@vltpkg/cli-js 1.2.0 → 1.3.1

package/{chunk-OE6VHHN4.js → chunk-P6LBJWJN.js}

@@ -15,12 +15,13 @@ import {
 import {
   assertOk,
   registryErrorMessage,
+  statusText,
   storeRoot,
   tokenRefusal
-} from "./chunk-UQUIO7LW.js";
+} from "./chunk-PBBULTAG.js";
 import {
   userAgent
-} from "./chunk-JTUZP2OD.js";
+} from "./chunk-LCAH3OGR.js";
 import {
   I,
   logRequest
@@ -30,12 +31,12 @@ import {
 } from "./chunk-XNLSTHDK.js";
 import {
   rimraf
-} from "./chunk-BHJT53TP.js";
+} from "./chunk-PDWPFR5T.js";
 import {
   asError,
   integrityHex,
   integrityRE
-} from "./chunk-G5BSQ6DP.js";
+} from "./chunk-BP3PQ67D.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -2323,14 +2324,14 @@ var require_request = __commonJS({
       onResponseStarted() {
         return this[kHandler].onResponseStarted?.();
       }
-      onHeaders(statusCode, headers, resume, statusText) {
+      onHeaders(statusCode, headers, resume, statusText2) {
         assert(!this.aborted);
         assert(!this.completed);
         if (channels.headers.hasSubscribers) {
-          channels.headers.publish({ request: this, response: { statusCode, headers, statusText } });
+          channels.headers.publish({ request: this, response: { statusCode, headers, statusText: statusText2 } });
         }
         try {
-          return this[kHandler].onHeaders(statusCode, headers, resume, statusText);
+          return this[kHandler].onHeaders(statusCode, headers, resume, statusText2);
         } catch (err) {
           this.abort(err);
         }
@@ -5083,9 +5084,9 @@ var require_util2 = __commonJS({
     function isErrorLike(object) {
       return object instanceof Error || (object?.constructor?.name === "Error" || object?.constructor?.name === "DOMException");
     }
-    function isValidReasonPhrase(statusText) {
-      for (let i = 0; i < statusText.length; ++i) {
-        const c = statusText.charCodeAt(i);
+    function isValidReasonPhrase(statusText2) {
+      for (let i = 0; i < statusText2.length; ++i) {
+        const c = statusText2.charCodeAt(i);
         if (!(c === 9 || // HTAB
         c >= 32 && c <= 126 || // SP / VCHAR
         c >= 128 && c <= 255)) {
@@ -7040,7 +7041,7 @@ var require_client_h1 = __commonJS({
        * @returns {number}
        */
       onHeadersComplete(statusCode, upgrade, shouldKeepAlive) {
-        const { client, socket, headers, statusText } = this;
+        const { client, socket, headers, statusText: statusText2 } = this;
         if (socket.destroyed) {
           return -1;
         }
@@ -7105,7 +7106,7 @@ var require_client_h1 = __commonJS({
         } else {
           socket[kReset] = true;
         }
-        const pause = request2.onHeaders(statusCode, headers, this.resume, statusText) === false;
+        const pause = request2.onHeaders(statusCode, headers, this.resume, statusText2) === false;
         if (request2.aborted) {
           return -1;
         }
@@ -12603,7 +12604,7 @@ var require_mock_utils = __commonJS({
       kTotalDispatchCount
     } = require_mock_symbols();
     var { serializePathWithQuery } = require_util();
-    var { STATUS_CODES: STATUS_CODES2 } = __require("node:http");
+    var { STATUS_CODES } = __require("node:http");
     var {
       types: {
         isPromise
@@ -12811,7 +12812,7 @@ var require_mock_utils = __commonJS({
       return result;
     }
     function getStatusText(statusCode) {
-      return STATUS_CODES2[statusCode] || "unknown";
+      return STATUS_CODES[statusCode] || "unknown";
     }
     async function getResponse(body) {
       const buffers = [];
@@ -20417,7 +20418,7 @@ var require_fetch = __commonJS({
     var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url();
     var { getGlobalDispatcher } = require_global2();
     var { webidl } = require_webidl();
-    var { STATUS_CODES: STATUS_CODES2 } = __require("node:http");
