agent-hitch 0.2.12 → 0.2.14

package/dist/src/resources/object-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-store.js","sourceRoot":"","sources":["../../../src/resources/object-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxG,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAoC,MAAM,eAAe,CAAC;AAGnJ,MAAM,CAAC,MAAM,uBAAuB,GAAmB,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACnM,MAAM,UAAU,MAAM,CAAC,QAAiC,EAAE;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACpI,MAAM,KAAK,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,KAAK,EAAE,CAAC;IAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,OAAO,KAAK,CAAC;AAC9G,CAAC;AACD,MAAM,SAAS,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/F,MAAM,OAAO,WAAW;IAED;IAAuB;IADnC,SAAS,CAAS;IAC3B,YAAqB,IAAY,EAAW,SAAS,uBAAuB;QAAvD,SAAI,GAAJ,IAAI,CAAQ;QAAW,WAAM,GAAN,MAAM,CAA0B;QAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAAC,CAAC;IACnJ,UAAU,CAAC,MAAc,IAAY,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,YAAqB,EAAE,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAChF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC5M,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjH,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YACnN,IAAI,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC1P,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACtG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY,EAAE,OAA0C;QACpG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,oDAAoD;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAwB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvI,IAAI,QAAQ,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAClF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAwB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAAC,MAAM,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAAC,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACrI,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QACtI,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QACtG,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAAC,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAClI,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,OAA0C,EAAE,MAAoB;QAChH,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC5G,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7I,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC9I,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACrH,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC1F,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;oBACvE,MAAM,EAAE,cAAc,EAAE,CAAC;oBAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;oBAC/C,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBACpH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACnC,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC5L,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAY,EAAE,IAAI,EAAE,CAAC;YACrG,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,CAAC;gBAAS,CAAC;YAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,OAA0C,EAAE,MAAoB;QAChH,MAAM,QAAQ,GAAuD,EAAE,CAAC;QAAC,IAAI,YAAY,GAAG,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,IAAY,EAAiB,EAAE;YAChE,MAAM,EAAE,cAAc,EAAE,CAAC;YAAC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;YAClH,IAAI,IAAI;gBAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACjG,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC;gBAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAAC,CAAC;;gBAC5L,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvI,CAAC,CAAC;QACF,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACtH,6EAA6E;QAC7E,MAAM,QAAQ,GAAiB,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;gBAC7J,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACrN,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC1G,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS;YACtB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;iBACvE,CAAC;gBAAC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QACjR,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClJ,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7M,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1I,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,WAAW,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxH,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;IAC3G,CAAC;CACF"}

package/dist/src/resources/oci-layer-validation.js

@@ -0,0 +1,202 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { Writable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGunzip } from "node:zlib";
+import path from "node:path";
+export const DEFAULT_IMAGE_IMPORT_BUDGET = { maxExpandedBytes: 8 * 1024 ** 3, maxFiles: 100_000 };
+const utf8 = new TextDecoder("utf-8", { fatal: true });
+const text = (bytes) => utf8.decode(bytes.subarray(0, bytes.indexOf(0) < 0 ? bytes.length : bytes.indexOf(0)));
+function number(bytes) {
+    const value = text(bytes).trim();
+    if (!/^[0-7]*$/.test(value))
+        throw new Error("unsupported OCI tar numeric encoding");
+    const parsed = parseInt(value || "0", 8);
+    if (!Number.isSafeInteger(parsed))
+        throw new Error("OCI tar size overflow");
+    return parsed;
+}
+function safePath(value) {
+    if (!value || Buffer.byteLength(value) > 4096 || value.startsWith("/") || /[\\\0]/.test(value) || value.split("/").some(part => part === ".." || Buffer.byteLength(part) > 255))
+        throw new Error("unsafe OCI layer path");
+    return path.posix.normalize(value).replace(/\/$/, "");
+}
+/** Inspects an uncompressed tar stream without writing any entry to disk.
+ * Supports regular entries, directories, links, PAX metadata and GNU long names.
