@ttsc/playground 0.20.1 → 0.22.0

package/README.md

@@ -137,6 +137,8 @@ import {
 
 const names = collectExternalPackageNames(userSource);
 const installed = await installPlaygroundDependencies(names, {
+  maxTarballBytes: 16 * 1024 * 1024,
+  maxUnpackedBytes: 64 * 1024 * 1024,
   onProgress: (p) => console.log(p.phase, p.packageName),
 });
 // mount installed.compilerFiles into the wasm MemFS via service.installDependencies
@@ -148,6 +150,12 @@ When a direct source import is removed, solve the complete current root list wit
 
 `PlaygroundShell` wires this automatically on every keystroke, debounced 900 ms, with an abort signal on source change.
 
+The installer verifies the strongest supported `dist.integrity` digest before decompression, or `dist.shasum` when integrity is absent. Historical and private registry metadata with neither field remains compatible but unauthenticated. Each tarball is streamed through independent compressed and expanded byte limits (16 MiB and 64 MiB by default), and every file must remain below one safe, consistent archive root (`package/` normally; DefinitelyTyped uses roots such as `node/`). Override the limits with `maxTarballBytes` and `maxUnpackedBytes` when a known package requires more.
+
+Integrity proves that archive bytes match registry metadata; it does not establish that package code is safe. `createSandboxRequire` is a CommonJS resolver and evaluator, not an origin, process, or capability sandbox. The byte limits protect installation availability, not runtime behavior such as loops, timers, network access, or globals exposed by the host. Sites accepting untrusted code or packages must provide an isolated `executeBundle` policy appropriate to their environment.
+
+The Execute lane's CommonJS resolver treats `package.json#exports` as the package boundary. It selects `require` and `default` conditions in manifest order, preserves Node's distinction between target selection and file loading, validates relative targets after wildcard substitution, and rejects mixed or numeric condition maps. A package mounted through an npm alias may still self-reference its real manifest `name` when it declares exports; packages without exports keep legacy direct-path resolution and do not gain self-reference behavior.
+
 ## Tailwind setup
 
 The bundled React components use Tailwind 4 utility classes. The host site must load Tailwind for them to render correctly.

package/lib/src/npm/installPlaygroundDependencies.js

@@ -4,6 +4,8 @@ exports.installPlaygroundDependencies = installPlaygroundDependencies;
 const BUILT_IN_PLAYGROUND_PACKAGES_1 = require("./BUILT_IN_PLAYGROUND_PACKAGES");
 const npmRegistry_1 = require("./internal/npmRegistry");
 const DEFAULT_MAX_PACKAGES = 48;
+const DEFAULT_MAX_TARBALL_BYTES = 16 * 1024 * 1024;
+const DEFAULT_MAX_UNPACKED_BYTES = 64 * 1024 * 1024;
 /**
  * Resolve, download, and unpack a set of npm packages directly inside the
  * browser, returning their files keyed for the wasm-side MemFS, Monaco's
@@ -42,6 +44,10 @@ async function installPlaygroundDependencies(packageNames, options = {}) {
         });
     }
     const maxPackages = options.maxPackages ?? DEFAULT_MAX_PACKAGES;
+    const maxTarballBytes = options.maxTarballBytes ?? DEFAULT_MAX_TARBALL_BYTES;
+    const maxUnpackedBytes = options.maxUnpackedBytes ?? DEFAULT_MAX_UNPACKED_BYTES;
+    (0, npmRegistry_1.validateNpmByteLimit)(maxTarballBytes, "compressed");
+    (0, npmRegistry_1.validateNpmByteLimit)(maxUnpackedBytes, "expanded");
     const queue = [];
     const queued = new Map();
     const done = new Map();
@@ -145,7 +151,14 @@ async function installPlaygroundDependencies(packageNames, options = {}) {
             continue;
         (0, npmRegistry_1.throwIfAborted)(options.signal);
         report("resolve", item, `Resolving ${item.name}`);
-        const metadata = await (0, npmRegistry_1.fetchNpmMetadata)(fetchImpl, item.registryName ?? item.name, item.optional, options.signal);
+        let metadata;
+        try {
+            metadata = await (0, npmRegistry_1.fetchNpmMetadata)(fetchImpl, item.registryName ?? item.name, item.optional, options.signal);
+        }
+        catch (error) {
+            (0, npmRegistry_1.throwIfAborted)(options.signal);
+            throw error;
+        }
         (0, npmRegistry_1.throwIfAborted)(options.signal);
         if (!metadata) {
             const mounted = installedDependencies.get(item.name);
@@ -187,18 +200,25 @@ async function installPlaygroundDependencies(packageNames, options = {}) {
         const versionMetadata = metadata.versions[version];
         const tarball = versionMetadata?.dist?.tarball;
         if (!versionMetadata || !tarball) {
-            if (item.optional) {
-                done.set(item.name, "");
-                report("skip", item, `Skipped optional ${item.name}`);
-                continue;
-            }
             throw new Error(`No tarball found for ${item.name}@${version}.`);
         }
-        report("download", item, `Downloading ${item.name}@${version}`, version);
-        const tgz = await (0, npmRegistry_1.downloadTarball)(fetchImpl, tarball, options.signal);
-        (0, npmRegistry_1.throwIfAborted)(options.signal);
