kordoc 4.17.1 → 4.17.2

package/dist/{chunk-3M2BMQJY.js → chunk-5JZEY5IL.js}

@@ -1,14 +1,14 @@
 import {
   KordocError
-} from "./chunk-4CSY3QUO.js";
+} from "./chunk-YGKC6E6A.js";
 
 // src/pdf/formula/models.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { createReadStream } from "fs";
-import { mkdir, stat, unlink, rename } from "fs/promises";
+import { mkdir, stat, unlink as unlink2, rename } from "fs/promises";
 import { createWriteStream } from "fs";
 import { homedir } from "os";
-import { join, dirname } from "path";
+import { join as join2, dirname as dirname2 } from "path";
 import { pipeline } from "stream/promises";
 import { Readable } from "stream";
 
@@ -28,6 +28,59 @@ function assertNetworkAllowed(what, hint) {
   );
 }
 
+// src/pdf/formula/model-partials.ts
+import { createHash, randomUUID } from "crypto";
+import { readFileSync, readlinkSync } from "fs";
+import { readdir, unlink } from "fs/promises";
+import { hostname } from "os";
+import { basename, dirname, join } from "path";
+var scope;
+function ownerScope() {
+  if (scope) return scope;
+  let namespace = "";
+  if (process.platform === "linux") {
+    try {
+      const boot = readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      if (!boot) throw new Error("Kernel boot identity unavailable");
+      namespace = `${boot}:${readlinkSync("/proc/self/ns/pid")}`;
+    } catch {
+      namespace = randomUUID();
+    }
+  }
+  scope = createHash("sha256").update(`${process.platform}\0${hostname()}\0${namespace}`).digest("hex").slice(0, 32);
+  return scope;
+}
+function modelDownloadPartialPath(localPath) {
+  return `${localPath}.kordoc-${ownerScope()}-${process.pid}-${randomUUID()}.part`;
+}
+async function cleanupModelDownloadPartials(localPath) {
+  const dir = dirname(localPath);
+  const prefix = `${basename(localPath)}.kordoc-${ownerScope()}-`;
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.startsWith(prefix)) continue;
+    const match = /^([1-9]\d*)-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.part$/.exec(entry.name.slice(prefix.length));
+    if (!match) continue;
+    const pid = Number(match[1]);
+    if (!Number.isSafeInteger(pid) || pid > 2147483647) continue;
+    try {
+      process.kill(pid, 0);
+      continue;
+    } catch (err) {
+      if (err.code !== "ESRCH") continue;
+    }
+    try {
+      await unlink(join(dir, entry.name));
+    } catch {
+    }
+  }
+}
+
 // src/pdf/formula/models.ts
 var MFD_MODEL = {
   name: "Pix2Text MFD",
@@ -66,9 +119,9 @@ var ALL_FORMULA_MODELS = [
 function getModelsDir(subdir) {
   const override = process.env.KORDOC_MODEL_CACHE;
   if (override && override.trim()) {
-    return join(override, subdir);
+    return join2(override, subdir);
   }
-  return join(homedir(), ".cache", "kordoc", "models", subdir);
+  return join2(homedir(), ".cache", "kordoc", "models", subdir);
 }
 function getFormulaModelsDir() {
   return getModelsDir("pix2text");
@@ -76,7 +129,7 @@ function getFormulaModelsDir() {
 async function getModelStatusIn(dir, specs) {
   const result = [];
   for (const spec of specs) {
-    const localPath = join(dir, spec.filename);
+    const localPath = join2(dir, spec.filename);
     let exists = false;
     try {
       const s = await stat(localPath);
@@ -119,7 +172,8 @@ async function getFormulaModelStatus() {
 async function ensureModelsIn(dir, specs, onProgress) {
   await mkdir(dir, { recursive: true });
   for (const spec of specs) {
-    const localPath = join(dir, spec.filename);
+    const localPath = join2(dir, spec.filename);
+    await cleanupModelDownloadPartials(localPath);
     if (await isExistingValid(localPath, spec.sha256)) {
       onProgress?.({
         spec,
@@ -130,10 +184,6 @@ async function ensureModelsIn(dir, specs, onProgress) {
       });
       continue;
     }
-    try {
-      await unlink(localPath);
-    } catch {
-    }
     await downloadToFile(spec, localPath, onProgress);
   }
 }
@@ -143,15 +193,12 @@ async function ensureFormulaModels(onProgress) {
 async function ensureSingleModel(spec, onProgress) {
   const dir = getFormulaModelsDir();
   await mkdir(dir, { recursive: true });
-  const localPath = join(dir, spec.filename);
+  const localPath = join2(dir, spec.filename);
+  await cleanupModelDownloadPartials(localPath);
   if (await isExistingValid(localPath, spec.sha256)) {
     onProgress?.({ spec, downloaded: 0, total: null, phase: "skip" });
     return;
   }
-  try {
-    await unlink(localPath);
-  } catch {
-  }
   await downloadToFile(spec, localPath, onProgress);
 }
 async function isExistingValid(localPath, sha256Expected) {
@@ -173,77 +220,72 @@ async function downloadToFile(spec, localPath, onProgress) {
     `${spec.name} \uBAA8\uB378 \uB2E4\uC6B4\uB85C\uB4DC`,
     "\uC628\uB77C\uC778 PC\uC5D0\uC11C `kordoc models --export <\uB514\uB809\uD1A0\uB9AC>` \uB85C \uB0B4\uBCF4\uB0B8 \uB4A4 \uC774 PC\uC5D0\uC11C `kordoc models --import <\uB514\uB809\uD1A0\uB9AC>` \uD558\uAC70\uB098, KORDOC_MODEL_CACHE \uB85C \uBAA8\uB378 \uCE90\uC2DC \uACBD\uB85C\uB97C \uC9C0\uC815\uD558\uC138\uC694"
   );
-  const partPath = `${localPath}.part`;
-  await mkdir(dirname(localPath), { recursive: true });
-  const resp = await fetch(spec.url, {
-    headers: {
-      // HF CDN 은 UA 없으면 가끔 403 을 뱉는다
-      "User-Agent": "kordoc-formula-ocr/1.0 (+https://github.com/chrisryugj/kordoc)"
-    }
-  });
-  if (!resp.ok || !resp.body) {
-    throw new Error(
-      `${spec.name} \uB2E4\uC6B4\uB85C\uB4DC \uC2E4\uD328: HTTP ${resp.status} ${resp.statusText} (${spec.url})`
-    );
-  }
-  const lenHeader = resp.headers.get("content-length");
-  const total = lenHeader ? Number.parseInt(lenHeader, 10) : null;
-  let downloaded = 0;
-  const ws = createWriteStream(partPath);
+  const partPath = modelDownloadPartialPath(localPath);
+  await mkdir(dirname2(localPath), { recursive: true });
   try {
-    const reader = Readable.fromWeb(resp.body);
-    reader.on("data", (chunk) => {
-      downloaded += chunk.length;
-      onProgress?.({
-        spec,
-        downloaded,
-        total,
-        phase: "download"
-      });
+    const resp = await fetch(spec.url, {
+      headers: {
+        // HF CDN 은 UA 없으면 가끔 403 을 뱉는다
+        "User-Agent": "kordoc-formula-ocr/1.0 (+https://github.com/chrisryugj/kordoc)"
+      }
     });
-    await pipeline(reader, ws);
-  } catch (e) {
+    if (!resp.ok || !resp.body) {
+      throw new Error(
+        `${spec.name} \uB2E4\uC6B4\uB85C\uB4DC \uC2E4\uD328: HTTP ${resp.status} ${resp.statusText} (${spec.url})`
+      );
+    }
+    const lenHeader = resp.headers.get("content-length");
+    const total = lenHeader ? Number.parseInt(lenHeader, 10) : null;
+    let downloaded = 0;
+    const ws = createWriteStream(partPath);
     try {
-      await unlink(partPath);
-    } catch {
+      const reader = Readable.fromWeb(resp.body);
+      reader.on("data", (chunk) => {
+        downloaded += chunk.length;
+        onProgress?.({
+          spec,
+          downloaded,
+          total,
+          phase: "download"
+        });
+      });
+      await pipeline(reader, ws);
+    } catch (e) {
+      throw new Error(`${spec.name} \uC2A4\uD2B8\uB9AC\uBC0D \uC2E4\uD328: ${e.message}`);
     }
-    throw new Error(`${spec.name} \uC2A4\uD2B8\uB9AC\uBC0D \uC2E4\uD328: ${e.message}`);
-  }
-  onProgress?.({
-    spec,
-    downloaded,
-    total,
-    phase: "verify"