+    var { STATUS_CODES } = __require("node:http");
     var { bytesMatch } = require_subresource_integrity();
     var { createDeferredPromise } = require_promise();
     var { isomorphicEncode } = require_infra();
@@ -21210,13 +21211,13 @@ var require_fetch = __commonJS({
         })();
       }
       try {
-        const { body, status, statusText, headersList, socket } = await dispatch({ body: requestBody });
+        const { body, status, statusText: statusText2, headersList, socket } = await dispatch({ body: requestBody });
         if (socket) {
-          response = makeResponse({ status, statusText, headersList, socket });
+          response = makeResponse({ status, statusText: statusText2, headersList, socket });
         } else {
           const iterator = body[Symbol.asyncIterator]();
           fetchParams.controller.next = () => iterator.next();
-          response = makeResponse({ status, statusText, headersList });
+          response = makeResponse({ status, statusText: statusText2, headersList });
         }
       } catch (err) {
         if (err.name === "AbortError") {
@@ -21338,7 +21339,7 @@ var require_fetch = __commonJS({
             onResponseStarted() {
               timingInfo.finalNetworkResponseStartTime = coarsenedSharedCurrentTime(fetchParams.crossOriginIsolatedCapability);
             },
-            onHeaders(status, rawHeaders, resume, statusText) {
+            onHeaders(status, rawHeaders, resume, statusText2) {
               if (status < 200) {
                 return false;
               }
@@ -21401,7 +21402,7 @@ var require_fetch = __commonJS({
               const onError = this.onError.bind(this);
               resolve5({
                 status,
-                statusText,
+                statusText: statusText2,
                 headersList,
                 body: decoders.length ? pipeline(this.body, ...decoders, (err) => {
                   if (err) {
@@ -21454,7 +21455,7 @@ var require_fetch = __commonJS({
               }
               resolve5({
                 status,
-                statusText: STATUS_CODES2[status],
+                statusText: STATUS_CODES[status],
                 headersList,
                 socket
               });
@@ -21478,7 +21479,7 @@ var require_fetch = __commonJS({
               }
               resolve5({
                 status,
-                statusText: STATUS_CODES2[status],
+                statusText: STATUS_CODES[status],
                 headersList,
                 socket
               });
@@ -26149,8 +26150,7 @@ var handleBeforeExit = () => {
 // ../../src/registry-client/src/index.ts
 var import_undici3 = __toESM(require_undici(), 1);
 import { randomUUID } from "node:crypto";
-import { readFileSync as readFileSync2 } from "node:fs";
-import { STATUS_CODES } from "node:http";
+import { closeSync, openSync, readFileSync as readFileSync2, readSync } from "node:fs";
 import { availableParallelism } from "node:os";
 import { dirname as dirname3, resolve as resolve4 } from "node:path";
 import { setTimeout as setTimeout2 } from "node:timers/promises";
@@ -26937,10 +26937,19 @@ var CacheEntry = class _CacheEntry {
    * i.e. a tarball the global store can be built from.
    */
   static isTarballEntry(buffer) {
+    return !!_CacheEntry.tarballIntegrity(buffer);
+  }
+  /**
+   * The hash recorded on such an entry, or undefined if this is not one.
+   * {@link isTarballEntry} is built on this, and both only need the head.
+   */
+  static tarballIntegrity(buffer) {
     const parsed = _CacheEntry.#parseHead(buffer);
-    if (parsed?.statusCode !== 200 || !parsed.integrity) return false;
+    if (parsed?.statusCode !== 200 || !parsed.integrity) {
+      return void 0;
+    }
     const ct = getRawHeader(parsed.headers, "content-type");
-    return !ct || !/\bjson\b/.test(getDecodedValue(ct));