+ * Sparse files and unknown entry/metadata formats fail closed before Docker runs. */
+class TarBudget {
+    budget;
+    files = 0;
+    header = Buffer.alloc(512);
+    fill = 0;
+    remaining = 0;
+    content = 0;
+    extension = "";
+    metadata = [];
+    zeros = 0;
+    pending = {};
+    paths = new Map();
+    parents = new Set();
+    constructor(budget) {
+        this.budget = budget;
+    }
+    accept(bytes) {
+        let offset = 0;
+        while (offset < bytes.length) {
+            if (this.remaining) {
+                const size = Math.min(this.remaining, bytes.length - offset);
+                if (this.extension && this.content)
+                    this.metadata.push(Buffer.from(bytes.subarray(offset, offset + Math.min(size, this.content))));
+                this.content = Math.max(0, this.content - size);
+                this.remaining -= size;
+                offset += size;
+                if (!this.remaining && this.extension)
+                    this.finishExtension();
+                continue;
+            }
+            const headerBytes = Math.min(512 - this.fill, bytes.length - offset);
+            bytes.copy(this.header, this.fill, offset, offset + headerBytes);
+            this.fill += headerBytes;
+            offset += headerBytes;
+            if (this.fill !== 512)
+                continue;
+            this.fill = 0;
+            if (this.header.every(n => n === 0)) {
+                this.zeros++;
+                continue;
+            }
+            if (this.zeros)
+                throw new Error("OCI tar data after end marker");
+            const sum = this.header.reduce((n, byte, i) => n + (i >= 148 && i < 156 ? 32 : byte), 0);
+            if (sum !== number(this.header.subarray(148, 156)))
+                throw new Error("OCI tar checksum mismatch");
+            if (++this.files > this.budget.maxFiles)
+                throw new Error("OCI layer entry budget exceeded");
+            const type = String.fromCharCode(this.header[156] || 48), rawSize = number(this.header.subarray(124, 136));
+            const magic = this.header.subarray(257, 263).toString("latin1");
+            if (!["ustar\0", "ustar ", "\0\0\0\0\0\0"].includes(magic))
+                throw new Error("unsupported OCI tar header format");
+            if (["x", "g", "L", "K"].includes(type)) {
+                if (rawSize < 1 || rawSize > 64 * 1024)
+                    throw new Error("OCI tar metadata budget exceeded");
+                this.extension = type;
+                this.content = rawSize;
+                this.remaining = Math.ceil(rawSize / 512) * 512;
+                continue;
+            }
+            if (!["0", "1", "2", "5"].includes(type))
+                throw new Error(`unsupported OCI tar entry type: ${type}`);
+            const metadata = this.pending;
+            this.pending = {};
+            const prefix = magic === "ustar\0" ? text(this.header.subarray(345, 500)) : "", name = safePath(metadata.path ?? `${prefix ? `${prefix}/` : ""}${text(this.header.subarray(0, 100))}`);
+            if (name === "." && type !== "5")
+                throw new Error("invalid OCI root entry");
+            if (this.paths.has(name))
+                throw new Error("duplicate OCI layer path");
+            if (type !== "5" && this.parents.has(name))
+                throw new Error("OCI layer path replaces a parent directory");
+            const parts = name.split("/");
+            for (let i = 1; i < parts.length; i++) {
+                const parentPath = parts.slice(0, i).join("/");
+                this.parents.add(parentPath);
+                const parent = this.paths.get(parentPath);
+                if (parent && parent !== "5")
+                    throw new Error("OCI layer path traverses a non-directory entry");
+            }
+            this.paths.set(name, type);
+            const size = metadata.size === undefined ? rawSize : Number(metadata.size);
+            if (!Number.isSafeInteger(size) || size < 0 || size > this.budget.maxExpandedBytes)
+                throw new Error("OCI layer expanded byte budget exceeded");
+            if (type !== "0" && size !== 0)
+                throw new Error("OCI non-file entry contains data");
+            if (type === "1" || type === "2") {
+                const target = metadata.linkpath ?? text(this.header.subarray(157, 257));
+                if (!target || Buffer.byteLength(target) > 4096 || /[\\\0]/.test(target))
+                    throw new Error("unsafe OCI layer link");
+                if (type === "1")
+                    safePath(target);
+                else {
+                    // Absolute symlinks are container-root relative. Relative links must
+                    // stay within that root; no host path is ever opened by this scanner.
+                    const resolved = path.posix.normalize(target.startsWith("/") ? target.slice(1) : path.posix.join(path.posix.dirname(name), target));
+                    if (resolved === ".." || resolved.startsWith("../"))
+                        throw new Error("unsafe OCI layer link escape");
+                }
+            }
+            this.remaining = Math.ceil(size / 512) * 512;
+        }
+    }
+    finishExtension() {
+        const bytes = Buffer.concat(this.metadata);
+        this.metadata = [];
+        const type = this.extension;
+        this.extension = "";
+        if (type === "L" || type === "K") {
+            this.pending[type === "L" ? "path" : "linkpath"] = text(bytes);
+            return;
+        }
+        const values = {};
+        for (let offset = 0; offset < bytes.length;) {
+            const space = bytes.indexOf(32, offset), lengthText = bytes.subarray(offset, space).toString();
+            const length = Number(lengthText);
+            if (space < offset || !/^[1-9][0-9]*$/.test(lengthText) || !Number.isSafeInteger(length) || length <= space - offset + 1 || offset + length > bytes.length || bytes[offset + length - 1] !== 10)
+                throw new Error("invalid OCI PAX record");
+            const value = utf8.decode(bytes.subarray(space + 1, offset + length - 1)), equals = value.indexOf("="), key = value.slice(0, equals);
+            if (equals < 1 || Object.hasOwn(values, key))
+                throw new Error("invalid OCI PAX key");
+            if (!["path", "linkpath", "size", "mtime", "atime", "ctime", "uid", "gid", "uname", "gname", "charset", "comment", "LIBARCHIVE.creationtime"].includes(key) && !key.startsWith("SCHILY.xattr."))
