@zhuoyuezs/ml-platform 0.2.0 → 0.2.2-alpha.0

package/runtime/business-client/src/http.js

@@ -1,254 +1,324 @@
 "use strict";
-
+Object.defineProperty(exports, "__esModule", { value: true });
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
 const zlib = require("zlib");
 const { expandHome } = require("./config");
-
 class PlatformApiClient {
-  constructor(baseUrl, timeoutSeconds = 30) {
-    this.baseUrl = String(baseUrl).trim().replace(/\/+$/, "");
-    if (!/^https?:\/\//.test(this.baseUrl)) throw new Error("server profile api_url must start with http:// or https://");
-    if (!(timeoutSeconds > 0)) throw new Error("request timeout must be positive");
-    this.timeoutMs = timeoutSeconds * 1000;
-  }
-
-  url(endpoint, params = {}) {
-    const url = new URL(endpoint.replace(/^\//, ""), `${this.baseUrl}/`);
-    for (const [key, value] of Object.entries(params)) {
-      if (value !== null && value !== undefined) url.searchParams.set(key, typeof value === "boolean" ? String(value) : value);
+    constructor(baseUrl, timeoutSeconds = 30) {
+        this.baseUrl = String(baseUrl).trim().replace(/\/+$/, "");
+        if (!/^https?:\/\//.test(this.baseUrl))
+            throw new Error("server profile api_url must start with http:// or https://");
+        if (!(timeoutSeconds > 0))
+            throw new Error("request timeout must be positive");
+        this.timeoutMs = timeoutSeconds * 1000;
     }
-    return url;
-  }
-
-  async request(method, endpoint, { params, payload, body, contentType } = {}) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    const headers = { Accept: "application/json" };
-    let requestBody = body;
-    if (payload !== undefined) {
-      headers["Content-Type"] = "application/json";
-      requestBody = JSON.stringify(payload);
-    } else if (contentType) headers["Content-Type"] = contentType;
-    let response;
-    try { response = await fetch(this.url(endpoint, params), { method, headers, body: requestBody, signal: controller.signal }); }
-    catch (error) { throw new Error(`platform API request failed: ${method} ${this.url(endpoint, params)}: ${error.message}`); }
-    finally { clearTimeout(timer); }
-    const text = await response.text();
-    let result;
-    try { result = JSON.parse(text); } catch (_) { throw new Error("platform API returned invalid JSON"); }
-    if (!response.ok) throw new Error(`platform API request failed: ${method} ${response.url}: HTTP ${response.status}: ${result?.detail ?? response.statusText}`);
-    if (!result || typeof result !== "object") throw new Error("platform API returned an unsupported JSON response");
-    return result;
-  }
-
-  get(endpoint, params) { return this.request("GET", endpoint, { params }); }
-  post(endpoint, payload, params) { return this.request("POST", endpoint, { payload, params }); }
-  put(endpoint, payload, params) { return this.request("PUT", endpoint, { payload, params }); }
-  delete(endpoint, params) { return this.request("DELETE", endpoint, { params }); }
-  uploadOperatorPackage(project, name, version, packagePath) {
-    const resolved = path.resolve(expandHome(packagePath));
-    if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) throw new Error(`operator package not found: ${resolved}`);
-    return this.request("POST", `/operator-packages/${encodeURIComponent(project)}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`, {
-      params: { filename: path.basename(resolved) }, body: fs.readFileSync(resolved), contentType: "application/octet-stream",
-    });
-  }
-
-  async downloadDatasetArtifact(project, datasetId, manifestHash, outputDir, force = false) {
-    const target = path.resolve(expandHome(outputDir));
-    if (fs.existsSync(target) && fs.readdirSync(target).length) {
-      if (!force) throw new Error(`download output directory is not empty: ${target}`);
-      fs.rmSync(target, { recursive: true, force: true });
-    }
-    fs.mkdirSync(target, { recursive: true });
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    const temporaryDir = fs.mkdtempSync(path.join(os.tmpdir(), "data-platform-artifact-download-"));
-    const temporary = path.join(temporaryDir, "artifact.zip");
-    let response;
-    try {
-      response = await fetch(this.url(`/dataset-artifacts/${encodeURIComponent(project)}/${encodeURIComponent(datasetId)}/${encodeURIComponent(manifestHash)}/download`), { headers: { Accept: "application/zip" }, signal: controller.signal });
-      if (!response.ok) {
-        let detail = response.statusText;
-        try { detail = JSON.parse(await abortable(response.text(), controller.signal))?.detail ?? detail; } catch (_) { /* use status text */ }
