swarm-deploy 0.0.0 → 0.1.0

package/dist/tar-protocol/extract.js

@@ -0,0 +1,124 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAndExtractTar = validateAndExtractTar;
+const b4a_1 = __importDefault(require("b4a"));
+const abort_js_1 = require("../abort.js");
+const errors_js_1 = require("../errors.js");
+const controls_js_1 = require("./controls.js");
+const hash_js_1 = require("./hash.js");
+const ustar_js_1 = require("./ustar.js");
+const EMPTY = b4a_1.default.alloc(0);
+function invalid(message, cause = null) {
+    return new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.PROTOCOL_INVALID, message, cause);
+}
+/**
+ * Validates a deterministic single-entry TAR stream and yields its payload.
+ *
+ * Because every byte outside the payload is fixed by the offered metadata, the
+ * whole stream can be checked by comparison: the header must equal the one
+ * canonical block, and everything after the payload must be zero. A stream that
+ * survives that is, by construction, one entry whose bytes are exactly
+ * `tar[512 .. 512 + fileSize)`, so no TAR parser is needed to extract it.
+ */
+class CanonicalTarReader {
+    metadata;
+    header;
+    position = 0;
+    constructor(metadata) {
+        this.metadata = metadata;
+        this.header = (0, ustar_js_1.canonicalUstarHeader)(metadata.name, metadata.fileSize);
+    }
+    /** Checks `chunk` in place and returns the slice of it that is file payload. */
+    write(chunk) {
+        const base = this.position;
+        if (base > this.metadata.tarSize - chunk.byteLength) {
+            throw invalid('Trailing TAR payload');
+        }
+        const contentEnd = ustar_js_1.TAR_BLOCK_BYTES + this.metadata.fileSize;
+        for (let index = 0; index < chunk.byteLength; index++) {
+            const absolute = base + index;
+            if (absolute < ustar_js_1.TAR_BLOCK_BYTES) {
+                if (chunk[index] !== this.header[absolute])
+                    throw invalid('Noncanonical TAR header');
+                continue;
+            }
+            if (absolute >= contentEnd && chunk[index] !== 0) {
+                throw invalid('Nonzero TAR padding or terminator');
+            }
+        }
+        this.position = base + chunk.byteLength;
+        // Payload occupies absolute offsets [512, 512 + fileSize); clip the chunk
+        // to that window and translate back to chunk-relative indices.
+        const start = Math.max(base, ustar_js_1.TAR_BLOCK_BYTES);
+        const end = Math.min(this.position, contentEnd);
+        return end <= start ? EMPTY : chunk.subarray(start - base, end - base);
+    }
+    finish() {
+        if (this.position !== this.metadata.tarSize)
+            throw invalid('Truncated TAR payload');
+    }
+}
+function assertStaging(staging) {
+    if (!staging ||
+        typeof staging !== 'object' ||
+        typeof staging.writeTar !== 'function' ||
+        typeof staging.writeFile !== 'function' ||
+        typeof staging.complete !== 'function' ||
+        typeof staging.abort !== 'function') {
+        throw invalid('Invalid TAR extraction staging interface');
+    }
+}
+async function validateAndExtractTar(source, offeredMetadata, staging, { signal = null } = {}) {
+    assertStaging(staging);
+    const metadata = (0, controls_js_1.decodeMetadataRecord)((0, controls_js_1.encodeMetadataRecord)(offeredMetadata));
+    const expectedFileDigest = b4a_1.default.from(metadata.fileSha256, 'hex');
+    const expectedTarDigest = b4a_1.default.from(metadata.tarSha256, 'hex');
+    const reader = new CanonicalTarReader(metadata);
+    const fileHash = new hash_js_1.SodiumSha256();
+    const tarHash = new hash_js_1.SodiumSha256();
+    let extractedBytes = 0;
+    try {
+        (0, abort_js_1.throwIfAborted)(signal);
+        for await (const value of source) {
+            (0, abort_js_1.throwIfAborted)(signal);
+            if (!b4a_1.default.isBuffer(value))
+                throw invalid('Invalid TAR source bytes');
+            const payload = reader.write(value);
+            tarHash.update(value);
+            await staging.writeTar(value);
+            if (payload.byteLength > 0) {
+                extractedBytes += payload.byteLength;
+                fileHash.update(payload);
+                await staging.writeFile(payload);
+            }
+        }
+        reader.finish();
+        if (extractedBytes !== metadata.fileSize)
+            throw invalid('Extracted file size mismatch');
+        const fileSha256 = fileHash.digest();
+        const tarSha256 = tarHash.digest();
+        if (!(0, hash_js_1.digestMatches)(fileSha256, expectedFileDigest)) {
+            throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.CHECKSUM_MISMATCH, 'Extracted file digest mismatch');
+        }
+        if (!(0, hash_js_1.digestMatches)(tarSha256, expectedTarDigest)) {
+            throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.CHECKSUM_MISMATCH, 'TAR digest mismatch');
+        }
+        await staging.complete();
+        return {
+            fileSize: extractedBytes,
+            fileSha256,
+            tarSize: metadata.tarSize,
+            tarSha256
+        };
+    }
+    catch (error) {
+        await Promise.resolve(staging.abort(error)).catch(() => { });
+        if (error instanceof errors_js_1.SwarmDeployError)
+            throw error;
+        throw invalid('TAR extraction failed', error);
+    }
+}
+//# sourceMappingURL=extract.js.map

