agent-hitch 0.2.13 → 0.2.14

package/dist/src/resources/index.js

@@ -0,0 +1,14 @@
+export { ResourceStore } from "./store.js";
+export { resourceRequest, resourceFileRequest, configuredResourceStore, preflightResourceInput } from "./api.js";
+export { readResourceInput, parseResourceDataset, parseResourceSelection, parseResourceTask, selectResources, sealResourceTask, preflightResourceTask, taskClosureLock, resourceDescriptorDirectory } from "./tasks.js";
+export { materializeResourceTask, finishResourceWorkspace } from "./materialize.js";
+export { parseResource, parseResourceLock, parseStrictJson, parseTree, canonical, identity, hash, RESOURCE_CAPABILITIES } from "./protocol.js";
+export { DockerResourceImageProvider } from "./oci-provider.js";
+export { auditResources } from "./gc.js";
+export { DEFAULT_RESOURCE_LIMITS } from "./object-store.js";
+export { createResourceDelivery, parseResourceDelivery, receiveResourceDelivery } from "./transfer.js";
+export { exportResourceBundle, importResourceBundle } from "./bundle.js";
+export { readResourceEvidence, sealResourceEvidence, confirmResourceResultSealed, reclaimResourceExecution } from "./evidence.js";
+export { resourceStorageStats } from "./stats.js";
+export { retainResourceResult } from "./result-retention.js";
+//# sourceMappingURL=index.js.map

package/dist/src/resources/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/resources/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAEjH,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAExN,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGpF,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE/I,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAEvG,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAClI,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/src/resources/materialize.js

@@ -0,0 +1,143 @@
+import { roleDirectory, validateRoleContexts } from "./role-context.js";
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { appendFile, chmod, copyFile, lstat, mkdir, readFile, rename, rm, statfs, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { durableWriteJSON as atomicWriteJSON } from "../foundation/index.js";
+import { canonical, identity, parseStrictJson } from "./protocol.js";
+import { validateLease } from "./store.js";
+import { preflightResourceTask, parseResourceTask, taskClosureLock } from "./tasks.js";
+export async function materializeResourceTask(store, plan, input) {
+    const checked = await preflightResourceTask(store, plan.task, { platform: plan.platform, owner: input.owner, generation: input.generation, ...(input.signal ? { signal: input.signal } : {}) });
+    if (checked.plan.digest !== plan.digest)
+        throw new Error("resource execution plan changed");
+    const { lease } = await store.acquire(input.owner, taskClosureLock(plan.task), "execution", input.signal), id = randomUUID();
+    const directory = path.join(store.directory, "workspaces", id), temp = `${directory}.tmp`, taskDirectory = path.join(directory, plan.task.task_id);
+    const evidence = { protocol: "hitch-resource-workspace@1", id, state: "active", leaseId: lease.id, plan, taskDirectory, materialized_task_digest: "", clonedBytes: 0, copiedBytes: 0, fallbackReasons: {}, images: checked.closure.images };
+    try {
+        return await store.locked(async () => {
+            const mode = input.policy?.mode ?? "auto", maxWorkspaces = input.policy?.maxWorkspaces ?? 4, maxCopy = input.policy?.maxCopyBytes ?? store.objects.budget.maxTotalBytes;
+            if (!["auto", "copy", "require-clone"].includes(mode) || !Number.isSafeInteger(maxWorkspaces) || maxWorkspaces < 1 || !Number.isSafeInteger(maxCopy) || maxCopy < 0)
+                throw new TypeError("invalid workspace policy");
+            const active = (await store.records("leases")).filter(l => { validateLease(l); return l.purpose === "execution" && l.state !== "released"; });
+            if (active.length > maxWorkspaces)
+                throw new Error("resource workspace concurrency budget exceeded");
+            await mkdir(path.dirname(directory), { recursive: true });
+            await mkdir(temp, { mode: 0o700 });
+            const destination = path.join(temp, plan.task.task_id);
+            await mkdir(destination);
+            const file = async (digest, target, size, executable) => {
+                input.signal?.throwIfAborted();
+                await store.objects.verify(digest, size);
+                let clone = false;
+                if (mode !== "copy")
+                    try {
+                        await copyFile(store.objects.objectPath(digest), target, constants.COPYFILE_FICLONE_FORCE | constants.COPYFILE_EXCL);
+                        clone = true;
+                    }
+                    catch (error) {
+                        const code = error.code ?? "unknown";
+                        if (mode === "require-clone" || !["ENOTSUP", "EOPNOTSUPP", "EXDEV", "ENOSYS"].includes(code))
