@vltpkg/cli-js 1.0.3 → 1.0.5

package/{access-5WETTBDZ.js → access-AFFG4IBZ.js}

@@ -11,15 +11,15 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   resolveRegistry
-} from "./chunk-T4GYDWUJ.js";
+} from "./chunk-5JFRXIK2.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
-import "./chunk-XU5SMHXP.js";
+import "./chunk-XKVU23NC.js";
 import "./chunk-WP6CYBPM.js";
 import {
   RegistryClient
-} from "./chunk-HNCE3YE5.js";
+} from "./chunk-R32BJAKT.js";
 import "./chunk-HAYXR3MW.js";
 import "./chunk-E74WGW5C.js";
 import "./chunk-LPIBYUMT.js";
@@ -27,7 +27,7 @@ import "./chunk-UBLFPJHV.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-BJBFEQRR.js";
 import "./chunk-VE6CCH33.js";
-import "./chunk-IITIX4ID.js";
+import "./chunk-VFBCWAOC.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{bugs-KONFLIQQ.js → bugs-MCLLEJJP.js}

@@ -14,26 +14,26 @@ import {
 } from "./chunk-CLVRCGOZ.js";
 import {
   createHostContextsMap
-} from "./chunk-TMBNGWXK.js";
+} from "./chunk-YRLO236S.js";
 import {
   PackageInfoClient
-} from "./chunk-G7UPIJAP.js";
-import "./chunk-FWKQ7YDF.js";
+} from "./chunk-YZPRRP7W.js";
+import "./chunk-ZWKI5OSF.js";
 import {
   Query,
   actual
-} from "./chunk-LZGKX7JI.js";
+} from "./chunk-3NGV7EC6.js";
 import {
   SecurityArchive
-} from "./chunk-5B23EKN4.js";
-import "./chunk-FFOXTPQA.js";
-import "./chunk-OCJDISSI.js";
+} from "./chunk-ED2DDTQT.js";
+import "./chunk-SVBEF5PK.js";
+import "./chunk-3OPNZI6G.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
 import {
   Spec
-} from "./chunk-XU5SMHXP.js";
+} from "./chunk-XKVU23NC.js";
 import "./chunk-WP6CYBPM.js";
 import "./chunk-HTOTG4TS.js";
 import {
@@ -45,7 +45,7 @@ import "./chunk-UBLFPJHV.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-BJBFEQRR.js";
 import "./chunk-VE6CCH33.js";
-import "./chunk-IITIX4ID.js";
+import "./chunk-VFBCWAOC.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{build-S7G2DU7I.js → build-TKUT6V2P.js}

@@ -11,14 +11,14 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   build
-} from "./chunk-LZGKX7JI.js";
-import "./chunk-5B23EKN4.js";
-import "./chunk-FFOXTPQA.js";
-import "./chunk-OCJDISSI.js";
+} from "./chunk-3NGV7EC6.js";
+import "./chunk-ED2DDTQT.js";
+import "./chunk-SVBEF5PK.js";
+import "./chunk-3OPNZI6G.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
-import "./chunk-XU5SMHXP.js";
+import "./chunk-XKVU23NC.js";
 import "./chunk-WP6CYBPM.js";
 import "./chunk-HTOTG4TS.js";
 import "./chunk-E74WGW5C.js";
@@ -29,7 +29,7 @@ import "./chunk-BJBFEQRR.js";
 import "./chunk-VE6CCH33.js";
 import {
   isErrorWithCause
-} from "./chunk-IITIX4ID.js";
+} from "./chunk-VFBCWAOC.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{cache-Z4OIMLXQ.js → cache-O464JQI4.js}