package/dist/tar-protocol/extract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/tar-protocol/extract.ts"],"names":[],"mappings":";;;;;;AAAA,8CAAqB;AACrB,0CAAkE;AAClE,4CAAuD;AACvD,+CAA+F;AAC/F,uCAAuD;AACvD,yCAAkE;AAoBlE,MAAM,KAAK,GAAG,aAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAE1B,SAAS,OAAO,CAAC,OAAe,EAAE,KAAK,GAAY,IAAI;IACrD,OAAO,IAAI,4BAAgB,CAAC,kBAAM,CAAC,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,kBAAkB;IACL,QAAQ,CAAgB;IACxB,MAAM,CAAQ;IACvB,QAAQ,GAAG,CAAC,CAAA;IAEpB,YAAY,QAAwB;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,IAAA,+BAAoB,EAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACtE,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,KAAiB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC1B,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAA;QACvC,CAAC;QACD,MAAM,UAAU,GAAG,0BAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAA;QAC3D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAA;YAC7B,IAAI,QAAQ,GAAG,0BAAe,EAAE,CAAC;gBAC/B,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAAE,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAA;gBACpF,SAAQ;YACV,CAAC;YACD,IAAI,QAAQ,IAAI,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,CAAC,mCAAmC,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC,UAAU,CAAA;QAEvC,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,0BAAe,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAC/C,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAA;IACxE,CAAC;IAED,MAAM;QACJ,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACrF,CAAC;CACF;AAED,SAAS,aAAa,CAAC,OAA6B;IAClD,IACE,CAAC,OAAO;QACR,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU;QACtC,OAAO,OAAO,CAAC,SAAS,KAAK,UAAU;QACvC,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU;QACtC,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EACnC,CAAC;QACD,MAAM,OAAO,CAAC,0CAA0C,CAAC,CAAA;IAC3D,CAAC;AACH,CAAC;AAEM,KAAK,gCACV,MAAwD,EACxD,eAA+B,EAC/B,OAA6B,EAC7B,EAAE,MAAM,GAAG,IAAI,EAAE,GAAyB,EAAE;IAE5C,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,MAAM,QAAQ,GAAG,IAAA,kCAAoB,EAAC,IAAA,kCAAoB,EAAC,eAAe,CAAC,CAAC,CAAA;IAC5E,MAAM,kBAAkB,GAAG,aAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC/D,MAAM,iBAAiB,GAAG,aAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,IAAI,sBAAY,EAAE,CAAA;IACnC,MAAM,OAAO,GAAG,IAAI,sBAAY,EAAE,CAAA;IAClC,IAAI,cAAc,GAAG,CAAC,CAAA;IAEtB,IAAI,CAAC;QACH,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAA;QACtB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACjC,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAA;YACtB,IAAI,CAAC,aAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;YACnE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBAC3B,cAAc,IAAI,OAAO,CAAC,UAAU,CAAA;gBACpC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACxB,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,CAAA;QACf,IAAI,cAAc,KAAK,QAAQ,CAAC,QAAQ;YAAE,MAAM,OAAO,CAAC,8BAA8B,CAAC,CAAA;QAEvF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAA;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;QAClC,IAAI,CAAC,IAAA,uBAAa,EAAC,UAAU,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,4BAAgB,CAAC,kBAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAA;QACxF,CAAC;QACD,IAAI,CAAC,IAAA,uBAAa,EAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,4BAAgB,CAAC,kBAAM,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAA;QAC7E,CAAC;QACD,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAA;QACxB,OAAO;YACL,QAAQ,EAAE,cAAc;YACxB,UAAU;YACV,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS;SACV,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3D,IAAI,KAAK,YAAY,4BAAgB;YAAE,MAAM,KAAK,CAAA;QAClD,MAAM,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC"}