-        throw new Error(`artifact download failed: HTTP ${response.status}: ${detail}`);
-      }
-      const total = contentLength(response);
-      let lastReported = -1;
-      const report = (received, complete = false) => {
-        if ((complete && received !== lastReported) || received === 0 || received - lastReported >= 1024 * 1024) {
-          reportDownloadProgress(received, total);
-          lastReported = received;
-        }
-      };
-      report(0);
-      await writeResponseBody(response, temporary, controller.signal, report);
-      const files = await extractArchive(temporary, target);
-      return { dataset_id: datasetId, manifest_hash: manifestHash, output_dir: target, file_count: files.length, files };
-    } catch (error) {
-      fs.rmSync(target, { recursive: true, force: true });
-      if (error instanceof Error && error.message.startsWith("artifact download failed:")) throw error;
-      throw new Error(`artifact download failed: ${error.message}`);
-    } finally {
-      clearTimeout(timer);
-      fs.rmSync(temporaryDir, { recursive: true, force: true });
+    url(endpoint, params = {}) {
+        const url = new URL(endpoint.replace(/^\//, ""), `${this.baseUrl}/`);
+        for (const [key, value] of Object.entries(params)) {
+            if (value !== null && value !== undefined)
+                url.searchParams.set(key, typeof value === "boolean" ? String(value) : value);
+        }
+        return url;
     }
-  }
-
-  async downloadDatasetArtifactFiles(project, datasetId, manifestHash, relativePaths, outputDir, force = false) {
-    const files = [...new Set((relativePaths || []).map((value) => String(value)))];
-    if (!files.length) throw new Error("at least one artifact file is required");
-    for (const relative of files) {
-      const normalized = relative.replace(/\\/g, "/");
-      const parts = normalized.split("/");
-      if (!normalized || normalized.startsWith("/") || normalized.endsWith("/") || parts.includes("..")) {
-        throw new Error(`artifact path escapes output directory: ${JSON.stringify(relative)}`);
-      }
+    async request(method, endpoint, { params, payload, body, contentType } = {}) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        const headers = { Accept: "application/json" };
+        let requestBody = body;
+        if (payload !== undefined) {
+            headers["Content-Type"] = "application/json";
+            requestBody = JSON.stringify(payload);
+        }
+        else if (contentType)
+            headers["Content-Type"] = contentType;
+        let response;
+        try {
+            response = await fetch(this.url(endpoint, params), { method, headers, body: requestBody, signal: controller.signal });
+        }
+        catch (error) {
+            throw new Error(`platform API request failed: ${method} ${this.url(endpoint, params)}: ${error.message}`);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const text = await response.text();
+        let result;
+        try {
+            result = JSON.parse(text);
+        }
+        catch (_) {
+            throw new Error("platform API returned invalid JSON");
+        }
+        if (!response.ok)
+            throw new Error(`platform API request failed: ${method} ${response.url}: HTTP ${response.status}: ${result?.detail ?? response.statusText}`);
+        if (!result || typeof result !== "object")
+            throw new Error("platform API returned an unsupported JSON response");
+        return result;
     }
-    const targetRoot = path.resolve(expandHome(outputDir));
-    if (fs.existsSync(targetRoot) && fs.readdirSync(targetRoot).length) {
-      if (!force) throw new Error(`download output directory is not empty: ${targetRoot}`);
-      fs.rmSync(targetRoot, { recursive: true, force: true });
+    get(endpoint, params) { return this.request("GET", endpoint, { params }); }
+    post(endpoint, payload, params) { return this.request("POST", endpoint, { payload, params }); }
+    put(endpoint, payload, params) { return this.request("PUT", endpoint, { payload, params }); }
+    delete(endpoint, params) { return this.request("DELETE", endpoint, { params }); }
+    uploadOperatorPackage(project, name, version, packagePath) {
+        const resolved = path.resolve(expandHome(packagePath));
+        if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile())
+            throw new Error(`operator package not found: ${resolved}`);
+        return this.request("POST", `/operator-packages/${encodeURIComponent(project)}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`, {