+    return !ct || !/\bjson\b/.test(getDecodedValue(ct)) ? parsed.integrity : void 0;
   }
   /**
    * Encode status + headers (no body) as they appear at the start of
@@ -27480,13 +27489,13 @@ var exchangeToken = async (idToken, packageName, registry) => {
 // ../../src/registry-client/src/index.ts
 var log3 = (msg) => console.error(msg);
 var isCacheableMethod = (m) => m === "GET" || m === "HEAD";
+var maxHeadSize = 1024 * 1024;
 var cacheKey = (method, url) => `${method !== "GET" ? method + " " : ""}${url}`;
 var agentOptions = {
   bodyTimeout: 6e5,
   headersTimeout: 6e5,
   keepAliveMaxTimeout: 12e5,
   keepAliveTimeout: 6e5,
-  keepAliveTimeoutThreshold: 3e4,
   connect: {
     timeout: 6e5,
     keepAlive: true,
@@ -27571,7 +27580,7 @@ var RegistryClient = class {
         }
       } catch {
       }
-      const status = STATUS_CODES[statusCode];
+      const status = statusText(statusCode);
       throw error(
         `Failed to fetch paginated results: ${statusCode}${status ? ` ${status}` : ""}${typeof detail === "string" && detail ? `: ${detail}` : ""}`,
         { code: "EREQUEST", status: statusCode, url: String(url) }
@@ -27688,7 +27697,7 @@ var RegistryClient = class {
       }
     }
     const { statusCode } = response;
-    const status = STATUS_CODES[statusCode];
+    const status = statusText(statusCode);
     throw error(
       `Failed to perform web login: ${statusCode}${status ? ` ${status}` : ""}`,
       {
@@ -27767,6 +27776,44 @@ var RegistryClient = class {
       response
     });
   }
+  /**
+   * The hash the cache recorded for `url`. This reads only the entry's
+   * head, which is about a kilobyte, rather than the body, which can be a
+   * megabyte. A caller that is about to look the package up in the global
+   * store needs nothing else, and if the store misses it can still read
+   * the body afterwards.
+   *
+   * Returns undefined if there is no entry, or if the entry is not a
+   * tarball. This never reads the body, so if `cache-unzip` rewrote the
+   * entry underneath us the worst case is a stale hash. That misses in the
+   * store; it cannot return the wrong bytes.
+   */
+  cachedIntegrity(url, options = {}) {
+    const { method = "GET" } = options;
+    try {
+      const key = cacheKey(
+        method,
+        typeof url === "string" ? new URL(url) : url
+      );
+      if (this.cache.peek(key)) return void 0;
+      const fd = openSync(this.cache.path(key), "r");
+      try {
+        const size = Buffer.allocUnsafe(4);
+        if (readSync(fd, size, 0, 4, 0) < 4) return void 0;
+        const headSize = size.readUInt32BE(0);
+        if (headSize < 7 || headSize > maxHeadSize) return void 0;
+        const head = Buffer.allocUnsafe(headSize);
+        if (readSync(fd, head, 0, headSize, 0) < headSize) {
+          return void 0;
+        }
+        return CacheEntry.tarballIntegrity(head);
+      } finally {
+        closeSync(fd);
+      }
+    } catch {
+    }
+    return void 0;
+  }
   /**
    * Read a valid cached non-JSON body straight off disk, bypassing the
    * in-memory cache LRU so that a tarball is never held in it.
@@ -27795,7 +27842,7 @@ var RegistryClient = class {
         if (i) paths.add(i);
       } catch {
       }
-      paths.add(this.cache.path(key));
+      if (!integrity) paths.add(this.cache.path(key));
       for (const path of paths) {
         let buf;
         try {
@@ -27938,7 +27985,7 @@ var RegistryClient = class {
     );
     if (!trustIntegrity && !result.fromCache) {
       result.deleteHeader("integrity");
-      if (result.isGzip) result.checkIntegrity({ url });
+      if (result.statusCode === 200) result.checkIntegrity({ url });
     }
     if (verifyDigest && !integrity && !result.fromCache && result.statusCode === 200) {
       result.checkDigest(verifyDigest === "required", { url });