package/dist/tar-protocol/hash.d.ts

@@ -0,0 +1,10 @@
+export declare const SHA256_BYTES = 32;
+export declare class SodiumSha256 {
+    private readonly state;
+    private finished;
+    constructor();
+    update(bytes: Uint8Array): this;
+    digest(): Buffer;
+}
+export declare function sodiumSha256(bytes: Uint8Array): Buffer;
+export declare function digestMatches(actual: Uint8Array, expected: Uint8Array): boolean;

package/dist/tar-protocol/hash.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SodiumSha256 = exports.SHA256_BYTES = void 0;
+exports.sodiumSha256 = sodiumSha256;
+exports.digestMatches = digestMatches;
+const b4a_1 = __importDefault(require("b4a"));
+const sodium_native_1 = __importDefault(require("sodium-native"));
+exports.SHA256_BYTES = 32;
+class SodiumSha256 {
+    state = b4a_1.default.alloc(sodium_native_1.default.crypto_hash_sha256_STATEBYTES);
+    finished = false;
+    constructor() {
+        sodium_native_1.default.crypto_hash_sha256_init(this.state);
+    }
+    update(bytes) {
+        if (this.finished)
+            throw new Error('SHA-256 state is finalized');
+        sodium_native_1.default.crypto_hash_sha256_update(this.state, bytes);
+        return this;
+    }
+    digest() {
+        if (this.finished)
+            throw new Error('SHA-256 state is finalized');
+        this.finished = true;
+        const digest = b4a_1.default.alloc(exports.SHA256_BYTES);
+        sodium_native_1.default.crypto_hash_sha256_final(this.state, digest);
+        return digest;
+    }
+}
+exports.SodiumSha256 = SodiumSha256;
+function sodiumSha256(bytes) {
+    const digest = b4a_1.default.alloc(exports.SHA256_BYTES);
+    sodium_native_1.default.crypto_hash_sha256(digest, bytes);
+    return digest;
+}
+function digestMatches(actual, expected) {
+    return (actual.byteLength === exports.SHA256_BYTES &&
+        expected.byteLength === exports.SHA256_BYTES &&
+        sodium_native_1.default.sodium_memcmp(actual, expected));
+}
+//# sourceMappingURL=hash.js.map

package/dist/tar-protocol/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/tar-protocol/hash.ts"],"names":[],"mappings":";;;;;;;;AAAA,8CAAqB;AACrB,kEAAkC;AAErB,QAAA,YAAY,GAAG,EAAE,CAAA;AAE9B;IACmB,KAAK,GAAG,aAAG,CAAC,KAAK,CAAC,uBAAM,CAAC,6BAA6B,CAAC,CAAA;IAChE,QAAQ,GAAG,KAAK,CAAA;IAExB;QACE,uBAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,CAAC,KAAiB;QACtB,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAChE,uBAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM;QACJ,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAChE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,MAAM,MAAM,GAAG,aAAG,CAAC,KAAK,CAAC,QAAA,YAAY,CAAC,CAAA;QACtC,uBAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACnD,OAAO,MAAM,CAAA;IACf,CAAC;CACF;;AAED,sBAA6B,KAAiB;IAC5C,MAAM,MAAM,GAAG,aAAG,CAAC,KAAK,CAAC,QAAA,YAAY,CAAC,CAAA;IACtC,uBAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACxC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,uBAA8B,MAAkB,EAAE,QAAoB;IACpE,OAAO,CACL,MAAM,CAAC,UAAU,KAAK,QAAA,YAAY;QAClC,QAAQ,CAAC,UAAU,KAAK,QAAA,YAAY;QACpC,uBAAM,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CACvC,CAAA;AACH,CAAC"}

package/dist/tar-protocol/lifecycle.d.ts

@@ -0,0 +1,13 @@
+import { type AbortSignalLike } from '../abort.js';
+export interface ProtocolWritable {
+    write(bytes: Uint8Array): boolean;
+    on(event: string, listener: (...args: unknown[]) => void): this;
+    removeListener(event: string, listener: (...args: unknown[]) => void): this;
+    destroy(error?: unknown): void;
+}
+export interface ProtocolWriteOptions {
+    signal?: AbortSignalLike | null;
+    timeout?: number;
+}
+export declare function writeProtocolBytes(stream: ProtocolWritable, bytes: Uint8Array, { signal, timeout }?: ProtocolWriteOptions): Promise<void>;
+export declare function writeFramedProtocolRecord(stream: ProtocolWritable, record: Uint8Array, options?: ProtocolWriteOptions): Promise<void>;