+            params: { filename: path.basename(resolved) }, body: fs.readFileSync(resolved), contentType: "application/octet-stream",
+        });
     }
-    fs.mkdirSync(targetRoot, { recursive: true });
-    try {
-      for (const relative of files) {
-        const normalized = relative.replace(/\\/g, "/");
-        const parts = normalized.split("/");
-        const destination = path.resolve(targetRoot, ...parts);
-        if (!normalized || normalized.startsWith("/") || normalized.endsWith("/")
-          || parts.includes("..") || destination !== targetRoot && !destination.startsWith(`${targetRoot}${path.sep}`)) {
-          throw new Error(`artifact path escapes output directory: ${JSON.stringify(relative)}`);
-        }
-        fs.mkdirSync(path.dirname(destination), { recursive: true });
-        const endpoint = `/dataset-artifacts/${encodeURIComponent(project)}/${encodeURIComponent(datasetId)}/${encodeURIComponent(manifestHash)}/files/${parts.map(encodeURIComponent).join("/")}`;
+    async downloadDatasetArtifact(project, datasetId, manifestHash, outputDir, force = false) {
+        const target = path.resolve(expandHome(outputDir));
+        if (fs.existsSync(target) && fs.readdirSync(target).length) {
+            if (!force)
+                throw new Error(`download output directory is not empty: ${target}`);
+            fs.rmSync(target, { recursive: true, force: true });
+        }
+        fs.mkdirSync(target, { recursive: true });
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        const temporaryDir = fs.mkdtempSync(path.join(os.tmpdir(), "data-platform-artifact-download-"));
+        const temporary = path.join(temporaryDir, "artifact.zip");
+        let response;
+        try {
+            response = await fetch(this.url(`/dataset-artifacts/${encodeURIComponent(project)}/${encodeURIComponent(datasetId)}/${encodeURIComponent(manifestHash)}/download`), { headers: { Accept: "application/zip" }, signal: controller.signal });
+            if (!response.ok) {
+                let detail = response.statusText;
+                try {
+                    detail = JSON.parse(await abortable(response.text(), controller.signal))?.detail ?? detail;
+                }
+                catch (_) { /* use status text */ }
+                throw new Error(`artifact download failed: HTTP ${response.status}: ${detail}`);
+            }
+            const total = contentLength(response);
+            let lastReported = -1;
+            const report = (received, complete = false) => {
+                if ((complete && received !== lastReported) || received === 0 || received - lastReported >= 1024 * 1024) {
+                    reportDownloadProgress(received, total);
+                    lastReported = received;
+                }
+            };
+            report(0);
+            await writeResponseBody(response, temporary, controller.signal, report);
+            const files = await extractArchive(temporary, target);
+            return { dataset_id: datasetId, manifest_hash: manifestHash, output_dir: target, file_count: files.length, files };
+        }
+        catch (error) {
+            fs.rmSync(target, { recursive: true, force: true });
+            if (error instanceof Error && error.message.startsWith("artifact download failed:"))
+                throw error;
+            throw new Error(`artifact download failed: ${error.message}`);
+        }
+        finally {
+            clearTimeout(timer);
+            fs.rmSync(temporaryDir, { recursive: true, force: true });
+        }
+    }
+    async downloadDatasetArtifactFiles(project, datasetId, manifestHash, relativePaths, outputDir, force = false) {
+        const files = [...new Set((relativePaths || []).map((value) => String(value)))];
+        if (!files.length)
+            throw new Error("at least one artifact file is required");
+        for (const relative of files) {
+            const normalized = relative.replace(/\\/g, "/");
+            const parts = normalized.split("/");
+            if (!normalized || normalized.startsWith("/") || normalized.endsWith("/") || parts.includes("..")) {
+                throw new Error(`artifact path escapes output directory: ${JSON.stringify(relative)}`);
+            }
+        }
+        const targetRoot = path.resolve(expandHome(outputDir));
+        if (fs.existsSync(targetRoot) && fs.readdirSync(targetRoot).length) {
+            if (!force)
+                throw new Error(`download output directory is not empty: ${targetRoot}`);