package/{chunk-UQUIO7LW.js → chunk-PBBULTAG.js}

@@ -12,13 +12,13 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   asError,
   isObject
-} from "./chunk-G5BSQ6DP.js";
+} from "./chunk-BP3PQ67D.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
 
 // ../../src/registry-client/src/registry-error.ts
-import { STATUS_CODES } from "node:http";
+var statusText = (code) => process.getBuiltinModule("node:http").STATUS_CODES[code];
 var MAX_DETAIL_LENGTH = 512;
 var truncate = (s) => s.length <= MAX_DETAIL_LENGTH ? s : `${s.slice(0, MAX_DETAIL_LENGTH - 1)}\u2026`;
 var isHTML = (s) => /^\s*(<!doctype\s+html|<html\b)/i.test(s);
@@ -42,7 +42,7 @@ var detailFromJSON = (text) => {
   return void 0;
 };
 var registryErrorMessage = (response) => {
-  const statusMessage = STATUS_CODES[response.statusCode];
+  const statusMessage = statusText(response.statusCode);
   const status = `${response.statusCode}${statusMessage ? ` ${statusMessage}` : ""}`;
   let text;
   try {
@@ -161,6 +161,7 @@ import { resolve } from "node:path";
 var storeRoot = (cache) => resolve(cache, "store", "v1");
 
 export {
+  statusText,
   registryErrorMessage,
   tokenRefusal,
   tokenRefusalAdvice,

package/{chunk-BHJT53TP.js → chunk-PDWPFR5T.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   Ze,
   ts
-} from "./chunk-VE6CCH33.js";
+} from "./chunk-Y5PA7DVK.js";
 
 // ../../node_modules/.vlt/~npm~rimraf@6.1.3/node_modules/rimraf/dist/esm/opt-arg.js
 var typeOrUndef = (val, t) => typeof val === "undefined" || typeof val === t;

