agent-hitch 0.2.13 → 0.2.14

package/dist/src/resources/oci-provider.js

@@ -0,0 +1,101 @@
+import { DockerRegistryResolver, resolveRegistryEnvironmentImage } from "../images/index.js";
+import { durableWriteJSON } from "../foundation/index.js";
+import { lstat, mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { exportRegistryBundle, fetchRegistryManifest, verifyRegistryManifest, importRegistryBundle, validateRegistryBundle, isRegistryBundle } from "./oci-registry-bundle.js";
+import { DEFAULT_IMAGE_IMPORT_BUDGET } from "./oci-layer-validation.js";
+import { DEFAULT_RESOURCE_LIMITS } from "./object-store.js";
+import { sha } from "./protocol.js";
+/** Transport is deliberately separate from the lock and all task identities. */
+export class DockerResourceImageProvider {
+    root;
+    transport;
+    resolver;
+    offline;
+    imagePolicy;
+    budget;
+    protocol = "hitch-oci-provider@1";
+    constructor(root, transport, resolver = new DockerRegistryResolver({ policy: "cache-first" }), offline = {}, imagePolicy = "cache-first", budget = DEFAULT_RESOURCE_LIMITS) {
+        this.root = root;
+        this.transport = transport;
+        this.resolver = resolver;
+        this.offline = offline;
+        this.imagePolicy = imagePolicy;
+        this.budget = budget;
+        if (resolver instanceof DockerRegistryResolver)
+            this.resolver = resolver.withBeforePull(async (reference, platform, signal) => {
+                const resource = { kind: "oci-image", manifestDigest: sha(reference.split("@")[1]), platform };
+                const staging = path.join(root, "store", "benchmark-resources", "staging");
+                await mkdir(staging, { recursive: true });
+                const temporary = await mkdtemp(path.join(staging, "oci-validation-")), file = path.join(temporary, "bundle");
+                try {
+                    await exportRegistryBundle(resource, reference, file, { maxBytes: Math.min(budget.maxObjectBytes, budget.maxTotalBytes), minFreeBytes: budget.minFreeBytes }, signal);
+                    const validated = await validateRegistryBundle(resource, file, signal, { maxExpandedBytes: budget.maxTotalBytes, maxFiles: budget.maxFiles });
+                    await durableWriteJSON(this.proofFile(resource), { manifest: validated.manifest });
+                }
+                finally {
+                    await rm(temporary, { recursive: true, force: true });
+                }
+            });
+    }
+    proofFile(resource) { return path.join(this.root, "store", "benchmark-resources", "oci-manifests", `${resource.manifestDigest.slice(7)}.json`); }
+    async exportArchive(resource, destination, signal, budget) {
+        if (this.offline.exportFormat === "docker-archive")
+            throw new Error("docker-archive cannot preserve verified manifest and expanded-layer budgets; use registry-bundle");
+        const image = await this.resolve(resource, signal);
+        return exportRegistryBundle(resource, image.reference, destination, budget ?? { maxBytes: 1024 ** 3, minFreeBytes: 64 * 1024 ** 2 }, signal);
+    }
+    async validateArchive(resource, source, signal, budget = DEFAULT_IMAGE_IMPORT_BUDGET) {
+        if (!await isRegistryBundle(source))
+            throw new Error("unvalidated Docker archives are unsupported; import a registry-bundle");
+        return (await validateRegistryBundle(resource, source, signal, budget)).usage;
+    }
+    async importArchive(resource, source, signal, budget = DEFAULT_IMAGE_IMPORT_BUDGET) {
+        signal = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]);
+        const reference = this.transport[resource.manifestDigest];
+        if (!reference)
+            throw new Error("offline OCI transport missing");
+        if (await isRegistryBundle(source)) {
+            if (!this.offline.registry)
+                throw new Error("registry bundle import requires an explicitly configured local offline registry");
+            const raw = await importRegistryBundle(resource, source, reference, this.offline.registry, signal, budget);
+            await durableWriteJSON(this.proofFile(resource), { manifest: raw });
+            // Only the explicitly configured loopback registry is contacted here.
+            // Normal execution remains cache-only and uses the exact original digest.