+            fs.rmSync(targetRoot, { recursive: true, force: true });
+        }
+        fs.mkdirSync(targetRoot, { recursive: true });
         try {
-          const response = await fetch(this.url(endpoint), { headers: { Accept: "application/octet-stream" }, signal: controller.signal });
-          if (!response.ok) {
-            let detail = response.statusText;
-            try { detail = JSON.parse(await response.text())?.detail ?? detail; } catch (_) { /* status text */ }
-            throw new Error(`artifact file download failed: HTTP ${response.status}: ${detail}`);
-          }
-          fs.writeFileSync(destination, Buffer.from(await response.arrayBuffer()), { flag: "wx" });
-        } finally { clearTimeout(timer); }
-      }
-    } catch (error) {
-      fs.rmSync(targetRoot, { recursive: true, force: true });
-      throw error;
+            for (const relative of files) {
+                const normalized = relative.replace(/\\/g, "/");
+                const parts = normalized.split("/");
+                const destination = path.resolve(targetRoot, ...parts);
+                if (!normalized || normalized.startsWith("/") || normalized.endsWith("/")
+                    || parts.includes("..") || destination !== targetRoot && !destination.startsWith(`${targetRoot}${path.sep}`)) {
+                    throw new Error(`artifact path escapes output directory: ${JSON.stringify(relative)}`);
+                }
+                fs.mkdirSync(path.dirname(destination), { recursive: true });
+                const endpoint = `/dataset-artifacts/${encodeURIComponent(project)}/${encodeURIComponent(datasetId)}/${encodeURIComponent(manifestHash)}/files/${parts.map(encodeURIComponent).join("/")}`;
+                const controller = new AbortController();
+                const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+                try {
+                    const response = await fetch(this.url(endpoint), { headers: { Accept: "application/octet-stream" }, signal: controller.signal });
+                    if (!response.ok) {
+                        let detail = response.statusText;
+                        try {
+                            detail = JSON.parse(await response.text())?.detail ?? detail;
+                        }
+                        catch (_) { /* status text */ }
+                        throw new Error(`artifact file download failed: HTTP ${response.status}: ${detail}`);
+                    }
+                    fs.writeFileSync(destination, Buffer.from(await response.arrayBuffer()), { flag: "wx" });
+                }
+                finally {
+                    clearTimeout(timer);
+                }
+            }
+        }
+        catch (error) {
+            fs.rmSync(targetRoot, { recursive: true, force: true });
+            throw error;
+        }
+        return { project, dataset_id: datasetId, manifest_hash: manifestHash, output_dir: targetRoot, file_count: files.length, files: files.sort() };
     }
-    return { project, dataset_id: datasetId, manifest_hash: manifestHash, output_dir: targetRoot, file_count: files.length, files: files.sort() };
-  }
 }
-
 function contentLength(response) {
-  const raw = response.headers?.get?.("content-length") ?? response.headers?.["content-length"];
-  const value = Number(raw);
-  return Number.isFinite(value) && value >= 0 ? value : null;
+    const raw = response.headers?.get?.("content-length") ?? response.headers?.["content-length"];
+    const value = Number(raw);
+    return Number.isFinite(value) && value >= 0 ? value : null;
 }
-
 function reportDownloadProgress(received, total) {
-  const suffix = total == null ? "" : `/${total}`;
-  process.stderr.write(`artifact download: received ${received}${suffix} bytes\n`);
+    const suffix = total == null ? "" : `/${total}`;
+    process.stderr.write(`artifact download: received ${received}${suffix} bytes\n`);
 }
-
 function abortable(value, signal) {
-  if (signal.aborted) return Promise.reject(new Error("This operation was aborted"));
-  return new Promise((resolve, reject) => {
-    const onAbort = () => { cleanup(); reject(new Error("This operation was aborted")); };
-    const cleanup = () => signal.removeEventListener("abort", onAbort);
-    signal.addEventListener("abort", onAbort, { once: true });
-    Promise.resolve(value).then((result) => { cleanup(); resolve(result); }, (error) => { cleanup(); reject(error); });
-  });
+    if (signal.aborted)
+        return Promise.reject(new Error("This operation was aborted"));
+    return new Promise((resolve, reject) => {
