kordoc 4.0.8 → 4.2.0

package/dist/{chunk-HMUEU7D7.js.map → chunk-FSXLSHCW.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/utils.ts"],"sourcesContent":["/** kordoc 공용 유틸리티 */\n\n/** 빌드 타임에 tsup define으로 주입되는 버전 */\ndeclare const __KORDOC_VERSION__: string\nexport const VERSION: string = typeof __KORDOC_VERSION__ !== \"undefined\" ? __KORDOC_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Node.js Buffer → ArrayBuffer 변환\n * pool Buffer의 공유 ArrayBuffer 문제를 안전하게 처리.\n * offset=0이고 전체 ArrayBuffer를 차지하면 복사 없이 직접 반환.\n */\nexport function toArrayBuffer(buf: Buffer): ArrayBuffer {\n  if (buf.byteOffset === 0 && buf.byteLength === buf.buffer.byteLength) {\n    return buf.buffer as ArrayBuffer\n  }\n  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength) as ArrayBuffer\n}\n\n/**\n * kordoc 내부 에러 클래스 — 사용자에게 노출해도 안전한 메시지만 포함.\n * MCP 에러 정제에서 instanceof로 판별하여 allowlist 패턴 매칭 없이 안전하게 통과.\n */\nexport class KordocError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"KordocError\"\n  }\n}\n\n/**\n * 에러 메시지 정제 — KordocError는 그대로, 나머지는 일반 메시지로 대체.\n * 파일시스템 경로, 스택 트레이스 등 내부 정보 노출 방지.\n */\nexport function sanitizeError(err: unknown): string {\n  if (err instanceof KordocError) return err.message\n  return \"문서 처리 중 오류가 발생했습니다\"\n}\n\n/**\n * ZIP 엔트리 경로의 경로 순회 여부 판별.\n * 백슬래시 정규화, .., 절대경로, Windows 드라이브 문자 모두 차단.\n */\nexport function isPathTraversal(name: string): boolean {\n  if (name.includes(\"\\x00\")) return true\n  const normalized = name.replace(/\\\\/g, \"/\")\n  const segments = normalized.split(\"/\")\n  return segments.some(s => s === \"..\") || normalized.startsWith(\"/\") || /^[A-Za-z]:/.test(normalized)\n}\n\n// ─── HWPX 섹션 href 해석 (parser/roundtrip 공용) ────────────────────\n\n/**\n * manifest href를 본문 섹션 경로(`Contents/sectionN.xml`)로 정규화.\n * 비본문 XML(header/script/settings)·path traversal·드라이브 경로는 null로 거른다.\n * 백슬래시 구분자를 슬래시로 통일해 parser와 roundtrip이 동일한 목록을 만든다.\n */\nexport function normalizeSectionHref(href: string): string | null {\n  if (!href) return null\n  let normalized = href.replace(/\\\\/g, \"/\").replace(/^\\/+/, \"\")\n  if (isPathTraversal(normalized)) return null\n  if (/^[Ss]ection\\d+\\.xml$/.test(normalized)) normalized = \"Contents/\" + normalized\n  return /(?:^|\\/)[Ss]ection\\d+\\.xml$/.test(normalized) ? normalized : null\n}\n\n/** sectionN.xml을 N 숫자 순서로 정렬 (section10 > section2). */\nexport function compareSectionPaths(a: string, b: string): number {\n  const ai = Number(a.match(/[Ss]ection(\\d+)\\.xml$/)?.[1] ?? Number.MAX_SAFE_INTEGER)\n  const bi = Number(b.match(/[Ss]ection(\\d+)\\.xml$/)?.[1] ?? Number.MAX_SAFE_INTEGER)\n  return ai === bi ? a.localeCompare(b) : ai - bi\n}\n\n// ─── ZIP 안전 로딩 (ZIP bomb 방지) ────────────────────\n\n/**\n * ZIP bomb 사전 검사 — Central Directory에서 비압축 합계와 엔트리 수 확인.\n * HWPX/XLSX/DOCX 등 모든 ZIP 기반 포맷에서 공통 사용.\n */\nexport function precheckZipSize(\n  buffer: ArrayBuffer,\n  maxUncompressedSize = 100 * 1024 * 1024,\n  maxEntries = 500,\n): { totalUncompressed: number; entryCount: number } {\n  try {\n    const data = new DataView(buffer)\n    const len = buffer.byteLength\n    // EOCD 시그니처 역방향 스캔\n    let eocdOffset = -1\n    for (let i = len - 22; i >= Math.max(0, len - 65557); i--) {\n      if (data.getUint32(i, true) === 0x06054b50) { eocdOffset = i; break }\n    }\n    if (eocdOffset < 0) return { totalUncompressed: 0, entryCount: 0 }\n\n    const entryCount = data.getUint16(eocdOffset + 10, true)\n    if (entryCount > maxEntries) {\n      throw new KordocError(`ZIP 엔트리 수 초과: ${entryCount} (최대 ${maxEntries})`)\n    }\n\n    const cdSize = data.getUint32(eocdOffset + 12, true)\n    const cdOffset = data.getUint32(eocdOffset + 16, true)\n    if (cdOffset + cdSize > len) return { totalUncompressed: 0, entryCount }\n\n    let totalUncompressed = 0\n    let pos = cdOffset\n    for (let i = 0; i < entryCount && pos + 46 <= cdOffset + cdSize; i++) {\n      if (data.getUint32(pos, true) !== 0x02014b50) break\n      totalUncompressed += data.getUint32(pos + 24, true)\n      const nameLen = data.getUint16(pos + 28, true)\n      const extraLen = data.getUint16(pos + 30, true)\n      const commentLen = data.getUint16(pos + 32, true)\n      pos += 46 + nameLen + extraLen + commentLen\n    }\n\n    if (totalUncompressed > maxUncompressedSize) {\n      throw new KordocError(`ZIP 비압축 크기 초과: ${(totalUncompressed / 1024 / 1024).toFixed(1)}MB (최대 ${maxUncompressedSize / 1024 / 1024}MB)`)\n    }\n\n    return { totalUncompressed, entryCount }\n  } catch (err) {\n    if (err instanceof KordocError) throw err\n    return { totalUncompressed: 0, entryCount: 0 }\n  }\n}\n\n/** XXE/Billion Laughs 방지 — DOCTYPE 제거 (내부 DTD 서브셋 포함) */\nexport function stripDtd(xml: string): string {\n  return xml.replace(/<!DOCTYPE\\s[^[>]*(\\[[\\s\\S]*?\\])?\\s*>/gi, \"\")\n}\n\n/** 하이퍼링크 URL 살균 — javascript: 등 XSS 위험 스킴 차단 */\nconst SAFE_HREF_RE = /^(?:https?:|mailto:|tel:|#)/i\nexport function sanitizeHref(href: string): string | null {\n  const trimmed = href.trim()\n  if (!trimmed || !SAFE_HREF_RE.test(trimmed)) return null\n  return trimmed\n}\n\n// ─── 안전한 min/max (스택 오버플로 방지) ─────────────\n\n/** Math.min(...arr) 대체 — 대형 배열에서 스택 오버플로 방지 */\nexport function safeMin(arr: number[]): number {\n  let min = Infinity\n  for (let i = 0; i < arr.length; i++) if (arr[i] < min) min = arr[i]\n  return min\n}\n\n/** Math.max(...arr) 대체 — 대형 배열에서 스택 오버플로 방지 */\nexport function safeMax(arr: number[]): number {\n  let max = -Infinity\n  for (let i = 0; i < arr.length; i++) if (arr[i] > max) max = arr[i]\n  return max\n}\n\n// ─── 에러 분류 ──────────────────────────────────────\n\nimport type { ErrorCode } from \"./types.js\"\n\n/** 에러를 구조화된 ErrorCode로 분류 — KordocError 메시지 패턴 매칭 */\nexport function classifyError(err: unknown): ErrorCode {\n  if (!