akm-cli 0.9.1 → 0.9.2-alpha.2

package/dist/registry/pinned-transport.js

@@ -0,0 +1,717 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { spawn, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import http from "node:http";
+import https from "node:https";
+import { isIP } from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { PassThrough, Readable } from "node:stream";
+import { createBrotliDecompress, createGunzip, createInflate } from "node:zlib";
+import { bareHostname } from "../core/network-policy.js";
+import { nodePinnedRequestHelperSource } from "./pinned-request-helper.js";
+const MAX_HELPER_PRELUDE_BYTES = 64 * 1024;
+const MAX_HELPER_FRAME_BYTES = 1024 * 1024;
+const MAX_HELPER_STDERR_BYTES = 8 * 1024;
+const MAX_REGISTRY_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
+const FRAME_PRELUDE = 0;
+const FRAME_BODY = 1;
+const FRAME_END = 2;
+const FRAME_ERROR = 3;
+export class RegistryPinnedTransportError extends Error {
+    code = "REGISTRY_PINNED_TRANSPORT";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "RegistryPinnedTransportError";
+    }
+}
+/**
+ * Connect to `address` while retaining the URL hostname for Host, TLS SNI, and
+ * certificate verification. Node uses a request-level pinned lookup. Bun uses
+ * the same Node transport in a fresh one-request helper because Bun's TLS
+ * client currently drops SNI when the connection is pinned to a numeric IP.
+ */
+export async function requestRegistryAddressPinned(url, address, init, timeoutMs, testOptions) {
+    if (isIP(address) === 0)
+        throw new Error(`Pinned registry address is not an IP literal: ${address}`);
+    const nodeExecutable = process.versions.bun ? resolveNodeExecutable(testOptions?.nodeExecutable) : undefined;
+    assertNodeRuntimeVersion();
+    const prepared = await prepareRequest(url, init);
+    if (process.versions.bun) {
+        if (!nodeExecutable)
+            throw new RegistryPinnedTransportError("Pinned registry Node helper is unavailable");
+        return requestWithNodeHelper(url, address, prepared, init, timeoutMs, nodeExecutable, testOptions);
+    }
+    return requestWithNodePinnedLookup(url, address, prepared, init, timeoutMs, testOptions);
+}
+/** Fail before DNS or socket activity when this runtime cannot provide the pinned transport. */
+export function assertRegistryPinnedTransportAvailable() {
+    if (process.versions.bun) {
+        resolveNodeExecutable(undefined);
+        return;
+    }
+    assertNodeRuntimeVersion();
+}
+async function requestWithNodePinnedLookup(url, address, prepared, init, timeoutMs, testOptions) {
+    const hostname = bareHostname(url.hostname);
+    const requestOptions = {
+        protocol: url.protocol,
+        hostname,
+        port: url.port || undefined,
+        path: `${url.pathname}${url.search}`,
+        method: prepared.method,
+        headers: requestHeaders(prepared.headers, url),
+        lookup: pinnedLookup(address),
+        // Never reuse a connection selected for an earlier DNS answer.
+        agent: false,
+        signal: init?.signal ?? undefined,
+    };
+    if (url.protocol === "https:" && isIP(hostname) === 0) {
+        requestOptions.servername = hostname;
+        if (testOptions?.ca)
+            requestOptions.ca = testOptions.ca;
+    }
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let headerTimer;
+        const requestFn = url.protocol === "https:" ? https.request : http.request;
+        const request = requestFn(requestOptions, (incoming) => {
+            if (settled) {
+                incoming.destroy();
+                return;
+            }
+            settled = true;
+            if (headerTimer)
+                clearTimeout(headerTimer);
+            resolve(responseFromIncoming(incoming, prepared.method, init?.signal));
+        });
+        headerTimer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            const error = new Error(`Registry request timed out after ${timeoutMs}ms while awaiting response headers`);
+            reject(error);
+            request.destroy(error);
+        }, timeoutMs);
+        request.once("error", (error) => {
+            if (headerTimer)
+                clearTimeout(headerTimer);
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        });
+        writeRequestBody(request, prepared.body).catch((error) => request.destroy(error));
+    });
+}
+async function requestWithNodeHelper(url, address, prepared, init, timeoutMs, executable, testOptions) {
+    const artifacts = createHelperArtifacts(testOptions?.ca);
+    const env = helperEnvironment(artifacts.caPath);
+    const args = [artifacts.helperPath];
+    let child;
+    try {
+        child = spawn(executable, args, {
+            env,
+            shell: false,
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+        });
+    }
+    catch (error) {
+        artifacts.cleanup();
+        throw new RegistryPinnedTransportError("Unable to start the pinned registry Node helper", { cause: error });
+    }
+    try {
+        testOptions?.onHelperSpawn?.({
+            executable,
+            args: [...args],
+            env: { ...env },
