emdash 0.36.0 → 0.38.0

package/dist/artifact-fetch-P2JXVwOq.mjs

@@ -0,0 +1,972 @@
+import { i as resolveAndValidateExternalUrlTarget, t as SsrfError } from "./ssrf-gl4gFNhw.mjs";
+import { RECORD_SCOPED_BLOB_CACHE_TYPE } from "@emdash-cms/registry-lexicons";
+
+//#region ../registry-verification/dist/auth-B730dpJ4.js
+const UNSUPPORTED_AUTH_MESSAGE = "This release requires an authentication method the client does not support.";
+function unsupportedAuthDetails(auth) {
+	if (!isRecord$1(auth) || typeof auth.hint_url !== "string" || auth.hint_url.length > 2048) return;
+	try {
+		const url = new URL(auth.hint_url);
+		if (url.protocol !== "https:" || url.username || url.password) return void 0;
+		return { hintUrl: url.href };
+	} catch {
+		return;
+	}
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+//#endregion
+//#region ../registry-verification/dist/errors-CI-j3m_y.js
+function verificationError(code, message, details) {
+	return {
+		success: false,
+		error: {
+			code,
+			message,
+			...details === void 0 ? {} : { details }
+		}
+	};
+}
+
+//#endregion
+//#region ../registry-verification/dist/checksum.js
+const SHA2_256_CODE = 18;
+const SHA2_256_LENGTH = 32;
+const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+/** Derive the required artifact checksum from a raw sha2-256 blob CID. */
+function multihashFromBlobCid(value) {
+	if (!value.startsWith("b")) return verificationError("BLOB_REF_INVALID", "The blob reference CID is malformed.");
+	const bytes = decodeBase32(value.slice(1));
+	if (bytes === null || bytes.length !== 36 || bytes[0] !== 1 || bytes[1] !== 85) return verificationError("BLOB_REF_INVALID", "Blob references must use a CIDv1 raw sha2-256 CID.");
+	const checksum = `b${encodeBase32(bytes.slice(2))}`;
+	if (!decodeMultihash(checksum).success) return verificationError("BLOB_REF_INVALID", "Blob references must use a CIDv1 raw sha2-256 CID.");
+	return {
+		success: true,
+		value: checksum
+	};
+}
+/** Decodes a lowercase base32 multibase-encoded multihash. */
+function decodeMultihash(value) {
+	if (!value.startsWith("b")) return verificationError("INVALID_MULTIHASH", "Checksums must be lowercase base32 multibase-encoded multihashes.");
+	const bytes = decodeBase32(value.slice(1));
+	if (bytes === null) return verificationError("INVALID_MULTIHASH", "The multibase checksum is malformed.");
+	const code = readVarint(bytes, 0);
+	if (code === null) return verificationError("INVALID_MULTIHASH", "The multihash algorithm code is malformed.");
+	const length = readVarint(bytes, code.nextOffset);
+	if (length === null || length.value !== bytes.length - length.nextOffset) return verificationError("INVALID_MULTIHASH", "The multihash digest length is malformed.");
+	if (code.value !== SHA2_256_CODE) return verificationError("UNSUPPORTED_MULTIHASH", "The multihash algorithm is not supported.");
+	if (length.value !== SHA2_256_LENGTH) return verificationError("INVALID_MULTIHASH", "The sha2-256 digest must be 32 bytes.");
+	return {
+		success: true,
+		value: {
+			algorithm: "sha2-256",
+			digest: bytes.slice(length.nextOffset)
+		}
+	};
+}
+async function computeArtifactDigestCandidates(bytes) {
+	const [sha256, sha384, sha512] = await Promise.all([
+		crypto.subtle.digest("SHA-256", new Uint8Array(bytes)),
+		crypto.subtle.digest("SHA-384", new Uint8Array(bytes)),
+		crypto.subtle.digest("SHA-512", new Uint8Array(bytes))
+	]);
+	return [
+		new Uint8Array(sha256),
+		new Uint8Array(sha384),
+		new Uint8Array(sha512)
+	];
+}
+async function verifyMultihash(bytes, expected) {
+	const decoded = decodeMultihash(expected);
+	if (!decoded.success) return decoded;
+	const actual = await computeDigest(bytes, decoded.value.algorithm);
+	if (!actual.success) return actual;
+	if (!compareDigestBytes(actual.value, decoded.value.digest)) return verificationError("CHECKSUM_MISMATCH", "The resource bytes do not match the expected checksum.");
+	return {
+		success: true,
+		value: true
+	};
+}
+/**
+* Compare public checksum digest bytes without early exit. Digests are public
+* integrity metadata, so a portable byte loop is preferable to a Node-only
+* timing primitive while still avoiding an ordinary equality short circuit.