+            await new DockerRegistryResolver({ policy: "registry" }).resolve(reference, resource.platform, signal);
+        }
+        else
+            throw new Error("unvalidated Docker archives are unsupported; import a registry-bundle");
+        await new DockerRegistryResolver({ policy: "cache-only" }).resolve(reference, resource.platform, signal);
+    }
+    async resolve(resource, signal) {
+        signal = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]);
+        if (resource.indexDigest)
+            throw new Error("this OCI provider does not support index membership verification; supply a platform manifest without an index lock");
+        const reference = this.transport[resource.manifestDigest];
+        if (!reference || !reference.endsWith(`@${resource.manifestDigest}`) || /[\s\0]/.test(reference))
+            throw new Error("immutable OCI resource transport is missing or mismatched");
+        const { manifest } = await resolveRegistryEnvironmentImage({ root: this.root, benchmarkId: "benchmark-resource", benchmarkRevision: resource.manifestDigest,
+            reference, platform: resource.platform, resolver: this.resolver, ...(signal ? { signal } : {}) });
+        if (!manifest.output.config_digest)
+            throw new Error("OCI resource provider must verify the config digest");
+        const file = this.proofFile(resource), info = await lstat(file).catch(e => { if (e.code !== "ENOENT")
+            throw e; return undefined; });
+        let raw;
+        if (info) {
+            if (!info.isFile() || info.size > 4 * 1024 ** 2)
+                throw new Error("invalid cached OCI manifest proof");
+            raw = JSON.parse(await readFile(file, "utf8")).manifest;
+        }
+        else {
+            if (this.imagePolicy === "cache-only")
+                throw new Error("cache-only OCI manifest proof missing; import a registry bundle or verify the image online first");
+            raw = await fetchRegistryManifest(resource, reference, signal);
+        }
+        verifyRegistryManifest(raw, resource, manifest.output.config_digest);
+        if (!info)
+            await durableWriteJSON(file, { manifest: raw });
+        return { imageId: manifest.image_id, manifestDigest: manifest.output.manifest_digest, configDigest: manifest.output.config_digest, platform: manifest.platform, reference: manifest.output.reference };
+    }
+}
+//# sourceMappingURL=oci-provider.js.map

package/dist/src/resources/oci-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-provider.js","sourceRoot":"","sources":["../../../src/resources/oci-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,+BAA+B,EAA8B,MAAM,oBAAoB,CAAC;AAGzH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAA4B,MAAM,0BAA0B,CAAC;AACzM,OAAO,EAAE,2BAA2B,EAA0B,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,uBAAuB,EAAuB,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,gFAAgF;AAChF,MAAM,OAAO,2BAA2B;IAEjB;IAAuB;IAA4C;IAAkG;IAA4C;IAAsC;IADnQ,QAAQ,GAAG,sBAA+B,CAAC;IACpD,YAAqB,IAAY,EAAW,SAAiC,EAAW,WAAkC,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,EAAW,UAA+B,EAAE,EAAW,cAAc,aAAa,EAAW,SAAyB,uBAAuB;QAAvS,SAAI,GAAJ,IAAI,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAwB;QAAW,aAAQ,GAAR,QAAQ,CAA+E;QAAW,YAAO,GAAP,OAAO,CAA0B;QAAW,gBAAW,GAAX,WAAW,CAAgB;QAAW,WAAM,GAAN,MAAM,CAA0C;QAC1T,IAAI,QAAQ,YAAY,sBAAsB;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAC5H,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,WAAoB,EAAE,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;gBACxG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAC9G,IAAI,CAAC;oBACH,MAAM,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;oBACtK,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC9I,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACrF,CAAC;wBAAS,CAAC;oBAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;YACtE,CAAC,CAAC,CAAC;IACL,CAAC;IACO,SAAS,CAAC,QAAkD,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnM,KAAK,CAAC,aAAa,CAAC,QAAkD,EAAE,WAAmB,EAAE,MAAoB,EAAE,MAAmD;QACpK,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;QACxK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/I,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,QAAkD,EAAE,MAAc,EAAE,MAAoB,EAAE,SAA4B,2BAA2B;QACrK,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC9H,OAAO,CAAC,MAAM,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,QAAkD,EAAE,MAAc,EAAE,MAAoB,EAAE,SAA4B,2BAA2B;QACnK,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC5H,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YAC/H,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3G,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzG,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAChG,MAAM,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3G,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAAkD,EAAE,MAAoB;QACpF,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,QAAQ,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,oHAAoH,CAAC,CAAC;QAChK,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/K,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,+BAA+B,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,QAAQ,CAAC,cAAc;YACzJ,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACpI,IAAI,GAAW,CAAC;QAChB,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACtG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;YAC3J,GAAG,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACzM,CAAC;CACF"}

package/dist/src/resources/oci-registry-bundle.js

@@ -0,0 +1,253 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { open, rm, statfs } from "node:fs/promises";
+import path from "node:path";
+import { canonical, hash, natural, object, parseStrictJson, sha } from "./protocol.js";
+import { DEFAULT_IMAGE_IMPORT_BUDGET, validateOciLayer } from "./oci-layer-validation.js";
+// Exact registry bytes, not a tar extraction or a reconstructed manifest.
