pray-cli 1.9.1 → 1.9.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # CHANGELOG
 
+## 1.9.2 (2026-09-01)
+
+- Align package version with the 1.9.2 release.
+- Reject `.praypkg` members that escape the package root or exceed size limits; unpack through staging into cache.
+- Move login sessions to the user Pray home with owner-only permissions and migrate legacy repository sessions.
+- Reject manifest and federation paths outside their roots; require registry hashes and recheck cached package trees.
+- Bound server requests, connections, timeouts, and federation peers; expose readiness and per-request identifiers.
+- Cap registry downloads at 64 MiB; unpack `.praypkg` tar members without system tar; reject absolute artifact URLs and check a present registry signature.
+- Enforce a measured line-coverage floor in CI.
+
 ## 1.9.1 (2026-08-29)
 
 - Rewrite every matching `pray` line when `pray update --latest` moves a package constraint, keeping indent and extra keywords.

package/dist/archive/path-safety.d.ts

@@ -0,0 +1,2 @@
+export declare function validateArchiveMemberPath(path: string): string;
+//# sourceMappingURL=path-safety.d.ts.map

package/dist/archive/path-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.d.ts","sourceRoot":"","sources":["../../src/archive/path-safety.ts"],"names":[],"mappings":"AAGA,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgB9D"}

package/dist/archive/path-safety.js

@@ -0,0 +1,18 @@
+import { isAbsolute, normalize } from "node:path";
+import { PrayError } from "../errors.js";
+export function validateArchiveMemberPath(path) {
+    const cleaned = path.replace(/^\.\//, "");
+    if (cleaned.length === 0 || isAbsolute(cleaned) || cleaned.startsWith("/")) {
+        throw PrayError.integrity(`package path must be relative: ${path}`);
+    }
+    for (const part of normalize(cleaned).split(/[/\\]/)) {
+        if (part === "" || part === ".") {
+            continue;
+        }
+        if (part === ".." || part.includes("\0")) {
+            throw PrayError.integrity(`package path escapes package root: ${path}`);
+        }
+    }
+    return cleaned;
+}
+//# sourceMappingURL=path-safety.js.map

package/dist/archive/path-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.js","sourceRoot":"","sources":["../../src/archive/path-safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,SAAS,CAAC,SAAS,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,SAAS,CAAC,SAAS,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/archive/praypkg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"praypkg.d.ts","sourceRoot":"","sources":["../../src/archive/praypkg.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,eAAe,GAC5B,MAAM,CAuBR;AAED,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,GACtB,IAAI,CASN;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,MAAM,CAGR;AAED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,eAAe,EAC7B,UAAU,EAAE,MAAM,GACjB,IAAI,CAIN"}
+{"version":3,"file":"praypkg.d.ts","sourceRoot":"","sources":["../../src/archive/praypkg.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAK3D,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,eAAe,GAC5B,MAAM,CAuBR;AAED,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,GACtB,IAAI,CAgBN;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,MAAM,CAGR;AAED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,eAAe,EAC7B,UAAU,EAAE,MAAM,GACjB,IAAI,CAIN"}

