@agentxm/registry-protocol 0.28.12 → 0.28.13

package/dist/src/unstable/publish/archive-guardrails.js

@@ -1,250 +0,0 @@
-import * as Data from "effect/Data";
-import * as Effect from "effect/Effect";
-export class ArchiveGuardrailError extends Data.TaggedError("ArchiveGuardrailError") {
-}
-const ZIP_EOCD_SIGNATURE = 0x06054b50;
-const ZIP_CDIR_SIGNATURE = 0x02014b50;
-export const ZIP_LOCAL_SIGNATURE = 0x04034b50;
-const COMPRESSION_STORE = 0;
-const COMPRESSION_DEFLATE = 8;
-const SUPPORTED_COMPRESSION = new Set([COMPRESSION_STORE, COMPRESSION_DEFLATE]);
-const S_IFLNK = 0xa000;
-const S_IFMT = 0xf000;
-const textDecoder = new TextDecoder();
-const DEFAULT_LIMITS = {
-    maxEntries: 10_000,
-    maxDecompressedBytes: 256 * 1024 * 1024,
-    maxCompressionRatio: 100,
-};
-const findEocdOffset = (buf) => Effect.gen(function* () {
-    const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
-    const minOffset = Math.max(0, buf.length - 22 - 65535);
-    for (let i = buf.length - 22; i >= minOffset; i--) {
-        if (view.getUint32(i, true) === ZIP_EOCD_SIGNATURE) {
-            return i;
-        }
-    }
-    return yield* new ArchiveGuardrailError({
-        code: "malformed_archive",
-        message: "ZIP end-of-central-directory record not found.",
-    });
-});
-export const parseZipCentralDirectory = (buf) => Effect.gen(function* () {
-    if (buf.length < 22) {
-        return yield* new ArchiveGuardrailError({
-            code: "malformed_archive",
-            message: "Archive too small to be a valid ZIP file.",
-        });
-    }
-    const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
-    if (view.getUint32(0, true) !== ZIP_LOCAL_SIGNATURE) {
-        return yield* new ArchiveGuardrailError({
-            code: "malformed_archive",
-            message: "Archive does not start with a valid ZIP local file header signature.",
-        });
-    }
-    const eocdOffset = yield* findEocdOffset(buf);
-    const totalEntries = view.getUint16(eocdOffset + 10, true);
-    const cdirSize = view.getUint32(eocdOffset + 12, true);
-    const cdirOffset = view.getUint32(eocdOffset + 16, true);
-    if (cdirOffset + cdirSize > buf.length) {
-        return yield* new ArchiveGuardrailError({
-            code: "malformed_archive",
-            message: "Central directory offset and size exceed archive bounds.",
-        });
-    }
-    const entries = [];
-    let offset = cdirOffset;
-    for (let i = 0; i < totalEntries; i++) {
-        if (offset + 46 > buf.length) {
-            return yield* new ArchiveGuardrailError({
-                code: "malformed_archive",
-                message: `Central directory entry ${i} exceeds archive bounds.`,
-            });
-        }
-        const signature = view.getUint32(offset, true);
-        if (signature !== ZIP_CDIR_SIGNATURE) {
-            return yield* new ArchiveGuardrailError({
-                code: "malformed_archive",
-                message: `Invalid central directory entry signature at offset ${offset}.`,
-            });
-        }
-        const compressionMethod = view.getUint16(offset + 10, true);
-        const compressedSize = view.getUint32(offset + 20, true);
-        const uncompressedSize = view.getUint32(offset + 24, true);
-        const fileNameLength = view.getUint16(offset + 28, true);
-        const extraFieldLength = view.getUint16(offset + 30, true);
-        const fileCommentLength = view.getUint16(offset + 32, true);
-        const externalAttributes = view.getUint32(offset + 38, true);
-        const localHeaderOffset = view.getUint32(offset + 42, true);
-        const fileNameStart = offset + 46;
-        const fileNameEnd = fileNameStart + fileNameLength;
-        if (fileNameEnd > buf.length) {
-            return yield* new ArchiveGuardrailError({
-                code: "malformed_archive",
-                message: `File name for entry ${i} exceeds archive bounds.`,
-            });
-        }
-        const fileName = textDecoder.decode(buf.slice(fileNameStart, fileNameEnd));
-        entries.push({
-            fileName,
-            compressedSize,
-            uncompressedSize,
-            compressionMethod,
-            externalAttributes,
-            localHeaderOffset,
-        });
-        offset = fileNameEnd + extraFieldLength + fileCommentLength;
-    }
-    return entries;
-});
-const checkPathTraversal = (entries) => {
-    for (const entry of entries) {
-        const normalized = entry.fileName.replace(/\\/g, "/");
-        if (normalized.includes("../") || normalized.includes("/..") || normalized === "..") {
-            return Effect.fail(new ArchiveGuardrailError({
-                code: "path_traversal",
-                message: `Archive entry contains path traversal: "${entry.fileName}".`,
-                entry: entry.fileName,
-            }));
-        }
-    }
-    return Effect.void;
-};
-const checkAbsolutePaths = (entries) => {
-    for (const entry of entries) {
-        const normalized = entry.fileName.replace(/\\/g, "/");
-        if (normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized)) {
-            return Effect.fail(new ArchiveGuardrailError({
-                code: "absolute_path",
-                message: `Archive entry contains an absolute path: "${entry.fileName}".`,
-                entry: entry.fileName,