-  });
-  let actual;
-  try {
-    actual = await sha256OfFile(partPath);
-  } catch (e) {
+    onProgress?.({
+      spec,
+      downloaded,
+      total,
+      phase: "verify"
+    });
+    let actual;
     try {
-      await unlink(partPath);
-    } catch {
+      actual = await sha256OfFile(partPath);
+    } catch (e) {
+      throw new Error(`${spec.name} SHA \uACC4\uC0B0 \uC2E4\uD328: ${e.message}`);
     }
-    throw new Error(`${spec.name} SHA \uACC4\uC0B0 \uC2E4\uD328: ${e.message}`);
-  }
-  if (actual !== spec.sha256) {
+    if (actual !== spec.sha256) {
+      throw new Error(
+        `${spec.name} SHA256 mismatch: expected ${spec.sha256}, got ${actual} \u2014 \uBAA8\uB378 URL \uC774 \uC624\uC5FC\uB418\uC5C8\uAC70\uB098 \uC804\uC1A1 \uC911 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.`
+      );
+    }
+    await rename(partPath, localPath);
+    onProgress?.({
+      spec,
+      downloaded,
+      total,
+      phase: "done"
+    });
+  } finally {
     try {
-      await unlink(partPath);
+      await unlink2(partPath);
     } catch {
     }
-    throw new Error(
-      `${spec.name} SHA256 mismatch: expected ${spec.sha256}, got ${actual} \u2014 \uBAA8\uB378 URL \uC774 \uC624\uC5FC\uB418\uC5C8\uAC70\uB098 \uC804\uC1A1 \uC911 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.`
-    );
   }
-  await rename(partPath, localPath);
-  onProgress?.({
-    spec,
-    downloaded,
-    total,
-    phase: "done"
-  });
 }
 async function sha256OfFile(p) {
-  const h = createHash("sha256");
+  const h = createHash2("sha256");
   const stream = createReadStream(p);
   await pipeline(stream, async function* (src) {
     for await (const chunk of src) {
@@ -266,4 +308,4 @@ export {
   ensureFormulaModels,
   ensureSingleModel
 };
-//# sourceMappingURL=chunk-3M2BMQJY.js.map
+//# sourceMappingURL=chunk-5JZEY5IL.js.map

package/dist/chunk-5JZEY5IL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/pdf/formula/models.ts","../src/shared/offline.ts","../src/pdf/formula/model-partials.ts"],"sourcesContent":["/**\n * 수식 OCR 모델 자동 다운로드 + SHA-256 검증\n *\n * 캐시 위치: `~/.cache/kordoc/models/pix2text/`\n * 총 ~155MB (MFD 44MB + MFR encoder 87MB + MFR decoder 30MB + tokenizer 40KB)\n *\n * HF URL + SHA 는 Docufinder archive/rust-formula-ocr-wip 에서 검증 완료됨.\n * 모델 버전 갱신 시 URL + SHA 를 함께 갱신해야 한다.\n */\n\nimport { createHash } from \"crypto\"\nimport { createReadStream } from \"fs\"\nimport { mkdir, stat, unlink, rename } from \"fs/promises\"\nimport { createWriteStream } from \"fs\"\nimport { homedir } from \"os\"\nimport { join, dirname } from \"path\"\nimport { pipeline } from \"stream/promises\"\nimport { Readable } from \"stream\"\nimport { assertNetworkAllowed } from \"../../shared/offline.js\"\nimport { cleanupModelDownloadPartials, modelDownloadPartialPath } from \"./model-partials.js\"\n\nexport interface ModelSpec {\n  name: string\n  filename: string\n  url: string\n  sha256: string\n  sizeMb: number\n}\n\n/** 모델 스펙 (SHA-256 은 실제 다운로드로 검증됨 — 변경 금지) */\nexport const MFD_MODEL: ModelSpec = {\n  name: \"Pix2Text MFD\",\n  filename: \"mfd.onnx\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfd/resolve/main/mfd-v20240618.onnx\",\n  sha256: \"51a8854743b17ae654729af8db82a630c1ccfa06debf4856c8b28055f87d02c1\",\n  sizeMb: 42,\n}\n\nexport const MFR_ENCODER_MODEL: ModelSpec = {\n  name: \"Pix2Text MFR encoder\",\n  filename: \"encoder_model.onnx\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/encoder_model.onnx\",\n  sha256: \"bd8d5c322792e9ec45793af5569e9748f82a3d728a9e00213dbfc56c1486f37d\",\n  sizeMb: 87,\n}\n\nexport const MFR_DECODER_MODEL: ModelSpec = {\n  name: \"Pix2Text MFR decoder\",\n  filename: \"decoder_model.onnx\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/decoder_model.onnx\",\n  sha256: \"fd0f92d7a012f3dae41e1ac79421aea0ea888b5a66cb3f9a004e424f82f3daed\",\n  sizeMb: 30,\n}\n\nexport const MFR_TOKENIZER: ModelSpec = {\n  name: \"Pix2Text MFR tokenizer\",\n  filename: \"tokenizer.json\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/tokenizer.json\",\n  sha256: \"3e2ab757277d22639bec28c9d7972e352d3d1dba223051fa674002dc5ab64df3\",\n  sizeMb: 1,\n}\n\nexport const ALL_FORMULA_MODELS: ReadonlyArray<ModelSpec> = [\n  MFD_MODEL,\n  MFR_ENCODER_MODEL,\n  MFR_DECODER_MODEL,\n  MFR_TOKENIZER,\n]\n\n/**\n * 모델 캐시 하위 디렉토리 경로. 환경 변수 `KORDOC_MODEL_CACHE` 가 설정되면\n * 해당 경로를 우선 사용, 없으면 `~/.cache/kordoc/models/<subdir>/`.\n * (수식 OCR 외 텍스트 OCR 등 다른 모델군도 공용 — subdir 로 격리)\n */\nexport function getModelsDir(subdir: string): string {\n  const override = process.env.KORDOC_MODEL_CACHE\n  if (override && override.trim()) {\n    return join(override, subdir)\n  }\n  return join(homedir(), \".cache\", \"kordoc\", \"models\", subdir)\n}\n\nexport function getFormulaModelsDir(): string {\n  return getModelsDir(\"pix2text\")\n}\n\nexport interface ModelStatus {\n  spec: ModelSpec\n  localPath: string\n  exists: boolean\n  /** SHA 검증까지 끝났는가 (exists && valid) */\n  verified: boolean\n  /** 검증 실패 시 이유 */\n  invalidReason?: string\n}\n\n/** 지정 모델군의 존재/유효성 상태 반환 (다운로드 없이 확인만) */\nexport async function getModelStatusIn(dir: string, specs: ReadonlyArray<ModelSpec>): Promise<ModelStatus[]> {\n  const result: ModelStatus[] = []\n  for (const spec of specs) {\n    const localPath = join(dir, spec.filename)\n    let exists = false\n    try {\n      const s = await stat(localPath)\n      exists = s.isFile() && s.size > 0\n    } catch {\n      exists = false\n    }\n    if (!exists) {\n      result.push({ spec, localPath, exists: false, verified: false })\n      continue\n    }\n    try {\n      const actual = await sha256OfFile(localPath)\n      if (actual === spec.sha256) {\n        result.push({ spec, localPath, exists: true, verified: true })\n      } else {\n        result.push({\n          spec,\n          localPath,\n          exists: true,\n          verified: false,\n          invalidReason: `SHA256 mismatch: expected ${spec.sha256}, got ${actual}`,\n        })\n      }\n    } catch (e) {\n      result.push({\n        spec,\n        localPath,\n        exists: true,\n        verified: false,\n        invalidReason: `SHA compute failed: ${(e as Error).message}`,\n      })\n    }\n  }\n  return result\n}\n\n/** 모든 수식 모델의 존재/유효성 상태 반환 (다운로드 없이 확인만) */\nexport async function getFormulaModelStatus(): Promise<ModelStatus[]> {\n  return getModelStatusIn(getFormulaModelsDir(), ALL_FORMULA_MODELS)\n}\n\nexport interface DownloadProgress {\n  spec: ModelSpec\n  /** 현재까지 다운로드한 바이트 */\n  downloaded: number\n  /** 전체 바이트 (알 수 있으면) */\n  total: number | null\n  /** \"download\" | \"verify\" | \"done\" | \"skip\" */\n  phase: \"download\" | \"verify\" | \"done\" | \"skip\" | \"error\"\n  message?: string\n}\n\nexport type ProgressHandler = (p: DownloadProgress) => void\n\n/**\n * 지정 모델군을 다운로드/검증한다.\n * - 이미 있고 SHA 일치 → skip\n * - 없음 → 다운로드 후 SHA 검증. 실패 시 파일 삭제.\n */\nexport async function ensureModelsIn(dir: string, specs: ReadonlyArray<ModelSpec>, onProgress?: ProgressHandler): Promise<void> {\n  await mkdir(dir, { recursive: true })\n\n  for (const spec of specs) {\n    const localPath = join(dir, spec.filename)\n    await cleanupModelDownloadPartials(localPath)\n\n    if (await isExistingValid(localPath, spec.sha256)) {\n      onProgress?.