package/dist/archive/praypkg.js

@@ -1,9 +1,12 @@
 import { spawnSync } from "node:child_process";
-import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { copyFileSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { PrayError } from "../errors.js";
 import { findPrayspecFile } from "../package-spec/index.js";
+import { MAX_ARCHIVE_TOTAL_BYTES } from "../resource-limits.js";
+import { validateArchiveMemberPath } from "./path-safety.js";
+import { extractTarArchive } from "./tar.js";
 export function buildPackageArchiveBytes(packageEntry) {
     const prayspecPath = findPrayspecFile(packageEntry.root);
     const staging = mkdtempSync(join(tmpdir(), "pray-package-"));
@@ -23,14 +26,15 @@ export function buildPackageArchiveBytes(packageEntry) {
     }
 }
 export function unpackPraypkg(artifactBytes, outputDirectory) {
-    mkdirSync(outputDirectory, { recursive: true });
+    if (artifactBytes.byteLength > MAX_ARCHIVE_TOTAL_BYTES) {
+        throw PrayError.integrity(`package archive exceeds ${MAX_ARCHIVE_TOTAL_BYTES} bytes`);
+    }
     const tarBytes = runCommand("zstd", ["-d", "-q", "-c"], artifactBytes);
-    const result = spawnSync("tar", ["-xf", "-", "-C", outputDirectory], {
-        input: tarBytes,
-    });
-    if (result.status !== 0) {
-        throw PrayError.integrity("failed to unpack package archive");
+    if (tarBytes.byteLength > MAX_ARCHIVE_TOTAL_BYTES) {
+        throw PrayError.integrity(`package archive exceeds ${MAX_ARCHIVE_TOTAL_BYTES} decompressed bytes`);
     }
+    extractTarArchive(tarBytes, outputDirectory);
+    rejectUnsafeExtractedTree(outputDirectory);
 }
 export function packageArchivePath(packageName, version) {
     const slug = packageName.replaceAll("/", "-");
@@ -49,18 +53,40 @@ function packageMetadataJson(packageEntry) {
         exports: packageEntry.selectedExports,
     });
 }
+function rejectUnsafeExtractedTree(outputDirectory) {
+    const stack = [outputDirectory];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (current === undefined) {
+            continue;
+        }
+        for (const entry of readdirSync(current, { withFileTypes: true })) {
+            const fullPath = join(current, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(fullPath);
+                continue;
+            }
+            if (lstatSync(fullPath).isSymbolicLink()) {
+                throw PrayError.integrity("unsupported package archive entry type");
+            }
+            const relative = fullPath.slice(outputDirectory.length + 1);
+            validateArchiveMemberPath(relative);
+        }
+    }
+}
 function runCommand(program, argumentsList, input) {
     const result = spawnSync(program, argumentsList, {
         input,
         encoding: "buffer",
-        maxBuffer: 64 * 1024 * 1024,
+        env: { ...process.env, COPYFILE_DISABLE: "1" },
+        maxBuffer: MAX_ARCHIVE_TOTAL_BYTES,
     });
     if (result.error?.code === "ENOENT") {
         throw PrayError.unsupported(`${program} is required to build or unpack package archives`);
     }
     if (result.status !== 0) {
         const message = result.stderr?.toString("utf8").trim();
-        throw PrayError.integrity(message.length > 0 ? message : `${program} failed`);
+        throw PrayError.integrity(message && message.length > 0 ? message : `${program} failed`);
     }
     return result.stdout;
 }