+        const onAbort = () => { cleanup(); reject(new Error("This operation was aborted")); };
+        const cleanup = () => signal.removeEventListener("abort", onAbort);
+        signal.addEventListener("abort", onAbort, { once: true });
+        Promise.resolve(value).then((result) => { cleanup(); resolve(result); }, (error) => { cleanup(); reject(error); });
+    });
 }
-
 async function writeResponseBody(response, outputPath, signal, onProgress) {
-  const handle = fs.openSync(outputPath, "w");
-  let received = 0;
-  try {
-    const write = (value) => {
-      const chunk = Buffer.from(value);
-      fs.writeSync(handle, chunk);
-      received += chunk.length;
-      onProgress(received);
-    };
-    if (response.body?.getReader) {
-      const reader = response.body.getReader();
-      while (true) {
-        const item = await abortable(reader.read(), signal);
-        if (item.done) break;
-        write(item.value);
-      }
-    } else if (response.body?.[Symbol.asyncIterator]) {
-      const iterator = response.body[Symbol.asyncIterator]();
-      while (true) {
-        const item = await abortable(iterator.next(), signal);
-        if (item.done) break;
-        write(item.value);
-      }
-    } else if (typeof response.arrayBuffer === "function") {
-      write(await abortable(response.arrayBuffer(), signal));
-    } else {
-      throw new Error("artifact download response has no readable body");
+    const handle = fs.openSync(outputPath, "w");
+    let received = 0;
+    try {
+        const write = (value) => {
+            const chunk = Buffer.from(value);
+            fs.writeSync(handle, chunk);
+            received += chunk.length;
+            onProgress(received);
+        };
+        if (response.body?.getReader) {
+            const reader = response.body.getReader();
+            while (true) {
+                const item = await abortable(reader.read(), signal);
+                if (item.done)
+                    break;
+                write(item.value);
+            }
+        }
+        else if (response.body?.[Symbol.asyncIterator]) {
+            const iterator = response.body[Symbol.asyncIterator]();
+            while (true) {
+                const item = await abortable(iterator.next(), signal);
+                if (item.done)
+                    break;
+                write(item.value);
+            }
+        }
+        else if (typeof response.arrayBuffer === "function") {
+            write(await abortable(response.arrayBuffer(), signal));
+        }
+        else {
+            throw new Error("artifact download response has no readable body");
+        }
+        onProgress(received, true);
+    }
+    finally {
+        fs.closeSync(handle);
     }
-    onProgress(received, true);
-  } finally {
-    fs.closeSync(handle);
-  }
 }
-
 async function extractArchive(archivePath, outputDir) {
-  const archive = fs.readFileSync(archivePath);
-  const end = findEndOfCentralDirectory(archive);
-  const entryCount = archive.readUInt16LE(end + 10);
-  const centralSize = archive.readUInt32LE(end + 12);
-  const centralOffset = archive.readUInt32LE(end + 16);
-  if (entryCount === 0xffff || centralSize === 0xffffffff || centralOffset === 0xffffffff) throw new Error("artifact archive ZIP64 format is unsupported");
-  if (centralOffset + centralSize > end) throw new Error("artifact archive central directory is invalid");
-  const files = [];
-  const names = new Set();
-  let cursor = centralOffset;
-  for (let index = 0; index < entryCount; index += 1) {
-    if (cursor + 46 > archive.length || archive.readUInt32LE(cursor) !== 0x02014b50) throw new Error("artifact archive central directory is invalid");
-    const flags = archive.readUInt16LE(cursor + 8); const method = archive.readUInt16LE(cursor + 10);
-    const crc = archive.readUInt32LE(cursor + 16); const compressedSize = archive.readUInt32LE(cursor + 20); const size = archive.readUInt32LE(cursor + 24);
-    const nameLength = archive.readUInt16LE(cursor + 28); const extraLength = archive.readUInt16LE(cursor + 30); const commentLength = archive.readUInt16LE(cursor + 32);
-    const attributes = archive.readUInt32LE(cursor + 38); const localOffset = archive.readUInt32LE(cursor + 42);
-    const next = cursor + 46 + nameLength + extraLength + commentLength;
-    if (next > archive.length || compressedSize === 0xffffffff || size === 0xffffffff || localOffset === 0xffffffff) throw new Error("artifact archive entry metadata is invalid");
-    if (flags & 1) throw new Error("artifact archive contains an encrypted entry");
-    if (![0, 8].includes(method)) throw new Error(`artifact archive compression method is unsupported: ${method}`);