@@ -15,26 +15,26 @@ import {
 import {
   stderr,
   stdout
-} from "./chunk-E737X73P.js";
+} from "./chunk-AL42Z2D3.js";
 import "./chunk-FEIPJIEN.js";
 import "./chunk-G2YT2GWF.js";
-import "./chunk-VB3IWNHX.js";
-import "./chunk-T4GYDWUJ.js";
+import "./chunk-GDJ7JT2R.js";
+import "./chunk-5JFRXIK2.js";
 import "./chunk-WGDTG44V.js";
-import "./chunk-OCJDISSI.js";
+import "./chunk-3OPNZI6G.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
 import {
   Spec
-} from "./chunk-XU5SMHXP.js";
+} from "./chunk-XKVU23NC.js";
 import "./chunk-WP6CYBPM.js";
 import {
   ViewClass
 } from "./chunk-4KCU2KZL.js";
 import {
   CacheEntry
-} from "./chunk-HNCE3YE5.js";
+} from "./chunk-R32BJAKT.js";
 import "./chunk-HAYXR3MW.js";
 import "./chunk-E74WGW5C.js";
 import "./chunk-LPIBYUMT.js";
@@ -42,7 +42,7 @@ import "./chunk-UBLFPJHV.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-BJBFEQRR.js";
 import "./chunk-VE6CCH33.js";
-import "./chunk-IITIX4ID.js";
+import "./chunk-VFBCWAOC.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/cache-unzip-src-unzip.js

@@ -4302,7 +4302,9 @@ var Cache = class _Cache extends I {
         return this.#diskRead(k3, v2, opts.context?.integrity);
       },
       allowStaleOnFetchRejection: true,
-      allowStaleOnFetchAbort: true,
+      // Eviction aborts in-flight fetch() placeholders. Resolving those
+      // as undefined is treated as a cache miss and re-downloads tarballs.
+      ignoreFetchAbort: true,
       allowStale: true,
       noDeleteOnStaleGet: true
     });
@@ -4544,6 +4546,15 @@ var Cache = class _Cache extends I {
 import { pathToFileURL } from "node:url";
 import { gunzipSync } from "node:zlib";
 var __CODE_SPLIT_SCRIPT_NAME = import.meta.filename;
+var MAX_DECOMPRESSION_RATIO = 1e3;
+var defaultMaxUnpackedBytes = 2 * 1024 * 1024 * 1024;
+var parseMaxUnpackedBytes = (raw) => {
+  const n7 = Number(raw);
+  return Number.isFinite(n7) && n7 >= 1 ? Math.floor(n7) : defaultMaxUnpackedBytes;
+};
+var maxUnpackedBytes = parseMaxUnpackedBytes(
+  process.env.VLT_TAR_MAX_UNPACKED_BYTES
+);
 var isMain = (path) => path === __CODE_SPLIT_SCRIPT_NAME || path === pathToFileURL(__CODE_SPLIT_SCRIPT_NAME).toString();
 var main = async (path, input = process.stdin) => {
   if (!path) {
@@ -4586,7 +4597,20 @@ var main = async (path, input = process.stdin) => {
       const headSizeOriginal = readSize(buffer, 0);
       const body = buffer.subarray(headSizeOriginal);
       if (body[0] === 31 && body[1] === 139) {
-        const unz = gunzipSync(body);
+        let unz;
+        try {
+          unz = gunzipSync(body, {
+            maxOutputLength: Math.min(
+              maxUnpackedBytes,
+              body.length * MAX_DECOMPRESSION_RATIO
+            )
+          });
+        } catch (er) {
+          if (er.code !== "ERR_BUFFER_TOO_LARGE") {
+            throw er;
+          }
+          return null;
+        }
         const headersBuffer = buffer.subarray(7, headSizeOriginal);
         const headers = [];
         let i = 0;

package/{chunk-UXIRAU5T.js → chunk-34VLICEH.js}

@@ -11,14 +11,14 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   asDependency
-} from "./chunk-LZGKX7JI.js";
+} from "./chunk-3NGV7EC6.js";
 import {
   joinDepIDTuple,
   splitDepID
-} from "./chunk-OCJDISSI.js";
+} from "./chunk-3OPNZI6G.js";
 import {
   Spec
-} from "./chunk-XU5SMHXP.js";
+} from "./chunk-XKVU23NC.js";
 
 // ../../src/cli-sdk/src/parse-add-remove-args.ts
 import { isAbsolute, relative, resolve } from "node:path";