package/dist/archive/praypkg.js.map

@@ -1 +1 @@
-{"version":3,"file":"praypkg.js","sourceRoot":"","sources":["../../src/archive/praypkg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D,MAAM,UAAU,wBAAwB,CACtC,YAA6B;IAE7B,MAAM,YAAY,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,aAAa,CACX,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAC9B,mBAAmB,CAAC,YAAY,CAAC,EACjC,MAAM,CACP,CAAC;QACF,aAAa,CACX,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,EACrC,YAAY,CAAC,YAAY,CAAC,CAC3B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,aAAqB,EACrB,eAAuB;IAEvB,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE;QACnE,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,OAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,OAAO,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAA6B,EAC7B,UAAkB;IAElB,MAAM,KAAK,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;IACrD,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,YAA6B;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI;QAC5B,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO;QAClC,SAAS,EAAE,YAAY,CAAC,QAAQ;QAChC,OAAO,EAAE,YAAY,CAAC,eAAe;KACtC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,OAAe,EACf,aAAuB,EACvB,KAAc;IAEd,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE;QAC/C,KAAK;QACL,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,IAAK,MAAM,CAAC,KAA2C,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,SAAS,CAAC,WAAW,CACzB,GAAG,OAAO,kDAAkD,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,SAAS,CAAC,SAAS,CACvB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,SAAS,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAgB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"praypkg.js","sourceRoot":"","sources":["../../src/archive/praypkg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,SAAS,EACT,SAAS,EACT,WAAW,EACX,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,UAAU,wBAAwB,CACtC,YAA6B;IAE7B,MAAM,YAAY,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,aAAa,CACX,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAC9B,mBAAmB,CAAC,YAAY,CAAC,EACjC,MAAM,CACP,CAAC;QACF,aAAa,CACX,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,EACrC,YAAY,CAAC,YAAY,CAAC,CAC3B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,aAAqB,EACrB,eAAuB;IAEvB,IAAI,aAAa,CAAC,UAAU,GAAG,uBAAuB,EAAE,CAAC;QACvD,MAAM,SAAS,CAAC,SAAS,CACvB,2BAA2B,uBAAuB,QAAQ,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,UAAU,GAAG,uBAAuB,EAAE,CAAC;QAClD,MAAM,SAAS,CAAC,SAAS,CACvB,2BAA2B,uBAAuB,qBAAqB,CACxE,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7C,yBAAyB,CAAC,eAAe,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,OAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,OAAO,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAA6B,EAC7B,UAAkB;IAElB,MAAM,KAAK,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;IACrD,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,YAA6B;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI;QAC5B,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO;QAClC,SAAS,EAAE,YAAY,CAAC,QAAQ;QAChC,OAAO,EAAE,YAAY,CAAC,eAAe;KACtC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,eAAuB;IACxD,MAAM,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBACzC,MAAM,SAAS,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5D,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,OAAe,EACf,aAAuB,EACvB,KAAc;IAEd,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE;QAC/C,KAAK;QACL,QAAQ,EAAE,QAAQ;QAClB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE;QAC9C,SAAS,EAAE,uBAAuB;KACnC,CAAC,CAAC;IACH,IAAK,MAAM,CAAC,KAA2C,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,SAAS,CAAC,WAAW,CACzB,GAAG,OAAO,kDAAkD,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,SAAS,CAAC,SAAS,CACvB,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,SAAS,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAgB,CAAC;AACjC,CAAC"}

package/dist/archive/tar.d.ts

@@ -0,0 +1,3 @@
+export declare function validateTarArchive(bytes: Buffer): void;
+export declare function extractTarArchive(bytes: Buffer, outputDirectory: string): void;
+//# sourceMappingURL=tar.d.ts.map

package/dist/archive/tar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.d.ts","sourceRoot":"","sources":["../../src/archive/tar.ts"],"names":[],"mappings":"AAYA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEtD;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,GACtB,IAAI,CAGN"}