+                throw new Error(`unsupported OCI PAX metadata: ${key}`);
+            values[key] = value.slice(equals + 1);
+            offset += length;
+        }
+        if (values.size !== undefined && !/^(0|[1-9][0-9]*)$/.test(values.size))
+            throw new Error("invalid OCI PAX size");
+        if (type === "g") {
+            if (["path", "linkpath", "size"].some(key => key in values))
+                throw new Error("unsupported OCI global path/size override");
+        }
+        else
+            for (const key of ["path", "linkpath", "size"])
+                if (values[key] !== undefined)
+                    this.pending[key] = values[key];
+    }
+    finish() {
+        if (this.fill || this.remaining || this.zeros < 2 || Object.keys(this.pending).length)
+            throw new Error("truncated OCI layer tar");
+    }
+}
+export async function validateOciLayer(file, start, size, mediaType, budget, signal) {
+    const gzip = ["application/vnd.oci.image.layer.v1.tar+gzip", "application/vnd.docker.image.rootfs.diff.tar.gzip"].includes(mediaType);
+    if (!gzip && mediaType !== "application/vnd.oci.image.layer.v1.tar" && mediaType !== "application/vnd.docker.image.rootfs.diff.tar")
+        throw new Error(`unsupported OCI layer media type: ${mediaType}`);
+    if (!size)
+        throw new Error("empty OCI layer blob");
+    const parser = new TarBudget(budget), hash = createHash("sha256");
+    let expandedBytes = 0;
+    // A Writable preserves the parser failure across pipeline teardown on Node 22;
+    // throwing from an async-iterator sink can replace it with an AbortError.
+    const consume = new Writable({
+        write(chunk, _encoding, callback) {
+            try {
+                signal?.throwIfAborted();
+                expandedBytes += chunk.length;
+                if (expandedBytes > budget.maxExpandedBytes)
+                    throw new Error("OCI layer expanded byte budget exceeded");
+                hash.update(chunk);
+                parser.accept(chunk);
+                callback();
+            }
+            catch (error) {
+                callback(error instanceof Error ? error : new Error(String(error)));
+            }
+        }
+    });
+    const input = createReadStream(file, { start, end: start + size - 1 });
+    if (gzip)
+        await pipeline(input, createGunzip(), consume, { signal });
+    else
+        await pipeline(input, consume, { signal });
+    parser.finish();
+    return { expandedBytes, files: parser.files, diffId: `sha256:${hash.digest("hex")}` };
+}
+//# sourceMappingURL=oci-layer-validation.js.map

package/dist/src/resources/oci-layer-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-layer-validation.js","sourceRoot":"","sources":["../../../src/resources/oci-layer-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,MAAM,CAAC,MAAM,2BAA2B,GAAsB,EAAE,gBAAgB,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACrH,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvH,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1N,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;qFAEqF;AACrF,MAAM,SAAS;IAYgB;IAX7B,KAAK,GAAG,CAAC,CAAC;IACF,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,CAAC;IACT,SAAS,GAAG,CAAC,CAAC;IACd,OAAO,GAAG,CAAC,CAAC;IACZ,SAAS,GAAG,EAAE,CAAC;IACf,QAAQ,GAAa,EAAE,CAAC;IACxB,KAAK,GAAG,CAAC,CAAC;IACV,OAAO,GAA2B,EAAE,CAAC;IACrC,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAC1D,MAAM,CAAC,KAAa;QAClB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;gBAC7D,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO;oBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;gBAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;gBAAC,MAAM,IAAI,IAAI,CAAC;gBACxF,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;oBAAE,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;YAAC,MAAM,IAAI,WAAW,CAAC;YAClH,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG;gBAAE,SAAS;YAChC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAChE,IAAI,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACjG,IAAI,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3G,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACjH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC5F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;gBAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;gBAAC,SAAS;YAC3G,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;YACrG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACvL,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5E,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACtE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC1C,IAAI,MAAM,IAAI,MAAM,KAAK,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC/I,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACpF,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACnH,IAAI,IAAI,KAAK,GAAG;oBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;qBAC9B,CAAC;oBACJ,qEAAqE;oBACrE,sEAAsE;oBACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;oBACpI,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACvG,CAAC;YACH,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;QAC/C,CAAC;IACH,CAAC;IACO,eAAe;QACrB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACjD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7G,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;YAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3O,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACrI,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACrF,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;YACzP,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAAC,MAAM,