+// API: https://distribution.github.io/distribution/spec/api/
+const MAGIC = Buffer.from("HITCH-OCI-REGISTRY-1\n"), MAX_HEADER = 4 * 1024 ** 2;
+const ACCEPT = "application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json";
+const FETCH_ACCEPT = `${ACCEPT}, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json`;
+export function registryLocation(reference) {
+    const [name, digest] = reference.split("@");
+    sha(digest);
+    const components = name.split("/"), explicit = /[.:]/.test(components[0]) || components[0] === "localhost";
+    const host = explicit ? components.shift() : "registry-1.docker.io";
+    if (components.length === 1 && !explicit)
+        components.unshift("library");
+    const repository = components.join("/");
+    if (!/^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/.test(repository))
+        throw new Error("invalid registry repository");
+    const local = /^(localhost|127\.0\.0\.1)(:\d+)?$/.test(host);
+    return { origin: `${local ? "http" : "https"}://${host === "docker.io" ? "registry-1.docker.io" : host}`, repository, digest: digest };
+}
+export function localRegistry(value) {
+    const url = new URL(value);
+    if (!["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+        throw new Error("offline registry must be an explicitly configured loopback origin");
+    return url;
+}
+async function boundedBody(response, maximum) {
+    if (!response.ok || !response.body)
+        throw new Error(`OCI registry request failed: HTTP ${response.status}`);
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of response.body) {
+        size += chunk.length;
+        if (size > maximum)
+            throw new Error("OCI response byte budget exceeded");
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+function descriptors(manifest, image) {
+    if (hash(manifest) !== image.manifestDigest)
+        throw new Error("offline OCI manifest digest mismatch");
+    const m = parseStrictJson(manifest);
+    if (m.schemaVersion !== 2 || !Array.isArray(m.layers) || !ACCEPT.split(", ").includes(String(m.mediaType)))
+        throw new Error("offline registry format requires a platform image manifest, not an index");
+    const parse = (v) => { const d = v; if (!d || typeof d !== "object" || d.urls !== undefined)
+        throw new Error("foreign OCI blobs are unsupported"); return { digest: sha(d.digest), size: natural(d.size) }; };
+    const layers = m.layers.map(v => ({ ...parse(v), mediaType: String(v.mediaType) }));
+    const config = parse(m.config), entries = [config, ...layers], unique = new Map();
+    for (const e of entries) {
+        if (unique.has(e.digest) && unique.get(e.digest).size !== e.size)
+            throw new Error("conflicting OCI descriptor sizes");
+        unique.set(e.digest, e);
+    }
+    return { blobs: [...unique.values()].map(({ digest, size }) => ({ digest, size })).sort((a, b) => a.digest.localeCompare(b.digest)), layers, mediaType: String(m.mediaType), config };
+}
+async function registryReader(reference, signal) {
+    const location = registryLocation(reference);
+    let token;
+    return async (suffix, accept) => {
+        const url = `${location.origin}/v2/${location.repository}/${suffix}`;
+        const request = () => fetch(url, { signal, headers: { ...(accept ? { accept } : {}), ...(token ? { authorization: `Bearer ${token}` } : {}) } });
+        let response = await request();
+        if (response.status === 401 && !token) {
+            const challenge = response.headers.get("www-authenticate") ?? "";
+            await response.body?.cancel();
+            const realm = challenge.match(/realm="([^"]+)"/)?.[1], service = challenge.match(/service="([^"]+)"/)?.[1];
+            if (!challenge.startsWith("Bearer ") || !realm)
+                throw new Error("registry bundle export supports anonymous bearer authentication only");
+            const auth = new URL(realm);
+            if (auth.protocol !== "https:" || auth.username || auth.password)
+                throw new Error("unsafe registry authentication endpoint");
+            if (service)
+                auth.searchParams.set("service", service);
+            auth.searchParams.set("scope", `repository:${location.repository}:pull`);
+            const value = parseStrictJson((await boundedBody(await fetch(auth, { signal }), 64 * 1024)).toString());
+            token = typeof value.token === "string" ? value.token : typeof value.access_token === "string" ? value.access_token : undefined;
+            if (!token)
+                throw new Error("registry authentication unavailable");
+            response = await request();
+        }
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error(`OCI registry request failed: HTTP ${response.status}`);
+        }
+        return response;
+    };
+}
+export async function fetchRegistryManifest(image, reference, signal) {
+    const bounded = AbortSignal.any([AbortSignal.timeout(30_000), ...(signal ? [signal] : [])]);
+    const get = await registryReader(reference, bounded), manifest = (await boundedBody(await get(`manifests/${image.manifestDigest}`, FETCH_ACCEPT), MAX_HEADER)).toString();
+    descriptors(manifest, image);
+    return manifest;
+}
+export function verifyRegistryManifest(manifest, image, configDigest) {
+    if (descriptors(manifest, image).config.digest !== configDigest)
+        throw new Error("OCI manifest config differs from actual Docker image");
+}
+export async function exportRegistryBundle(image, reference, file, budget, signal) {
+    const bounded = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]);
+    const get = await registryReader(reference, bounded), manifest = (await boundedBody(await get(`manifests/${image.manifestDigest}`, FETCH_ACCEPT), MAX_HEADER)).toString();