+            directory: artifacts.directory,
+            pid: child.pid,
+        });
+    }
+    catch (error) {
+        child.kill("SIGKILL");
+        artifacts.cleanup();
+        throw error;
+    }
+    let promiseSettled = false;
+    let responseProduced = false;
+    let protocolTerminal = false;
+    let childKilled = false;
+    let consumerCancelled = false;
+    const rawBody = new PassThrough();
+    const stderr = collectLimitedStderr(child.stderr).catch(() => "");
+    const exited = new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("exit", (code, signal) => resolve({ code, signal }));
+    });
+    void exited.then(artifacts.cleanup, artifacts.cleanup);
+    const killChild = () => {
+        if (childKilled || child.exitCode !== null || child.signalCode !== null)
+            return;
+        childKilled = true;
+        child.kill("SIGKILL");
+    };
+    const abortReason = () => {
+        const reason = init?.signal?.reason;
+        return reason instanceof Error ? reason : new Error("Registry request aborted");
+    };
+    return new Promise((resolve, reject) => {
+        const rejectBeforeResponse = (error) => {
+            if (responseProduced) {
+                if (!rawBody.destroyed)
+                    rawBody.destroy(asTransportError(error));
+                return;
+            }
+            if (promiseSettled)
+                return;
+            promiseSettled = true;
+            reject(asTransportError(error));
+        };
+        const onAbort = () => {
+            const error = abortReason();
+            killChild();
+            rejectBeforeResponse(error);
+        };
+        if (init?.signal?.aborted) {
+            onAbort();
+            return;
+        }
+        init?.signal?.addEventListener("abort", onAbort, { once: true });
+        const headerTimer = setTimeout(() => {
+            const error = new RegistryPinnedTransportError(`Registry request timed out after ${timeoutMs}ms while awaiting response headers`);
+            killChild();
+            rejectBeforeResponse(error);
+        }, timeoutMs);
+        void writeHelperRequest(child, url, address, prepared, timeoutMs).catch((error) => {
+            if (protocolTerminal || promiseSettled)
+                return;
+            killChild();
+            rejectBeforeResponse(error);
+        });
+        void pumpHelperFrames(child.stdout, rawBody, exited, {
+            onPrelude: (prelude) => {
+                if (responseProduced)
+                    throw new RegistryPinnedTransportError("Registry helper sent more than one prelude");
+                if (promiseSettled)
+                    throw new RegistryPinnedTransportError("Registry helper responded after the request ended");
+                responseProduced = true;
+                promiseSettled = true;
+                clearTimeout(headerTimer);
+                const response = responseFromRaw(rawBody, prelude, prepared.method, init?.signal, () => {
+                    consumerCancelled = true;
+                    if (!protocolTerminal)
+                        killChild();
+                });
+                resolve(response);
+            },
+            onTerminal: () => {
+                protocolTerminal = true;
+            },
+        })
+            .catch(async (error) => {
+            clearTimeout(headerTimer);
+            killChild();
+            if (consumerCancelled || init?.signal?.aborted) {
+                if (!promiseSettled)
+                    rejectBeforeResponse(abortReason());
+                return;
+            }
+            // Always drain but never surface helper stderr: a failed executable
+            // could echo the private stdin request, including authorization.
+            await stderr;
+            rejectBeforeResponse(new RegistryPinnedTransportError(asErrorMessage(error), { cause: error }));
+        })
+            .finally(() => {
+            clearTimeout(headerTimer);
+            init?.signal?.removeEventListener("abort", onAbort);
+        });
+    });
+}
+function resolveNodeExecutable(override) {
+    if (override === null) {
+        throw new RegistryPinnedTransportError("Pinned registry networking under Bun requires Node.js >= 24 on PATH; no Node executable is available");
+    }
+    const candidates = override === undefined
+        ? (process.env.PATH ?? "")
+            .split(path.delimiter)
+            .filter(Boolean)
+            .map((directory) => path.join(directory, process.platform === "win32" ? "node.exe" : "node"))
+        : [override];
+    for (const candidate of candidates) {
+        if (!path.isAbsolute(candidate))
+            continue;
+        try {
+            const resolved = fs.realpathSync(candidate);
+            if (!path.isAbsolute(resolved) || !fs.statSync(resolved).isFile())
+                continue;
+            fs.accessSync(resolved, fs.constants.X_OK);
+            if (override === undefined && !isSupportedNodeExecutable(resolved))
+                continue;
+            return resolved;
+        }
+        catch {
+            // Try the next PATH entry. The helper itself enforces Node >= 24.