-            }));
-        }
-    }
-    return Effect.void;
-};
-const checkDuplicateEntries = (entries) => {
-    const seen = new Set();
-    for (const entry of entries) {
-        const normalized = entry.fileName.toLowerCase();
-        if (seen.has(normalized)) {
-            return Effect.fail(new ArchiveGuardrailError({
-                code: "duplicate_entry",
-                message: `Archive contains duplicate entry: "${entry.fileName}".`,
-                entry: entry.fileName,
-            }));
-        }
-        seen.add(normalized);
-    }
-    return Effect.void;
-};
-const checkSymlinks = (entries) => {
-    for (const entry of entries) {
-        const unixMode = entry.externalAttributes >>> 16;
-        if ((unixMode & S_IFMT) === S_IFLNK) {
-            return Effect.fail(new ArchiveGuardrailError({
-                code: "symlink_entry",
-                message: `Archive contains symlink entry: "${entry.fileName}".`,
-                entry: entry.fileName,
-            }));
-        }
-    }
-    return Effect.void;
-};
-const checkCompressionMethods = (entries) => {
-    for (const entry of entries) {
-        if (!SUPPORTED_COMPRESSION.has(entry.compressionMethod)) {
-            return Effect.fail(new ArchiveGuardrailError({
-                code: "unsupported_compression",
-                message: `Archive entry uses unsupported compression method ${entry.compressionMethod}: "${entry.fileName}".`,
-                entry: entry.fileName,
-            }));
-        }
-    }
-    return Effect.void;
-};
-const checkEntryCount = (entries, limits) => entries.length > limits.maxEntries
-    ? Effect.fail(new ArchiveGuardrailError({
-        code: "entry_count_exceeded",
-        message: `Archive contains ${entries.length} entries, exceeding the maximum allowed ${limits.maxEntries}.`,
-    }))
-    : Effect.void;
-const checkDecompressedSize = (entries, limits) => {
-    let totalUncompressed = 0;
-    for (const entry of entries) {
-        totalUncompressed += entry.uncompressedSize;
-        if (totalUncompressed > limits.maxDecompressedBytes) {
-            return Effect.fail(new ArchiveGuardrailError({
-                code: "decompression_limit_exceeded",
-                message: `Archive decompressed size exceeds maximum allowed ${limits.maxDecompressedBytes} bytes.`,
-                entry: entry.fileName,
-            }));
-        }
-    }
-    return Effect.void;
-};
-const checkCompressionRatio = (entries, limits) => {
-    for (const entry of entries) {
-        if (entry.compressedSize === 0) {
-            if (entry.uncompressedSize > 0) {
-                return Effect.fail(new ArchiveGuardrailError({
-                    code: "compression_ratio_exceeded",
-                    message: `Archive entry "${entry.fileName}" exceeds maximum compression ratio.`,
-                    entry: entry.fileName,
-                }));
-            }
-            continue;
-        }
-        const ratio = entry.uncompressedSize / entry.compressedSize;
-        if (ratio > limits.maxCompressionRatio) {
-            return Effect.fail(new ArchiveGuardrailError({
-                code: "compression_ratio_exceeded",
-                message: `Archive entry "${entry.fileName}" exceeds maximum compression ratio ${limits.maxCompressionRatio}.`,
-                entry: entry.fileName,
-            }));
-        }
-    }
-    return Effect.void;
-};
-const FORBIDDEN_SEGMENTS = new Set(["node_modules", ".git"]);
-/**
- * Reject archives carrying build or secret leftovers: any `node_modules` or
- * `.git` path segment, and `.env` / `.env.*` files. Kept out of
- * {@link validateArchive} on purpose — that function is the registry ingest
- * contract, and archives accepted by earlier clients must keep ingesting.
- *
- * `.env*` matches the basename exactly (`.env`) or by dotted prefix
- * (`.env.local`, `.env.production`, and also `.env.example`), so sibling names
- * like `.envrc` and `environment.md` are unaffected.
- */
-export const checkForbiddenSourceEntries = (entries) => {
-    for (const entry of entries) {
-        const segments = entry.fileName.replace(/\\/g, "/").split("/");
-        const basename = segments[segments.length - 1] ?? "";
-        if (segments.some((segment) => FORBIDDEN_SEGMENTS.has(segment)) ||
-            basename === ".env" ||
-            basename.startsWith(".env.")) {
-            return Effect.fail(new ArchiveGuardrailError({
-                code: "forbidden_entry",
-                message: `Archive contains a forbidden entry: "${entry.fileName}".`,
-                entry: entry.fileName,
-            }));
-        }
-    }
-    return Effect.void;
-};
-export const validateArchive = (archiveBytes, limits) => Effect.gen(function* () {
-    const appliedLimits = { ...DEFAULT_LIMITS, ...limits };
-    const entries = yield* parseZipCentralDirectory(archiveBytes);
-    yield* checkPathTraversal(entries);
-    yield* checkAbsolutePaths(entries);
-    yield* checkDuplicateEntries(entries);
-    yield* checkSymlinks(entries);
-    yield* checkCompressionMethods(entries);
-    yield* checkEntryCount(entries, appliedLimits);
-    yield* checkDecompressedSize(entries, appliedLimits);
-    yield* checkCompressionRatio(entries, appliedLimits);
-    return entries;
-});
-//# sourceMappingURL=archive-guardrails.js.map

