X))throw Error("Invalid Docker credential helper name");let O=Bun.which(`docker-credential-${X}`);if(!O)throw Error(`Docker credential helper not found: docker-credential-${X}`);let E=Bun.spawn([O,"get"],{stdin:"pipe",stdout:"pipe",stderr:"pipe"});E.stdin.write(`${H}
588
588
  `),E.stdin.end();let C=setTimeout(()=>E.kill(),30000);try{let[k,d,_0]=await Promise.all([new Response(E.stdout).text(),new Response(E.stderr).text(),E.exited]);if(_0!==0){if(/credentials not found in native keychain|credentials not found in native keyring|no credentials/i.test(k+d))return;throw Error(`Docker credential helper ${X} failed (exit ${_0})`)}let X0;try{X0=f1(JSON.parse(k),"Credential helper response")}catch{throw Error("Invalid Docker credential helper response")}if(typeof X0.Username!=="string"||typeof X0.Secret!=="string"||!X0.Secret)throw Error("Incomplete Docker credential helper response");return X0.Username==="<token>"?{identityToken:X0.Secret}:{username:X0.Username,password:X0.Secret}}finally{clearTimeout(C)}}function lE(X=process.env.BUNKO_DOCKER_CONFIG??qv0(process.env.DOCKER_CONFIG??qv0(WLw(),".docker"),"config.json"),H=QLw){let O=new Map;async function E(C){let k;try{k=f1(JSON.parse(await XLw(X,"utf8")),"Docker config")}catch(o){if(o.code==="ENOENT")return;throw Error("Cannot read Docker credential configuration")}let d=k.credHelpers===void 0?{}:f1(k.credHelpers,"credHelpers"),_0=Object.entries(d).find(([o])=>Vv0(o)===C)?.[1],X0=_0===""||_0===void 0?k.credsStore===""?void 0:k.credsStore:_0;if(X0!==void 0){if(typeof X0!=="string"||!/^[a-zA-Z0-9_.-]+$/.test(X0))throw Error("Invalid Docker credential helper name");return H(X0,C==="registry-1.docker.io"?"https://index.docker.io/v1/":C)}let I0=k.auths===void 0?{}:f1(k.auths,"auths"),z0=Object.entries(I0).find(([o])=>Vv0(o)===C)?.[1];if(!z0)return;let p0=f1(z0,"Docker auth entry");if(typeof p0.registrytoken==="string"&&p0.registrytoken)return{registryToken:p0.registrytoken};if(typeof p0.identitytoken==="string"&&p0.identitytoken)return{identityToken:p0.identitytoken};if(typeof p0.auth==="string"&&p0.auth){if(!/^[A-Za-z0-9+/]+={0,2}$/.test(p0.auth))throw Error("Invalid Docker auth encoding");let o=Buffer.from(p0.auth,"base64").toString(),Tw=o.indexOf(":");if(Tw<1)throw Error("Invalid Docker auth entry");return{username:o.slice(0,Tw),password:o.slice(Tw+1)}}if(typeof p0.username==="string"&&typeof p0.password==="string")return{username:p0.username,password:p0.password}}return(C,k)=>{if(k)O.delete(C);let d=O.get(C);if(!d)d=E(C),O.set(C,d);return d}}async function*UW0(X){let H=X.getReader(),O=!1;try{while(!0){let{done:E,value:C}=await H.read();if(E){O=!0;return}yield C}}finally{if(!O)try{await H.cancel()}catch{}try{H.releaseLock()}catch{}}}async function zU(X,H=8388608){if(!X.body)throw Error("Empty registry response");let O=[],E=0;for await(let C of UW0(X.body)){if(E+=C.byteLength,E>H)throw Error(`Registry metadata exceeds ${H} bytes`);O.push(C)}return Buffer.concat(O)}class cP extends Error{}class gv extends Error{}var ZLw=new Set(["BLOB_UNKNOWN","BLOB_UPLOAD_INVALID","BLOB_UPLOAD_UNKNOWN","DIGEST_INVALID","MANIFEST_BLOB_UNKNOWN","MANIFEST_INVALID","MANIFEST_UNKNOWN","NAME_INVALID","NAME_UNKNOWN","SIZE_INVALID","UNAUTHORIZED","DENIED","UNSUPPORTED","TOOMANYREQUESTS","TAG_INVALID","MANIFEST_UNVERIFIED"]);async function ILw(X){if(!X.body)return{codes:[],immutableTag:!1};let H=X.body.getReader(),O;try{let E=await Promise.race([(async()=>{let X0=[],I0=0;while(!0){let{done:z0,value:p0}=await H.read();if(z0)return Buffer.concat(X0);if(I0+=p0.byteLength,I0>65536)throw Error("Registry error body exceeds limit");X0.push(p0)}})(),new Promise((X0,I0)=>{O=setTimeout(()=>I0(Error("Registry error body deadline")),1000)})]),C=JSON.parse(E.toString()),k=Array.isArray(C?.errors)?C.errors:[],d=[...new Set(k.map((X0)=>X0?.code).filter((X0)=>typeof X0==="string"&&ZLw.has(X0)))].slice(0,8),_0=[400,403,405,409,412].includes(X.status)&&k.some((X0)=>["TAG_INVALID","DENIED","UNSUPPORTED"].includes(X0?.code)&&typeof X0.message==="string"&&/\bimmutab(?:le|ility)\b|\blocked tag\b|\btag (?:is )?locked\b/i.test(X0.message));return{codes:d,immutableTag:_0}}catch{return{codes:[],immutableTag:!1}}finally{clearTimeout(O),H.cancel().catch(()=>{});try{H.releaseLock()}catch{}}}class AU extends Error{status;codes;immutableTag;constructor(X,H,O,E=[],C=!1){super(`Registry ${H} failed (${X}): ${O}${E.length?` [${E.join(", ")}]`:""}`);this.status=X;this.codes=E;this.immutableTag=C}static async response(X,H,O){let E=await ILw(X);return new AU(X.status,H,O,E.codes,E.immutableTag)}}class Pv0{registry;options;origin;fetcher;credentials;insecureOrigins;challenges=new Map;tokens=new Map;constructor(X,H={}){this.registry=X;this.options=H;Hb(X),this.insecureOrigins=new Set((H.insecure??[]).map((C)=>new URL(`http://${Hb(C)}`).origin));let O=new URL(`http://${X}`).origin;if(this.origin=this.insecureOrigins.has(O)?O:new URL(`https://${X}`).origin,H.headersTimeoutMs!==void 0&&(!Number.isFinite(H.headersTimeoutMs)||H.headersTimeoutMs<=0))throw Error("Registry header timeout must be positive");if(H.maxRetryDelayMs!==void 0&&(!Number.isFinite(H.maxRetryDelayMs)||H.maxRetryDelayMs<0||H.maxRetryDelayMs>30000))throw Error("Registry retry delay limit must be between 0 and 30000 ms");let E=H.fetcher??fetch;this.fetcher=(C,k)=>{let d=new URL(C).origin,_0=H.tls?.[d];return E(C,{...k,..._0&&d.startsWith("https://")?{tls:{..._0,rejectUnauthorized:!0}}:{}})},this.credentials=H.credentials??lE()}safeURL(X,H=this.origin){let O=new URL(X,H);if(O.username||O.password||O.hash)throw Error("Registry URLs must not contain credentials or fragments");if(O.protocol!=="https:"&&!(O.protocol==="http:"&&this.insecureOrigins.has(O.origin)))throw Error("Registry URLs and redirects must use HTTPS; explicitly allow a test registry with --insecure-registry");return O}async authenticate(X,H,O){let E=await this.credentials(this.registry,O);if(/^Basic\s/i.test(X)){if(E?.username===void 0||E.password===void 0)throw Error(`Registry credentials required: ${this.registry}; configure Docker login or a credential helper`);return{authorization:`Basic ${Buffer.from(`${E.username}:${E.password}`).toString("base64")}`,expires:Date.now()+300000}}if(!/^Bearer\s/i.test(X))throw Error(`Unsupported registry authentication: ${this.registry}`);if(E?.registryToken)return{authorization:`Bearer ${E.registryToken}`,expires:Date.now()+60000};let C=Object.create(null);for(let Tw of X.replace(/^Bearer\s+/i,"").matchAll(/(?:^|,)\s*([\w-]+)\s*=\s*(?:"((?:\\.|[^"\\])*)"|([^,\s]+))/g)){let j0=Tw[1].toLowerCase();if(Object.hasOwn(C,j0))throw Error("Ambiguous registry authentication challenge");C[j0]=Tw[2]===void 0?Tw[3]:Tw[2].replace(/\\(.)/g,"$1")}if(!C.realm)throw Error("Registry Bearer challenge has no realm");let k=this.safeURL(C.realm),d=new URLSearchParams;if(C.service)d.set("service",C.service);for(let Tw of H)d.append("scope",Tw);let _0=new Headers,X0;if(E?.identityToken)X0=d,X0.set("grant_type","refresh_token"),X0.set("refresh_token",E.identityToken),X0.set("client_id","bunko");else{for(let[Tw,j0]of d)k.searchParams.append(Tw,j0);if(E?.username!==void 0&&E.password!==void 0)_0.set("Authorization",`Basic ${Buffer.from(`${E.username}:${E.password}`).toString("base64")}`)}let I0;try{I0=await this.fetcher(k,{method:X0?"POST":"GET",headers:_0,body:X0,redirect:"error",signal:AbortSignal.timeout(30000)})}catch(Tw){if(Tw instanceof gv)throw Tw;throw Error(`Registry token request failed: ${this.registry}`)}if(!I0.ok)throw await AU.response(I0,"authentication",this.registry);let z0;try{z0=f1(JSON.parse(Buffer.from(await zU(I0,1048576)).toString()),"Token response")}catch{throw Error("Invalid registry token response")}let p0=z0.token??z0.access_token;if(typeof p0!=="string"||!p0)throw Error("Registry returned no Bearer token");let o=typeof z0.expires_in==="number"&&z0.expires_in>0?z0.expires_in:60;return{authorization:`Bearer ${p0}`,expires:Date.now()+Math.max(1,o-Math.min(30,o/2))*1000}}async request(X,H={},O=[],E=[]){let C=this.safeURL(X),k=H.method??"GET",d=[...new Set(O)].sort().join(" "),_0=k==="GET"||k==="HEAD",X0=!1;for(let I0=0;;I0++){H.signal?.throwIfAborted();let z0=this.tokens.get(d),p0=this.challenges.get(d);if(C.origin===this.origin&&z0&&z0.expires<=Date.now()&&p0)this.tokens.set(d,await this.authenticate(p0,O,!0));let o=C,Tw;try{for(let j0=0;j0<=5;j0++){H.signal?.throwIfAborted();let C0=new Headers(H.headers);C0.delete("Authorization");let Xw=this.tokens.get(d);if(o.origin===this.origin&&Xw&&Xw.expires>Date.now())C0.set("Authorization",Xw.authorization);if(!C0.has("Accept"))C0.set("Accept",[l4.index,l4.manifest,l4.dockerIndex,l4.dockerManifest,"application/octet-stream"].join(", "));let Zw=_0?new AbortController:void 0,w2=Zw?setTimeout(()=>Zw.abort(),this.options.headersTimeoutMs??120000):void 0,iw=Zw?H.signal?AbortSignal.any([H.signal,Zw.signal]):Zw.signal:H.signal;try{Tw=await this.fetcher(o,{...H,headers:C0,redirect:"manual",signal:iw})}finally{clearTimeout(w2)}if(![301,302,303,307,308].includes(Tw.status))break;let aw=Tw.headers.get("Location");if(await Tw.body?.cancel(),!aw||j0===5||!_0&&![307,308].includes(Tw.status))throw Error("Invalid or excessive registry redirect");o=this.safeURL(aw,o.toString())}}catch(j0){if(H.signal?.aborted)throw H.signal.reason;if(j0 instanceof gv)throw j0;if(j0 instanceof Error&&/HTTPS|credentials or fragments|registry redirect/.test(j0.message))throw j0;if(!_0||I0>=(this.options.retries??3))throw new cP(`Registry ${k} connection failed: ${this.registry}`);await this.backoff(I0);continue}if(!Tw)throw Error("No registry response");if(Tw.status===401&&o.origin===this.origin&&!X0){let j0=Tw.headers.get("WWW-Authenticate")??"";await Tw.body?.cancel();let C0=this.tokens.has(d);this.tokens.set(d,await this.authenticate(j0,O,C0)),this.challenges.set(d,j0),X0=!0,I0--;continue}if(_0&&(Tw.status===429||Tw.status>=500)&&I0<(this.options.retries??3)){let j0=Tw.headers.get("Retry-After");await Tw.body?.cancel(),await this.backoff(I0,j0);continue}if(!Tw.ok&&!E.includes(Tw.status))throw await AU.response(Tw,k,this.registry);return Tw}}async backoff(X,H){let O=H?/^\d+$/.test(H)?Number(H)*1000:Date.parse(H)-Date.now():NaN,E=Number.isFinite(O)?Math.max(0,Math.min(30000,O)):Math.min(5000,250*2**X+Math.random()*100);await(this.options.sleep??Bun.sleep)(Math.min(E,this.options.maxRetryDelayMs??30000))}}var Ov0=new WeakMap;function xv(X,H={},O=!1){let E=Ov0.get(H);if(!E)E=new Map,Ov0.set(H,E);let C=`${O?"mirror":"origin"}:${X}`,k=E.get(C);if(!k)k=new Pv0(X,O?{...H,retries:Math.min(H.retries??1,1),headersTimeoutMs:Math.min(H.headersTimeoutMs??5000,5000),maxRetryDelayMs:Math.min(H.maxRetryDelayMs??250,250)}:H),E.set(C,k);return k}function Av0(X,H,O,E){e5(X);let C=new AbortController,k=YLw(X,H,O,E,C.signal),d=k.return.bind(k),_0=k.throw.bind(k);return k.return=(X0)=>{return C.abort(),d(X0)},k.throw=(X0)=>{return C.abort(),_0(X0)},k}async function bW0(X,H){let O;try{return await Promise.race([X,new Promise((E,C)=>{if(O=()=>C(H.reason),H.aborted)O();else H.addEventListener("abort",O,{once:!0})})])}finally{if(O)H.removeEventListener("abort",O)}}async function*YLw(X,H,O,E,C){let k=0;for(let d=0;;d++){let _0=new Headers({"Accept-Encoding":"identity"});if(k)_0.set("Range",`bytes=${k}-`);C.throwIfAborted();let X0=await bW0(H(_0,C),C),I0=0;try{let o=X0.headers.get("Docker-Content-Digest");if(o&&o!