(err instanceof Error)) return \"PARSE_ERROR\"\n  const msg = err.message\n  if (msg.includes(\"암호화\")) return \"ENCRYPTED\"\n  if (msg.includes(\"DRM\")) return \"DRM_PROTECTED\"\n  if (msg.includes(\"ZIP bomb\") || msg.includes(\"ZIP 비압축 크기 초과\") || msg.includes(\"ZIP 엔트리 수 초과\")) return \"ZIP_BOMB\"\n  if (msg.includes(\"bomb\") || msg.includes(\"크기 초과\") || msg.includes(\"압축 해제\")) return \"DECOMPRESSION_BOMB\"\n  if (msg.includes(\"이미지 기반\")) return \"IMAGE_BASED_PDF\"\n  if (msg.includes(\"섹션\") && (msg.includes(\"찾을 수 없\") || msg.includes(\"없음\"))) return \"NO_SECTIONS\"\n  if (msg.includes(\"시그니처\") || msg.includes(\"복구할 수 없\")) return \"CORRUPTED\"\n  return \"PARSE_ERROR\"\n}\n"],"mappings":";;;AAIO,IAAM,UAAkB,OAA4C,UAAqB;AAOzF,SAAS,cAAc,KAA0B;AACtD,MAAI,IAAI,eAAe,KAAK,IAAI,eAAe,IAAI,OAAO,YAAY;AACpE,WAAO,IAAI;AAAA,EACb;AACA,SAAO,IAAI,OAAO,MAAM,IAAI,YAAY,IAAI,aAAa,IAAI,UAAU;AACzE;AAMO,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAMO,SAAS,cAAc,KAAsB;AAClD,MAAI,eAAe,YAAa,QAAO,IAAI;AAC3C,SAAO;AACT;AAMO,SAAS,gBAAgB,MAAuB;AACrD,MAAI,KAAK,SAAS,IAAM,EAAG,QAAO;AAClC,QAAM,aAAa,KAAK,QAAQ,OAAO,GAAG;AAC1C,QAAM,WAAW,WAAW,MAAM,GAAG;AACrC,SAAO,SAAS,KAAK,OAAK,MAAM,IAAI,KAAK,WAAW,WAAW,GAAG,KAAK,aAAa,KAAK,UAAU;AACrG;AASO,SAAS,qBAAqB,MAA6B;AAChE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,aAAa,KAAK,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAC5D,MAAI,gBAAgB,UAAU,EAAG,QAAO;AACxC,MAAI,uBAAuB,KAAK,UAAU,EAAG,cAAa,cAAc;AACxE,SAAO,8BAA8B,KAAK,UAAU,IAAI,aAAa;AACvE;AAGO,SAAS,oBAAoB,GAAW,GAAmB;AAChE,QAAM,KAAK,OAAO,EAAE,MAAM,uBAAuB,IAAI,CAAC,KAAK,OAAO,gBAAgB;AAClF,QAAM,KAAK,OAAO,EAAE,MAAM,uBAAuB,IAAI,CAAC,KAAK,OAAO,gBAAgB;AAClF,SAAO,OAAO,KAAK,EAAE,cAAc,CAAC,IAAI,KAAK;AAC/C;AAQO,SAAS,gBACd,QACA,sBAAsB,MAAM,OAAO,MACnC,aAAa,KACsC;AACnD,MAAI;AACF,UAAM,OAAO,IAAI,SAAS,MAAM;AAChC,UAAM,MAAM,OAAO;AAEnB,QAAI,aAAa;AACjB,aAAS,IAAI,MAAM,IAAI,KAAK,KAAK,IAAI,GAAG,MAAM,KAAK,GAAG,KAAK;AACzD,UAAI,KAAK,UAAU,GAAG,IAAI,MAAM,WAAY;AAAE,qBAAa;AAAG;AAAA,MAAM;AAAA,IACtE;AACA,QAAI,aAAa,EAAG,QAAO,EAAE,mBAAmB,GAAG,YAAY,EAAE;AAEjE,UAAM,aAAa,KAAK,UAAU,aAAa,IAAI,IAAI;AACvD,QAAI,aAAa,YAAY;AAC3B,YAAM,IAAI,YAAY,+CAAiB,UAAU,kBAAQ,UAAU,GAAG;AAAA,IACxE;AAEA,UAAM,SAAS,KAAK,UAAU,aAAa,IAAI,IAAI;AACnD,UAAM,WAAW,KAAK,UAAU,aAAa,IAAI,IAAI;AACrD,QAAI,WAAW,SAAS,IAAK,QAAO,EAAE,mBAAmB,GAAG,WAAW;AAEvE,QAAI,oBAAoB;AACxB,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,cAAc,MAAM,MAAM,WAAW,QAAQ,KAAK;AACpE,UAAI,KAAK,UAAU,KAAK,IAAI,MAAM,SAAY;AAC9C,2BAAqB,KAAK,UAAU,MAAM,IAAI,IAAI;AAClD,YAAM,UAAU,KAAK,UAAU,MAAM,IAAI,IAAI;AAC7C,YAAM,WAAW,KAAK,UAAU,MAAM,IAAI,IAAI;AAC9C,YAAM,aAAa,KAAK,UAAU,MAAM,IAAI,IAAI;AAChD,aAAO,KAAK,UAAU,WAAW;AAAA,IACnC;AAEA,QAAI,oBAAoB,qBAAqB;AAC3C,YAAM,IAAI,YAAY,sDAAmB,oBAAoB,OAAO,MAAM,QAAQ,CAAC,CAAC,oBAAU,sBAAsB,OAAO,IAAI,KAAK;AAAA,IACtI;AAEA,WAAO,EAAE,mBAAmB,WAAW;AAAA,EACzC,SAAS,KAAK;AACZ,QAAI,eAAe,YAAa,OAAM;AACtC,WAAO,EAAE,mBAAmB,GAAG,YAAY,EAAE;AAAA,EAC/C;AACF;AAGO,SAAS,SAAS,KAAqB;AAC5C,SAAO,IAAI,QAAQ,0CAA0C,EAAE;AACjE;AAGA,IAAM,eAAe;AACd,SAAS,aAAa,MAA6B;AACxD,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,WAAW,CAAC,aAAa,KAAK,OAAO,EAAG,QAAO;AACpD,SAAO;AACT;AAKO,SAAS,QAAQ,KAAuB;AAC7C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,KAAI,IAAI,CAAC,IAAI,IAAK,OAAM,IAAI,CAAC;AAClE,SAAO;AACT;AAGO,SAAS,QAAQ,KAAuB;AAC7C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,KAAI,IAAI,CAAC,IAAI,IAAK,OAAM,IAAI,CAAC;AAClE,SAAO;AACT;AAOO,SAAS,cAAc,KAAyB;AACrD,MAAI,EAAE,eAAe,OAAQ,QAAO;AACpC,QAAM,MAAM,IAAI;AAChB,MAAI,IAAI,SAAS,oBAAK,EAAG,QAAO;AAChC,MAAI,IAAI,SAAS,KAAK,EAAG,QAAO;AAChC,MAAI,IAAI,SAAS,UAAU,KAAK,IAAI,SAAS,kDAAe,KAAK,IAAI,SAAS,4CAAc,EAAG,QAAO;AACtG,MAAI,IAAI,SAAS,MAAM,KAAK,IAAI,SAAS,2BAAO,KAAK,IAAI,SAAS,2BAAO,EAAG,QAAO;AACnF,MAAI,IAAI,SAAS,iCAAQ,EAAG,QAAO;AACnC,MAAI,IAAI,SAAS,cAAI,MAAM,IAAI,SAAS,4BAAQ,KAAK,IAAI,SAAS,cAAI,GAAI,QAAO;AACjF,MAAI,IAAI,SAAS,0BAAM,KAAK,IAAI,SAAS,kCAAS,EAAG,QAAO;AAC5D,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/utils.ts"],"sourcesContent":["/** kordoc 공용 유틸리티 */\n\n/** 빌드 타임에 tsup define으로 주입되는 버전 */\ndeclare const __KORDOC_VERSION__: string\nexport const VERSION: string = typeof __KORDOC_VERSION__ !== \"undefined\" ? __KORDOC_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Node.js Buffer → ArrayBuffer 변환\n * pool Buffer의 공유 ArrayBuffer 문제를 안전하게 처리.\n * offset=0이고 전체 ArrayBuffer를 차지하면 복사 없이 직접 반환.\n */\nexport function toArrayBuffer(buf: Buffer): ArrayBuffer {\n  if (buf.byteOffset === 0 && buf.byteLength === buf.buffer.byteLength) {\n    return buf.buffer as ArrayBuffer\n  }\n  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength) as ArrayBuffer\n}\n\n/**\n * kordoc 내부 에러 클래스 — 사용자에게 노출해도 안전한 메시지만 포함.\n * MCP 에러 정제에서 instanceof로 판별하여 allowlist 패턴 매칭 없이 안전하게 통과.\n */\nexport class KordocError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"KordocError\"\n  }\n}\n\n/**\n * 에러 메시지 정제 — KordocError는 그대로, 나머지는 일반 메시지로 대체.\n * 파일시스템 경로, 스택 트레이스 등 내부 정보 노출 방지.\n */\nexport function sanitizeError(err: unknown): string {\n  if (err instanceof KordocError) return err.message\n  return \"문서 처리 중 오류가 발생했습니다\"\n}\n\n/**\n * ZIP 엔트리 경로의 경로 순회 여부 판별.\n * 백슬래시 정규화, .., 절대경로, Windows 드라이브 문자 모두 차단.\n */\nexport function isPathTraversal(name: string): boolean {\n  if (name.includes(\"\\x00\")) return true\n  const normalized = name.replace(/\\\\/g, \"/\")\n  const segments = normalized.split(\"/\")\n  return segments.some(s => s === \"..\") || normalized.startsWith(\"/\") || /^[A-Za-z]:/.test(normalized)\n}\n\n// ─── HWPX 섹션 href 해석 (parser/roundtrip 공용) ────────────────────\n\n/**\n * manifest href를 본문 섹션 경로(`Contents/sectionN.xml`)로 정규화.\n * 비본문 XML(header/script/settings)·path traversal·드라이브 경로는 null로 거른다.\n * 백슬래시 구분자를 슬래시로 통일해 parser와 roundtrip이 동일한 목록을 만든다.\n */\nexport function normalizeSectionHref(href: string): string | null {\n  if (!href) return null\n  let normalized = href.replace(/\\\\/g, \"/\").replace(/^\\/+/, \"\")\n  if (isPathTraversal(normalized)) return null\n  if (/^[Ss]ection\\d+\\.xml$/.test(normalized)) normalized = \"Contents/\" + normalized\n  return /(?:^|\\/)[Ss]ection\\d+\\.xml$/.test(normalized) ? normalized : null\n}\n\n/** sectionN.xml을 N 숫자 순서로 정렬 (section10 > section2). */\nexport function compareSectionPaths(a: string, b: string): number {\n  const ai = Number(a.match(/[Ss]ection(\\d+)\\.xml$/)?.