-        report("extract", item, `Extracting ${item.name}@${version}`, version);
-        const unpacked = await (0, npmRegistry_1.unpackNpmTarball)(tgz, options.signal);
+        let unpacked;
+        try {
+            report("download", item, `Downloading ${item.name}@${version}`, version);
+            const tgz = await (0, npmRegistry_1.downloadTarball)(fetchImpl, tarball, options.signal, maxTarballBytes);
+            (0, npmRegistry_1.throwIfAborted)(options.signal);
+            await (0, npmRegistry_1.verifyTarball)(tgz, versionMetadata.dist ?? {}, options.signal);
+            (0, npmRegistry_1.throwIfAborted)(options.signal);
+            report("extract", item, `Extracting ${item.name}@${version}`, version);
+            unpacked = await (0, npmRegistry_1.unpackNpmTarball)(tgz, options.signal, maxUnpackedBytes);
+        }
+        catch (error) {
+            (0, npmRegistry_1.throwIfAborted)(options.signal);
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`Failed to install ${item.name}@${version}: ${message}`, {
+                cause: error,
+            });
+        }
         (0, npmRegistry_1.throwIfAborted)(options.signal);
         const packageJson = {
             ...versionMetadata,

package/lib/src/npm/installPlaygroundDependencies.js.map

@@ -1 +1 @@
-{"version":3,"file":"installPlaygroundDependencies.js","sourceRoot":"","sources":["../../../src/npm/installPlaygroundDependencies.ts"],"names":[],"mappings":";;;AAIA,iFAA8E;AAC9E,wDAYgC;AAEhC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;;;;;;;GAWG;AACI,KAAK,wCACV,YAA8B,EAC9B,OAAO,GAAwC,EAAE;IAEjD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,eAAe,IAAI,2DAA4B,CACxD,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IACJ,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5D,IACE,QAAQ,KAAK,SAAS;YACtB,CAAC,QAAQ,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY;gBAChD,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,sCAAsC,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,QAAQ,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,OAAO,GAAG,CAC5J,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACpB,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAC1D,CAAC;YACF,SAAS;QACX,CAAC;QACD,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;YACzC,GAAG,UAAU;YACb,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA+C,CAAC;IAC9E,MAAM,MAAM,GAAuC;QACjD,oBAAoB,EAAE,EAAE;QACxB,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE;QACd,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAQ,EAAE;QACzC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;gBACnD,IAAI,UAAU,CAAC,QAAQ;oBAAE,OAAO;gBAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,EAAE,CAAC;oBACpE,KAAK,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;oBAC7C,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;oBAC/B,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;oBACvC,KAAK,CAAC,QAAQ,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;oBAChD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;oBACvB,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBACvC,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;wBACrB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACpB,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,MAAM,wBAAwB,CAC5B,UAAU,CAAC,IAAI,EACf,KAAK,CAAC,YAAa,EACnB,UAAU,CACX,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,QAAQ,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAClE,uEAAuE;gBACvE,sEAAsE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,IAAI,CAAC;oBACH,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC3D,IAAI,OAAO;wBAAE,MAAM,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC1D,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACtD,sEAAsE;gBACtE,sEAAsE;gBACtE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;YAChE,IAAI,UAAU,CAAC,QAAQ;gBAAE,OAAO;YAChC,MAAM,wBAAwB,CAC5B,UAAU,CAAC,IAAI,EACf,OAAO,CAAC,YAAY,EACpB,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QACzE,UAAU,CAAC,QAAQ,GAAG;YACpB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,gBAAgB,CAAC,UAAU,CAAC;SAC7B,CAAC;QACF,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAC7C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAC9B,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CACb,KAAyC,EACzC,IAAuB,EACvB,OAAe,EACf,OAAgB,EACV,EAAE;QACR,OAAO,CAAC,UAAU,EAAE,CAAC;YACnB,KAAK;YACL,WAAW,EAAE,IAAI,EAAE,IAAI;YACvB,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,oCAAoC,WAAW,qDAAqD,CACrG,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE/B,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAA,8BAAgB,EACrC,SAAS,EACT,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,EAC9B,IAAI,CAAC,QAAQ,EACb,OAAO,CAAC,MAAM,CACf,CAAC;QACF,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,sEAAsE;gBACtE,qEAAqE;gBACrE,sEAAsE;gBACtE,iCAAiC;gBACjC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;gBACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,CACJ,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACzB,IAAI,EACJ,OAAO;gBACL,CAAC,CAAC,kBAAkB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE;gBAClD,CAAC,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE,EACnC,OAAO,EAAE,OAAO,CACjB,CAAC;YACF,SAAS;QACX,CAAC;QAED,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,mBAAmB,CAC3B,QAAQ,EACR,IAAI,EACJ,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,MAAM,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,CACJ,MAAM,EACN,IAAI,EACJ,kBAAkB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,EAChD,OAAO,CAAC,OAAO,CAChB,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,eAAe,EAAE,IAAI,EAAE,OAAO,CAAC;QAC/C,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtD,SAAS;YACX,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,IAAA,6BAAe,EAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACtE,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAA,8BAAgB,EAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,WAAW,GAAG;YAClB,GAAG,eAAe;YAClB,GAAG,QAAQ,CAAC,WAAW;SACxB,CAAC;QACF,MAAM,YAAY,GAAG,IAAA,+BAAiB,EAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAE9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,MAAM,CAClE,CAAC,GAAG,EAAE,EAAE,CAAC,qCAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAC3C,CAAC,MAAM,CAAC;QACT,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI;YAC5C,OAAO;YACP,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,MAAM;YACzD,gBAAgB;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAEnE,IAAA,wCAA0B,EAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC;gBACN,IAAI,EAAE,IAAA,gCAAkB,EAAC,IAAI,CAAC,IAAI,CAAC;gBACnC,KAAK,EAAE,GAAG;gBACV,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE;YACjB,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YACvC,OAAO;YACP,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACtE,GAAG,OAAO;aACX,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,oBAAoB,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACxE,GAAG,UAAU;QACb,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;KACjE,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAgB;IAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,GAAG,CACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,YAAY,EAAE,KAAK,CAAC,CAAC,CAAE;QACvB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAgB;IACxC,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA6C,EAC7C,IAAgB,EAChB,WAAW,GAAsB,EAAE;IAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAEnC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,QAAQ,GAAG,IAAA,2BAAa,EAAC,QAAQ,EAAE;gBACjC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC3C,GAAG,WAAW;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,2BAAa,EAAC,QAAQ,EAAE;gBACxC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;gBAC3D,OAAO,CAAC,KAAK;gBACb,GAAG,WAAW;aACf,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,mEAAmE;QACrE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,QAAoC;IAEpC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,QAAQ;SACzB,GAAG,CACF,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CACvB,GAAG,SAAS,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACnD;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,KAAK,CAAC,GAAG,OAAO,iBAAiB,WAAW,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAuC,EACvC,KAAc;IAEd,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,KAAK,CACd,WAAW,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,SAAS,OAAO,CAAC,YAAY,sDAAsD,OAAO,EAAE,CACvI,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAY,EACZ,YAAoB,EACpB,QAAoB;IAEpB,OAAO,IAAI,KAAK,CACd,uCAAuC,IAAI,4BAA4B,YAAY,SAAS,QAAQ,CAAC,SAAS,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,YAAY,GAAG,CAC3L,CAAC;AACJ,CAAC"}
+{"version":3,"file":"installPlaygroundDependencies.js","sourceRoot":"","sources":["../../../src/npm/installPlaygroundDependencies.ts"],"names":[],"mappings":";;;AAIA,iFAA8E;AAC9E,wDAcgC;AAEhC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpD;;;;;;;;;;;GAWG;AACI,KAAK,wCACV,YAA8B,EAC9B,OAAO,GAAwC,EAAE;IAEjD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,eAAe,IAAI,2DAA4B,CACxD,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IACJ,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5D,IACE,QAAQ,KAAK,SAAS;YACtB,CAAC,QAAQ,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY;gBAChD,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,sCAAsC,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,QAAQ,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,OAAO,GAAG,CAC5J,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACpB,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAC1D,CAAC;YACF,SAAS;QACX,CAAC;QACD,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;YACzC,GAAG,UAAU;YACb,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAC7E,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IACzD,IAAA,kCAAoB,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IACpD,IAAA,kCAAoB,EAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA+C,CAAC;IAC9E,MAAM,MAAM,GAAuC;QACjD,oBAAoB,EAAE,EAAE;QACxB,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE;QACd,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAQ,EAAE;QACzC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;gBACnD,IAAI,UAAU,CAAC,QAAQ;oBAAE,OAAO;gBAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,EAAE,CAAC;oBACpE,KAAK,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;oBAC7C,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;oBAC/B,