@agentxm/client-core 0.1.6

package/dist/src/unstable/publish/index.js

@@ -0,0 +1,5 @@
+export { ArchiveGuardrailError, validateArchive, } from "./archive-guardrails.js";
+export { IngestLimitError, IngestUnsupportedContentTypeError, REGISTRY_PUBLISH_MAX_REQUEST_BYTES, REGISTRY_PUBLISH_MAX_ARCHIVE_BYTES, enforceRequestSizeLimit, enforceArchiveSizeLimit, enforceArchiveContentType, } from "./ingest-limits.js";
+export { ManifestError, validateDeclaredManifestAlignment, } from "./manifest-policy.js";
+export { normalizePublishInput, } from "./input-normalization.js";
+//# sourceMappingURL=index.js.map

package/dist/src/unstable/publish/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/unstable/publish/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,uBAAuB,EACvB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,iCAAiC,GAIlC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,GAItB,MAAM,0BAA0B,CAAC"}

package/dist/src/unstable/publish/ingest-limits.d.ts

@@ -0,0 +1,25 @@
+import * as Result from "effect/Result";
+export declare const REGISTRY_PUBLISH_MAX_REQUEST_BYTES: number;
+export declare const REGISTRY_PUBLISH_MAX_ARCHIVE_BYTES: number;
+declare const IngestLimitError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "IngestLimitError";
+} & Readonly<A>;
+export declare class IngestLimitError extends IngestLimitError_base<{
+    readonly code: "ingest_request_too_large" | "ingest_archive_too_large" | "ingest_decompression_limit";
+    readonly detail: string;
+    readonly limit?: number;
+    readonly actual?: number;
+}> {
+}
+declare const IngestUnsupportedContentTypeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "IngestUnsupportedContentTypeError";
+} & Readonly<A>;
+export declare class IngestUnsupportedContentTypeError extends IngestUnsupportedContentTypeError_base<{
+    readonly detail: string;
+}> {
+}
+export declare const enforceRequestSizeLimit: (contentLength: number | undefined, maxBytes?: number) => Result.Result<void, IngestLimitError>;
+export declare const enforceArchiveSizeLimit: (archiveBytes: number, maxBytes?: number) => Result.Result<void, IngestLimitError>;
+export declare const enforceArchiveContentType: (contentType: string | undefined) => Result.Result<void, IngestUnsupportedContentTypeError>;
+export {};
+//# sourceMappingURL=ingest-limits.d.ts.map

package/dist/src/unstable/publish/ingest-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-limits.d.ts","sourceRoot":"","sources":["../../../../src/unstable/publish/ingest-limits.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,kCAAkC,QAAmB,CAAC;AACnE,eAAO,MAAM,kCAAkC,QAAmB,CAAC;;;;AAEnE,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,IAAI,EACT,0BAA0B,GAC1B,0BAA0B,GAC1B,4BAA4B,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;;;;AAEL,qBAAa,iCAAkC,SAAQ,uCAErD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;AAEL,eAAO,MAAM,uBAAuB,GAClC,eAAe,MAAM,GAAG,SAAS,EACjC,WAAU,MAA2C,KACpD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAatC,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAClC,cAAc,MAAM,EACpB,WAAU,MAA2C,KACpD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAatC,CAAC;AAIF,eAAO,MAAM,yBAAyB,GACpC,aAAa,MAAM,GAAG,SAAS,KAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,CAWvD,CAAC"}

package/dist/src/unstable/publish/ingest-limits.js

@@ -0,0 +1,41 @@
+import * as Data from "effect/Data";
+import * as Result from "effect/Result";
+export const REGISTRY_PUBLISH_MAX_REQUEST_BYTES = 35 * 1024 * 1024;
+export const REGISTRY_PUBLISH_MAX_ARCHIVE_BYTES = 25 * 1024 * 1024;
+export class IngestLimitError extends Data.TaggedError("IngestLimitError") {
+}
+export class IngestUnsupportedContentTypeError extends Data.TaggedError("IngestUnsupportedContentTypeError") {
+}
+export const enforceRequestSizeLimit = (contentLength, maxBytes = REGISTRY_PUBLISH_MAX_REQUEST_BYTES) => {
+    if (contentLength !== undefined && contentLength > maxBytes) {
+        return Result.fail(new IngestLimitError({
+            code: "ingest_request_too_large",
+            detail: `Request body exceeds maximum size of ${maxBytes} bytes.`,
+            limit: maxBytes,
+            actual: contentLength,
+        }));
+    }
+    return Result.void;
+};
+export const enforceArchiveSizeLimit = (archiveBytes, maxBytes = REGISTRY_PUBLISH_MAX_ARCHIVE_BYTES) => {
+    if (archiveBytes > maxBytes) {
+        return Result.fail(new IngestLimitError({
+            code: "ingest_archive_too_large",
+            detail: `Archive exceeds maximum size of ${maxBytes} bytes.`,
+            limit: maxBytes,
+            actual: archiveBytes,
+        }));
+    }
+    return Result.void;
+};
+const V1_ARCHIVE_CONTENT_TYPES = new Set(["application/zip"]);
+export const enforceArchiveContentType = (contentType) => {
+    const normalized = contentType?.split(";")[0]?.trim().toLowerCase();
+    if (!normalized || !V1_ARCHIVE_CONTENT_TYPES.has(normalized)) {
+        return Result.fail(new IngestUnsupportedContentTypeError({
+            detail: `Unsupported archive content type: ${contentType ?? "(none)"}. Supported: application/zip.`,
+        }));
+    }
+    return Result.void;
+};
+//# sourceMappingURL=ingest-limits.js.map