+    const { blobs } = descriptors(manifest, image), header = Buffer.from(JSON.stringify({ protocol: "hitch-oci-registry-bundle@1", manifest, blobs })), length = Buffer.alloc(4);
+    length.writeUInt32BE(header.length);
+    const total = MAGIC.length + 4 + header.length + blobs.reduce((n, b) => n + b.size, 0);
+    if (header.length > MAX_HEADER || total > budget.maxBytes)
+        throw new Error("offline OCI archive budget exceeded");
+    const space = await statfs(path.dirname(file), { bigint: true });
+    if (space.bavail * space.bsize < BigInt(total + budget.minFreeBytes))
+        throw new Error("offline OCI free-space reserve exceeded");
+    const output = await open(file, "wx", 0o600);
+    try {
+        await output.writeFile(Buffer.concat([MAGIC, length, header]));
+        for (const blob of blobs) {
+            let size = 0;
+            const digest = createHash("sha256"), response = await get(`blobs/${blob.digest}`);
+            for await (const chunk of response.body) {
+                bounded.throwIfAborted();
+                size += chunk.length;
+                if (size > blob.size)
+                    throw new Error("OCI blob exceeds its manifest size");
+                digest.update(chunk);
+                await output.writeFile(chunk);
+            }
+            if (size !== blob.size || `sha256:${digest.digest("hex")}` !== blob.digest)
+                throw new Error("OCI blob integrity mismatch");
+        }
+        await output.sync();
+    }
+    catch (error) {
+        await rm(file, { force: true });
+        throw error;
+    }
+    finally {
+        await output.close();
+    }
+}
+export async function isRegistryBundle(file) {
+    const handle = await open(file, "r");
+    try {
+        const buffer = Buffer.alloc(MAGIC.length);
+        await handle.read(buffer, 0, buffer.length, 0);
+        return buffer.equals(MAGIC);
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Validates digests, expanded bytes, entry counts and tar paths without extraction. */
+export async function validateRegistryBundle(image, file, signal, budget = DEFAULT_IMAGE_IMPORT_BUDGET) {
+    natural(budget.maxExpandedBytes);
+    natural(budget.maxFiles);
+    const bounded = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]), handle = await open(file, "r");
+    let manifest, blobs, layers, mediaType, config, offset;
+    try {
+        const prefix = Buffer.alloc(MAGIC.length + 4);
+        await handle.read(prefix, 0, prefix.length, 0);
+        const length = prefix.readUInt32BE(MAGIC.length);
+        if (!prefix.subarray(0, MAGIC.length).equals(MAGIC) || length > MAX_HEADER)
+            throw new Error("invalid OCI bundle header");
+        const header = Buffer.alloc(length);
+        if ((await handle.read(header, 0, length, prefix.length)).bytesRead !== length)
+            throw new Error("truncated OCI header");
+        const raw = object(parseStrictJson(header.toString()), ["protocol", "manifest", "blobs"]);
+        if (raw.protocol !== "hitch-oci-registry-bundle@1" || typeof raw.manifest !== "string")
+            throw new Error("invalid OCI bundle protocol");
+        manifest = raw.manifest;
+        ({ blobs, layers, mediaType, config } = descriptors(manifest, image));
+        if (canonical(raw.blobs) !== canonical(blobs))
+            throw new Error("OCI bundle inventory mismatch");
+        offset = prefix.length + length;
+        if ((await handle.stat()).size !== offset + blobs.reduce((n, b) => n + b.size, 0))
+            throw new Error("OCI bundle size mismatch");
+    }
+    finally {
+        await handle.close();
+    }
+    let position = offset;
+    const positions = new Map();
+    let diffIds = [];
+    for (const blob of blobs) {
+        positions.set(blob.digest, position);
+        const digest = createHash("sha256"), chunks = [];
+        if (blob.size)
+            for await (const chunk of createReadStream(file, { start: position, end: position + blob.size - 1 })) {
+                bounded.throwIfAborted();
+                digest.update(chunk);
+                if (blob.digest === config.digest) {
+                    if (blob.size > MAX_HEADER)
+                        throw new Error("OCI config size budget exceeded");
+                    chunks.push(chunk);
+                }
+            }
+        if (`sha256:${digest.digest("hex")}` !== blob.digest)
+            throw new Error("offline OCI blob digest mismatch");
+        if (blob.digest === config.digest) {
+            const c = parseStrictJson(Buffer.concat(chunks).toString());
+            if (`${c.os}/${c.architecture}${c.variant ? `/${c.variant}` : ""}` !== image.platform)
+                throw new Error("offline OCI config platform mismatch");
+            const rootfs = c.rootfs;
+            if (!rootfs || rootfs.type !== "layers" || !Array.isArray(rootfs.diff_ids) || rootfs.diff_ids.length !== layers.length)
+                throw new Error("offline OCI config layer inventory mismatch");
+            diffIds = rootfs.diff_ids.map(sha);
+        }
+        position += blob.size;
+    }
+    const usage = { expandedBytes: 0, files: 0 };
+    for (const [i, layer] of layers.entries()) {
+        const observed = await validateOciLayer(file, positions.get(layer.digest), layer.size, layer.mediaType, { maxExpandedBytes: budget.maxExpandedBytes - usage.expandedBytes, maxFiles: budget.maxFiles - usage.files }, bounded);
+        if (observed.diffId !== diffIds[i])
+            throw new Error("offline OCI uncompressed layer digest mismatch");
+        usage.expandedBytes += observed.expandedBytes;