+*/
+function compareDigestBytes(left, right) {
+	let difference = left.length ^ right.length;
+	const maximumLength = Math.max(left.length, right.length);
+	for (let index = 0; index < maximumLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+	return difference === 0;
+}
+async function computeDigest(bytes, algorithm) {
+	if (algorithm !== "sha2-256") return verificationError("UNSUPPORTED_MULTIHASH", "The multihash algorithm is not supported.");
+	try {
+		return {
+			success: true,
+			value: new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(bytes)))
+		};
+	} catch {
+		return verificationError("UNSUPPORTED_MULTIHASH", "The sha2-256 algorithm is unavailable.");
+	}
+}
+function readVarint(bytes, offset) {
+	let value = 0;
+	let shift = 0;
+	for (let index = offset; index < bytes.length && index < offset + 5; index += 1) {
+		const byte = bytes[index];
+		if (byte === void 0) return null;
+		value |= (byte & 127) << shift;
+		if ((byte & 128) === 0) return {
+			value,
+			nextOffset: index + 1
+		};
+		shift += 7;
+	}
+	return null;
+}
+function encodeBase32(bytes) {
+	let result = "";
+	let buffer = 0;
+	let bits = 0;
+	for (const byte of bytes) {
+		buffer = buffer << 8 | byte;
+		bits += 8;
+		while (bits >= 5) {
+			result += BASE32_ALPHABET[buffer >>> bits - 5 & 31] ?? "";
+			bits -= 5;
+		}
+	}
+	if (bits > 0) result += BASE32_ALPHABET[buffer << 5 - bits & 31] ?? "";
+	return result;
+}
+function decodeBase32(value) {
+	if (value.length === 0) return null;
+	let buffer = 0;
+	let bits = 0;
+	const output = [];
+	for (const character of value) {
+		const digit = BASE32_ALPHABET.indexOf(character);
+		if (digit === -1) return null;
+		buffer = buffer << 5 | digit;
+		bits += 5;
+		if (bits >= 8) {
+			output.push(buffer >>> bits - 8 & 255);
+			bits -= 8;
+		}
+	}
+	if (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return null;
+	return new Uint8Array(output);
+}
+
+//#endregion
+//#region ../registry-verification/dist/fetch-C8Kl1l1t.js
+const DIGITS = /^\d+$/;
+const IPV4_LITERAL = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+const IPV4_PART = /^\d{1,3}$/;
+const IPV6_PART = /^[0-9a-f]{1,4}$/i;
+const TRAILING_DOT$1 = /\.+$/;
+const DEFAULT_FETCH_LIMITS = {
+	headerTimeoutMs: 1e4,
+	totalTimeoutMs: 3e4,
+	maxBytes: 25 * 1024 * 1024,
+	maxRedirects: 3
+};
+async function fetchVerifiedResource(value, options) {
+	const limits = {
+		headerTimeoutMs: options.headerTimeoutMs ?? DEFAULT_FETCH_LIMITS.headerTimeoutMs,
+		totalTimeoutMs: options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs,
+		maxBytes: options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes,
+		maxRedirects: options.maxRedirects ?? DEFAULT_FETCH_LIMITS.maxRedirects
+	};
+	if (!areValidLimits(limits)) return verificationError("INVALID_URL", "Fetch limits must be positive integers.");
+	const startedAt = Date.now();
+	let currentUrl = parseAndValidateUrl(value, void 0, options.allowHttpLocalhost === true);
+	if (!currentUrl.success) return currentUrl;
+	for (let redirects = 0;; redirects += 1) {
+		const remaining = limits.totalTimeoutMs - (Date.now() - startedAt);
+		if (remaining <= 0) return verificationError("RESOURCE_TIMEOUT", "The resource fetch exceeded its total timeout.");
+		const host = isAllowedLoopback(currentUrl.value, options.allowHttpLocalhost === true) ? {
+			success: true,
+			value: true
+		} : await validateHost(currentUrl.value, options.resolveHostname, remaining);
+		if (!host.success) return host;
+		const remainingAfterResolution = limits.totalTimeoutMs - (Date.now() - startedAt);
+		if (remainingAfterResolution <= 0) return verificationError("RESOURCE_TIMEOUT", "The resource fetch exceeded its total timeout.");
+		const response = await fetchResponse(options.fetch, currentUrl.value, Math.min(remainingAfterResolution, limits.headerTimeoutMs));
+		if (!response.success) return response;
+		if (isRedirect(response.value.status)) {
+			if (redirects >= limits.maxRedirects) return verificationError("REDIRECT_LIMIT_EXCEEDED", "The resource exceeded the redirect limit.");
+			const location = response.value.headers.get("location");
+			if (location === null) return verificationError("REDIRECT_LOCATION_MISSING", "The redirect response has no location header.");
+			currentUrl = parseAndValidateUrl(location, currentUrl.value, options.allowHttpLocalhost === true);
+			if (!currentUrl.success) return currentUrl;
+			continue;
+		}
+		if (!response.value.ok && !options.allowedStatuses?.includes(response.value.status)) return verificationError("RESOURCE_STATUS_ERROR", `The resource returned HTTP ${response.value.status}.`);