package/dist/tar-protocol/lifecycle.js

@@ -0,0 +1,90 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeProtocolBytes = writeProtocolBytes;
+exports.writeFramedProtocolRecord = writeFramedProtocolRecord;
+const b4a_1 = __importDefault(require("b4a"));
+const abort_js_1 = require("../abort.js");
+const errors_js_1 = require("../errors.js");
+const controls_js_1 = require("./controls.js");
+const DEFAULT_WRITE_TIMEOUT = 60_000;
+const MAX_TIMEOUT = 0x7fffffff;
+function invalid(message, cause = null) {
+    return new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.PROTOCOL_INVALID, message, cause);
+}
+function closedBeforeDrain() {
+    const error = invalid('Protocol stream closed before drain');
+    error.transport = true;
+    return error;
+}
+function assertTimeout(timeout) {
+    if (!Number.isSafeInteger(timeout) || timeout <= 0 || timeout > MAX_TIMEOUT) {
+        throw invalid('Invalid protocol write timeout');
+    }
+}
+function writeProtocolBytes(stream, bytes, { signal = null, timeout = DEFAULT_WRITE_TIMEOUT } = {}) {
+    if (!stream || typeof stream.write !== 'function' || typeof stream.destroy !== 'function') {
+        return Promise.reject(invalid('Invalid protocol stream'));
+    }
+    if (!b4a_1.default.isBuffer(bytes))
+        return Promise.reject(invalid('Invalid protocol bytes'));
+    try {
+        assertTimeout(timeout);
+        if (signal?.aborted)
+            throw (0, abort_js_1.abortError)();
+        if (stream.destroyed === true) {
+            throw closedBeforeDrain();
+        }
+        if (stream.write(bytes))
+            return Promise.resolve();
+        if (stream.destroyed === true) {
+            throw closedBeforeDrain();
+        }
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let removeAbort = () => { };
+        const timer = setTimeout(() => finish(new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.UPLOAD_IDLE_TIMEOUT, 'Protocol write drain timed out')), timeout);
+        const cleanup = () => {
+            clearTimeout(timer);
+            removeAbort();
+            stream.removeListener('drain', onDrain);
+            stream.removeListener('error', onError);
+            stream.removeListener('close', onClose);
+        };
+        const finish = (error = null) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            if (error === null) {
+                resolve();
+                return;
+            }
+            try {
+                stream.destroy(error);
+            }
+            catch { }
+            reject(error);
+        };
+        const onDrain = () => finish();
+        const onError = (error) => finish(error instanceof Error ? error : invalid('Protocol stream failed', error));
+        const onClose = () => finish(closedBeforeDrain());
+        stream.on('drain', onDrain);
+        stream.on('error', onError);
+        stream.on('close', onClose);
+        removeAbort = (0, abort_js_1.onAbort)(signal, () => finish((0, abort_js_1.abortError)()));
+        if (stream.destroyed === true) {
+            finish(closedBeforeDrain());
+        }
+    });
+}
+function writeFramedProtocolRecord(stream, record, options = {}) {
+    return writeProtocolBytes(stream, (0, controls_js_1.encodeControlFrame)(record), options);
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/tar-protocol/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../src/tar-protocol/lifecycle.ts"],"names":[],"mappings":";;;;;;;AAAA,8CAAqB;AACrB,0CAAuE;AACvE,4CAAuD;AACvD,+CAAkD;AAclD,MAAM,qBAAqB,GAAG,MAAM,CAAA;AACpC,MAAM,WAAW,GAAG,UAAU,CAAA;AAE9B,SAAS,OAAO,CAAC,OAAe,EAAE,KAAK,GAAY,IAAI;IACrD,OAAO,IAAI,4BAAgB,CAAC,kBAAM,CAAC,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAA;IAC5D,KAAK,CAAC,SAAS,GAAG,IAAI,CAAA;IACtB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;QAC5E,MAAM,OAAO,CAAC,gCAAgC,CAAC,CAAA;IACjD,CAAC;AACH,CAAC;AAED,4BACE,MAAwB,EACxB,KAAiB,EACjB,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAG,qBAAqB,EAAE,GAAyB,EAAE;IAE7E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC1F,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,aAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAA;IAClF,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,CAAC,CAAA;QACtB,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAA,qBAAU,GAAE,CAAA;QACvC,IAAK,MAA8D,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACvF,MAAM,iBAAiB,EAAE,CAAA;QAC3B,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QACjD,IAAK,MAA8D,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACvF,MAAM,iBAAiB,EAAE,CAAA;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,WAAW,GAAG,GAAG,EAAE,GAAE,CAAC,CAAA;QAC1B,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CACH,MAAM,CAAC,IAAI,4BAAgB,CAAC,kBAAM,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC,EAC5F,OAAO,CACR,CAAA;QAED,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,WAAW,EAAE,CAAA;YACb,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACvC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACvC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACzC,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,KAAK,GAAY,IAAI,EAAQ,EAAE;YAC7C,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,EAAE,CAAA;YACT,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACvB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC,CAAA;QACD,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,EAAE,CAAA;QACpC,MAAM,OAAO,GAAG,CAAC,KAAc,EAAQ,EAAE,CACvC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC,CAAA;QACnF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAA;QAEvD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC3B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC3B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC3B,WAAW,GAAG,IAAA,kBAAO,EAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAA,qBAAU,GAAE,CAAC,CAAC,CAAA;QACzD,IAAK,MAA8D,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACvF,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,mCACE,MAAwB,EACxB,MAAkB,EAClB,OAAO,GAAyB,EAAE;IAElC,OAAO,kBAAkB,CAAC,MAAM,EAAE,IAAA,gCAAkB,EAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAA;AACxE,CAAC"}