+        }
+    }
+    throw new RegistryPinnedTransportError("Pinned registry networking under Bun requires Node.js >= 24 on PATH. Install Node.js or run akm with Node.");
+}
+function isSupportedNodeExecutable(executable) {
+    const result = spawnSync(executable, ["--version"], {
+        encoding: "utf8",
+        env: helperEnvironment(undefined),
+        maxBuffer: 1_024,
+        shell: false,
+        timeout: 3_000,
+        windowsHide: true,
+    });
+    if (result.error || result.status !== 0)
+        return false;
+    const match = /^v(\d+)\./.exec(result.stdout.trim());
+    const major = match?.[1];
+    return major !== undefined && Number.parseInt(major, 10) >= 24;
+}
+function assertNodeRuntimeVersion() {
+    if (process.versions.bun)
+        return;
+    const major = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
+    if (!Number.isInteger(major) || major < 24) {
+        throw new RegistryPinnedTransportError(`Pinned registry networking requires Node.js >= 24; found ${process.versions.node}`);
+    }
+}
+function createHelperArtifacts(ca) {
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), "akm-registry-helper-"));
+    fs.chmodSync(directory, 0o700);
+    const helperPath = path.join(directory, "request.mjs");
+    const caPath = ca === undefined ? undefined : path.join(directory, "ca.pem");
+    const cleanup = () => {
+        for (const file of [helperPath, caPath]) {
+            if (!file)
+                continue;
+            try {
+                const stat = fs.lstatSync(file, { throwIfNoEntry: false });
+                if (stat?.isFile())
+                    fs.unlinkSync(file);
+            }
+            catch {
+                // A private one-request directory is best-effort cleanup after exit.
+            }
+        }
+        try {
+            fs.rmdirSync(directory);
+        }
+        catch {
+            // Preserve unexpected contents for diagnosis; never recurse here.
+        }
+    };
+    try {
+        const source = nodePinnedRequestHelperSource();
+        fs.writeFileSync(helperPath, source, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        if (caPath && ca !== undefined)
+            fs.writeFileSync(caPath, ca, { flag: "wx", mode: 0o600 });
+        for (const file of [helperPath, caPath]) {
+            if (!file)
+                continue;
+            const stat = fs.lstatSync(file);
+            if (!stat.isFile())
+                throw new RegistryPinnedTransportError("Registry helper artifact is not a regular file");
+        }
+        return { directory, helperPath, caPath, cleanup };
+    }
+    catch (error) {
+        cleanup();
+        if (error instanceof RegistryPinnedTransportError)
+            throw error;
+        throw new RegistryPinnedTransportError("Unable to prepare the pinned registry Node helper", { cause: error });
+    }
+}
+function helperEnvironment(caPath) {
+    const env = {};
+    for (const name of [
+        "SystemRoot",
+        "WINDIR",
+        "TMPDIR",
+        "TEMP",
+        "TMP",
+        "LANG",
+        "LC_ALL",
+        "TZ",
+        "SSL_CERT_FILE",
+        "SSL_CERT_DIR",
+        "NODE_EXTRA_CA_CERTS",
+    ]) {
+        const value = process.env[name];
+        if (value !== undefined)
+            env[name] = value;
+    }
+    if (caPath)
+        env.NODE_EXTRA_CA_CERTS = caPath;
+    return env;
+}
+async function writeHelperRequest(child, url, address, prepared, timeoutMs) {
+    const prelude = Buffer.from(JSON.stringify({
+        url: url.toString(),
+        address,
+        method: prepared.method,
+        headers: [...prepared.headers.entries()],
+        timeoutMs,
+        bodyPresent: prepared.body !== undefined,
+    }));
+    if (prelude.byteLength === 0 || prelude.byteLength > MAX_HELPER_PRELUDE_BYTES) {
+        throw new RegistryPinnedTransportError("Registry helper request prelude exceeds its protocol limit");
+    }
+    const length = Buffer.allocUnsafe(4);
+    length.writeUInt32BE(prelude.byteLength, 0);
+    await writeNodeChunk(child.stdin, length);
+    await writeNodeChunk(child.stdin, prelude);
+    if (prepared.body instanceof Uint8Array) {
+        await writeNodeChunk(child.stdin, prepared.body);
+    }
+    else if (prepared.body) {
+        for await (const chunk of Readable.fromWeb(prepared.body)) {
+            await writeNodeChunk(child.stdin, Buffer.from(chunk));
+        }
+    }
+    await endNodeWritable(child.stdin);
+}
+async function writeNodeChunk(stream, chunk) {
+    await new Promise((resolve, reject) => {
+        stream.write(chunk, (error) => (error ? reject(error) : resolve()));
+    });
+}
+async function endNodeWritable(stream) {
+    await new Promise((resolve, reject) => {
+        stream.once("error", reject);
+        stream.end(() => resolve());
+    });
+}