+                            throw error;
+                        evidence.fallbackReasons[code] = (evidence.fallbackReasons[code] ?? 0) + 1;
+                    }
+                if (clone)
+                    evidence.clonedBytes += size;
+                else {
+                    if (evidence.copiedBytes + size > maxCopy)
+                        throw new Error("resource workspace copy budget exceeded");
+                    const space = await statfs(temp, { bigint: true });
+                    if (space.bavail * space.bsize < BigInt(size + store.objects.budget.minFreeBytes))
+                        throw new Error("resource workspace free-space reserve exceeded");
+                    await copyFile(store.objects.objectPath(digest), target, constants.COPYFILE_EXCL);
+                    evidence.copiedBytes += size;
+                }
+                input.signal?.throwIfAborted();
+                await store.objects.verify(digest, size, target);
+                await chmod(target, executable ? 0o755 : 0o644);
+            };
+            const tree = async (resource, target) => {
+                const manifest = await store.objects.readTree(resource.manifestDigest);
+                for (const entry of manifest.entries) {
+                    const output = path.join(target, entry.path);
+                    if (entry.kind === "directory")
+                        await mkdir(output, { mode: 0o755 });
+                    else
+                        await file(entry.digest, output, entry.size, entry.executable);
+                }
+            };
+            await tree(plan.task.sourceTree, destination);
+            await validateRoleContexts(destination, plan.task.lock.bindings, plan.platform, checked.closure.images);
+            for (const binding of plan.task.lock.bindings) {
+                if (binding.use === "environment-image")
+                    continue;
+                const target = path.join(destination, roleDirectory(binding.consumer), binding.target), resource = plan.task.lock.resources[binding.resource];
+                await mkdir(path.dirname(target), { recursive: true });
+                // A source descriptor may not overwrite or shadow a resource binding.
+                if (await lstat(target).catch((e) => { if (e.code !== "ENOENT")
+                    throw e; return undefined; }))
+                    throw new Error("resource target collides with task descriptor");
+                if (resource.kind === "tree") {
+                    await mkdir(target);
+                    await tree(resource, target);
+                }
+                else if (resource.kind === "blob" && binding.use === "input-file")
+                    await file(resource.digest, target, resource.size, binding.executable);
+                else
+                    throw new Error("resource binding changed after preflight");
+            }
+            const roles = new Map(plan.task.lock.bindings.map(b => [canonical(b.consumer), b.consumer]));
+            for (const [role, consumer] of roles) {
+                const file = path.join(destination, roleDirectory(consumer), "Dockerfile"), text = await readFile(file, "utf8");
+                const transported = text.replace(/^(FROM\s+)(\S+)(.*)$/gim, (_all, prefix, ref, suffix) => {
+                    const image = checked.closure.images.find(i => ref.endsWith(`@${i.manifestDigest}`));
+                    if (!image)
+                        throw new Error("unresolved OCI build base");
+                    return `${prefix}${image.reference}${suffix}`;
+                });
+                await writeFile(file, transported);
+                await appendFile(file, `\nLABEL dev.hitch.resource.plan=${JSON.stringify(plan.digest)} dev.hitch.resource.consumer=${JSON.stringify(role)}\n`);
+            }
+            // Import the actual output as an identity proof while holding the same lock.
+            // Its independent evidence lease keeps it reproducible until result sealing.
+            const staging = path.join(temp, "proof");
+            await mkdir(staging);
+            const actual = await store.objects.importTree(destination, staging, d => store.protect(lease, d), input.signal);
+            evidence.materializedTree = actual.resource;
+            evidence.materialized_task_digest = identity("hitch-materialized-task@1", actual.resource);
+            await rm(staging, { recursive: true });
+            input.signal?.throwIfAborted();
+            await rename(temp, directory);
+            await atomicWriteJSON(path.join(store.directory, "workspace-records", `${id}.json`), evidence);
+            return evidence;
+        }, input.signal);
+    }
+    catch (error) {
+        await rm(temp, { recursive: true, force: true });
+        // If published, retain the workspace and execution lease for explicit recovery.