package/dist/tar-protocol/manifest.d.ts

@@ -0,0 +1,46 @@
+import { type AbortSignalLike } from '../abort.js';
+import { type MetadataRecord } from './controls.js';
+export { deterministicTarSize, TAR_BLOCK_BYTES, TAR_GID, TAR_GNAME, TAR_MODE, TAR_MTIME_MS, TAR_UID, TAR_UNAME } from './ustar.js';
+export declare const TAR_TRANSFER_DOMAIN = "swarm-deploy/direct-tar/v1";
+export interface TarSourceIdentity {
+    dev: number | bigint;
+    ino: number | bigint;
+    size: number;
+    mtimeMs: number;
+}
+export interface TarManifest {
+    path: string;
+    name: string;
+    fileSize: number;
+    fileSha256: Buffer;
+    tarSize: number;
+    tarSha256: Buffer;
+    transferId: Buffer;
+    source: TarSourceIdentity;
+}
+export interface TarOperationOptions {
+    signal?: AbortSignalLike | null;
+}
+export interface TarResumeOptions extends TarOperationOptions {
+    expectedPrefixSha256?: Uint8Array | null;
+}
+export type TarResumeResult = {
+    status: 'MATCH';
+    prefixSha256: Buffer;
+    bytesSent: number;
+} | {
+    status: 'RESET_REQUIRED';
+    prefixSha256: Buffer;
+    bytesSent: 0;
+};
+export declare function computeTarTransferId(clientPublicKey: Uint8Array, immutable: {
+    name: string;
+    fileSize: number;
+    fileSha256: Uint8Array;
+    tarSize: number;
+    tarSha256: Uint8Array;
+}): Buffer;
+export declare function buildTarManifest(filePath: string, clientPublicKey: Uint8Array, { signal }?: TarOperationOptions): Promise<TarManifest>;
+export declare function regenerateTarSuffix(manifest: TarManifest, offset: number, write: (chunk: Buffer) => void | Promise<void>, { signal, expectedPrefixSha256 }?: TarResumeOptions): Promise<TarResumeResult>;
+export declare function metadataFromManifest(manifest: TarManifest, reset?: boolean): MetadataRecord;
+export declare function assertMetadataTransferId(clientPublicKey: Uint8Array, offeredMetadata: MetadataRecord): void;