+async function pumpHelperFrames(stdout, rawBody, exited, callbacks) {
+    const iterator = stdout[Symbol.asyncIterator]();
+    let buffered = Buffer.alloc(0);
+    const readExact = async (length) => {
+        while (buffered.byteLength < length) {
+            const next = await iterator.next();
+            if (next.done)
+                throw new RegistryPinnedTransportError("Registry helper output ended before a terminal frame");
+            buffered = Buffer.concat([buffered, Buffer.from(next.value)]);
+        }
+        const result = buffered.subarray(0, length);
+        buffered = buffered.subarray(length);
+        return result;
+    };
+    let sawPrelude = false;
+    while (true) {
+        const frameHeader = await readExact(5);
+        const type = frameHeader[0];
+        const length = frameHeader.readUInt32BE(1);
+        const limit = type === FRAME_BODY ? MAX_HELPER_FRAME_BYTES : MAX_HELPER_PRELUDE_BYTES;
+        if (length > limit)
+            throw new RegistryPinnedTransportError("Registry helper frame exceeds its protocol limit");
+        const payload = await readExact(length);
+        if (type === FRAME_PRELUDE) {
+            if (sawPrelude)
+                throw new RegistryPinnedTransportError("Registry helper sent duplicate response metadata");
+            const prelude = parseHelperPrelude(payload);
+            sawPrelude = true;
+            callbacks.onPrelude(prelude);
+            // A HEAD or null-body status cancels the transport synchronously from
+            // the prelude callback. Do not consume any body frames already buffered
+            // behind that prelude or wait for a helper that has been terminated.
+            if (rawBody.destroyed)
+                return;
+            continue;
+        }
+        if (type === FRAME_BODY) {
+            if (!sawPrelude)
+                throw new RegistryPinnedTransportError("Registry helper sent body data before response metadata");
+            if (payload.byteLength > 0 && !rawBody.write(payload)) {
+                await new Promise((resolve, reject) => {
+                    const onDrain = () => {
+                        cleanup();
+                        resolve();
+                    };
+                    const onError = (error) => {
+                        cleanup();
+                        reject(error);
+                    };
+                    const cleanup = () => {
+                        rawBody.off("drain", onDrain);
+                        rawBody.off("error", onError);
+                    };
+                    rawBody.once("drain", onDrain);
+                    rawBody.once("error", onError);
+                });
+            }
+            continue;
+        }
+        if (type === FRAME_END) {
+            if (!sawPrelude || length !== 0)
+                throw new RegistryPinnedTransportError("Registry helper sent an invalid end frame");
+            const result = await exited;
+            if (result.code !== 0 || result.signal) {
+                throw new RegistryPinnedTransportError(`Registry helper exited unexpectedly (${result.signal ?? `code ${result.code ?? "unknown"}`})`);
+            }
+            callbacks.onTerminal();
+            rawBody.end();
+            return;
+        }
+        if (type === FRAME_ERROR) {
+            const detail = parseHelperError(payload);
+            throw new RegistryPinnedTransportError(detail);
+        }
+        throw new RegistryPinnedTransportError(`Registry helper sent unknown frame type ${String(type)}`);
+    }
+}
+function parseHelperPrelude(payload) {
+    let candidate;
+    try {
+        candidate = JSON.parse(payload.toString("utf8"));
+    }
+    catch {
+        throw new RegistryPinnedTransportError("Registry helper sent invalid response metadata");
+    }
+    if (typeof candidate !== "object" || candidate === null) {
+        throw new RegistryPinnedTransportError("Registry helper sent invalid response metadata");
+    }
+    const value = candidate;
+    if (typeof value.status !== "number" ||
+        !Number.isInteger(value.status) ||
+        value.status < 200 ||
+        value.status > 599 ||
+        typeof value.statusText !== "string" ||
+        !Array.isArray(value.rawHeaders) ||
+        value.rawHeaders.length > 512 ||
+        value.rawHeaders.length % 2 !== 0 ||
+        value.rawHeaders.some((entry) => typeof entry !== "string" || entry.length > 16_384)) {
+        throw new RegistryPinnedTransportError("Registry helper sent invalid response metadata");
+    }
+    return { status: value.status, statusText: value.statusText, rawHeaders: value.rawHeaders };
+}
+function parseHelperError(payload) {
+    try {
+        const candidate = JSON.parse(payload.toString("utf8"));
+        const message = typeof candidate.message === "string" ? candidate.message : "Pinned registry helper failed";