==X.digest)throw Error("Registry blob digest header mismatch");let Tw=X.size;if(X0.status===206){let C0=/^bytes (\d+)-(\d+)\/(\d+)$/.exec(X0.headers.get("Content-Range")??"");if(!C0||Number(C0[1])!==k||Number(C0[2])!==X.size-1||Number(C0[3])!==X.size)throw Error("Registry blob Content-Range mismatch");Tw-=k}else if(X0.status===200)I0=k;else throw Error("Unexpected registry blob response status");let j0=X0.headers.get("Content-Length");if(j0!==null&&(!/^\d+$/.test(j0)||Number(j0)!==Tw))throw Error("Registry blob Content-Length mismatch");if(!X0.body)throw Error("Registry blob response has no body")}catch(o){throw X0.body?.cancel().catch(()=>{}),o}let z0=X0.body.getReader(),p0=!1;try{while(!0){let o,Tw;try{Tw=await bW0(Promise.race([z0.read(),new Promise((C0,Xw)=>{o=setTimeout(()=>Xw(Error("idle")),O)})]),C)}catch{throw C.throwIfAborted(),new cP("Registry blob connection failed while reading body")}finally{clearTimeout(o)}if(Tw.done){if(k!==X.size||I0)throw new cP("Registry blob connection failed before the complete body");p0=!0;return}let j0=Tw.value;if(I0){let C0=Math.min(I0,j0.length);I0-=C0,j0=j0.subarray(C0)}if(k+j0.length>X.size)throw Error("Registry blob exceeds descriptor size");if(k+=j0.length,j0.length)yield j0}}catch(o){if(!(o instanceof cP))throw o;if(k===X.size&&!I0)return;if(d>=3)throw o}finally{if(!p0)z0.cancel().catch(()=>{});try{z0.releaseLock()}catch{}}await bW0(E(d),C)}}function T00(X){if(typeof X!=="string")throw Error("Registry mirror must be a host with an optional repository prefix");let[H,...O]=X.split("/"),E=Hb(H);if(O.some((k)=>!/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*$/.test(k)))throw Error("Invalid registry mirror repository prefix");let C=O.join("/");return{registry:E,prefix:C,name:E+(C?`/${C}`:"")}}function G00(X){let H=Object.create(null);for(let O of X??[]){let E=O.split("=");if(E.length!==2||!E[0]||!E[1])throw Error("--registry-mirror requires ORIGIN=MIRROR");let C=Hb(E[0],!0),k=T00(E[1]);if(C===Hb(k.registry,!0)&&!k.prefix)throw Error("Registry mirror must differ from its origin");let d=H[C]??=[];if(d.some((_0)=>{let X0=T00(_0);return Hb(X0.registry,!0)===Hb(k.registry,!0)&&X0.prefix===k.prefix}))throw Error("Duplicate registry mirror");if(d.length>=8)throw Error("At most eight mirrors are allowed per registry");d.push(k.name)}return H}function zv0(X,H,O={}){if(X!==void 0)return G00(X);if(H!==void 0)return G00(H.split(/\r?\n/).map((E)=>E.trim()).filter(Boolean));return O}import{createReadStream as Fv0}from"fs";import{join as Kv0}from"path";async function Ev0(X,H){let O=[],E=0;for await(let C of Fv0(X)){let k=Buffer.from(C);if(E+=k.length,E>H)throw Error("Layout metadata exceeds size limit");O.push(k)}return Buffer.concat(O)}class Lb{directory;constructor(X){this.directory=X}async root(){if(f1(JSON.parse((await Ev0(Kv0(this.directory,"oci-layout"),65536)).toString()),"OCI layout").imageLayoutVersion!=="1.0.0")throw Error("Unsupported OCI layout version");let H=await Ev0(Kv0(this.directory,"index.json"),8388608);return{bytes:H,descriptor:{mediaType:l4.index,digest:c9(H),size:H.length}}}async blob(X){return Fv0(new AM(this.directory).path(X.digest))}}function Oj(X){if(X.includes("://")||/[\s?#]/.test(X))throw Error(`Invalid image reference: ${X}`);let H=X.split("@");if(H.length>2||H.length===2&&!H[1])throw Error(`Invalid image reference: ${X}`);let O=H[0],E=H[1];if(E)e5({digest:E,size:0,mediaType:l4.manifest});let C=O.lastIndexOf(":"),k=O.lastIndexOf("/");if(C>k){if(E)throw Error("An image reference must use a tag or a digest, not both");E=O.slice(C+1),O=O.slice(0,C)}if(E??="latest",!E.startsWith("sha256:")&&!/^[\w][\w.-]{0,127}$/.test(E))throw Error("Invalid image tag");let d=O.split("/"),_0="registry-1.docker.io";if(d.length>1&&(/[.:]/.test(d[0])||d[0]==="localhost"))_0=d.shift().toLowerCase();if(["docker.io","index.docker.io"].includes(_0))_0="registry-1.docker.io";if(_0=Hb(_0),_0==="registry-1.docker.io"&&d.length===1)d.unshift("library");if(d.some((X0)=>!/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*$/.test(X0)))throw Error("Invalid registry repository");return{registry:_0,repository:d.join("/"),reference:E}}var Rv0=new WeakSet,Nv0=new WeakSet;class rM{ref;client;onMirrorFallback;mirrors;bodyIdleTimeoutMs;constructor(X,H={}){this.ref=Oj(X);let O=typeof H==="function"?{fetcher:H,credentials:async()=>{return}}:H;if(this.onMirrorFallback=O.onMirrorFallback,this.bodyIdleTimeoutMs=O.bodyIdleTimeoutMs??120000,!Number.isFinite(this.bodyIdleTimeoutMs)||this.bodyIdleTimeoutMs<=0||this.bodyIdleTimeoutMs>2147483647)throw Error("Registry blob idle timeout must be positive and fit a timer");this.client=xv(this.ref.registry,O);let E=O.mirrors?.[Hb(this.ref.registry,!0)]??[];if(!Array.isArray(E)||E.length>8)throw Error("At most eight mirrors are allowed per registry");this.mirrors=E.map((C)=>{let k=T00(C);return{client:xv(k.registry,O,!0),repository:k.prefix?`${k.prefix}/${this.ref.repository}`:this.ref.repository,name:k.name}})}async read(X,H,O={}){let E=[`repository:${this.ref.repository}:pull`];if(H)for(let C of this.mirrors){let k=C.client;if(Rv0.has(k))continue;try{return await k.request(X.replace(`/v2/${this.ref.repository}/`,`/v2/${C.repository}/`),O,[`repository:${C.repository}:pull`])}catch(d){if(O.signal?.aborted)throw O.signal.reason;if(!(d instanceof cP)&&!(d instanceof AU&&(d.status===404||d.status===429||d.status>=500)))throw d;if(!(d instanceof AU&&d.status===404))Rv0.add(k);if(Nv0.has(k))continue;Nv0.add(k),this.onMirrorFallback?.({registry:this.ref.registry,mirror:C.name,reason:d instanceof AU?`HTTP ${d.status}`:"connection failed"})}}return this.client.request(X,O,E)}async root(){let X=await this.read(`/v2/${this.ref.repository}/manifests/${this.ref.reference}`,this.ref.reference.startsWith("sha256:")),H=await zU(X),O=c9(H);if(this.ref.reference.startsWith("sha256:")&&O!==this.ref.reference)throw Error("Base manifest digest mismatch");let E=X.headers.get("docker-content-digest");if(E&&E!==O)throw Error("Registry manifest digest header mismatch");let C=f1(JSON.parse(Buffer.from(H).toString()),"Base manifest"),k=X.headers.get("content-type")?.split(";")[0];return{bytes:H,descriptor:e5({mediaType:C.mediaType??k,digest:O,size:H.length})}}async blob(X){let H=[l4.index,l4.manifest,l4.dockerIndex,l4.dockerManifest].includes(X.mediaType),O=`/v2/${this.ref.repository}/${H?"manifests":"blobs"}/${X.digest}`;if(!H)return Av0(X,(C,k)=>this.read(O,!0,{headers:C,signal:k}),this.bodyIdleTimeoutMs,(C)=>this.client.backoff(C));let E=await this.read(O,!0);if(!E.body)throw Error(`Missing blob body: ${X.digest}`);return UW0(E.body)}}function HLw(X,H,O){let E=f1(X,"Image config");if(E.os!==H.os||E.architecture!==H.architecture)throw Error("Base image platform does not match the requested platform");if(E.variant!==void 0&&E.variant!==(H.variant??(H.architecture==="arm64"?"v8":void 0)))throw Error("Base image variant does not match the requested platform");let C=f1(E.rootfs,"Image rootfs");if(C.type!=="layers"||!Array.isArray(C.diff_ids)||C.diff_ids.length!==O)throw Error("Base rootfs DiffIDs do not match its layers");for(let k of C.diff_ids)e5({digest:k,size:0,mediaType:l4.tar});if(E.history!=null){if(!Array.isArray(E.history))throw Error("Invalid base history");for(let k of E.history){let d=f1(k,"History entry");for(let _0 of["created","created_by","comment"])if(d[_0]!=null&&typeof d[_0]!=="string")throw Error(`Invalid history ${_0}`);if(d.empty_layer!=null&&typeof d.empty_layer!=="boolean")throw Error("Invalid history empty_layer")}if(E.history.filter((k)=>!k.empty_layer).length!==O)throw Error("Base history does not match its layers")}if(E.author!=null&&typeof E.author!=="string")throw Error("Invalid base author");if(E.config!=null){let k=f1(E.config,"Runtime config");for(let d of["Env","Entrypoint","Cmd"])if(k[d]!=null&&(!Array.isArray(k[d])||!k[d].every((_0)=>typeof _0==="string")))throw Error(`Invalid base ${d}`);for(let d of["User","WorkingDir","StopSignal"])if(k[d]!=null&&typeof k[d]!=="string")throw Error(`Invalid base ${d}`);if(k.Labels!=null&&!Object.values(f1(k.Labels,"Base labels")).every((d)=>typeof d==="string"))throw Error("Invalid base labels");for(let d of["ExposedPorts","Volumes"])if(k[d]!=null)for(let _0 of Object.values(f1(k[d],`Base ${d}`)))f1(_0,`Base ${d} entry`)}return E}async function Pj(X,H,O,E=!1){let C=await X.root();await O.putStream(LLw(C.bytes),C.descriptor.mediaType,C.descriptor);async function k(z0){if(z0.size>8388608)throw Error("Base metadata exceeds size limit");if(z0.digest!==C.descriptor.digest)await O.putStream(await X.blob(z0),z0.mediaType,z0);return f1(JSON.parse(Buffer.from(await O.read(z0)).toString()),"Base metadata")}async function d(z0,p0){if(p0>8)throw Error("Base index nesting limit exceeded");let o=await k(z0);if(o.schemaVersion!==2||o.mediaType!=null&&o.mediaType!==z0.mediaType)throw Error("Unsupported or inconsistent base manifest schema");if([l4.index,l4.dockerIndex].includes(z0.mediaType)){if(!Array.isArray(o.manifests))throw Error("Invalid base index");let j0=o.manifests.map(e5).filter((C0)=>{if(C0.artifactType)return!1;if(!C0.platform)return!0;return C0.platform.os===H.os&&C0.platform.architecture===H.architecture&&(C0.platform.variant??(C0.platform.architecture==="arm64"?"v8":void 0))===(H.variant??(H.architecture==="arm64"?"v8":void 0))});if(j0.length!==1)throw Error(`Expected exactly one base for ${H.os}/${H.architecture}, found ${j0.length}`);return d(j0[0],p0+1)}if(![l4.manifest,l4.dockerManifest].includes(z0.mediaType)||!Array.isArray(o.layers))throw Error("Unsupported base manifest type");let Tw=e5(o.config);if(![l4.config,l4.dockerConfig].includes(Tw.mediaType))throw Error("Base is an artifact, not a runnable image");return{descriptor:z0,manifest:{schemaVersion:2,mediaType:z0.mediaType,config:Tw,layers:o.layers.map(e5)}}}let _0=await d(C.descriptor,0),X0=HLw(await k(_0.manifest.config),H,_0.manifest.layers.length),I0=[];for(let z0 of _0.manifest.layers){if(z0.mediaType===l4.zstd&&z0.size>2147483648)throw Error("Zstd base layer exceeds compressed size limit");if(![l4.tar,l4.gzip,l4.dockerGzip,l4.zstd].includes(z0.mediaType))throw Error(`Unsupported base layer type: ${z0.mediaType}`);if(E)O.defer(z0,()=>X.blob(z0),X instanceof rM?X.ref:void 0);else await O.putStream(await X.blob(z0),z0.mediaType,z0);I0.push({mediaType:z0.mediaType===l4.dockerGzip?l4.gzip:z0.mediaType,digest:z0.digest,size:z0.size,...z0.annotations?{annotations:z0.annotations}:{}})}return{..._0,manifest:{..._0.manifest,layers:I0},config:X0,indexDigest:[l4.index,l4.dockerIndex].includes(C.descriptor.mediaType)?C.descriptor.digest:void 0}}async function*LLw(X){yield X}import{posix as qLw}from"path";function yv(X){if(X===void 0||X==="preserve")return;if(!["0444","0555","0644","0755"].includes(String(X))||typeof X!