package/dist/tar-protocol/manifest.js

@@ -0,0 +1,287 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TAR_TRANSFER_DOMAIN = exports.TAR_UNAME = exports.TAR_UID = exports.TAR_MTIME_MS = exports.TAR_MODE = exports.TAR_GNAME = exports.TAR_GID = exports.TAR_BLOCK_BYTES = exports.deterministicTarSize = void 0;
+exports.computeTarTransferId = computeTarTransferId;
+exports.buildTarManifest = buildTarManifest;
+exports.regenerateTarSuffix = regenerateTarSuffix;
+exports.metadataFromManifest = metadataFromManifest;
+exports.assertMetadataTransferId = assertMetadataTransferId;
+const b4a_1 = __importDefault(require("b4a"));
+const _fs_1 = __importDefault(require("#fs"));
+const _path_1 = __importDefault(require("#path"));
+const sodium_native_1 = __importDefault(require("sodium-native"));
+const abort_js_1 = require("../abort.js");
+const errors_js_1 = require("../errors.js");
+const files_js_1 = require("../files.js");
+const layout_js_1 = require("../storage/layout.js");
+const controls_js_1 = require("./controls.js");
+const hash_js_1 = require("./hash.js");
+const ustar_js_1 = require("./ustar.js");
+var ustar_js_2 = require("./ustar.js");
+Object.defineProperty(exports, "deterministicTarSize", { enumerable: true, get: function () { return ustar_js_2.deterministicTarSize; } });
+Object.defineProperty(exports, "TAR_BLOCK_BYTES", { enumerable: true, get: function () { return ustar_js_2.TAR_BLOCK_BYTES; } });
+Object.defineProperty(exports, "TAR_GID", { enumerable: true, get: function () { return ustar_js_2.TAR_GID; } });
+Object.defineProperty(exports, "TAR_GNAME", { enumerable: true, get: function () { return ustar_js_2.TAR_GNAME; } });
+Object.defineProperty(exports, "TAR_MODE", { enumerable: true, get: function () { return ustar_js_2.TAR_MODE; } });
+Object.defineProperty(exports, "TAR_MTIME_MS", { enumerable: true, get: function () { return ustar_js_2.TAR_MTIME_MS; } });
+Object.defineProperty(exports, "TAR_UID", { enumerable: true, get: function () { return ustar_js_2.TAR_UID; } });
+Object.defineProperty(exports, "TAR_UNAME", { enumerable: true, get: function () { return ustar_js_2.TAR_UNAME; } });
+exports.TAR_TRANSFER_DOMAIN = 'swarm-deploy/direct-tar/v1';
+const READ_BYTES = 64 * 1024;
+function invalid(message, cause = null) {
+    return new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.PROTOCOL_INVALID, message, cause);
+}
+function assertSafeSize(size) {
+    (0, ustar_js_1.assertUstarFileSize)(size);
+}
+function assertClientKey(key) {
+    if (!b4a_1.default.isBuffer(key) || key.byteLength !== 32)
+        throw invalid('Invalid client public key');
+}
+function canonicalName(filePath) {
+    const name = (0, files_js_1.validateBasename)(_path_1.default.basename(filePath));
+    if ((0, files_js_1.isReservedHistoryName)(name)) {
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.INVALID_FILENAME, 'Filename cannot be encoded as USTAR');
+    }
+    return name;
+}
+function identity(stat) {
+    return { dev: stat.dev, ino: stat.ino, size: stat.size, mtimeMs: stat.mtimeMs };
+}
+function sameIdentity(expected, actual) {
+    return (actual.isFile() &&
+        actual.dev === expected.dev &&
+        actual.ino === expected.ino &&
+        actual.size === expected.size &&
+        actual.mtimeMs === expected.mtimeMs);
+}
+function assertIdentity(expected, actual, message) {
+    if (!sameIdentity(expected, actual))
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.FILE_BUSY, message);
+}
+async function openStableSource(filePath, expected, signal) {
+    (0, abort_js_1.throwIfAborted)(signal);
+    const pathStat = await _fs_1.default.promises.lstat(filePath);
+    (0, abort_js_1.throwIfAborted)(signal);
+    if (pathStat.isSymbolicLink() || !pathStat.isFile()) {
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.INVALID_FILENAME, 'Path must be a regular file');
+    }
+    const observed = identity(pathStat);
+    if (expected)
+        assertIdentity(expected, pathStat, 'Source file changed before TAR generation');
+    let handle = null;
+    try {
+        handle = await _fs_1.default.promises.open(filePath, (0, layout_js_1.safeFileOpenFlags)('read'));
+        const opened = await handle.stat();
+        assertIdentity(expected || observed, opened, 'Source identity changed while opening');
+        return { handle, source: expected || observed };
+    }
+    catch (error) {
+        if (handle)
+            await handle.close().catch(() => { });
+        if (error instanceof errors_js_1.SwarmDeployError)
+            throw error;
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.FILE_BUSY, 'Unable to safely open source file', error);