+        const code = typeof candidate.code === "string" ? ` [${candidate.code}]` : "";
+        return `${message}${code}`;
+    }
+    catch {
+        return "Pinned registry helper failed with an invalid error frame";
+    }
+}
+function collectLimitedStderr(stderr) {
+    return (async () => {
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of stderr) {
+            if (total >= MAX_HELPER_STDERR_BYTES)
+                continue;
+            const buffer = Buffer.from(chunk);
+            const selected = buffer.subarray(0, MAX_HELPER_STDERR_BYTES - total);
+            chunks.push(selected);
+            total += selected.byteLength;
+        }
+        return Buffer.concat(chunks).toString("utf8").trim();
+    })();
+}
+function pinnedLookup(address) {
+    const family = isIP(address);
+    if (family === 0)
+        throw new Error(`Pinned registry address is not an IP literal: ${address}`);
+    return ((_hostname, options, callback) => {
+        if (typeof options === "object" && options.all) {
+            callback(null, [{ address, family }]);
+            return;
+        }
+        callback(null, address, family);
+    });
+}
+async function prepareRequest(url, init) {
+    const method = (init?.method ?? "GET").toUpperCase();
+    const headers = new Headers(init?.headers);
+    const body = init?.body;
+    if (body === undefined || body === null)
+        return { method, headers };
+    if (method === "GET" || method === "HEAD") {
+        throw new TypeError(`Request with ${method} method cannot have a body`);
+    }
+    if (typeof body === "string") {
+        if (!headers.has("content-type"))
+            headers.set("content-type", "text/plain;charset=UTF-8");
+        return { method, headers, body: boundedRequestBytes(new TextEncoder().encode(body)) };
+    }
+    if (body instanceof URLSearchParams) {
+        if (!headers.has("content-type")) {
+            headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+        }
+        return { method, headers, body: boundedRequestBytes(new TextEncoder().encode(body.toString())) };
+    }
+    if (body instanceof Blob) {
+        if (body.type && !headers.has("content-type"))
+            headers.set("content-type", body.type);
+        if (body.size > MAX_REGISTRY_REQUEST_BODY_BYTES)
+            throw requestBodyTooLarge(body.size);
+        return { method, headers, body: boundedRequestBytes(new Uint8Array(await body.arrayBuffer())) };
+    }
+    if (body instanceof FormData) {
+        const encoded = new Request(url, { method, body });
+        for (const [name, value] of encoded.headers) {
+            if (!headers.has(name))
+                headers.set(name, value);
+        }
+        return { method, headers, body: boundedRequestBytes(new Uint8Array(await encoded.arrayBuffer())) };
+    }
+    if (body instanceof ArrayBuffer) {
+        return { method, headers, body: boundedRequestBytes(new Uint8Array(body)) };
+    }
+    if (ArrayBuffer.isView(body)) {
+        return {
+            method,
+            headers,
+            body: boundedRequestBytes(new Uint8Array(body.buffer, body.byteOffset, body.byteLength)),
+        };
+    }
+    if (body instanceof ReadableStream) {
+        return { method, headers, body: boundedRequestStream(body) };
+    }
+    throw new TypeError("Unsupported registry request body type");
+}
+function boundedRequestBytes(body) {
+    if (body.byteLength > MAX_REGISTRY_REQUEST_BODY_BYTES)
+        throw requestBodyTooLarge(body.byteLength);
+    return body;
+}
+function boundedRequestStream(body) {
+    let total = 0;
+    return body.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            if (!(chunk instanceof Uint8Array)) {
+                controller.error(new RegistryPinnedTransportError("Registry request body stream must contain byte chunks"));
+                return;
+            }
+            total += chunk.byteLength;
+            if (total > MAX_REGISTRY_REQUEST_BODY_BYTES) {
+                controller.error(requestBodyTooLarge(total));
+                return;
+            }
+            controller.enqueue(chunk);
+        },
+    }));
+}
+function requestBodyTooLarge(observedBytes) {
+    return new RegistryPinnedTransportError(`Registry request body exceeds ${MAX_REGISTRY_REQUEST_BODY_BYTES} bytes (observed: ${observedBytes})`);
+}
+function requestHeaders(headers, url) {
+    const result = {};
+    for (const [name, value] of headers)
+        result[name] = value;
+    for (const name of [
+        "connection",
+        "keep-alive",
+        "proxy-authorization",
+        "proxy-connection",
+        "te",
+        "trailer",
+        "transfer-encoding",
+        "upgrade",
+    ]) {
+        delete result[name];
+    }
+    // Never let a caller pair the validated socket/TLS identity with an
+    // unrelated HTTP virtual host.