IAAI,MAAM,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACjH,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5H,CAAC;;YAAM,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC;gBAAE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;oBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAE,CAAC;IACzH,CAAC;IACD,MAAM;QACJ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpI,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,SAAiB,EAAE,MAAyB,EAAE,MAAoB;IAClJ,MAAM,IAAI,GAAG,CAAC,6CAA6C,EAAE,mDAAmD,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACtI,IAAI,CAAC,IAAI,IAAI,SAAS,KAAK,wCAAwC,IAAI,SAAS,KAAK,8CAA8C;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;IACvM,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAAC,IAAI,aAAa,GAAG,CAAC,CAAC;IACzF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC;QAC3B,KAAK,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;YACtC,IAAI,CAAC;gBACH,MAAM,EAAE,cAAc,EAAE,CAAC;gBAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;gBACxD,IAAI,aAAa,GAAG,MAAM,CAAC,gBAAgB;oBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBACxG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,QAAQ,EAAE,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAC1F,CAAC;KACF,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,IAAI;QAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;;QAChE,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AACzG,CAAC"}

package/dist/src/resources/oci-provider.js

@@ -0,0 +1,101 @@
+import { DockerRegistryResolver, resolveRegistryEnvironmentImage } from "../images/index.js";
+import { durableWriteJSON } from "../foundation/index.js";
+import { lstat, mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { exportRegistryBundle, fetchRegistryManifest, verifyRegistryManifest, importRegistryBundle, validateRegistryBundle, isRegistryBundle } from "./oci-registry-bundle.js";
+import { DEFAULT_IMAGE_IMPORT_BUDGET } from "./oci-layer-validation.js";
+import { DEFAULT_RESOURCE_LIMITS } from "./object-store.js";
+import { sha } from "./protocol.js";
+/** Transport is deliberately separate from the lock and all task identities. */
+export class DockerResourceImageProvider {
+    root;
+    transport;
+    resolver;
+    offline;
+    imagePolicy;
+    budget;
+    protocol = "hitch-oci-provider@1";
+    constructor(root, transport, resolver = new DockerRegistryResolver({ policy: "cache-first" }), offline = {}, imagePolicy = "cache-first", budget = DEFAULT_RESOURCE_LIMITS) {
+        this.root = root;
+        this.transport = transport;
+        this.resolver = resolver;
+        this.offline = offline;
+        this.imagePolicy = imagePolicy;
+        this.budget = budget;
+        if (resolver instanceof DockerRegistryResolver)
+            this.resolver = resolver.withBeforePull(async (reference, platform, signal) => {
+                const resource = { kind: "oci-image", manifestDigest: sha(reference.split("@")[1]), platform };
+                const staging = path.join(root, "store", "benchmark-resources", "staging");
+                await mkdir(staging, { recursive: true });
+                const temporary = await mkdtemp(path.join(staging, "oci-validation-")), file = path.join(temporary, "bundle");
+                try {
+                    await exportRegistryBundle(resource, reference, file, { maxBytes: Math.min(budget.maxObjectBytes, budget.maxTotalBytes), minFreeBytes: budget.minFreeBytes }, signal);
+                    const validated = await validateRegistryBundle(resource, file, signal, { maxExpandedBytes: budget.maxTotalBytes, maxFiles: budget.maxFiles });
+                    await durableWriteJSON(this.proofFile(resource), { manifest: validated.manifest });
+                }
+                finally {
+                    await rm(temporary, { recursive: true, force: true });
+                }
+            });
+    }
+    proofFile(resource) { return path.join(this.root, "store", "benchmark-resources", "oci-manifests", `${resource.manifestDigest.slice(7)}.json`); }
+    async exportArchive(resource, destination, signal, budget) {
+        if (this.offline.exportFormat === "docker-archive")
+            throw new Error("docker-archive cannot preserve verified manifest and expanded-layer budgets; use registry-bundle");
+        const image = await this.resolve(resource, signal);
+        return exportRegistryBundle(resource, image.reference, destination, budget ?? { maxBytes: 1024 ** 3, minFreeBytes: 64 * 1024 ** 2 }, signal);
+    }
+    async validateArchive(resource, source, signal, budget = DEFAULT_IMAGE_IMPORT_BUDGET) {
+        if (!await isRegistryBundle(source))
+            throw new Error("unvalidated Docker archives are unsupported; import a registry-bundle");
+        return (await validateRegistryBundle(resource, source, signal, budget)).usage;
+    }
+    async importArchive(resource, source, signal, budget = DEFAULT_IMAGE_IMPORT_BUDGET) {
+        signal = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]);
+        const reference = this.transport[resource.manifestDigest];
+        if (!reference)
+            throw new Error("offline OCI transport missing");
+        if (await isRegistryBundle(source)) {
+            if (!this.offline.registry)
+                throw new Error("registry bundle import requires an explicitly configured local offline registry");
+            const raw = await importRegistryBundle(resource, source, reference, this.offline.registry, signal, budget);
+            await durableWriteJSON(this.proofFile(resource), { manifest: raw });
+            // Only the explicitly configured loopback registry is contacted here.