+        if (!await lstat(directory).catch(() => undefined))
+            await store.finishLease(lease.id, "ended");
+        throw error;
+    }
+}
+export async function finishResourceWorkspace(store, id, confirmation) {
+    if (!/^[a-f0-9-]{36}$/.test(id) || confirmation.executionEnded !== true || confirmation.resultSealed !== true)
+        throw new TypeError("workspace cleanup requires execution end and result sealing confirmation");
+    await store.locked(async () => {
+        const file = path.join(store.directory, "workspace-records", `${id}.json`), record = parseStrictJson(await readFile(file, "utf8"));
+        parseResourceTask(record.plan.task);
+        if (record.protocol !== "hitch-resource-workspace@1" || record.id !== id || record.taskDirectory !== path.join(store.directory, "workspaces", id, record.plan.task.task_id))
+            throw new TypeError("workspace ownership record mismatch");
+        record.state = "sealed";
+        await atomicWriteJSON(file, record);
+        await rm(path.join(store.directory, "workspaces", id), { recursive: true, force: true });
+        const lease = await store.readRecord("leases", record.leaseId);
+        if (!lease)
+            throw new Error("workspace lease missing");
+        validateLease(lease);
+        await store.finishLeaseLocked(lease);
+        record.state = "removed";
+        await atomicWriteJSON(file, record);
+    });
+}
+//# sourceMappingURL=materialize.js.map

package/dist/src/resources/materialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialize.js","sourceRoot":"","sources":["../../../src/resources/materialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAW,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/H,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,IAAI,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAU,eAAe,EAA8C,MAAM,eAAe,CAAC;AACzH,OAAO,EAAiB,aAAa,EAAsB,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAC;AAkB1G,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAoB,EAAE,IAAkB,EAAE,KAA4F;IAClL,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChM,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC5F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC;IAC7H,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,GAAG,SAAS,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnJ,MAAM,QAAQ,GAAsB,EAAE,QAAQ,EAAE,4BAA4B,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,wBAAwB,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IAC/P,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YACxK,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACrN,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAgB,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7J,IAAI,MAAM,CAAC,MAAM,GAAG,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACrG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;YACjF,MAAM,IAAI,GAAG,KAAK,EAAE,MAA0B,EAAE,MAAc,EAAE,IAAY,EAAE,UAAmB,EAAE,EAAE;gBACnG,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAAC,IAAI,KAAK,GAAG,KAAK,CAAC;gBAC5F,IAAI,IAAI,KAAK,MAAM;oBAAE,IAAI,CAAC;wBAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,sBAAsB,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;wBAAC,KAAK,GAAG,IAAI,CAAC;oBAAC,CAAC;oBAChK,OAAO,KAAK,EAAE,CAAC;wBAAC,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,IAAI,SAAS,CAAC;wBAAC,IAAI,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;4BAAE,MAAM,KAAK,CAAC;wBAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;oBAAC,CAAC;gBACzQ,IAAI,KAAK;oBAAE,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC;qBACnC,CAAC;oBACJ,IAAI,QAAQ,CAAC,WAAW,GAAG,IAAI,GAAG,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;oBACtG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;oBACzM,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;oBAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC;gBAClH,CAAC;gBACD,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACpI,CAAC,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,EAAE,QAA6C,EAAE,MAAc,EAAE,EAAE;gBACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;gBACvE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;wBAAE,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;wBAChE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC9C,MAAM,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxG,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,IAAI,OAAO,CAAC,GAAG,KAAK,mBAAmB;oBAAE,SAAS;gBAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAE,CAAC;gBAC/I,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,sEAAsE;gBACtE,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAwB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACvL,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;oBAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAAC,CAAC;qBAC/E,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,YAAY;oBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;;oBACrI,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,EAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,MAAc,EAAE,GAAW,EAAE,MAAc,EAAE,EAAE;oBAChH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;oBAAC,IAAI,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;oBAC/I,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBAChD,CAAC,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAAC,MAAM,UAAU,CAAC,IAAI,EAAE,mCAAmC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrL,CAAC;YACD,6EAA6E;YAC7E,6EAA6E;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAChH,QAAQ,CAAC,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC5C,QAAQ,CAAC,wBAAwB,GAAG,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3F,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACvE,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAAC,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9H,OAAO,QAAQ,CAAC;QAClB