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;oBACvC,KAAK,CAAC,QAAQ,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;oBAChD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;oBACvB,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBACvC,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;wBACrB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACpB,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,MAAM,wBAAwB,CAC5B,UAAU,CAAC,IAAI,EACf,KAAK,CAAC,YAAa,EACnB,UAAU,CACX,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,QAAQ,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAClE,uEAAuE;gBACvE,sEAAsE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,IAAI,CAAC;oBACH,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC3D,IAAI,OAAO;wBAAE,MAAM,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC1D,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACtD,sEAAsE;gBACtE,sEAAsE;gBACtE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;YAChE,IAAI,UAAU,CAAC,QAAQ;gBAAE,OAAO;YAChC,MAAM,wBAAwB,CAC5B,UAAU,CAAC,IAAI,EACf,OAAO,CAAC,YAAY,EACpB,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QACzE,UAAU,CAAC,QAAQ,GAAG;YACpB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,gBAAgB,CAAC,UAAU,CAAC;SAC7B,CAAC;QACF,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAC7C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAC9B,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CACb,KAAyC,EACzC,IAAuB,EACvB,OAAe,EACf,OAAgB,EACV,EAAE;QACR,OAAO,CAAC,UAAU,EAAE,CAAC;YACnB,KAAK;YACL,WAAW,EAAE,IAAI,EAAE,IAAI;YACvB,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,oCAAoC,WAAW,qDAAqD,CACrG,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE/B,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,QAAsD,CAAC;QAC3D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAA,8BAAgB,EAC/B,SAAS,EACT,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,EAC9B,IAAI,CAAC,QAAQ,EACb,OAAO,CAAC,MAAM,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,sEAAsE;gBACtE,qEAAqE;gBACrE,sEAAsE;gBACtE,iCAAiC;gBACjC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;gBACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,CACJ,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACzB,IAAI,EACJ,OAAO;gBACL,CAAC,CAAC,kBAAkB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE;gBAClD,CAAC,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE,EACnC,OAAO,EAAE,OAAO,CACjB,CAAC;YACF,SAAS;QACX,CAAC;QAED,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,mBAAmB,CAC3B,QAAQ,EACR,IAAI,EACJ,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,MAAM,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,CACJ,MAAM,EACN,IAAI,EACJ,kBAAkB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,EAChD,OAAO,CAAC,OAAO,CAChB,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,eAAe,EAAE,IAAI,EAAE,OAAO,CAAC;QAC/C,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,QAAsD,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;YACzE,MAAM,GAAG,GAAG,MAAM,IAAA,6BAAe,EAC/B,SAAS,EACT,OAAO,EACP,OAAO,CAAC,MAAM,EACd,eAAe,CAChB,CAAC;YACF,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,IAAA,2BAAa,EAAC,GAAG,EAAE,eAAe,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACrE,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;YACvE,QAAQ,GAAG,MAAM,IAAA,8BAAgB,EAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,IAAI,IAAI,OAAO,KAAK,OAAO,EAAE,EAAE;gBACvE,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAA,4BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,WAAW,GAAG;YAClB,GAAG,eAAe;YAClB,GAAG,QAAQ,CAAC,WAAW;SACxB,CAAC;QACF,MAAM,YAAY,GAAG,IAAA,+BAAiB,EAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAE9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,MAAM,CAClE,CAAC,GAAG,EAAE,EAAE,CAAC,qCAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAC3C,CAAC,MAAM,CAAC;QACT,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI;YAC5C,OAAO;YACP,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,MAAM;YACzD,gBAAgB;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAEnE,IAAA,wCAA0B,EAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC;gBACN,IAAI,EAAE,IAAA,gCAAkB,EAAC,IAAI,CAAC,IAAI,CAAC;gBACnC,KAAK,EAAE,GAAG;gBACV,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE;YACjB,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YACvC,OAAO;YACP,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACtE,GAAG,OAAO;aACX,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,oBAAoB,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACxE,GAAG,UAAU;QACb,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;KACjE,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAgB;IAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,GAAG,CACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,YAAY,EAAE,KAAK,CAAC,CAAC,CAAE;QACvB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAgB;IACxC,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA6C,EAC7C,IAAgB,EAChB,WAAW,GAAsB,EAAE;IAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAEnC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,QAAQ,GAAG,IAAA,2BAAa,EAAC,QAAQ,EAAE;gBACjC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC3C,GAAG,WAAW;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,2BAAa,EAAC