+            // Normal execution remains cache-only and uses the exact original digest.
+            await new DockerRegistryResolver({ policy: "registry" }).resolve(reference, resource.platform, signal);
+        }
+        else
+            throw new Error("unvalidated Docker archives are unsupported; import a registry-bundle");
+        await new DockerRegistryResolver({ policy: "cache-only" }).resolve(reference, resource.platform, signal);
+    }
+    async resolve(resource, signal) {
+        signal = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]);
+        if (resource.indexDigest)
+            throw new Error("this OCI provider does not support index membership verification; supply a platform manifest without an index lock");
+        const reference = this.transport[resource.manifestDigest];
+        if (!reference || !reference.endsWith(`@${resource.manifestDigest}`) || /[\s\0]/.test(reference))
+            throw new Error("immutable OCI resource transport is missing or mismatched");
+        const { manifest } = await resolveRegistryEnvironmentImage({ root: this.root, benchmarkId: "benchmark-resource", benchmarkRevision: resource.manifestDigest,
+            reference, platform: resource.platform, resolver: this.resolver, ...(signal ? { signal } : {}) });
+        if (!manifest.output.config_digest)
+            throw new Error("OCI resource provider must verify the config digest");
+        const file = this.proofFile(resource), info = await lstat(file).catch(e => { if (e.code !== "ENOENT")
+            throw e; return undefined; });
+        let raw;
+        if (info) {
+            if (!info.isFile() || info.size > 4 * 1024 ** 2)
+                throw new Error("invalid cached OCI manifest proof");
+            raw = JSON.parse(await readFile(file, "utf8")).manifest;
+        }
+        else {
+            if (this.imagePolicy === "cache-only")
+                throw new Error("cache-only OCI manifest proof missing; import a registry bundle or verify the image online first");
+            raw = await fetchRegistryManifest(resource, reference, signal);
+        }
+        verifyRegistryManifest(raw, resource, manifest.output.config_digest);
+        if (!info)
+            await durableWriteJSON(file, { manifest: raw });
+        return { imageId: manifest.image_id, manifestDigest: manifest.output.manifest_digest, configDigest: manifest.output.config_digest, platform: manifest.platform, reference: manifest.output.reference };
+    }
+}
+//# sourceMappingURL=oci-provider.js.map

package/dist/src/resources/oci-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-provider.js","sourceRoot":"","sources":["../../../src/resources/oci-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,+BAA+B,EAA8B,MAAM,oBAAoB,CAAC;AAGzH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAA4B,MAAM,0BAA0B,CAAC;AACzM,OAAO,EAAE,2BAA2B,EAA0B,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,uBAAuB,EAAuB,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,gFAAgF;AAChF,MAAM,OAAO,2BAA2B;IAEjB;IAAuB;IAA4C;IAAkG;IAA4C;IAAsC;IADnQ,QAAQ,GAAG,sBAA+B,CAAC;IACpD,YAAqB,IAAY,EAAW,SAAiC,EAAW,WAAkC,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,EAAW,UAA+B,EAAE,EAAW,cAAc,aAAa,EAAW,SAAyB,uBAAuB;QAAvS,SAAI,GAAJ,IAAI,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAwB;QAAW,aAAQ,GAAR,QAAQ,CAA+E;QAAW,YAAO,GAAP,OAAO,CAA0B;QAAW,gBAAW,GAAX,WAAW,CAAgB;QAAW,WAAM,GAAN,MAAM,CAA0C;QAC1T,IAAI,QAAQ,YAAY,sBAAsB;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAC5H,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,WAAoB,EAAE,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;gBACxG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAC9G,IAAI,CAAC;oBACH,MAAM,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;oBACtK,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC9I,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACrF,CAAC;wBAAS,CAAC;oBAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;YACtE,CAAC,CAAC,CAAC;IACL,CAAC;IACO,SAAS,CAAC,QAAkD,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnM,KAAK,CAAC,aAAa,CAAC,QAAkD,EAAE,WAAmB,EAAE,MAAoB,EAAE,MAAmD;QACpK,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;QACxK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/I,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,QAAkD,EAAE,MAAc,EAAE,MAAoB,EAAE,SAA4B,2BAA2B;QACrK,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC9H,OAAO,CAAC,MAAM,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,QAAkD,EAAE,MAAc,EAAE,MAAoB,EAAE,SAA4B,2BAA2B;QACnK,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC5H,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YAC/H,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3G,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzG,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAChG,MAAM,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3G,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAAkD,EAAE,MAAoB;QACpF,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,QAAQ,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,oHAAoH,CAAC,CAAC;QAChK,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/K,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,+BAA+B,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,QAAQ,CAAC,cAAc;YACzJ,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACpI,IAAI,GAAW,CAAC;QAChB,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACtG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;YAC3J,GAAG,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACzM,CAAC;CACF"}

package/dist/src/resources/oci-registry-bundle.js

@@ -0,0 +1,253 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { open, rm, statfs } from "node:fs/promises";
+import path from "node:path";
+import { canonical, hash, natural, object, parseStrictJson, sha } from "./protocol.js";
+import { DEFAULT_IMAGE_IMPORT_BUDGET, validateOciLayer } from "./oci-layer-validation.js";
+// Exact registry bytes, not a tar extraction or a reconstructed manifest.