=="string")throw Error("Asset mode must be preserve, 0444, 0555, 0644 or 0755");return parseInt(X,8)}function hv(X){let H=X.map((O)=>new Bun.Glob(O));return(O)=>{for(let E=O;E!==".";E=qLw.dirname(E))if(H.some((C)=>C.match(E)))return!0;return!1}}function Cv0(X,H,O,E){let C=hv(O);return X.filter((k)=>!C(k.path.slice(H.length+1))).map((k)=>k.type==="file"&&E!==void 0?{...k,mode:E,executable:Boolean(E&73)}:k)}var VLw=new Set(["--watch","--hot","--no-clear-screen","--smol","--cpu-prof","--cpu-prof-md","--heap-prof","--heap-prof-md","--no-install","--prefer-offline","--prefer-latest","--expose-gc","--no-deprecation","--throw-deprecation","--zero-fill-buffers","--use-system-ca","--use-openssl-ca","--use-bundled-ca","--redis-preconnect","--sql-preconnect","--no-addons","--no-env-file","--no-orphans","--experimental-http2-fetch","--experimental-http3-fetch","--insecure-http-parser","--experimental-stream-iter","--no-warnings","--trace-warnings","--trace-deprecation","--pending-deprecation","--tls-min-v1.0","--tls-min-v1.1","--tls-min-v1.2","--tls-min-v1.3","--tls-max-v1.2","--tls-max-v1.3","--no-ffi-cc","--preserve-symlinks","--preserve-symlinks-main","--no-macros","--jsx-side-effects","--ignore-dce-annotations"]),OLw=new Set(["--preload","--require","--import","--cpu-prof-name","--cpu-prof-dir","--cpu-prof-interval","--heap-prof-name","--heap-prof-dir","--heap-prof-interval","--port","--conditions","--fetch-preconnect","--max-http-header-size","--dns-result-order","--title","--unhandled-rejections","--console-depth","--user-agent","--env-file","--cwd","--config","--watch-kill-signal","--redirect-warnings","--disable-warning","--main-fields","--extension-order","--tsconfig-override","--define","--drop","--feature","--loader","--jsx-factory","--jsx-fragment","--jsx-import-source","--jsx-runtime"]),Sv0=new Set(["--inspect","--inspect-wait","--inspect-brk"]),jv0={"-r":"--preload","-c":"--config","-d":"--define","-l":"--loader"};function gv0(X){let H=[];for(let O=0;O<X.length;O++){let E=X[O],C=E.indexOf("="),k=C<0?E:E.slice(0,C),d=Object.hasOwn(jv0,k)?jv0[k]:k;if(VLw.has(d)&&C<0){H.push(d);continue}if(Sv0.has(d)&&C<0){H.push(d);continue}if(OLw.has(d)||Sv0.has(d)){let _0=C<0?X[++O]:E.slice(C+1);if(_0&&(C>=0||!_0.startsWith("-"))&&!_0.includes("\x00")){H.push(`${d}=${_0}`);continue}throw Error(`runtime.args requires a non-empty value for ${d}; use --option=value`)}throw Error(`Invalid runtime.args at index ${O}: expected a supported Bun runtime option; put application arguments in args`)}return H}var PLw=new Set(["mode","base","platforms","assets","assetExcludes","assetMode","assetMappings","external","env","ports","user","workdir","labels","annotations","args","build","runtime","deps","inheritBaseOciLabels","toolchain"]),xv0=["env","labels","annotations","build","runtime","deps","toolchain"];function yv0(X,H,O=!1){if(X.defaults!==void 0&&!O)throw Error("bunko.defaults is only supported at a workspace root");let E=f1(H??{},"Workspace bunko"),C=f1(E.defaults??{},"bunko.defaults");if(Object.keys(C).some((X0)=>!PLw.has(X0)))throw Error("Unsupported workspace default option");let{defaults:k,...d}=X,_0={...C,...d};for(let X0 of xv0)if(d[X0]===null)_0[X0]=void 0;else if(C[X0]!==void 0&&d[X0]!==void 0)_0[X0]={...f1(C[X0],`defaults.${X0}`),...f1(d[X0],X0)};if(C.build!==void 0&&d.build!==void 0&&d.build!==null){let X0=f1(C.build,"defaults.build"),I0=f1(d.build,"build");if(X0.define!==void 0&&I0.define!==void 0)_0.build.define=I0.define===null?{}:{...f1(X0.define,"defaults.build.define"),...f1(I0.define,"build.define")}}return _0}function hv0(X,H){let O=f1(H??{},"Workspace bunko"),E=f1(O.defaults??{},"bunko.defaults"),C=[];for(let[k,d]of Object.entries(E)){if(!xv0.includes(k)){if(X[k]===void 0)C.push(k);continue}if(X[k]===null||d===null)continue;let _0=f1(d,`defaults.${k}`),X0=f1(X[k]??{},k);for(let[I0,z0]of Object.entries(_0))if(k==="build"&&I0==="define"){if(X0.define===null||z0===null)continue;let p0=f1(z0,"defaults.build.define"),o=f1(X0.define??{},"build.define");for(let Tw of Object.keys(p0))if(o[Tw]===void 0)C.push(`build.define.${Tw}`)}else if(X0[I0]===void 0)C.push(`${k}.${I0}`)}return C.sort()}function kv(X){if(typeof X!=="string")return!1;let H=/^1\.(3|4)\.(0|[1-9]\d*)$/.exec(X);return Boolean(H&&(H[1]==="4"||Number(H[2])>=11))}function kv0(X,H){let O=f1(H??{},"toolchain");if(Object.keys(O).some((k)=>!["version","revision"].includes(k)))throw Error("toolchain accepts version and revision only");let E=[],C=[];if(O.version!==void 0){if(!kv(O.version))throw Error("toolchain.version must be an exact supported Bun version (>=1.3.11 <1.5)");E.push(O.version)}if(O.revision!==void 0&&(typeof O.revision!=="string"||!/^[a-f0-9]{7,40}$/.test(O.revision)))throw Error("toolchain.revision must be the exact revision printed by bun --revision");for(let k of X){if(typeof k.packageManager==="string"&&k.packageManager.startsWith("bun@")){let _0=k.packageManager.slice(4);if(!kv(_0))throw Error("Bun packageManager must declare an exact supported version");E.push(_0)}let d=f1(k.engines??{},"engines");if(d.bun!==void 0){if(typeof d.bun!=="string"||!d.bun.trim())throw Error("engines.bun must be a nonempty version range");C.push(d.bun)}}if(new Set(E).size>1)throw Error("Conflicting Bun toolchain version declarations");return{version:E[0],revision:O.revision,ranges:[...new Set(C)]}}function U00(X,H){if(X.version&&X.version!==H.version)throw Error("Selected Bun does not match the declared version; install it locally and select --bun-path");if(X.revision&&X.revision!==H.revision)throw Error("Selected Bun does not match the declared revision");if(X.ranges.some((O)=>!Bun.semver.satisfies(H.version,O)))throw Error("Selected Bun does not satisfy engines.bun")}import{basename as ALw,extname as zLw}from"path";var fv0=["usr/share/fonts","usr/local/share/fonts"];function fv(X){return fv0.some((H)=>X===H||X.startsWith(`${H}/`))}function DW0(X,H,O){if(fv0.includes(X)||H&73)throw Error("System font mappings require non-executable files below a font directory");if(/\.(ttf|otf|ttc|otc)$/i.test(X)){if(O<12||O>134217728)throw Error("System font file must be between 12 bytes and 128 MiB");return"font"}if(/^(?:OFL|LICENSE|LICENCE|COPYING|NOTICE|README)(?:[._-][a-z0-9._-]+)?$/i.test(ALw(X))&&O<=1048576)return"notice";throw Error("System font mappings only accept TTF, OTF, TTC, OTC and license/notice files")}async function uv0(X,H,O){let E=Bun.file(X),C=E.size;if(DW0(H,O,C)==="notice"){try{if(new TextDecoder("utf-8",{fatal:!0}).decode(await E.arrayBuffer()).includes("\x00"))throw Error()}catch{throw Error("System font license/notice files must be UTF-8 text without NUL bytes")}return}let k=()=>Error("Invalid system font SFNT data");async function d(z0,p0){if(z0<0||z0+p0>C)throw k();let o=Buffer.from(await E.slice(z0,z0+p0).arrayBuffer());if(o.length!==p0)throw k();return o}let _0=await d(0,12),X0=[".ttc",".otc"].includes(zLw(H).toLowerCase()),I0=[0];if(X0){let z0=_0.readUInt32BE(8);if(_0.readUInt32BE(0)!==1953784678||![65536,131072].includes(_0.readUInt32BE(4))||z0<1||z0>64)throw k();let p0=await d(12,z0*4);if(I0=Array.from({length:z0},(o,Tw)=>p0.readUInt32BE(Tw*4)),I0.some((o)=>o<12+z0*4))throw k()}for(let z0 of I0){let p0=await d(z0,12),o=p0.readUInt32BE(0),Tw=p0.readUInt16BE(4);if(![65536,1330926671,1953658213].includes(o)||Tw<1||Tw>4096)throw k();let j0=await d(z0+12,Tw*16),C0=new Set;for(let Xw=0;Xw<Tw;Xw++){let Zw=Xw*16,w2=j0.toString("latin1",Zw,Zw+4),iw=j0.readUInt32BE(Zw+8),aw=j0.readUInt32BE(Zw+12);if(C0.has(w2)||!/^[\x20-\x7e]{4}$/.test(w2)||iw<12||iw+aw>C||["head","name","cmap"].includes(w2)&&aw===0)throw k();C0.add(w2)}if(!["head","name","cmap"].every((Xw)=>C0.has(Xw)))throw k()}}import{chmod as dqw,copyFile as cqw,lstat as K00,mkdir as lqw,readdir as pqw,realpath as zm0}from"fs/promises";import{basename as iqw,dirname as nqw,join as pv,relative as sqw,resolve as Km0}from"path";import{createHash as KLw}from"crypto";import{createReadStream as ELw}from"fs";import{posix as Aj}from"path";import{Readable as RLw}from"stream";import{pipeline as NLw}from"stream/promises";import{createGzip as FLw}from"zlib";function QB(X){if(!X||X.startsWith("/")||X.includes("\\")||/[\x00-\x1f\x7f]/.test(X)||X.split("/").some((H)=>!H||H==="."||H===".."||H.startsWith(".wh.")||Buffer.byteLength(H)>255))throw Error(`Unsafe archive path: ${JSON.stringify(X)}`);return X}function CLw(X,H){let O=new Set(X.map((d)=>d.path)),E=new Map,C=new Map;function k(d,_0=!1){QB(d.path);let X0=d.path.toLowerCase();if(C.has(X0)&&C.get(X0)!==d.path)throw Error(`Case-colliding archive path: ${d.path}`);C.set(X0,d.path);let I0=E.get(d.path);if(I0&&(I0.type!=="directory"||d.type!=="directory"))throw Error(`Overlapping archive path: ${d.path}`);if(!I0||!_0)E.set(d.path,d)}for(let d of X){k(d);let _0=Aj.dirname(d.path);while(_0!==".")k({path:_0,type:"directory"},!0),_0=Aj.dirname(_0);if(d.type==="symlink"){if(!d.target||Aj.isAbsolute(d.target)||/[\\\x00-\x1f\x7f]/.test(d.target))throw Error(`Unsafe symlink: ${d.path}`);let X0=Aj.normalize(Aj.join(Aj.dirname(d.path),d.target));if(X0===".."||X0.startsWith("../"))throw Error(`Escaping symlink: ${d.path}`)}}return[...E.values()].filter((d)=>!H||O.has(d.path)||H.some((_0)=>d.path===_0||d.path.startsWith(`${_0}/`))).sort((d,_0)=>Buffer.compare(Buffer.from(d.path),Buffer.from(_0.path)))}function uv(X,H,O,E){let C=E.toString(8);if(!Number.isSafeInteger(E)||E<0||C.length>=O)throw Error("Tar number overflow");X.write(`${C.padStart(O-1,"0")}\x00`,H,O,"ascii")}function SLw(X){if(Buffer.byteLength(X)<=100)return{name:X,prefix:""};for(let H=X.lastIndexOf("/");H>0;H=X.lastIndexOf("/",H-1)){let O=X.slice(0,H),E=X.slice(H+1);if(Buffer.byteLength(O)<=155&&Buffer.byteLength(E)<=100)return{prefix:O,name:E}}}function vv0(X,H,O,E,C,k=""){let d=Buffer.alloc(512);d.write(X.name,0,100,"utf8"),uv(d,100,8,E),uv(d,108,8,0),uv(d,116,8,0),uv(d,124,12,O),uv(d,136,12,C),d.fill(32,148,156),d.write(H,156,1,"ascii"),d.write(k,157,100,"utf8"),d.write("ustar\x00",257,6,"ascii"),d.write("00",263,2,"ascii"),d.write(X.prefix,345,155,"utf8");let _0=d.reduce((X0,I0)=>X0+I0,0);return d.write(`${_0.toString(8).padStart(6,"0")}\x00 `,148,8,"ascii"),d}function b00(X,H){let O=` ${X}=${H}
589