package/{chunk-5YB6UIC3.js → chunk-QXKWSPKX.js}

@@ -20,15 +20,15 @@ import {
   pickManifest,
   resolve,
   revs
-} from "./chunk-6G7MTZGS.js";
+} from "./chunk-BUKZHMMK.js";
 import {
   Spec
-} from "./chunk-G5NJ7CYI.js";
+} from "./chunk-64VFL4WI.js";
 import {
   registryErrorMessage,
   storeRoot,
   tokenRefusalAdvice
-} from "./chunk-UQUIO7LW.js";
+} from "./chunk-PBBULTAG.js";
 import {
   logRequest
 } from "./chunk-U7TEQCBN.js";
@@ -37,8 +37,10 @@ import {
 } from "./chunk-XNLSTHDK.js";
 import {
   asPackument,
-  integrityHex
-} from "./chunk-G5BSQ6DP.js";
+  brotliTarballUrl,
+  integrityHex,
+  tarballFormat
+} from "./chunk-BP3PQ67D.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -204,7 +206,7 @@ var PackageInfoClient = class {
   #tarPoolPromise;
   async getRegistryClient() {
     if (this.#registryClient) return this.#registryClient;
-    this.#registryClientPromise ??= import("./src-2BUT4WYP.js").then(({ RegistryClient }) => {
+    this.#registryClientPromise ??= import("./src-PKFKIVVK.js").then(({ RegistryClient }) => {
       this.#registryClient = new RegistryClient(this.options);
       return this.#registryClient;
     });
@@ -244,7 +246,7 @@ var PackageInfoClient = class {
   }
   async getTarPool() {
     if (this.#tarPool) return this.#tarPool;
-    this.#tarPoolPromise ??= import("./src-OKMGXMAD.js").then(
+    this.#tarPoolPromise ??= import("./src-EJSVFFXB.js").then(
       ({ Pool }) => {
         this.#tarPool = new Pool();
         return this.#tarPool;
@@ -252,6 +254,18 @@ var PackageInfoClient = class {
     );
     return this.#tarPoolPromise;
   }
+  /**
+   * A version's Brotli (`.tar.br`) alternate: its absolute URL, plus its
+   * hash if the registry sent one. Returns undefined if the version has no
+   * alternate, if it has one this client does not use (see
+   * {@link brotliTarballUrl}), or if `--no-brotli-tarballs` is set.
+   * `dist.tarball` is already absolute by this point; see
+   * `absolutizeTarballs`.
+   */
+  #brotliTarball(tarball, alternates) {
+    if (this.options["brotli-tarballs"] === false) return void 0;
+    return brotliTarballUrl(tarball, alternates);
+  }
   constructor(options = {}) {
     this.options = options;
     this.#projectRoot = options.projectRoot || process.cwd();
@@ -286,8 +300,13 @@ var PackageInfoClient = class {
       installScripts = false
     } = options;
     const f = spec.final;
-    const alreadyResolved = !!(integrity && resolved);
-    const r = alreadyResolved ? { resolved, integrity, spec } : await this.resolve(spec, options);
+    const brotli = !!resolved && tarballFormat(resolved) === "brotli";
+    const r = resolved && (integrity || brotli) ? {
+      resolved,
+      integrity,
+      spec,
+      ...brotli && !integrity ? { digestRequired: true } : {}
+    } : await this.resolve(spec, options);
     switch (f.type) {
       case "git": {
         const {
@@ -322,8 +341,14 @@ var PackageInfoClient = class {
       }
       case "registry": {
         const pool = await this.getTarPool();
-        const hex = f.type === "registry" && this.#storeLinker !== "unpack" ? integrityHex(r.integrity) : void 0;
+        const format = tarballFormat(r.resolved);
+        const storeOn = f.type === "registry" && this.#storeLinker !== "unpack";
         const copy = this.#storeLinker === "copy" || installScripts;
+        const hex = !storeOn ? void 0 : r.integrity ? integrityHex(r.integrity) : integrityHex(
+          (await this.getRegistryClient()).cachedIntegrity(
+            r.resolved
+          )
+        );
         if (hex) {
           if (debug.enabled && !this.#storeHitRateLogged) {
             this.#storeHitRateLogged = true;
@@ -353,10 +378,10 @@ var PackageInfoClient = class {
         });
         if (cached) {
           try {
-            await pool.unpack(cached.body, target);
+            await pool.unpack(cached.body, target, format);
             logRequest(r.resolved, "cache");
             r.integrity ??= cached.integrity;
-            if (hex || cached.gzip) {
+            if (storeOn || cached.gzip) {
               rc.queueForStore(cached.key, r.integrity);
             }
             return r;
@@ -387,7 +412,8 @@ var PackageInfoClient = class {
               }
             );
           }
-          if (!trustIntegrity && response.checkIntegrity({ spec, url: resolved })) {
+          const verified = !trustIntegrity && response.checkIntegrity({ spec, url: resolved });
+          if (verified) {
             this.#trustedIntegrities.set(
               r.resolved,
               response.integrity
@@ -395,7 +421,7 @@ var PackageInfoClient = class {
           }
           const buf2 = response.buffer();
           if (r.integrity) {
-            if (!fromLockfile && !response.fromCache) {
+            if (!verified && !fromLockfile && !response.fromCache) {
               const hash = createHash("sha512");
               hash.update(buf2);
               const computed = `sha512-${hash.digest("base64")}`;
@@ -427,7 +453,7 @@ var PackageInfoClient = class {
           }
         }
         try {
-          await (await this.getTarPool()).unpack(buf, target);
+          await pool.unpack(buf, target, format);
         } catch (er) {
           throw this.#resolveError(
             spec,
@@ -627,11 +653,12 @@ var PackageInfoClient = class {
               { response, url: tarball }
             );
           }
-          if (!trustIntegrity && response.checkIntegrity({ spec, url: tarball })) {
+          const verified = !trustIntegrity && response.checkIntegrity({ spec, url: tarball });
+          if (verified) {
             this.#trustedIntegrities.set(tarball, response.integrity);
           }
           const buf = response.buffer();
-          if (integrity && !response.fromCache) {
+          if (integrity && !verified && !response.fromCache) {
             const hash = createHash("sha512");
             hash.update(buf);
             const computed = `sha512-${hash.digest("base64")}`;
@@ -1027,15 +1054,21 @@ var PackageInfoClient = class {
       case "registry": {
         const mani = await this.manifest(spec, options);
         if (mani.dist) {
-          const { integrity, tarball, signatures } = mani.dist;
+          const { integrity, tarball, signatures, alternates } = mani.dist;
           if (tarball) {
-            const r = {
-              resolved: tarball,
-              integrity,
-              signatures,
-              spec
-            };
-            if (!integrity && this.#vltPackuments.has(`${f.registry}${f.name}`)) {
+            const brotli = this.#brotliTarball(tarball, alternates);
+            const r = brotli ? {
+              resolved: brotli.tarball,
+              spec,
+              // Pin the alternate's own hash if the registry sent
+              // one. That also means we can look the package up in
+              // the global store before downloading it. If there is
+              // no hash, the Repr-Digest header is the only check we
+              // get, so require it instead of treating it as
+              // optional.
+              ...brotli.integrity ? { integrity: brotli.integrity } : { digestRequired: true }
+            } : { resolved: tarball, integrity, signatures, spec };
+            if (!brotli && !integrity && this.#vltPackuments.has(`${f.registry}${f.name}`)) {
               r.digestRequired = true;
             }
             this.#resolutions.set(memoKey, r);

