@westbayberry/dg 2.0.11 → 2.2.0

package/dist/proxy/metadata-map.js

@@ -1,13 +1,15 @@
 import { createHash } from "node:crypto";
+import { brotliDecompressSync, gunzipSync, inflateRawSync, inflateSync } from "node:zlib";
 export function extractRegistryMetadataIdentities(metadataUrl, response) {
+    const decoded = { headers: response.headers, body: decodeContentEncoding(response.headers, response.body) };
     // PyPI Simple index (PEP 503 HTML or PEP 691 JSON) — the pip/uv/pipx flow.
     if (isPypiSimpleIndexUrl(metadataUrl)) {
-        return extractPypiSimpleIdentities(metadataUrl, response);
+        return extractPypiSimpleIdentities(metadataUrl, decoded);
     }
-    if (!looksLikeJson(response.headers["content-type"])) {
+    if (!looksLikeJson(decoded.headers["content-type"])) {
         return [];
     }
-    const parsed = parseJson(response.body);
+    const parsed = parseJson(decoded.body);
     if (!isRecord(parsed)) {
         return [];
     }
@@ -16,6 +18,42 @@ export function extractRegistryMetadataIdentities(metadataUrl, response) {
         ...extractPypiIdentities(metadataUrl, parsed)
     ];
 }
+// Content-Encoding lists encodings in the order they were applied; decode in
+// reverse. Any unknown token or decode failure returns the body untouched so
+// the response falls back to artifact handling instead of crashing the proxy.
+function decodeContentEncoding(headers, body) {
+    const raw = headers["content-encoding"];
+    const encodings = (Array.isArray(raw) ? raw.join(",") : String(raw ?? ""))
+        .split(",")
+        .map((token) => token.trim().toLowerCase())
+        .filter((token) => token.length > 0 && token !== "identity");
+    let decoded = body;
+    for (const encoding of encodings.reverse()) {
+        try {
+            if (encoding === "gzip" || encoding === "x-gzip") {
+                decoded = gunzipSync(decoded);
+            }
+            else if (encoding === "br") {
+                decoded = brotliDecompressSync(decoded);
+            }
+            else if (encoding === "deflate") {
+                try {
+                    decoded = inflateSync(decoded);
+                }
+                catch {
+                    decoded = inflateRawSync(decoded);
+                }
+            }
+            else {
+                return body;
+            }
+        }
+        catch {
+            return body;
+        }
+    }
+    return decoded;
+}
 // A registry INDEX/metadata request (not an artifact download). These must be
 // passed through untouched — never verified as a package — so e.g. pip's
 // `pypi.org/simple/<pkg>/` index is not mistaken for a package named "simple".
@@ -202,7 +240,9 @@ function fallbackIdentity(artifactUrl, classification) {
     const ecosystem = ecosystemForManager(classification.manager);
     const parsed = ecosystem === "pypi"
         ? parsePypiArtifactFilename(decodeURIComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "")) ?? parsePackageVersionFromUrl(artifactUrl)
-        : parsePackageVersionFromUrl(artifactUrl);
+        : ecosystem === "cargo"
+            ? parseCargoArtifactUrl(artifactUrl) ?? parsePackageVersionFromUrl(artifactUrl)
+            : parsePackageVersionFromUrl(artifactUrl);
     const requested = requestedIdentityFromArgs(classification, parsed.name);
     return {
         ecosystem,
@@ -213,6 +253,28 @@ function fallbackIdentity(artifactUrl, classification) {
         sourceKind: "url-fallback"
     };
 }
+// crates.io serves downloads at /api/v1/crates/{name}/{version}/download,
+// static.crates.io at /crates/{name}/{version}/download and as
+// {name}-{version}.crate files. Crate versions always start with a digit
+// (semver), so the filename split is unambiguous even for names with dashes.
+function parseCargoArtifactUrl(artifactUrl) {
+    const downloadMatch = /^\/(?:api\/v1\/)?crates\/([^/]+)\/([^/]+)\/download\/?$/.exec(artifactUrl.pathname);
+    if (downloadMatch && downloadMatch[1] && downloadMatch[2]) {
+        return {
+            name: decodeURIComponent(downloadMatch[1]),
+            version: decodeURIComponent(downloadMatch[2])
+        };
+    }
+    const file = decodeURIComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "");
+    if (/\.crate$/i.test(file)) {
+        const stem = file.slice(0, -".crate".length);
+        const match = /^(.+)-(\d[0-9A-Za-z.+-]*)$/.exec(stem);
+        if (match && match[1] && match[2]) {
+            return { name: match[1], version: match[2] };
+        }
+    }
+    return null;
+}
 function parsePackageVersionFromUrl(artifactUrl) {
     const parts = artifactUrl.pathname.split("/").filter(Boolean).map((part) => decodeURIComponent(part));
     const file = parts.at(-1) ?? artifactUrl.hostname;

package/dist/proxy/preverified.js

@@ -0,0 +1,55 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+const PREVERIFIED_FILE = "preverified.json";
+export function preverifiedKey(ecosystem, name, version) {
+    const canonicalName = ecosystem === "pypi" ? name.toLowerCase().replace(/[-_.]+/g, "-") : name;
+    return `${ecosystem}:${canonicalName}@${version}`;
+}
+export function writePreverifiedFile(sessionDir, entries) {
+    writeFileSync(join(sessionDir, PREVERIFIED_FILE), `${JSON.stringify(entries)}\n`, {
+        encoding: "utf8",
+        mode: 0o600
+    });
+}
+let loaded = null;
+export function loadPreverifiedMap(sessionDir) {
+    if (loaded?.dir === sessionDir) {
+        return loaded.map;
+    }
+    const path = join(sessionDir, PREVERIFIED_FILE);
+    if (!existsSync(path)) {
+        return new Map();
+    }
+    const map = new Map();
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (Array.isArray(parsed)) {
+            for (const entry of parsed) {
+                if (isPreverifiedEntry(entry)) {
+                    map.set(preverifiedKey(entry.ecosystem, entry.name, entry.version), entry);
+                }
+            }
+        }
+    }
+    catch {
+        return new Map();
+    }
+    loaded = { dir: sessionDir, map };
+    return map;
+}
+export function resetPreverifiedCache() {
+    loaded = null;
+}
+function isPreverifiedEntry(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const entry = value;
+    return ((entry.ecosystem === "npm" || entry.ecosystem === "pypi") &&
+        typeof entry.name === "string" && entry.name.length > 0 &&
+        typeof entry.version === "string" && entry.version.length > 0 &&
+        (entry.action === "pass" || entry.action === "warn") &&
+        (entry.reason === undefined || typeof entry.reason === "string") &&
+        (entry.scannedSha256 === undefined || typeof entry.scannedSha256 === "string") &&
+        typeof entry.cooldownEvaluated === "boolean");
+}