,QAAQ,EAAE;gBACxC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;gBAC3D,OAAO,CAAC,KAAK;gBACb,GAAG,WAAW;aACf,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,mEAAmE;QACrE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,QAAoC;IAEpC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,QAAQ;SACzB,GAAG,CACF,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CACvB,GAAG,SAAS,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACnD;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,KAAK,CAAC,GAAG,OAAO,iBAAiB,WAAW,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAuC,EACvC,KAAc;IAEd,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,KAAK,CACd,WAAW,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,SAAS,OAAO,CAAC,YAAY,sDAAsD,OAAO,EAAE,CACvI,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAY,EACZ,YAAoB,EACpB,QAAoB;IAEpB,OAAO,IAAI,KAAK,CACd,uCAAuC,IAAI,4BAA4B,YAAY,SAAS,QAAQ,CAAC,SAAS,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,YAAY,GAAG,CAC3L,CAAC;AACJ,CAAC"}

package/lib/src/npm/internal/npmRegistry.d.ts

@@ -18,6 +18,8 @@ export interface INpmVersionMetadata {
         optional?: boolean;
     }>;
     dist?: {
+        integrity?: string;
+        shasum?: string;
         tarball?: string;
     };
 }
@@ -44,12 +46,21 @@ export interface IVersionRequest {
     requester: string;
 }
 export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+declare const VALIDATED_NPM_BYTE_LIMIT: unique symbol;
+type ValidatedNpmByteLimit = number & {
+    readonly [VALIDATED_NPM_BYTE_LIMIT]: true;
+};
 export declare const DECLARATION_FILE_REGEXP: RegExp;
 export declare function throwIfAborted(signal: AbortSignal | undefined): void;
 export declare function fetchNpmMetadata(fetchImpl: FetchLike, packageName: string, optional: boolean, signal: AbortSignal | undefined): Promise<INpmMetadata | null>;
 export declare function selectVersion(metadata: INpmMetadata, ranges: readonly string[] | string): string;
-export declare function downloadTarball(fetchImpl: FetchLike, tarball: string, signal: AbortSignal | undefined): Promise<ArrayBuffer>;
-export declare function unpackNpmTarball(tgz: ArrayBuffer, signal: AbortSignal | undefined): Promise<IUnpackedPackage>;
+export declare function downloadTarball(fetchImpl: FetchLike, tarball: string, signal: AbortSignal | undefined, maxBytes?: number): Promise<ArrayBuffer>;
+/** Verify registry authentication metadata against the compressed bytes. */
+export declare function verifyTarball(tgz: ArrayBuffer, dist: {
+    integrity?: string;
+    shasum?: string;
+}, signal: AbortSignal | undefined): Promise<void>;
+export declare function unpackNpmTarball(tgz: ArrayBuffer, signal: AbortSignal | undefined, maxBytes?: number): Promise<IUnpackedPackage>;
 export interface IMountedFiles {
     compilerFiles: Record<string, string>;
     editorLibs: Record<string, string>;
@@ -65,4 +76,6 @@ export declare function enqueuePackageDependencies(packageJson: {
     }>;
 }, enqueue: (item: IQueueItem) => void, requester: string): void;
 export declare function toTypesPackageName(packageName: string): string;
+/** Validate one public npm archive byte budget before starting related work. */
+export declare function validateNpmByteLimit(maxBytes: number, kind: "compressed" | "expanded"): ValidatedNpmByteLimit;
 export {};

package/lib/src/npm/internal/npmRegistry.js

@@ -5,10 +5,12 @@ exports.throwIfAborted = throwIfAborted;
 exports.fetchNpmMetadata = fetchNpmMetadata;
 exports.selectVersion = selectVersion;
 exports.downloadTarball = downloadTarball;
+exports.verifyTarball = verifyTarball;
 exports.unpackNpmTarball = unpackNpmTarball;
 exports.mountPackageFiles = mountPackageFiles;
 exports.enqueuePackageDependencies = enqueuePackageDependencies;
 exports.toTypesPackageName = toTypesPackageName;
+exports.validateNpmByteLimit = validateNpmByteLimit;
 const semver_1 = require("semver");
 const TEXT_FILE_REGEXP = /(^package\.json$|\.([cm]?js|jsx|[cm]?ts|tsx|json)$|\.d\.[cm]?ts$)/i;
 exports.DECLARATION_FILE_REGEXP = /\.d\.[cm]?ts$/i;
@@ -21,18 +23,26 @@ function throwIfAborted(signal) {
     throw new DOMException("The operation was aborted.", "AbortError");
 }
 async function fetchNpmMetadata(fetchImpl, packageName, optional, signal) {
-    const response = await fetchImpl(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
+    throwIfAborted(signal);
+    const response = await fetchWithAbort(() => fetchImpl(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
         headers: {
             Accept: "application/vnd.npm.install-v1+json, application/json",
         },
         signal,
-    });
-    if (response.status === 404 && optional)
+    }), signal);
+    throwIfResponseAborted(response, signal);
+    if (response.status === 404 && optional) {
+        cancelResponseBody(response);
         return null;
+    }
     if (!response.ok) {
+        cancelResponseBody(response);
         throw new Error(`npm registry returned ${response.status} while resolving ${packageName}.`);
     }
-    return (await response.json());
+    throwIfAborted(signal);
+    const metadata = (await abortable(() => response.json(), signal));
+    throwIfAborted(signal);
+    return metadata;
 }