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,gFAAgF;QAChF,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAAE,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/F,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAoB,EAAE,EAAU,EAAE,YAA0D;IACxI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,IAAI,YAAY,CAAC,YAAY,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAC;IAC/M,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;QACxJ,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,KAAK,4BAA4B,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QACxO,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC;QAAC,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAgB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAClM,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;QAAC,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/resources/object-store.js

@@ -0,0 +1,191 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, readdir, rename, rm, statfs, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { syncDirectory } from "../foundation/index.js";
+import { canonical, compare, hash, natural, parseStrictJson, parseTree, portablePath, sha } from "./protocol.js";
+export const DEFAULT_RESOURCE_LIMITS = { maxObjectBytes: 1024 ** 3, maxTotalBytes: 8 * 1024 ** 3, maxFiles: 100_000, minFreeBytes: 64 * 1024 ** 2, maxViewBytes: 512 * 1024 ** 2 };
+export function limits(input = {}) {
+    if (Object.keys(input).some(k => !Object.keys(DEFAULT_RESOURCE_LIMITS).includes(k)))
+        throw new TypeError("unknown resource budget");
+    const value = { ...DEFAULT_RESOURCE_LIMITS, ...input };
+    Object.values(value).forEach(natural);
+    return value;
+}
+const signature = (s) => [s.dev, s.ino, s.mode, s.size, s.mtimeMs, s.ctimeMs].join(":");
+export class ObjectStore {
+    root;
+    budget;
+    directory;
+    constructor(root, budget = DEFAULT_RESOURCE_LIMITS) {
+        this.root = root;
+        this.budget = budget;
+        this.directory = path.join(root, "store", "benchmark-resources");
+    }
+    objectPath(digest) { return path.join(this.directory, "objects", "sha256", sha(digest).slice(7)); }
+    async verify(digest, expectedSize, file = this.objectPath(digest)) {
+        const info = await lstat(file);
+        if (!info.isFile() || info.isSymbolicLink() || info.size > this.budget.maxObjectBytes || expectedSize !== undefined && info.size !== expectedSize)
+            throw new Error("resource object type or size mismatch");
+        const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            if (signature(await handle.stat()) !== signature(info))
+                throw new Error("resource object changed while opening");
+            const h = createHash("sha256");
+            let size = 0;
+            for await (const chunk of handle.createReadStream({ autoClose: false })) {
+                size += chunk.length;
+                if (size > this.budget.maxObjectBytes)
+                    throw new Error("resource object byte budget exceeded");
+                h.update(chunk);
+            }
+            if (`sha256:${h.digest("hex")}` !== digest || size !== info.size || signature(await handle.stat()) !== signature(info) || signature(await lstat(file)) !== signature(info))
+                throw new Error("resource object digest mismatch or concurrent modification");
+            return size;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async readTree(digest) {
+        const size = await this.verify(digest);
+        if (size > 16 * 1024 ** 2)
+            throw new Error("tree manifest byte budget exceeded");
+        const text = await readFile(this.objectPath(digest), "utf8"), tree = parseTree(parseStrictJson(text));
+        if (hash(text) !== digest || text !== canonical(tree))
+            throw new Error("non-canonical tree manifest");
+        if (tree.entries.length > this.budget.maxFiles)
+            throw new Error("tree file budget exceeded");
+        return tree;
+    }
+    async publish(staged, digest, size, protect) {
+        await protect(digest); // Durable producer lease precedes first visibility.
+        const destination = this.objectPath(digest);
+        await mkdir(path.dirname(destination), { recursive: true });
+        const existing = await lstat(destination).catch((e) => { if (e.code !== "ENOENT")
+            throw e; return undefined; });
+        if (existing) {
+            await this.verify(digest, size);
+            await rm(staged);
+            return false;
+        }
+        const quarantined = path.join(this.directory, "quarantine", digest.slice(7));
+        if (await lstat(quarantined).catch((e) => { if (e.code !== "ENOENT")
+            throw e; return undefined; })) {
+            await this.verify(digest, size, quarantined);
+            await rename(quarantined, destination);
+            await syncDirectory(path.dirname(destination));
+            await rm(path.join(this.directory, "quarantine-index", `${digest.slice(7)}.json`), { force: true });
+            await rm(staged);
+            return false;
+        }
+        // All publishers and GC hold the store lock. An existing empty/corrupt object
+        // is never overwritten and shared files are never hardlinked into workspaces.
+        const handle = await open(staged, "r");
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(staged, destination);
+        await syncDirectory(path.dirname(destination));
+        await this.verify(digest, size);
+        return true;
+    }
+    async importFile(source, staging, protect, signal) {
+        signal?.throwIfAborted();
+        const info = await lstat(source);
+        if (!info.isFile() || info.isSymbolicLink())
+            throw new TypeError("resource import requires a regular file");