package/{chunk-FOJCK57G.js → chunk-U3WCCLFD.js}

@@ -13,10 +13,10 @@ import {
   asDepID,
   baseDepID,
   splitDepID
-} from "./chunk-SYGF27W7.js";
+} from "./chunk-JIQBZ2UT.js";
 import {
   userAgent
-} from "./chunk-JTUZP2OD.js";
+} from "./chunk-LCAH3OGR.js";
 import {
   I
 } from "./chunk-U7TEQCBN.js";
@@ -25,7 +25,7 @@ import {
 } from "./chunk-XNLSTHDK.js";
 import {
   defaultRegistryName
-} from "./chunk-G5BSQ6DP.js";
+} from "./chunk-BP3PQ67D.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-QA6RE2GS.js → chunk-X2WYIUFQ.js}

@@ -12,11 +12,11 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   rimraf,
   rimrafSync
-} from "./chunk-BHJT53TP.js";
+} from "./chunk-PDWPFR5T.js";
 import {
   isManifest,
   normalizeBinPaths
-} from "./chunk-G5BSQ6DP.js";
+} from "./chunk-BP3PQ67D.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -87,7 +87,13 @@ import {
   statSync,
   writeFileSync
 } from "node:fs";
-import { lstat, mkdir, rename, writeFile } from "node:fs/promises";
+import {
+  lstat,
+  mkdir,
+  readFile,
+  rename,
+  writeFile
+} from "node:fs/promises";
 import {
   basename as basename2,
   dirname,
@@ -590,7 +596,12 @@ var parseKVLine = (set, line) => {
 };
 
 // ../../src/tar/src/unpack.ts
-import { unzip as unzipCB, unzipSync as unzipSyncCB } from "node:zlib";
+import {
+  brotliDecompress as brotliCB,
+  brotliDecompressSync as brotliSyncCB,
+  unzip as unzipCB,
+  unzipSync as unzipSyncCB
+} from "node:zlib";
 
