packtory 0.0.96 → 0.0.97

package/sbom/sbom-builder.js

@@ -1,3 +1,58 @@
-import '@cyclonedx/cyclonedx-library';
-import 'spdx-expression-parse';
+import * as cdx from '@cyclonedx/cyclonedx-library';
+import spdxParse from 'spdx-expression-parse';
+function isParseableSpdxExpression(value) {
+    try {
+        spdxParse(value);
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+function buildPurl(name, versionOrSpecifier) {
+    return `pkg:npm/${name}@${encodeURIComponent(versionOrSpecifier)}`;
+}
+function buildRootComponent(rootComponent) {
+    const purl = buildPurl(rootComponent.name, rootComponent.version);
+    return new cdx.Models.Component(cdx.Enums.ComponentType.Library, rootComponent.name, {
+        version: rootComponent.version,
+        bomRef: purl,
+        purl
+    });
+}
+function buildDependencyComponent(dependency) {
+    const purl = buildPurl(dependency.name, dependency.specifier);
+    const component = new cdx.Models.Component(cdx.Enums.ComponentType.Library, dependency.name, {
+        version: dependency.specifier,
+        bomRef: purl,
+        purl,
+        scope: dependency.scope
+    });
+    if (dependency.license === undefined) {
+        return component;
+    }
+    if (isParseableSpdxExpression(dependency.license)) {
+        component.licenses.add(new cdx.Models.LicenseExpression(dependency.license));
+        return component;
+    }
+    component.licenses.add(new cdx.Models.NamedLicense(dependency.license));
+    return component;
+}
+function buildToolComponent(toolVersion) {
+    return new cdx.Models.Component(cdx.Enums.ComponentType.Application, 'packtory', {
+        version: toolVersion
+    });
+}
+export function buildSbom(options) {
+    const bom = new cdx.Models.Bom();
+    bom.metadata.tools.components.add(buildToolComponent(options.toolVersion));
+    const rootComponent = buildRootComponent(options.rootComponent);
+    bom.metadata.component = rootComponent;
+    for (const dependency of options.dependencies) {
+        const component = buildDependencyComponent(dependency);
+        bom.components.add(component);
+        rootComponent.dependencies.add(component.bomRef);
+    }
+    return bom;
+}
 //# sourceMappingURL=sbom-builder.js.map

package/sbom/sbom-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-builder.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-builder.ts"],"names":[],"mappings":"AAAA,OAAqB,8BAA8B,CAAC;AACpD,OAAsB,uBAAuB,CAAC"}
+{"version":3,"file":"sbom-builder.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AACpD,OAAO,SAAS,MAAM,uBAAuB,CAAC;AAoB9C,SAAS,yBAAyB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACD,SAAS,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,kBAA0B;IACvD,OAAO,WAAW,IAAI,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,aAAgC;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;QACjF,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,MAAM,EAAE,IAAI;QACZ,IAAI;KACP,CAAC,CAAC;AACP,CAAC;AAED,SAAS,wBAAwB,CAAC,UAA0B;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE;QACzF,OAAO,EAAE,UAAU,CAAC,SAAS;QAC7B,MAAM,EAAE,IAAI;QACZ,IAAI;QACJ,KAAK,EAAE,UAAU,CAAC,KAAK;KAC1B,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,yBAAyB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7E,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC3C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,UAAU,EAAE;QAC7E,OAAO,EAAE,WAAW;KACvB,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAA2B;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACjC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAE3E,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,aAAa,CAAC;IAEvC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC"}

package/sbom/sbom-canonicalizer.js

@@ -1,4 +1,46 @@
-import 'remeda';
-import "../common/package-layout.js";
-import "../common/stable-json.js";
+import { isArray, isPlainObject } from 'remeda';
+import { bundleRelativePath, sbomArtifactFilePath } from "../common/package-layout.js";
+import { serializeStableJson } from "../common/stable-json.js";
+const packtoryToolName = 'packtory';
+function pluckObjectField(value, key) {
+    if (!isPlainObject(value)) {
+        return undefined;
+    }
+    return value[key];
+}
+function resolveToolComponents(parsed) {
+    const metadata = pluckObjectField(parsed, 'metadata');
+    const tools = pluckObjectField(metadata, 'tools');
+    const components = pluckObjectField(tools, 'components');
+    return isArray(components) ? components : undefined;
+}
+function stripPacktoryVersion(parsed) {
+    const components = resolveToolComponents(parsed);
+    if (components === undefined) {
+        return;
+    }
+    for (const entry of components) {
+        if (isPlainObject(entry) && entry.name === packtoryToolName) {
+            delete entry.version;
+        }
+    }
+}
+function canonicalizeSbomContent(content) {
+    try {
+        const parsed = JSON.parse(content);
+        stripPacktoryVersion(parsed);
+        return serializeStableJson(parsed);
+    }
+    catch {
+        return content;
+    }
+}
+export function canonicalizeSbomInFileSet(files) {
+    return files.map(function (file) {
+        if (bundleRelativePath(file.filePath) !== sbomArtifactFilePath) {
+            return file;
+        }
+        return { ...file, content: canonicalizeSbomContent(file.content) };
+    });
+}
 //# sourceMappingURL=sbom-canonicalizer.js.map