+    result.host = url.host;
+    return result;
+}
+async function writeRequestBody(request, body) {
+    if (!body) {
+        request.end();
+        return;
+    }
+    if (body instanceof Uint8Array) {
+        request.end(body);
+        return;
+    }
+    const readable = Readable.fromWeb(body);
+    readable.once("error", (error) => request.destroy(error));
+    readable.pipe(request);
+}
+function responseFromIncoming(incoming, method, signal) {
+    return responseFromRaw(incoming, {
+        status: incoming.statusCode ?? 500,
+        statusText: incoming.statusMessage ?? "",
+        rawHeaders: incoming.rawHeaders,
+    }, method, signal, () => incoming.destroy());
+}
+function responseFromRaw(raw, metadata, method, signal, onCancel) {
+    const headers = responseHeaders(metadata.rawHeaders);
+    const { status, statusText } = metadata;
+    if (responseMustNotHaveBody(method, status)) {
+        // Draining is unsafe here: a hostile peer can attach an endless chunked
+        // body to a null-body status and retain the pinned socket/helper forever.
+        // Terminate the underlying transport before exposing the bodyless response.
+        onCancel();
+        if (!raw.destroyed)
+            raw.destroy();
+        return new Response(null, { status, statusText, headers });
+    }
+    const decoded = decodeResponseStream(raw, headers.get("content-encoding") ?? "");
+    const onAbort = () => {
+        const reason = signal?.reason;
+        decoded.destroy(reason instanceof Error ? reason : new Error("Registry response body aborted"));
+        onCancel();
+    };
+    if (signal) {
+        if (signal.aborted)
+            onAbort();
+        else
+            signal.addEventListener("abort", onAbort, { once: true });
+        decoded.once("close", () => signal.removeEventListener("abort", onAbort));
+    }
+    decoded.once("error", onCancel);
+    decoded.once("close", onCancel);
+    const body = Readable.toWeb(decoded);
+    return new Response(body, { status, statusText, headers });
+}
+/** Fetch null-body cases accepted by the helper's final-response protocol. */
+function responseMustNotHaveBody(method, status) {
+    // Interim 1xx responses never enter this function: node:http reports them
+    // separately and the helper protocol accepts final statuses from 200 onward.
+    return method === "HEAD" || status === 204 || status === 205 || status === 304;
+}
+function responseHeaders(rawHeaders) {
+    const headers = new Headers();
+    for (let index = 0; index < rawHeaders.length; index += 2) {
+        const name = rawHeaders[index];
+        const value = rawHeaders[index + 1];
+        if (name !== undefined && value !== undefined)
+            headers.append(name, value);
+    }
+    return headers;
+}
+function decodeResponseStream(raw, contentEncoding) {
+    const encodings = contentEncoding
+        .split(",")
+        .map((encoding) => encoding.trim().toLowerCase())
+        .filter(Boolean)
+        .reverse();
+    let stream = raw;
+    for (const encoding of encodings) {
+        if (encoding === "gzip" || encoding === "x-gzip")
+            stream = stream.pipe(createGunzip());
+        else if (encoding === "deflate")
+            stream = stream.pipe(createInflate());
+        else if (encoding === "br")
+            stream = stream.pipe(createBrotliDecompress());
+    }
+    return stream;
+}
+function asTransportError(error) {
+    if (error instanceof Error)
+        return error;
+    return new RegistryPinnedTransportError(String(error));
+}
+function asErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}