 // ../../src/tar/src/find-tar-dir.ts
 var findTarDir = (path, tarDir) => {
@@ -639,6 +650,27 @@ var unzipSync = (input) => {
     throw unzipError(er, input.length, max);
   }
 };
+var isGzip = (b) => b[0] === 31 && b[1] === 139;
+var brotli = async (input) => {
+  const max = unzipMax(input.length);
+  return new Promise(
+    (res, rej) => brotliCB(
+      input,
+      { maxOutputLength: max },
+      (er, result) => er ? rej(unzipError(er, input.length, max)) : res(result)
+    )
+  );
+};
+var brotliSync = (input) => {
+  const max = unzipMax(input.length);
+  try {
+    return brotliSyncCB(input, { maxOutputLength: max });
+  } catch (er) {
+    throw unzipError(er, input.length, max);
+  }
+};
+var decompress = async (input, format) => format === "brotli" ? brotli(input) : isGzip(input) ? unzip(input) : input;
+var decompressSync = (input, format) => format === "brotli" ? brotliSync(input) : isGzip(input) ? unzipSync(input) : input;
 var exists = async (path) => {
   try {
     await lstat(path);
@@ -737,24 +769,26 @@ var write = async (path, body, executable = false) => {
     mode: executable ? 511 : 438
   });
 };
-var unpack = async (tarData, target) => {
-  const isGzip = tarData[0] === 31 && tarData[1] === 139;
-  await unpackUnzipped(
-    isGzip ? await unzip(tarData) : tarData,
-    target
-  );
+var unpack = async (tarData, target, format) => {
+  await unpackUnzipped(await decompress(tarData, format), target);
 };
-var unpackSync = (tarData, target) => {
-  const isGzip = tarData[0] === 31 && tarData[1] === 139;
-  unpackUnzippedSync(isGzip ? unzipSync(tarData) : tarData, target);
+var unpackSync = (tarData, target, format) => {
+  unpackUnzippedSync(decompressSync(tarData, format), target);
 };
-var unpackFileSync = (file, target, offset = 0) => unpackSync(readFileSync2(file).subarray(offset), target);
+var unpackParallel = async (tarData, target, format) => {
+  unpackUnzippedSync(await decompress(tarData, format), target);
+};
+var unpackFileParallel = async (file, target, offset = 0, format) => unpackParallel(
+  (await readFile(file)).subarray(offset),
+  target,
+  format
+);
+var unpackFileSync = (file, target, offset = 0, format) => unpackSync(readFileSync2(file).subarray(offset), target, format);
 var tmpName = (target) => dirname(target) + sep + "." + basename2(target) + "." + tmpSuffix();
 var parseTarball = (buffer, tmp2) => {
-  const isGzip = buffer[0] === 31 && buffer[1] === 139;
-  if (isGzip) {
+  if (isGzip(buffer)) {
     throw error("still gzipped after unzipping", {
-      found: isGzip,
+      found: true,
       wanted: false
     });
   }
@@ -923,10 +957,9 @@ var unpackUnzippedSync = (buffer, target) => {
     }
   }
 };
-var storeLayout = (tarData, dir) => {
-  const isGzip = tarData[0] === 31 && tarData[1] === 139;
+var storeLayout = (tarData, dir, format) => {
   const { dirs, files } = parseTarball(
-    isGzip ? unzipSync(tarData) : tarData,
+    decompressSync(tarData, format),
     dir
   );
   const rel = (p) => relative(dir, p).replace(/\\/g, "/");
@@ -968,8 +1001,8 @@ var storeLayout = (tarData, dir) => {
     binFiles
   };
 };
-var unpackToStoreSync = (tarData, dir) => {
-  const { index, files, binFiles } = storeLayout(tarData, dir);
+var unpackToStoreSync = (tarData, dir, format) => {
+  const { index, files, binFiles } = storeLayout(tarData, dir, format);
   mkdirSync(dirname(dir), { recursive: true });
   mkdirSync(dir, { mode: 511 });
   let succeeded = false;
@@ -1101,6 +1134,8 @@ export {
   readStoreIndex,
   unpack,
   unpackSync,
+  unpackParallel,
+  unpackFileParallel,
   unpackFileSync,
   tmpName,
   unpackToStoreSync,

package/{chunk-VE6CCH33.js → chunk-Y5PA7DVK.js}

@@ -2995,6 +2995,7 @@ var Ze = Object.assign(Je, { glob: Je, globSync: ts, sync: Ui, globStream: Qe, s
 Ze.glob = Ze;
 
 export {
+  ot,
   ts,
   Ze
 };