package/dist/src/unstable/publish/ingest-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-limits.js","sourceRoot":"","sources":["../../../../src/unstable/publish/ingest-limits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnE,MAAM,OAAO,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAQvE;CAAG;AAEL,MAAM,OAAO,iCAAkC,SAAQ,IAAI,CAAC,WAAW,CACrE,mCAAmC,CAGnC;CAAG;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,aAAiC,EACjC,WAAmB,kCAAkC,EACd,EAAE;IACzC,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,gBAAgB,CAAC;YACnB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,wCAAwC,QAAQ,SAAS;YACjE,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,aAAa;SACtB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,YAAoB,EACpB,WAAmB,kCAAkC,EACd,EAAE;IACzC,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,gBAAgB,CAAC;YACnB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,mCAAmC,QAAQ,SAAS;YAC5D,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,YAAY;SACrB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,WAA+B,EACyB,EAAE;IAC1D,MAAM,UAAU,GAAG,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpE,IAAI,CAAC,UAAU,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,iCAAiC,CAAC;YACpC,MAAM,EAAE,qCAAqC,WAAW,IAAI,QAAQ,+BAA+B;SACpG,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC,CAAC"}

package/dist/src/unstable/publish/input-normalization.d.ts

@@ -0,0 +1,39 @@
+import * as Effect from "effect/Effect";
+import type { ExtensionName, ExtensionType } from "../extensions/index.js";
+import type { Handle } from "../extensions/handle.js";
+import { ArchiveGuardrailError, type ArchiveGuardrailLimits, type ZipEntry } from "./archive-guardrails.js";
+import { type IngestLimitError, type IngestUnsupportedContentTypeError } from "./ingest-limits.js";
+import { type ManifestError, type ResolvedManifest } from "./manifest-policy.js";
+import type { ExactSemverVersion } from "../version-constraints/version-constraints.js";
+export interface DeclaredPublishIdentity {
+    readonly owner: Handle;
+    readonly type: ExtensionType;
+    readonly name: ExtensionName;
+    readonly version: ExactSemverVersion;
+}
+export interface PublishArchiveInput {
+    readonly archiveBytes: Uint8Array;
+    readonly archiveContentType?: string;
+    readonly clientIntegrity?: string;
+}
+export interface NormalizePublishInputArgs {
+    readonly declaredIdentity: DeclaredPublishIdentity;
+    readonly archive: PublishArchiveInput;
+    readonly digestHeader?: string;
+    readonly readEntry?: (archiveBytes: Uint8Array, entry: ZipEntry) => Effect.Effect<Uint8Array, ArchiveGuardrailError>;
+    readonly guardrailLimits?: ArchiveGuardrailLimits;
+}
+export interface PublishInput {
+    readonly owner: Handle;
+    readonly type: ExtensionType;
+    readonly name: ExtensionName;
+    readonly version: ExactSemverVersion;
+    readonly archiveBytes: Uint8Array;
+    readonly archiveContentType: string;
+    readonly manifest: ResolvedManifest;
+    readonly clientIntegrity?: string;
+    readonly digestHeader?: string;
+}
+export declare const defaultReadEntry: (archiveBytes: Uint8Array, entry: ZipEntry) => Effect.Effect<Uint8Array, ArchiveGuardrailError>;
+export declare const normalizePublishInput: (args: NormalizePublishInputArgs) => Effect.Effect<PublishInput, IngestLimitError | IngestUnsupportedContentTypeError | ArchiveGuardrailError | ManifestError>;
+//# sourceMappingURL=input-normalization.d.ts.map