package/sbom/sbom-canonicalizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-canonicalizer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-canonicalizer.ts"],"names":[],"mappings":"AAAA,OAAuC,QAAQ,CAAC;AAChD,OAAyD,6BAA6B,CAAC;AACvF,OAAoC,0BAA0B,CAAC"}
+{"version":3,"file":"sbom-canonicalizer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-canonicalizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC,SAAS,gBAAgB,CAAC,KAAc,EAAE,GAAW;IACjD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAe;IACzC,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC,OAAO,CAAC;QACzB,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC5C,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAiC;IACvE,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,IAAI;QAC3B,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,oBAAoB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/sbom/sbom-file.d.ts

@@ -1,8 +1,18 @@
 import type { PublishSettings } from '../config/publish-settings.ts';
 import { type FileDescription } from '../file-manager/file-description.ts';
 import type { SbomPackage, SbomSiblingPackage } from '../published-package/published-package.ts';
+import type { LicenseResolver } from './license-resolver.ts';
+import type { SbomSerializer } from './sbom-serializer.ts';
+type ToolVersionProvider = () => Promise<string>;
+type SbomFileBuilderDependencies = {
+    readonly licenseResolver: LicenseResolver;
+    readonly sbomSerializer: SbomSerializer;
+    readonly toolVersionProvider: ToolVersionProvider;
+    readonly projectFolder: string;
+};
 export type SbomFileBuilder = {
     generate: (bundle: SbomPackage, siblings: readonly SbomSiblingPackage[], publishSettings: PublishSettings) => Promise<readonly FileDescription[] | undefined>;
 };
+export declare function createSbomFileBuilder(dependencies: SbomFileBuilderDependencies): SbomFileBuilder;
 export {};
 //# sourceMappingURL=sbom-file.d.ts.map

package/sbom/sbom-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-file.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;MAe3F,MAAM,eAAe,GAAG;IAC1B,QAAQ,EAAE,CACN,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,SAAS,kBAAkB,EAAE,EACvC,eAAe,EAAE,eAAe,KAC/B,OAAO,CAAC,SAAS,eAAe,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD,CAAC;AAuBF"}
+{"version":3,"file":"sbom-file.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAEjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,KAAK,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAEjD,KAAK,2BAA2B,GAAG;IAC/B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,QAAQ,EAAE,CACN,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,SAAS,kBAAkB,EAAE,EACvC,eAAe,EAAE,eAAe,KAC/B,OAAO,CAAC,SAAS,eAAe,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD,CAAC;AAuBF,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,2BAA2B,GAAG,eAAe,CA6ChG"}