+		const contentLength = response.value.headers.get("content-length");
+		if (contentLength !== null && (!DIGITS.test(contentLength) || Number(contentLength) > limits.maxBytes)) return verificationError("RESOURCE_SIZE_EXCEEDED", "The resource exceeds the byte limit.");
+		const bytes = await readResponse(response.value, limits.maxBytes, startedAt, limits.totalTimeoutMs);
+		if (!bytes.success) return bytes;
+		return {
+			success: true,
+			value: {
+				bytes: bytes.value,
+				url: currentUrl.value,
+				status: response.value.status,
+				headers: response.value.headers
+			}
+		};
+	}
+}
+function parseAndValidateUrl(value, base, allowHttpLocalhost = false) {
+	let url;
+	try {
+		url = new URL(value, base);
+	} catch {
+		return verificationError("INVALID_URL", "The resource URL is invalid.");
+	}
+	if (url.protocol !== "https:" && !isAllowedLoopback(url, allowHttpLocalhost) || url.username !== "" || url.password !== "") return verificationError("INVALID_URL", "Resource URLs must use HTTPS and cannot include credentials.");
+	if (!isAllowedLoopback(url, allowHttpLocalhost) && (isIpLiteral(url.hostname) || isLocalHostname(url.hostname))) return verificationError("HOST_REJECTED", "The resource host is not permitted.");
+	return {
+		success: true,
+		value: url
+	};
+}
+function isAllowedLoopback(url, enabled) {
+	if (!enabled || url.protocol !== "http:" && url.protocol !== "https:") return false;
+	const hostname = url.hostname.toLowerCase().replace(TRAILING_DOT$1, "");
+	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+}
+async function validateHost(url, resolver, timeoutMs) {
+	try {
+		const addresses = await withTimeout(Promise.resolve().then(() => resolver(url.hostname)), timeoutMs);
+		if (addresses.length === 0 || addresses.some(isForbiddenAddress)) return verificationError("HOST_REJECTED", "The resource host resolved to a forbidden address.");
+		return {
+			success: true,
+			value: true
+		};
+	} catch (error) {
+		if (isAbortError(error)) return verificationError("RESOURCE_TIMEOUT", "The resource fetch exceeded its total timeout.");
+		return verificationError("HOST_REJECTED", "The resource host could not be validated.");
+	}
+}
+async function fetchResponse(fetchImplementation, url, timeoutMs) {
+	const controller = new AbortController();
+	try {
+		return {
+			success: true,
+			value: await withTimeout(Promise.resolve().then(() => fetchImplementation(url, {
+				method: "GET",
+				redirect: "manual",
+				signal: controller.signal
+			})), timeoutMs, () => controller.abort())
+		};
+	} catch (error) {
+		if (controller.signal.aborted || isAbortError(error)) return verificationError("RESOURCE_TIMEOUT", "The resource response headers timed out.");
+		return verificationError("FETCH_FAILED", "The resource request failed.");
+	}
+}
+async function readResponse(response, maximumBytes, startedAt, totalTimeoutMs) {
+	if (response.body === null) return {
+		success: true,
+		value: new Uint8Array()
+	};
+	const reader = response.body.getReader();
+	const chunks = [];
+	let length = 0;
+	try {
+		for (;;) {
+			const remaining = totalTimeoutMs - (Date.now() - startedAt);
+			if (remaining <= 0) {
+				await reader.cancel();
+				return verificationError("RESOURCE_TIMEOUT", "The resource fetch exceeded its total timeout.");
+			}
+			const chunk = await readWithTimeout(reader, remaining);
+			if (!chunk.success) {
+				await reader.cancel();
+				return chunk;
+			}
+			if (chunk.value.done) break;
+			const value = chunk.value.value;
+			length += value.length;
+			if (length > maximumBytes) {
+				await reader.cancel();
+				return verificationError("RESOURCE_SIZE_EXCEEDED", "The resource exceeds the byte limit.");
+			}
+			chunks.push(value);
+		}
+	} catch {
+		return verificationError("FETCH_FAILED", "The resource response could not be read.");
+	} finally {
+		reader.releaseLock();
+	}
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return {
+		success: true,
+		value: output
+	};
+}
+async function readWithTimeout(reader, timeoutMs) {
+	try {
+		return {
+			success: true,
+			value: await withTimeout(Promise.resolve().then(() => reader.read()), timeoutMs)
+		};
+	} catch (error) {
+		if (isAbortError(error)) return verificationError("RESOURCE_TIMEOUT", "The resource fetch exceeded its total timeout.");
+		return verificationError("FETCH_FAILED", "The resource response could not be read.");
+	}
+}
+/**
+* Every operation has both fulfillment and rejection handlers, so an operation
+* that loses the timeout race cannot later become an unhandled rejection.