package/dist/src/unstable/publish/input-normalization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-normalization.d.ts","sourceRoot":"","sources":["../../../../src/unstable/publish/input-normalization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAE3B,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,iCAAiC,EACvC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EAGtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AAExF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,YAAY,EAAE,UAAU,EACxB,KAAK,EAAE,QAAQ,KACZ,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;IACtD,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CACnD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAID,eAAO,MAAM,gBAAgB,GAC3B,cAAc,UAAU,EACxB,OAAO,QAAQ,KACd,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAwD9C,CAAC;AAEL,eAAO,MAAM,qBAAqB,GAChC,MAAM,yBAAyB,KAC9B,MAAM,CAAC,MAAM,CACd,YAAY,EACZ,gBAAgB,GAAG,iCAAiC,GAAG,qBAAqB,GAAG,aAAa,CA4C1F,CAAC"}

package/dist/src/unstable/publish/input-normalization.js

@@ -0,0 +1,85 @@
+import * as Effect from "effect/Effect";
+import { inflateRawSync } from "node:zlib";
+import { ArchiveGuardrailError, ZIP_LOCAL_SIGNATURE, validateArchive, } from "./archive-guardrails.js";
+import { enforceArchiveContentType, enforceArchiveSizeLimit, } from "./ingest-limits.js";
+import { resolveManifest, validateDeclaredManifestAlignment, } from "./manifest-policy.js";
+const LOCAL_FILE_HEADER_SIZE = 30;
+export const defaultReadEntry = (archiveBytes, entry) => Effect.gen(function* () {
+    const { localHeaderOffset, compressedSize, compressionMethod, fileName } = entry;
+    if (localHeaderOffset + LOCAL_FILE_HEADER_SIZE > archiveBytes.length) {
+        return yield* new ArchiveGuardrailError({
+            code: "malformed_archive",
+            message: `Local file header for entry "${fileName}" exceeds archive bounds.`,
+            entry: fileName,
+        });
+    }
+    const view = new DataView(archiveBytes.buffer, archiveBytes.byteOffset, archiveBytes.byteLength);
+    const signature = view.getUint32(localHeaderOffset, true);
+    if (signature !== ZIP_LOCAL_SIGNATURE) {
+        return yield* new ArchiveGuardrailError({
+            code: "malformed_archive",
+            message: `Invalid local file header signature for entry "${fileName}".`,
+            entry: fileName,
+        });
+    }
+    const fileNameLength = view.getUint16(localHeaderOffset + 26, true);
+    const extraFieldLength = view.getUint16(localHeaderOffset + 28, true);
+    const dataStart = localHeaderOffset + LOCAL_FILE_HEADER_SIZE + fileNameLength + extraFieldLength;
+    if (dataStart + compressedSize > archiveBytes.length) {
+        return yield* new ArchiveGuardrailError({
+            code: "malformed_archive",
+            message: `Compressed data for entry "${fileName}" exceeds archive bounds.`,
+            entry: fileName,
+        });
+    }
+    const compressedData = archiveBytes.slice(dataStart, dataStart + compressedSize);
+    if (compressionMethod === 0) {
+        return compressedData;
+    }
+    if (compressionMethod === 8) {
+        const result = inflateRawSync(compressedData);
+        return new Uint8Array(result.buffer, result.byteOffset, result.byteLength);
+    }
+    return yield* new ArchiveGuardrailError({
+        code: "unsupported_compression",
+        message: `Unsupported compression method ${compressionMethod} for entry "${fileName}".`,
+        entry: fileName,
+    });
+});
+export const normalizePublishInput = (args) => Effect.gen(function* () {
+    const { declaredIdentity, archive, digestHeader, guardrailLimits } = args;
+    const entryReader = args.readEntry ?? defaultReadEntry;
+    yield* enforceArchiveContentType(archive.archiveContentType);
+    yield* enforceArchiveSizeLimit(archive.archiveBytes.length);
+    const entries = yield* validateArchive(archive.archiveBytes, guardrailLimits);
+    const manifest = yield* resolveManifest({
+        type: declaredIdentity.type,
+        entries,
+        readEntry: (fileName) => {
+            const entry = entries.find((candidate) => candidate.fileName === fileName);
+            if (entry === undefined) {
+                return Effect.fail(new ArchiveGuardrailError({
+                    code: "malformed_archive",
+                    message: `Entry "${fileName}" not found in archive.`,
+                    entry: fileName,
+                }));
+            }
+            return entryReader(archive.archiveBytes, entry);
+        },
+    });
+    yield* validateDeclaredManifestAlignment(declaredIdentity, manifest.identity);
+    return {
+        owner: declaredIdentity.owner,
+        type: declaredIdentity.type,
+        name: declaredIdentity.name,
+        version: declaredIdentity.version,
+        archiveBytes: archive.archiveBytes,
+        archiveContentType: archive.archiveContentType ?? "application/zip",
+        manifest,
+        ...(archive.clientIntegrity === undefined
+            ? {}
+            : { clientIntegrity: archive.clientIntegrity }),
+        ...(digestHeader === undefined ? {} : { digestHeader }),
+    };
+});
+//# sourceMappingURL=input-normalization.js.map

package/dist/src/unstable/publish/input-normalization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-normalization.js","sourceRoot":"","sources":["../../../../src/unstable/publish/input-normalization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EACL,qBAAqB,EAErB,mBAAmB,EAEnB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,uBAAuB,GAGxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,eAAe,EACf,iCAAiC,GAClC,MAAM,sBAAsB,CAAC;AAuC9B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,YAAwB,EACxB,KAAe,EACmC,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAEjF,IAAI,iBAAiB,GAAG,sBAAsB,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC;YACtC,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,gCAAgC,QAAQ,2BAA2B;YAC5E,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,QAAQ,CACvB,YAAY,CAAC,MAAM,EACnB,YAAY,CAAC,UAAU,EACvB,YAAY,CAAC,UAAU,CACxB,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,SAAS,KAAK,mBAAmB,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC;YACtC,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,kDAAkD,QAAQ,IAAI;YACvE,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACtE,MAAM,SAAS,GACb,iBAAiB,GAAG,sBAAsB,GAAG,cAAc,GAAG,gBAAgB,CAAC;IAEjF,IAAI,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC;YACtC,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,8BAA8B,QAAQ,2BAA2B;YAC1E,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,cAAc,CAAC,CAAC;IAEjF,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QAC9C,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC;QACtC,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,kCAAkC,iBAAiB,eAAe,QAAQ,IAAI;QACvF,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAA+B,EAI/B,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAEvD,KAAK,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7D,KAAK,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACtC,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,OAAO;QACP,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC3E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,qBAAqB,CAAC;oBACxB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,UAAU,QAAQ,yBAAyB;oBACpD,KAAK,EAAE,QAAQ;iBAChB,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;KACF,CAAC,CAAC;IAEH,KAAK,CAAC,CAAC,iCAAiC,CAAC,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE9E,OAAO;QACL,KAAK,EAAE,gBAAgB,CAAC,KAAK;QAC7B,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,OAAO,EAAE,gBAAgB,CAAC,OAAO;QACjC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,iBAAiB;QACnE,QAAQ;QACR,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACjD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/src/unstable/publish/manifest-policy.d.ts