package/sbom/sbom-file.js

@@ -1,6 +1,55 @@
-import '@cyclonedx/cyclonedx-library';
-import "../common/package-layout.js";
-import "../file-manager/file-description.js";
-import "./extract-license.js";
-import "./sbom-builder.js";
+import * as cdx from '@cyclonedx/cyclonedx-library';
+import { sbomArtifactFilePath } from "../common/package-layout.js";
+import { createFileDescription } from "../file-manager/file-description.js";
+import { extractLicenseFromManifest } from "./extract-license.js";
+import { buildSbom } from "./sbom-builder.js";
+function isSbomEnabled(publishSettings) {
+    return publishSettings.sbom?.enabled ?? true;
+}
+function listDependencyEntries(bundle) {
+    return [
+        ...Object.entries(bundle.dependencies).map(function ([name, specifier]) {
+            return { name, specifier, scope: cdx.Enums.ComponentScope.Required };
+        }),
+        ...Object.entries(bundle.peerDependencies).map(function ([name, specifier]) {
+            return { name, specifier, scope: cdx.Enums.ComponentScope.Optional };
+        })
+    ];
+}
+export function createSbomFileBuilder(dependencies) {
+    const { licenseResolver, sbomSerializer, toolVersionProvider, projectFolder } = dependencies;
+    async function resolveDependencyEntries(bundle, siblings) {
+        const siblingsByName = new Map(siblings.map(function (sibling) {
+            return [sibling.name, sibling];
+        }));
+        const entries = listDependencyEntries(bundle);
+        return Promise.all(entries.map(async function (entry) {
+            const sibling = siblingsByName.get(entry.name);
+            const license = sibling === undefined
+                ? await licenseResolver.resolveLicense({ projectFolder, dependencyName: entry.name })
+                : extractLicenseFromManifest(sibling.packageJson);
+            return { ...entry, license };
+        }));
+    }
+    async function buildFile(bundle, siblings) {
+        const [resolvedToolVersion, sbomDependencies] = await Promise.all([
+            toolVersionProvider(),
+            resolveDependencyEntries(bundle, siblings)
+        ]);
+        const bom = buildSbom({
+            toolVersion: resolvedToolVersion,
+            rootComponent: { name: bundle.packageJson.name, version: bundle.packageJson.version },
+            dependencies: sbomDependencies
+        });
+        return createFileDescription(sbomArtifactFilePath, sbomSerializer.serialize(bom));
+    }
+    return {
+        async generate(bundle, siblings, publishSettings) {
+            if (!isSbomEnabled(publishSettings)) {
+                return undefined;
+            }
+            return [await buildFile(bundle, siblings)];
+        }
+    };
+}
 //# sourceMappingURL=sbom-file.js.map

package/sbom/sbom-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-file.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAAA,OAAqB,8BAA8B,CAAC;AACpD,OAAqC,6BAA6B,CAAC;AAEnE,OAA4D,qCAAqC,CAAC;AAElG,OAA2C,sBAAsB,CAAC;AAGlE,OAA+C,mBAAmB,CAAC"}
+{"version":3,"file":"sbom-file.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAwB,MAAM,qCAAqC,CAAC;AAElG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAGlE,OAAO,EAAE,SAAS,EAAuB,MAAM,mBAAmB,CAAC;AAyBnE,SAAS,aAAa,CAAC,eAAgC;IACnD,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB;IAC9C,OAAO;QACH,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAkB,UAAU,CAAE,IAAI,EAAE,SAAS,CAAE;YACrF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QACzE,CAAC,CAAC;QACF,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAkB,UAAU,CAAE,IAAI,EAAE,SAAS,CAAE;YACzF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QACzE,CAAC,CAAC;KACL,CAAC;AACN,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAyC;IAC3E,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC;IAE7F,KAAK,UAAU,wBAAwB,CACnC,MAAmB,EACnB,QAAuC;QAEvC,MAAM,cAAc,GAAG,IAAI,GAAG,CAC1B,QAAQ,CAAC,GAAG,CAAC,UAAU,OAAO;YAC1B,OAAO,CAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAE,CAAC;QACrC,CAAC,CAAC,CACL,CAAC;QACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC,GAAG,CACd,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,KAAK;YAC7B,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS;gBACjC,CAAC,CAAC,MAAM,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrF,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACtD,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC;QACjC,CAAC,CAAC,CACL,CAAC;IACN,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,MAAmB,EAAE,QAAuC;QACjF,MAAM,CAAE,mBAAmB,EAAE,gBAAgB,CAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChE,mBAAmB,EAAE;YACrB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC;SAC7C,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC;YAClB,WAAW,EAAE,mBAAmB;YAChC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACrF,YAAY,EAAE,gBAAgB;SACjC,CAAC,CAAC;QACH,OAAO,qBAAqB,CAAC,oBAAoB,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO;QACH,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe;YAC5C,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,CAAE,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAE,CAAC;QACjD,CAAC;KACJ,CAAC;AACN,CAAC"}

package/sbom/sbom-serializer.d.ts

@@ -0,0 +1,8 @@
+import * as cdx from '@cyclonedx/cyclonedx-library';
+type SerializableBom = Readonly<cdx.Models.Bom>;
+export type SbomSerializer = {
+    serialize: (bom: SerializableBom) => string;
+};
+export declare function createSbomSerializer(): SbomSerializer;
+export {};
+//# sourceMappingURL=sbom-serializer.d.ts.map

package/sbom/sbom-serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-serializer.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AAEpD,KAAK,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG;IACzB,SAAS,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC;CAC/C,CAAC;AAUF,wBAAgB,oBAAoB,IAAI,cAAc,CAOrD"}