+*/
+function withTimeout(operation, timeoutMs, onTimeout) {
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const timeout = setTimeout(() => {
+			if (settled) return;
+			settled = true;
+			onTimeout?.();
+			reject(new DOMException("Timed out", "AbortError"));
+		}, timeoutMs);
+		operation.then((value) => {
+			if (settled) return void 0;
+			settled = true;
+			clearTimeout(timeout);
+			resolve(value);
+		}, (error) => {
+			if (settled) return void 0;
+			settled = true;
+			clearTimeout(timeout);
+			reject(error);
+		});
+	});
+}
+function areValidLimits(limits) {
+	return Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0);
+}
+function isRedirect(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function isAbortError(error) {
+	return error instanceof DOMException && error.name === "AbortError";
+}
+function isIpLiteral(hostname) {
+	return IPV4_LITERAL.test(hostname) || hostname.includes(":");
+}
+function isLocalHostname(hostname) {
+	const normalized = hostname.toLowerCase();
+	return normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal");
+}
+function isForbiddenAddress(address) {
+	const ipv4 = parseIpv4(address);
+	if (ipv4 !== null) {
+		const [a, b] = ipv4;
+		return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 0 || b === 168) || a === 198 && (b === 18 || b === 19) || a >= 224;
+	}
+	const ipv6 = parseIpv6(address);
+	if (ipv6 === null) return true;
+	const first = ipv6[0];
+	const isUnspecified = ipv6.every((part) => part === 0);
+	const isLoopback = ipv6.slice(0, 7).every((part) => part === 0) && ipv6[7] === 1;
+	const isPrivate = (first & 65024) === 64512;
+	const isLinkLocal = (first & 65472) === 65152;
+	const isMulticast = (first & 65280) === 65280;
+	if (ipv6.slice(0, 5).every((part) => part === 0) && ipv6[5] === 65535) return isForbiddenAddress(`${ipv6[6] >>> 8}.${ipv6[6] & 255}.${ipv6[7] >>> 8}.${ipv6[7] & 255}`);
+	return isUnspecified || isLoopback || isPrivate || isLinkLocal || isMulticast;
+}
+function parseIpv4(value) {
+	const parts = value.split(".");
+	if (parts.length !== 4) return null;
+	const numbers = parts.map((part) => IPV4_PART.test(part) ? Number(part) : NaN);
+	if (numbers.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
+	return [
+		numbers[0],
+		numbers[1],
+		numbers[2],
+		numbers[3]
+	];
+}
+function parseIpv6(value) {
+	if (value.includes(":::") || value.split("::").length > 2) return null;
+	const [before = "", after = ""] = value.split("::");
+	const head = before === "" ? [] : before.split(":");
+	const tail = after === "" ? [] : after.split(":");
+	const parts = [...head, ...tail];
+	if (parts.some((part) => !IPV6_PART.test(part)) || parts.length > 8) return null;
+	if (!value.includes("::") && parts.length !== 8) return null;
+	const zeroes = value.includes("::") ? 8 - parts.length : 0;
+	return [
+		...head,
+		...Array.from({ length: zeroes }).fill("0"),
+		...tail
+	].map((part) => Number.parseInt(part, 16));
+}
+
+//#endregion
+//#region ../registry-verification/dist/artifact.js
+const DID_DOCUMENT_MAX_BYTES = 256 * 1024;
+const PLC_DID_PATTERN = /^did:plc:[a-z2-7]{24}$/;
+const CID_PATTERN = /^b[a-z2-7]+$/;
+const UNSAFE_PATH_SEGMENT = /[/\\?#]/;
+async function fetchReleaseArtifact(input, options) {
+	const deadline = Date.now() + (options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs);
+	const { artifact } = input;
+	if (!artifact.blob && !artifact.url) return verificationError("RELEASE_ARTIFACT_SOURCE_MISSING", "The release artifact must provide a blob or URL.");
+	if (artifact.requiresAuth === true || input.auth !== void 0) return unsupportedAuth(input.auth);
+	const blobCid = modernBlobCid(artifact.blob);
+	const blobMetadata = blobCid && artifact.blob && "ref" in artifact.blob ? artifact.blob : void 0;
+	if (artifact.blob && !blobCid) return verificationError("BLOB_REF_INVALID", "Legacy blob references are not supported.");
+	if (blobCid) {
+		const expected = multihashFromBlobCid(blobCid);
+		if (!expected.success) return expected;
+		if (expected.value !== artifact.checksum) return verificationError("CHECKSUM_MISMATCH", "The artifact checksum does not match its blob reference CID.");
+	}
+	let lastError;
+	for (const cache of input.artifactCaches ?? []) {
+		const serviceEndpoint = recordScopedCacheEndpoint(cache);
+		if (!serviceEndpoint || !blobCid) continue;
+		const cacheUrl = recordScopedBlobCacheUrl(serviceEndpoint, input.record, blobCid);
+		if (!cacheUrl.success) {
+			lastError = cacheUrl.error;
+			continue;
+		}
+		const attemptOptions = withinDeadline(options, deadline);
+		if (!attemptOptions) return timedOut();
+		const result = await fetchAndVerify("artifact-cache", cacheUrl.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);
+		if (result.success) return result;
+		lastError = result.error;
+	}
+	if (blobCid) {
+		const resolutionOptions = withinDeadline(options, deadline);
+		if (!resolutionOptions) return timedOut();
+		const pds = input.pdsEndpoint ? {
+			success: true,
+			value: input.pdsEndpoint
+		} : await resolvePublisherPdsEndpoint(input.record.did, resolutionOptions);
+		if (pds.success) {
+			const url = blobUrl(pds.value, input.record.did, blobCid);
+			if (url.success) {
+				const attemptOptions = withinDeadline(options, deadline);
+				if (!attemptOptions) return timedOut();