@@ -0,0 +1,171 @@
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import { type ExtensionName, type ExtensionType } from "../extensions/common.js";
+import { type Handle } from "../extensions/handle.js";
+import { type ExactSemverVersion } from "../version-constraints/version-constraints.js";
+import type { ArchiveGuardrailError, ZipEntry } from "./archive-guardrails.js";
+declare const ManifestError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ManifestError";
+} & Readonly<A>;
+export declare class ManifestError extends ManifestError_base<{
+    readonly code: "manifest_missing" | "manifest_multiple" | "manifest_invalid_json" | "manifest_schema_invalid" | "declared_manifest_mismatch";
+    readonly detail: string;
+    readonly details?: unknown;
+}> {
+}
+export declare const manifestFilenameForType: (type: string) => string | undefined;
+export declare const ManifestIdentitySchema: Schema.Struct<{
+    readonly owner: Schema.brand<Schema.String, "Handle">;
+    readonly type: Schema.Literals<readonly ["skill", "command", "mcp-server", "subagent", "file", "rule", "pack"]>;
+    readonly name: Schema.brand<Schema.String, "ExtensionName">;
+    readonly version: Schema.brand<Schema.String, "ExactSemverVersion">;
+}>;
+export type ManifestIdentity = Schema.Schema.Type<typeof ManifestIdentitySchema>;
+export declare const manifestSchemaForType: (type: string) => Schema.Struct<{
+    readonly type: Schema.Literal<"command">;
+    readonly name: Schema.brand<Schema.String, "ExtensionName">;
+    readonly agents: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly agentOverrides: Schema.optional<Schema.$Record<Schema.String, Schema.$Record<Schema.String, Schema.Unknown>>>;
+    readonly owner: Schema.brand<Schema.String, "Handle">;
+    readonly version: Schema.brand<Schema.String, "ExactSemverVersion">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly keywords: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly repository: Schema.optional<Schema.String>;
+    readonly homepage: Schema.optional<Schema.String>;
+    readonly license: Schema.optional<Schema.String>;
+    readonly bugs: Schema.optional<Schema.String>;
+    readonly authors: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly email: Schema.optional<Schema.String>;
+        readonly url: Schema.optional<Schema.String>;
+    }>>>;
+    readonly compatiblePackages: Schema.optional<Schema.$Array<Schema.decodeTo<Schema.toType<Schema.Struct<{
+        readonly type: Schema.brand<Schema.String, "PackageType">;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly name: Schema.String;
+        readonly version: Schema.optional<Schema.String>;
+    }>>, Schema.String, never, never>>>;
+    readonly $schema: Schema.optional<Schema.String>;
+}> | Schema.Struct<{
+    readonly type: Schema.Literal<"mcp-server">;
+    readonly name: Schema.brand<Schema.String, "ExtensionName">;
+    readonly owner: Schema.brand<Schema.String, "Handle">;
+    readonly version: Schema.brand<Schema.String, "ExactSemverVersion">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly keywords: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly repository: Schema.optional<Schema.String>;
+    readonly homepage: Schema.optional<Schema.String>;
+    readonly license: Schema.optional<Schema.String>;
+    readonly bugs: Schema.optional<Schema.String>;
+    readonly authors: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly email: Schema.optional<Schema.String>;
+        readonly url: Schema.optional<Schema.String>;
+    }>>>;
+    readonly compatiblePackages: Schema.optional<Schema.$Array<Schema.decodeTo<Schema.toType<Schema.Struct<{
+        readonly type: Schema.brand<Schema.String, "PackageType">;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly name: Schema.String;
+        readonly version: Schema.optional<Schema.String>;
+    }>>, Schema.String, never, never>>>;
+    readonly $schema: Schema.optional<Schema.String>;
+}> | Schema.Struct<{
+    readonly type: Schema.Literal<"skill">;
+    readonly name: Schema.brand<Schema.String, "ExtensionName">;
+    readonly agents: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly owner: Schema.brand<Schema.String, "Handle">;
+    readonly version: Schema.brand<Schema.String, "ExactSemverVersion">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly keywords: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly repository: Schema.optional<Schema.String>;
+    readonly homepage: Schema.optional<Schema.String>;
+    readonly license: Schema.optional<Schema.String>;
+    readonly bugs: Schema.optional<Schema.String>;
