published-bundle.js (1266B)
1 import { decodeBundle, fetchBytes, sha256 } from './bundle.js'; 2 // Common authenticated package/source boundary, independent of the evaluator. 3 export async function publishedBundle(hash, localId) { 4 const base = new URL('../', import.meta.url); 5 let source = null; 6 if (localId !== undefined) { 7 const catalogue = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(await fetchBytes(new URL('catalogue.json', base), 64000))); 8 if (!Array.isArray(catalogue)) 9 throw new Error('Invalid catalogue'); 10 const entry = catalogue.find((item) => !!item && typeof item === 'object' && item['id'] === localId); 11 if (!entry || entry['hash'] !== hash) 12 throw new Error('Invalid catalogue pin'); 13 if (typeof entry['source'] !== 'string' || entry['source'].length > 32000 || await sha256(new TextEncoder().encode(entry['source'])) !== entry['sourceSha256']) 14 throw new Error('Catalogue source integrity failure'); 15 source = entry['source']; 16 } 17 const bytes = await fetchBytes(new URL(`/_arboricx/bundle/hash/${hash}`, base)); 18 if (await sha256(bytes) !== hash) 19 throw new Error('Bundle SHA-256 mismatch'); 20 return { hash, bytes, bundle: decodeBundle(bytes), source }; 21 }