+        if (info.size > this.budget.maxObjectBytes || info.size > this.budget.maxTotalBytes)
+            throw new Error("resource object byte budget exceeded");
+        const space = await statfs(staging, { bigint: true });
+        if (space.bsize * space.bavail < BigInt(info.size + this.budget.minFreeBytes))
+            throw new Error("resource import free-space reserve exceeded");
+        const input = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW), file = path.join(staging, randomUUID());
+        try {
+            if (signature(await input.stat()) !== signature(info))
+                throw new Error("resource source changed");
+            const output = await open(file, "wx", 0o600), digest = createHash("sha256");
+            let size = 0;
+            try {
+                for await (const chunk of input.createReadStream({ autoClose: false })) {
+                    signal?.throwIfAborted();
+                    size += chunk.length;
+                    if (size > this.budget.maxObjectBytes || size > info.size)
+                        throw new Error("resource source grew past byte budget");
+                    digest.update(chunk);
+                    await output.writeFile(chunk);
+                }
+                await output.sync();
+            }
+            finally {
+                await output.close();
+            }
+            if (size !== info.size || signature(await input.stat()) !== signature(info) || signature(await lstat(source)) !== signature(info))
+                throw new Error("resource source changed during import");
+            const resource = { kind: "blob", digest: `sha256:${digest.digest("hex")}`, size };
+            signal?.throwIfAborted();
+            return { resource, storedBytes: await this.publish(file, resource.digest, size, protect) ? size : 0 };
+        }
+        finally {
+            await input.close();
+            await rm(file, { force: true });
+        }
+    }
+    async importTree(source, staging, protect, signal) {
+        const snapshot = [];
+        let logicalBytes = 0, storedBytes = 0;
+        const visit = async (file, name) => {
+            signal?.throwIfAborted();
+            const info = await lstat(file);
+            if (!info.isFile() && !info.isDirectory())
+                throw new TypeError("resource import refuses links and special files");
+            if (name)
+                portablePath(name);
+            snapshot.push({ name, file, info });
+            if (snapshot.length > this.budget.maxFiles + 1)
+                throw new Error("resource file budget exceeded");
+            if (info.isFile()) {
+                logicalBytes += info.size;
+                if (info.size > this.budget.maxObjectBytes || logicalBytes > this.budget.maxTotalBytes)
+                    throw new Error("resource total byte budget exceeded");
+            }
+            else
+                for (const child of (await readdir(file)).sort(compare))
+                    await visit(path.join(file, child), name ? `${name}/${child}` : child);
+        };
+        await visit(source, "");
+        if (!snapshot[0]?.info.isDirectory())
+            throw new TypeError("tree source must be a directory");
+        // Validate shape, Unicode and case collisions before publishing any content.
+        const skeleton = { protocol: "hitch-tree@1", entries: snapshot.filter(e => e.name).map(e => e.info.isDirectory()
+                ? { path: e.name, kind: "directory" } : { path: e.name, kind: "file", digest: `sha256:${"0".repeat(64)}`, size: e.info.size, executable: Boolean(e.info.mode & 0o111) }).sort((a, b) => compare(a.path, b.path)) };
+        parseTree(skeleton);
+        const entries = [];
+        for (const e of snapshot) {
+            if (signature(await lstat(e.file)) !== signature(e.info))
+                throw new Error("resource source path changed");
+            if (!e.name)
+                continue;
+            if (e.info.isDirectory())
+                entries.push({ path: e.name, kind: "directory" });
+            else {
+                const imported = await this.importFile(e.file, staging, protect, signal);
+                storedBytes += imported.storedBytes;
+                entries.push({ path: e.name, kind: "file", digest: imported.resource.digest, size: imported.resource.size, executable: Boolean(e.info.mode & 0o111) });
+            }
+        }
+        for (const e of snapshot)
+            if (signature(await lstat(e.file)) !== signature(e.info))
+                throw new Error("resource source changed during tree import");
+        const tree = parseTree({ protocol: "hitch-tree@1", entries: entries.sort((a, b) => compare(a.path, b.path)) }), text = canonical(tree), manifestDigest = hash(text), file = path.join(staging, randomUUID());
+        if (Buffer.byteLength(text) > Math.min(this.budget.maxObjectBytes, 16 * 1024 ** 2))
+            throw new Error("tree manifest byte budget exceeded");
+        await writeFile(file, text, { flag: "wx", mode: 0o600 });
+        storedBytes += await this.publish(file, manifestDigest, Buffer.byteLength(text), protect) ? Buffer.byteLength(text) : 0;
+        return { resource: { kind: "tree", format: "hitch-tree@1", manifestDigest }, logicalBytes, storedBytes };
+    }
+}
+//# sourceMappingURL=object-store.js.map