+    readonly authors: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly email: Schema.optional<Schema.String>;
+        readonly url: Schema.optional<Schema.String>;
+    }>>>;
+    readonly compatiblePackages: Schema.optional<Schema.$Array<Schema.decodeTo<Schema.toType<Schema.Struct<{
+        readonly type: Schema.brand<Schema.String, "PackageType">;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly name: Schema.String;
+        readonly version: Schema.optional<Schema.String>;
+    }>>, Schema.String, never, never>>>;
+    readonly $schema: Schema.optional<Schema.String>;
+}> | Schema.Struct<{
+    readonly type: Schema.Literal<"pack">;
+    readonly name: Schema.brand<Schema.String, "ExtensionName">;
+    readonly skills: Schema.optional<Schema.$Record<Schema.String, Schema.brand<Schema.String, "VersionConstraint">>>;
+    readonly commands: Schema.optional<Schema.$Record<Schema.String, Schema.brand<Schema.String, "VersionConstraint">>>;
+    readonly "mcp-servers": Schema.optional<Schema.$Record<Schema.String, Schema.brand<Schema.String, "VersionConstraint">>>;
+    readonly subagents: Schema.optional<Schema.$Record<Schema.String, Schema.brand<Schema.String, "VersionConstraint">>>;
+    readonly owner: Schema.brand<Schema.String, "Handle">;
+    readonly version: Schema.brand<Schema.String, "ExactSemverVersion">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly keywords: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly repository: Schema.optional<Schema.String>;
+    readonly homepage: Schema.optional<Schema.String>;
+    readonly license: Schema.optional<Schema.String>;
+    readonly bugs: Schema.optional<Schema.String>;
+    readonly authors: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly email: Schema.optional<Schema.String>;
+        readonly url: Schema.optional<Schema.String>;
+    }>>>;
+    readonly compatiblePackages: Schema.optional<Schema.$Array<Schema.decodeTo<Schema.toType<Schema.Struct<{
+        readonly type: Schema.brand<Schema.String, "PackageType">;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly name: Schema.String;
+        readonly version: Schema.optional<Schema.String>;
+    }>>, Schema.String, never, never>>>;
+    readonly $schema: Schema.optional<Schema.String>;
+}> | Schema.Struct<{
+    readonly type: Schema.Literal<"subagent">;
+    readonly name: Schema.brand<Schema.String, "ExtensionName">;
+    readonly model: Schema.optional<Schema.String>;
+    readonly toolAccess: Schema.optional<Schema.Literals<readonly ["full", "readonly", "none"]>>;
+    readonly background: Schema.optional<Schema.withConstructorDefault<Schema.Boolean>>;
+    readonly agents: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly owner: Schema.brand<Schema.String, "Handle">;
+    readonly version: Schema.brand<Schema.String, "ExactSemverVersion">;
+    readonly description: Schema.optional<Schema.String>;
+    readonly keywords: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly repository: Schema.optional<Schema.String>;
+    readonly homepage: Schema.optional<Schema.String>;
+    readonly license: Schema.optional<Schema.String>;
+    readonly bugs: Schema.optional<Schema.String>;
+    readonly authors: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly email: Schema.optional<Schema.String>;
+        readonly url: Schema.optional<Schema.String>;
+    }>>>;
+    readonly compatiblePackages: Schema.optional<Schema.$Array<Schema.decodeTo<Schema.toType<Schema.Struct<{
+        readonly type: Schema.brand<Schema.String, "PackageType">;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly name: Schema.String;
+        readonly version: Schema.optional<Schema.String>;
+    }>>, Schema.String, never, never>>>;
+    readonly $schema: Schema.optional<Schema.String>;
+}> | undefined;
+export interface ManifestResolutionInput {
+    readonly type: string;
+    readonly entries: readonly ZipEntry[];
+    readonly readEntry: (fileName: string) => Effect.Effect<Uint8Array, ArchiveGuardrailError>;
+}
+export interface DeclaredPublishIdentity {
+    readonly owner: Handle;
+    readonly type: ExtensionType;
+    readonly name: ExtensionName;
+    readonly version: ExactSemverVersion;
+}
+export interface ResolvedManifest {
+    readonly identity: ManifestIdentity;
+    readonly raw: unknown;
+    readonly fileName: string;
+}
+export declare const resolveManifest: (input: ManifestResolutionInput) => Effect.Effect<ResolvedManifest, ManifestError | ArchiveGuardrailError>;
+export declare const validateDeclaredManifestAlignment: (declaredIdentity: DeclaredPublishIdentity, manifest: ManifestIdentity) => Result.Result<void, ManifestError>;
+export {};
+//# sourceMappingURL=manifest-policy.d.ts.map