+        usage.files += observed.files;
+    }
+    return { manifest: manifest, blobs: blobs, mediaType: mediaType, offset: offset, usage };
+}
+/** Validates every layer before any local registry or Docker mutation. */
+export async function importRegistryBundle(image, file, reference, registry, signal, budget = DEFAULT_IMAGE_IMPORT_BUDGET) {
+    const origin = localRegistry(registry), location = registryLocation(reference);
+    if (new URL(location.origin).host !== origin.host)
+        throw new Error("offline image transport must name the configured local registry");
+    const bounded = AbortSignal.any([AbortSignal.timeout(120_000), ...(signal ? [signal] : [])]);
+    const { manifest, blobs, mediaType, offset } = await validateRegistryBundle(image, file, bounded, budget);
+    let position = offset;
+    const api = `${origin.origin}/v2/${location.repository}`;
+    for (const blob of blobs) {
+        const head = await fetch(`${api}/blobs/${blob.digest}`, { method: "HEAD", signal: bounded, redirect: "error" });
+        if (head.status !== 200) {
+            if (head.status !== 404)
+                throw new Error(`offline registry probe failed: ${head.status}`);
+            const start = await fetch(`${api}/blobs/uploads/`, { method: "POST", signal: bounded, redirect: "error" });
+            await start.body?.cancel();
+            const upload = new URL(start.headers.get("location") ?? "", api);
+            if (start.status !== 202 || upload.origin !== origin.origin || !upload.pathname.startsWith(`/v2/${location.repository}/blobs/uploads/`))
+                throw new Error("unsafe local registry upload location");
+            upload.searchParams.set("digest", blob.digest);
+            const response = await fetch(upload, { method: "PUT", signal: bounded, redirect: "error", headers: { "content-type": "application/octet-stream", "content-length": String(blob.size) }, body: blob.size ? createReadStream(file, { start: position, end: position + blob.size - 1 }) : Buffer.alloc(0), duplex: "half" });
+            await response.body?.cancel();
+            if (response.status !== 201)
+                throw new Error(`offline registry blob upload failed: ${response.status}`);
+        }
+        position += blob.size;
+    }
+    const result = await fetch(`${api}/manifests/${image.manifestDigest}`, { method: "PUT", signal: bounded, redirect: "error", headers: { "content-type": mediaType }, body: manifest });
+    await result.body?.cancel();
+    if (result.status !== 201)
+        throw new Error(`offline registry manifest publication failed: ${result.status}`);
+    return manifest;
+}
+//# sourceMappingURL=oci-registry-bundle.js.map

package/dist/src/resources/oci-registry-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-registry-bundle.js","sourceRoot":"","sources":["../../../src/resources/oci-registry-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAS,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAiB,MAAM,eAAe,CAAC;AACtG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAiD,MAAM,2BAA2B,CAAC;AAEzI,0EAA0E;AAC1E,6DAA6D;AAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,UAAU,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAChF,MAAM,MAAM,GAAG,kGAAkG,CAAC;AAClH,MAAM,YAAY,GAAG,GAAG,MAAM,sGAAsG,CAAC;AAKrI,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC;IAC7G,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACrE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ;QAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,mEAAmE,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1I,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAAO,EAAE,CAAC;AAC1I,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvR,OAAO,GAAG,CAAC;AACb,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,QAAkB,EAAE,OAAe;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAiB,EAAE,CAAC;IAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAC9C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,IAA4C,EAAE,CAAC;QAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QAAC,IAAI,IAAI,GAAG,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IACxM,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AACD,SAAS,WAAW,CAAC,QAAgB,EAAE,KAAY;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACrG,MAAM,CAAC,GAAG,eAAe,CAAC,QAAQ,CAA4B,CAAC;IAC/D,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACxM,MAAM,KAAK,GAAG,CAAC,CAAU,EAAc,EAAE,GAAG,MAAM,CAAC,GAAG,CAA4B,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9P,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAE,CAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAC7K,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;AACxL,CAAC;AACD,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAmB;IAClE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAAC,IAAI,KAAyB,CAAC;IAC5E,OAAO,KAAK,EAAE,MAAc,EAAE,MAAe,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,MAAM,OAAO,QAAQ,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjJ,IAAI,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAChG,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YACxI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC1J,IAAI,OAAO;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,QAAQ,CAAC,UAAU,OAAO,CAAC,CAAC;YACjI,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAA4B,CAAC;YACnI,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YAChI,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAAC,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,QAAQ,CAAC;IAChJ,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAY,EAAE,SAAiB,EAAE,MAAoB;IAC/F,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,MAAM,GAAG,CAAC,aAAa,KAAK,CAAC,cAAc,EAAE,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