package/dist/src/unstable/publish/filtered-package-validation.d.ts

@@ -1,24 +0,0 @@
-import * as Effect from "effect/Effect";
-import type { ExtensionType } from "@agentxm/extension-model/unstable/extensions";
-import type { ArchiveGuardrailError, ZipEntry } from "./archive-guardrails.js";
-import type { ResolvedManifest } from "./manifest-policy.js";
-declare const FilteredPackageError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "FilteredPackageError";
-} & Readonly<A>;
-/** A type-specific package invariant failed against the filtered archive. */
-export declare class FilteredPackageError extends FilteredPackageError_base<{
-    readonly code: "required_file_missing" | "content_invalid" | "reference_invalid";
-    readonly detail: string;
-    readonly path?: string;
-}> {
-}
-export interface ValidateFilteredPackageArgs {
-    readonly type: ExtensionType;
-    readonly entries: ReadonlyArray<ZipEntry>;
-    readonly manifest: ResolvedManifest;
-    readonly readEntry: (fileName: string) => Effect.Effect<Uint8Array, ArchiveGuardrailError | FilteredPackageError>;
-}
-/** Validate the complete type-specific package after Registry-only filtering. */
-export declare const validateFilteredPackage: (args: ValidateFilteredPackageArgs) => Effect.Effect<void, FilteredPackageError>;
-export {};
-//# sourceMappingURL=filtered-package-validation.d.ts.map