package/dist/src/resources/object-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-store.js","sourceRoot":"","sources":["../../../src/resources/object-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxG,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAoC,MAAM,eAAe,CAAC;AAGnJ,MAAM,CAAC,MAAM,uBAAuB,GAAmB,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACnM,MAAM,UAAU,MAAM,CAAC,QAAiC,EAAE;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACpI,MAAM,KAAK,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,KAAK,EAAE,CAAC;IAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,OAAO,KAAK,CAAC;AAC9G,CAAC;AACD,MAAM,SAAS,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/F,MAAM,OAAO,WAAW;IAED;IAAuB;IADnC,SAAS,CAAS;IAC3B,YAAqB,IAAY,EAAW,SAAS,uBAAuB;QAAvD,SAAI,GAAJ,IAAI,CAAQ;QAAW,WAAM,GAAN,MAAM,CAA0B;QAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAAC,CAAC;IACnJ,UAAU,CAAC,MAAc,IAAY,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,YAAqB,EAAE,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAChF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC5M,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjH,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YACnN,IAAI,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC1P,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACtG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY,EAAE,OAA0C;QACpG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,oDAAoD;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAwB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvI,IAAI,QAAQ,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAClF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAwB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAAC,MAAM,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAAC,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACrI,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QACtI,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QACtG,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAAC,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAClI,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,OAA0C,EAAE,MAAoB;QAChH,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC5G,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7I,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC9I,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACrH,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC1F,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;oBACvE,MAAM,EAAE,cAAc,EAAE,CAAC;oBAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;oBAC/C,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBACpH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACnC,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC5L,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAY,EAAE,IAAI,EAAE,CAAC;YACrG,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,CAAC;gBAAS,CAAC;YAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,OAA0C,EAAE,MAAoB;QAChH,MAAM,QAAQ,GAAuD,EAAE,CAAC;QAAC,IAAI,YAAY,GAAG,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,IAAY,EAAiB,EAAE;YAChE,MAAM,EAAE,cAAc,EAAE,CAAC;YAAC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;YAClH,IAAI,IAAI;gBAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACjG,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC;gBAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAAC,CAAC;;gBAC5L,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvI,CAAC,CAAC;QACF,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACtH,6EAA6E;QAC7E,MAAM,QAAQ,GAAiB,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;gBAC7J,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACrN,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC1G,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS;YACtB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;iBACvE,CAAC;gBAAC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QACjR,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClJ,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7M,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1I,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,WAAW,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxH,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;IAC3G,CAAC;CACF"}

package/dist/src/resources/oci-layer-validation.js

@@ -0,0 +1,202 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { Writable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGunzip } from "node:zlib";
+import path from "node:path";
+export const DEFAULT_IMAGE_IMPORT_BUDGET = { maxExpandedBytes: 8 * 1024 ** 3, maxFiles: 100_000 };
+const utf8 = new TextDecoder("utf-8", { fatal: true });
+const text = (bytes) => utf8.decode(bytes.subarray(0, bytes.indexOf(0) < 0 ? bytes.length : bytes.indexOf(0)));
+function number(bytes) {
+    const value = text(bytes).trim();
+    if (!/^[0-7]*$/.test(value))
+        throw new Error("unsupported OCI tar numeric encoding");
+    const parsed = parseInt(value || "0", 8);
+    if (!Number.isSafeInteger(parsed))
+        throw new Error("OCI tar size overflow");
+    return parsed;
+}
+function safePath(value) {
+    if (!value || Buffer.byteLength(value) > 4096 || value.startsWith("/") || /[\\\0]/.test(value) || value.split("/").some(part => part === ".." || Buffer.byteLength(part) > 255))
+        throw new Error("unsafe OCI layer path");
+    return path.posix.normalize(value).replace(/\/$/, "");
+}
+/** Inspects an uncompressed tar stream without writing any entry to disk.
+ * Supports regular entries, directories, links, PAX metadata and GNU long names.
+ * Sparse files and unknown entry/metadata formats fail closed before Docker runs. */
+class TarBudget {
+    budget;
+    files = 0;
+    header = Buffer.alloc(512);
+    fill = 0;
+    remaining = 0;
+    content = 0;
+    extension = "";
+    metadata = [];
+    zeros = 0;
+    pending = {};
+    paths = new Map();
+    parents = new Set();
+    constructor(budget) {
+        this.budget = budget;
+    }
+    accept(bytes) {
+        let offset = 0;
+        while (offset < bytes.length) {
+            if (this.remaining) {
+                const size = Math.min(this.remaining, bytes.length - offset);
+                if (this.extension && this.content)
+                    this.metadata.push(Buffer.from(bytes.subarray(offset, offset + Math.min(size, this.content))));