1K,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAAC,OAAO,QAAQ,CAAC;AAChD,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,KAAY,EAAE,YAAoB;IACzF,IAAI,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAC3I,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAY,EAAE,SAAiB,EAAE,IAAY,EAAE,MAAc,EAAE,MAAoB;IAC5H,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,MAAM,GAAG,CAAC,aAAa,KAAK,CAAC,cAAc,EAAE,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1K,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,6BAA6B,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClN,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU,IAAI,KAAK,GAAG,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACnM,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,GAAG,CAAC,CAAC;YAAC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAChG,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,IAA4C,EAAE,CAAC;gBAChF,OAAO,CAAC,cAAc,EAAE,CAAC;gBAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnL,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,UAAU,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7H,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrG,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACzM,CAAC;AACD,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAY,EAAE,IAAY,EAAE,MAAoB,EAAE,SAA4B,2BAA2B;IACpJ,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7H,IAAI,QAAgB,EAAE,KAAmB,EAAE,MAAiD,EAAE,SAAiB,EAAE,MAAkB,EAAE,MAAc,CAAC;IACpJ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3K,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7J,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,QAAQ,KAAK,6BAA6B,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACvI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/F,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAChG,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjI,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACnC,IAAI,QAAQ,GAAG,MAAO,CAAC;IAAC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAAC,IAAI,OAAO,GAAa,EAAE,CAAC;IAChG,KAAK,MAAM,IAAI,IAAI,KAAM,EAAE,CAAC;QAC1B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAa,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAO,CAAC,MAAM,EAAE,CAAC;oBAAC,IAAI,IAAI,CAAC,IAAI,GAAG,UAAU;wBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,CAAC;YAAC,CAAC;QACpT,IAAI,UAAU,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1G,IAAI,IAAI,CAAC,MAAM,KAAK,MAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAA4B,CAAC;YACvF,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,KAAK,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC/I,MAAM,MAAM,GAAG,CAAC,CAAC,MAA6C,CAAC;YAC/D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACxL,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,KAAK,GAAqB,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QAChO,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtG,KAAK,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAAC,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAS,EAAE,KAAK,EAAE,KAAM,EAAE,SAAS,EAAE,SAAU,EAAE,MAAM,EAAE,MAAO,EAAE,KAAK,EAAE,CAAC;AAC/F,CAAC;AACD,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAY,EAAE,IAAY,EAAE,SAAiB,EAAE,QAAgB,EAAE,MAAoB,EAAE,SAA4B,2BAA2B;IACvL,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC/E,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1G,IAAI,QAAQ,GAAG,MAAM,CAAC;IACtB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,KAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACvI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YACjE,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,UAAU,iBAAiB,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAClM,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAiB,CAAC,CAAC;YACzU,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,cAAc,KAAK,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,SAAU,EAAE,EAAE,IAAI,EAAE,QAAS,EAAE,CAAC,CAAC;IACxL,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1I,OAAO,QAAS,CAAC;AACnB,CAAC"}

package/dist/src/resources/protocol.js

@@ -0,0 +1,222 @@
+import { createHash } from "node:crypto";
+export const RESOURCE_CAPABILITIES = ["blob@1", "tree@1", "oci-image@1", "input-file@1", "input-tree@1", "environment-image@1", "private-copy@1", "read-only@1"];
+export function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.keys(value).sort(compare).map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+    const result = JSON.stringify(value);
+    if (result === undefined || typeof value === "number" && !Number.isFinite(value))
+        throw new TypeError("non-canonical JSON value");
+    return result;
+}
+export function hash(bytes) { return `sha256:${createHash("sha256").update(bytes).digest("hex")}`; }
+export function identity(domain, value) { return hash(canonical({ protocol: domain, value })); }
+export function compare(a, b) { return Buffer.compare(Buffer.from(a), Buffer.from(b)); }
+export function object(value, keys) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("resource record must be an object");
+    const result = value;
+    if (Object.keys(result).some(key => !keys.includes(key)))
+        throw new TypeError("unknown resource field");
+    return result;
+}
+export function sha(value) {
+    if (typeof value !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value))
+        throw new TypeError("invalid resource SHA-256");
+    return value;
+}
+export function natural(value) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new TypeError("resource size must be a non-negative safe integer");
+    return value;
+}
+export function resourceId(value) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(value) || value === "." || value === "..")