package/sbom/sbom-serializer.js

@@ -1,2 +1,15 @@
-import '@cyclonedx/cyclonedx-library';
+import * as cdx from '@cyclonedx/cyclonedx-library';
+function createCycloneDxJsonSerializer() {
+    return new cdx.Serialize.JsonSerializer(new cdx.Serialize.JSON.Normalize.Factory(cdx.Spec.Spec1dot6));
+}
+function serializeBom(serializer, bom) {
+    return String(Reflect.apply(serializer.serialize, serializer, [bom, { sortLists: true, space: 4 }]));
+}
+export function createSbomSerializer() {
+    const serializer = createCycloneDxJsonSerializer();
+    const serialize = function (bom) {
+        return serializeBom(serializer, bom);
+    };
+    return { serialize };
+}
 //# sourceMappingURL=sbom-serializer.js.map

package/sbom/sbom-serializer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-serializer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAqB,8BAA8B,CAAC"}
+{"version":3,"file":"sbom-serializer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AAQpD,SAAS,6BAA6B;IAClC,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,YAAY,CAAC,UAAwC,EAAE,GAAoB;IAChF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,oBAAoB;IAChC,MAAM,UAAU,GAAG,6BAA6B,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,UAAU,GAAoB;QAC5C,OAAO,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,CAAC;AACzB,CAAC"}

package/sbom/tool-version.js

@@ -1,2 +1,50 @@
-import 'remeda';
+import { isObjectType, isPlainObject } from 'remeda';
+const candidatePackageNames = ['@packtory/cli', 'packtory'];
+function buildUnresolvableMessage() {
+    const intro = 'Cannot determine packtory tool version: neither "@packtory/cli" nor "packtory" is resolvable.';
+    return `${intro} Install packtory via npm so it lives under node_modules/.`;
+}
+function isCandidatePackageName(value) {
+    return value === '@packtory/cli' || value === 'packtory';
+}
+function isImportResolutionError(error) {
+    if (!isObjectType(error) || !Object.hasOwn(error, 'code')) {
+        return false;
+    }
+    const code = Reflect.get(error, 'code');
+    return code === 'ERR_MODULE_NOT_FOUND' || code === 'ERR_PACKAGE_PATH_NOT_EXPORTED';
+}
+function unwrapJsonModule(importedModule) {
+    if (!isPlainObject(importedModule) || !Object.hasOwn(importedModule, 'default')) {
+        return importedModule;
+    }
+    return importedModule.default;
+}
+function parseToolPackageJson(specifier, importedModule) {
+    const parsed = unwrapJsonModule(importedModule);
+    if (!isPlainObject(parsed) || typeof parsed.version !== 'string') {
+        throw new Error(`Imported packtory package.json from "${specifier}" is missing a version field`);
+    }
+    if (!isCandidatePackageName(parsed.name)) {
+        throw new Error(`Imported packtory package.json from "${specifier}" has unexpected package name`);
+    }
+    return parsed.version;
+}
+export function createPacktoryToolVersionResolver(dependencies) {
+    const { importPackageJson } = dependencies;
+    return async function resolvePacktoryToolVersion() {
+        for (const candidatePackageName of candidatePackageNames) {
+            const specifier = `${candidatePackageName}/package.json`;
+            try {
+                return parseToolPackageJson(specifier, await importPackageJson(specifier));
+            }
+            catch (error) {
+                if (!isImportResolutionError(error)) {
+                    throw error;
+                }
+            }
+        }
+        throw new Error(buildUnresolvableMessage());
+    };
+}
 //# sourceMappingURL=tool-version.js.map

package/sbom/tool-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-version.js","sourceRoot":"","sources":["../../../../source/sbom/tool-version.ts"],"names":[],"mappings":"AAAA,OAA4C,QAAQ,CAAC"}
+{"version":3,"file":"tool-version.js","sourceRoot":"","sources":["../../../../source/sbom/tool-version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,qBAAqB,GAAG,CAAE,eAAe,EAAE,UAAU,CAAW,CAAC;AAQvE,SAAS,wBAAwB;IAC7B,MAAM,KAAK,GAAG,+FAA+F,CAAC;IAC9G,OAAO,GAAG,KAAK,4DAA4D,CAAC;AAChF,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC3C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,+BAA+B,CAAC;AACvF,CAAC;AAED,SAAS,gBAAgB,CAAC,cAAuB;IAC7C,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9E,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,OAAO,cAAc,CAAC,OAAO,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,cAAuB;IACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAChD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,8BAA8B,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,+BAA+B,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC7C,YAA6C;IAE7C,MAAM,EAAE,iBAAiB,EAAE,GAAG,YAAY,CAAC;IAE3C,OAAO,KAAK,UAAU,0BAA0B;QAC5C,KAAK,MAAM,oBAAoB,IAAI,qBAAqB,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,GAAG,oBAAoB,eAAe,CAAC;YACzD,IAAI,CAAC;gBACD,OAAO,oBAAoB,CAAC,SAAS,EAAE,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACtB,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAC;gBAChB,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;AACN,CAAC"}