package/dist/archive/tar.js

@@ -0,0 +1,157 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { PrayError } from "../errors.js";
+import { MAX_ARCHIVE_ENTRIES, MAX_ARCHIVE_ENTRY_BYTES, MAX_ARCHIVE_TOTAL_BYTES, } from "../resource-limits.js";
+import { validateArchiveMemberPath } from "./path-safety.js";
+const TAR_BLOCK_BYTES = 512;
+export function validateTarArchive(bytes) {
+    walkTarArchive(bytes);
+}
+export function extractTarArchive(bytes, outputDirectory) {
+    mkdirSync(outputDirectory, { recursive: true });
+    walkTarArchive(bytes, outputDirectory);
+}
+function walkTarArchive(bytes, outputDirectory) {
+    const paths = new Set();
+    let offset = 0;
+    let entryCount = 0;
+    let totalBytes = 0;
+    let pendingPath;
+    while (offset + TAR_BLOCK_BYTES <= bytes.length) {
+        const header = bytes.subarray(offset, offset + TAR_BLOCK_BYTES);
+        if (header.every((byte) => byte === 0))
+            return;
+        verifyChecksum(header);
+        const size = parseOctal(header.subarray(124, 136), "entry size");
+        const dataStart = offset + TAR_BLOCK_BYTES;
+        const dataEnd = dataStart + size;
+        if (dataEnd > bytes.length) {
+            throw PrayError.integrity("truncated package archive entry");
+        }
+        const type = String.fromCharCode(header[156] ?? 0);
+        const data = bytes.subarray(dataStart, dataEnd);
+        if (type === "x") {
+            pendingPath = paxPath(data);
+        }
+        else if (type === "L") {
+            pendingPath = cString(data).replace(/\n$/, "");
+        }
+        else {
+            const rawPath = pendingPath ?? tarHeaderPath(header);
+            pendingPath = undefined;
+            if (type === "5" && (rawPath === "." || rawPath === "./")) {
+                offset =
+                    dataStart + Math.ceil(size / TAR_BLOCK_BYTES) * TAR_BLOCK_BYTES;
+                continue;
+            }
+            const path = validateArchiveMemberPath(rawPath);
+            if (basenameStartsWithAppleDouble(path)) {
+                offset =
+                    dataStart + Math.ceil(size / TAR_BLOCK_BYTES) * TAR_BLOCK_BYTES;
+                continue;
+            }
+            if (type === "5") {
+                if (outputDirectory !== undefined) {
+                    mkdirSync(extractedDestination(outputDirectory, path), {
+                        recursive: true,
+                    });
+                }
+            }
+            else {
+                if (type !== "0" && type !== "\0") {
+                    throw PrayError.integrity("unsupported package archive entry type");
+                }
+                entryCount += 1;
+                if (entryCount > MAX_ARCHIVE_ENTRIES) {
+                    throw PrayError.integrity(`package archive exceeds ${MAX_ARCHIVE_ENTRIES} entries`);
+                }
+                if (paths.has(path)) {
+                    throw PrayError.integrity(`duplicate package archive path: ${path}`);
+                }
+                paths.add(path);
+                if (size > MAX_ARCHIVE_ENTRY_BYTES) {
+                    throw PrayError.integrity(`package archive entry exceeds ${MAX_ARCHIVE_ENTRY_BYTES} bytes: ${path}`);
+                }
+                totalBytes += size;
+                if (totalBytes > MAX_ARCHIVE_TOTAL_BYTES) {
+                    throw PrayError.integrity(`package archive exceeds ${MAX_ARCHIVE_TOTAL_BYTES} decompressed bytes`);
+                }
+                if (outputDirectory !== undefined) {
+                    const destination = extractedDestination(outputDirectory, path);
+                    mkdirSync(dirname(destination), { recursive: true });
+                    writeFileSync(destination, data, { flag: "wx" });
+                }
+            }
+        }
+        offset = dataStart + Math.ceil(size / TAR_BLOCK_BYTES) * TAR_BLOCK_BYTES;
+    }
+    throw PrayError.integrity("package archive is missing its end marker");
+}
+function extractedDestination(outputDirectory, path) {
+    const destination = join(outputDirectory, path);
+    if (destination !== outputDirectory &&
+        !destination.startsWith(`${outputDirectory}/`) &&
+        !destination.startsWith(`${outputDirectory}\\`)) {
+        throw PrayError.integrity(`package path escapes package root: ${path}`);
+    }
+    return destination;
+}
+function basenameStartsWithAppleDouble(path) {
+    const parts = path.split(/[/\\]/);
+    const basename = parts[parts.length - 1] ?? "";
+    return basename.startsWith("._");
+}
+function verifyChecksum(header) {
+    const stored = parseOctal(header.subarray(148, 154), "checksum");
+    let sum = 0;
+    for (let index = 0; index < header.length; index += 1) {
+        sum += index >= 148 && index < 156 ? 32 : (header[index] ?? 0);
+    }
+    if (sum !== stored) {
+        throw PrayError.integrity("invalid package archive checksum");
+    }
+}
+function tarHeaderPath(header) {
+    const name = cString(header.subarray(0, 100));
+    const prefix = cString(header.subarray(345, 500));
+    return prefix.length > 0 ? `${prefix}/${name}` : name;
+}
+function cString(bytes) {
+    const end = bytes.indexOf(0);
+    return new TextDecoder("utf-8", { fatal: true }).decode(end >= 0 ? bytes.subarray(0, end) : bytes);
+}
+function parseOctal(bytes, label) {
+    const value = cString(bytes).trim();
+    if (!/^[0-7]+$/.test(value)) {
+        throw PrayError.integrity(`invalid package archive ${label}`);
+    }
+    const parsed = Number.parseInt(value, 8);
+    if (!Number.isSafeInteger(parsed)) {
+        throw PrayError.integrity(`invalid package archive ${label}`);
+    }
+    return parsed;
+}
+function paxPath(data) {
+    let cursor = 0;
+    let path;
+    while (cursor < data.length) {
+        const separator = data.indexOf(0x20, cursor);
+        const length = Number.parseInt(data.subarray(cursor, separator).toString("ascii"), 10);
+        const recordEnd = cursor + length;
+        if (separator < 0 ||
+            !Number.isSafeInteger(length) ||
+            length <= 0 ||
+            recordEnd > data.length) {
+            throw PrayError.integrity("invalid package archive pax header");
+        }
+        const record = data.subarray(separator + 1, recordEnd - 1);
+        const equals = record.indexOf(0x3d);
+        const key = equals < 0 ? "" : record.subarray(0, equals).toString("ascii");
+        if (key === "path") {
+            path = new TextDecoder("utf-8", { fatal: true }).decode(record.subarray(equals + 1));
+        }
+        cursor = recordEnd;
+    }
+    return path;
+}
+//# sourceMappingURL=tar.js.map