+				const result = await fetchAndVerify("blob", url.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);
+				if (result.success) return result;
+				lastError = result.error;
+			} else lastError = url.error;
+		} else lastError = pds.error;
+	}
+	if (artifact.url) {
+		const attemptOptions = withinDeadline(options, deadline);
+		if (!attemptOptions) return timedOut();
+		const result = await fetchAndVerify("url", artifact.url, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);
+		if (result.success) return result;
+		lastError = result.error;
+	}
+	return lastError ? {
+		success: false,
+		error: lastError
+	} : verificationError("FETCH_FAILED", "The release artifact could not be fetched.");
+}
+function recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid) {
+	try {
+		const endpoint = new URL(serviceEndpoint);
+		if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.pathname !== "/" || endpoint.search || endpoint.hash) throw new Error();
+		const segments = [
+			"r",
+			record.did,
+			record.collection,
+			record.rkey,
+			record.cid,
+			blobCid
+		];
+		if (!CID_PATTERN.test(record.cid) || !CID_PATTERN.test(blobCid) || segments.some((segment) => !isSafePathSegment(segment))) throw new Error();
+		return {
+			success: true,
+			value: new URL(segments.join("/"), endpoint)
+		};
+	} catch {
+		return verificationError("INVALID_URL", "The record-scoped blob cache endpoint is invalid.");
+	}
+}
+function recordScopedImageCacheUrl(serviceEndpoint, preset, record, blobCid) {
+	const raw = recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid);
+	if (!raw.success) return raw;
+	const url = new URL(raw.value);
+	url.pathname = `/img/${preset}${url.pathname}`;
+	return {
+		success: true,
+		value: url
+	};
+}
+async function resolvePublisherPdsEndpoint(publisherDid, options) {
+	const documentUrl = didDocumentUrl(publisherDid);
+	if (!documentUrl) return verificationError("PDS_RESOLUTION_FAILED", "The publisher DID is not supported.");
+	const fetched = await fetchVerifiedResource(documentUrl, {
+		...options,
+		maxBytes: DID_DOCUMENT_MAX_BYTES
+	});
+	if (!fetched.success) return verificationError("PDS_RESOLUTION_FAILED", "The publisher DID document could not be fetched.");
+	let document;
+	try {
+		document = JSON.parse(new TextDecoder().decode(fetched.value.bytes));
+	} catch {
+		return verificationError("PDS_RESOLUTION_FAILED", "The publisher DID document is malformed.");
+	}
+	if (!isRecord(document) || document.id !== publisherDid || !Array.isArray(document.service)) return verificationError("PDS_RESOLUTION_FAILED", "The publisher DID document has no valid PDS service.");
+	const service = document.service.find((value) => isRecord(value) && (value.id === `${publisherDid}#atproto_pds` || value.id === "#atproto_pds") && value.type === "AtprotoPersonalDataServer" && typeof value.serviceEndpoint === "string");
+	if (!isRecord(service) || typeof service.serviceEndpoint !== "string") return verificationError("PDS_RESOLUTION_FAILED", "The publisher DID document has no valid PDS service.");
+	try {
+		const endpoint = new URL(service.serviceEndpoint);
+		if (!(options.allowHttpLocalhost === true && endpoint.protocol === "http:" && (endpoint.hostname === "localhost" || endpoint.hostname === "127.0.0.1")) && endpoint.protocol !== "https:" || endpoint.username || endpoint.password) throw new Error();
+		return {
+			success: true,
+			value: endpoint.href
+		};
+	} catch {
+		return verificationError("PDS_RESOLUTION_FAILED", "The publisher DID document has no valid PDS service.");
+	}
+}
+async function fetchAndVerify(source, url, checksum, options, blobMetadata) {
+	const fetched = await fetchVerifiedResource(url, options);
+	if (!fetched.success) return blobMetadata && fetched.error.code === "RESOURCE_SIZE_EXCEEDED" ? verificationError("BLOB_METADATA_MISMATCH", "The fetched artifact size does not match its signed blob metadata.") : fetched;
+	const verified = await verifyMultihash(fetched.value.bytes, checksum);
+	if (!verified.success) return verified;
+	const contentType = fetched.value.headers.get("content-type")?.split(";", 1)[0]?.trim();
+	if (blobMetadata && (fetched.value.bytes.byteLength !== blobMetadata.size || contentType !== void 0 && contentType !== blobMetadata.mimeType)) return verificationError("BLOB_METADATA_MISMATCH", "The fetched artifact does not match its signed blob metadata.");
+	return {
+		success: true,
+		value: {
+			bytes: fetched.value.bytes,
+			source,
+			url: fetched.value.url
+		}
+	};
+}
+function withBlobSizeLimit(options, blobMetadata) {
+	if (!blobMetadata) return options;
+	return {
+		...options,
+		maxBytes: Math.min(options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes, blobMetadata.size)
+	};
+}
+function blobUrl(pdsEndpoint, publisherDid, cid) {
+	try {
+		const url = new URL("/xrpc/com.atproto.sync.getBlob", pdsEndpoint);
+		url.searchParams.set("did", publisherDid);
+		url.searchParams.set("cid", cid);
+		return {
+			success: true,
+			value: url
+		};
+	} catch {
+		return verificationError("PDS_RESOLUTION_FAILED", "The publisher PDS endpoint is invalid.");
+	}
+}
+function didDocumentUrl(did) {
+	if (PLC_DID_PATTERN.test(did)) return `https://plc.directory/${encodeURIComponent(did)}`;
+	if (!did.startsWith("did:web:")) return null;
+	try {