[1] ?? Number.MAX_SAFE_INTEGER)\n  const bi = Number(b.match(/[Ss]ection(\\d+)\\.xml$/)?.[1] ?? Number.MAX_SAFE_INTEGER)\n  return ai === bi ? a.localeCompare(b) : ai - bi\n}\n\n// ─── ZIP 안전 로딩 (ZIP bomb 방지) ────────────────────\n\n/**\n * ZIP bomb 사전 검사 — Central Directory에서 비압축 합계와 엔트리 수 확인.\n * HWPX/XLSX/DOCX 등 모든 ZIP 기반 포맷에서 공통 사용.\n */\nexport function precheckZipSize(\n  buffer: ArrayBuffer,\n  maxUncompressedSize = 100 * 1024 * 1024,\n  maxEntries = 500,\n): { totalUncompressed: number; entryCount: number } {\n  try {\n    const data = new DataView(buffer)\n    const len = buffer.byteLength\n    // EOCD 시그니처 역방향 스캔\n    let eocdOffset = -1\n    for (let i = len - 22; i >= Math.max(0, len - 65557); i--) {\n      if (data.getUint32(i, true) === 0x06054b50) { eocdOffset = i; break }\n    }\n    if (eocdOffset < 0) return { totalUncompressed: 0, entryCount: 0 }\n\n    const entryCount = data.getUint16(eocdOffset + 10, true)\n    if (entryCount > maxEntries) {\n      throw new KordocError(`ZIP 엔트리 수 초과: ${entryCount} (최대 ${maxEntries})`)\n    }\n\n    const cdSize = data.getUint32(eocdOffset + 12, true)\n    const cdOffset = data.getUint32(eocdOffset + 16, true)\n    if (cdOffset + cdSize > len) return { totalUncompressed: 0, entryCount }\n\n    let totalUncompressed = 0\n    let pos = cdOffset\n    for (let i = 0; i < entryCount && pos + 46 <= cdOffset + cdSize; i++) {\n      if (data.getUint32(pos, true) !== 0x02014b50) break\n      totalUncompressed += data.getUint32(pos + 24, true)\n      const nameLen = data.getUint16(pos + 28, true)\n      const extraLen = data.getUint16(pos + 30, true)\n      const commentLen = data.getUint16(pos + 32, true)\n      pos += 46 + nameLen + extraLen + commentLen\n    }\n\n    if (totalUncompressed > maxUncompressedSize) {\n      throw new KordocError(`ZIP 비압축 크기 초과: ${(totalUncompressed / 1024 / 1024).toFixed(1)}MB (최대 ${maxUncompressedSize / 1024 / 1024}MB)`)\n    }\n\n    return { totalUncompressed, entryCount }\n  } catch (err) {\n    if (err instanceof KordocError) throw err\n    return { totalUncompressed: 0, entryCount: 0 }\n  }\n}\n\n/** XXE/Billion Laughs 방지 — DOCTYPE 제거 (내부 DTD 서브셋 포함) */\nexport function stripDtd(xml: string): string {\n  return xml.replace(/<!DOCTYPE\\s[^[>]*(\\[[\\s\\S]*?\\])?\\s*>/gi, \"\")\n}\n\n/** 하이퍼링크 URL 살균 — javascript: 등 XSS 위험 스킴 차단 */\nconst SAFE_HREF_RE = /^(?:https?:|mailto:|tel:|#)/i\nexport function sanitizeHref(href: string): string | null {\n  const trimmed = href.trim()\n  if (!trimmed || !SAFE_HREF_RE.test(trimmed)) return null\n  // 괄호 percent-encoding — 마크다운 링크 목적지에서 불균형 ')'는 링크를 조기 종료시켜\n  // 문법이 깨진다 (원문 하이퍼링크에 ')'가 박힌 실문서 존재). %28/%29는 의미 동일.\n  return trimmed.replace(/\\(/g, \"%28\").replace(/\\)/g, \"%29\")\n}\n\n// ─── 안전한 min/max (스택 오버플로 방지) ─────────────\n\n/** Math.min(...arr) 대체 — 대형 배열에서 스택 오버플로 방지 */\nexport function safeMin(arr: number[]): number {\n  let min = Infinity\n  for (let i = 0; i < arr.length; i++) if (arr[i] < min) min = arr[i]\n  return min\n}\n\n/** Math.max(...arr) 대체 — 대형 배열에서 스택 오버플로 방지 */\nexport function safeMax(arr: number[]): number {\n  let max = -Infinity\n  for (let i = 0; i < arr.length; i++) if (arr[i] > max) max = arr[i]\n  return max\n}\n\n// ─── 에러 분류 ──────────────────────────────────────\n\nimport type { ErrorCode } from \"./types.js\"\n\n/** 에러를 구조화된 ErrorCode로 분류 — KordocError 메시지 패턴 매칭 */\nexport function classifyError(err: unknown): ErrorCode {\n  if (!(err instanceof Error)) return \"PARSE_ERROR\"\n  const msg = err.message\n  if (msg.includes(\"암호화\")) return \"ENCRYPTED\"\n  if (msg.includes(\"DRM\")) return \"DRM_PROTECTED\"\n  if (msg.includes(\"ZIP bomb\") || msg.includes(\"ZIP 비압축 크기 초과\") || msg.includes(\"ZIP 엔트리 수 초과\")) return \"ZIP_BOMB\"\n  if (msg.includes(\"bomb\") || msg.includes(\"크기 초과\") || msg.includes(\"압축 해제\")) return \"DECOMPRESSION_BOMB\"\n  if (msg.includes(\"이미지 기반\")) return \"IMAGE_BASED_PDF\"\n  if (msg.includes(\"섹션\") && (msg.includes(\"찾을 수 없\") || msg.includes(\"없음\"))) return \"NO_SECTIONS\"\n  if (msg.includes(\"시그니처\") || msg.includes(\"복구할 수 없\")) return \"CORRUPTED\"\n  return \"PARSE_ERROR\"\n}\n"],"mappings":";;;AAIO,IAAM,UAAkB,OAA4C,UAAqB;AAOzF,SAAS,cAAc,KAA0B;AACtD,MAAI,IAAI,eAAe,KAAK,IAAI,eAAe,IAAI,OAAO,YAAY;AACpE,WAAO,IAAI;AAAA,EACb;AACA,SAAO,IAAI,OAAO,MAAM,IAAI,YAAY,IAAI,aAAa,IAAI,UAAU;AACzE;AAMO,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAMO,SAAS,cAAc,KAAsB;AAClD,MAAI,eAAe,YAAa,QAAO,IAAI;AAC3C,SAAO;AACT;AAMO,SAAS,gBAAgB,MAAuB;AACrD,MAAI,KAAK,SAAS,IAAM,EAAG,QAAO;AAClC,QAAM,aAAa,KAAK,QAAQ,OAAO,GAAG;AAC1C,QAAM,WAAW,WAAW,MAAM,GAAG;AACrC,SAAO,SAAS,KAAK,OAAK,MAAM,IAAI,KAAK,WAAW,WAAW,GAAG,KAAK,aAAa,KAAK,UAAU;AACrG;AASO,SAAS,qBAAqB,MAA6B;AAChE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,aAAa,KAAK,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAC5D,MAAI,gBAAgB,UAAU,EAAG,QAAO;AACxC,MAAI,uBAAuB,KAAK,UAAU,EAAG,cAAa,cAAc;AACxE,SAAO,8BAA8B,KAAK,UAAU,IAAI,aAAa;AACvE;AAGO,SAAS,oBAAoB,GAAW,GAAmB;AAChE,QAAM,KAAK,OAAO,EAAE,MAAM,uBAAuB,IAAI,CAAC,KAAK,OAAO,gBAAgB;AAClF,QAAM,KAAK,OAAO,EAAE,MAAM,uBAAuB,IAAI,CAAC,KAAK,OAAO,gBAAgB;AAClF,SAAO,OAAO,KAAK,EAAE,cAAc,CAAC,IAAI,KAAK;AAC/C;AAQO,SAAS,gBACd,QACA,sBAAsB,MAAM,OAAO,MACnC,aAAa,KACsC;AACnD,MAAI;AACF,UAAM,OAAO,IAAI,SAAS,MAAM;AAChC,UAAM,MAAM,OAAO;AAEnB,QAAI,aAAa;AACjB,aAAS,IAAI,MAAM,IAAI,KAAK,KAAK,IAAI,GAAG,MAAM,KAAK,GAAG,KAAK;AACzD,UAAI,KAAK,UAAU,GAAG,IAAI,MAAM,WAAY;AAAE,qBAAa;AAAG;AAAA,MAAM;AAAA,IACtE;AACA,QAAI,aAAa,EAAG,QAAO,EAAE,mBAAmB,GAAG,YAAY,EAAE;AAEjE,UAAM,aAAa,KAAK,UAAU,aAAa,IAAI,IAAI;AACvD,QAAI,aAAa,YAAY;AAC3B,YAAM,IAAI,YAAY,+CAAiB,UAAU,kBAAQ,UAAU,GAAG;AAAA,IACxE;AAEA,UAAM,SAAS,KAAK,UAAU,aAAa,IAAI,IAAI;AACnD,UAAM,WAAW,KAAK,UAAU,aAAa,IAAI,IAAI;AACrD,QAAI,WAAW,SAAS,IAAK,QAAO,EAAE,mBAAmB,GAAG,WAAW;AAEvE,QAAI,oBAAoB;AACxB,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,cAAc,MAAM,MAAM,WAAW,QAAQ,KAAK;AACpE,UAAI,KAAK,UAAU,KAAK,IAAI,MAAM,SAAY;AAC9C,2BAAqB,KAAK,UAAU,MAAM,IAAI,IAAI;AAClD,YAAM,UAAU,KAAK,UAAU,MAAM,IAAI,IAAI;AAC7C,YAAM,WAAW,KAAK,UAAU,MAAM,IAAI,IAAI;AAC9C,YAAM,aAAa,KAAK,UAAU,MAAM,IAAI,IAAI;AAChD,aAAO,KAAK,UAAU,WAAW;AAAA,IACnC;AAEA,QAAI,oBAAoB,qBAAqB;AAC3C,YAAM,IAAI,YAAY,sDAAmB,oBAAoB,OAAO,MAAM,QAAQ,CAAC,CAAC,oBAAU,sBAAsB,OAAO,IAAI,KAAK;AAAA,IACtI;AAEA,WAAO,EAAE,mBAAmB,WAAW;AAAA,EACzC,SAAS,KAAK;AACZ,QAAI,eAAe,YAAa,OAAM;AACtC,WAAO,EAAE,mBAAmB,GAAG,YAAY,EAAE;AAAA,EAC/C;AACF;AAGO,SAAS,SAAS,KAAqB;AAC5C,SAAO,IAAI,QAAQ,0CAA0C,EAAE;AACjE;AAGA,IAAM,eAAe;AACd,SAAS,aAAa,MAA6B;AACxD,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,WAAW,CAAC,aAAa,KAAK,OAAO,EAAG,QAAO;AAGpD,SAAO,QAAQ,QAAQ,OAAO,KAAK,EAAE,QAAQ,OAAO,KAAK;AAC3D;AAKO,SAAS,QAAQ,KAAuB;AAC7C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,KAAI,IAAI,CAAC,IAAI,IAAK,OAAM,IAAI,CAAC;AAClE,SAAO;AACT;AAGO,SAAS,QAAQ,KAAuB;AAC7C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,KAAI,IAAI,CAAC,IAAI,IAAK,OAAM,IAAI,CAAC;AAClE,SAAO;AACT;AAOO,SAAS,cAAc,KAAyB;AACrD,MAAI,EAAE,eAAe,OAAQ,QAAO;AACpC,QAAM,MAAM,IAAI;AAChB,MAAI,IAAI,SAAS,oBAAK,EAAG,QAAO;AAChC,MAAI,IAAI,SAAS,KAAK,EAAG,QAAO;AAChC,MAAI,IAAI,SAAS,UAAU,KAAK,IAAI,SAAS,kDAAe,KAAK,IAAI,SAAS,4CAAc,EAAG,QAAO;AACtG,MAAI,IAAI,SAAS,MAAM,KAAK,IAAI,SAAS,2BAAO,KAAK,IAAI,SAAS,2BAAO,EAAG,QAAO;AACnF,MAAI,IAAI,SAAS,iCAAQ,EAAG,QAAO;AACnC,MAAI,IAAI,SAAS,cAAI,MAAM,IAAI,SAAS,4BAAQ,KAAK,IAAI,SAAS,cAAI,GAAI,QAAO;AACjF,MAAI,IAAI,SAAS,0BAAM,KAAK,IAAI,SAAS,kCAAS,EAAG,QAAO;AAC5D,SAAO;AACT;","names":[]}

package/dist/chunk-GEPINOL6.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+import {
+  ensureModelsIn,
+  getModelStatusIn,
+  getModelsDir
+} from "./chunk-NNDVFNMJ.js";
+
+// src/ocr/models.ts
+import { join } from "path";
+var OCR_DET_MODEL = {
+  name: "PP-OCRv5 mobile det",
+  filename: "det.onnx",
+  url: "https://huggingface.co/PaddlePaddle/PP-OCRv5_mobile_det_onnx/resolve/main/inference.onnx",
+  sha256: "a431985659dc921974177a95adcfbb90fd9e51989a5e04d70d0b75f597b6e61d",
+  sizeMb: 5
+};
+var OCR_REC_MODEL = {
+  name: "PP-OCRv5 korean rec",
+  filename: "rec_korean.onnx",
+  url: "https://huggingface.co/PaddlePaddle/korean_PP-OCRv5_mobile_rec_onnx/resolve/main/inference.onnx",
+  sha256: "92f0b7785e64fc9090106a241cf4c1eb97472824558272751b88a2a4476d3a08",
+  sizeMb: 13
+};
+var OCR_REC_DICT = {
+  name: "PP-OCRv5 korean dict",
+  filename: "rec_korean.yml",
+  url: "https://huggingface.co/PaddlePaddle/korean_PP-OCRv5_mobile_rec_onnx/resolve/main/inference.yml",
+  sha256: "f757fa1c40e99edcf27e9cce879b93eb2a51fa46f5ef39095689b8c37dd75998",
+  sizeMb: 1
+};
+var ALL_OCR_MODELS = [OCR_DET_MODEL, OCR_REC_MODEL, OCR_REC_DICT];
+function getOcrModelsDir() {
+  return getModelsDir("ppocr");
+}
+async function ensureOcrModels(onProgress) {
+  return ensureModelsIn(getOcrModelsDir(), ALL_OCR_MODELS, onProgress);
+}
+async function getOcrModelStatus() {
+  return getModelStatusIn(getOcrModelsDir(), ALL_OCR_MODELS);
+}
+function parseCharacterDict(yml) {
+  const lines = yml.split("\n");
+  const chars = [];
+  let inDict = false;
+  let dictIndent = -1;
+  for (const line of lines) {
+    if (!inDict) {
+      const m2 = /^(\s*)character_dict:\s*$/.exec(line);
+      if (m2) {
+        inDict = true;
+        dictIndent = m2[1].length;
+      }
+      continue;
+    }
+    const m = /^(\s*)- (.*)$/.exec(line);
+    if (m && m[1].length >= dictIndent) {
+      let v = m[2];
+      if (v.length >= 2 && (v.startsWith("'") && v.endsWith("'") || v.startsWith('"') && v.endsWith('"'))) {
+        v = v.slice(1, -1).replace(/''/g, "'");
+      }
+      chars.push(v);
+      continue;
+    }
+    if (line.trim() !== "") break;
+  }
+  return chars;
+}
+function ocrModelPath(spec) {
+  return join(getOcrModelsDir(), spec.filename);
+}
+
+export {
+  OCR_DET_MODEL,
+  OCR_REC_MODEL,
+  OCR_REC_DICT,
+  ALL_OCR_MODELS,
+  getOcrModelsDir,
+  ensureOcrModels,
+  getOcrModelStatus,
+  parseCharacterDict,
+  ocrModelPath
+};
+//# sourceMappingURL=chunk-GEPINOL6.js.map

package/dist/chunk-GEPINOL6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ocr/models.ts"],"sourcesContent":["/**\n * 내장 텍스트 OCR 모델 (PP-OCRv5 korean) 스펙 + 다운로드/검증.\n *\n * 캐시 위치: `~/.cache/kordoc/models/ppocr/` — 총 ~18MB (det 4.6 + rec 12.8 + dict 0.1)\n * 다운로드 인프라는 수식 OCR 과 공용 (formula/models.ts ensureModelsIn).\n *\n * 모델 출처: PaddlePaddle 공식 HuggingFace org 의 ONNX 변환본 (Apache-2.0).\n * SHA-256 은 실제 다운로드 + HF API lfs.oid 대조로 검증됨 — 변경 금지.\n * 한국어 사전은 rec 리포의 inference.yml `PostProcess.character_dict` 에\n * 내장 (11,945자 — 완성형 한글 11,172 음절 전량 + 자모/라틴/기호).\n */\n\nimport { join } from \"path\"\nimport {\n  type ModelSpec,\n  type ModelStatus,\n  type ProgressHandler,\n  ensureModelsIn,\n  getModelStatusIn,\n  getModelsDir,\n} from \"../pdf/formula/models.js\"\n\nexport const OCR_DET_MODEL: ModelSpec = {\n  name: \"PP-OCRv5 mobile det\",\n  filename: \"det.onnx\",\n  url: \"https://huggingface.co/PaddlePaddle/PP-OCRv5_mobile_det_onnx/resolve/main/inference.onnx\",\n  sha256: \"a431985659dc921974177a95adcfbb90fd9e51989a5e04d70d0b75f597b6e61d\",\n  sizeMb: 5,\n}\n\nexport const OCR_REC_MODEL: ModelSpec = {\n  name: \"PP-OCRv5 korean rec\",\n  filename: \"rec_korean.onnx\",\n  url: \"https://huggingface.co/PaddlePaddle/korean_PP-OCRv5_mobile_rec_onnx/resolve/main/inference.onnx\",\n  sha256: \"92f0b7785e64fc9090106a241cf4c1eb97472824558272751b88a2a4476d3a08\",\n  sizeMb: 13,\n}\n\nexport const OCR_REC_DICT: ModelSpec = {\n  name: \"PP-OCRv5 korean dict\",\n  filename: \"rec_korean.yml\",\n  url: \"https://huggingface.co/PaddlePaddle/korean_PP-OCRv5_mobile_rec_onnx/resolve/main/inference.yml\",\n  sha256: \"f757fa1c40e99edcf27e9cce879b93eb2a51fa46f5ef39095689b8c37dd75998\",\n  sizeMb: 1,\n}\n\nexport const ALL_OCR_MODELS: ReadonlyArray<ModelSpec> = [OCR_DET_MODEL, OCR_REC_MODEL, OCR_REC_DICT]\n\nexport function getOcrModelsDir(): string {\n  return getModelsDir(\"ppocr\")\n}\n\n/** 모든 텍스트 OCR 모델 다운로드/검증 (있으면 skip) */\nexport async function ensureOcrModels(onProgress?: ProgressHandler): Promise<void> {\n  return ensureModelsIn(getOcrModelsDir(), ALL_OCR_MODELS, onProgress)\n}\n\n/** 텍스트 OCR 모델 상태 (다운로드 없이 확인만) */\nexport async function getOcrModelStatus(): Promise<ModelStatus[]> {\n  return getModelStatusIn(getOcrModelsDir(), ALL_OCR_MODELS)\n}\n\n/**\n * inference.yml 에서 `PostProcess.character_dict` 리스트를 추출.