package/dist/archive/tar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.js","sourceRoot":"","sources":["../../src/archive/tar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,cAAc,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,eAAuB;IAEvB,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,eAAwB;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAA+B,CAAC;IAEpC,OAAO,MAAM,GAAG,eAAe,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO;QAC/C,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,GAAG,eAAe,CAAC;QAC3C,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;QACjC,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,SAAS,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,WAAW,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;YACrD,WAAW,GAAG,SAAS,CAAC;YACxB,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC1D,MAAM;oBACJ,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,GAAG,eAAe,CAAC;gBAClE,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,MAAM;oBACJ,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,GAAG,eAAe,CAAC;gBAClE,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;oBAClC,SAAS,CAAC,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE;wBACrD,SAAS,EAAE,IAAI;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClC,MAAM,SAAS,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;gBACtE,CAAC;gBACD,UAAU,IAAI,CAAC,CAAC;gBAChB,IAAI,UAAU,GAAG,mBAAmB,EAAE,CAAC;oBACrC,MAAM,SAAS,CAAC,SAAS,CACvB,2BAA2B,mBAAmB,UAAU,CACzD,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpB,MAAM,SAAS,CAAC,SAAS,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,IAAI,IAAI,GAAG,uBAAuB,EAAE,CAAC;oBACnC,MAAM,SAAS,CAAC,SAAS,CACvB,iCAAiC,uBAAuB,WAAW,IAAI,EAAE,CAC1E,CAAC;gBACJ,CAAC;gBACD,UAAU,IAAI,IAAI,CAAC;gBACnB,IAAI,UAAU,GAAG,uBAAuB,EAAE,CAAC;oBACzC,MAAM,SAAS,CAAC,SAAS,CACvB,2BAA2B,uBAAuB,qBAAqB,CACxE,CAAC;gBACJ,CAAC;gBACD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,WAAW,GAAG,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;oBAChE,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBACrD,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,GAAG,eAAe,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,eAAuB,EAAE,IAAY;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAChD,IACE,WAAW,KAAK,eAAe;QAC/B,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,eAAe,GAAG,CAAC;QAC9C,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,eAAe,IAAI,CAAC,EAC/C,CAAC;QACD,MAAM,SAAS,CAAC,SAAS,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,6BAA6B,CAAC,IAAY;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,SAAS,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CACrD,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,KAAa;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,CAAC,SAAS,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,SAAS,CAAC,SAAS,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAwB,CAAC;IAC7B,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAClD,EAAE,CACH,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;QAClC,IACE,SAAS,GAAG,CAAC;YACb,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;YAC7B,MAAM,IAAI,CAAC;YACX,SAAS,GAAG,IAAI,CAAC,MAAM,EACvB,CAAC;YACD,MAAM,SAAS,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CACrD,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAC5B,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/session.d.ts