- `,E=Buffer.byteLength(O)+1;while(E!==Buffer.byteLength(O)+String(E).length)E=Buffer.byteLength(O)+String(E).length;return Buffer.from(`${E}${O}`)}var mv0=(X)=>Buffer.alloc((512-X%512)%512);async function*JW0(X,H,O){if(!Number.isSafeInteger(H)||H<0)throw Error("Invalid tar epoch");for(let E of CLw(X,O?.map(QB))){let C=SLw(E.path),k=E.type==="file"?"content"in E?E.content.byteLength:E.size:0,d=E.type==="symlink"?E.target:"",_0=[];if(!C)_0.push(b00("path",E.path));if(Buffer.byteLength(d)>100)_0.push(b00("linkpath",d));if(k>=8589934592)_0.push(b00("size",String(k)));if(H>=8589934592)_0.push(b00("mtime",String(H)));if(_0.length){let z0=Buffer.concat(_0);yield vv0({name:`PaxHeaders/${c9(E.path).slice(7,39)}`,prefix:""},"x",z0.length,420,0),yield z0,yield mv0(z0.length)}let X0=E.type==="directory"?"5":E.type==="symlink"?"2":"0";if(E.type==="file"&&E.mode!==void 0&&![292,365,420,493].includes(E.mode))throw Error("Unsupported archive file mode");let I0=E.type==="directory"?493:E.type==="symlink"?511:E.mode??(E.executable?493:420);if(yield vv0(C??{name:"PaxEntry",prefix:""},X0,k<8589934592?k:0,I0,H<8589934592?H:0,Buffer.byteLength(d)<=100?d:""),E.type==="file"){if("content"in E)yield E.content;else{let z0=0;for await(let p0 of ELw(E.source)){if(z0+=p0.length,z0>k)throw Error(`File changed while packing: ${E.path}`);yield p0}if(z0!==k)throw Error(`File changed while packing: ${E.path}`)}yield mv0(k)}}yield Buffer.alloc(1024)}async function qH(X,H,O,E,C){if(H.length===0)return;let k=KLw("sha256");async function*d(){for await(let p0 of JW0(H,E,C))k.update(p0),yield p0}let _0=RLw.from(d()),X0=FLw({level:6}),I0=NLw(_0,X0);I0.catch(()=>{});async function*z0(){let p0=Buffer.alloc(0),o=!1;for await(let Tw of X0){if(o){yield Tw;continue}if(p0=Buffer.concat([p0,Tw]),p0.length>=10)p0.fill(0,4,8),p0[9]=255,o=!0,yield p0,p0=Buffer.alloc(0)}if(!o)throw Error("Incomplete gzip stream")}try{let p0=await X.putStream(z0(),l4.gzip);await I0;let o=`sha256:${k.digest("hex")}`;return{kind:O,descriptor:p0,diffId:o}}finally{_0.destroy(),X0.destroy(),await I0.catch(()=>{})}}import{AsyncLocalStorage as gLw}from"async_hooks";import{setTimeout as xLw}from"timers/promises";import{randomBytes as yLw}from"crypto";var pE={name:"bunko",version:"0.1.0-rc.5",private:!0,license:"MIT",type:"module",description:"Build OCI images from Bun applications without Dockerfiles",bin:{bunko:"./packages/bunko/cli.ts"},engines:{bun:">=1.3.11 <1.5"},scripts:{dev:"bun packages/bunko/cli.ts",build:"bun scripts/bundle.ts",test:"bun test --timeout 15000","bench:syntax":"bun test/syntax-benchmark.ts","release:prepare":"bun scripts/release.ts",typecheck:"tsc --noEmit","test:smoke":"bun test/smoke.ts","test:registry":"bun test/registry-conformance.ts","test:registry-local":"bun test/registry-local.ts","test:build-smoke":"bun test/build-smoke.ts","test:resolve-smoke":"bun test/resolve-smoke.ts","test:bundled-smoke":"bun test/bundled-smoke.ts","test:closure-smoke":"bun test/closure-smoke.ts","test:workspace-smoke":"bun test/workspace-smoke.ts",check:"bun run typecheck && bun run test","test:compile-smoke":"bun test/compile-smoke.ts","test:runtime-ca-compile":"bun test/runtime-ca-compile-smoke.ts","test:operations-smoke":"bun test/operations-smoke.ts","test:apply-smoke":"bun test/apply-smoke.ts","bench:performance":"bun test/performance-benchmark.ts","test:runtime-smoke":"bun test/runtime-smoke.ts","test:ko-smoke":"bun test/ko-smoke.ts","bench:builders":"bun test/buildkit-benchmark.ts","test:local-resolve":"bun test/local-resolve-smoke.ts","test:prepared-deps":"bun test/buildkit-deps-smoke.ts","test:zstd-smoke":"bun test/zstd-smoke.ts","test:metadata":"bun test/metadata-smoke.ts","test:cache-distribution":"bun test/cache-distribution-smoke.ts","test:signing-smoke":"bun test/signing-smoke.ts","test:prune-smoke":"bun test/prune-smoke.ts","test:multiple-entrypoints":"bun test/multiple-entrypoints-smoke.ts","test:asset-contexts":"bun test/asset-contexts-smoke.ts","test:application-validation":"bun scripts/validation/run-fixture.ts","test:runtime-injection":"bun scripts/validation/runtime-smoke.ts","test:telemetry":"bun scripts/validation/telemetry-smoke.ts","test:fonts":"bun scripts/validation/fonts-smoke.ts"},devDependencies:{"@types/bun":"1.3.11","@types/tar-stream":"3.1.4","@types/yauzl":"3.4.0",ignore:"7.0.9","tar-stream":"3.2.1",typescript:"5.9.3",yaml:"2.9.0",yauzl:"3.4.0"}};var vv=new gLw,D00=(X)=>Object.entries(X).map(([H,O])=>({key:H,value:{stringValue:O}})),XW0=(X)=>yLw(X).toString("hex"),J00=[0.01,0.05,0.1,0.5,1,5,10,30,60,300];function dv0(X,H=process.env){if(!X||H.OTEL_SDK_DISABLED?.toLowerCase()==="true")return;H=Object.fromEntries(Object.entries(H).filter(([,_0])=>_0!==""));let O={};try{for(let _0 of(H.OTEL_EXPORTER_OTLP_HEADERS??"").split(",").filter(Boolean)){let X0=_0.indexOf("=");if(X0<1)throw Error();let I0=_0.slice(0,X0).trim().toLowerCase(),z0=decodeURIComponent(_0.slice(X0+1).trim());if(!/^[!#$%&'*+.^_`|~0-9a-z-]+$/.test(I0)||/[\r\n]/.test(z0)||["host","content-type","content-length","connection","transfer-encoding"].includes(I0))throw Error();O[I0]=z0}new Headers(O)}catch{throw Error("Invalid OTEL_EXPORTER_OTLP_HEADERS")}let E=Number(H.OTEL_EXPORTER_OTLP_TIMEOUT??"2000");if(!Number.isInteger(E)||E<1||E>1e4)throw Error("OTEL_EXPORTER_OTLP_TIMEOUT must be 1\u201310000 milliseconds");let C=(_0)=>{let X0=H[`OTEL_${_0}_EXPORTER`]??"otlp";if(X0==="none")return;if(X0!=="otlp")throw Error(`OTEL_${_0}_EXPORTER must be otlp or none`);if((H[`OTEL_EXPORTER_OTLP_${_0}_PROTOCOL`]??H.OTEL_EXPORTER_OTLP_PROTOCOL??"http/json")!=="http/json")throw Error("Bunko telemetry supports only OTLP http/json");let I0;try{let z0=H[`OTEL_EXPORTER_OTLP_${_0}_ENDPOINT`];if(I0=new URL(z0??H.OTEL_EXPORTER_OTLP_ENDPOINT??"http://127.0.0.1:4318"),!["https:","http:"].includes(I0.protocol)||I0.username||I0.password||I0.search||I0.hash)throw Error();if(!z0)I0.pathname=`${I0.pathname.replace(/\/$/,"")}/v1/${_0.toLowerCase()}`}catch{throw Error(`Invalid OTLP ${_0.toLowerCase()} endpoint`)}if(I0.protocol==="http:"&&Object.keys(O).length)throw Error("OTLP exporter headers require HTTPS endpoints");return I0},k=C("TRACES"),d=C("METRICS");return k||d?{traces:k,metrics:d,headers:O,timeout:E}:void 0}class WW0{config;warn;traceId=XW0(16);root=XW0(8);wall=BigInt(Date.now())*1000000n;start=performance.now();spans=[];series=new Map;groups=new Map;targets=new Map;dropped=0;ended=!1;running=!1;timestamp(){return(this.wall+BigInt(Math.round((performance.now()-this.start)*1e6))).toString()}constructor(X,H=()=>{}){this.config=X;this.warn=H}span(X,H,O={}){let E=this.timestamp();return{traceId:this.traceId,spanId:XW0(8),parentSpanId:H,name:X,kind:1,startTimeUnixNano:E,endTimeUnixNano:E,attributes:D00(O),status:{code:0}}}group(X,H,O,E){let C=this.groups.get(X);if(!C){if(this.groups.size>=256)return this.dropped++,O;C=this.span(H,O,E),this.groups.set(X,C)}return C.spanId}async phase(X,H,O,E){let C=vv.getStore();O??=C.target,E??=C.platform;let k=C.parent;if(O!==C.target||E!==C.platform){if(k=this.root,O){if(!this.targets.has(O)&&this.targets.size<128)this.targets.set(O,String(this.targets.size));let p0=this.targets.get(O)??"overflow";if(k=this.group(`target:${p0}`,"bunko.target",k,{"bunko.target.index":p0}),E)k=this.group(`target:${p0}:${E}`,"bunko.platform",k,{"bunko.platform":E})}}let d={"bunko.phase":X,...E?{"bunko.platform":E}:{}},_0=this.span(`bunko.${X}`,k,d),X0=performance.now(),I0=this.spans.length<4096;if(I0)this.spans.push(_0);else this.dropped++;let z0="success";try{return await vv.run({session:this,parent:I0?_0.spanId:k,target:O,platform:E},H)}catch(p0){throw z0="failure",_0.status.code=2,p0}finally{_0.endTimeUnixNano=this.timestamp();let p0=O?this.targets.get(O)??"overflow":void 0;for(let o of p0===void 0?[]:[`target:${p0}`,`target:${p0}:${E}`]){let Tw=this.groups.get(o);if(Tw)Tw.endTimeUnixNano=_0.endTimeUnixNano}this.record("bunko.phase.duration","s",(performance.now()-X0)/1000,{...d,"bunko.result":z0},!0)}}record(X,H,O,E,C=!1){if(!Number.isFinite(O)||O<0)return;let k=JSON.stringify([X,Object.entries(E).sort()]),d=this.series.get(k);if(!d){if(this.series.size>=512){this.dropped++;return}d={name:X,unit:H,attributes:E,sum:0,count:0,buckets:C?Array(J00.length+1).fill(0):void 0},this.series.set(k,d)}if(d.sum+=O,d.count++,d.buckets){let _0=J00.findIndex((X0)=>O<=X0);d.buckets[_0<0?J00.length:_0]++}}async run(X,H,O=()=>!1){if(this.running)throw Error("Telemetry invocation may only run once");this.running=!0;let E="success";try{let C=await vv.run({session:this,parent:this.root},H);if(O(C))E="failure";return C}catch(C){throw E="failure",C}finally{let C=this.timestamp();for(let k of this.groups.values())this.spans.push(k);this.spans.push({...this.span("bunko.build"),spanId:this.root,startTimeUnixNano:this.wall.toString(),endTimeUnixNano:C,attributes:D00({"bunko.command":X}),status:{code:E==="failure"?2:1}}),this.record("bunko.build.count","{build}",1,{"bunko.command":X,"bunko.result":E}),this.record("bunko.build.duration","s",(performance.now()-this.start)/1000,{"bunko.command":X,"bunko.result":E},!0),await this.flush()}}async flush(){if(this.ended)return;this.ended=!0;let X={attributes:D00({"service.name":"bunko","service.version":pE.version})},H={name:"bunko",version:pE.version},O=this.timestamp(),E=new Map;for(let X0 of this.series.values()){let I0=E.get(X0.name),z0=X0.buckets?"histogram":"sum";if(!I0)I0={name:X0.name,unit:X0.unit,[z0]:{aggregationTemporality:1,...X0.buckets?{}:{isMonotonic:!0},dataPoints:[]}},E.set(X0.name,I0);I0[z0].dataPoints.push({attributes:D00(X0.attributes),startTimeUnixNano:this.wall.toString(),timeUnixNano:O,...X0.buckets?{count:String(X0.count),sum:X0.sum,explicitBounds:J00,bucketCounts:X0.buckets.map(String)}:{asDouble:X0.sum}})}let C=[[this.config.traces,{resourceSpans:[{resource:X,scopeSpans:[{scope:H,spans:this.spans}]}]}],[this.config.metrics,{resourceMetrics:[{resource:X,scopeMetrics:[{scope:H,metrics:[...E.values()]}]}]}]],k=new AbortController,d=setTimeout(()=>k.abort(),this.config.timeout),_0=this.dropped>0;try{await Promise.all(C.map(async([X0,I0])=>{if(!X0)return;try{let z0=JSON.stringify(I0),o=await(async()=>{for(let Zw=0;;Zw++){let w2;try{w2=await fetch(X0,{method:"POST",headers:{...this.config.headers,"content-type":"application/json"},body:z0,redirect:"manual",signal:k.signal})}catch{if(Zw||k.signal.aborted)throw Error()}if(w2&&![429,502,503,504].includes(w2.status))return w2;let iw=w2?.headers.get("retry-after"),aw=100;if(iw){let E1=/^\d+$/.test(iw)?Number(iw)*1000:Date.parse(iw)-Date.now();if(Number.isFinite(E1))aw=Math.max(aw,E1)}if(w2)await w2.body?.cancel();if(Zw||aw>=this.config.timeout)throw Error();await xLw(aw,void 0,{signal:k.signal})}})();if(o.status!==200||!o.body)throw await o.body?.cancel(),Error();let Tw=o.body.getReader(),j0=0,C0=[];try{while(!0){let{done:Zw,value:w2}=await Tw.read();if(Zw)break;if(j0+=w2.length,j0>65536)throw Error();C0.push(w2)}}finally{await Tw.cancel()}let Xw=JSON.parse(Buffer.concat(C0).toString());if(!Xw||typeof Xw!=="object"||Array.isArray(Xw))throw Error();if(Xw.partialSuccess!==void 0){let Zw=Xw.partialSuccess;if(!Zw||typeof Zw!=="object"||Array.isArray(Zw))throw Error();let w2=Zw.rejectedSpans??Zw.rejectedDataPoints??0;if(!/^[0-9]+$/.test(String(w2))||!Number.isSafeInteger(Number(w2))||Zw.errorMessage!==void 0&&typeof Zw.errorMessage!=="string")throw Error();if(Number(w2)>0||Zw.errorMessage)_0=!0}}catch{_0=!0}}))}catch{_0=!0}finally{if(k.abort(),clearTimeout(d),_0)try{this.warn()}catch{}}}}function cv0(X,H,O,E){let C=vv.getStore();return C?C.session.phase(X,H,O,E):H()}function mv(X,H,O,E){vv.getStore()?.session.record(X,H,O,E)}var y5=_00(W00(),1),pv0="Bundling may relocate this module-relative path. Use an explicit runtime asset root and verify file reads in the image.",hLw=new Set(["dir","dirname","path","filename","url"]),kLw=new Set(["__dirname","__filename"]),fLw=100;function Q00(X){let H=X;if(!H||!Number.isSafeInteger(H.total)||H.total<0||!Array.isArray(H.warnings)||H.warnings.length!