+// API: https://distribution.github.io/distribution/spec/api/
+const MAGIC = Buffer.from("HITCH-OCI-REGISTRY-1\n"), MAX_HEADER = 4 * 1024 ** 2;
+const ACCEPT = "application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json";
+const FETCH_ACCEPT = `${ACCEPT}, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json`;
+export function registryLocation(reference) {
+    const [name, digest] = reference.split("@");
+    sha(digest);
+    const components = name.split("/"), explicit = /[.:]/.test(components[0]) || components[0] === "localhost";
+    const host = explicit ? components.shift() : "registry-1.docker.io";
+    if (components.length === 1 && !explicit)
+        components.unshift("library");
+    const repository = components.join("/");
+    if (!/^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/.test(repository))
+        throw new Error("invalid registry repository");
+    const local = /^(localhost|127\.0\.0\.1)(:\d+)?$/.test(host);
+    return { origin: `${local ? "http" : "https"}://${host === "docker.io" ? "registry-1.docker.io" : host}`, repository, digest: digest };
+}
+export function localRegistry(value) {
+    const url = new URL(value);
+    if (!["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+        throw new Error("offline registry must be an explicitly configured loopback origin");
+    return url;
+}
+async function boundedBody(response, maximum) {
+    if (!response.ok || !response.body)
+        throw new Error(`OCI registry request failed: HTTP ${response.status}`);
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of response.body) {
+        size += chunk.length;
+        if (size > maximum)
+            throw new Error("OCI response byte budget exceeded");
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+function descriptors(manifest, image) {
+    if (hash(manifest) !== image.manifestDigest)
+        throw new Error("offline OCI manifest digest mismatch");
+    const m = parseStrictJson(manifest);
+    if (m.schemaVersion !== 2 || !Array.isArray(m.layers) || !ACCEPT.split(", ").includes(String(m.mediaType)))
+        throw new Error("offline registry format requires a platform image manifest, not an index");
+    const parse = (v) => { const d = v; if (!d || typeof d !== "object" || d.urls !== undefined)
+        throw new Error("foreign OCI blobs are unsupported"); return { digest: sha(d.digest), size: natural(d.size) }; };
+    const layers = m.layers.map(v => ({ ...parse(v), mediaType: String(v.mediaType) }));
+    const config = parse(m.config), entries = [config, ...layers], unique = new Map();
+    for (const e of entries) {
+        if (unique.has(e.digest) && unique.get(e.digest).size !== e.size)
+            throw new Error("conflicting OCI descriptor sizes");
+        unique.set(e.digest, e);
+    }
+    return { blobs: [...unique.values()].map(({ digest, size }) => ({ digest, size })).sort((a, b) => a.digest.localeCompare(b.digest)), layers, mediaType: String(m.mediaType), config };
+}
+async function registryReader(reference, signal) {
+    const location = registryLocation(reference);
+    let token;
+    return async (suffix, accept) => {
+        const url = `${location.origin}/v2/${location.repository}/${suffix}`;
+        const request = () => fetch(url, { signal, headers: { ...(accept ? { accept } : {}), ...(token ? { authorization: `Bearer ${token}` } : {}) } });
+        let response = await request();
+        if (response.status === 401 && !token) {
+            const challenge = response.headers.get("www-authenticate") ?? "";
+            await response.body?.cancel();
+            const realm = challenge.match(/realm="([^"]+)"/)?.[1], service = challenge.match(/service="([^"]+)"/)?.[1];
+            if (!challenge.startsWith("Bearer ") || !realm)
+                throw new Error("registry bundle export supports anonymous bearer authentication only");
+            const auth = new URL(realm);
+            if (auth.protocol !== "https:" || auth.username || auth.password)
+                throw new Error("unsafe registry authentication endpoint");
+            if (service)
+                auth.searchParams.set("service", service);
+            auth.searchParams.set("scope", `repository:${location.repository}:pull`);
+            const value = parseStrictJson((await boundedBody(await fetch(auth, { signal }), 64 * 1024)).toString());
+            token = typeof value.token === "string" ? value.token : typeof value.access_token === "string" ? value.access_token : undefined;
+            if (!token)
+                throw new Error("registry authentication unavailable");
+            response = await request();
+        }