 function selectVersion(metadata, ranges) {
     const versions = metadata.versions;
@@ -60,16 +70,54 @@ function selectVersion(metadata, ranges) {
         .map((range) => JSON.stringify(range))
         .join(", ")}.`);
 }
-async function downloadTarball(fetchImpl, tarball, signal) {
-    const response = await fetchImpl(tarball, { signal });
+async function downloadTarball(fetchImpl, tarball, signal, maxBytes = 16 * 1024 * 1024) {
+    throwIfAborted(signal);
+    const byteLimit = validateNpmByteLimit(maxBytes, "compressed");
+    const response = await fetchWithAbort(() => fetchImpl(tarball, { signal }), signal);
+    throwIfResponseAborted(response, signal);
     if (!response.ok) {
+        cancelResponseBody(response);
         throw new Error(`tarball download failed with HTTP ${response.status}.`);
     }
-    return response.arrayBuffer();
+    const declaredLength = response.headers.get("content-length");
+    if (declaredLength !== null) {
+        const parsed = Number(declaredLength);
+        if (Number.isFinite(parsed) && parsed >= 0 && parsed > byteLimit) {
+            cancelResponseBody(response);
+            throw new Error(`tarball exceeds the ${formatByteLimit(byteLimit)} compressed byte limit.`);
+        }
+    }
+    return collectBoundedStream(response.body, byteLimit, "compressed", signal, () => response.arrayBuffer());
+}
+/** Verify registry authentication metadata against the compressed bytes. */
+async function verifyTarball(tgz, dist, signal) {
+    throwIfAborted(signal);
+    if (dist.integrity !== undefined) {
+        const candidates = parseIntegrity(dist.integrity);
+        const strength = Math.max(...candidates.map(({ rank }) => rank));
+        const strongest = candidates.filter((candidate) => candidate.rank === strength);
+        const actual = new Uint8Array(await abortable(() => crypto.subtle.digest(strongest[0].webAlgorithm, tgz), signal));
+        throwIfAborted(signal);
+        if (!strongest.some(({ digest }) => equalBytes(actual, digest))) {
+            throw new Error(`tarball integrity mismatch (${strongest[0].algorithm}).`);
+        }
+        return;
+    }
+    if (dist.shasum !== undefined) {
+        if (!/^[a-fA-F0-9]{40}$/.test(dist.shasum)) {
+            throw new Error("tarball shasum is not a valid SHA-1 digest.");
+        }
+        const actual = new Uint8Array(await abortable(() => crypto.subtle.digest("SHA-1", tgz), signal));
+        throwIfAborted(signal);
+        if (!equalBytes(actual, decodeHex(dist.shasum))) {
+            throw new Error("tarball shasum mismatch (sha1).");
+        }
+    }
 }
-async function unpackNpmTarball(tgz, signal) {
+async function unpackNpmTarball(tgz, signal, maxBytes = 64 * 1024 * 1024) {
     throwIfAborted(signal);
-    const tar = await gunzip(tgz);
+    const byteLimit = validateNpmByteLimit(maxBytes, "expanded");
+    const tar = await gunzip(tgz, byteLimit, signal);
     throwIfAborted(signal);
     const decoder = new TextDecoder();
     const files = {};
@@ -77,22 +125,44 @@ async function unpackNpmTarball(tgz, signal) {
     let offset = 0;
     let longPath = null;
     let paxPath = null;
-    while (offset + 512 <= tar.length) {
+    let terminated = false;
+    let archiveRoot = null;
+    const confine = (rawPath) => {
+        const confined = confineTarPath(rawPath, archiveRoot);
+        archiveRoot = confined.root;
+        return confined.relative;
+    };
+    while (offset < tar.length) {
         throwIfAborted(signal);
+        if (offset + 512 > tar.length) {
+            throw new Error("Truncated tar header.");
+        }
         const header = tar.subarray(offset, offset + 512);
         offset += 512;
-        if (header.every((value) => value === 0))
+        if (header.every((value) => value === 0)) {
+            terminated = true;
             break;
+        }
         const type = String.fromCharCode(header[156] ?? 0);
         const size = parseOctal(header.subarray(124, 136));
+        if (size > tar.length - offset) {
+            throw new Error("Tar entry body extends beyond the archive.");
+        }
         const body = tar.subarray(offset, offset + size);
-        offset += Math.ceil(size / 512) * 512;
+        const paddedSize = Math.ceil(size / 512) * 512;
+        if (!Number.isSafeInteger(paddedSize) || paddedSize > tar.length - offset) {
+            throw new Error("Tar entry padding extends beyond the archive.");
+        }
+        offset += paddedSize;
         if (type === "L") {
             longPath = trimNull(decoder.decode(body));
+            confine(longPath);
             continue;
         }
         if (type === "x") {
             paxPath = parsePaxPath(body);
+            if (paxPath !== null)
+                confine(paxPath);
             continue;
         }
         if (type !== "0" && type !== "\0") {
@@ -100,11 +170,11 @@ async function unpackNpmTarball(tgz, signal) {
             paxPath = null;
             continue;
         }
-        const rawPath = paxPath ?? longPath ?? readTarString(header.subarray(0, 100), decoder);
+        const rawPath = paxPath ?? longPath ?? readTarHeaderPath(header, decoder);
         longPath = null;