@@ -5,7 +5,7 @@ export interface SessionFile {
     kind: string;
     signer_fingerprint?: string;
 }
-export declare function sessionFilePath(root: string): string;
+export declare function sessionFilePath(_root: string): string;
 export declare function persistSession(root: string, session: SessionFile): SessionFile;
 export declare function loadSessions(path: string): SessionFile[] | undefined;
 //# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAQD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,GACnB,WAAW,CAgBb;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,GAAG,SAAS,CAcpE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAQD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,GACnB,WAAW,CAiBb;AA2BD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,GAAG,SAAS,CAcpE"}

package/dist/auth/session.js

@@ -1,12 +1,14 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
 import { PrayError } from "../errors.js";
-export function sessionFilePath(root) {
-    return join(root, ".pray", "session.json");
+import { trustHome } from "../trust/store.js";
+export function sessionFilePath(_root) {
+    return join(trustHome(), "session.json");
 }
 export function persistSession(root, session) {
     const path = sessionFilePath(root);
     mkdirSync(join(path, ".."), { recursive: true });
+    migrateLegacySession(root, path);
     const sessions = loadSessions(path) ?? [];
     const existingIndex = sessions.findIndex((entry) => entry.server_url === session.server_url);
     if (existingIndex >= 0) {
@@ -16,9 +18,32 @@ export function persistSession(root, session) {
         sessions.push(session);
     }
     const document = sessions.length === 1 ? sessions[0] : { sessions };
-    writeFileSync(path, `${JSON.stringify(document, null, 2)}\n`, "utf8");
+    writeSessionDocument(path, document);
     return session;
 }
+function migrateLegacySession(root, path) {
+    const legacyPath = join(root, ".pray", "session.json");
+    if (!existsSync(legacyPath) || legacyPath === path)
+        return;
+    const sessions = loadSessions(path) ?? [];
+    for (const legacy of loadSessions(legacyPath) ?? []) {
+        if (!sessions.some((entry) => entry.server_url === legacy.server_url)) {
+            sessions.push(legacy);
+        }
+    }
+    const document = sessions.length === 1 ? sessions[0] : { sessions };
+    writeSessionDocument(path, document);
+    rmSync(legacyPath);
+}
+function writeSessionDocument(path, document) {
+    const temporaryPath = `${path}.tmp-${process.pid}`;
+    writeFileSync(temporaryPath, `${JSON.stringify(document, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    chmodSync(temporaryPath, 0o600);
+    renameSync(temporaryPath, path);
+}
 export function loadSessions(path) {
     if (!existsSync(path)) {
         return undefined;

package/dist/auth/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAgBzC,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,OAAoB;IAEpB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CACnD,CAAC;IACF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GACZ,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;QAC3E,IAAI,UAAU,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,QAAuB,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAgB9C,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,cAAc,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,OAAoB;IAEpB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CACnD,CAAC;IACF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GACZ,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtD,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO;IAC3D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GACZ,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtD,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAAyB;IACnE,MAAM,aAAa,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,aAAa,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACrE,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAChC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;QAC3E,IAAI,UAAU,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,QAAuB,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/http/body.d.ts

@@ -0,0 +1,2 @@
+export declare function readBoundedHttpBody(response: Response, maxBytes?: number): Promise<Buffer>;
+//# sourceMappingURL=body.d.ts.map

package/dist/http/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../src/http/body.ts"],"names":[],"mappings":"AAGA,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAAgC,GACzC,OAAO,CAAC,MAAM,CAAC,CA8BjB"}

package/dist/http/body.js

@@ -0,0 +1,32 @@
+import { PrayError } from "../errors.js";
+import { MAX_HTTP_RESPONSE_BYTES } from "../resource-limits.js";
+export async function readBoundedHttpBody(response, maxBytes = MAX_HTTP_RESPONSE_BYTES) {
+    const declared = response.headers.get("content-length");
+    if (declared !== null) {
+        const length = Number(declared);
+        if (Number.isFinite(length) && length > maxBytes) {
+            throw PrayError.resolution(`HTTP response exceeds ${maxBytes} bytes`);
+        }
+    }
+    if (response.body === null) {
+        return Buffer.alloc(0);
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let length = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        const bytes = Buffer.from(value);
+        length += bytes.byteLength;
+        if (length > maxBytes) {
+            await reader.cancel();
+            throw PrayError.resolution(`HTTP response exceeds ${maxBytes} bytes`);
+        }
+        chunks.push(bytes);
+    }
+    return Buffer.concat(chunks, length);
+}
+//# sourceMappingURL=body.js.map