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error(`OCI registry request failed: HTTP ${response.status}`);
+        }
+        return response;
+    };
+}
+export async function fetchRegistryManifest(image, reference, signal) {
+    const bounded = AbortSignal.any([AbortSignal.timeout(30_000), ...(signal ? [signal] : [])]);
+    const get = await registryReader(reference, bounded), manifest = (await boundedBody(await get(`manifests/${image.manifestDigest}`, FETCH_ACCEPT), MAX_HEADER)).toString();
+    descriptors(manifest, image);
+    return manifest;
+}
+export function verifyRegistryManifest(manifest, image, configDigest) {
+    if (descriptors(manifest, image).config.digest !== configDigest)
+        throw new Error("OCI manifest config differs from actual Docker image");
+}
+export async function exportRegistryBundle(image, reference, file, budget, signal) {
+    const bounded = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]);
+    const get = await registryReader(reference, bounded), manifest = (await boundedBody(await get(`manifests/${image.manifestDigest}`, FETCH_ACCEPT), MAX_HEADER)).toString();
+    const { blobs } = descriptors(manifest, image), header = Buffer.from(JSON.stringify({ protocol: "hitch-oci-registry-bundle@1", manifest, blobs })), length = Buffer.alloc(4);
+    length.writeUInt32BE(header.length);
+    const total = MAGIC.length + 4 + header.length + blobs.reduce((n, b) => n + b.size, 0);
+    if (header.length > MAX_HEADER || total > budget.maxBytes)
+        throw new Error("offline OCI archive budget exceeded");
+    const space = await statfs(path.dirname(file), { bigint: true });
+    if (space.bavail * space.bsize < BigInt(total + budget.minFreeBytes))
+        throw new Error("offline OCI free-space reserve exceeded");
+    const output = await open(file, "wx", 0o600);
+    try {
+        await output.writeFile(Buffer.concat([MAGIC, length, header]));
+        for (const blob of blobs) {
+            let size = 0;
+            const digest = createHash("sha256"), response = await get(`blobs/${blob.digest}`);
+            for await (const chunk of response.body) {
+                bounded.throwIfAborted();
+                size += chunk.length;
+                if (size > blob.size)
+                    throw new Error("OCI blob exceeds its manifest size");
+                digest.update(chunk);
+                await output.writeFile(chunk);
+            }
+            if (size !== blob.size || `sha256:${digest.digest("hex")}` !== blob.digest)
+                throw new Error("OCI blob integrity mismatch");
+        }
+        await output.sync();
+    }
+    catch (error) {
+        await rm(file, { force: true });
+        throw error;
+    }
+    finally {
+        await output.close();
+    }
+}
+export async function isRegistryBundle(file) {
+    const handle = await open(file, "r");
+    try {
+        const buffer = Buffer.alloc(MAGIC.length);
+        await handle.read(buffer, 0, buffer.length, 0);
+        return buffer.equals(MAGIC);
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Validates digests, expanded bytes, entry counts and tar paths without extraction. */
+export async function validateRegistryBundle(image, file, signal, budget = DEFAULT_IMAGE_IMPORT_BUDGET) {
+    natural(budget.maxExpandedBytes);
+    natural(budget.maxFiles);
+    const bounded = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]), handle = await open(file, "r");
+    let manifest, blobs, layers, mediaType, config, offset;
+    try {
+        const prefix = Buffer.alloc(MAGIC.length + 4);
+        await handle.read(prefix, 0, prefix.length, 0);
+        const length = prefix.readUInt32BE(MAGIC.length);
+        if (!prefix.subarray(0, MAGIC.length).equals(MAGIC) || length > MAX_HEADER)
+            throw new Error("invalid OCI bundle header");
+        const header = Buffer.alloc(length);
+        if ((await handle.read(header, 0, length, prefix.length)).bytesRead !== length)
+            throw new Error("truncated OCI header");
+        const raw = object(parseStrictJson(header.toString()), ["protocol", "manifest", "blobs"]);
+        if (raw.protocol !== "hitch-oci-registry-bundle@1" || typeof raw.manifest !== "string")
+            throw new Error("invalid OCI bundle protocol");
+        manifest = raw.manifest;
+        ({ blobs, layers, mediaType, config } = descriptors(manifest, image));
+        if (canonical(raw.blobs) !== canonical(blobs))
+            throw new Error("OCI bundle inventory mismatch");
+        offset = prefix.length + length;
+        if ((await handle.stat()).size !== offset + blobs.reduce((n, b) => n + b.size, 0))
+            throw new Error("OCI bundle size mismatch");
+    }