==Math.min(H.total,fLw))throw Error("Invalid module-location diagnostics");let O=new Set;for(let E of H.warnings){if(!E||E.code!=="BUNKO_MODULE_LOCATION"||typeof E.file!=="string"||!E.file||E.file.length>4096||/[\x00-\x1f\\]/.test(E.file)||E.file.startsWith("/")||E.file.split("/").some((k)=>k===".."||k==="."||!k)||!Number.isSafeInteger(E.line)||E.line<1||!Number.isSafeInteger(E.column)||E.column<1||![...kLw,...[...hLw].map((k)=>`import.meta.${k}`)].includes(E.expression))throw Error("Invalid module-location warning");let C=`${E.file}\x00${E.expression}`;if(O.has(C))throw Error("Duplicate module-location warning");O.add(C)}return H}import{mkdir as kqw,rename as fqw,rm as uqw,writeFile as vqw}from"fs/promises";import{randomUUID as mqw}from"crypto";import{join as lv}from"path";import{createHash as uLw}from"crypto";import{createReadStream as vLw,createWriteStream as mLw}from"fs";import{Transform as dLw,Writable as cLw}from"stream";import{pipeline as QW0}from"stream/promises";import{createGunzip as lLw,createZstdDecompress as pLw,constants as iLw}from"zlib";async function tq(X,H,O,E,C=2147483648){await X.ensure(H);let k=uLw("sha256"),d=0,_0=new dLw({transform(z0,p0,o){if(d+=z0.length,d>C){o(Error("Decoded layer exceeds size limit"));return}k.update(z0),o(null,z0)}}),X0=vLw(X.path(H.digest)),I0=E?mLw(E,{flags:"wx"}):new cLw({write(z0,p0,o){o()}});if(H.mediaType===l4.gzip||H.mediaType===l4.dockerGzip)await QW0(X0,lLw(),_0,I0);else if(H.mediaType===l4.zstd)await QW0(X0,pLw({params:{[iLw.ZSTD_d_windowLogMax]:27}}),_0,I0);else if(H.mediaType===l4.tar)await QW0(X0,_0,I0);else throw Error(`Cannot decode layer media type: ${H.mediaType}`);if(`sha256:${k.digest("hex")}`!==O)throw Error(`Layer DiffID mismatch: ${H.digest}`)}function VH(X){if(X.includes("@")||X.lastIndexOf(":")>X.lastIndexOf("/"))throw Error("Repository must not include a tag or digest");return Oj(X)}function qb(X){return`${X.registry==="registry-1.docker.io"?"docker.io":X.registry}/${X.repository}`}class OH extends Error{result;constructor(X,H,O){super(X,{cause:O});this.result=H}}class UI{ref;client;scope;acknowledgedSubjects=new Map;acceptsSubject(X,H){return this.acknowledgedSubjects.get(X.digest)===H.digest}constructor(X,H={}){this.ref=VH(X),this.client=xv(this.ref.registry,H),this.scope=`repository:${this.ref.repository}:pull,push`}async exists(X){let H=await this.client.request(`/v2/${this.ref.repository}/blobs/${X.digest}`,{method:"HEAD"},[this.scope],[404]);if(await H.body?.cancel(),H.status===404)return!1;let O=H.headers.get("Docker-Content-Digest"),E=H.headers.get("Content-Length");if(O&&O!==X.digest||E&&Number(E)!==X.size)throw Error("Registry blob HEAD digest/size mismatch");return!0}async confirmBlob(X){for(let H=0;;H++){if(await this.exists(X))return!0;if(H>=3)return!1;await this.client.backoff(H)}}async blob(X,H,O="base",E=!1){let C={digest:H.digest,kind:O,size:H.size,uploaded:0,action:"reused"};if(await this.exists(H))return C;if(E)return{...C,action:"would-upload",uploaded:H.size};let k=X.origins.get(H.digest),d,_0=new URL(this.client.origin).hostname,X0=_0==="ghcr.io"||/^(?:(?:us|eu|asia)\.)?gcr\.io$/.test(_0)||/^[a-z0-9-]+-docker\.pkg\.dev$/.test(_0),I0=X0,z0=8388608,p0=(Tw)=>{let j0=Tw.headers.get("OCI-Chunk-Min-Length"),C0=j0===null?0:/^\d+$/.test(j0)?Number(j0):NaN;I0=X0||!Number.isSafeInteger(C0)||C0>33554432,z0=I0?8388608:Math.max(8388608,C0)};if(k?.registry===this.ref.registry&&k.repository!==this.ref.repository){let Tw=new URL(`/v2/${this.ref.repository}/blobs/uploads/`,this.client.origin);Tw.searchParams.set("mount",H.digest),Tw.searchParams.set("from",k.repository);let j0;try{j0=await this.client.request(Tw,{method:"POST"},[this.scope,`repository:${k.repository}:pull`],[400,403,404,405])}catch(C0){if(!Z00(C0))throw C0;if(await this.exists(H))return C}if(j0){if(await j0.body?.cancel(),j0.status===201){if(!await this.confirmBlob(H))throw Error("Mounted registry blob is missing");return{...C,action:"mounted"}}if(j0.status===202)d=this.location(j0,Tw.toString()),p0(j0)}}if(!d)d=await this.startUpload(p0);let o=!1;try{await X.ensure(H);let Tw=Bun.file(X.path(H.digest));if(Tw.size!==H.size)throw Error("Upload blob size mismatch");let j0=0,C0=0,Xw=0;while(!I0&&j0<H.size){let Zw=Math.min(j0+z0,H.size);try{let w2=Buffer.from(await Tw.slice(j0,Zw).arrayBuffer());if(w2.length!==Zw-j0)throw Error("Upload source changed while reading chunk");let iw=await this.client.request(d,{method:"PATCH",headers:{"Content-Type":"application/octet-stream","Content-Length":String(Zw-j0),"Content-Range":`${j0}-${Zw-1}`},body:w2},[this.scope]);if(await iw.body?.cancel(),iw.status!==202)throw Error("Registry did not accept upload chunk");d=this.location(iw,d),j0=Zw,C0=0}catch(w2){if(!Z00(w2)&&!(w2 instanceof AU&&[404,410,416].includes(w2.status)))throw w2;if(++C0>3)throw Error(`${w2 instanceof Error?w2.message:"Upload failed"}; blob ${H.digest}, offset ${j0}/${H.size}`);await this.client.backoff(C0-1);let iw=await this.client.request(d,{},[this.scope],[404,410]);if(await iw.body?.cancel(),iw.status===404||iw.status===410){if(++Xw>3)throw Error("Registry repeatedly expired the upload session");d=await this.startUpload(p0),j0=0;continue}let aw=/^(?:bytes=)?0-(\d+)$/.exec(iw.headers.get("Range")??"");if(!aw)throw Error("Registry upload status has no valid Range");if(j0===0&&aw[1]==="0"){await this.cancelUpload(d),d=await this.startUpload(p0);continue}let E1=Number(aw[1])+1;if(!Number.isSafeInteger(E1)||E1<j0||E1>Zw)throw Error("Registry upload offset is inconsistent");if(j0=E1,iw.headers.has("Location"))d=this.location(iw,d)}}for(let Zw=0;;Zw++){let w2=new URL(d);w2.searchParams.set("digest",H.digest);try{let iw=await this.client.request(w2,{method:"PUT",headers:{"Content-Length":String(I0?H.size:0),"Content-Type":"application/octet-stream"},body:I0?Tw:void 0},[this.scope]);if(await iw.body?.cancel(),!iw.ok)throw Error("Registry did not finalize upload");let aw=iw.headers.get("Docker-Content-Digest");if(aw&&aw!==H.digest)throw Error("Registry upload digest mismatch");break}catch(iw){if(I0&&!Z00(iw))throw iw;if(await this.exists(H))break;if(Zw>=2)throw iw;if(I0)await this.cancelUpload(d),d=await this.startUpload(p0),I0=!0}}if(!await this.confirmBlob(H))throw Error("Uploaded registry blob is missing");return o=!0,{...C,action:"uploaded",uploaded:H.size}}finally{if(!o)await this.cancelUpload(d)}}async startUpload(X){let H=`/v2/${this.ref.repository}/blobs/uploads/`;for(let O=0;;O++)try{let E=await this.client.request(H,{method:"POST"},[this.scope]);if(await E.body?.cancel(),E.status!==202)throw Error("Registry did not create an upload session");let C=this.location(E,new URL(H,this.client.origin).toString());return X(E),C}catch(E){if(O>=2||!Z00(E)||E instanceof AU&&E.status===404)throw E;await this.client.backoff(O)}}async cancelUpload(X){try{await(await this.client.request(X,{method:"DELETE"},[this.scope],[404,405])).body?.cancel()}catch{}}location(X,H){let O=X.headers.get("Location");if(!O)throw Error("Registry upload response has no Location");return new URL(O,H).toString()}async manifest(X,H,O=H.digest){let E=await X.read(H);this.acknowledgedSubjects.delete(H.digest);let C=`/v2/${this.ref.repository}/manifests/${O}`,k;for(let X0=0;;X0++)try{k=await this.client.request(C,{method:"PUT",headers:{"Content-Type":H.mediaType},body:Buffer.from(E)},[this.scope]);break}catch(I0){if(!(I0 instanceof AU?I0.status===429||I0.status>=500:I0 instanceof Error&&I0.message.includes("connection failed")))throw I0;let p0=await this.client.request(C,{},[this.scope],[404]);if(p0.ok){if(c9(await zU(p0))===H.digest)return}else await p0.body?.cancel();if(X0>=2)throw I0}if(await k.body?.cancel(),!k.ok)throw Error("Registry did not accept manifest");let d=k.headers.get("Docker-Content-Digest");if(d&&d!==H.digest)throw Error("Published manifest digest mismatch");let _0=k.headers.get("OCI-Subject");if(_0){let X0=f1(JSON.parse(Buffer.from(E).toString()),"Published manifest").subject;if(!X0||_0!==e5(X0).digest)throw Error("Registry OCI-Subject acknowledgement mismatch")}for(let X0=0;;X0++){let I0=await this.client.request(`/v2/${this.ref.repository}/manifests/${O}`,{},[this.scope],[404]);if(I0.status===404)await I0.body?.cancel();else if(c9(await zU(I0))===H.digest){if(_0)this.acknowledgedSubjects.set(H.digest,_0);return}if(X0>=3)throw Error("Registry did not return the published manifest bytes after bounded verification retries");await this.client.backoff(X0)}}async resolveTag(X){let H=await this.client.request(`/v2/${this.ref.repository}/manifests/${X}`,{},[this.scope],[404]);if(H.status===404){await H.body?.cancel();return}let O=c9(await zU(H)),E=H.headers.get("Docker-Content-Digest");if(E&&E!==O)throw Error("Registry tag digest header mismatch");return O}async publish(X,H,O,E=new Map,C=!1,k="fail"){if(!["fail","skip"].includes(k))throw Error("Tag conflict policy must be fail or skip");for(let I0 of O)if(!/^[\w][\w.-]{0,127}$/.test(I0))throw Error(`Invalid image tag: ${I0}`);let d={reference:`${qb(this.ref)}@${H.digest}`,published:!1,tags:[],pendingTags:[...O],transfers:[]},_0=new Set,X0=async(I0)=>{if(_0.has(I0.digest))return;if(_0.add(I0.digest),I0.mediaType===l4.index){let z0=f1(JSON.parse(Buffer.from(await X.read(I0)).toString()),"Image index");if(!Array.isArray(z0.manifests))throw Error("Invalid image index");for(let p0 of z0.manifests)await X0(e5(p0))}else if(I0.mediaType===l4.manifest){let z0=f1(JSON.parse(Buffer.from(await X.read(I0)).toString()),"Image manifest");if(!Array.isArray(z0.layers))throw Error("Invalid image layers");for(let p0 of[...z0.layers,z0.config]){let o=e5(p0);if(_0.has(o.digest))continue;_0.add(o.digest),d.transfers.push(await this.blob(X,o,E.get(o.digest)??(o.mediaType===l4.config?"config":"base"),C))}}else throw Error("Publication root must be an OCI manifest or index");if(!C)await this.manifest(X,I0)};try{if(await X0(H),C)return d;d.published=!0;for(let I0 of O){if(k==="skip"&&await this.resolveTag(I0)===H.digest)(d.existingTags??=[]).push(I0);else try{await this.manifest(X,H,I0)}catch(z0){if(k!=="skip"||!(z0 instanceof AU)||!z0.immutableTag)throw z0;let p0=await this.resolveTag(I0);if(!p0)throw z0;if(p0!==H.digest){(d.skippedTags??=[]).push({tag:I0,digest:p0,status:z0.status}),d.pendingTags.shift();continue}(d.existingTags??=[]).push(I0)}d.tags.push(I0),d.pendingTags.shift()}return d}catch(I0){throw new OH(I0 instanceof Error?I0.message:"Image publication failed",d,I0)}}}function Z00(X){return X instanceof AU?[404,408,429].includes(X.status)||X.status>=500:X instanceof Error&&X.message.includes("connection failed")}var Dm0=_00(Gm0(),1);import{createReadStream as Oqw}from"fs";import{lstat as Um0}from"fs/promises";import{dirname as Pqw,join as bm0,relative as Aqw}from"path";function O00(X){let H=new Map,O=new Map,E=0;function C(d){if(!H.has(d))H.set(d,(async()=>{if(d){let z0=await Um0(bm0(X,d));if(!z0.isDirectory()||z0.isSymbolicLink())throw Error("Source ignore scope must be a regular directory")}let _0=bm0(X,d,".gitignore"),X0;try{X0=await Um0(_0)}catch(z0){if(z0.code==="ENOENT")return;throw z0}if(!X0.isFile()||X0.isSymbolicLink()||X0.size>262144)throw Error("Source .gitignore must be a regular file of at most 256 KiB");let I0=await Bun.file(_0).slice(0,262145).text();if(E+=Buffer.byteLength(I0),Buffer.byteLength(I0)>262144||E>4194304)throw Error("Source .gitignore rules exceed the size limit");return Dm0.default({ignorecase:!1}).add(I0)})());return H.get(d)}function k(d,_0=!1){if(!d||d===".")return Promise.resolve(!1);let X0=d+(_0?"