package/dist/src/unstable/publish/filtered-package-validation.js

@@ -1,117 +0,0 @@
-import * as Data from "effect/Data";
-import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import { parseFrontmatterEffect } from "../content/frontmatter.js";
-import { inspectKnowledgeEntries } from "../knowledge/okf.js";
-import { parseSkillMd } from "../content/skill-content.js";
-import { parseSubagentMd } from "../content/subagent-content.js";
-/** A type-specific package invariant failed against the filtered archive. */
-export class FilteredPackageError extends Data.TaggedError("FilteredPackageError") {
-}
-const rawField = (raw, field) => typeof raw === "object" && raw !== null && !Array.isArray(raw)
-    ? Reflect.get(raw, field)
-    : undefined;
-const safeArchivePath = (value) => value.length > 0 &&
-    !value.startsWith("/") &&
-    !value.includes("\\") &&
-    !value.split("/").some((segment) => segment === "" || segment === "." || segment === "..");
-const requireEntry = (entries, path) => {
-    const found = entries.find((entry) => entry.fileName === path);
-    return found === undefined
-        ? Effect.fail(new FilteredPackageError({
-            code: "required_file_missing",
-            detail: `Filtered ${path} is required by this package type.`,
-            path,
-        }))
-        : Effect.succeed(found);
-};
-const readText = (args, path) => Effect.gen(function* () {
-    yield* requireEntry(args.entries, path);
-    const bytes = yield* args.readEntry(path).pipe(Effect.mapError(() => new FilteredPackageError({
-        code: "content_invalid",
-        detail: `Could not read filtered package file "${path}".`,
-        path,
-    })));
-    return new TextDecoder().decode(bytes);
-});
-/** Validate the complete type-specific package after Registry-only filtering. */
-export const validateFilteredPackage = (args) => Effect.gen(function* () {
-    const name = args.manifest.identity.name;
-    switch (args.type) {
-        case "skill": {
-            const path = "src/SKILL.md";
-            const content = yield* readText(args, path);
-            if (Option.isNone(parseSkillMd(content, name))) {
-                return yield* new FilteredPackageError({
-                    code: "content_invalid",
-                    detail: `Filtered "${path}" must contain valid Agent Skill frontmatter whose name is "${name}".`,
-                    path,
-                });
-            }
-            return;
-        }
-        case "subagent": {
-            const path = `src/${name}.md`;
-            const content = yield* readText(args, path);
-            yield* parseSubagentMd(content, name).pipe(Effect.mapError(() => new FilteredPackageError({
-                code: "content_invalid",
-                detail: `Filtered "${path}" must contain valid subagent frontmatter whose name is "${name}".`,
-                path,
-            })));
-            return;
-        }
-        case "rule": {
-            const path = "src/RULE.md";
-            const content = yield* readText(args, path);
-            yield* parseFrontmatterEffect(content).pipe(Effect.mapError(() => new FilteredPackageError({
-                code: "content_invalid",
-                detail: `Filtered "${path}" contains invalid frontmatter.`,
-                path,
-            })));
-            return;
-        }
-        case "hook": {
-            const entrypoint = rawField(args.manifest.raw, "entrypoint");
-            if (typeof entrypoint !== "string" || !safeArchivePath(entrypoint)) {
-                return yield* new FilteredPackageError({
-                    code: "reference_invalid",
-                    detail: "Hook entrypoint must be a safe package-relative file path.",
-                });
-            }
-            yield* requireEntry(args.entries, entrypoint);
-            return;
-        }
-        case "knowledge": {
-            if (rawField(args.manifest.raw, "bundleRoot") !== "src") {
-                return yield* new FilteredPackageError({
-                    code: "reference_invalid",
-                    detail: "Knowledge bundleRoot must resolve to the filtered src directory.",
-                });
-            }
-            yield* readText(args, "src/index.md");
-            const sourcePrefix = "src/";
-            const knowledgeEntries = args.entries
-                .filter((entry) => entry.fileName.startsWith(sourcePrefix))
-                .map((entry) => ({
-                relativePath: entry.fileName.slice(sourcePrefix.length),
-                type: "File",
-                size: BigInt(entry.uncompressedSize),
-            }));
-            const inspection = yield* inspectKnowledgeEntries(knowledgeEntries, (relativePath) => readText(args, `${sourcePrefix}${relativePath}`));
-            const errors = inspection.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
-            if (errors.length > 0) {
-                return yield* new FilteredPackageError({
-                    code: "content_invalid",
-                    detail: `Filtered Knowledge bundle is invalid: ${errors
-                        .map((diagnostic) => `${diagnostic.relativePath}: ${diagnostic.message}`)
-                        .join("; ")}`,
-                });
-            }
-            return;
-        }
-        case "mcp-server":
-        case "pack":
-            return;
-    }
-});
-//# sourceMappingURL=filtered-package-validation.js.map