-    const rawNameBytes = archive.subarray(cursor + 46, cursor + 46 + nameLength);
-    const rawName = decodeZipFilename(rawNameBytes, flags);
-    const name = rawName.replace(/\\/g, "/"); const parts = name.split("/"); const mode = (attributes >>> 16) & 0xffff;
-    if (!name || name.startsWith("/") || /^[A-Za-z]:/.test(name) || parts.includes("..")) throw new Error(`artifact archive contains unsafe path: ${JSON.stringify(rawName)}`);
-    if ((mode & 0o170000) === 0o120000) throw new Error(`artifact archive contains a symbolic link: ${JSON.stringify(rawName)}`);
-    if (names.has(name)) throw new Error(`artifact archive contains duplicate path: ${JSON.stringify(rawName)}`); names.add(name);
-    const targetRoot = path.resolve(outputDir); const target = path.resolve(targetRoot, ...parts);
-    if (target !== targetRoot && !target.startsWith(`${targetRoot}${path.sep}`)) throw new Error(`artifact archive path escapes output directory: ${JSON.stringify(rawName)}`);
-    if (name.endsWith("/")) { fs.mkdirSync(target, { recursive: true }); cursor = next; continue; }
-    if (localOffset + 30 > archive.length || archive.readUInt32LE(localOffset) !== 0x04034b50) throw new Error("artifact archive local entry is invalid");
-    const localNameLength = archive.readUInt16LE(localOffset + 26); const localExtraLength = archive.readUInt16LE(localOffset + 28); const dataOffset = localOffset + 30 + localNameLength + localExtraLength;
-    if (dataOffset + compressedSize > archive.length) throw new Error("artifact archive entry data is truncated");
-    const compressed = archive.subarray(dataOffset, dataOffset + compressedSize); const content = method === 0 ? compressed : zlib.inflateRawSync(compressed);
-    if (content.length !== size || crc32(content) !== crc) throw new Error(`artifact archive entry integrity check failed: ${JSON.stringify(rawName)}`);
-    fs.mkdirSync(path.dirname(target), { recursive: true }); fs.writeFileSync(target, content, { flag: "wx" }); files.push(name); cursor = next;
-  }
-  if (cursor !== centralOffset + centralSize) throw new Error("artifact archive central directory size is invalid");
-  return files.sort();
+    const archive = fs.readFileSync(archivePath);
+    const end = findEndOfCentralDirectory(archive);
+    const entryCount = archive.readUInt16LE(end + 10);
+    const centralSize = archive.readUInt32LE(end + 12);
+    const centralOffset = archive.readUInt32LE(end + 16);
+    if (entryCount === 0xffff || centralSize === 0xffffffff || centralOffset === 0xffffffff)
+        throw new Error("artifact archive ZIP64 format is unsupported");
+    if (centralOffset + centralSize > end)
+        throw new Error("artifact archive central directory is invalid");
+    const files = [];
+    const names = new Set();
+    let cursor = centralOffset;
+    for (let index = 0; index < entryCount; index += 1) {
+        if (cursor + 46 > archive.length || archive.readUInt32LE(cursor) !== 0x02014b50)
+            throw new Error("artifact archive central directory is invalid");
+        const flags = archive.readUInt16LE(cursor + 8);
+        const method = archive.readUInt16LE(cursor + 10);
+        const crc = archive.readUInt32LE(cursor + 16);
+        const compressedSize = archive.readUInt32LE(cursor + 20);
+        const size = archive.readUInt32LE(cursor + 24);
+        const nameLength = archive.readUInt16LE(cursor + 28);
+        const extraLength = archive.readUInt16LE(cursor + 30);
+        const commentLength = archive.readUInt16LE(cursor + 32);
+        const attributes = archive.readUInt32LE(cursor + 38);
+        const localOffset = archive.readUInt32LE(cursor + 42);
+        const next = cursor + 46 + nameLength + extraLength + commentLength;
+        if (next > archive.length || compressedSize === 0xffffffff || size === 0xffffffff || localOffset === 0xffffffff)
+            throw new Error("artifact archive entry metadata is invalid");
+        if (flags & 1)
+            throw new Error("artifact archive contains an encrypted entry");
+        if (![0, 8].includes(method))
+            throw new Error(`artifact archive compression method is unsupported: ${method}`);
+        const rawNameBytes = archive.subarray(cursor + 46, cursor + 46 + nameLength);
+        const rawName = decodeZipFilename(rawNameBytes, flags);
+        const name = rawName.replace(/\\/g, "/");
+        const parts = name.split("/");
+        const mode = (attributes >>> 16) & 0xffff;
+        if (!name || name.startsWith("/") || /^[A-Za-z]:/.test(name) || parts.includes(".."))