package/dist/http/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../src/http/body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAkB,EAClB,WAAmB,uBAAuB;IAE1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YACjD,MAAM,SAAS,CAAC,UAAU,CAAC,yBAAyB,QAAQ,QAAQ,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;QAC3B,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YACtB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,SAAS,CAAC,UAAU,CAAC,yBAAyB,QAAQ,QAAQ,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC"}

package/dist/http/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAEA,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9D;AAED,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAGA,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9D;AAED,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/http/client.js

@@ -1,10 +1,11 @@
 import { PrayError } from "../errors.js";
+import { readBoundedHttpBody } from "./body.js";
 export async function httpGet(url) {
     const response = await fetch(url);
     if (!response.ok) {
         throw PrayError.resolution(`HTTP request failed for ${url}: ${response.status}`);
     }
-    return Buffer.from(await response.arrayBuffer());
+    return readBoundedHttpBody(response);
 }
 export async function httpGetText(url) {
     return (await httpGet(url)).toString("utf8");
@@ -28,7 +29,7 @@ export async function httpPostJson(url, contentType, body) {
         headers: { "Content-Type": contentType },
         body: typeof body === "string" ? body : new Uint8Array(body),
     });
-    const responseBody = Buffer.from(await response.arrayBuffer());
+    const responseBody = await readBoundedHttpBody(response);
     if (!response.ok) {
         throw PrayError.resolution(`HTTP request failed for ${url}: ${response.status}: ${responseBody.toString("utf8")}`);
     }

package/dist/http/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,CAAC,UAAU,CACxB,2BAA2B,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,WAAmB,EACnB,IAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,CAAC,UAAU,CACxB,0BAA0B,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,WAAmB,EACnB,IAAqB;IAErB,MAAM,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,WAAmB,EACnB,IAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,CAAC,UAAU,CACxB,2BAA2B,GAAG,KAAK,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAY;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,CACL,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/B,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC;QACnC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,CAAC,UAAU,CACxB,2BAA2B,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,WAAmB,EACnB,IAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,CAAC,UAAU,CACxB,0BAA0B,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,WAAmB,EACnB,IAAqB;IAErB,MAAM,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,WAAmB,EACnB,IAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,CAAC,UAAU,CACxB,2BAA2B,GAAG,KAAK,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAY;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,CACL,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/B,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC;QACnC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC"}

package/dist/lockfile/types.d.ts

@@ -44,6 +44,6 @@ export interface Lockfile {
     managed_span: ManagedSpanRecord[];
 }
 export declare function canonicalLockfile(lockfile: Lockfile): Lockfile;
-export declare const PACKAGE_VERSION = "1.9.1";
-export declare const GENERATED_BY = "pray 1.9.1 (typescript)";
+export declare const PACKAGE_VERSION = "1.9.2";
+export declare const GENERATED_BY = "pray 1.9.2 (typescript)";
 //# sourceMappingURL=types.d.ts.map

package/dist/lockfile/types.js

@@ -11,6 +11,6 @@ export function canonicalLockfile(lockfile) {
             left.id.localeCompare(right.id)),
     };
 }
-export const PACKAGE_VERSION = "1.9.1";
+export const PACKAGE_VERSION = "1.9.2";
 export const GENERATED_BY = `pray ${PACKAGE_VERSION} (typescript)`;
 //# sourceMappingURL=types.js.map

package/dist/manifest/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/manifest/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EAEnB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AAEpB,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAiB7D;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAEpD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAGvD;AAED,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/manifest/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EAEnB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AAGpB,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAiB7D;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAIpD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAGvD;AAED,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,CAAC"}