/":"");if(!O.has(X0))O.set(X0,(async()=>{let I0=Pqw(d);if(I0!=="."&&await k(I0,!0))return!0;let z0=d.split("/"),p0=!1;for(let o=0;o<z0.length;o++){let Tw=z0.slice(0,o).join("/"),C0=(await C(Tw))?.test(Aqw(Tw||".",d)+(_0?"/":""));if(C0?.ignored)p0=!0;else if(C0?.unignored)p0=!1}return p0})());return O.get(X0)}return k}async function Jm0(X,H){let O="";for await(let E of Oqw(X,{highWaterMark:65536})){let C=O+Buffer.from(E).toString("latin1");if(/-----BEGIN [A-Z0-9 ]{0,64}PRIVATE KEY-----/.test(C))throw Error(`Private-key marker in source input: ${H}; remove the credential or exclude the file`);O=C.slice(-128)}}import{lstat as Wm0,readFile as Qm0,readdir as zqw}from"fs/promises";import{dirname as Kqw,join as ID,relative as Xm0,resolve as Eqw}from"path";var nE=new Set([".git",".cursor","node_modules",".bunko-output",".bunko-build",".npmrc",".bunko-cache",".docker",".aws",".config",".yarnrc.yml",".DS_Store",".ssh",".kube",".gnupg",".netrc",".terraform","id_rsa","id_dsa","id_ecdsa","id_ed25519","terraform.tfstate","terraform.tfstate.backup"]);async function Zm0(X,H,O=[],E=[]){let C=await sE(X),k=H.some((p0)=>p0.mode==="source")?O00(X):void 0,d=(p0)=>p0.split("/").some((o,Tw,j0)=>C(j0.slice(0,Tw+1).join("/"))),_0=(p0)=>p0.split("/").some((o)=>nE.has(o)||o.startsWith(".env"))||[...O,...E].some((o)=>ID(X,p0)===o||ID(X,p0).startsWith(`${o}/`)),X0=new Set(["package.json","bun.lock","tsconfig.json","jsconfig.json"]);for(let p0 of H){for(let j0 of Object.values(p0.entrypoints??{default:p0.entrypoint}))X0.add(ID(p0.targetPath,j0));for(let j0 of["tsconfig.json","jsconfig.json"])X0.add(ID(p0.targetPath,j0));for(let j0 of p0.workspace?.packages??[])X0.add(ID(j0.path,"package.json"));let o=hv(p0.assetExcludes);async function Tw(j0){if(o(Xm0(p0.targetPath||".",j0))){if(p0.mode==="source"&&[...X0].some((Xw)=>Xw===j0||Xw.startsWith(`${j0}/`)))throw Error(`Asset exclusion overlaps a required source input: ${j0}`);E.push(ID(X,j0));return}X0.add(j0);let C0=await Wm0(ID(X,j0));if(C0.isSymbolicLink())throw Error(`Source symlinks are not supported: ${j0}`);if(C0.isDirectory())for(let Xw of await zqw(ID(X,j0)))await Tw(ID(j0,Xw));else if(!C0.isFile())throw Error(`Unsupported asset file type: ${j0}`)}for(let j0 of p0.assets){let C0=!1;for await(let Xw of new Bun.Glob(j0).scan({cwd:ID(X,p0.targetPath),dot:!0,onlyFiles:!1,followSymlinks:!1}))C0=!0,await Tw(ID(p0.targetPath,Xw));if(!C0)throw Error(`Asset pattern matched no files: ${j0}`)}for(let j0 of p0.workspace?.packages??[{manifest:JSON.parse(p0.manifestText)}])for(let C0 of Object.values(j0.manifest.patchedDependencies??{}))if(typeof C0==="string")X0.add(C0)}let I0=new Set;async function z0(p0){if(I0.has(p0))return;if(I0.add(p0),d(p0)||await k?.(p0))throw Error(`Ignored required input: ${p0}`);X0.add(p0);let o=f1(Bun.JSONC.parse(await Qm0(ID(X,p0),"utf8")),"tsconfig");for(let Tw of o.extends===void 0?[]:Array.isArray(o.extends)?o.extends:[o.extends]){if(typeof Tw!=="string"||!Tw.startsWith("."))continue;let j0=Eqw(X,Kqw(p0),Tw.endsWith(".json")?Tw:Tw+".json"),C0=Xm0(X,j0);if(C0===".."||C0.startsWith("../"))throw Error("tsconfig extends must stay inside the project snapshot");await z0(C0)}}for await(let p0 of new Bun.Glob("**/{tsconfig,jsconfig}.json").scan({cwd:X,dot:!0,followSymlinks:!1}))if(!_0(p0)&&!d(p0)&&!await k?.(p0))await z0(p0);if(H.some((p0)=>p0.mode==="source")){for(let p0 of X0)if(E.some((o)=>ID(X,p0)===o||ID(X,p0).startsWith(`${o}/`)))throw Error(`Asset exclusion overlaps a required source input: ${p0}`)}return[...X0]}async function sE(X){let H;try{let E=ID(X,".bunkoignore");if(!(await Wm0(E)).isFile())throw Error(".bunkoignore must be a regular file");H=await Qm0(E,"utf8")}catch(E){if(E.code==="ENOENT")return()=>!1;throw E}let O=H.split(/\r?\n/).map((E)=>E.trim()).filter((E)=>E&&!E.startsWith("#")).map((E)=>{let C=E.replace(/^(?:\.\/)+/,"").replace(/\/$/,"");if(!C||C.startsWith("/")||C.startsWith("!")||/[\\\x00-\x1f]/.test(C)||C.split("/").includes(".."))throw Error("Invalid .bunkoignore pattern");return new Bun.Glob(C)});return(E)=>E!==".bunkoignore"&&O.some((C)=>C.match(E))}import{createHash as Rqw}from"crypto";import{chmod as Nqw,copyFile as Fqw,lstat as LW0,mkdir as Cqw,readdir as Ym0,readFile as uyw,open as Sqw}from"fs/promises";import{join as Rj,posix as Im0,relative as jqw,resolve as Hm0}from"path";var x3=_00(W00(),1);/*! TypeScript 5.9.3 — Copyright Microsoft Corporation.
589
+ `,E=Buffer.byteLength(O)+1;while(E!==Buffer.byteLength(O)+String(E).length)E=Buffer.byteLength(O)+String(E).length;return Buffer.from(`${E}${O}`)}var mv0=(X)=>Buffer.alloc((512-X%512)%512);async function*JW0(X,H,O){if(!Number.isSafeInteger(H)||H<0)throw Error("Invalid tar epoch");for(let E of CLw(X,O?.map(QB))){let C=SLw(E.path),k=E.type==="file"?"content"in E?E.content.byteLength:E.size:0,d=E.type==="symlink"?E.target:"",_0=[];if(!C)_0.push(b00("path",E.path));if(Buffer.byteLength(d)>100)_0.push(b00("linkpath",d));if(k>=8589934592)_0.push(b00("size",String(k)));if(H>=8589934592)_0.push(b00("mtime",String(H)));if(_0.length){let z0=Buffer.concat(_0);yield vv0({name:`PaxHeaders/${c9(E.path).slice(7,39)}`,prefix:""},"x",z0.length,420,0),yield z0,yield mv0(z0.length)}let X0=E.type==="directory"?"5":E.type==="symlink"?"2":"0";if(E.type==="file"&&E.mode!==void 0&&![292,365,420,493].includes(E.mode))throw Error("Unsupported archive file mode");let I0=E.type==="directory"?493:E.type==="symlink"?511:E.mode??(E.executable?493:420);if(yield vv0(C??{name:"PaxEntry",prefix:""},X0,k<8589934592?k:0,I0,H<8589934592?H:0,Buffer.byteLength(d)<=100?d:""),E.type==="file"){if("content"in E)yield E.content;else{let z0=0;for await(let p0 of ELw(E.source)){if(z0+=p0.length,z0>k)throw Error(`File changed while packing: ${E.path}`);yield p0}if(z0!==k)throw Error(`File changed while packing: ${E.path}`)}yield mv0(k)}}yield Buffer.alloc(1024)}async function qH(X,H,O,E,C){if(H.length===0)return;let k=KLw("sha256");async function*d(){for await(let p0 of JW0(H,E,C))k.update(p0),yield p0}let _0=RLw.from(d()),X0=FLw({level:6}),I0=NLw(_0,X0);I0.catch(()=>{});async function*z0(){let p0=Buffer.alloc(0),o=!1;for await(let Tw of X0){if(o){yield Tw;continue}if(p0=Buffer.concat([p0,Tw]),p0.length>=10)p0.fill(0,4,8),p0[9]=255,o=!0,yield p0,p0=Buffer.alloc(0)}if(!o)throw Error("Incomplete gzip stream")}try{let p0=await X.putStream(z0(),l4.gzip);await I0;let o=`sha256:${k.digest("hex")}`;return{kind:O,descriptor:p0,diffId:o}}finally{_0.destroy(),X0.destroy(),await I0.catch(()=>{})}}import{AsyncLocalStorage as gLw}from"async_hooks";import{setTimeout as xLw}from"timers/promises";import{randomBytes as yLw}from"crypto";var pE={name:"bunko",version:"0.1.0",private:!0,license:"MIT",type:"module",description:"Build OCI images from Bun applications without Dockerfiles",bin:{bunko:"./packages/bunko/cli.ts"},engines:{bun:">=1.3.11 <1.5"},scripts:{dev:"bun packages/bunko/cli.ts",build:"bun scripts/bundle.ts",test:"bun test --timeout 15000","bench:syntax":"bun test/syntax-benchmark.ts","release:prepare":"bun scripts/release.ts",typecheck:"tsc --noEmit","test:smoke":"bun test/smoke.ts","test:registry":"bun test/registry-conformance.ts","test:registry-local":"bun test/registry-local.ts","test:build-smoke":"bun test/build-smoke.ts","test:resolve-smoke":"bun test/resolve-smoke.ts","test:bundled-smoke":"bun test/bundled-smoke.ts","test:closure-smoke":"bun test/closure-smoke.ts","test:workspace-smoke":"bun test/workspace-smoke.ts",check:"bun run typecheck && bun run test","test:compile-smoke":"bun test/compile-smoke.ts","test:runtime-ca-compile":"bun test/runtime-ca-compile-smoke.ts","test:operations-smoke":"bun test/operations-smoke.ts","test:apply-smoke":"bun test/apply-smoke.ts","bench:performance":"bun test/performance-benchmark.ts","test:runtime-smoke":"bun test/runtime-smoke.ts","test:ko-smoke":"bun test/ko-smoke.ts","bench:builders":"bun test/buildkit-benchmark.ts","test:local-resolve":"bun test/local-resolve-smoke.ts","test:prepared-deps":"bun test/buildkit-deps-smoke.ts","test:zstd-smoke":"bun test/zstd-smoke.ts","test:metadata":"bun test/metadata-smoke.ts","test:cache-distribution":"bun test/cache-distribution-smoke.ts","test:signing-smoke":"bun test/signing-smoke.ts","test:prune-smoke":"bun test/prune-smoke.ts","test:multiple-entrypoints":"bun test/multiple-entrypoints-smoke.ts","test:asset-contexts":"bun test/asset-contexts-smoke.ts","test:application-validation":"bun scripts/validation/run-fixture.ts","test:runtime-injection":"bun scripts/validation/runtime-smoke.ts","test:telemetry":"bun scripts/validation/telemetry-smoke.ts","test:fonts":"bun scripts/validation/fonts-smoke.ts"},devDependencies:{"@types/bun":"1.3.11","@types/tar-stream":"3.1.4","@types/yauzl":"3.4.0",ignore:"7.0.9","tar-stream":"3.2.1",typescript:"5.9.3",yaml:"2.9.0",yauzl:"3.4.0"}};var vv=new gLw,D00=(X)=>Object.entries(X).map(([H,O])=>({key:H,value:{stringValue:O}})),XW0=(X)=>yLw(X).toString("hex"),J00=[0.01,0.05,0.1,0.5,1,5,10,30,60,300];function dv0(X,H=process.env){if(!X||H.OTEL_SDK_DISABLED?.toLowerCase()==="true")return;H=Object.fromEntries(Object.entries(H).filter(([,_0])=>_0!==""));let O={};try{for(let _0 of(H.OTEL_EXPORTER_OTLP_HEADERS??"").split(",").filter(Boolean)){let X0=_0.indexOf("=");if(X0<1)throw Error();let I0=_0.slice(0,X0).trim().toLowerCase(),z0=decodeURIComponent(_0.slice(X0+1).trim());if(!/^[!#$%&'*+.^_`|~0-9a-z-]+$/.test(I0)||/[\r\n]/.test(z0)||["host","content-type","content-length","connection","transfer-encoding"].includes(I0))throw Error();O[I0]=z0}new Headers(O)}catch{throw Error("Invalid OTEL_EXPORTER_OTLP_HEADERS")}let E=Number(H.OTEL_EXPORTER_OTLP_TIMEOUT??"2000");if(!Number.isInteger(E)||E<1||E>1e4)throw Error("OTEL_EXPORTER_OTLP_TIMEOUT must be 1\u201310000 milliseconds");let C=(_0)=>{let X0=H[`OTEL_${_0}_EXPORTER`]??"otlp";if(X0==="none")return;if(X0!=="otlp")throw Error(`OTEL_${_0}_EXPORTER must be otlp or none`);if((H[`OTEL_EXPORTER_OTLP_${_0}_PROTOCOL`]??H.OTEL_EXPORTER_OTLP_PROTOCOL??"http/json")!=="http/json")throw Error("Bunko telemetry supports only OTLP http/json");let I0;try{let z0=H[`OTEL_EXPORTER_OTLP_${_0}_ENDPOINT`];if(I0=new URL(z0??H.OTEL_EXPORTER_OTLP_ENDPOINT??"http://127.0.0.1:4318"),!["https:","http:"].includes(I0.protocol)||I0.username||I0.password||I0.search||I0.hash)throw Error();if(!z0)I0.pathname=`${I0.pathname.replace(/\/$/,"")}/v1/${_0.toLowerCase()}`}catch{throw Error(`Invalid OTLP ${_0.toLowerCase()} endpoint`)}if(I0.protocol==="http:"&&Object.keys(O).length)throw Error("OTLP exporter headers require HTTPS endpoints");return I0},k=C("TRACES"),d=C("METRICS");return k||d?