package/sbom.cdx.json

@@ -9,16 +9,16 @@
                 {
                     "type": "application",
                     "name": "packtory",
-                    "version": "0.0.99"
+                    "version": "0.0.97"
                 }
             ]
         },
         "component": {
             "type": "library",
             "name": "packtory",
-            "version": "0.0.96",
-            "bom-ref": "pkg:npm/packtory@0.0.96",
-            "purl": "pkg:npm/packtory@0.0.96"
+            "version": "0.0.97",
+            "bom-ref": "pkg:npm/packtory@0.0.97",
+            "purl": "pkg:npm/packtory@0.0.97"
         }
     },
     "components": [
@@ -376,7 +376,7 @@
             "ref": "pkg:npm/npm-registry-fetch@20.0.1"
         },
         {
-            "ref": "pkg:npm/packtory@0.0.96",
+            "ref": "pkg:npm/packtory@0.0.97",
             "dependsOn": [
                 "pkg:npm/@arethetypeswrong/core@0.18.5",
                 "pkg:npm/@cyclonedx/cyclonedx-library@10.2.0",

package/tar/extract-tar.js

@@ -1,4 +1,84 @@
-import 'node:zlib';
-import 'node:stream';
-import 'tar-stream';
+import { createGunzip } from 'node:zlib';
+import { Readable } from 'node:stream';
+import { extract } from 'tar-stream';
+function defaultExtractTarLimits() {
+    return {
+        maxEntryCount: 50_000,
+        maxEntryPathLength: 4096,
+        maxExtractedBytes: 1_073_741_824
+    };
+}
+function toError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+function assertWithinEntryCountLimit(entries, limits) {
+    if (entries.length >= limits.maxEntryCount) {
+        throw new Error(`Refusing to extract tarball with more than ${limits.maxEntryCount} entries`);
+    }
+}
+function assertWithinEntryPathLimit(entry, limits) {
+    if (entry.header.name.length > limits.maxEntryPathLength) {
+        throw new Error(`Refusing to extract tarball entry with path longer than ${limits.maxEntryPathLength} characters`);
+    }
+}
+function assertWithinExtractedSizeLimit(extractedBytes, limits) {
+    if (extractedBytes > limits.maxExtractedBytes) {
+        throw new Error(`Refusing to extract tarball larger than ${limits.maxExtractedBytes} bytes`);
+    }
+}
+async function readEntryContent(entry, currentExtractedBytes, limits) {
+    let result = '';
+    let extractedBytes = currentExtractedBytes;
+    for await (const chunk of entry) {
+        extractedBytes += chunk.length;
+        assertWithinExtractedSizeLimit(extractedBytes, limits);
+        result += chunk.toString();
+    }
+    return { content: result, extractedBytes };
+}
+function stableTarHeader(header) {
+    const contentHeader = { ...header };
+    Reflect.deleteProperty(contentHeader, 'byteOffset');
+    return contentHeader;
+}
+async function collectTarEntries(stream, limits) {
+    const entries = [];
+    let extractedBytes = 0;
+    for await (const entry of stream) {
+        assertWithinEntryCountLimit(entries, limits);
+        assertWithinEntryPathLimit(entry, limits);
+        const content = await readEntryContent(entry, extractedBytes, limits);
+        extractedBytes = content.extractedBytes;
+        entries.push({ header: stableTarHeader(entry.header), content: content.content });
+    }
+    return entries;
+}
+async function waitForStreamError(stream) {
+    return await new Promise(function (_resolve, reject) {
+        stream.once('error', function (error) {
+            reject(toError(error));
+        });
+    });
+}
+function appendOutcome(outcomes, outcome) {
+    outcomes.add(outcome);
+    return outcomes;
+}
+async function raceExtractionOutcomes(streams, limits) {
+    const entries = await Promise.race(appendOutcome(appendOutcome(appendOutcome(appendOutcome(new Set(), collectTarEntries(streams.tarEntries, limits)), waitForStreamError(streams.source)), waitForStreamError(streams.gunzip)), waitForStreamError(streams.extractStream)));
+    return Array.from(entries);
+}
+export async function extractTarEntries(buffer, dependencies = {}, limits = defaultExtractTarLimits()) {
+    const createSource = dependencies.createSource ?? Readable.from;
+    const extractStream = extract();
+    const source = createSource(buffer);
+    const gunzip = createGunzip();
+    const tarEntries = source.pipe(gunzip).pipe(extractStream);
+    try {
+        return await raceExtractionOutcomes({ extractStream, gunzip, source, tarEntries }, limits);
+    }
+    catch (error) {
+        throw toError(error);
+    }
+}
 //# sourceMappingURL=extract-tar.js.map