         paxPath = null;
-        const rel = stripTarRoot(rawPath);
-        if (!rel || !TEXT_FILE_REGEXP.test(rel))
+        const rel = confine(rawPath);
+        if (!TEXT_FILE_REGEXP.test(rel))
             continue;
         const text = decoder.decode(body);
         files[rel] = text;
@@ -117,16 +187,18 @@ async function unpackNpmTarball(tgz, signal) {
             }
         }
     }
+    if (!terminated)
+        throw new Error("Tar archive has no end marker.");
     return { files, packageJson };
 }
-async function gunzip(input) {
+async function gunzip(input, maxBytes, signal) {
     if (!("DecompressionStream" in globalThis)) {
         throw new Error("This browser cannot unpack npm tgz files because DecompressionStream is unavailable.");
     }
     const stream = new Blob([input])
         .stream()
         .pipeThrough(new DecompressionStream("gzip"));
-    return new Uint8Array(await new Response(stream).arrayBuffer());
+    return new Uint8Array(await collectBoundedStream(stream, maxBytes, "expanded", signal, async () => new Response(stream).arrayBuffer()));
 }
 function mountPackageFiles(packageName, files) {
     const compilerFiles = {};
@@ -193,11 +265,19 @@ function readTarString(bytes, decoder) {
 }
 function trimNull(text) {
     const index = text.indexOf("\0");
-    return (index < 0 ? text : text.slice(0, index)).trim();
+    return index < 0 ? text : text.slice(0, index);
 }
 function parseOctal(bytes) {
     const text = trimNull(new TextDecoder().decode(bytes)).trim();
-    return text ? Number.parseInt(text, 8) : 0;
+    if (text.length === 0)
+        return 0;
+    if (!/^[0-7]+$/.test(text))
+        throw new Error("Invalid tar entry size.");
+    const value = Number.parseInt(text, 8);
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new Error("Tar entry size is outside the safe integer range.");
+    }
+    return value;
 }
 function parsePaxPath(bytes) {
     const decoder = new TextDecoder();
@@ -227,13 +307,238 @@ function parsePaxPath(bytes) {
     }
     return path;
 }
-function stripTarRoot(path) {
-    const normalized = path.replace(/\\/g, "/").replace(/^\/+/, "");
-    if (!normalized)
-        return "";
-    if (normalized.startsWith("package/"))
-        return normalized.slice("package/".length);
-    const slash = normalized.indexOf("/");
-    return slash < 0 ? normalized : normalized.slice(slash + 1);
+function readTarHeaderPath(header, decoder) {
+    const name = readTarString(header.subarray(0, 100), decoder);
+    const prefix = readTarString(header.subarray(345, 500), decoder);
+    return prefix ? `${prefix}/${name}` : name;
+}
+/**
+ * Require an npm archive path below one safe, consistent top-level root.
+ *
+ * Npm normally emits `package/`, while current DefinitelyTyped tarballs use
+ * roots such as `node/` and `react/`. The root spelling does not enter the
+ * mounted key; consistency and safe remaining segments provide confinement.
+ */
+function confineTarPath(rawPath, archiveRoot) {
+    if (rawPath.length === 0 ||
+        rawPath.includes("\\") ||
+        rawPath.startsWith("/") ||
+        /^[a-zA-Z]:/.test(rawPath)) {
+        throw new Error(`Invalid npm tar entry path ${JSON.stringify(rawPath)}.`);
+    }
+    const segments = rawPath.split("/");
+    if (segments.length < 2 ||
+        segments.some((segment, index) => segment.length === 0 ||
+            segment === "." ||
+            segment === ".." ||
+            (index > 0 && /^[a-zA-Z]:/.test(segment)))) {
+        throw new Error(`npm tar entry is outside a confined package root: ${JSON.stringify(rawPath)}.`);
+    }
+    const root = segments[0];
+    if (archiveRoot !== null && root !== archiveRoot) {
+        throw new Error(`npm tar archive mixes package roots ${JSON.stringify(archiveRoot)} and ${JSON.stringify(root)}.`);
+    }
+    return { relative: segments.slice(1).join("/"), root };
+}
+function parseIntegrity(integrity) {
+    const tokens = integrity.trim().split(/\s+/).filter(Boolean);
+    if (tokens.length === 0)
+        throw new Error("tarball integrity is empty.");
+    const candidates = [];
+    for (const token of tokens) {
+        const match = /^([A-Za-z0-9]+)-([A-Za-z0-9+/]+={0,2})(?:\?[!-~]+)?$/i.exec(token);
+        if (!match) {
+            throw new Error("tarball integrity contains malformed metadata.");
+        }
+        const algorithm = match[1].toLowerCase();
+        if (!["sha1", "sha256", "sha384", "sha512"].includes(algorithm)) {
+            decodeBase64(match[2]);
+            continue;
+        }
+        const expectedLength = algorithm === "sha512"
+            ? 64
+            : algorithm === "sha384"
+                ? 48
+                : algorithm === "sha256"
+                    ? 32
+                    : 20;
+        const digest = decodeBase64(match[2]);
+        if (digest.length !== expectedLength) {
+            throw new Error("tarball integrity contains a malformed digest.");
+        }
+        candidates.push({
+            algorithm,
+            digest,
+            rank: expectedLength,
+            webAlgorithm: algorithm.replace("sha", "SHA-"),
+        });
+    }
+    if (candidates.length === 0) {