+		const parts = did.slice(8).split(":").map(decodeURIComponent);
+		const host = parts.shift();
+		if (!host || parts.some((part) => part === "" || part === "." || part === "..")) return null;
+		const path = parts.length === 0 ? "/.well-known/did.json" : `/${parts.join("/")}/did.json`;
+		return new URL(path, `https://${host}`).href;
+	} catch {
+		return null;
+	}
+}
+function unsupportedAuth(auth) {
+	return verificationError("AUTH_METHOD_UNSUPPORTED", UNSUPPORTED_AUTH_MESSAGE, unsupportedAuthDetails(auth));
+}
+function withinDeadline(options, deadline) {
+	const remaining = deadline - Date.now();
+	if (remaining <= 0) return null;
+	return {
+		...options,
+		totalTimeoutMs: remaining
+	};
+}
+function timedOut() {
+	return verificationError("RESOURCE_TIMEOUT", "Artifact retrieval exceeded its total timeout.");
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function modernBlobCid(blob) {
+	if (!blob || !("ref" in blob) || typeof blob.ref?.$link !== "string") return null;
+	return blob.ref.$link;
+}
+function recordScopedCacheEndpoint(value) {
+	if (!isRecord(value) || value.$type !== RECORD_SCOPED_BLOB_CACHE_TYPE) return null;
+	return typeof value.serviceEndpoint === "string" ? value.serviceEndpoint : null;
+}
+function isSafePathSegment(value) {
+	if (value.length === 0 || UNSAFE_PATH_SEGMENT.test(value)) return false;
+	for (const character of value) {
+		const codePoint = character.codePointAt(0);
+		if (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return false;
+	}
+	return true;
+}
+
+//#endregion
+//#region src/registry/artifact-fetch.ts
+const TRAILING_DOT = /\.+$/;
+const HEADER_END = new Uint8Array([
+	13,
+	10,
+	13,
+	10
+]);
+const CRLF = new Uint8Array([13, 10]);
+const STATUS_LINE_RE = /^HTTP\/1\.[01] ([2-5][0-9]{2})(?: .*)?$/;
+const HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const FOLDED_HEADER_RE = /^[ \t]/;
+const CONTENT_LENGTH_RE = /^(0|[1-9][0-9]*)$/;
+const CHUNK_SIZE_RE = /^[0-9A-Fa-f]+$/;
+const MAX_HEADER_BYTES = 32 * 1024;
+const LOCALHOST_HOSTNAMES = new Set([
+	"localhost",
+	"localhost.localdomain",
+	"ip6-localhost",
+	"ip6-loopback"
+]);
+let defaultTransport = null;
+function isLocalhostHostname(hostname) {
+	const normalized = hostname.toLowerCase().replace(TRAILING_DOT, "");
+	return LOCALHOST_HOSTNAMES.has(normalized) || normalized.endsWith(".localhost") || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]" || normalized.startsWith("::ffff:127.") || normalized.startsWith("::ffff:7f00:");
+}
+async function resolveSafeArtifactTarget(urlString) {
+	let url;
+	try {
+		url = new URL(urlString);
+	} catch {
+		throw new Error(`Invalid artifact URL: ${urlString}`);
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`Artifact URL protocol not allowed: ${url.protocol}`);
+	if (url.username || url.password) throw new Error("Artifact URL must not contain embedded credentials");
+	const hostname = stripIpv6Brackets(url.hostname.toLowerCase().replace(TRAILING_DOT, ""));
+	const localhost = isLocalhostHostname(hostname);
+	if (!import.meta.env.DEV) {
+		if (url.protocol === "http:") throw new Error("Artifact URL must use https");
+		if (localhost) throw new Error(`Artifact URL points to localhost: ${hostname}`);
+	} else if (url.protocol === "http:" && !localhost) throw new Error("Artifact URL must use https (http allowed only for localhost in dev)");
+	if (localhost) return {
+		url,
+		addresses: []
+	};
+	try {
+		return await resolveAndValidateExternalUrlTarget(url.href);
+	} catch (error) {
+		if (error instanceof SsrfError) throw new Error(`Artifact URL rejected: ${error.message}`, { cause: error });
+		throw error;
+	}
+}
+async function fetchRegistryArtifactUrl(urlString, options) {
+	if (!Number.isSafeInteger(options.maxResponseBytes) || options.maxResponseBytes < 0) throw new TypeError("Registry artifact response limit is invalid");
+	const target = await resolveSafeArtifactTarget(urlString);
+	if (target.addresses.length === 0) return globalThis.fetch(target.url, {
+		redirect: "manual",
+		signal: options.signal
+	});
+	const result = await (defaultTransport ?? await createRuntimeRegistryArtifactTransport()).fetch({
+		url: target.url,
+		allowedAddresses: target.addresses,
+		signal: options.signal,
+		maxResponseBytes: options.maxResponseBytes
+	});
+	if (!target.addresses.includes(result.connectedAddress)) {
+		await result.response.body?.cancel().catch(() => void 0);
+		throw new Error("Registry artifact transport connected outside the validated address set");
+	}
+	return result.response;
+}
+async function createRuntimeRegistryArtifactTransport() {
+	try {
+		const connect = objectProperty(await import("cloudflare:sockets"), "connect");
+		if (!isWorkerSocketConnect(connect)) throw new TypeError("Workers socket binding is invalid");
+		return createWorkersRegistryArtifactTransport(connect);
+	} catch {
+		return createNodeRegistryArtifactTransport();
+	}
+}
+function createWorkersRegistryArtifactTransport(connect) {
+	return { async fetch(input) {
+		let lastError;
+		for (const address of input.allowedAddresses) {
+			if (input.signal.aborted) throw new Error("Registry artifact request was aborted");
+			let socket;
+			let tls;
+			try {
+				socket = connect({
+					hostname: address,
+					port: parseHttpsPort(input.url)
+				}, {