package/dist/src/unstable/publish/manifest-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-policy.d.ts","sourceRoot":"","sources":["../../../../src/unstable/publish/manifest-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAiBpE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;;;;AAE/E,qBAAa,aAAc,SAAQ,mBAAkC;IACnE,QAAQ,CAAC,IAAI,EACT,kBAAkB,GAClB,mBAAmB,GACnB,uBAAuB,GACvB,yBAAyB,GACzB,4BAA4B,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;CAAG;AAEL,eAAO,MAAM,uBAAuB,GAAI,MAAM,MAAM,KAAG,MAAM,GAAG,SAe/D,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;EAYjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEjF,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAejD,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;CAC5F;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,eAAe,GAC1B,OAAO,uBAAuB,KAC7B,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,aAAa,GAAG,qBAAqB,CA2EpE,CAAC;AAEL,eAAO,MAAM,iCAAiC,GAC5C,kBAAkB,uBAAuB,EACzC,UAAU,gBAAgB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CA6BnC,CAAC"}

package/dist/src/unstable/publish/manifest-policy.js

@@ -0,0 +1,131 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import * as SchemaIssue from "effect/SchemaIssue";
+import { CommandManifestSchema, COMMAND_MANIFEST_FILENAME } from "../commands/manifest-schema.js";
+import { ExtensionNameSchema, ExtensionTypeSchema, } from "../extensions/common.js";
+import { HandleSchema } from "../extensions/handle.js";
+import { McpServerManifestSchema, MCP_SERVER_MANIFEST_FILENAME, } from "../mcp-servers/manifest-schema.js";
+import { EXTENSION_PACK_MANIFEST_FILENAME, ExtensionPackManifestSchema, } from "../packs/manifest-schema.js";
+import { SkillManifestSchema, MANIFEST_FILENAME as SKILL_MANIFEST_FILENAME, } from "../skills/manifest-schema.js";
+import { SubagentManifestSchema, MANIFEST_FILENAME as SUBAGENT_MANIFEST_FILENAME, } from "../subagents/manifest-schema.js";
+import { ExactSemverVersionSchema, } from "../version-constraints/version-constraints.js";
+export class ManifestError extends Data.TaggedError("ManifestError") {
+}
+export const manifestFilenameForType = (type) => {
+    switch (type) {
+        case "skill":
+            return SKILL_MANIFEST_FILENAME;
+        case "command":
+            return COMMAND_MANIFEST_FILENAME;
+        case "mcp-server":
+            return MCP_SERVER_MANIFEST_FILENAME;
+        case "subagent":
+            return SUBAGENT_MANIFEST_FILENAME;
+        case "pack":
+            return EXTENSION_PACK_MANIFEST_FILENAME;
+        default:
+            return undefined;
+    }
+};
+export const ManifestIdentitySchema = Schema.Struct({
+    owner: HandleSchema.pipe(Schema.annotateKey({ messageMissingKey: "owner is required" })),
+    type: ExtensionTypeSchema.pipe(Schema.annotateKey({ messageMissingKey: "type is required" })),
+    name: ExtensionNameSchema.pipe(Schema.annotateKey({ messageMissingKey: "name is required" })),
+    version: ExactSemverVersionSchema.pipe(Schema.annotateKey({ messageMissingKey: "version is required" })),
+}).annotate({
+    identifier: "ManifestIdentity",
+    title: "Manifest Identity",
+    description: "The key identity fields from a manifest: who owns it, what type, its name, and version.",
+});
+export const manifestSchemaForType = (type) => {
+    switch (type) {
+        case "skill":
+            return SkillManifestSchema;
+        case "command":
+            return CommandManifestSchema;
+        case "mcp-server":
+            return McpServerManifestSchema;
+        case "subagent":
+            return SubagentManifestSchema;
+        case "pack":
+            return ExtensionPackManifestSchema;
+        default:
+            return undefined;
+    }
+};
+export const resolveManifest = (input) => Effect.gen(function* () {
+    const expectedFilename = manifestFilenameForType(input.type);
+    if (expectedFilename === undefined) {
+        return yield* new ManifestError({
+            code: "manifest_missing",
+            detail: `No manifest filename policy for extension type "${input.type}".`,
+        });
+    }
+    const [manifestEntry, ...rest] = input.entries.filter((entry) => {
+        const normalized = entry.fileName.replace(/\\/g, "/");
+        return (normalized === expectedFilename ||
+            normalized.toLowerCase() === expectedFilename.toLowerCase());
+    });
+    if (manifestEntry === undefined) {
+        return yield* new ManifestError({
+            code: "manifest_missing",
+            detail: `Expected manifest file "${expectedFilename}" not found in archive root.`,
+        });
+    }
+    if (rest.length > 0) {
+        const allCandidates = [manifestEntry, ...rest];
+        return yield* new ManifestError({
+            code: "manifest_multiple",
+            detail: `Multiple manifest candidates found for type "${input.type}": ${allCandidates.map((candidate) => candidate.fileName).join(", ")}.`,
+        });
+    }
+    const rawBytes = yield* input.readEntry(manifestEntry.fileName);
+    const text = new TextDecoder().decode(rawBytes);
+    const parsed = yield* Schema.decodeUnknownEffect(Schema.UnknownFromJsonString)(text).pipe(Effect.mapError(() => new ManifestError({
+        code: "manifest_invalid_json",
+        detail: `Manifest file "${manifestEntry.fileName}" contains invalid JSON.`,
+    })));
+    const schema = manifestSchemaForType(input.type);
+    if (schema !== undefined) {
+        yield* Schema.decodeUnknownEffect(schema)(parsed).pipe(Effect.mapError((error) => new ManifestError({
+            code: "manifest_schema_invalid",
+            detail: `Manifest file "${manifestEntry.fileName}" does not conform to the ${input.type} manifest schema.`,
+            details: SchemaIssue.makeFormatterDefault()(error.issue),
+        })));
+    }
+    const identity = yield* Schema.decodeUnknownEffect(ManifestIdentitySchema)(parsed).pipe(Effect.mapError(() => new ManifestError({
+        code: "manifest_schema_invalid",
+        detail: `Manifest file "${manifestEntry.fileName}" is missing required identity fields (owner, type, name, version).`,
+    })));
+    return {
+        identity,
+        raw: parsed,
+        fileName: manifestEntry.fileName,
+    };
+});
+export const validateDeclaredManifestAlignment = (declaredIdentity, manifest) => {
+    const mismatches = [];
+    if (declaredIdentity.name !== manifest.name) {
+        mismatches.push(`name: declared="${declaredIdentity.name}" manifest="${manifest.name}"`);
+    }
+    if (declaredIdentity.owner !== manifest.owner) {
+        mismatches.push(`owner: declared="${declaredIdentity.owner}" manifest="${manifest.owner}"`);
+    }
+    if (declaredIdentity.type !== manifest.type) {
+        mismatches.push(`type: declared="${declaredIdentity.type}" manifest="${manifest.type}"`);
+    }
+    if (declaredIdentity.version !== manifest.version) {
+        mismatches.push(`version: declared="${declaredIdentity.version}" manifest="${manifest.version}"`);
+    }
+    if (mismatches.length > 0) {
+        return Result.fail(new ManifestError({
+            code: "declared_manifest_mismatch",
+            detail: `Declared publish identity and manifest identity disagree: ${mismatches.join(", ")}.`,
+            details: { declaredIdentity, manifest },
+        }));
+    }
+    return Result.void;
+};
+//# sourceMappingURL=manifest-policy.js.map