{traces:k,metrics:d,headers:O,timeout:E}:void 0}class WW0{config;warn;traceId=XW0(16);root=XW0(8);wall=BigInt(Date.now())*1000000n;start=performance.now();spans=[];series=new Map;groups=new Map;targets=new Map;dropped=0;ended=!1;running=!1;timestamp(){return(this.wall+BigInt(Math.round((performance.now()-this.start)*1e6))).toString()}constructor(X,H=()=>{}){this.config=X;this.warn=H}span(X,H,O={}){let E=this.timestamp();return{traceId:this.traceId,spanId:XW0(8),parentSpanId:H,name:X,kind:1,startTimeUnixNano:E,endTimeUnixNano:E,attributes:D00(O),status:{code:0}}}group(X,H,O,E){let C=this.groups.get(X);if(!C){if(this.groups.size>=256)return this.dropped++,O;C=this.span(H,O,E),this.groups.set(X,C)}return C.spanId}async phase(X,H,O,E){let C=vv.getStore();O??=C.target,E??=C.platform;let k=C.parent;if(O!==C.target||E!==C.platform){if(k=this.root,O){if(!this.targets.has(O)&&this.targets.size<128)this.targets.set(O,String(this.targets.size));let p0=this.targets.get(O)??"overflow";if(k=this.group(`target:${p0}`,"bunko.target",k,{"bunko.target.index":p0}),E)k=this.group(`target:${p0}:${E}`,"bunko.platform",k,{"bunko.platform":E})}}let d={"bunko.phase":X,...E?{"bunko.platform":E}:{}},_0=this.span(`bunko.${X}`,k,d),X0=performance.now(),I0=this.spans.length<4096;if(I0)this.spans.push(_0);else this.dropped++;let z0="success";try{return await vv.run({session:this,parent:I0?_0.spanId:k,target:O,platform:E},H)}catch(p0){throw z0="failure",_0.status.code=2,p0}finally{_0.endTimeUnixNano=this.timestamp();let p0=O?this.targets.get(O)??"overflow":void 0;for(let o of p0===void 0?[]:[`target:${p0}`,`target:${p0}:${E}`]){let Tw=this.groups.get(o);if(Tw)Tw.endTimeUnixNano=_0.endTimeUnixNano}this.record("bunko.phase.duration","s",(performance.now()-X0)/1000,{...d,"bunko.result":z0},!0)}}record(X,H,O,E,C=!1){if(!Number.isFinite(O)||O<0)return;let k=JSON.stringify([X,Object.entries(E).sort()]),d=this.series.get(k);if(!d){if(this.series.size>=512){this.dropped++;return}d={name:X,unit:H,attributes:E,sum:0,count:0,buckets:C?Array(J00.length+1).fill(0):void 0},this.series.set(k,d)}if(d.sum+=O,d.count++,d.buckets){let _0=J00.findIndex((X0)=>O<=X0);d.buckets[_0<0?J00.length:_0]++}}async run(X,H,O=()=>!1){if(this.running)throw Error("Telemetry invocation may only run once");this.running=!0;let E="success";try{let C=await vv.run({session:this,parent:this.root},H);if(O(C))E="failure";return C}catch(C){throw E="failure",C}finally{let C=this.timestamp();for(let k of this.groups.values())this.spans.push(k);this.spans.push({...this.span("bunko.build"),spanId:this.root,startTimeUnixNano:this.wall.toString(),endTimeUnixNano:C,attributes:D00({"bunko.command":X}),status:{code:E==="failure"?2:1}}),this.record("bunko.build.count","{build}",1,{"bunko.command":X,"bunko.result":E}),this.record("bunko.build.duration","s",(performance.now()-this.start)/1000,{"bunko.command":X,"bunko.result":E},!0),await this.flush()}}async flush(){if(this.ended)return;this.ended=!0;let X={attributes:D00({"service.name":"bunko","service.version":pE.version})},H={name:"bunko",version:pE.version},O=this.timestamp(),E=new Map;for(let X0 of this.series.values()){let I0=E.get(X0.name),z0=X0.buckets?"histogram":"sum";if(!I0)I0={name:X0.name,unit:X0.unit,[z0]:{aggregationTemporality:1,...X0.buckets?{}:{isMonotonic:!0},dataPoints:[]}},E.set(X0.name,I0);I0[z0].dataPoints.push({attributes:D00(X0.attributes),startTimeUnixNano:this.wall.toString(),timeUnixNano:O,...X0.buckets?{count:String(X0.count),sum:X0.sum,explicitBounds:J00,bucketCounts:X0.buckets.map(String)}:{asDouble:X0.sum}})}let C=[[this.config.traces,{resourceSpans:[{resource:X,scopeSpans:[{scope:H,spans:this.spans}]}]}],[this.config.metrics,{resourceMetrics:[{resource:X,scopeMetrics:[{scope:H,metrics:[...E.values()]}]}]}]],k=new AbortController,d=setTimeout(()=>k.abort(),this.config.timeout),_0=this.dropped>0;try{await Promise.all(C.map(async([X0,I0])=>{if(!X0)return;try{let z0=JSON.stringify(I0),o=await(async()=>{for(let Zw=0;;Zw++){let w2;try{w2=await fetch(X0,{method:"POST",headers:{...this.config.headers,"content-type":"application/json"},body:z0,redirect:"manual",signal:k.signal})}catch{if(Zw||k.signal.aborted)throw Error()}if(w2&&![429,502,503,504].includes(w2.status))return w2;let iw=w2?.headers.get("retry-after"),aw=100;if(iw){let E1=/^\d+$/.test(iw)?Number(iw)*1000:Date.parse(iw)-Date.now();if(Number.isFinite(E1))aw=Math.max(aw,E1)}if(w2)await w2.body?.cancel();if(Zw||aw>=this.config.timeout)throw Error();await xLw(aw,void 0,{signal:k.signal})}})();if(o.status!==200||!o.body)throw await o.body?.cancel(),Error();let Tw=o.body.getReader(),j0=0,C0=[];try{while(!0){let{done:Zw,value:w2}=await Tw.read();if(Zw)break;if(j0+=w2.length,j0>65536)throw Error();C0.push(w2)}}finally{await Tw.cancel()}let Xw=JSON.parse(Buffer.concat(C0).toString());if(!Xw||typeof Xw!=="object"||Array.isArray(Xw))throw Error();if(Xw.partialSuccess!==void 0){let Zw=Xw.partialSuccess;if(!Zw||typeof Zw!=="object"||Array.isArray(Zw))throw Error();let w2=Zw.rejectedSpans??Zw.rejectedDataPoints??0;if(!/^[0-9]+$/.test(String(w2))||!Number.isSafeInteger(Number(w2))||Zw.errorMessage!==void 0&&typeof Zw.errorMessage!=="string")throw Error();if(Number(w2)>0||Zw.errorMessage)_0=!0}}catch{_0=!0}}))}catch{_0=!0}finally{if(k.abort(),clearTimeout(d),_0)try{this.warn()}catch{}}}}function cv0(X,H,O,E){let C=vv.getStore();return C?C.session.phase(X,H,O,E):H()}function mv(X,H,O,E){vv.getStore()?.session.record(X,H,O,E)}var y5=_00(W00(),1),pv0="Bundling may relocate this module-relative path. Use an explicit runtime asset root and verify file reads in the image.",hLw=new Set(["dir","dirname","path","filename","url"]),kLw=new Set(["__dirname","__filename"]),fLw=100;function Q00(X){let H=X;if(!H||!Number.isSafeInteger(H.total)||H.total<0||!Array.isArray(H.warnings)||H.warnings.length!==Math.min(H.total,fLw))throw Error("Invalid module-location diagnostics");let O=new Set;for(let E of H.warnings){if(!E||E.code!=="BUNKO_MODULE_LOCATION"||typeof E.file!=="string"||!E.file||E.file.length>4096||/[\x00-\x1f\\]/.test(E.file)||E.file.startsWith("/")||E.file.split("/").some((k)=>k===".."||k==="."||!k)||!Number.isSafeInteger(E.line)||E.line<1||!Number.isSafeInteger(E.column)||E.column<1||![...kLw,...[...hLw].map((k)=>`import.meta.${k}`)].includes(E.expression))throw Error("Invalid module-location warning");let C=`${E.file}\x00${E.expression}`;if(O.has(C))throw Error("Duplicate module-location warning");O.add(C)}return H}import{mkdir as kqw,rename as fqw,rm as uqw,writeFile as vqw}from"fs/promises";import{randomUUID as mqw}from"crypto";import{join as lv}from"path";import{createHash as uLw}from"crypto";import{createReadStream as vLw,createWriteStream as mLw}from"fs";import{Transform as dLw,Writable as cLw}from"stream";import{pipeline as QW0}from"stream/promises";import{createGunzip as lLw,createZstdDecompress as pLw,constants as iLw}from"zlib";async function tq(X,H,O,E,C=2147483648){await X.ensure(H);let k=uLw("sha256"),d=0,_0=new dLw({transform(z0,p0,o){if(d+=z0.length,d>C){o(Error("Decoded layer exceeds size limit"));return}k.update(z0),o(null,z0)}}),X0=vLw(X.path(H.digest)),I0=E?mLw(E,{flags:"wx"}):new cLw({write(z0,p0,o){o()}});if(H.mediaType===l4.gzip||H.mediaType===l4.dockerGzip)await QW0(X0,lLw(),_0,I0);else if(H.mediaType===l4.zstd)await QW0(X0,pLw({params:{[iLw.ZSTD_d_windowLogMax]:27}}),_0,I0);else if(H.mediaType===l4.tar)await QW0(X0,_0,I0);else throw Error(`Cannot decode layer media type: ${H.mediaType}`);if(`sha256:${k.digest("hex")}`!==O)throw Error(`Layer DiffID mismatch: ${H.digest}`)}function VH(X){if(X.includes("@")||X.lastIndexOf(":")>X.lastIndexOf("/"))throw Error("Repository must not include a tag or digest");return Oj(X)}function qb(X){return`${X.registry==="registry-1.docker.io"?"docker.io":X.registry}/${X.repository}`}class OH extends Error{result;constructor(X,H,O){super(X,{cause:O});this.result=H}}class UI{ref;client;scope;acknowledgedSubjects=new Map;acceptsSubject(X,H){return this.acknowledgedSubjects.get(X.digest)===H.digest}constructor(X,H={}){this.ref=VH(X),this.client=xv(this.ref.registry,H),this.scope=`repository:${this.ref.repository}:pull,push`}async exists(X){let H=await this.client.request(`/v2/${this.ref.repository}/blobs/${X.digest}`,{method:"HEAD"},[this.scope],[404]);if(await H.body?.cancel(),H.status===404)return!1;let O=H.headers.get("Docker-Content-Digest"),E=H.headers.get("Content-Length");if(O&&O!==X.digest||E&&Number(E)!==X.size)throw Error("Registry blob HEAD digest/size mismatch");return!0}async confirmBlob(X){for(let H=0;;H++){if(await this.exists(X))return!0;if(H>=3)return!1;await this.client.backoff(H)}}async blob(X,H,O="base",E=!1){let C={digest:H.digest,kind:O,size:H.size,uploaded:0,action:"reused"};if(await this.exists(H))return C;if(E)return{...C,action:"would-upload",uploaded:H.size};let k=X.origins.get(H.digest),d,_0=new URL(this.client.origin).hostname,X0=_0==="ghcr.io"||/^(?:(?:us|eu|asia)\.)?gcr\.io$/.test(_0)||/^[a-z0-9-]+-docker\.pkg\.dev$/.test(_0),I0=X0,z0=8388608,p0=(Tw)=>{let j0=Tw.headers.get("OCI-Chunk-Min-Length"),C0=j0===null?0:/^\d+$/.test(j0)?Number(j0):NaN;I0=X0||!Number.isSafeInteger(C0)||C0>33554432,z0=I0?8388608:Math.max(8388608,C0)};if(k?.registry===this.ref.registry&&k.repository!==this.ref.repository){let Tw=new URL(`/v2/${this.ref.repository}/blobs/uploads/`,this.client.origin);Tw.searchParams.set("mount",H.digest),Tw.searchParams.set("from",k.repository);let j0;try{j0=await this.client.request(Tw,{method:"POST"},[this.scope,`repository:${k.repository}:pull`],[400,403,404,405])}catch(C0){if(!Z00(C0))throw C0;if(await this.exists(H))return C}if(j0){if(await j0.body?.cancel(),j0.status===201){if(!await this.confirmBlob(H))throw Error("Mounted registry blob is missing");return{...C,action:"mounted"}}if(j0.status===202)d=this.location(j0,Tw.toString()),p0(j0)}}if(!d)d=await this.startUpload(p0);let o=!1;try{await X.ensure(H);let Tw=Bun.file(X.path(H.digest));if(Tw.size!==H.size)throw Error("Upload blob size mismatch");let j0=0,C0=0,Xw=0;while(!I0&&j0<H.size){let Zw=Math.min(j0+z0,H.size);try{let w2=Buffer.from(await Tw.slice(j0,Zw).arrayBuffer());if(w2.length!==Zw-j0)throw Error("Upload source changed while reading chunk");let iw=await this.client.request(d,{method:"PATCH",headers:{"Content-Type":"application/octet-stream","Content-Length":String(Zw-j0),"Content-Range":`${j0}-${Zw-1}`},body:w2},[this.scope]);if(await iw.body?.cancel(),iw.status!==202)throw Error("Registry did not accept upload chunk");d=this.location(iw,d),j0=Zw,C0=0}catch(w2){if(!Z00(w2)&&!