({\n        spec,\n        downloaded: 0,\n        total: null,\n        phase: \"skip\",\n        message: \"이미 존재 + SHA 일치\",\n      })\n      continue\n    }\n\n    // Keep the destination until atomic replacement; another process may have\n    // finished a valid download since our initial check.\n    await downloadToFile(spec, localPath, onProgress)\n  }\n}\n\n/** 필요한 모든 수식 모델을 다운로드/검증한다. */\nexport async function ensureFormulaModels(onProgress?: ProgressHandler): Promise<void> {\n  return ensureModelsIn(getFormulaModelsDir(), ALL_FORMULA_MODELS, onProgress)\n}\n\n/** 단일 모델만 확인/다운로드 (진단 UI 에서 개별 상태 새로고침용) */\nexport async function ensureSingleModel(spec: ModelSpec, onProgress?: ProgressHandler): Promise<void> {\n  const dir = getFormulaModelsDir()\n  await mkdir(dir, { recursive: true })\n  const localPath = join(dir, spec.filename)\n  await cleanupModelDownloadPartials(localPath)\n  if (await isExistingValid(localPath, spec.sha256)) {\n    onProgress?.({ spec, downloaded: 0, total: null, phase: \"skip\" })\n    return\n  }\n  await downloadToFile(spec, localPath, onProgress)\n}\n\nasync function isExistingValid(localPath: string, sha256Expected: string): Promise<boolean> {\n  try {\n    const s = await stat(localPath)\n    if (!s.isFile() || s.size === 0) return false\n  } catch {\n    return false\n  }\n  try {\n    const actual = await sha256OfFile(localPath)\n    return actual === sha256Expected\n  } catch {\n    return false\n  }\n}\n\nasync function downloadToFile(\n  spec: ModelSpec,\n  localPath: string,\n  onProgress?: ProgressHandler,\n): Promise<void> {\n  // 폐쇄망 모드에서는 요청 자체를 보내지 않는다 (사이드로드 안내로 대체)\n  assertNetworkAllowed(\n    `${spec.name} 모델 다운로드`,\n    \"온라인 PC에서 `kordoc models --export <디렉토리>` 로 내보낸 뒤 이 PC에서 `kordoc models --import <디렉토리>` 하거나, KORDOC_MODEL_CACHE 로 모델 캐시 경로를 지정하세요\",\n  )\n\n  // 먼저 .part 로 받고 검증 후 rename — 중단된 다운로드가 \"정상 파일\"로 오인되는 걸 방지\n  // Batch workers may download the same missing model concurrently. Never share\n  // a partial file: only a fully verified download is atomically published.\n  const partPath = modelDownloadPartialPath(localPath)\n  await mkdir(dirname(localPath), { recursive: true })\n\n  try {\n    const resp = await fetch(spec.url, {\n      headers: {\n        // HF CDN 은 UA 없으면 가끔 403 을 뱉는다\n        \"User-Agent\": \"kordoc-formula-ocr/1.0 (+https://github.com/chrisryugj/kordoc)\",\n      },\n    })\n    if (!resp.ok || !resp.body) {\n      throw new Error(\n        `${spec.name} 다운로드 실패: HTTP ${resp.status} ${resp.statusText} (${spec.url})`,\n      )\n    }\n\n    const lenHeader = resp.headers.get(\"content-length\")\n    const total = lenHeader ? Number.parseInt(lenHeader, 10) : null\n    let downloaded = 0\n\n    const ws = createWriteStream(partPath)\n    try {\n      const reader = Readable.fromWeb(resp.body as unknown as import(\"stream/web\").ReadableStream)\n      reader.on(\"data\", (chunk: Buffer | Uint8Array) => {\n        downloaded += chunk.length\n        onProgress?.({\n          spec,\n          downloaded,\n          total,\n          phase: \"download\",\n        })\n      })\n      await pipeline(reader, ws)\n    } catch (e) {\n      throw new Error(`${spec.name} 스트리밍 실패: ${(e as Error).message}`)\n    }\n\n    onProgress?.({\n      spec,\n      downloaded,\n      total,\n      phase: \"verify\",\n    })\n\n    // SHA 검증\n    let actual: string\n    try {\n      actual = await sha256OfFile(partPath)\n    } catch (e) {\n      throw new Error(`${spec.name} SHA 계산 실패: ${(e as Error).message}`)\n    }\n\n    if (actual !== spec.sha256) {\n      throw new Error(\n        `${spec.name} SHA256 mismatch: expected ${spec.sha256}, got ${actual} — 모델 URL 이 오염되었거나 전송 중 손상되었습니다.`,\n      )\n    }\n\n    await rename(partPath, localPath)\n    onProgress?.({\n      spec,\n      downloaded,\n      total,\n      phase: \"done\",\n    })\n  } finally {\n    // Successful rename already removed this path. Process termination bypasses\n    // finally; the next ensure call reclaims it only after proving the owner dead.\n    try { await unlink(partPath) } catch { /* Preserve the original outcome. */ }\n  }\n}\n\nasync function sha256OfFile(p: string): Promise<string> {\n  const h = createHash(\"sha256\")\n  const stream = createReadStream(p)\n  await pipeline(stream, async function* (src) {\n    for await (const chunk of src) {\n      h.update(chunk)\n      // yield 안 함 (소비만)\n    }\n  })\n  return h.digest(\"hex\")\n}\n","/**\n * 폐쇄망(내부망) 배포용 아웃바운드 통신 킬스위치 + 파일 접근 루트 제한.\n *\n * kordoc 자체는 문서 파서라 상시 외부 통신이 없지만, 두 경로만 나간다:\n *   1. OCR/수식 모델 최초 1회 다운로드 (huggingface.co)\n *   2. `kordoc watch --webhook` 사용자가 명시한 URL\n *\n * `KORDOC_OFFLINE=1` 이면 위 경로를 **시도 전에** 차단한다. 보안성 검토에서\n * \"외부 통신 없음\"을 런타임으로 증명하기 위한 단일 관문 — 새 아웃바운드 경로를\n * 추가하면 반드시 `assertNetworkAllowed()` 를 먼저 통과시킬 것.\n *\n * `KORDOC_ROOT` 는 파일 접근을 특정 디렉토리 하위로 제한한다(미설정 시 제한 없음 —\n * 기존 동작 보존). 내부망 배포에서는 두 변수를 함께 고정하는 것을 권장.\n */\n\nimport { realpathSync } from \"fs\"\nimport { isAbsolute, relative, resolve, sep } from \"path\"\nimport { KordocError } from \"../utils.js\"\n\nconst TRUTHY = new Set([\"1\", \"true\", \"yes\", \"on\"])\n\nfunction envFlag(name: string): boolean {\n  const v = process.env[name]\n  return !!v && TRUTHY.has(v.trim().toLowerCase())\n}\n\n/** 폐쇄망 모드 여부 (`KORDOC_OFFLINE=1|true|yes|on`) */\nexport function isOfflineMode(): boolean {\n  return envFlag(\"KORDOC_OFFLINE\")\n}\n\n/**\n * 아웃바운드 통신 관문. 폐쇄망 모드면 요청을 보내기 전에 예외로 끊는다.\n * @param what 차단 대상 설명 (사용자에게 노출됨 — 호스트/URL 은 넣지 말 것)\n * @param hint 대안 안내 (오프라인 사이드로드 방법 등)\n */\nexport function assertNetworkAllowed(what: string, hint?: string): void {\n  if (!isOfflineMode()) return\n  throw new KordocError(\n    `폐쇄망 모드(KORDOC_OFFLINE)에서 차단됨: ${what}` + (hint ? ` — ${hint}` : \"\"),\n  )\n}\n\n/** 파일 접근 루트 (`KORDOC_ROOT`). 미설정이면 null = 제한 없음 */\nexport function getAccessRoot(): string | null {\n  const raw = process.env.KORDOC_ROOT\n  if (!raw || !raw.trim()) return null\n  const resolved = resolve(raw.trim())\n  try {\n    return realpathSync(resolved)\n  } catch {\n    // 루트가 실재하지 않으면 모든 접근이 막히는 게 안전한 기본값\n    return resolved\n  }\n}\n\n/** 경로가 루트 하위인지 (루트 자신 포함). 경계 문자열 매칭이 아닌 세그먼트 단위 비교 */\nexport function isWithinRoot(realPath: string, root: string): boolean {\n  if (realPath === root) return true\n  const rel = relative(root, realPath)\n  return rel !== \"\" && !rel.startsWith(\"..\") && !isAbsolute(rel) && !rel.startsWith(`..${sep}`)\n}\n\n/**\n * `KORDOC_ROOT` 가 설정된 경우 경로가 루트 하위인지 검증한다.\n * 인자는 이미 realpath 로 해석된 절대경로여야 한다 (심볼릭 링크 탈출 방지).\n */\nexport function assertWithinRoot(realPath: string): void {\n  const root = getAccessRoot()\n  if (!root) return\n  if (!isWithinRoot(realPath, root)) {\n    throw new KordocError(`허용된 작업 디렉토리(KORDOC_ROOT) 밖의 경로입니다: ${realPath}`)\n  }\n}\n","/** Process-owned temporary model downloads. Never infer abandonment from age alone. */\nimport { createHash, randomUUID } from \"node:crypto\"\nimport { readFileSync, readlinkSync } from \"node:fs\"\nimport { readdir, unlink } from \"node:fs/promises\"\nimport { hostname } from \"node:os\"\nimport { basename, dirname, join } from \"node:path\"\n\nlet scope: string | undefined\nfunction ownerScope(): string {\n  if (scope) return scope\n  let namespace = \"\"\n  if (process.platform === \"linux\") {\n    try {\n      // A cache may be shared by containers whose PID spaces differ. A missing\n      // PID in this namespace says nothing about a download in another one.\n      // Boot identity also separates machines with matching hostnames/ns inodes.