+        throw new TypeError("invalid resource ID");
+    return value;
+}
+export function portablePath(value) {
+    if (typeof value !== "string" || !value || value.length > 4096 || value.normalize("NFC") !== value
+        || /[\\\x00-\x1f\x7f:]/.test(value) || value.split("/").some(part => !part || part === "." || part === ".." || /[. ]$/.test(part)
+        || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part)))
+        throw new TypeError("non-portable resource path");
+    return value;
+}
+export function parseResource(value) {
+    const raw = object(value, ["kind", "digest", "size", "format", "manifestDigest", "platform", "indexDigest"]);
+    if (raw.kind === "blob") {
+        object(raw, ["kind", "digest", "size"]);
+        return { kind: "blob", digest: sha(raw.digest), size: natural(raw.size) };
+    }
+    if (raw.kind === "tree") {
+        object(raw, ["kind", "format", "manifestDigest"]);
+        if (raw.format !== "hitch-tree@1")
+            throw new TypeError("unsupported resource tree format");
+        return { kind: "tree", format: raw.format, manifestDigest: sha(raw.manifestDigest) };
+    }
+    if (raw.kind === "oci-image") {
+        object(raw, ["kind", "manifestDigest", "platform", "indexDigest"]);
+        if (typeof raw.platform !== "string" || !/^linux\/(amd64|arm64)(\/v[0-9]+)?$/.test(raw.platform))
+            throw new TypeError("unsupported OCI platform");
+        return { kind: "oci-image", manifestDigest: sha(raw.manifestDigest), platform: raw.platform,
+            ...(raw.indexDigest === undefined ? {} : { indexDigest: sha(raw.indexDigest) }) };
+    }
+    throw new TypeError("unsupported resource kind");
+}
+export function parseResourceLock(value) {
+    const raw = object(value, ["protocol", "resources", "bindings", "requiredCapabilities"]);
+    if (raw.protocol !== "hitch-resource-lock@1")
+        throw new TypeError("unsupported resource lock protocol");
+    if (!raw.resources || typeof raw.resources !== "object" || Array.isArray(raw.resources))
+        throw new TypeError("resources must be a map");
+    const resources = Object.fromEntries(Object.entries(raw.resources).sort(([a], [b]) => compare(a, b)).map(([id, resource]) => [resourceId(id), parseResource(resource)]));
+    if (!Array.isArray(raw.requiredCapabilities) || raw.requiredCapabilities.some(c => typeof c !== "string" || !/^[a-z][a-z0-9-]*@[1-9][0-9]*$/.test(c))
+        || new Set(raw.requiredCapabilities).size !== raw.requiredCapabilities.length)
+        throw new TypeError("invalid required resource capabilities");
+    if (!Array.isArray(raw.bindings))
+        throw new TypeError("resource bindings must be an array");
+    const bindings = raw.bindings.map(value => {
+        const binding = object(value, ["resource", "consumer", "use", "target", "executable", "access", "slot"]);
+        const resource = resourceId(binding.resource), dependency = resources[resource];
+        if (!dependency)
+            throw new TypeError("binding refers to missing resource");
+        const role = object(binding.consumer, ["role", "serviceId"]);
+        let consumer;
+        if (role.role === "service")
+            consumer = { role: "service", serviceId: portablePath(resourceId(role.serviceId)) };
+        else if ((role.role === "candidate" || role.role === "verifier") && role.serviceId === undefined)
+            consumer = { role: role.role };
+        else
+            throw new TypeError("invalid resource consumer");
+        if (consumer.role === "service" && consumer.serviceId.toLowerCase() === "main")
+            throw new TypeError("main is reserved for the candidate role");
+        if (binding.use === "environment-image") {
+            object(binding, ["resource", "consumer", "use", "slot"]);
+            if (dependency.kind !== "oci-image" || binding.slot !== "runtime" && binding.slot !== "build-base")
+                throw new TypeError("invalid environment image binding");
+            return { resource, consumer, use: binding.use, slot: binding.slot };
+        }
+        object(binding, ["resource", "consumer", "use", "target", "executable", "access"]);
+        const target = portablePath(binding.target), access = binding.access;
+        if (access !== "read-only" && access !== "private-copy")
+            throw new TypeError("invalid resource access");
+        if (binding.use === "input-file" && dependency.kind === "blob" && typeof binding.executable === "boolean")
+            return { resource, consumer, use: binding.use, target, access, executable: binding.executable };
+        if (binding.use === "input-tree" && dependency.kind === "tree" && binding.executable === undefined)
+            return { resource, consumer, use: binding.use, target, access };
+        throw new TypeError("resource kind and binding use disagree");