+    }
+}
+async function* generateTar(handle, name, size, fileHash, signal) {
+    (0, abort_js_1.throwIfAborted)(signal);
+    yield (0, ustar_js_1.canonicalUstarHeader)(name, size);
+    let position = 0;
+    while (position < size) {
+        (0, abort_js_1.throwIfAborted)(signal);
+        const chunk = b4a_1.default.alloc(Math.min(READ_BYTES, size - position));
+        const read = await handle.read(chunk, 0, chunk.byteLength, position);
+        const count = typeof read === 'number' ? read : read.bytesRead;
+        if (count !== chunk.byteLength) {
+            throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.FILE_BUSY, 'Source file was truncated');
+        }
+        fileHash.update(chunk);
+        position += count;
+        yield chunk;
+    }
+    const padding = (ustar_js_1.TAR_BLOCK_BYTES - (size % ustar_js_1.TAR_BLOCK_BYTES)) % ustar_js_1.TAR_BLOCK_BYTES;
+    if (padding > 0)
+        yield b4a_1.default.alloc(padding);
+    yield b4a_1.default.alloc(2 * ustar_js_1.TAR_BLOCK_BYTES);
+}
+async function assertSourceFinal(filePath, handle, expected, signal) {
+    (0, abort_js_1.throwIfAborted)(signal);
+    assertIdentity(expected, await handle.stat(), 'Source file changed during TAR generation');
+    assertIdentity(expected, await _fs_1.default.promises.lstat(filePath), 'Source path changed during TAR generation');
+    (0, abort_js_1.throwIfAborted)(signal);
+}
+function transferField(hash, label, value) {
+    const labelBytes = b4a_1.default.from(`${label}\u0000`);
+    const valueBytes = typeof value === 'number' ? b4a_1.default.from(String(value)) : b4a_1.default.from(value);
+    hash
+        .update(labelBytes)
+        .update(b4a_1.default.from(`${valueBytes.byteLength}:`))
+        .update(valueBytes);
+}
+function computeTarTransferId(clientPublicKey, immutable) {
+    assertClientKey(clientPublicKey);
+    assertSafeSize(immutable.fileSize);
+    if (!b4a_1.default.isBuffer(immutable.fileSha256) || immutable.fileSha256.byteLength !== 32) {
+        throw invalid('Invalid file digest');
+    }
+    if (!b4a_1.default.isBuffer(immutable.tarSha256) || immutable.tarSha256.byteLength !== 32) {
+        throw invalid('Invalid TAR digest');
+    }
+    const hash = new hash_js_1.SodiumSha256();
+    transferField(hash, 'domain', exports.TAR_TRANSFER_DOMAIN);
+    transferField(hash, 'clientPublicKey', clientPublicKey);
+    transferField(hash, 'name', immutable.name);
+    transferField(hash, 'fileSize', immutable.fileSize);
+    transferField(hash, 'fileSha256', immutable.fileSha256);
+    transferField(hash, 'tarSize', immutable.tarSize);
+    transferField(hash, 'tarSha256', immutable.tarSha256);
+    transferField(hash, 'type', 'file');
+    transferField(hash, 'mode', ustar_js_1.TAR_MODE);
+    transferField(hash, 'uid', ustar_js_1.TAR_UID);
+    transferField(hash, 'gid', ustar_js_1.TAR_GID);
+    transferField(hash, 'mtimeMs', ustar_js_1.TAR_MTIME_MS);
+    transferField(hash, 'uname', ustar_js_1.TAR_UNAME);
+    transferField(hash, 'gname', ustar_js_1.TAR_GNAME);
+    transferField(hash, 'pax', 'none');
+    return hash.digest();
+}
+async function buildTarManifest(filePath, clientPublicKey, { signal = null } = {}) {
+    assertClientKey(clientPublicKey);
+    const name = canonicalName(filePath);
+    const opened = await openStableSource(filePath, null, signal);
+    assertSafeSize(opened.source.size);
+    const fileHash = new hash_js_1.SodiumSha256();
+    const tarHash = new hash_js_1.SodiumSha256();
+    let tarSize = 0;
+    try {
+        for await (const chunk of generateTar(opened.handle, name, opened.source.size, fileHash, signal)) {
+            tarHash.update(chunk);
+            tarSize += chunk.byteLength;
+        }
+        await assertSourceFinal(filePath, opened.handle, opened.source, signal);
+    }
+    finally {
+        await opened.handle.close().catch(() => { });
+    }
+    if (tarSize !== (0, ustar_js_1.deterministicTarSize)(opened.source.size)) {
+        throw invalid('Noncanonical deterministic TAR length');
+    }
+    const fileSha256 = fileHash.digest();
+    const tarSha256 = tarHash.digest();
+    const transferId = computeTarTransferId(clientPublicKey, {
+        name,
+        fileSize: opened.source.size,
+        fileSha256,
+        tarSize,
+        tarSha256
+    });
+    return {
+        path: filePath,
+        name,
+        fileSize: opened.source.size,
+        fileSha256,
+        tarSize,
+        tarSha256,
+        transferId,
+        source: opened.source
+    };
+}