\n      const boot = readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim()\n      if (!boot) throw new Error(\"Kernel boot identity unavailable\")\n      namespace = `${boot}:${readlinkSync(\"/proc/self/ns/pid\")}`\n    } catch {\n      // Fail closed if namespace identity is unavailable: only this process can\n      // recognize its own paths; it will not scavenge another process's files.\n      namespace = randomUUID()\n    }\n  }\n  scope = createHash(\"sha256\").update(`${process.platform}\\0${hostname()}\\0${namespace}`).digest(\"hex\").slice(0, 32)\n  return scope\n}\n\nexport function modelDownloadPartialPath(localPath: string): string {\n  return `${localPath}.kordoc-${ownerScope()}-${process.pid}-${randomUUID()}.part`\n}\n\n/** Best effort: cache maintenance must not prevent use of a valid model. */\nexport async function cleanupModelDownloadPartials(localPath: string): Promise<void> {\n  const dir = dirname(localPath)\n  const prefix = `${basename(localPath)}.kordoc-${ownerScope()}-`\n  let entries\n  try { entries = await readdir(dir, { withFileTypes: true }) } catch { return }\n  for (const entry of entries) {\n    // Do not follow symlinks, touch other models, or guess ownership for old\n    // UUID-only partials/foreign hosts/namespaces. Their owner could still be live.\n    if (!entry.isFile() || !entry.name.startsWith(prefix)) continue\n    const match = /^([1-9]\\d*)-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\\.part$/.exec(entry.name.slice(prefix.length))\n    if (!match) continue\n    const pid = Number(match[1])\n    if (!Number.isSafeInteger(pid) || pid > 0x7fffffff) continue\n    try {\n      process.kill(pid, 0)\n      continue // Includes a reused PID: retaining an orphan beats deleting live data.\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"ESRCH\") continue // EPERM/unknown = potentially live.\n    }\n    try { await unlink(join(dir, entry.name)) } catch { /* Another cleaner may have won. */ }\n  }\n}\n"],"mappings":";;;;;AAUA,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,wBAAwB;AACjC,SAAS,OAAO,MAAM,UAAAC,SAAQ,cAAc;AAC5C,SAAS,yBAAyB;AAClC,SAAS,eAAe;AACxB,SAAS,QAAAC,OAAM,WAAAC,gBAAe;AAC9B,SAAS,gBAAgB;AACzB,SAAS,gBAAgB;;;ACEzB,IAAM,SAAS,oBAAI,IAAI,CAAC,KAAK,QAAQ,OAAO,IAAI,CAAC;AAEjD,SAAS,QAAQ,MAAuB;AACtC,QAAM,IAAI,QAAQ,IAAI,IAAI;AAC1B,SAAO,CAAC,CAAC,KAAK,OAAO,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC;AACjD;AAGO,SAAS,gBAAyB;AACvC,SAAO,QAAQ,gBAAgB;AACjC;AAOO,SAAS,qBAAqB,MAAc,MAAqB;AACtE,MAAI,CAAC,cAAc,EAAG;AACtB,QAAM,IAAI;AAAA,IACR,mFAAiC,IAAI,MAAM,OAAO,WAAM,IAAI,KAAK;AAAA,EACnE;AACF;;;ACxCA,SAAS,YAAY,kBAAkB;AACvC,SAAS,cAAc,oBAAoB;AAC3C,SAAS,SAAS,cAAc;AAChC,SAAS,gBAAgB;AACzB,SAAS,UAAU,SAAS,YAAY;AAExC,IAAI;AACJ,SAAS,aAAqB;AAC5B,MAAI,MAAO,QAAO;AAClB,MAAI,YAAY;AAChB,MAAI,QAAQ,aAAa,SAAS;AAChC,QAAI;AAIF,YAAM,OAAO,aAAa,mCAAmC,MAAM,EAAE,KAAK;AAC1E,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kCAAkC;AAC7D,kBAAY,GAAG,IAAI,IAAI,aAAa,mBAAmB,CAAC;AAAA,IAC1D,QAAQ;AAGN,kBAAY,WAAW;AAAA,IACzB;AAAA,EACF;AACA,UAAQ,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,QAAQ,KAAK,SAAS,CAAC,KAAK,SAAS,EAAE,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACjH,SAAO;AACT;AAEO,SAAS,yBAAyB,WAA2B;AAClE,SAAO,GAAG,SAAS,WAAW,WAAW,CAAC,IAAI,QAAQ,GAAG,IAAI,WAAW,CAAC;AAC3E;AAGA,eAAsB,6BAA6B,WAAkC;AACnF,QAAM,MAAM,QAAQ,SAAS;AAC7B,QAAM,SAAS,GAAG,SAAS,SAAS,CAAC,WAAW,WAAW,CAAC;AAC5D,MAAI;AACJ,MAAI;AAAE,cAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,EAAE,QAAQ;AAAE;AAAA,EAAO;AAC7E,aAAW,SAAS,SAAS;AAG3B,QAAI,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,KAAK,WAAW,MAAM,EAAG;AACvD,UAAM,QAAQ,oFAAoF,KAAK,MAAM,KAAK,MAAM,OAAO,MAAM,CAAC;AACtI,QAAI,CAAC,MAAO;AACZ,UAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,QAAI,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,WAAY;AACpD,QAAI;AACF,cAAQ,KAAK,KAAK,CAAC;AACnB;AAAA,IACF,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,QAAS;AAAA,IACvD;AACA,QAAI;AAAE,YAAM,OAAO,KAAK,KAAK,MAAM,IAAI,CAAC;AAAA,IAAE,QAAQ;AAAA,IAAsC;AAAA,EAC1F;AACF;;;AFzBO,IAAM,YAAuB;AAAA,EAClC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,IAAM,oBAA+B;AAAA,EAC1C,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,IAAM,oBAA+B;AAAA,EAC1C,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,IAAM,gBAA2B;AAAA,EACtC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,IAAM,qBAA+C;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,SAAS,aAAa,QAAwB;AACnD,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,YAAY,SAAS,KAAK,GAAG;AAC/B,WAAOC,MAAK,UAAU,MAAM;AAAA,EAC9B;AACA,SAAOA,MAAK,QAAQ,GAAG,UAAU,UAAU,UAAU,MAAM;AAC7D;AAEO,SAAS,sBAA8B;AAC5C,SAAO,aAAa,UAAU;AAChC;AAaA,eAAsB,iBAAiB,KAAa,OAAyD;AAC3G,QAAM,SAAwB,CAAC;AAC/B,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAYA,MAAK,KAAK,KAAK,QAAQ;AACzC,QAAI,SAAS;AACb,QAAI;AACF,YAAM,IAAI,MAAM,KAAK,SAAS;AAC9B,eAAS,EAAE,OAAO,KAAK,EAAE,OAAO;AAAA,IAClC,QAAQ;AACN,eAAS;AAAA,IACX;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,KAAK,EAAE,MAAM,WAAW,QAAQ,OAAO,UAAU,MAAM,CAAC;AAC/D;AAAA,IACF;AACA,QAAI;AACF,YAAM,SAAS,MAAM,aAAa,SAAS;AAC3C,UAAI,WAAW,KAAK,QAAQ;AAC1B,eAAO,KAAK,EAAE,MAAM,WAAW,QAAQ,MAAM,UAAU,KAAK,CAAC;AAAA,MAC/D,OAAO;AACL,eAAO,KAAK;AAAA,UACV;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,eAAe,6BAA6B,KAAK,MAAM,SAAS,MAAM;AAAA,QACxE,CAAC;AAAA,MACH;AAAA,IACF,SAAS,GAAG;AACV,aAAO,KAAK;AAAA,QACV;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe,uBAAwB,EAAY,OAAO;AAAA,MAC5D,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAsB,wBAAgD;AACpE,SAAO,iBAAiB,oBAAoB,GAAG,kBAAkB;AACnE;AAoBA,eAAsB,eAAe,KAAa,OAAiC,YAA6C;AAC9H,QAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAEpC,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAYA,MAAK,KAAK,KAAK,QAAQ;AACzC,UAAM,6BAA6B,SAAS;AAE5C,QAAI,MAAM,gBAAgB,WAAW,KAAK,MAAM,GAAG;AACjD,mBAAa;AAAA,QACX;AAAA,QACA,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,OAAO;AAAA,QACP,SAAS;AAAA,MACX,CAAC;AACD;AAAA,IACF;AAIA,UAAM,eAAe,MAAM,WAAW,UAAU;AAAA,EAClD;AACF;AAGA,eAAsB,oBAAoB,YAA6C;AACrF,SAAO,eAAe,oBAAoB,GAAG,oBAAoB,UAAU;AAC7E;AAGA,eAAsB,kBAAkB,MAAiB,YAA6C;AACpG,QAAM,MAAM,oBAAoB;AAChC,QAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACpC,QAAM,YAAYA,MAAK,KAAK,KAAK,QAAQ;AACzC,QAAM,6BAA6B,SAAS;AAC5C,MAAI,MAAM,gBAAgB,WAAW,KAAK,MAAM,GAAG;AACjD,iBAAa,EAAE,MAAM,YAAY,GAAG,OAAO,MAAM,OAAO,OAAO,CAAC;AAChE;AAAA,EACF;AACA,QAAM,eAAe,MAAM,WAAW,UAAU;AAClD;AAEA,eAAe,gBAAgB,WAAmB,gBAA0C;AAC1F,MAAI;AACF,UAAM,IAAI,MAAM,KAAK,SAAS;AAC9B,QAAI,CAAC,EAAE,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,SAAS;AAC3C,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,eACb,MACA,WACA,YACe;AAEf;AAAA,IACE,GAAG,KAAK,IAAI;AAAA,IACZ;AAAA,EACF;AAKA,QAAM,WAAW,yBAAyB,SAAS;AACnD,QAAM,MAAMC,SAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAEnD,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,KAAK,KAAK;AAAA,MACjC,SAAS;AAAA;AAAA,QAEP,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,MAAM;AAC1B,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,IAAI,gDAAkB,KAAK,MAAM,IAAI,KAAK,UAAU,KAAK,KAAK,GAAG;AAAA,MAC3E;AAAA,IACF;AAEA,UAAM,YAAY,KAAK,QAAQ,IAAI,gBAAgB;AACnD,UAAM,QAAQ,YAAY,OAAO,SAAS,WAAW,EAAE,IAAI;AAC3D,QAAI,aAAa;AAEjB,UAAM,KAAK,kBAAkB,QAAQ;AACrC,QAAI;AACF,YAAM,SAAS,SAAS,QAAQ,KAAK,IAAsD;AAC3F,aAAO,GAAG,QAAQ,CAAC,UAA+B;AAChD,sBAAc,MAAM;AACpB,qBAAa;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AACD,YAAM,SAAS,QAAQ,EAAE;AAAA,IAC3B,SAAS,GAAG;AACV,YAAM,IAAI,MAAM,GAAG,KAAK,IAAI,2CAAc,EAAY,OAAO,EAAE;AAAA,IACjE;AAEA,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAGD,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,aAAa,QAAQ;AAAA,IACtC,SAAS,GAAG;AACV,YAAM,IAAI,MAAM,GAAG,KAAK,IAAI,mCAAgB,EAAY,OAAO,EAAE;AAAA,IACnE;AAEA,QAAI,WAAW,KAAK,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,IAAI,8BAA8B,KAAK,MAAM,SAAS,MAAM;AAAA,MACtE;AAAA,IACF;AAEA,UAAM,OAAO,UAAU,SAAS;AAChC,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH,UAAE;AAGA,QAAI;AAAE,YAAMC,QAAO,QAAQ;AAAA,IAAE,QAAQ;AAAA,IAAuC;AAAA,EAC9E;AACF;AAEA,eAAe,aAAa,GAA4B;AACtD,QAAM,IAAIC,YAAW,QAAQ;AAC7B,QAAM,SAAS,iBAAiB,CAAC;AACjC,QAAM,SAAS,QAAQ,iBAAiB,KAAK;AAC3C,qBAAiB,SAAS,KAAK;AAC7B,QAAE,OAAO,KAAK;AAAA,IAEhB;AAAA,EACF,CAAC;AACD,SAAO,EAAE,OAAO,KAAK;AACvB;","names":["createHash","unlink","join","dirname","join","dirname","unlink","createHash"]}