package/dist/manifest/index.js

@@ -3,6 +3,7 @@ import { PrayError } from "../errors.js";
 import { sha256Prefixed } from "../hashing.js";
 import { parseManifestText } from "./parser.js";
 import { canonicalManifest, defaultRenderPolicy, manifestToJson, } from "./types.js";
+import { validateManifestPaths } from "./validate.js";
 export function readManifestText(manifestPath) {
     try {
         return readFileSync(manifestPath, "utf8");
@@ -19,7 +20,9 @@ export function readManifestText(manifestPath) {
     }
 }
 export function parseManifest(text) {
-    return parseManifestText(text);
+    const manifest = parseManifestText(text);
+    validateManifestPaths(manifest);
+    return manifest;
 }
 export function manifestHash(manifest) {
     const bytes = Buffer.from(JSON.stringify(manifestToJson(manifest)), "utf8");

package/dist/manifest/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/manifest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EAMnB,cAAc,GAEf,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;YACD,MAAM,SAAS,CAAC,QAAQ,CACtB,WAAW,YAAY,+BAA+B,CACvD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EAEjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAOpB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/manifest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EAMnB,cAAc,GAEf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;YACD,MAAM,SAAS,CAAC,QAAQ,CACtB,WAAW,YAAY,+BAA+B,CACvD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EAEjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAOpB,CAAC"}

package/dist/manifest/validate.d.ts

@@ -0,0 +1,4 @@
+import type { Manifest } from "./types.js";
+export declare function validateManifestPaths(manifest: Manifest): void;
+export declare function validateProjectRelativePath(value: string): string;
+//# sourceMappingURL=validate.d.ts.map

package/dist/manifest/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/manifest/validate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAgB9D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBjE"}

package/dist/manifest/validate.js

@@ -0,0 +1,37 @@
+import { isAbsolute, win32 } from "node:path";
+import { PrayError } from "../errors.js";
+export function validateManifestPaths(manifest) {
+    for (const target of manifest.targets) {
+        for (const path of [
+            ...target.outputs,
+            ...target.skills,
+            ...target.commands,
+            ...target.rules,
+        ]) {
+            validateProjectRelativePath(path);
+        }
+    }
+    for (const packageEntry of manifest.packages) {
+        if (packageEntry.path)
+            validateProjectRelativePath(packageEntry.path);
+        if (packageEntry.file)
+            validateProjectRelativePath(packageEntry.file);
+    }
+    for (const local of manifest.local)
+        validateProjectRelativePath(local.path);
+}
+export function validateProjectRelativePath(value) {
+    const path = value.trim();
+    if (path.length === 0 || isAbsolute(path) || win32.isAbsolute(path)) {
+        throw PrayError.manifest(`project path must be repository-relative: ${value}`);
+    }
+    const parts = path.replaceAll("\\", "/").split("/");
+    if (parts.includes("..") || path.includes("\0")) {
+        throw PrayError.manifest(`project path escapes repository root: ${value}`);
+    }
+    if (parts.every((part) => part.length === 0 || part === ".")) {
+        throw PrayError.manifest(`project path must be repository-relative: ${value}`);
+    }
+    return path;
+}
+//# sourceMappingURL=validate.js.map

package/dist/manifest/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/manifest/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,MAAM,UAAU,qBAAqB,CAAC,QAAkB;IACtD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI;YACjB,GAAG,MAAM,CAAC,OAAO;YACjB,GAAG,MAAM,CAAC,MAAM;YAChB,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,MAAM,CAAC,KAAK;SAChB,EAAE,CAAC;YACF,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC7C,IAAI,YAAY,CAAC,IAAI;YAAE,2BAA2B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,YAAY,CAAC,IAAI;YAAE,2BAA2B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK;QAAE,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,SAAS,CAAC,QAAQ,CACtB,6CAA6C,KAAK,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,CAAC,QAAQ,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,CAAC,QAAQ,CACtB,6CAA6C,KAAK,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/registry/cache.d.ts

@@ -0,0 +1,2 @@
+export declare function registryCacheDirectory(projectRoot: string, sourceKey: string, packageName: string, version: string, artifactHash?: string): string;
+//# sourceMappingURL=cache.d.ts.map