+					secureTransport: "starttls",
+					allowHalfOpen: false
+				});
+				await abortable(socket.opened, input.signal, () => socket?.close());
+				tls = socket.startTls({ expectedServerHostname: stripIpv6Brackets(input.url.hostname) });
+				await abortable(tls.opened, input.signal, () => tls?.close());
+				const writer = tls.writable.getWriter();
+				try {
+					await abortable(writer.write(buildHttpRequest(input.url)), input.signal, () => tls?.close());
+				} finally {
+					writer.releaseLock();
+				}
+				const bytes = await readWorkerSocketResponse(tls, input.maxResponseBytes + MAX_HEADER_BYTES, input.signal);
+				await tls.close().catch(() => void 0);
+				return {
+					response: parsedResponseToWebResponse(parsePinnedHttpResponse(bytes, input.maxResponseBytes)),
+					connectedAddress: address
+				};
+			} catch (error) {
+				await Promise.all([tls?.close().catch(() => void 0), socket?.close().catch(() => void 0)]);
+				if (input.signal.aborted) throw error;
+				lastError = error;
+			}
+		}
+		throw new Error("Registry artifact transport could not connect to an approved address", { cause: lastError });
+	} };
+}
+async function createNodeRegistryArtifactTransport() {
+	const { request } = await import("node:https");
+	return { async fetch(input) {
+		let lastError;
+		for (const address of input.allowedAddresses) try {
+			return {
+				response: await new Promise((resolve, reject) => {
+					const chunks = [];
+					let total = 0;
+					const req = request({
+						protocol: "https:",
+						hostname: stripIpv6Brackets(input.url.hostname),
+						port: parseHttpsPort(input.url),
+						path: `${input.url.pathname}${input.url.search}`,
+						method: "GET",
+						agent: false,
+						headers: {
+							Host: input.url.host,
+							Connection: "close",
+							"Accept-Encoding": "identity"
+						},
+						lookup: (_hostname, _options, callback) => {
+							callback(null, address, address.includes(":") ? 6 : 4);
+						},
+						signal: input.signal
+					}, (upstream) => {
+						const contentEncoding = upstream.headers["content-encoding"];
+						if (contentEncoding && contentEncoding.toLowerCase() !== "identity") {
+							upstream.destroy(/* @__PURE__ */ new Error("Registry artifact response content encoding is unsupported"));
+							return;
+						}
+						upstream.on("data", (chunk) => {
+							total += chunk.byteLength;
+							if (total > input.maxResponseBytes) {
+								upstream.destroy(/* @__PURE__ */ new RangeError("Registry artifact response exceeds its byte limit"));
+								return;
+							}
+							chunks.push(new Uint8Array(chunk));
+						});
+						upstream.once("error", reject);
+						upstream.once("end", () => {
+							const bytes = concatBytes(chunks, total);
+							const headers = new Headers();
+							for (let index = 0; index < upstream.rawHeaders.length; index += 2) headers.append(upstream.rawHeaders[index], upstream.rawHeaders[index + 1]);
+							resolve(parsedResponseToWebResponse({
+								status: upstream.statusCode ?? 502,
+								headers,
+								body: bytes
+							}));
+						});
+					});
+					req.once("error", reject);
+					req.end();
+				}),
+				connectedAddress: address
+			};
+		} catch (error) {
+			if (input.signal.aborted) throw error;
+			lastError = error;
+		}
+		throw new Error("Registry artifact transport could not connect to an approved address", { cause: lastError });
+	} };
+}
+function parsePinnedHttpResponse(bytes, maxResponseBytes) {
+	const headerEnd = findSequence(bytes, HEADER_END, 0);
+	if (headerEnd === -1 || headerEnd > MAX_HEADER_BYTES) throw new Error("Registry artifact response headers are invalid or too large");
+	const lines = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, headerEnd)).split("\r\n");
+	const statusMatch = STATUS_LINE_RE.exec(lines.shift() ?? "");
+	if (!statusMatch) throw new Error("Registry artifact response status line is invalid");
+	const headers = new Headers();
+	const rawHeaders = /* @__PURE__ */ new Map();
+	for (const line of lines) {
+		if (FOLDED_HEADER_RE.test(line)) throw new Error("Registry artifact response uses folded headers");
+		const separator = line.indexOf(":");
+		if (separator < 1) throw new Error("Registry artifact response header is invalid");
+		const name = line.slice(0, separator);
+		const value = line.slice(separator + 1).trim();
+		if (!HEADER_NAME_RE.test(name) || containsInvalidHeaderValue(value)) throw new Error("Registry artifact response header is invalid");
+		const normalized = name.toLowerCase();
+		const values = rawHeaders.get(normalized) ?? [];
+		values.push(value);
+		rawHeaders.set(normalized, values);
+		headers.append(name, value);
+	}
+	const contentEncoding = rawHeaders.get("content-encoding");
+	if (contentEncoding && (contentEncoding.length !== 1 || contentEncoding[0]?.toLowerCase() !== "identity")) throw new Error("Registry artifact response content encoding is unsupported");
+	const contentLength = rawHeaders.get("content-length");
+	const transferEncoding = rawHeaders.get("transfer-encoding");
+	if (contentLength && transferEncoding) throw new Error("Registry artifact response framing is ambiguous");
+	const bodyBytes = bytes.subarray(headerEnd + HEADER_END.length);
+	let body;
+	if (transferEncoding) {