package/dist/{chunk-5FCLQVT5.cjs → chunk-6DOCSYEM.cjs}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkGRHSVGSBcjs = require('./chunk-GRHSVGSB.cjs');
+var _chunkKZVQK5NScjs = require('./chunk-KZVQK5NS.cjs');
 
 // src/pdf/formula/models.ts
 var _crypto = require('crypto');
@@ -23,11 +23,64 @@ function isOfflineMode() {
 }
 function assertNetworkAllowed(what, hint) {
   if (!isOfflineMode()) return;
-  throw new (0, _chunkGRHSVGSBcjs.KordocError)(
+  throw new (0, _chunkKZVQK5NScjs.KordocError)(
     `\uD3D0\uC1C4\uB9DD \uBAA8\uB4DC(KORDOC_OFFLINE)\uC5D0\uC11C \uCC28\uB2E8\uB428: ${what}` + (hint ? ` \u2014 ${hint}` : "")
   );
 }
 
+// src/pdf/formula/model-partials.ts
+
+
+
+
+
+var scope;
+function ownerScope() {
+  if (scope) return scope;
+  let namespace = "";
+  if (process.platform === "linux") {
+    try {
+      const boot = _fs.readFileSync.call(void 0, "/proc/sys/kernel/random/boot_id", "utf8").trim();
+      if (!boot) throw new Error("Kernel boot identity unavailable");
+      namespace = `${boot}:${_fs.readlinkSync.call(void 0, "/proc/self/ns/pid")}`;
+    } catch (e2) {
+      namespace = _crypto.randomUUID.call(void 0, );
+    }
+  }
+  scope = _crypto.createHash.call(void 0, "sha256").update(`${process.platform}\0${_os.hostname.call(void 0, )}\0${namespace}`).digest("hex").slice(0, 32);
+  return scope;
+}
+function modelDownloadPartialPath(localPath) {
+  return `${localPath}.kordoc-${ownerScope()}-${process.pid}-${_crypto.randomUUID.call(void 0, )}.part`;
+}
+async function cleanupModelDownloadPartials(localPath) {
+  const dir = _path.dirname.call(void 0, localPath);
+  const prefix = `${_path.basename.call(void 0, localPath)}.kordoc-${ownerScope()}-`;
+  let entries;
+  try {
+    entries = await _promises.readdir.call(void 0, dir, { withFileTypes: true });
+  } catch (e3) {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.startsWith(prefix)) continue;
+    const match = /^([1-9]\d*)-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.part$/.exec(entry.name.slice(prefix.length));
+    if (!match) continue;
+    const pid = Number(match[1]);
+    if (!Number.isSafeInteger(pid) || pid > 2147483647) continue;
+    try {
+      process.kill(pid, 0);
+      continue;
+    } catch (err) {
+      if (err.code !== "ESRCH") continue;
+    }
+    try {
+      await _promises.unlink.call(void 0, _path.join.call(void 0, dir, entry.name));
+    } catch (e4) {
+    }
+  }
+}
+
 // src/pdf/formula/models.ts
 var MFD_MODEL = {
   name: "Pix2Text MFD",
@@ -81,7 +134,7 @@ async function getModelStatusIn(dir, specs) {
     try {
       const s = await _promises.stat.call(void 0, localPath);
       exists = s.isFile() && s.size > 0;
-    } catch (e2) {
+    } catch (e5) {
       exists = false;
     }
     if (!exists) {
@@ -120,6 +173,7 @@ async function ensureModelsIn(dir, specs, onProgress) {
   await _promises.mkdir.call(void 0, dir, { recursive: true });
   for (const spec of specs) {
     const localPath = _path.join.call(void 0, dir, spec.filename);
+    await cleanupModelDownloadPartials(localPath);
     if (await isExistingValid(localPath, spec.sha256)) {
       _optionalChain([onProgress, 'optionalCall', _ => _({
         spec,
@@ -130,10 +184,6 @@ async function ensureModelsIn(dir, specs, onProgress) {
       })]);
       continue;
     }
-    try {
-      await _promises.unlink.call(void 0, localPath);
-    } catch (e3) {
-    }
     await downloadToFile(spec, localPath, onProgress);
   }
 }
@@ -144,27 +194,24 @@ async function ensureSingleModel(spec, onProgress) {
   const dir = getFormulaModelsDir();
   await _promises.mkdir.call(void 0, dir, { recursive: true });
   const localPath = _path.join.call(void 0, dir, spec.filename);
+  await cleanupModelDownloadPartials(localPath);
   if (await isExistingValid(localPath, spec.sha256)) {
     _optionalChain([onProgress, 'optionalCall', _2 => _2({ spec, downloaded: 0, total: null, phase: "skip" })]);
     return;
   }
-  try {
-    await _promises.unlink.call(void 0, localPath);
-  } catch (e4) {
-  }
   await downloadToFile(spec, localPath, onProgress);
 }
 async function isExistingValid(localPath, sha256Expected) {
   try {
     const s = await _promises.stat.call(void 0, localPath);
     if (!s.isFile() || s.size === 0) return false;
-  } catch (e5) {
+  } catch (e6) {
     return false;
   }
   try {
     const actual = await sha256OfFile(localPath);
     return actual === sha256Expected;
-  } catch (e6) {
+  } catch (e7) {
     return false;
   }
 }
@@ -173,74 +220,69 @@ async function downloadToFile(spec, localPath, onProgress) {
     `${spec.name} \uBAA8\uB378 \uB2E4\uC6B4\uB85C\uB4DC`,
     "\uC628\uB77C\uC778 PC\uC5D0\uC11C `kordoc models --export <\uB514\uB809\uD1A0\uB9AC>` \uB85C \uB0B4\uBCF4\uB0B8 \uB4A4 \uC774 PC\uC5D0\uC11C `kordoc models --import <\uB514\uB809\uD1A0\uB9AC>` \uD558\uAC70\uB098, KORDOC_MODEL_CACHE \uB85C \uBAA8\uB378 \uCE90\uC2DC \uACBD\uB85C\uB97C \uC9C0\uC815\uD558\uC138\uC694"
   );
-  const partPath = `${localPath}.part`;
+  const partPath = modelDownloadPartialPath(localPath);
   await _promises.mkdir.call(void 0, _path.dirname.call(void 0, localPath), { recursive: true });
-  const resp = await fetch(spec.url, {
-    headers: {
-      // HF CDN 은 UA 없으면 가끔 403 을 뱉는다
-      "User-Agent": "kordoc-formula-ocr/1.0 (+https://github.com/chrisryugj/kordoc)"
-    }
-  });
-  if (!resp.ok || !resp.body) {
-    throw new Error(
-      `${spec.name} \uB2E4\uC6B4\uB85C\uB4DC \uC2E4\uD328: HTTP ${resp.status} ${resp.statusText} (${spec.url})`
-    );
-  }
-  const lenHeader = resp.headers.get("content-length");
-  const total = lenHeader ? Number.parseInt(lenHeader, 10) : null;
-  let downloaded = 0;
-  const ws = _fs.createWriteStream.call(void 0, partPath);
   try {
-    const reader = _stream.Readable.fromWeb(resp.body);
-    reader.on("data", (chunk) => {
-      downloaded += chunk.length;
-      _optionalChain([onProgress, 'optionalCall', _3 => _3({
-        spec,
-        downloaded,
-        total,
-        phase: "download"
-      })]);
+    const resp = await fetch(spec.url, {
+      headers: {
+        // HF CDN 은 UA 없으면 가끔 403 을 뱉는다
+        "User-Agent": "kordoc-formula-ocr/1.0 (+https://github.com/chrisryugj/kordoc)"
+      }
     });
-    await _promises3.pipeline.call(void 0, reader, ws);
-  } catch (e) {
+    if (!resp.ok || !resp.body) {
+      throw new Error(
+        `${spec.name} \uB2E4\uC6B4\uB85C\uB4DC \uC2E4\uD328: HTTP ${resp.status} ${resp.statusText} (${spec.url})`
+      );
+    }
+    const lenHeader = resp.headers.get("content-length");