+        throw new Error("tarball integrity has no supported digest algorithm.");
+    }
+    return candidates;
+}
+function decodeBase64(value) {
+    try {
+        const decoded = atob(value);
+        return Uint8Array.from(decoded, (character) => character.charCodeAt(0));
+    }
+    catch {
+        throw new Error("tarball integrity contains malformed base64.");
+    }
+}
+function decodeHex(value) {
+    return Uint8Array.from(value.match(/../g) ?? [], (byte) => Number.parseInt(byte, 16));
+}
+function equalBytes(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; ++index) {
+        difference |= left[index] ^ right[index];
+    }
+    return difference === 0;
+}
+async function collectBoundedStream(stream, maxBytes, kind, signal, fallback) {
+    if (stream === null) {
+        throwIfAborted(signal);
+        const bytes = await abortable(fallback, signal);
+        throwIfAborted(signal);
+        if (bytes.byteLength > maxBytes) {
+            throw new Error(`tarball exceeds the ${formatByteLimit(maxBytes)} ${kind} byte limit.`);
+        }
+        return bytes;
+    }
+    const reader = stream.getReader();
+    const chunks = [];
+    let length = 0;
+    let abort;
+    const aborted = signal === undefined
+        ? undefined
+        : new Promise((_resolve, reject) => {
+            abort = () => {
+                let error;
+                try {
+                    throwIfAborted(signal);
+                    return;
+                }
+                catch (caught) {
+                    error = caught;
+                }
+                void reader.cancel(error).catch(() => undefined);
+                reject(error);
+            };
+            signal.addEventListener("abort", abort, { once: true });
+        });
+    try {
+        for (;;) {
+            throwIfAborted(signal);
+            const read = reader.read();
+            const next = aborted ? await Promise.race([read, aborted]) : await read;
+            throwIfAborted(signal);
+            if (next.done)
+                break;
+            if (next.value.byteLength > maxBytes - length) {
+                void reader.cancel().catch(() => undefined);
+                throw new Error(`tarball exceeds the ${formatByteLimit(maxBytes)} ${kind} byte limit.`);
+            }
+            chunks.push(next.value);
+            length += next.value.byteLength;
+        }
+    }
+    catch (error) {
+        void reader.cancel(error).catch(() => undefined);
+        throw error;
+    }
+    finally {
+        if (abort !== undefined)
+            signal?.removeEventListener("abort", abort);
+    }
+    const output = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output.buffer;
+}
+function formatByteLimit(bytes) {
+    return `${bytes.toLocaleString("en-US")}-byte`;
+}
+/** Validate one public npm archive byte budget before starting related work. */
+function validateNpmByteLimit(maxBytes, kind) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error(`${kind} byte limit must be a positive safe integer.`);
+    }
+    return maxBytes;
+}
+/**
+ * Reject promptly on abort even when an underlying browser task is not
+ * cancellable.
+ */
+function abortable(start, signal, disposeLateValue) {
+    throwIfAborted(signal);
+    let task;
+    try {
+        task = start();
+    }
+    catch (error) {
+        throwIfAborted(signal);
+        throw error;
+    }
+    if (signal === undefined)
+        return task;
+    return new Promise((resolve, reject) => {
+        let aborted = false;
+        const abort = () => {
+            if (aborted)
+                return;
+            aborted = true;
+            signal.removeEventListener("abort", abort);
+            try {
+                throwIfAborted(signal);
+            }
+            catch (error) {
+                reject(error);
+            }
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        void task
+            .then((value) => {
+            if (signal.aborted) {
+                try {
+                    disposeLateValue?.(value);
+                }
+                catch {
+                    // Disposal is best-effort and must not replace the abort reason.
+                }
+                abort();
+                return;
+            }
+            resolve(value);
+        }, reject)
+            .finally(() => {
+            signal.removeEventListener("abort", abort);
+        });
+        if (signal.aborted)
+            abort();
+    });
+}
+/** Cancel an unused response body without obscuring the deciding outcome. */
+function cancelResponseBody(response) {
+    void response.body?.cancel().catch(() => undefined);
+}
+/** Preserve the abort reason across the response-to-caller handoff. */
+function throwIfResponseAborted(response, signal) {
+    if (!signal?.aborted)
+        return;
+    cancelResponseBody(response);
+    throwIfAborted(signal);
+}
+/** Fetch one response and cancel any body that loses the abort race. */
+async function fetchWithAbort(start, signal) {
+    const response = await abortable(start, signal, cancelResponseBody);
+    throwIfResponseAborted(response, signal);
+    return response;
 }
 //# sourceMappingURL=npmRegistry.js.map