\n * 전체 YAML 파서 없이 해당 블록의 `- <char>` 라인만 순서대로 읽는다\n * (공식 yml 구조 고정 — 들여쓰기 2칸, 한 줄 한 글자).\n *\n * CTC 클래스 배열: index 0 = blank, 1..N = 사전 순서, N+1(마지막) = space.\n */\nexport function parseCharacterDict(yml: string): string[] {\n  const lines = yml.split(\"\\n\")\n  const chars: string[] = []\n  let inDict = false\n  let dictIndent = -1\n  for (const line of lines) {\n    if (!inDict) {\n      const m = /^(\\s*)character_dict:\\s*$/.exec(line)\n      if (m) {\n        inDict = true\n        dictIndent = m[1].length\n      }\n      continue\n    }\n    // 리스트 항목 — YAML 은 키와 같은 들여쓰기의 \"- x\" 도 허용 (공식 yml 실측: 둘 다 2칸)\n    const m = /^(\\s*)- (.*)$/.exec(line)\n    if (m && m[1].length >= dictIndent) {\n      let v = m[2]\n      // YAML 인용 문자 처리 ('#' 같은 예약 문자는 인용됨)\n      if (v.length >= 2 && ((v.startsWith(\"'\") && v.endsWith(\"'\")) || (v.startsWith('\"') && v.endsWith('\"')))) {\n        v = v.slice(1, -1).replace(/''/g, \"'\")\n      }\n      chars.push(v)\n      continue\n    }\n    // 들여쓰기가 얕아지면 블록 종료 (빈 줄은 통과)\n    if (line.trim() !== \"\") break\n  }\n  return chars\n}\n\nexport function ocrModelPath(spec: ModelSpec): string {\n  return join(getOcrModelsDir(), spec.filename)\n}\n"],"mappings":";;;;;;;;AAYA,SAAS,YAAY;AAUd,IAAM,gBAA2B;AAAA,EACtC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,IAAM,gBAA2B;AAAA,EACtC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,IAAM,eAA0B;AAAA,EACrC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,IAAM,iBAA2C,CAAC,eAAe,eAAe,YAAY;AAE5F,SAAS,kBAA0B;AACxC,SAAO,aAAa,OAAO;AAC7B;AAGA,eAAsB,gBAAgB,YAA6C;AACjF,SAAO,eAAe,gBAAgB,GAAG,gBAAgB,UAAU;AACrE;AAGA,eAAsB,oBAA4C;AAChE,SAAO,iBAAiB,gBAAgB,GAAG,cAAc;AAC3D;AASO,SAAS,mBAAmB,KAAuB;AACxD,QAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,aAAa;AACjB,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,QAAQ;AACX,YAAMA,KAAI,4BAA4B,KAAK,IAAI;AAC/C,UAAIA,IAAG;AACL,iBAAS;AACT,qBAAaA,GAAE,CAAC,EAAE;AAAA,MACpB;AACA;AAAA,IACF;AAEA,UAAM,IAAI,gBAAgB,KAAK,IAAI;AACnC,QAAI,KAAK,EAAE,CAAC,EAAE,UAAU,YAAY;AAClC,UAAI,IAAI,EAAE,CAAC;AAEX,UAAI,EAAE,UAAU,MAAO,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,KAAO,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,IAAK;AACvG,YAAI,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,OAAO,GAAG;AAAA,MACvC;AACA,YAAM,KAAK,CAAC;AACZ;AAAA,IACF;AAEA,QAAI,KAAK,KAAK,MAAM,GAAI;AAAA,EAC1B;AACA,SAAO;AACT;AAEO,SAAS,aAAa,MAAyB;AACpD,SAAO,KAAK,gBAAgB,GAAG,KAAK,QAAQ;AAC9C;","names":["m"]}

package/dist/chunk-H7OWEYH2.cjs

@@ -0,0 +1,243 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/pdf/formula/models.ts
+var _crypto = require('crypto');
+var _fs = require('fs');
+var _promises = require('fs/promises');
+
+var _os = require('os');
+var _path = require('path');
+var _promises3 = require('stream/promises');
+var _stream = require('stream');
+var MFD_MODEL = {
+  name: "Pix2Text MFD",
+  filename: "mfd.onnx",
+  url: "https://huggingface.co/breezedeus/pix2text-mfd/resolve/main/mfd-v20240618.onnx",
+  sha256: "51a8854743b17ae654729af8db82a630c1ccfa06debf4856c8b28055f87d02c1",
+  sizeMb: 42
+};
+var MFR_ENCODER_MODEL = {
+  name: "Pix2Text MFR encoder",
+  filename: "encoder_model.onnx",
+  url: "https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/encoder_model.onnx",
+  sha256: "bd8d5c322792e9ec45793af5569e9748f82a3d728a9e00213dbfc56c1486f37d",
+  sizeMb: 87
+};
+var MFR_DECODER_MODEL = {
+  name: "Pix2Text MFR decoder",
+  filename: "decoder_model.onnx",
+  url: "https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/decoder_model.onnx",
+  sha256: "fd0f92d7a012f3dae41e1ac79421aea0ea888b5a66cb3f9a004e424f82f3daed",
+  sizeMb: 30
+};
+var MFR_TOKENIZER = {
+  name: "Pix2Text MFR tokenizer",
+  filename: "tokenizer.json",
+  url: "https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/tokenizer.json",
+  sha256: "3e2ab757277d22639bec28c9d7972e352d3d1dba223051fa674002dc5ab64df3",
+  sizeMb: 1
+};
+var ALL_FORMULA_MODELS = [
+  MFD_MODEL,
+  MFR_ENCODER_MODEL,
+  MFR_DECODER_MODEL,
+  MFR_TOKENIZER
+];
+function getModelsDir(subdir) {
+  const override = process.env.KORDOC_MODEL_CACHE;
+  if (override && override.trim()) {
+    return _path.join.call(void 0, override, subdir);
+  }
+  return _path.join.call(void 0, _os.homedir.call(void 0, ), ".cache", "kordoc", "models", subdir);
+}
+function getFormulaModelsDir() {
+  return getModelsDir("pix2text");
+}
+async function getModelStatusIn(dir, specs) {
+  const result = [];
+  for (const spec of specs) {
+    const localPath = _path.join.call(void 0, dir, spec.filename);
+    let exists = false;
+    try {
+      const s = await _promises.stat.call(void 0, localPath);
+      exists = s.isFile() && s.size > 0;
+    } catch (e2) {
+      exists = false;
+    }
+    if (!exists) {
+      result.push({ spec, localPath, exists: false, verified: false });
+      continue;
+    }
+    try {
+      const actual = await sha256OfFile(localPath);
+      if (actual === spec.sha256) {
+        result.push({ spec, localPath, exists: true, verified: true });
+      } else {
+        result.push({
+          spec,
+          localPath,
+          exists: true,
+          verified: false,
+          invalidReason: `SHA256 mismatch: expected ${spec.sha256}, got ${actual}`
+        });
+      }
+    } catch (e) {
+      result.push({
+        spec,
+        localPath,
+        exists: true,
+        verified: false,
+        invalidReason: `SHA compute failed: ${e.message}`
+      });
+    }
+  }
+  return result;
+}
+async function getFormulaModelStatus() {
+  return getModelStatusIn(getFormulaModelsDir(), ALL_FORMULA_MODELS);