+async function regenerateTarSuffix(manifest, offset, write, { signal = null, expectedPrefixSha256 = null } = {}) {
+    if (!manifest || typeof manifest !== 'object')
+        throw invalid('Invalid TAR manifest');
+    if (!Number.isSafeInteger(offset) || offset < 0 || offset > manifest.tarSize) {
+        throw invalid('Invalid TAR resume offset');
+    }
+    if (typeof write !== 'function')
+        throw invalid('Invalid TAR suffix writer');
+    if (expectedPrefixSha256 !== null &&
+        (!b4a_1.default.isBuffer(expectedPrefixSha256) || expectedPrefixSha256.byteLength !== 32)) {
+        throw invalid('Invalid expected prefix digest');
+    }
+    const opened = await openStableSource(manifest.path, manifest.source, signal);
+    const fileHash = new hash_js_1.SodiumSha256();
+    const tarHash = new hash_js_1.SodiumSha256();
+    const prefixHash = new hash_js_1.SodiumSha256();
+    let position = 0;
+    let bytesSent = 0;
+    let prefixSha256 = offset === 0 ? prefixHash.digest() : null;
+    let resetRequired = prefixSha256 !== null &&
+        expectedPrefixSha256 !== null &&
+        !sodium_native_1.default.sodium_memcmp(prefixSha256, expectedPrefixSha256);
+    try {
+        for await (const chunk of generateTar(opened.handle, manifest.name, manifest.fileSize, fileHash, signal)) {
+            (0, abort_js_1.throwIfAborted)(signal);
+            tarHash.update(chunk);
+            const end = position + chunk.byteLength;
+            if (position < offset) {
+                const prefixEnd = Math.min(chunk.byteLength, offset - position);
+                prefixHash.update(chunk.subarray(0, prefixEnd));
+                if (end >= offset) {
+                    prefixSha256 = prefixHash.digest();
+                    if (expectedPrefixSha256 && !sodium_native_1.default.sodium_memcmp(prefixSha256, expectedPrefixSha256)) {
+                        resetRequired = true;
+                    }
+                    if (!resetRequired && prefixEnd < chunk.byteLength) {
+                        const suffix = chunk.subarray(prefixEnd);
+                        await write(suffix);
+                        bytesSent += suffix.byteLength;
+                    }
+                }
+            }
+            else if (!resetRequired) {
+                await write(chunk);
+                bytesSent += chunk.byteLength;
+            }
+            position = end;
+        }
+        await assertSourceFinal(manifest.path, opened.handle, manifest.source, signal);
+    }
+    finally {
+        await opened.handle.close().catch(() => { });
+    }
+    if (position !== manifest.tarSize ||
+        (!resetRequired && bytesSent !== manifest.tarSize - offset)) {
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.FILE_BUSY, 'Regenerated TAR length changed');
+    }
+    const regeneratedFile = fileHash.digest();
+    const regeneratedTar = tarHash.digest();
+    if (!(0, hash_js_1.digestMatches)(regeneratedFile, manifest.fileSha256) ||
+        !(0, hash_js_1.digestMatches)(regeneratedTar, manifest.tarSha256)) {
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.FILE_BUSY, 'Source file changed during TAR regeneration');
+    }
+    if (prefixSha256 === null)
+        throw invalid('Unable to hash TAR prefix');
+    if (resetRequired)
+        return { status: 'RESET_REQUIRED', prefixSha256, bytesSent: 0 };
+    return { status: 'MATCH', prefixSha256, bytesSent };
+}
+function metadataFromManifest(manifest, reset = false) {
+    return {
+        v: controls_js_1.CONTROL_VERSION,
+        name: manifest.name,
+        fileSize: manifest.fileSize,
+        fileSha256: b4a_1.default.toString(manifest.fileSha256, 'hex'),
+        tarSize: manifest.tarSize,
+        tarSha256: b4a_1.default.toString(manifest.tarSha256, 'hex'),
+        transferId: b4a_1.default.toString(manifest.transferId, 'hex'),
+        reset
+    };
+}
+function assertMetadataTransferId(clientPublicKey, offeredMetadata) {
+    const metadata = (0, controls_js_1.decodeMetadataRecord)((0, controls_js_1.encodeMetadataRecord)(offeredMetadata));
+    const expected = computeTarTransferId(clientPublicKey, {
+        name: metadata.name,
+        fileSize: metadata.fileSize,
+        fileSha256: b4a_1.default.from(metadata.fileSha256, 'hex'),
+        tarSize: metadata.tarSize,
+        tarSha256: b4a_1.default.from(metadata.tarSha256, 'hex')
+    });
+    const offered = b4a_1.default.from(metadata.transferId, 'hex');
+    if (!sodium_native_1.default.sodium_memcmp(expected, offered))
+        throw invalid('Noncanonical TAR transfer ID');
+}
+//# sourceMappingURL=manifest.js.map