+		if (transferEncoding.length !== 1 || transferEncoding[0]?.toLowerCase() !== "chunked") throw new Error("Registry artifact response transfer encoding is unsupported");
+		body = decodeChunkedBody(bodyBytes, maxResponseBytes);
+	} else if (contentLength) {
+		if (contentLength.length !== 1 || !CONTENT_LENGTH_RE.test(contentLength[0])) throw new Error("Registry artifact response content length is invalid");
+		const length = Number(contentLength[0]);
+		if (!Number.isSafeInteger(length) || length !== bodyBytes.byteLength) throw new Error("Registry artifact response body length does not match its framing");
+		body = new Uint8Array(bodyBytes);
+	} else body = new Uint8Array(bodyBytes);
+	if (body.byteLength > maxResponseBytes) throw new RangeError("Registry artifact response exceeds its byte limit");
+	return {
+		status: Number(statusMatch[1]),
+		headers,
+		body
+	};
+}
+function parsedResponseToWebResponse(parsed) {
+	const bodyAllowed = ![
+		204,
+		205,
+		304
+	].includes(parsed.status);
+	let body = null;
+	if (bodyAllowed) {
+		body = new ArrayBuffer(parsed.body.byteLength);
+		new Uint8Array(body).set(parsed.body);
+	}
+	return new Response(body, {
+		status: parsed.status,
+		headers: parsed.headers
+	});
+}
+function buildHttpRequest(url) {
+	return new TextEncoder().encode([
+		`GET ${url.pathname}${url.search} HTTP/1.1`,
+		`Host: ${url.host}`,
+		"Connection: close",
+		"Accept-Encoding: identity",
+		"",
+		""
+	].join("\r\n"));
+}
+async function readWorkerSocketResponse(socket, maximumBytes, signal) {
+	const reader = socket.readable.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const next = await abortable(reader.read(), signal, () => socket.close());
+			if (next.done) break;
+			total += next.value.byteLength;
+			if (total > maximumBytes) throw new RangeError("Registry artifact response exceeds its byte limit");
+			chunks.push(next.value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	return concatBytes(chunks, total);
+}
+function decodeChunkedBody(bytes, maximumBytes) {
+	const chunks = [];
+	let offset = 0;
+	let total = 0;
+	for (;;) {
+		const lineEnd = findSequence(bytes, CRLF, offset);
+		if (lineEnd === -1 || lineEnd - offset > 128) throw new Error("Registry artifact chunk size line is invalid");
+		const sizeText = new TextDecoder().decode(bytes.subarray(offset, lineEnd)).split(";", 1)[0];
+		if (!sizeText || !CHUNK_SIZE_RE.test(sizeText)) throw new Error("Registry artifact chunk size is invalid");
+		const size = Number.parseInt(sizeText, 16);
+		if (!Number.isSafeInteger(size)) throw new Error("Registry artifact chunk size is invalid");
+		offset = lineEnd + CRLF.length;
+		if (size === 0) {
+			if (offset + CRLF.length !== bytes.length || bytes[offset] !== 13 || bytes[offset + 1] !== 10) throw new Error("Registry artifact chunk trailer is invalid");
+			break;
+		}
+		if (offset + size + CRLF.length > bytes.length) throw new Error("Registry artifact chunk body is truncated");
+		if (bytes[offset + size] !== 13 || bytes[offset + size + 1] !== 10) throw new Error("Registry artifact chunk delimiter is invalid");
+		total += size;
+		if (total > maximumBytes) throw new RangeError("Registry artifact response exceeds its byte limit");
+		chunks.push(new Uint8Array(bytes.subarray(offset, offset + size)));
+		offset += size + CRLF.length;
+	}
+	return concatBytes(chunks, total);
+}
+function findSequence(bytes, sequence, start) {
+	outer: for (let offset = start; offset <= bytes.length - sequence.length; offset += 1) {
+		for (let index = 0; index < sequence.length; index += 1) if (bytes[offset + index] !== sequence[index]) continue outer;
+		return offset;
+	}
+	return -1;
+}
+function concatBytes(chunks, total) {
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+function containsInvalidHeaderValue(value) {
+	for (const character of value) {
+		const code = character.codePointAt(0);
+		if (code === 0 || code === 10 || code === 13) return true;
+	}
+	return false;
+}
+function parseHttpsPort(url) {
+	const port = url.port === "" ? 443 : Number(url.port);
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new TypeError("Registry artifact HTTPS port is invalid");
+	return port;
+}
+function stripIpv6Brackets(hostname) {
+	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function objectProperty(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	return Object.getOwnPropertyDescriptor(value, key)?.value;
+}
+function isWorkerSocketConnect(value) {
+	return typeof value === "function";
+}
+async function abortable(operation, signal, onAbort) {
+	if (signal.aborted) throw new Error("Registry artifact request was aborted");
+	let abort;
+	const aborted = new Promise((_resolve, reject) => {
+		abort = () => {
+			onAbort();
+			reject(/* @__PURE__ */ new Error("Registry artifact request was aborted"));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+	});
+	try {
+		return await Promise.race([operation, aborted]);
+	} finally {
+		if (abort) signal.removeEventListener("abort", abort);
+	}
+}
+
+//#endregion
+export { fetchVerifiedResource as a, verifyMultihash as c, resolvePublisherPdsEndpoint as i, verificationError as l, fetchReleaseArtifact as n, computeArtifactDigestCandidates as o, recordScopedImageCacheUrl as r, multihashFromBlobCid as s, fetchRegistryArtifactUrl as t };
+//# sourceMappingURL=artifact-fetch-P2JXVwOq.mjs.map