+    finally {
+        await handle.close();
+    }
+    let position = offset;
+    const positions = new Map();
+    let diffIds = [];
+    for (const blob of blobs) {
+        positions.set(blob.digest, position);
+        const digest = createHash("sha256"), chunks = [];
+        if (blob.size)
+            for await (const chunk of createReadStream(file, { start: position, end: position + blob.size - 1 })) {
+                bounded.throwIfAborted();
+                digest.update(chunk);
+                if (blob.digest === config.digest) {
+                    if (blob.size > MAX_HEADER)
+                        throw new Error("OCI config size budget exceeded");
+                    chunks.push(chunk);
+                }
+            }
+        if (`sha256:${digest.digest("hex")}` !== blob.digest)
+            throw new Error("offline OCI blob digest mismatch");
+        if (blob.digest === config.digest) {
+            const c = parseStrictJson(Buffer.concat(chunks).toString());
+            if (`${c.os}/${c.architecture}${c.variant ? `/${c.variant}` : ""}` !== image.platform)
+                throw new Error("offline OCI config platform mismatch");
+            const rootfs = c.rootfs;
+            if (!rootfs || rootfs.type !== "layers" || !Array.isArray(rootfs.diff_ids) || rootfs.diff_ids.length !== layers.length)
+                throw new Error("offline OCI config layer inventory mismatch");
+            diffIds = rootfs.diff_ids.map(sha);
+        }
+        position += blob.size;
+    }
+    const usage = { expandedBytes: 0, files: 0 };
+    for (const [i, layer] of layers.entries()) {
+        const observed = await validateOciLayer(file, positions.get(layer.digest), layer.size, layer.mediaType, { maxExpandedBytes: budget.maxExpandedBytes - usage.expandedBytes, maxFiles: budget.maxFiles - usage.files }, bounded);
+        if (observed.diffId !== diffIds[i])
+            throw new Error("offline OCI uncompressed layer digest mismatch");
+        usage.expandedBytes += observed.expandedBytes;
+        usage.files += observed.files;
+    }
+    return { manifest: manifest, blobs: blobs, mediaType: mediaType, offset: offset, usage };
+}
+/** Validates every layer before any local registry or Docker mutation. */
+export async function importRegistryBundle(image, file, reference, registry, signal, budget = DEFAULT_IMAGE_IMPORT_BUDGET) {
+    const origin = localRegistry(registry), location = registryLocation(reference);
+    if (new URL(location.origin).host !== origin.host)
+        throw new Error("offline image transport must name the configured local registry");
+    const bounded = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]);
+    const { manifest, blobs, mediaType, offset } = await validateRegistryBundle(image, file, bounded, budget);
+    let position = offset;
+    const api = `${origin.origin}/v2/${location.repository}`;
+    for (const blob of blobs) {
+        const head = await fetch(`${api}/blobs/${blob.digest}`, { method: "HEAD", signal: bounded, redirect: "error" });
+        if (head.status !== 200) {
+            if (head.status !== 404)
+                throw new Error(`offline registry probe failed: ${head.status}`);
+            const start = await fetch(`${api}/blobs/uploads/`, { method: "POST", signal: bounded, redirect: "error" });
+            await start.body?.cancel();
+            const upload = new URL(start.headers.get("location") ?? "", api);
+            if (start.status !== 202 || upload.origin !== origin.origin || !upload.pathname.startsWith(`/v2/${location.repository}/blobs/uploads/`))
+                throw new Error("unsafe local registry upload location");
+            upload.searchParams.set("digest", blob.digest);
+            const response = await fetch(upload, { method: "PUT", signal: bounded, redirect: "error", headers: { "content-type": "application/octet-stream", "content-length": String(blob.size) }, body: blob.size ? createReadStream(file, { start: position, end: position + blob.size - 1 }) : Buffer.alloc(0), duplex: "half" });
+            await response.body?.cancel();
+            if (response.status !== 201)
+                throw new Error(`offline registry blob upload failed: ${response.status}`);
+        }
+        position += blob.size;
+    }
+    const result = await fetch(`${api}/manifests/${image.manifestDigest}`, { method: "PUT", signal: bounded, redirect: "error", headers: { "content-type": mediaType }, body: manifest });
+    await result.body?.cancel();
+    if (result.status !== 201)
+        throw new Error(`offline registry manifest publication failed: ${result.status}`);
+    return manifest;
+}
+//# sourceMappingURL=oci-registry-bundle.js.map