(w2 instanceof AU&&[404,410,416].includes(w2.status)))throw w2;if(++C0>3)throw Error(`${w2 instanceof Error?w2.message:"Upload failed"}; blob ${H.digest}, offset ${j0}/${H.size}`);await this.client.backoff(C0-1);let iw=await this.client.request(d,{},[this.scope],[404,410]);if(await iw.body?.cancel(),iw.status===404||iw.status===410){if(++Xw>3)throw Error("Registry repeatedly expired the upload session");d=await this.startUpload(p0),j0=0;continue}let aw=/^(?:bytes=)?0-(\d+)$/.exec(iw.headers.get("Range")??"");if(!aw)throw Error("Registry upload status has no valid Range");if(j0===0&&aw[1]==="0"){await this.cancelUpload(d),d=await this.startUpload(p0);continue}let E1=Number(aw[1])+1;if(!Number.isSafeInteger(E1)||E1<j0||E1>Zw)throw Error("Registry upload offset is inconsistent");if(j0=E1,iw.headers.has("Location"))d=this.location(iw,d)}}for(let Zw=0;;Zw++){let w2=new URL(d);w2.searchParams.set("digest",H.digest);try{let iw=await this.client.request(w2,{method:"PUT",headers:{"Content-Length":String(I0?H.size:0),"Content-Type":"application/octet-stream"},body:I0?Tw:void 0},[this.scope]);if(await iw.body?.cancel(),!iw.ok)throw Error("Registry did not finalize upload");let aw=iw.headers.get("Docker-Content-Digest");if(aw&&aw!==H.digest)throw Error("Registry upload digest mismatch");break}catch(iw){if(I0&&!Z00(iw))throw iw;if(await this.exists(H))break;if(Zw>=2)throw iw;if(I0)await this.cancelUpload(d),d=await this.startUpload(p0),I0=!0}}if(!await this.confirmBlob(H))throw Error("Uploaded registry blob is missing");return o=!0,{...C,action:"uploaded",uploaded:H.size}}finally{if(!o)await this.cancelUpload(d)}}async startUpload(X){let H=`/v2/${this.ref.repository}/blobs/uploads/`;for(let O=0;;O++)try{let E=await this.client.request(H,{method:"POST"},[this.scope]);if(await E.body?.cancel(),E.status!==202)throw Error("Registry did not create an upload session");let C=this.location(E,new URL(H,this.client.origin).toString());return X(E),C}catch(E){if(O>=2||!Z00(E)||E instanceof AU&&E.status===404)throw E;await this.client.backoff(O)}}async cancelUpload(X){try{await(await this.client.request(X,{method:"DELETE"},[this.scope],[404,405])).body?.cancel()}catch{}}location(X,H){let O=X.headers.get("Location");if(!O)throw Error("Registry upload response has no Location");return new URL(O,H).toString()}async manifest(X,H,O=H.digest){let E=await X.read(H);this.acknowledgedSubjects.delete(H.digest);let C=`/v2/${this.ref.repository}/manifests/${O}`,k;for(let X0=0;;X0++)try{k=await this.client.request(C,{method:"PUT",headers:{"Content-Type":H.mediaType},body:Buffer.from(E)},[this.scope]);break}catch(I0){if(!(I0 instanceof AU?I0.status===429||I0.status>=500:I0 instanceof Error&&I0.message.includes("connection failed")))throw I0;let p0=await this.client.request(C,{},[this.scope],[404]);if(p0.ok){if(c9(await zU(p0))===H.digest)return}else await p0.body?.cancel();if(X0>=2)throw I0}if(await k.body?.cancel(),!k.ok)throw Error("Registry did not accept manifest");let d=k.headers.get("Docker-Content-Digest");if(d&&d!==H.digest)throw Error("Published manifest digest mismatch");let _0=k.headers.get("OCI-Subject");if(_0){let X0=f1(JSON.parse(Buffer.from(E).toString()),"Published manifest").subject;if(!X0||_0!==e5(X0).digest)throw Error("Registry OCI-Subject acknowledgement mismatch")}for(let X0=0;;X0++){let I0=await this.client.request(`/v2/${this.ref.repository}/manifests/${O}`,{},[this.scope],[404]);if(I0.status===404)await I0.body?.cancel();else if(c9(await zU(I0))===H.digest){if(_0)this.acknowledgedSubjects.set(H.digest,_0);return}if(X0>=3)throw Error("Registry did not return the published manifest bytes after bounded verification retries");await this.client.backoff(X0)}}async resolveTag(X){let H=await this.client.request(`/v2/${this.ref.repository}/manifests/${X}`,{},[this.scope],[404]);if(H.status===404){await H.body?.cancel();return}let O=c9(await zU(H)),E=H.headers.get("Docker-Content-Digest");if(E&&E!==O)throw Error("Registry tag digest header mismatch");return O}async publish(X,H,O,E=new Map,C=!1,k="fail"){if(!["fail","skip"].includes(k))throw Error("Tag conflict policy must be fail or skip");for(let I0 of O)if(!/^[\w][\w.-]{0,127}$/.test(I0))throw Error(`Invalid image tag: ${I0}`);let d={reference:`${qb(this.ref)}@${H.digest}`,published:!1,tags:[],pendingTags:[...O],transfers:[]},_0=new Set,X0=async(I0)=>{if(_0.has(I0.digest))return;if(_0.add(I0.digest),I0.mediaType===l4.index){let z0=f1(JSON.parse(Buffer.from(await X.read(I0)).toString()),"Image index");if(!Array.isArray(z0.manifests))throw Error("Invalid image index");for(let p0 of z0.manifests)await X0(e5(p0))}else if(I0.mediaType===l4.manifest){let z0=f1(JSON.parse(Buffer.from(await X.read(I0)).toString()),"Image manifest");if(!Array.isArray(z0.layers))throw Error("Invalid image layers");for(let p0 of[...z0.layers,z0.config]){let o=e5(p0);if(_0.has(o.digest))continue;_0.add(o.digest),d.transfers.push(await this.blob(X,o,E.get(o.digest)??(o.mediaType===l4.config?"config":"base"),C))}}else throw Error("Publication root must be an OCI manifest or index");if(!C)await this.manifest(X,I0)};try{if(await X0(H),C)return d;d.published=!0;for(let I0 of O){if(k==="skip"&&await this.resolveTag(I0)===H.digest)(d.existingTags??=[]).push(I0);else try{await this.manifest(X,H,I0)}catch(z0){if(k!=="skip"||!(z0 instanceof AU)||!z0.immutableTag)throw z0;let p0=await this.resolveTag(I0);if(!p0)throw z0;if(p0!==H.digest){(d.skippedTags??=[]).push({tag:I0,digest:p0,status:z0.status}),d.pendingTags.shift();continue}(d.existingTags??=[]).push(I0)}d.tags.push(I0),d.pendingTags.shift()}return d}catch(I0){throw new OH(I0 instanceof Error?I0.message:"Image publication failed",d,I0)}}}function Z00(X){return X instanceof AU?[404,408,429].includes(X.status)||X.status>=500:X instanceof Error&&X.message.includes("connection failed")}var Dm0=_00(Gm0(),1);import{createReadStream as Oqw}from"fs";import{lstat as Um0}from"fs/promises";import{dirname as Pqw,join as bm0,relative as Aqw}from"path";function O00(X){let H=new Map,O=new Map,E=0;function C(d){if(!H.has(d))H.set(d,(async()=>{if(d){let z0=await Um0(bm0(X,d));if(!z0.isDirectory()||z0.isSymbolicLink())throw Error("Source ignore scope must be a regular directory")}let _0=bm0(X,d,".gitignore"),X0;try{X0=await Um0(_0)}catch(z0){if(z0.code==="ENOENT")return;throw z0}if(!X0.isFile()||X0.isSymbolicLink()||X0.size>262144)throw Error("Source .gitignore must be a regular file of at most 256 KiB");let I0=await Bun.file(_0).slice(0,262145).text();if(E+=Buffer.byteLength(I0),Buffer.byteLength(I0)>262144||E>4194304)throw Error("Source .gitignore rules exceed the size limit");return Dm0.default({ignorecase:!1}).add(I0)})());return H.get(d)}function k(d,_0=!1){if(!d||d===".")return Promise.resolve(!1);let X0=d+(_0?"/":"");if(!O.has(X0))O.set(X0,(async()=>{let I0=Pqw(d);if(I0!=="."&&await k(I0,!0))return!0;let z0=d.split("/"),p0=!1;for(let o=0;o<z0.length;o++){let Tw=z0.slice(0,o).join("/"),C0=(await C(Tw))?.test(Aqw(Tw||".",d)+(_0?"/":""));if(C0?.ignored)p0=!0;else if(C0?.unignored)p0=!1}return p0})());return O.get(X0)}return k}async function Jm0(X,H){let O="";for await(let E of Oqw(X,{highWaterMark:65536})){let C=O+Buffer.from(E).toString("latin1");if(/-----BEGIN [A-Z0-9 ]{0,64}PRIVATE KEY-----/.test(C))throw Error(`Private-key marker in source input: ${H}; remove the credential or exclude the file`);O=C.slice(-128)}}import{lstat as Wm0,readFile as Qm0,readdir as zqw}from"fs/promises";import{dirname as Kqw,join as ID,relative as Xm0,resolve as Eqw}from"path";var nE=new Set([".git",".cursor","node_modules",".bunko-output",".bunko-build",".npmrc",".bunko-cache",".docker",".aws",".config",".yarnrc.yml",".DS_Store",".ssh",".kube",".gnupg",".netrc",".terraform","id_rsa","id_dsa","id_ecdsa","id_ed25519","terraform.tfstate","terraform.tfstate.backup"]);async function Zm0(X,H,O=[],E=[]){let C=await sE(X),k=H.some((p0)=>p0.mode==="source")?O00(X):void 0,d=(p0)=>p0.split("/").some((o,Tw,j0)=>C(j0.slice(0,Tw+1).join("/"))),_0=(p0)=>p0.split("/").some((o)=>nE.has(o)||o.startsWith(".env"))||[...O,...E].some((o)=>ID(X,p0)===o||ID(X,p0).startsWith(`${o}/`)),X0=new Set(["package.json","bun.lock","tsconfig.json","jsconfig.json"]);for(let p0 of H){for(let j0 of Object.values(p0.entrypoints??{default:p0.entrypoint}))X0.add(ID(p0.targetPath,j0));for(let j0 of["tsconfig.json","jsconfig.json"])X0.add(ID(p0.targetPath,j0));for(let j0 of p0.workspace?.packages??[])X0.add(ID(j0.path,"package.json"));let o=hv(p0.assetExcludes);async function Tw(j0){if(o(Xm0(p0.targetPath||".",j0))){if(p0.mode==="source"&&[...X0].some((Xw)=>Xw===j0||Xw.startsWith(`${j0}/`)))throw Error(`Asset exclusion overlaps a required source input: ${j0}`);E.push(ID(X,j0));return}X0.add(j0);let C0=await Wm0(ID(X,j0));if(C0.isSymbolicLink())throw Error(`Source symlinks are not supported: ${j0}`);if(C0.isDirectory())for(let Xw of await zqw(ID(X,j0)))await Tw(ID(j0,Xw));else if(!C0.isFile())throw Error(`Unsupported asset file type: ${j0}`)}for(let j0 of p0.assets){let C0=!1;for await(let Xw of new Bun.Glob(j0).scan({cwd:ID(X,p0.targetPath),dot:!0,onlyFiles:!1,followSymlinks:!1}))C0=!0,await Tw(ID(p0.targetPath,Xw));if(!C0)throw Error(`Asset pattern matched no files: ${j0}`)}for(let j0 of p0.workspace?.packages??[{manifest:JSON.parse(p0.manifestText)}])for(let C0 of Object.values(j0.manifest.patchedDependencies??{}))if(typeof C0==="string")X0.add(C0)}let I0=new Set;async function z0(p0){if(I0.has(p0))return;if(I0.add(p0),d(p0)||await k?.(p0))throw Error(`Ignored required input: ${p0}`);X0.add(p0);let o=f1(Bun.JSONC.parse(await Qm0(ID(X,p0),"utf8")),"tsconfig");for(let Tw of o.extends===void 0?[]:Array.isArray(o.extends)?o.extends:[o.extends]){if(typeof Tw!=="string"||!Tw.startsWith("."))continue;let j0=Eqw(X,Kqw(p0),Tw.endsWith(".json")?Tw:Tw+".json"),C0=Xm0(X,j0);if(C0===".."||C0.startsWith("../"))throw Error("tsconfig extends must stay inside the project snapshot");await z0(C0)}}for await(let p0 of new Bun.Glob("**/{tsconfig,jsconfig}.json").scan({cwd:X,dot:!0,followSymlinks:!1}))if(!_0(p0)&&!d(p0)&&!await k?.(p0))await z0(p0);if(H.some((p0)=>p0.mode==="source")){for(let p0 of X0)if(E.some((o)=>ID(X,p0)===o||ID(X,p0).startsWith(`${o}/`)))throw Error(`Asset exclusion overlaps a required source input: ${p0}`)}return[...X0]}async function sE(X){let H;try{let E=ID(X,".bunkoignore");if(!(await Wm0(E)).isFile())throw Error(".bunkoignore must be a regular file");H=await Qm0(E,"utf8")}catch(E){if(E.code==="ENOENT")return()=>!1;throw E}let O=H.split(/\r?\n/).map((E)=>E.trim()).filter((E)=>E&&!E.startsWith("#")).map((E)=>{let C=E.replace(/^(?:\.\/)+/,"").replace(/\/$/,"");if(!C||C.startsWith("/")||C.startsWith("!")||/[\\\x00-\x1f]/.test(C)||C.split("/").includes(".."))throw Error("Invalid .bunkoignore pattern");return new Bun.Glob(C)});return(E)=>E!==".bunkoignore"&&O.some((C)=>C.match(E))}import{createHash as Rqw}from"crypto";import{chmod as Nqw,copyFile as Fqw,lstat as LW0,mkdir as Cqw,readdir as Ym0,readFile as uyw,open as Sqw}from"fs/promises";import{join as Rj,posix as Im0,relative as jqw,resolve as Hm0}from"path";var x3=_00(W00(),1);/*! TypeScript 5.9.3 — Copyright Microsoft Corporation.
590
590
  Apache License
591
591
 
592
592
  Version 2.0, January 2004
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sakajunquality/bunko",
3
- "version": "0.1.0-rc.5",
3
+ "version": "0.1.0",
4
4
  "description": "Build OCI images from Bun applications without Dockerfiles",
5
5
  "license": "MIT",
6
6
  "type": "module",
@@ -35,6 +35,6 @@
35
35
  "publishConfig": {
36
36
  "access": "public",
37
37
  "registry": "https://registry.npmjs.org/",
38
- "tag": "next"
38
+ "tag": "latest"
39
39
  }
40
40
  }