package/tar/extract-tar.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-tar.js","sourceRoot":"","sources":["../../../../source/tar/extract-tar.ts"],"names":[],"mappings":"AAAA,OAA6B,WAAW,CAAC;AACzC,OAAyB,aAAa,CAAC;AACvC,OAAyD,YAAY,CAAC"}
+{"version":3,"file":"extract-tar.js","sourceRoot":"","sources":["../../../../source/tar/extract-tar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAmC,MAAM,YAAY,CAAC;AA6BtE,SAAS,uBAAuB;IAC5B,OAAO;QACH,aAAa,EAAE,MAAM;QACrB,kBAAkB,EAAE,IAAI;QACxB,iBAAiB,EAAE,aAAa;KACnC,CAAC;AACN,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC3B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC;AAUD,SAAS,2BAA2B,CAAC,OAA4B,EAAE,MAAwB;IACvF,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,aAAa,UAAU,CAAC,CAAC;IAClG,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAqB,EAAE,MAAwB;IAC/E,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACX,2DAA2D,MAAM,CAAC,kBAAkB,aAAa,CACpG,CAAC;IACN,CAAC;AACL,CAAC;AAED,SAAS,8BAA8B,CAAC,cAAsB,EAAE,MAAwB;IACpF,IAAI,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,iBAAiB,QAAQ,CAAC,CAAC;IACjG,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC3B,KAAqB,EACrB,qBAA6B,EAC7B,MAAwB;IAExB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,cAAc,GAAG,qBAAqB,CAAC;IAE3C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC9B,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC;QAC/B,8BAA8B,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAAC,MAAuB;IAC5C,MAAM,aAAa,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IACpC,OAAO,CAAC,cAAc,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACpD,OAAO,aAAa,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAqC,EAAE,MAAwB;IAC5F,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC/B,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACtE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAoB;IAClD,OAAO,MAAM,IAAI,OAAO,CAAQ,UAAU,QAAQ,EAAE,MAAM;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,KAAc;YACzC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAOD,SAAS,aAAa,CAClB,QAAqC,EACrC,OAAqC;IAErC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAA0B,EAAE,MAAwB;IACtF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAC9B,aAAa,CACT,aAAa,CACT,aAAa,CACT,aAAa,CACT,IAAI,GAAG,EAAgC,EACvC,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAChD,EACD,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CACrC,EACD,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CACrC,EACD,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAC5C,CACJ,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,MAAc,EACd,eAAgD,EAAE,EAClD,SAA2B,uBAAuB,EAAE;IAEpD,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,IAAI,QAAQ,CAAC,IAAI,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAkC,CAAC;IAE5F,IAAI,CAAC;QACD,OAAO,MAAM,sBAAsB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACL,CAAC"}

package/tar/gzipped-pack.js

@@ -1 +1,21 @@
+const gzipHeaderOperatingSystemFieldIndex = 9;
+const gzipHeaderOperatingSystemUnknown = 255;
+function normalizeGzipHeader(data) {
+    const normalized = Buffer.from(data);
+    normalized[gzipHeaderOperatingSystemFieldIndex] = gzipHeaderOperatingSystemUnknown;
+    return normalized;
+}
+function gzipStreamChunkToBuffer(chunk) {
+    if (typeof chunk === 'string' || chunk instanceof Uint8Array) {
+        return Buffer.from(chunk);
+    }
+    throw new TypeError('Expected gzip stream to yield Buffer, Uint8Array, or string chunks');
+}
+export async function collectGzippedPack(pack, gzip) {
+    const chunks = [];
+    for await (const chunk of pack.pipe(gzip)) {
+        chunks.push(gzipStreamChunkToBuffer(chunk));
+    }
+    return normalizeGzipHeader(Buffer.concat(chunks));
+}
 //# sourceMappingURL=gzipped-pack.js.map

package/tar/gzipped-pack.js.map

@@ -1 +1 @@
-{"version":3,"file":"gzipped-pack.js","sourceRoot":"","sources":["../../../../source/tar/gzipped-pack.ts"],"names":[],"mappings":""}
+{"version":3,"file":"gzipped-pack.js","sourceRoot":"","sources":["../../../../source/tar/gzipped-pack.ts"],"names":[],"mappings":"AAGA,MAAM,mCAAmC,GAAG,CAAC,CAAC;AAC9C,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAE7C,SAAS,mBAAmB,CAAC,IAAY;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,UAAU,CAAC,mCAAmC,CAAC,GAAG,gCAAgC,CAAC;IACnF,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,oEAAoE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,IAAwB,EACxB,IAAwC;IAExC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/tar/tarball-builder.d.ts