package/dist/src/unstable/publish/manifest-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-policy.js","sourceRoot":"","sources":["../../../../src/unstable/publish/manifest-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,WAAW,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAClG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAGpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAe,MAAM,yBAAyB,CAAC;AACpE,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,IAAI,uBAAuB,GAC7C,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,sBAAsB,EACtB,iBAAiB,IAAI,0BAA0B,GAChD,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,wBAAwB,GAEzB,MAAM,+CAA+C,CAAC;AAGvD,MAAM,OAAO,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CASjE;CAAG;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAsB,EAAE;IAC1E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,uBAAuB,CAAC;QACjC,KAAK,SAAS;YACZ,OAAO,yBAAyB,CAAC;QACnC,KAAK,YAAY;YACf,OAAO,4BAA4B,CAAC;QACtC,KAAK,UAAU;YACb,OAAO,0BAA0B,CAAC;QACpC,KAAK,MAAM;YACT,OAAO,gCAAgC,CAAC;QAC1C;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACxF,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7F,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7F,OAAO,EAAE,wBAAwB,CAAC,IAAI,CACpC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC,CACjE;CACF,CAAC,CAAC,QAAQ,CAAC;IACV,UAAU,EAAE,kBAAkB;IAC9B,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EACT,yFAAyF;CAC5F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAE,EAAE;IACpD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,mBAAmB,CAAC;QAC7B,KAAK,SAAS;YACZ,OAAO,qBAAqB,CAAC;QAC/B,KAAK,YAAY;YACf,OAAO,uBAAuB,CAAC;QACjC,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC;QAChC,KAAK,MAAM;YACT,OAAO,2BAA2B,CAAC;QACrC;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAqBF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAA8B,EAC0C,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC;YAC9B,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,mDAAmD,KAAK,CAAC,IAAI,IAAI;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,CACL,UAAU,KAAK,gBAAgB;YAC/B,UAAU,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC;YAC9B,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,2BAA2B,gBAAgB,8BAA8B;SAClF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC;YAC9B,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,gDAAgD,KAAK,CAAC,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC3I,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CACvF,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,aAAa,CAAC;QAChB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,kBAAkB,aAAa,CAAC,QAAQ,0BAA0B;KAC3E,CAAC,CACL,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,aAAa,CAAC;YAChB,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,kBAAkB,aAAa,CAAC,QAAQ,6BAA6B,KAAK,CAAC,IAAI,mBAAmB;YAC1G,OAAO,EAAE,WAAW,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;SACzD,CAAC,CACL,CACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CACrF,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,aAAa,CAAC;QAChB,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,kBAAkB,aAAa,CAAC,QAAQ,qEAAqE;KACtH,CAAC,CACL,CACF,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,GAAG,EAAE,MAAM;QACX,QAAQ,EAAE,aAAa,CAAC,QAAQ;KACjC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAC/C,gBAAyC,EACzC,QAA0B,EACU,EAAE;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,IAAI,gBAAgB,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,UAAU,CAAC,IAAI,CAAC,mBAAmB,gBAAgB,CAAC,IAAI,eAAe,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC9C,UAAU,CAAC,IAAI,CAAC,oBAAoB,gBAAgB,CAAC,KAAK,eAAe,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,UAAU,CAAC,IAAI,CAAC,mBAAmB,gBAAgB,CAAC,IAAI,eAAe,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClD,UAAU,CAAC,IAAI,CACb,sBAAsB,gBAAgB,CAAC,OAAO,eAAe,QAAQ,CAAC,OAAO,GAAG,CACjF,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,aAAa,CAAC;YAChB,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,6DAA6D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7F,OAAO,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE;SACxC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC,CAAC"}

package/dist/src/unstable/publish/test-zip-helpers.d.ts

@@ -0,0 +1,13 @@
+interface ZipFileEntry {
+    fileName: string;
+    content: Uint8Array;
+    compressionMethod?: number;
+    externalAttributes?: number;
+}
+export declare const buildZip: (entries: ZipFileEntry[]) => Uint8Array;
+export declare const buildSymlinkZip: (symlinkName: string, targetPath: string) => Uint8Array;
+export declare const buildDecompressionBombZip: (uncompressedSize: number, compressedSize: number, entryName?: string) => Uint8Array;
+export declare const buildMalformedZip: () => Uint8Array;
+export declare const textContent: (text: string) => Uint8Array;
+export {};
+//# sourceMappingURL=test-zip-helpers.d.ts.map

package/dist/src/unstable/publish/test-zip-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-zip-helpers.d.ts","sourceRoot":"","sources":["../../../../src/unstable/publish/test-zip-helpers.ts"],"names":[],"mappings":"AAEA,UAAU,YAAY;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,UAAU,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyBD,eAAO,MAAM,QAAQ,GAAI,SAAS,YAAY,EAAE,KAAG,UA4ElD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,aAAa,MAAM,EAAE,YAAY,MAAM,KAAG,UASzE,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,kBAAkB,MAAM,EACxB,gBAAgB,MAAM,EACtB,kBAAsB,KACrB,UAsBF,CAAC;AAEF,eAAO,MAAM,iBAAiB,QAAO,UACiB,CAAC;AAEvD,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,UAAsC,CAAC"}