+}
+async function ensureModelsIn(dir, specs, onProgress) {
+  await _promises.mkdir.call(void 0, dir, { recursive: true });
+  for (const spec of specs) {
+    const localPath = _path.join.call(void 0, dir, spec.filename);
+    if (await isExistingValid(localPath, spec.sha256)) {
+      _optionalChain([onProgress, 'optionalCall', _ => _({
+        spec,
+        downloaded: 0,
+        total: null,
+        phase: "skip",
+        message: "\uC774\uBBF8 \uC874\uC7AC + SHA \uC77C\uCE58"
+      })]);
+      continue;
+    }
+    try {
+      await _promises.unlink.call(void 0, localPath);
+    } catch (e3) {
+    }
+    await downloadToFile(spec, localPath, onProgress);
+  }
+}
+async function ensureFormulaModels(onProgress) {
+  return ensureModelsIn(getFormulaModelsDir(), ALL_FORMULA_MODELS, onProgress);
+}
+async function ensureSingleModel(spec, onProgress) {
+  const dir = getFormulaModelsDir();
+  await _promises.mkdir.call(void 0, dir, { recursive: true });
+  const localPath = _path.join.call(void 0, dir, spec.filename);
+  if (await isExistingValid(localPath, spec.sha256)) {
+    _optionalChain([onProgress, 'optionalCall', _2 => _2({ spec, downloaded: 0, total: null, phase: "skip" })]);
+    return;
+  }
+  try {
+    await _promises.unlink.call(void 0, localPath);
+  } catch (e4) {
+  }
+  await downloadToFile(spec, localPath, onProgress);
+}
+async function isExistingValid(localPath, sha256Expected) {
+  try {
+    const s = await _promises.stat.call(void 0, localPath);
+    if (!s.isFile() || s.size === 0) return false;
+  } catch (e5) {
+    return false;
+  }
+  try {
+    const actual = await sha256OfFile(localPath);
+    return actual === sha256Expected;
+  } catch (e6) {
+    return false;
+  }
+}
+async function downloadToFile(spec, localPath, onProgress) {
+  const partPath = `${localPath}.part`;
+  await _promises.mkdir.call(void 0, _path.dirname.call(void 0, localPath), { recursive: true });
+  const resp = await fetch(spec.url, {
+    headers: {
+      // HF CDN 은 UA 없으면 가끔 403 을 뱉는다
+      "User-Agent": "kordoc-formula-ocr/1.0 (+https://github.com/chrisryugj/kordoc)"
+    }
+  });
+  if (!resp.ok || !resp.body) {
+    throw new Error(
+      `${spec.name} \uB2E4\uC6B4\uB85C\uB4DC \uC2E4\uD328: HTTP ${resp.status} ${resp.statusText} (${spec.url})`
+    );
+  }
+  const lenHeader = resp.headers.get("content-length");
+  const total = lenHeader ? Number.parseInt(lenHeader, 10) : null;
+  let downloaded = 0;
+  const ws = _fs.createWriteStream.call(void 0, partPath);
+  try {
+    const reader = _stream.Readable.fromWeb(resp.body);
+    reader.on("data", (chunk) => {
+      downloaded += chunk.length;
+      _optionalChain([onProgress, 'optionalCall', _3 => _3({
+        spec,
+        downloaded,
+        total,
+        phase: "download"
+      })]);
+    });
+    await _promises3.pipeline.call(void 0, reader, ws);
+  } catch (e) {
+    try {
+      await _promises.unlink.call(void 0, partPath);
+    } catch (e7) {
+    }
+    throw new Error(`${spec.name} \uC2A4\uD2B8\uB9AC\uBC0D \uC2E4\uD328: ${e.message}`);
+  }
+  _optionalChain([onProgress, 'optionalCall', _4 => _4({
+    spec,
+    downloaded,
+    total,
+    phase: "verify"
+  })]);
+  let actual;
+  try {
+    actual = await sha256OfFile(partPath);
+  } catch (e) {
+    try {
+      await _promises.unlink.call(void 0, partPath);
+    } catch (e8) {
+    }
+    throw new Error(`${spec.name} SHA \uACC4\uC0B0 \uC2E4\uD328: ${e.message}`);
+  }
+  if (actual !== spec.sha256) {
+    try {
+      await _promises.unlink.call(void 0, partPath);
+    } catch (e9) {
+    }
+    throw new Error(
+      `${spec.name} SHA256 mismatch: expected ${spec.sha256}, got ${actual} \u2014 \uBAA8\uB378 URL \uC774 \uC624\uC5FC\uB418\uC5C8\uAC70\uB098 \uC804\uC1A1 \uC911 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.`
+    );
+  }
+  await _promises.rename.call(void 0, partPath, localPath);
+  _optionalChain([onProgress, 'optionalCall', _5 => _5({
+    spec,
+    downloaded,
+    total,
+    phase: "done"
+  })]);
+}
+async function sha256OfFile(p) {
+  const h = _crypto.createHash.call(void 0, "sha256");
+  const stream = _fs.createReadStream.call(void 0, p);
+  await _promises3.pipeline.call(void 0, stream, async function* (src) {
+    for await (const chunk of src) {
+      h.update(chunk);
+    }
+  });
+  return h.digest("hex");
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.MFD_MODEL = MFD_MODEL; exports.MFR_ENCODER_MODEL = MFR_ENCODER_MODEL; exports.MFR_DECODER_MODEL = MFR_DECODER_MODEL; exports.MFR_TOKENIZER = MFR_TOKENIZER; exports.ALL_FORMULA_MODELS = ALL_FORMULA_MODELS; exports.getModelsDir = getModelsDir; exports.getFormulaModelsDir = getFormulaModelsDir; exports.getFormulaModelStatus = getFormulaModelStatus; exports.ensureModelsIn = ensureModelsIn; exports.ensureFormulaModels = ensureFormulaModels; exports.ensureSingleModel = ensureSingleModel;
+//# sourceMappingURL=chunk-H7OWEYH2.cjs.map

package/dist/chunk-H7OWEYH2.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/chris_gomdori/workspace/kordoc/dist/chunk-H7OWEYH2.cjs","../src/pdf/formula/models.ts"],"names":[],"mappings":"AAAA;ACUA,gCAA2B;AAC3B,wBAAiC;AACjC,uCAA4C;AAC5C;AACA,wBAAwB;AACxB,4BAA8B;AAC9B,4CAAyB;AACzB,gCAAyB;AAWlB,IAAM,UAAA,EAAuB;AAAA,EAClC,IAAA,EAAM,cAAA;AAAA,EACN,QAAA,EAAU,UAAA;AAAA,EACV,GAAA,EAAK,gFAAA;AAAA,EACL,MAAA,EAAQ,kEAAA;AAAA,EACR,MAAA,EAAQ;AACV,CAAA;AAEO,IAAM,kBAAA,EAA+B;AAAA,EAC1C,IAAA,EAAM,sBAAA;AAAA,EACN,QAAA,EAAU,oBAAA;AAAA,EACV,GAAA,EAAK,gFAAA;AAAA,EACL,MAAA,EAAQ,kEAAA;AAAA,EACR,MAAA,EAAQ;AACV,CAAA;AAEO,IAAM,kBAAA,EAA+B;AAAA,EAC1C,IAAA,EAAM,sBAAA;AAAA,EACN,QAAA,EAAU,oBAAA;AAAA,EACV,GAAA,EAAK,gFAAA;AAAA,EACL,MAAA,EAAQ,kEAAA;AAAA,EACR,MAAA,EAAQ;AACV,CAAA;AAEO,IAAM,cAAA,EAA2B;AAAA,EACtC,IAAA,EAAM,wBAAA;AAAA,EACN,QAAA,EAAU,gBAAA;AAAA,EACV,GAAA,EAAK,4EAAA;AAAA,EACL,MAAA,EAAQ,kEAAA;AAAA,EACR,MAAA,EAAQ;AACV,CAAA;AAEO,IAAM,mBAAA,EAA+C;AAAA,EAC1D,SAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACF,CAAA;AAOO,SAAS,YAAA,CAAa,MAAA,EAAwB;AACnD,EAAA,MAAM,SAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,kBAAA;AAC7B,EAAA,GAAA,CAAI,SAAA,GAAY,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG;AAC/B,IAAA,OAAO,wBAAA,QAAK,EAAU,MAAM,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,wBAAA,yBAAK,CAAQ,EAAG,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,MAAM,CAAA;AAC7D;AAEO,SAAS,mBAAA,CAAA,EAA8B;AAC5C,EAAA,OAAO,YAAA,CAAa,UAAU,CAAA;AAChC;AAaA,MAAA,SAAsB,gBAAA,CAAiB,GAAA,EAAa,KAAA,EAAyD;AAC3G,EAAA,MAAM,OAAA,EAAwB,CAAC,CAAA;AAC/B,EAAA,IAAA,CAAA,MAAW,KAAA,GAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,UAAA,EAAY,wBAAA,GAAK,EAAK,IAAA,CAAK,QAAQ,CAAA;AACzC,IAAA,IAAI,OAAA,EAAS,KAAA;AACb,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,EAAI,MAAM,4BAAA,SAAc,CAAA;AAC9B,MAAA,OAAA,EAAS,CAAA,CAAE,MAAA,CAAO,EAAA,GAAK,CAAA,CAAE,KAAA,EAAO,CAAA;AAAA,IAClC,EAAA,WAAQ;AACN,MAAA,OAAA,EAAS,KAAA;AAAA,IACX;AACA,IAAA,GAAA,CAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,KAAA,EAAO,QAAA,EAAU,MAAM,CAAC,CAAA;AAC/D,MAAA,QAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,EAAS,MAAM,YAAA,CAAa,SAAS,CAAA;AAC3C,MAAA,GAAA,CAAI,OAAA,IAAW,IAAA,CAAK,MAAA,EAAQ;AAC1B,QAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAU,KAAK,CAAC,CAAA;AAAA,MAC/D,EAAA,KAAO;AACL,QAAA,MAAA,CAAO,IAAA,CAAK;AAAA,UACV,IAAA;AAAA,UACA,SAAA;AAAA,UACA,MAAA,EAAQ,IAAA;AAAA,UACR,QAAA,EAAU,KAAA;AAAA,UACV,aAAA,EAAe,CAAA,0BAAA,EAA6B,IAAA,CAAK,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA;AAAA,QAAA;AACvE,MAAA;AACH,IAAA;AAEA,MAAA;AAAY,QAAA;AACV,QAAA;AACA,QAAA;AACQ,QAAA;AACE,QAAA;AACgD,MAAA;AAC3D,IAAA;AACH,EAAA;AAEF,EAAA;AACF;AAGA;AACE,EAAA;AACF;AAoBA;AACE,EAAA;AAEA,EAAA;AACE,IAAA;AAEA,IAAA;AACE,sBAAA;AAAa,QAAA;AACX,QAAA;AACY,QAAA;AACL,QAAA;AACA,QAAA;AACE,MAAA;AAEX,MAAA;AAAA,IAAA;AAIF,IAAA;AACE,MAAA;AAAsB,IAAA;AAChB,IAAA;AAIR,IAAA;AAAgD,EAAA;AAEpD;AAGA;AACE,EAAA;AACF;AAGA;AACE,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACE,oBAAA;AACA,IAAA;AAAA,EAAA;AAEF,EAAA;AACE,IAAA;AAAsB,EAAA;AAChB,EAAA;AACR,EAAA;AACF;AAEA;AACE,EAAA;AACE,IAAA;AACA,IAAA;AAAwC,EAAA;AAExC,IAAA;AAAO,EAAA;AAET,EAAA;AACE,IAAA;AACA,IAAA;AAAkB,EAAA;AAElB,IAAA;AAAO,EAAA;AAEX;AAEA;AAME,EAAA;AACA,EAAA;AAEA,EAAA;AAAmC,IAAA;AACxB;AAAA,MAAA;AAEO,IAAA;AAChB,EAAA;AAEF,EAAA;AACE,IAAA;AAAU,MAAA;AACiE,IAAA;AAC3E,EAAA;AAGF,EAAA;AACA,EAAA;AACA,EAAA;AAEA,EAAA;AACA,EAAA;AACE,IAAA;AACA,IAAA;AACE,MAAA;AACA,sBAAA;AAAa,QAAA;AACX,QAAA;AACA,QAAA;AACA,QAAA;AACO,MAAA;AACR,IAAA;AAEH,IAAA;AAAyB,EAAA;AAEzB,IAAA;AACE,MAAA;AAAqB,IAAA;AACf,IAAA;AACR,IAAA;AAA+D,EAAA;AAGjE,kBAAA;AAAa,IAAA;AACX,IAAA;AACA,IAAA;AACA,IAAA;AACO,EAAA;AAIT,EAAA;AACA,EAAA;AACE,IAAA;AAAoC,EAAA;AAEpC,IAAA;AACE,MAAA;AAAqB,IAAA;AACf,IAAA;AACR,IAAA;AAAiE,EAAA;AAGnE,EAAA;AACE,IAAA;AACE,MAAA;AAAqB,IAAA;AACf,IAAA;AACR,IAAA;AAAU,MAAA;AAC4D,IAAA;AACtE,EAAA;AAGF,EAAA;AACA,kBAAA;AAAa,IAAA;AACX,IAAA;AACA,IAAA;AACA,IAAA;AACO,EAAA;AAEX;AAEA;AACE,EAAA;AACA,EAAA;AACA,EAAA;AACE,IAAA;AACE,MAAA;AAAc,IAAA;AAEhB,EAAA;AAEF,EAAA;AACF;ADrFA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/Users/chris_gomdori/workspace/kordoc/dist/chunk-H7OWEYH2.cjs","sourcesContent":[null,"/**\n * 수식 OCR 모델 자동 다운로드 + SHA-256 검증\n *\n * 캐시 위치: `~/.cache/kordoc/models/pix2text/`\n * 총 ~155MB (MFD 44MB + MFR encoder 87MB + MFR decoder 30MB + tokenizer 40KB)\n *\n * HF URL + SHA 는 Docufinder archive/rust-formula-ocr-wip 에서 검증 완료됨.\n * 모델 버전 갱신 시 URL + SHA 를 함께 갱신해야 한다.\n */\n\nimport { createHash } from \"crypto\"\nimport { createReadStream } from \"fs\"\nimport { mkdir, stat, unlink, rename } from \"fs/promises\"\nimport { createWriteStream } from \"fs\"\nimport { homedir } from \"os\"\nimport { join, dirname } from \"path\"\nimport { pipeline } from \"stream/promises\"\nimport { Readable } from \"stream\"\n\nexport interface ModelSpec {\n  name: string\n  filename: string\n  url: string\n  sha256: string\n  sizeMb: number\n}\n\n/** 모델 스펙 (SHA-256 은 실제 다운로드로 검증됨 — 변경 금지) */\nexport const MFD_MODEL: ModelSpec = {\n  name: \"Pix2Text MFD\",\n  filename: \"mfd.onnx\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfd/resolve/main/mfd-v20240618.onnx\",\n  sha256: \"51a8854743b17ae654729af8db82a630c1ccfa06debf4856c8b28055f87d02c1\",\n  sizeMb: 42,\n}\n\nexport const MFR_ENCODER_MODEL: ModelSpec = {\n  name: \"Pix2Text MFR encoder\",\n  filename: \"encoder_model.onnx\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/encoder_model.onnx\",\n  sha256: \"bd8d5c322792e9ec45793af5569e9748f82a3d728a9e00213dbfc56c1486f37d\",\n  sizeMb: 87,\n}\n\nexport const MFR_DECODER_MODEL: ModelSpec = {\n  name: \"Pix2Text MFR decoder\",\n  filename: \"decoder_model.onnx\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/decoder_model.onnx\",\n  sha256: \"fd0f92d7a012f3dae41e1ac79421aea0ea888b5a66cb3f9a004e424f82f3daed\",\n  sizeMb: 30,\n}\n\nexport const MFR_TOKENIZER: ModelSpec = {\n  name: \"Pix2Text MFR tokenizer\",\n  filename: \"tokenizer.json\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/tokenizer.json\",\n  sha256: \"3e2ab757277d22639bec28c9d7972e352d3d1dba223051fa674002dc5ab64df3\",\n  sizeMb: 1,\n}\n\nexport const ALL_FORMULA_MODELS: ReadonlyArray<ModelSpec> = [\n  MFD_MODEL,\n  MFR_ENCODER_MODEL,\n  MFR_DECODER_MODEL,\n  MFR_TOKENIZER,\n]\n\n/**\n * 모델 캐시 하위 디렉토리 경로. 환경 변수 `KORDOC_MODEL_CACHE` 가 설정되면\n * 해당 경로를 우선 사용, 없으면 `~/.cache/kordoc/models/<subdir>/`.