+                this.content = Math.max(0, this.content - size);
+                this.remaining -= size;
+                offset += size;
+                if (!this.remaining && this.extension)
+                    this.finishExtension();
+                continue;
+            }
+            const headerBytes = Math.min(512 - this.fill, bytes.length - offset);
+            bytes.copy(this.header, this.fill, offset, offset + headerBytes);
+            this.fill += headerBytes;
+            offset += headerBytes;
+            if (this.fill !== 512)
+                continue;
+            this.fill = 0;
+            if (this.header.every(n => n === 0)) {
+                this.zeros++;
+                continue;
+            }
+            if (this.zeros)
+                throw new Error("OCI tar data after end marker");
+            const sum = this.header.reduce((n, byte, i) => n + (i >= 148 && i < 156 ? 32 : byte), 0);
+            if (sum !== number(this.header.subarray(148, 156)))
+                throw new Error("OCI tar checksum mismatch");
+            if (++this.files > this.budget.maxFiles)
+                throw new Error("OCI layer entry budget exceeded");
+            const type = String.fromCharCode(this.header[156] || 48), rawSize = number(this.header.subarray(124, 136));
+            const magic = this.header.subarray(257, 263).toString("latin1");
+            if (!["ustar\0", "ustar ", "\0\0\0\0\0\0"].includes(magic))
+                throw new Error("unsupported OCI tar header format");
+            if (["x", "g", "L", "K"].includes(type)) {
+                if (rawSize < 1 || rawSize > 64 * 1024)
+                    throw new Error("OCI tar metadata budget exceeded");
+                this.extension = type;
+                this.content = rawSize;
+                this.remaining = Math.ceil(rawSize / 512) * 512;
+                continue;
+            }
+            if (!["0", "1", "2", "5"].includes(type))
+                throw new Error(`unsupported OCI tar entry type: ${type}`);
+            const metadata = this.pending;
+            this.pending = {};
+            const prefix = magic === "ustar\0" ? text(this.header.subarray(345, 500)) : "", name = safePath(metadata.path ?? `${prefix ? `${prefix}/` : ""}${text(this.header.subarray(0, 100))}`);
+            if (name === "." && type !== "5")
+                throw new Error("invalid OCI root entry");
+            if (this.paths.has(name))
+                throw new Error("duplicate OCI layer path");
+            if (type !== "5" && this.parents.has(name))
+                throw new Error("OCI layer path replaces a parent directory");
+            const parts = name.split("/");
+            for (let i = 1; i < parts.length; i++) {
+                const parentPath = parts.slice(0, i).join("/");
+                this.parents.add(parentPath);
+                const parent = this.paths.get(parentPath);
+                if (parent && parent !== "5")
+                    throw new Error("OCI layer path traverses a non-directory entry");
+            }
+            this.paths.set(name, type);
+            const size = metadata.size === undefined ? rawSize : Number(metadata.size);
+            if (!Number.isSafeInteger(size) || size < 0 || size > this.budget.maxExpandedBytes)
+                throw new Error("OCI layer expanded byte budget exceeded");
+            if (type !== "0" && size !== 0)
+                throw new Error("OCI non-file entry contains data");
+            if (type === "1" || type === "2") {
+                const target = metadata.linkpath ?? text(this.header.subarray(157, 257));
+                if (!target || Buffer.byteLength(target) > 4096 || /[\\\0]/.test(target))
+                    throw new Error("unsafe OCI layer link");
+                if (type === "1")
+                    safePath(target);
+                else {
+                    // Absolute symlinks are container-root relative. Relative links must
+                    // stay within that root; no host path is ever opened by this scanner.
+                    const resolved = path.posix.normalize(target.startsWith("/") ? target.slice(1) : path.posix.join(path.posix.dirname(name), target));
+                    if (resolved === ".." || resolved.startsWith("../"))
+                        throw new Error("unsafe OCI layer link escape");
+                }
+            }
+            this.remaining = Math.ceil(size / 512) * 512;
+        }
+    }
+    finishExtension() {
+        const bytes = Buffer.concat(this.metadata);
+        this.metadata = [];
+        const type = this.extension;
+        this.extension = "";
+        if (type === "L" || type === "K") {
+            this.pending[type === "L" ? "path" : "linkpath"] = text(bytes);
+            return;
+        }
+        const values = {};
+        for (let offset = 0; offset < bytes.length;) {
+            const space = bytes.indexOf(32, offset), lengthText = bytes.subarray(offset, space).toString();
+            const length = Number(lengthText);
+            if (space < offset || !/^[1-9][0-9]*$/.test(lengthText) || !Number.isSafeInteger(length) || length <= space - offset + 1 || offset + length > bytes.length || bytes[offset + length - 1] !== 10)
+                throw new Error("invalid OCI PAX record");
+            const value = utf8.decode(bytes.subarray(space + 1, offset + length - 1)), equals = value.indexOf("="), key = value.slice(0, equals);
+            if (equals < 1 || Object.hasOwn(values, key))
+                throw new Error("invalid OCI PAX key");
+            if (!["path", "linkpath", "size", "mtime", "atime", "ctime", "uid", "gid", "uname", "gname", "charset", "comment", "LIBARCHIVE.creationtime"].includes(key) && !key.startsWith("SCHILY.xattr."))