+    const total = lenHeader ? Number.parseInt(lenHeader, 10) : null;
+    let downloaded = 0;
+    const ws = _fs.createWriteStream.call(void 0, partPath);
     try {
-      await _promises.unlink.call(void 0, partPath);
-    } catch (e7) {
+      const reader = _stream.Readable.fromWeb(resp.body);
+      reader.on("data", (chunk) => {
+        downloaded += chunk.length;
+        _optionalChain([onProgress, 'optionalCall', _3 => _3({
+          spec,
+          downloaded,
+          total,
+          phase: "download"
+        })]);
+      });
+      await _promises3.pipeline.call(void 0, reader, ws);
+    } catch (e) {
+      throw new Error(`${spec.name} \uC2A4\uD2B8\uB9AC\uBC0D \uC2E4\uD328: ${e.message}`);
     }
-    throw new Error(`${spec.name} \uC2A4\uD2B8\uB9AC\uBC0D \uC2E4\uD328: ${e.message}`);
-  }
-  _optionalChain([onProgress, 'optionalCall', _4 => _4({
-    spec,
-    downloaded,
-    total,
-    phase: "verify"
-  })]);
-  let actual;
-  try {
-    actual = await sha256OfFile(partPath);
-  } catch (e) {
+    _optionalChain([onProgress, 'optionalCall', _4 => _4({
+      spec,
+      downloaded,
+      total,
+      phase: "verify"
+    })]);
+    let actual;
     try {
-      await _promises.unlink.call(void 0, partPath);
-    } catch (e8) {
+      actual = await sha256OfFile(partPath);
+    } catch (e) {
+      throw new Error(`${spec.name} SHA \uACC4\uC0B0 \uC2E4\uD328: ${e.message}`);
     }
-    throw new Error(`${spec.name} SHA \uACC4\uC0B0 \uC2E4\uD328: ${e.message}`);
-  }
-  if (actual !== spec.sha256) {
+    if (actual !== spec.sha256) {
+      throw new Error(
+        `${spec.name} SHA256 mismatch: expected ${spec.sha256}, got ${actual} \u2014 \uBAA8\uB378 URL \uC774 \uC624\uC5FC\uB418\uC5C8\uAC70\uB098 \uC804\uC1A1 \uC911 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.`
+      );
+    }
+    await _promises.rename.call(void 0, partPath, localPath);
+    _optionalChain([onProgress, 'optionalCall', _5 => _5({
+      spec,
+      downloaded,
+      total,
+      phase: "done"
+    })]);
+  } finally {
     try {
       await _promises.unlink.call(void 0, partPath);
-    } catch (e9) {
+    } catch (e8) {
     }
-    throw new Error(
-      `${spec.name} SHA256 mismatch: expected ${spec.sha256}, got ${actual} \u2014 \uBAA8\uB378 URL \uC774 \uC624\uC5FC\uB418\uC5C8\uAC70\uB098 \uC804\uC1A1 \uC911 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.`
-    );
   }
-  await _promises.rename.call(void 0, partPath, localPath);
-  _optionalChain([onProgress, 'optionalCall', _5 => _5({
-    spec,
-    downloaded,
-    total,
-    phase: "done"
-  })]);
 }
 async function sha256OfFile(p) {
   const h = _crypto.createHash.call(void 0, "sha256");
@@ -266,4 +308,4 @@ async function sha256OfFile(p) {
 
 
 exports.MFD_MODEL = MFD_MODEL; exports.MFR_ENCODER_MODEL = MFR_ENCODER_MODEL; exports.MFR_DECODER_MODEL = MFR_DECODER_MODEL; exports.MFR_TOKENIZER = MFR_TOKENIZER; exports.ALL_FORMULA_MODELS = ALL_FORMULA_MODELS; exports.getModelsDir = getModelsDir; exports.getFormulaModelsDir = getFormulaModelsDir; exports.getFormulaModelStatus = getFormulaModelStatus; exports.ensureModelsIn = ensureModelsIn; exports.ensureFormulaModels = ensureFormulaModels; exports.ensureSingleModel = ensureSingleModel;
-//# sourceMappingURL=chunk-5FCLQVT5.cjs.map
+//# sourceMappingURL=chunk-6DOCSYEM.cjs.map

package/dist/chunk-6DOCSYEM.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/mong-e/workspace/kordoc-quality-99/dist/chunk-6DOCSYEM.cjs","../src/pdf/formula/models.ts","../src/shared/offline.ts","../src/pdf/formula/model-partials.ts"],"names":[],"mappings":"AAAA;AACE;AACF,wDAA6B;AAC7B;AACA;ACMA,gCAA2B;AAC3B,wBAAiC;AACjC,uCAA4C;AAC5C;AACA,wBAAwB;AACxB,4BAA8B;AAC9B,4CAAyB;AACzB,gCAAyB;ADJzB;AACA;AEKA,IAAM,OAAA,kBAAS,IAAI,GAAA,CAAI,CAAC,GAAA,EAAK,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAC,CAAA;AAEjD,SAAS,OAAA,CAAQ,IAAA,EAAuB;AACtC,EAAA,MAAM,EAAA,EAAI,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAC1B,EAAA,OAAO,CAAC,CAAC,EAAA,GAAK,MAAA,CAAO,GAAA,CAAI,CAAA,CAAE,IAAA,CAAK,CAAA,CAAE,WAAA,CAAY,CAAC,CAAA;AACjD;AAGO,SAAS,aAAA,CAAA,EAAyB;AACvC,EAAA,OAAO,OAAA,CAAQ,gBAAgB,CAAA;AACjC;AAOO,SAAS,oBAAA,CAAqB,IAAA,EAAc,IAAA,EAAqB;AACtE,EAAA,GAAA,CAAI,CAAC,aAAA,CAAc,CAAA,EAAG,MAAA;AACtB,EAAA,MAAM,IAAI,kCAAA;AAAA,IACR,CAAA,gFAAA,EAAiC,IAAI,CAAA,EAAA;AACvC,EAAA;AACF;AFZ4F;AACA;AG7BrD;AACI;AACX;AACP;AACe;AAEpC;AAC0B;AACV,EAAA;AACF,EAAA;AACkB,EAAA;AAC5B,IAAA;AAIwE,MAAA;AACb,MAAA;AACL,MAAA;AAClD,IAAA;AAGiB,MAAA;AACzB,IAAA;AACF,EAAA;AACwF,EAAA;AACjF,EAAA;AACT;AAEoE;AACO,EAAA;AAC3E;AAGqF;AACtD,EAAA;AAC+B,EAAA;AACxD,EAAA;AACA,EAAA;AAAsD,IAAA;AAAU,EAAA;AAAE,IAAA;AAAO,EAAA;AAChD,EAAA;AAG4B,IAAA;AACzC,IAAA;AACF,IAAA;AACe,IAAA;AACyB,IAAA;AAChD,IAAA;AACiB,MAAA;AACnB,MAAA;AACY,IAAA;AACyC,MAAA;AACvD,IAAA;AACI,IAAA;AAAoC,MAAA;AAAU,IAAA;AAAsC,IAAA;AAC1F,EAAA;AACF;AH2B4F;AACA;ACrDxD;AAC5B,EAAA;AACI,EAAA;AACL,EAAA;AACG,EAAA;AACA,EAAA;AACV;AAE4C;AACpC,EAAA;AACI,EAAA;AACL,EAAA;AACG,EAAA;AACA,EAAA;AACV;AAE4C;AACpC,EAAA;AACI,EAAA;AACL,EAAA;AACG,EAAA;AACA,EAAA;AACV;AAEwC;AAChC,EAAA;AACI,EAAA;AACL,EAAA;AACG,EAAA;AACA,EAAA;AACV;AAE4D;AAC1D,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACF;AAOqD;AACtB,EAAA;AACI,EAAA;AACH,IAAA;AAC9B,EAAA;AAC2D,EAAA;AAC7D;AAE8C;AACd,EAAA;AAChC;AAa6G;AAC5E,EAAA;AACL,EAAA;AACiB,IAAA;AAC5B,IAAA;AACT,IAAA;AAC4B,MAAA;AACE,MAAA;AAC1B,IAAA;AACG,MAAA;AACX,IAAA;AACa,IAAA;AACoD,MAAA;AAC/D,MAAA;AACF,IAAA;AACI,IAAA;AACyC,MAAA;AACf,MAAA;AACmC,QAAA;AACxD,MAAA;AACO,QAAA;AACV,UAAA;AACA,UAAA;AACQ,UAAA;AACE,UAAA;AAC4D,UAAA;AACvE,QAAA;AACH,MAAA;AACU,IAAA;AACE,MAAA;AACV,QAAA;AACA,QAAA;AACQ,QAAA;AACE,QAAA;AACgD,QAAA;AAC3D,MAAA;AACH,IAAA;AACF,EAAA;AACO,EAAA;AACT;AAGsE;AACH,EAAA;AACnE;AAoBgI;AAC1F,EAAA;AAEV,EAAA;AACiB,IAAA;AACG,IAAA;AAEO,IAAA;AACpC,sBAAA;AACX,QAAA;AACY,QAAA;AACL,QAAA;AACA,QAAA;AACE,QAAA;AACV,MAAA;AACD,MAAA;AACF,IAAA;AAIgD,IAAA;AAClD,EAAA;AACF;AAGuF;AACV,EAAA;AAC7E;AAGsG;AACpE,EAAA;AACI,EAAA;AACK,EAAA;AACG,EAAA;AACO,EAAA;AACe,oBAAA;AAChE,IAAA;AACF,EAAA;AACgD,EAAA;AAClD;AAE4F;AACtF,EAAA;AAC4B,IAAA;AACU,IAAA;AAClC,EAAA;AACC,IAAA;AACT,EAAA;AACI,EAAA;AACyC,IAAA;AACzB,IAAA;AACZ,EAAA;AACC,IAAA;AACT,EAAA;AACF;AAMiB;AAEf,EAAA;AACc,IAAA;AACZ,IAAA;AACF,EAAA;AAKmD,EAAA;AACA,EAAA;AAE/C,EAAA;AACiC,IAAA;AACxB,MAAA;AAAA;AAEO,QAAA;AAChB,MAAA;AACD,IAAA;AAC2B,IAAA;AAChB,MAAA;AAC0C,QAAA;AACpD,MAAA;AACF,IAAA;AAEmD,IAAA;AACQ,IAAA;AAC1C,IAAA;AAEoB,IAAA;AACjC,IAAA;AACyF,MAAA;AACzC,MAAA;AAC5B,QAAA;AACP,wBAAA;AACX,UAAA;AACA,UAAA;AACA,UAAA;AACO,UAAA;AACR,QAAA;AACF,MAAA;AACwB,MAAA;AACf,IAAA;AACqD,MAAA;AACjE,IAAA;AAEa,oBAAA;AACX,MAAA;AACA,MAAA;AACA,MAAA;AACO,MAAA;AACR,IAAA;AAGG,IAAA;AACA,IAAA;AACkC,MAAA;AAC1B,IAAA;AACuD,MAAA;AACnE,IAAA;AAE4B,IAAA;AAChB,MAAA;AAC4D,QAAA;AACtE,MAAA;AACF,IAAA;AAEgC,IAAA;AACnB,oBAAA;AACX,MAAA;AACA,MAAA;AACA,MAAA;AACO,MAAA;AACR,IAAA;AACD,EAAA;AAGI,IAAA;AAAuB,MAAA;AAAU,IAAA;AAAuC,IAAA;AAC9E,EAAA;AACF;AAEwD;AACzB,EAAA;AACI,EAAA;AACY,EAAA;AACZ,IAAA;AACf,MAAA;AAEhB,IAAA;AACD,EAAA;AACoB,EAAA;AACvB;ADlB4F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/Users/mong-e/workspace/kordoc-quality-99/dist/chunk-6DOCSYEM.cjs","sourcesContent":[null,"/**\n * 수식 OCR 모델 자동 다운로드 + SHA-256 검증\n *\n * 캐시 위치: `~/.cache/kordoc/models/pix2text/`\n * 총 ~155MB (MFD 44MB + MFR encoder 87MB + MFR decoder 30MB + tokenizer 40KB)\n *\n * HF URL + SHA 는 Docufinder archive/rust-formula-ocr-wip 에서 검증 완료됨.\n * 모델 버전 갱신 시 URL + SHA 를 함께 갱신해야 한다.