@@ -0,0 +1,14 @@
+import zlib from 'node:zlib';
+import type { FileDescription } from '../file-manager/file-description.ts';
+import type { FileManager } from '../file-manager/file-manager.ts';
+import { type VendorEntry } from '../vendor-materializer/vendor-entry.ts';
+export type TarballBuilder = {
+    build: (fileDescriptions: readonly FileDescription[], vendorEntries?: readonly VendorEntry[]) => Promise<Buffer>;
+};
+type TarballBuilderDependencies = {
+    readonly createGzip: typeof zlib.createGzip;
+    readonly fileManager: Pick<FileManager, 'getRealPath' | 'readFileBytes'>;
+};
+export declare function createTarballBuilder(dependencies?: Partial<TarballBuilderDependencies>): TarballBuilder;
+export {};
+//# sourceMappingURL=tarball-builder.d.ts.map

package/tar/tarball-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball-builder.d.ts","sourceRoot":"","sources":["../../../../source/tar/tarball-builder.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAGrG,MAAM,MAAM,cAAc,GAAG;IACzB,KAAK,EAAE,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,EAAE,aAAa,CAAC,EAAE,SAAS,WAAW,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACpH,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,GAAG,eAAe,CAAC,CAAC;CAC5E,CAAC;AAMF,wBAAgB,oBAAoB,CAAC,YAAY,GAAE,OAAO,CAAC,0BAA0B,CAAM,GAAG,cAAc,CAiD3G"}

package/tar/tarball-builder.js

@@ -1,6 +1,46 @@
-import 'node:zlib';
-import 'tar-stream';
-import "../vendor-materializer/vendor-entry.js";
-import "./gzipped-pack.js";
+import zlib from 'node:zlib';
+import tar, {} from 'tar-stream';
+import { validateVendorEntrySource } from "../vendor-materializer/vendor-entry.js";
+import { collectGzippedPack } from "./gzipped-pack.js";
 const staticFileModificationTime = new Date(0);
+const executableFileMode = 493;
+const nonExecutableFileMode = 420;
+export function createTarballBuilder(dependencies = {}) {
+    const createGzip = dependencies.createGzip ?? zlib.createGzip;
+    const fileManager = dependencies.fileManager ?? {
+        async getRealPath(filePath) {
+            return filePath;
+        },
+        async readFileBytes() {
+            throw new Error('readFileBytes is required to materialize vendor entries into the tarball');
+        }
+    };
+    function addEntry(pack, filePath, isExecutable, payload) {
+        const entry = pack.entry({
+            name: filePath,
+            mtime: staticFileModificationTime,
+            mode: isExecutable ? executableFileMode : nonExecutableFileMode
+        }, payload);
+        entry.end();
+    }
+    async function createPack(fileDescriptions, vendorEntries) {
+        const pack = tar.pack();
+        for (const fileDescription of fileDescriptions) {
+            addEntry(pack, fileDescription.filePath, fileDescription.isExecutable, fileDescription.content);
+        }
+        for (const vendorEntry of vendorEntries) {
+            await validateVendorEntrySource(fileManager, vendorEntry);
+            const payload = await fileManager.readFileBytes(vendorEntry.sourceAbsolutePath);
+            addEntry(pack, vendorEntry.targetRelativePath, vendorEntry.isExecutable, payload);
+        }
+        pack.finalize();
+        return pack;
+    }
+    return {
+        async build(fileDescriptions, vendorEntries = []) {
+            const pack = await createPack(fileDescriptions, vendorEntries);
+            return collectGzippedPack(pack, createGzip({ level: 9 }));
+        }
+    };
+}
 //# sourceMappingURL=tarball-builder.js.map