+                throw new Error(`unsupported OCI PAX metadata: ${key}`);
+            values[key] = value.slice(equals + 1);
+            offset += length;
+        }
+        if (values.size !== undefined && !/^(0|[1-9][0-9]*)$/.test(values.size))
+            throw new Error("invalid OCI PAX size");
+        if (type === "g") {
+            if (["path", "linkpath", "size"].some(key => key in values))
+                throw new Error("unsupported OCI global path/size override");
+        }
+        else
+            for (const key of ["path", "linkpath", "size"])
+                if (values[key] !== undefined)
+                    this.pending[key] = values[key];
+    }
+    finish() {
+        if (this.fill || this.remaining || this.zeros < 2 || Object.keys(this.pending).length)
+            throw new Error("truncated OCI layer tar");
+    }
+}
+export async function validateOciLayer(file, start, size, mediaType, budget, signal) {
+    const gzip = ["application/vnd.oci.image.layer.v1.tar+gzip", "application/vnd.docker.image.rootfs.diff.tar.gzip"].includes(mediaType);
+    if (!gzip && mediaType !== "application/vnd.oci.image.layer.v1.tar" && mediaType !== "application/vnd.docker.image.rootfs.diff.tar")
+        throw new Error(`unsupported OCI layer media type: ${mediaType}`);
+    if (!size)
+        throw new Error("empty OCI layer blob");
+    const parser = new TarBudget(budget), hash = createHash("sha256");
+    let expandedBytes = 0;
+    // A Writable preserves the parser failure across pipeline teardown on Node 22;
+    // throwing from an async-iterator sink can replace it with an AbortError.
+    const consume = new Writable({
+        write(chunk, _encoding, callback) {
+            try {
+                signal?.throwIfAborted();
+                expandedBytes += chunk.length;
+                if (expandedBytes > budget.maxExpandedBytes)
+                    throw new Error("OCI layer expanded byte budget exceeded");
+                hash.update(chunk);
+                parser.accept(chunk);
+                callback();
+            }
+            catch (error) {
+                callback(error instanceof Error ? error : new Error(String(error)));
+            }
+        }
+    });
+    const input = createReadStream(file, { start, end: start + size - 1 });
+    if (gzip)
+        await pipeline(input, createGunzip(), consume, { signal });
+    else
+        await pipeline(input, consume, { signal });
+    parser.finish();
+    return { expandedBytes, files: parser.files, diffId: `sha256:${hash.digest("hex")}` };
+}
+//# sourceMappingURL=oci-layer-validation.js.map

package/dist/src/resources/oci-layer-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-layer-validation.js","sourceRoot":"","sources":["../../../src/resources/oci-layer-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,MAAM,CAAC,MAAM,2BAA2B,GAAsB,EAAE,gBAAgB,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACrH,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvH,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1N,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;qFAEqF;AACrF,MAAM,SAAS;IAYgB;IAX7B,KAAK,GAAG,CAAC,CAAC;IACF,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,CAAC;IACT,SAAS,GAAG,CAAC,CAAC;IACd,OAAO,GAAG,CAAC,CAAC;IACZ,SAAS,GAAG,EAAE,CAAC;IACf,QAAQ,GAAa,EAAE,CAAC;IACxB,KAAK,GAAG,CAAC,CAAC;IACV,OAAO,GAA2B,EAAE,CAAC;IACrC,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAC1D,MAAM,CAAC,KAAa;QAClB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;gBAC7D,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO;oBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;gBAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;gBAAC,MAAM,IAAI,IAAI,CAAC;gBACxF,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;oBAAE,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;YAAC,MAAM,IAAI,WAAW,CAAC;YAClH,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG;gBAAE,SAAS;YAChC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAChE,IAAI,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACjG,IAAI,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3G,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACjH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC5F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;gBAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;gBAAC,SAAS;YAC3G,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;YACrG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACvL,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5E,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACtE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC1C,IAAI,MAAM,IAAI,MAAM,KAAK,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC/I,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACpF,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACnH,IAAI,IAAI,KAAK,GAAG;oBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;qBAC9B,CAAC;oBACJ,qEAAqE;oBACrE,sEAAsE;oBACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;oBACpI,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACvG,CAAC;YACH,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;QAC/C,CAAC;IACH,CAAC;IACO,eAAe;QACrB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACjD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7G,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;YAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3O,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACrI,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACrF,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;YACzP,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAAC,MAAM,IAAI,MAAM,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACjH,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5H,CAAC;;YAAM,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC;gBAAE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;oBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAE,CAAC;IACzH,CAAC;IACD,MAAM;QACJ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpI,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,SAAiB,EAAE,MAAyB,EAAE,MAAoB;IAClJ,MAAM,IAAI,GAAG,CAAC,6CAA6C,EAAE,mDAAmD,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACtI,IAAI,CAAC,IAAI,IAAI,SAAS,KAAK,wCAAwC,IAAI,SAAS,KAAK,8CAA8C;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;IACvM,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAAC,IAAI,aAAa,GAAG,CAAC,CAAC;IACzF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC;QAC3B,KAAK,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;YACtC,IAAI,CAAC;gBACH,MAAM,EAAE,cAAc,EAAE,CAAC;gBAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;gBACxD,IAAI,aAAa,GAAG,MAAM,CAAC,gBAAgB;oBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBACxG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,QAAQ,EAAE,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAC1F,CAAC;KACF,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,IAAI;QAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;;QAChE,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AACzG,CAAC"}