+    });
+    for (const [index, binding] of bindings.entries())
+        for (const other of bindings.slice(0, index)) {
+            if (canonical(binding.consumer).toLowerCase() !== canonical(other.consumer).toLowerCase())
+                continue;
+            if (binding.use === "environment-image" && other.use === "environment-image" && binding.slot === other.slot)
+                throw new TypeError("duplicate environment slot");
+            if (binding.use !== "environment-image" && other.use !== "environment-image") {
+                const a = binding.target.toLocaleLowerCase("en-US"), b = other.target.toLocaleLowerCase("en-US");
+                if (a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`))
+                    throw new TypeError("conflicting resource paths");
+            }
+        }
+    return { protocol: raw.protocol, resources, bindings, requiredCapabilities: [...raw.requiredCapabilities] };
+}
+export function parseTree(value) {
+    const raw = object(value, ["protocol", "entries"]);
+    if (raw.protocol !== "hitch-tree@1" || !Array.isArray(raw.entries))
+        throw new TypeError("unsupported tree manifest");
+    const entries = raw.entries.map(value => {
+        const entry = object(value, ["path", "kind", "digest", "size", "executable"]), name = portablePath(entry.path);
+        if (entry.kind === "directory") {
+            object(entry, ["path", "kind"]);
+            return { path: name, kind: "directory" };
+        }
+        if (entry.kind !== "file" || typeof entry.executable !== "boolean")
+            throw new TypeError("invalid tree entry");
+        return { path: name, kind: "file", digest: sha(entry.digest), size: natural(entry.size), executable: entry.executable };
+    });
+    const paths = new Map();
+    for (const [i, entry] of entries.entries()) {
+        if (i && compare(entries[i - 1].path, entry.path) >= 0)
+            throw new TypeError("tree paths must be unique and byte-sorted");
+        const key = entry.path.toLocaleLowerCase("en-US");
+        if (paths.has(key))
+            throw new TypeError("tree paths collide on a case-insensitive filesystem");
+        paths.set(key, entry);
+        const parts = entry.path.split("/");
+        parts.pop();
+        if (parts.length && paths.get(parts.join("/").toLocaleLowerCase("en-US"))?.kind !== "directory")
+            throw new TypeError("tree parent directory is missing");
+    }
+    return { protocol: raw.protocol, entries };
+}
+/** JSON.parse accepts duplicate keys. Lock/manifest text must reject them before
+ * parsing so a repeated resource ID cannot silently replace its first value. */
+export function parseStrictJson(text) {
+    let at = 0;
+    const white = () => { while (/\s/u.test(text[at] ?? "") && at < text.length)
+        at++; };
+    const string = () => {
+        white();
+        const start = at;
+        if (text[at++] !== '"')
+            throw new TypeError("invalid JSON key");
+        while (at < text.length) {
+            const c = text[at++];
+            if (c === "\\")
+                at++;
+            else if (c === '"')
+                return JSON.parse(text.slice(start, at));
+        }
+        throw new TypeError("unterminated JSON string");
+    };
+    const value = (depth) => {
+        if (depth > 128)
+            throw new TypeError("resource JSON nesting limit exceeded");
+        white();
+        const c = text[at];
+        if (c === '"') {
+            string();
+            return;
+        }
+        if (c === "{" || c === "[") {
+            at++;
+            white();
+            const close = c === "{" ? "}" : "]", keys = new Set();
+            if (text[at] === close) {
+                at++;
+                return;
+            }
+            for (;;) {
+                if (c === "{") {
+                    const key = string();
+                    if (keys.has(key))
+                        throw new TypeError("duplicate JSON key");
+                    keys.add(key);
+                    white();
+                    if (text[at++] !== ":")
+                        throw new TypeError("invalid JSON");
+                }
+                value(depth + 1);
+                white();
+                const end = text[at++];
+                if (end === close)
+                    break;
+                if (end !== ",")
+                    throw new TypeError("invalid JSON");
+            }
+            return;
+        }
+        const start = at;
+        while (at < text.length && !/[\s,}\]]/.test(text[at]))
+            at++;
+        if (at === start)
+            throw new TypeError("invalid JSON");
+    };
+    value(0);
+    white();
+    if (at !== text.length)
+        throw new TypeError("trailing JSON content");
+    return JSON.parse(text);
+}
+//# sourceMappingURL=protocol.js.map