\n */\n\nimport { createHash } from \"crypto\"\nimport { createReadStream } from \"fs\"\nimport { mkdir, stat, unlink, rename } from \"fs/promises\"\nimport { createWriteStream } from \"fs\"\nimport { homedir } from \"os\"\nimport { join, dirname } from \"path\"\nimport { pipeline } from \"stream/promises\"\nimport { Readable } from \"stream\"\nimport { assertNetworkAllowed } from \"../../shared/offline.js\"\nimport { cleanupModelDownloadPartials, modelDownloadPartialPath } from \"./model-partials.js\"\n\nexport interface ModelSpec {\n  name: string\n  filename: string\n  url: string\n  sha256: string\n  sizeMb: number\n}\n\n/** 모델 스펙 (SHA-256 은 실제 다운로드로 검증됨 — 변경 금지) */\nexport const MFD_MODEL: ModelSpec = {\n  name: \"Pix2Text MFD\",\n  filename: \"mfd.onnx\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfd/resolve/main/mfd-v20240618.onnx\",\n  sha256: \"51a8854743b17ae654729af8db82a630c1ccfa06debf4856c8b28055f87d02c1\",\n  sizeMb: 42,\n}\n\nexport const MFR_ENCODER_MODEL: ModelSpec = {\n  name: \"Pix2Text MFR encoder\",\n  filename: \"encoder_model.onnx\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/encoder_model.onnx\",\n  sha256: \"bd8d5c322792e9ec45793af5569e9748f82a3d728a9e00213dbfc56c1486f37d\",\n  sizeMb: 87,\n}\n\nexport const MFR_DECODER_MODEL: ModelSpec = {\n  name: \"Pix2Text MFR decoder\",\n  filename: \"decoder_model.onnx\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/decoder_model.onnx\",\n  sha256: \"fd0f92d7a012f3dae41e1ac79421aea0ea888b5a66cb3f9a004e424f82f3daed\",\n  sizeMb: 30,\n}\n\nexport const MFR_TOKENIZER: ModelSpec = {\n  name: \"Pix2Text MFR tokenizer\",\n  filename: \"tokenizer.json\",\n  url: \"https://huggingface.co/breezedeus/pix2text-mfr/resolve/main/tokenizer.json\",\n  sha256: \"3e2ab757277d22639bec28c9d7972e352d3d1dba223051fa674002dc5ab64df3\",\n  sizeMb: 1,\n}\n\nexport const ALL_FORMULA_MODELS: ReadonlyArray<ModelSpec> = [\n  MFD_MODEL,\n  MFR_ENCODER_MODEL,\n  MFR_DECODER_MODEL,\n  MFR_TOKENIZER,\n]\n\n/**\n * 모델 캐시 하위 디렉토리 경로. 환경 변수 `KORDOC_MODEL_CACHE` 가 설정되면\n * 해당 경로를 우선 사용, 없으면 `~/.cache/kordoc/models/<subdir>/`.\n * (수식 OCR 외 텍스트 OCR 등 다른 모델군도 공용 — subdir 로 격리)\n */\nexport function getModelsDir(subdir: string): string {\n  const override = process.env.KORDOC_MODEL_CACHE\n  if (override && override.trim()) {\n    return join(override, subdir)\n  }\n  return join(homedir(), \".cache\", \"kordoc\", \"models\", subdir)\n}\n\nexport function getFormulaModelsDir(): string {\n  return getModelsDir(\"pix2text\")\n}\n\nexport interface ModelStatus {\n  spec: ModelSpec\n  localPath: string\n  exists: boolean\n  /** SHA 검증까지 끝났는가 (exists && valid) */\n  verified: boolean\n  /** 검증 실패 시 이유 */\n  invalidReason?: string\n}\n\n/** 지정 모델군의 존재/유효성 상태 반환 (다운로드 없이 확인만) */\nexport async function getModelStatusIn(dir: string, specs: ReadonlyArray<ModelSpec>): Promise<ModelStatus[]> {\n  const result: ModelStatus[] = []\n  for (const spec of specs) {\n    const localPath = join(dir, spec.filename)\n    let exists = false\n    try {\n      const s = await stat(localPath)\n      exists = s.isFile() && s.size > 0\n    } catch {\n      exists = false\n    }\n    if (!exists) {\n      result.push({ spec, localPath, exists: false, verified: false })\n      continue\n    }\n    try {\n      const actual = await sha256OfFile(localPath)\n      if (actual === spec.sha256) {\n        result.push({ spec, localPath, exists: true, verified: true })\n      } else {\n        result.push({\n          spec,\n          localPath,\n          exists: true,\n          verified: false,\n          invalidReason: `SHA256 mismatch: expected ${spec.sha256}, got ${actual}`,\n        })\n      }\n    } catch (e) {\n      result.push({\n        spec,\n        localPath,\n        exists: true,\n        verified: false,\n        invalidReason: `SHA compute failed: ${(e as Error).message}`,\n      })\n    }\n  }\n  return result\n}\n\n/** 모든 수식 모델의 존재/유효성 상태 반환 (다운로드 없이 확인만) */\nexport async function getFormulaModelStatus(): Promise<ModelStatus[]> {\n  return getModelStatusIn(getFormulaModelsDir(), ALL_FORMULA_MODELS)\n}\n\nexport interface DownloadProgress {\n  spec: ModelSpec\n  /** 현재까지 다운로드한 바이트 */\n  downloaded: number\n  /** 전체 바이트 (알 수 있으면) */\n  total: number | null\n  /** \"download\" | \"verify\" | \"done\" | \"skip\" */\n  phase: \"download\" | \"verify\" | \"done\" | \"skip\" | \"error\"\n  message?: string\n}\n\nexport type ProgressHandler = (p: DownloadProgress) => void\n\n/**\n * 지정 모델군을 다운로드/검증한다.\n * - 이미 있고 SHA 일치 → skip\n * - 없음 → 다운로드 후 SHA 검증. 실패 시 파일 삭제.\n */\nexport async function ensureModelsIn(dir: string, specs: ReadonlyArray<ModelSpec>, onProgress?: ProgressHandler): Promise<void> {\n  await mkdir(dir, { recursive: true })\n\n  for (const spec of specs) {\n    const localPath = join(dir, spec.filename)\n    await cleanupModelDownloadPartials(localPath)\n\n    if (await isExistingValid(localPath, spec.sha256)) {\n      onProgress?.({\n        spec,\n        downloaded: 0,\n        total: null,\n        phase: \"skip\",\n        message: \"이미 존재 + SHA 일치\",\n      })\n      continue\n    }\n\n    // Keep the destination until atomic replacement; another process may have\n    // finished a valid download since our initial check.\n    await downloadToFile(spec, localPath, onProgress)\n  }\n}\n\n/** 필요한 모든 수식 모델을 다운로드/검증한다. */\nexport async function ensureFormulaModels(onProgress?: ProgressHandler): Promise<void> {\n  return ensureModelsIn(getFormulaModelsDir(), ALL_FORMULA_MODELS, onProgress)\n}\n\n/** 단일 모델만 확인/다운로드 (진단 UI 에서 개별 상태 새로고침용) */\nexport async function ensureSingleModel(spec: ModelSpec, onProgress?: ProgressHandler): Promise<void> {\n  const dir = getFormulaModelsDir()\n  await mkdir(dir, { recursive: true })\n  const localPath = join(dir, spec.filename)\n  await cleanupModelDownloadPartials(localPath)\n  if (await isExistingValid(localPath, spec.sha256)) {\n    onProgress?.({ spec, downloaded: 0, total: null, phase: \"skip\" })\n    return\n  }\n  await downloadToFile(spec, localPath, onProgress)\n}\n\nasync function isExistingValid(localPath: string, sha256Expected: string): Promise<boolean> {\n  try {\n    const s = await stat(localPath)\n    if (!s.isFile() || s.size === 0) return false\n  } catch {\n    return false\n  }\n  try {\n    const actual = await sha256OfFile(localPath)\n    return actual === sha256Expected\n  } catch {\n    return false\n  }\n}\n\nasync function downloadToFile(\n  spec: ModelSpec,\n  localPath: string,\n  onProgress?: ProgressHandler,\n): Promise<void> {\n  // 폐쇄망 모드에서는 요청 자체를 보내지 않는다 (사이드로드 안내로 대체)\n  assertNetworkAllowed(\n    `${spec.name} 모델 다운로드`,\n    \"온라인 PC에서 `kordoc models --export <디렉토리>` 로 내보낸 뒤 이 PC에서 `kordoc models --import <디렉토리>` 하거나, KORDOC_MODEL_CACHE 로 모델 캐시 경로를 지정하세요\",\n  )\n\n  // 먼저 .part 로 받고 검증 후 rename — 중단된 다운로드가 \"정상 파일\"로 오인되는 걸 방지\n  // Batch workers may download the same missing model concurrently. Never share\n  // a partial file: only a fully verified download is atomically published.\n  const partPath = modelDownloadPartialPath(localPath)\n  await mkdir(dirname(localPath), { recursive: true })\n\n  try {\n    const resp = await fetch(spec.url, {\n      headers: {\n        // HF CDN 은 UA 없으면 가끔 403 을 뱉는다\n        \"User-Agent\": \"kordoc-formula-ocr/1.0 (+https://github.com/chrisryugj/kordoc)\",\n      },\n    })\n    if (!resp.ok || !resp.body) {\n      throw new Error(\n        `${spec.name} 다운로드 실패: HTTP ${resp.status} ${resp.statusText} (${spec.url})`,\n      )\n    }\n\n    const lenHeader = resp.headers.get(\"content-length\")\n    const total = lenHeader ? Number.parseInt(lenHeader, 10) : null\n    let downloaded = 0\n\n    const ws = createWriteStream(partPath)\n    try {\n      const reader = Readable.fromWeb(resp.body as unknown as import(\"stream/web\").ReadableStream)\n      reader.on(\"data\", (chunk: Buffer | Uint8Array) => {\n        downloaded += chunk.length\n        onProgress?.({\n          spec,\n          downloaded,\n          total,\n          phase: \"download\",\n        })\n      })\n      await pipeline(reader, ws)\n    } catch (e) {\n      throw new Error(`${spec.name} 스트리밍 실패: ${(e as Error).message}`)\n    }\n\n    onProgress?.({\n      spec,\n      downloaded,\n      total,\n      phase: \"verify\",\n    })\n\n    // SHA 검증\n    let actual: string\n    try {\n      actual = await sha256OfFile(partPath)\n    } catch (e) {\n      throw new Error(`${spec.name} SHA 계산 실패: ${(e as Error).message}`)\n    }\n\n    if (actual !== spec.sha256) {\n      throw new Error(\n        `${spec.name} SHA256 mismatch: expected ${spec.sha256}, got ${actual} — 모델 URL 이 오염되었거나 전송 중 손상되었습니다.`,\n      )\n    }\n\n    await rename(partPath, localPath)\n    onProgress?.({\n      spec,\n      downloaded,\n      total,\n      phase: \"done\",\n    })\n  } finally {\n    // Successful rename already removed this path. Process termination bypasses\n    // finally; the next ensure call reclaims it only after proving the owner dead.\n    try { await unlink(partPath) } catch { /* Preserve the original outcome. */ }\n  }\n}\n\nasync function sha256OfFile(p: string): Promise<string> {\n  const h = createHash(\"sha256\")\n  const stream = createReadStream(p)\n  await pipeline(stream, async function* (src) {\n    for await (const chunk of src) {\n      h.update(chunk)\n      // yield 안 함 (소비만)\n    }\n  })\n  return h.digest(\"hex\")\n}\n","/**\n * 폐쇄망(내부망) 배포용 아웃바운드 통신 킬스위치 + 파일 접근 루트 제한.\n *\n * kordoc 자체는 문서 파서라 상시 외부 통신이 없지만, 두 경로만 나간다:\n *   1. OCR/수식 모델 최초 1회 다운로드 (huggingface.co)\n *   2. `kordoc watch --webhook` 사용자가 명시한 URL\n *\n * `KORDOC_OFFLINE=1` 이면 위 경로를 **시도 전에** 차단한다. 보안성 검토에서\n * \"외부 통신 없음\"을 런타임으로 증명하기 위한 단일 관문 — 새 아웃바운드 경로를\n * 추가하면 반드시 `assertNetworkAllowed()` 를 먼저 통과시킬 것.\n *\n * `KORDOC_ROOT` 는 파일 접근을 특정 디렉토리 하위로 제한한다(미설정 시 제한 없음 —\n * 기존 동작 보존). 내부망 배포에서는 두 변수를 함께 고정하는 것을 권장.\n */\n\nimport { realpathSync } from \"fs\"\nimport { isAbsolute, relative, resolve, sep } from \"path\"\nimport { KordocError } from \"../utils.js\"\n\nconst TRUTHY = new Set([\"1\", \"true\", \"yes\", \"on\"])\n\nfunction envFlag(name: string): boolean {\n  const v = process.env[name]\n  return !!v && TRUTHY.has(v.trim().toLowerCase())\n}\n\n/** 폐쇄망 모드 여부 (`KORDOC_OFFLINE=1|true|yes|on`) */\nexport function isOfflineMode(): boolean {\n  return envFlag(\"KORDOC_OFFLINE\")\n}\n\n/**\n * 아웃바운드 통신 관문. 폐쇄망 모드면 요청을 보내기 전에 예외로 끊는다.\n * @param what 차단 대상 설명 (사용자에게 노출됨 — 호스트/URL 은 넣지 말 것)\n * @param hint 대안 안내 (오프라인 사이드로드 방법 등)\n */\nexport function assertNetworkAllowed(what: string, hint?: string): void {\n  if (!isOfflineMode()) return\n  throw new KordocError(\n    `폐쇄망 모드(KORDOC_OFFLINE)에서 차단됨: ${what}` + (hint ? ` — ${hint}` : \"\"),\n  )\n}\n\n/** 파일 접근 루트 (`KORDOC_ROOT`). 미설정이면 null = 제한 없음 */\nexport function getAccessRoot(): string | null {\n  const raw = process.env.KORDOC_ROOT\n  if (!raw || !raw.trim()) return null\n  const resolved = resolve(raw.trim())\n  try {\n    return realpathSync(resolved)\n  } catch {\n    // 루트가 실재하지 않으면 모든 접근이 막히는 게 안전한 기본값\n    return resolved\n  }\n}\n\n/** 경로가 루트 하위인지 (루트 자신 포함). 경계 문자열 매칭이 아닌 세그먼트 단위 비교 */\nexport function isWithinRoot(realPath: string, root: string): boolean {\n  if (realPath === root) return true\n  const rel = relative(root, realPath)\n  return rel !== \"\" && !rel.startsWith(\"..\") && !isAbsolute(rel) && !rel.startsWith(`..${sep}`)\n}\n\n/**\n * `KORDOC_ROOT` 가 설정된 경우 경로가 루트 하위인지 검증한다.\n * 인자는 이미 realpath 로 해석된 절대경로여야 한다 (심볼릭 링크 탈출 방지).\n */\nexport function assertWithinRoot(realPath: string): void {\n  const root = getAccessRoot()\n  if (!root) return\n  if (!isWithinRoot(realPath, root)) {\n    throw new KordocError(`허용된 작업 디렉토리(KORDOC_ROOT) 밖의 경로입니다: ${realPath}`)\n  }\n}\n","/** Process-owned temporary model downloads. Never infer abandonment from age alone. */\nimport { createHash, randomUUID } from \"node:crypto\"\nimport { readFileSync, readlinkSync } from \"node:fs\"\nimport { readdir, unlink } from \"node:fs/promises\"\nimport { hostname } from \"node:os\"\nimport { basename, dirname, join } from \"node:path\"\n\nlet scope: string | undefined\nfunction ownerScope(): string {\n  if (scope) return scope\n  let namespace = \"\"\n  if (process.platform === \"linux\") {\n    try {\n      // A cache may be shared by containers whose PID spaces differ. A missing\n      // PID in this namespace says nothing about a download in another one.\n      // Boot identity also separates machines with matching hostnames/ns inodes.\n      const boot = readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim()\n      if (!boot) throw new Error(\"Kernel boot identity unavailable\")\n      namespace = `${boot}:${readlinkSync(\"/proc/self/ns/pid\")}`\n    } catch {\n      // Fail closed if namespace identity is unavailable: only this process can\n      // recognize its own paths; it will not scavenge another process's files.\n      namespace = randomUUID()\n    }\n  }\n  scope = createHash(\"sha256\").update(`${process.platform}\\0${hostname()}\\0${namespace}`).digest(\"hex\").slice(0, 32)\n  return scope\n}\n\nexport function modelDownloadPartialPath(localPath: string): string {\n  return `${localPath}.kordoc-${ownerScope()}-${process.pid}-${randomUUID()}.part`\n}\n\n/** Best effort: cache maintenance must not prevent use of a valid model. */\nexport async function cleanupModelDownloadPartials(localPath: string): Promise<void> {\n  const dir = dirname(localPath)\n  const prefix = `${basename(localPath)}.kordoc-${ownerScope()}-`\n  let entries\n  try { entries = await readdir(dir, { withFileTypes: true }) } catch { return }\n  for (const entry of entries) {\n    // Do not follow symlinks, touch other models, or guess ownership for old\n    // UUID-only partials/foreign hosts/namespaces. Their owner could still be live.\n    if (!entry.isFile() || !entry.name.startsWith(prefix)) continue\n    const match = /^([1-9]\\d*)-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\\.part$/.exec(entry.name.slice(prefix.length))\n    if (!match) continue\n    const pid = Number(match[1])\n    if (!Number.isSafeInteger(pid) || pid > 0x7fffffff) continue\n    try {\n      process.kill(pid, 0)\n      continue // Includes a reused PID: retaining an orphan beats deleting live data.\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"ESRCH\") continue // EPERM/unknown = potentially live.\n    }\n    try { await unlink(join(dir, entry.name)) } catch { /* Another cleaner may have won. */ }\n  }\n}\n"]}

package/dist/{chunk-N6MPDM55.js → chunk-6OCKAXIS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   KordocError
-} from "./chunk-QXNQ2HNB.js";
+} from "./chunk-A2W2JQ3S.js";
 
 // src/shared/offline.ts
 import { realpathSync } from "fs";
@@ -49,4 +49,4 @@ export {
   getAccessRoot,
   assertWithinRoot
 };
-//# sourceMappingURL=chunk-N6MPDM55.js.map
+//# sourceMappingURL=chunk-6OCKAXIS.js.map