+            throw new Error(`artifact archive contains unsafe path: ${JSON.stringify(rawName)}`);
+        if ((mode & 0o170000) === 0o120000)
+            throw new Error(`artifact archive contains a symbolic link: ${JSON.stringify(rawName)}`);
+        if (names.has(name))
+            throw new Error(`artifact archive contains duplicate path: ${JSON.stringify(rawName)}`);
+        names.add(name);
+        const targetRoot = path.resolve(outputDir);
+        const target = path.resolve(targetRoot, ...parts);
+        if (target !== targetRoot && !target.startsWith(`${targetRoot}${path.sep}`))
+            throw new Error(`artifact archive path escapes output directory: ${JSON.stringify(rawName)}`);
+        if (name.endsWith("/")) {
+            fs.mkdirSync(target, { recursive: true });
+            cursor = next;
+            continue;
+        }
+        if (localOffset + 30 > archive.length || archive.readUInt32LE(localOffset) !== 0x04034b50)
+            throw new Error("artifact archive local entry is invalid");
+        const localNameLength = archive.readUInt16LE(localOffset + 26);
+        const localExtraLength = archive.readUInt16LE(localOffset + 28);
+        const dataOffset = localOffset + 30 + localNameLength + localExtraLength;
+        if (dataOffset + compressedSize > archive.length)
+            throw new Error("artifact archive entry data is truncated");
+        const compressed = archive.subarray(dataOffset, dataOffset + compressedSize);
+        const content = method === 0 ? compressed : zlib.inflateRawSync(compressed);
+        if (content.length !== size || crc32(content) !== crc)
+            throw new Error(`artifact archive entry integrity check failed: ${JSON.stringify(rawName)}`);
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, content, { flag: "wx" });
+        files.push(name);
+        cursor = next;
+    }
+    if (cursor !== centralOffset + centralSize)
+        throw new Error("artifact archive central directory size is invalid");
+    return files.sort();
 }
-
 function decodeZipFilename(bytes, flags) {
-  if (flags & 0x800) return bytes.toString("utf8");
-  // ZIP producers commonly omit the UTF-8 flag for ASCII entry names. Keep
-  // those names interoperable while refusing ambiguous non-ASCII encodings.
-  if (bytes.some((value) => value > 0x7f)) throw new Error("artifact archive contains an unsupported non-UTF-8 filename");
-  return bytes.toString("ascii");
+    if (flags & 0x800)
+        return bytes.toString("utf8");
+    // ZIP producers commonly omit the UTF-8 flag for ASCII entry names. Keep
+    // those names interoperable while refusing ambiguous non-ASCII encodings.
+    if (bytes.some((value) => value > 0x7f))
+        throw new Error("artifact archive contains an unsupported non-UTF-8 filename");
+    return bytes.toString("ascii");
 }
-
-function findEndOfCentralDirectory(archive) { const minimum = Math.max(0, archive.length - 65557); for (let offset = archive.length - 22; offset >= minimum; offset -= 1) if (archive.readUInt32LE(offset) === 0x06054b50 && offset + 22 + archive.readUInt16LE(offset + 20) === archive.length) return offset; throw new Error("artifact download is not a valid zip archive"); }
-function crc32(buffer) { let crc = 0xffffffff; for (const byte of buffer) { crc ^= byte; for (let bit = 0; bit < 8; bit += 1) crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1)); } return (crc ^ 0xffffffff) >>> 0; }
-
+function findEndOfCentralDirectory(archive) { const minimum = Math.max(0, archive.length - 65557); for (let offset = archive.length - 22; offset >= minimum; offset -= 1)
+    if (archive.readUInt32LE(offset) === 0x06054b50 && offset + 22 + archive.readUInt16LE(offset + 20) === archive.length)
+        return offset; throw new Error("artifact download is not a valid zip archive"); }
+function crc32(buffer) { let crc = 0xffffffff; for (const byte of buffer) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1)
+        crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+} return (crc ^ 0xffffffff) >>> 0; }
 module.exports = { PlatformApiClient, extractArchive };