\n * (수식 OCR 외 텍스트 OCR 등 다른 모델군도 공용 — subdir 로 격리)\n */\nexport function getModelsDir(subdir: string): string {\n  const override = process.env.KORDOC_MODEL_CACHE\n  if (override && override.trim()) {\n    return join(override, subdir)\n  }\n  return join(homedir(), \".cache\", \"kordoc\", \"models\", subdir)\n}\n\nexport function getFormulaModelsDir(): string {\n  return getModelsDir(\"pix2text\")\n}\n\nexport interface ModelStatus {\n  spec: ModelSpec\n  localPath: string\n  exists: boolean\n  /** SHA 검증까지 끝났는가 (exists && valid) */\n  verified: boolean\n  /** 검증 실패 시 이유 */\n  invalidReason?: string\n}\n\n/** 지정 모델군의 존재/유효성 상태 반환 (다운로드 없이 확인만) */\nexport async function getModelStatusIn(dir: string, specs: ReadonlyArray<ModelSpec>): Promise<ModelStatus[]> {\n  const result: ModelStatus[] = []\n  for (const spec of specs) {\n    const localPath = join(dir, spec.filename)\n    let exists = false\n    try {\n      const s = await stat(localPath)\n      exists = s.isFile() && s.size > 0\n    } catch {\n      exists = false\n    }\n    if (!exists) {\n      result.push({ spec, localPath, exists: false, verified: false })\n      continue\n    }\n    try {\n      const actual = await sha256OfFile(localPath)\n      if (actual === spec.sha256) {\n        result.push({ spec, localPath, exists: true, verified: true })\n      } else {\n        result.push({\n          spec,\n          localPath,\n          exists: true,\n          verified: false,\n          invalidReason: `SHA256 mismatch: expected ${spec.sha256}, got ${actual}`,\n        })\n      }\n    } catch (e) {\n      result.push({\n        spec,\n        localPath,\n        exists: true,\n        verified: false,\n        invalidReason: `SHA compute failed: ${(e as Error).message}`,\n      })\n    }\n  }\n  return result\n}\n\n/** 모든 수식 모델의 존재/유효성 상태 반환 (다운로드 없이 확인만) */\nexport async function getFormulaModelStatus(): Promise<ModelStatus[]> {\n  return getModelStatusIn(getFormulaModelsDir(), ALL_FORMULA_MODELS)\n}\n\nexport interface DownloadProgress {\n  spec: ModelSpec\n  /** 현재까지 다운로드한 바이트 */\n  downloaded: number\n  /** 전체 바이트 (알 수 있으면) */\n  total: number | null\n  /** \"download\" | \"verify\" | \"done\" | \"skip\" */\n  phase: \"download\" | \"verify\" | \"done\" | \"skip\" | \"error\"\n  message?: string\n}\n\nexport type ProgressHandler = (p: DownloadProgress) => void\n\n/**\n * 지정 모델군을 다운로드/검증한다.\n * - 이미 있고 SHA 일치 → skip\n * - 없음 → 다운로드 후 SHA 검증. 실패 시 파일 삭제.\n */\nexport async function ensureModelsIn(dir: string, specs: ReadonlyArray<ModelSpec>, onProgress?: ProgressHandler): Promise<void> {\n  await mkdir(dir, { recursive: true })\n\n  for (const spec of specs) {\n    const localPath = join(dir, spec.filename)\n\n    if (await isExistingValid(localPath, spec.sha256)) {\n      onProgress?.({\n        spec,\n        downloaded: 0,\n        total: null,\n        phase: \"skip\",\n        message: \"이미 존재 + SHA 일치\",\n      })\n      continue\n    }\n\n    // 기존 파일 있지만 SHA 불일치 → 삭제\n    try {\n      await unlink(localPath)\n    } catch {\n      // 없을 수 있음\n    }\n\n    await downloadToFile(spec, localPath, onProgress)\n  }\n}\n\n/** 필요한 모든 수식 모델을 다운로드/검증한다. */\nexport async function ensureFormulaModels(onProgress?: ProgressHandler): Promise<void> {\n  return ensureModelsIn(getFormulaModelsDir(), ALL_FORMULA_MODELS, onProgress)\n}\n\n/** 단일 모델만 확인/다운로드 (진단 UI 에서 개별 상태 새로고침용) */\nexport async function ensureSingleModel(spec: ModelSpec, onProgress?: ProgressHandler): Promise<void> {\n  const dir = getFormulaModelsDir()\n  await mkdir(dir, { recursive: true })\n  const localPath = join(dir, spec.filename)\n  if (await isExistingValid(localPath, spec.sha256)) {\n    onProgress?.({ spec, downloaded: 0, total: null, phase: \"skip\" })\n    return\n  }\n  try {\n    await unlink(localPath)\n  } catch {}\n  await downloadToFile(spec, localPath, onProgress)\n}\n\nasync function isExistingValid(localPath: string, sha256Expected: string): Promise<boolean> {\n  try {\n    const s = await stat(localPath)\n    if (!s.isFile() || s.size === 0) return false\n  } catch {\n    return false\n  }\n  try {\n    const actual = await sha256OfFile(localPath)\n    return actual === sha256Expected\n  } catch {\n    return false\n  }\n}\n\nasync function downloadToFile(\n  spec: ModelSpec,\n  localPath: string,\n  onProgress?: ProgressHandler,\n): Promise<void> {\n  // 먼저 .part 로 받고 검증 후 rename — 중단된 다운로드가 \"정상 파일\"로 오인되는 걸 방지\n  const partPath = `${localPath}.part`\n  await mkdir(dirname(localPath), { recursive: true })\n\n  const resp = await fetch(spec.url, {\n    headers: {\n      // HF CDN 은 UA 없으면 가끔 403 을 뱉는다\n      \"User-Agent\": \"kordoc-formula-ocr/1.0 (+https://github.com/chrisryugj/kordoc)\",\n    },\n  })\n  if (!resp.ok || !resp.body) {\n    throw new Error(\n      `${spec.name} 다운로드 실패: HTTP ${resp.status} ${resp.statusText} (${spec.url})`,\n    )\n  }\n\n  const lenHeader = resp.headers.get(\"content-length\")\n  const total = lenHeader ? Number.parseInt(lenHeader, 10) : null\n  let downloaded = 0\n\n  const ws = createWriteStream(partPath)\n  try {\n    const reader = Readable.fromWeb(resp.body as unknown as import(\"stream/web\").ReadableStream)\n    reader.on(\"data\", (chunk: Buffer | Uint8Array) => {\n      downloaded += chunk.length\n      onProgress?.({\n        spec,\n        downloaded,\n        total,\n        phase: \"download\",\n      })\n    })\n    await pipeline(reader, ws)\n  } catch (e) {\n    try {\n      await unlink(partPath)\n    } catch {}\n    throw new Error(`${spec.name} 스트리밍 실패: ${(e as Error).message}`)\n  }\n\n  onProgress?.({\n    spec,\n    downloaded,\n    total,\n    phase: \"verify\",\n  })\n\n  // SHA 검증\n  let actual: string\n  try {\n    actual = await sha256OfFile(partPath)\n  } catch (e) {\n    try {\n      await unlink(partPath)\n    } catch {}\n    throw new Error(`${spec.name} SHA 계산 실패: ${(e as Error).message}`)\n  }\n\n  if (actual !== spec.sha256) {\n    try {\n      await unlink(partPath)\n    } catch {}\n    throw new Error(\n      `${spec.name} SHA256 mismatch: expected ${spec.sha256}, got ${actual} — 모델 URL 이 오염되었거나 전송 중 손상되었습니다.`,\n    )\n  }\n\n  await rename(partPath, localPath)\n  onProgress?.({\n    spec,\n    downloaded,\n    total,\n    phase: \"done\",\n  })\n}\n\nasync function sha256OfFile(p: string): Promise<string> {\n  const h = createHash(\"sha256\")\n  const stream = createReadStream(p)\n  await pipeline(stream, async function* (src) {\n    for await (const chunk of src) {\n      h.update(chunk)\n      // yield 안 함 (소비만)\n    }\n  })\n  return h.digest(\"hex\")\n}\n"]}