package/tar/tarball-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"tarball-builder.js","sourceRoot":"","sources":["../../../../source/tar/tarball-builder.ts"],"names":[],"mappings":"AAAA,OAAiB,WAAW,CAAC;AAC7B,OAA+B,YAAY,CAAC;AAG5C,OAA4D,wCAAwC,CAAC;AACrG,OAAmC,mBAAmB,CAAC;AAWvD,MAAM,0BAA0B,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"tarball-builder.js","sourceRoot":"","sources":["../../../../source/tar/tarball-builder.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,EAAE,EAAa,MAAM,YAAY,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAoB,MAAM,wCAAwC,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAWvD,MAAM,0BAA0B,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/C,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,MAAM,UAAU,oBAAoB,CAAC,eAAoD,EAAE;IACvF,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC;IAC9D,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI;QAC5C,KAAK,CAAC,WAAW,CAAC,QAAgB;YAC9B,OAAO,QAAQ,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,aAAa;YACf,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAChG,CAAC;KACJ,CAAC;IAEF,SAAS,QAAQ,CAAC,IAAU,EAAE,QAAgB,EAAE,YAAqB,EAAE,OAAwB;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACpB;YACI,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB;SAClE,EACD,OAAO,CACV,CAAC;QACF,KAAK,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,UAAU,CACrB,gBAA4C,EAC5C,aAAqC;QAErC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAExB,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;QACpG,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,aAAa,EAAE,CAAC;YACtC,MAAM,yBAAyB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;YAChF,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,kBAAkB,EAAE,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEhB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,aAAa,GAAG,EAAE;YAC5C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC/D,OAAO,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;KACJ,CAAC;AACN,CAAC"}

package/vendor-materializer/vendor-entry.d.ts

@@ -0,0 +1,12 @@
+import type { FileManager } from '../file-manager/file-manager.ts';
+export type VendorEntry = {
+    readonly sourceAbsolutePath: string;
+    readonly sourcePackageRootPath: string;
+    readonly targetRelativePath: string;
+    readonly isExecutable: boolean;
+};
+type VendorEntrySourceValidator = Pick<FileManager, 'getRealPath'>;
+export declare function validateVendorEntrySource(validator: VendorEntrySourceValidator, entry: VendorEntry): Promise<void>;
+export declare function applyPrefixToVendorEntry(prefix: string, entry: VendorEntry): VendorEntry;
+export {};
+//# sourceMappingURL=vendor-entry.d.ts.map

package/vendor-materializer/vendor-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor-entry.d.ts","sourceRoot":"","sources":["../../../../source/vendor-materializer/vendor-entry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE,MAAM,MAAM,WAAW,GAAG;IACtB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAClC,CAAC;AAEF,KAAK,0BAA0B,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAOnE,wBAAsB,yBAAyB,CAC3C,SAAS,EAAE,0BAA0B,EACrC,KAAK,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,WAAW,CAOxF"}

package/vendor-materializer/vendor-entry.js

@@ -1,2 +1,21 @@
-import 'node:path';
+import path from 'node:path';
+function isInFolder(folder, candidate) {
+    const relativePath = path.relative(folder, candidate);
+    return !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
+}
+export async function validateVendorEntrySource(validator, entry) {
+    const rootPath = path.resolve(entry.sourcePackageRootPath);
+    const realSourcePath = await validator.getRealPath(entry.sourceAbsolutePath);
+    if (!isInFolder(rootPath, path.resolve(realSourcePath))) {
+        throw new Error(`Vendored file "${entry.sourceAbsolutePath}" resolved outside package root "${entry.sourcePackageRootPath}"`);
+    }
+}
+export function applyPrefixToVendorEntry(prefix, entry) {
+    return {
+        sourceAbsolutePath: entry.sourceAbsolutePath,
+        sourcePackageRootPath: entry.sourcePackageRootPath,
+        targetRelativePath: `${prefix}/${entry.targetRelativePath}`,
+        isExecutable: entry.isExecutable
+    };
+}
 //# sourceMappingURL=vendor-entry.js.map

package/vendor-materializer/vendor-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendor-entry.js","sourceRoot":"","sources":["../../../../source/vendor-materializer/vendor-entry.ts"],"names":[],"mappings":"AAAA,OAAiB,WAAW,CAAC"}
+{"version":3,"file":"vendor-entry.js","sourceRoot":"","sources":["../../../../source/vendor-materializer/vendor-entry.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAY7B,SAAS,UAAU,CAAC,MAAc,EAAE,SAAiB;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,SAAqC,EACrC,KAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACX,kBAAkB,KAAK,CAAC,kBAAkB,oCAAoC,KAAK,CAAC,qBAAqB,GAAG,CAC/G,CAAC;IACN,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,KAAkB;IACvE,OAAO;QACH,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE;QAC3D,YAAY,EAAE,KAAK,CAAC,YAAY;KACnC,CAAC;AACN,CAAC"}