package/dist/src/unstable/publish/ingest-limits.d.ts

@@ -1,25 +0,0 @@
-import * as Result from "effect/Result";
-export declare const REGISTRY_PUBLISH_MAX_REQUEST_BYTES: number;
-export declare const REGISTRY_PUBLISH_MAX_ARCHIVE_BYTES: number;
-declare const IngestLimitError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "IngestLimitError";
-} & Readonly<A>;
-export declare class IngestLimitError extends IngestLimitError_base<{
-    readonly code: "ingest_request_too_large" | "ingest_archive_too_large" | "ingest_decompression_limit";
-    readonly detail: string;
-    readonly limit?: number;
-    readonly actual?: number;
-}> {
-}
-declare const IngestUnsupportedContentTypeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "IngestUnsupportedContentTypeError";
-} & Readonly<A>;
-export declare class IngestUnsupportedContentTypeError extends IngestUnsupportedContentTypeError_base<{
-    readonly detail: string;
-}> {
-}
-export declare const enforceRequestSizeLimit: (contentLength: number | undefined, maxBytes?: number) => Result.Result<void, IngestLimitError>;
-export declare const enforceArchiveSizeLimit: (archiveBytes: number, maxBytes?: number) => Result.Result<void, IngestLimitError>;
-export declare const enforceArchiveContentType: (contentType: string | undefined) => Result.Result<void, IngestUnsupportedContentTypeError>;
-export {};
-//# sourceMappingURL=ingest-limits.d.ts.map

package/dist/src/unstable/publish/ingest-limits.js

@@ -1,41 +0,0 @@
-import * as Data from "effect/Data";
-import * as Result from "effect/Result";
-export const REGISTRY_PUBLISH_MAX_REQUEST_BYTES = 35 * 1024 * 1024;
-export const REGISTRY_PUBLISH_MAX_ARCHIVE_BYTES = 25 * 1024 * 1024;
-export class IngestLimitError extends Data.TaggedError("IngestLimitError") {
-}
-export class IngestUnsupportedContentTypeError extends Data.TaggedError("IngestUnsupportedContentTypeError") {
-}
-export const enforceRequestSizeLimit = (contentLength, maxBytes = REGISTRY_PUBLISH_MAX_REQUEST_BYTES) => {
-    if (contentLength !== undefined && contentLength > maxBytes) {
-        return Result.fail(new IngestLimitError({
-            code: "ingest_request_too_large",
-            detail: `Request body exceeds maximum size of ${maxBytes} bytes.`,
-            limit: maxBytes,
-            actual: contentLength,
-        }));
-    }
-    return Result.void;
-};
-export const enforceArchiveSizeLimit = (archiveBytes, maxBytes = REGISTRY_PUBLISH_MAX_ARCHIVE_BYTES) => {
-    if (archiveBytes > maxBytes) {
-        return Result.fail(new IngestLimitError({
-            code: "ingest_archive_too_large",
-            detail: `Archive exceeds maximum size of ${maxBytes} bytes.`,
-            limit: maxBytes,
-            actual: archiveBytes,
-        }));
-    }
-    return Result.void;
-};
-const V1_ARCHIVE_CONTENT_TYPES = new Set(["application/zip"]);
-export const enforceArchiveContentType = (contentType) => {
-    const normalized = contentType?.split(";")[0]?.trim().toLowerCase();
-    if (!normalized || !V1_ARCHIVE_CONTENT_TYPES.has(normalized)) {
-        return Result.fail(new IngestUnsupportedContentTypeError({
-            detail: `Unsupported archive content type: ${contentType ?? "(none)"}. Supported: application/zip.`,
-        }));
-    }
-    return Result.void;
-};
-//# sourceMappingURL=ingest-limits.js.map

package/dist/src/unstable/publish/input-normalization.d.ts

@@ -1,40 +0,0 @@
-import * as Effect from "effect/Effect";
-import type { ExtensionName, ExtensionType } from "@agentxm/extension-model/unstable/extensions";
-import type { Handle } from "@agentxm/extension-model/unstable/extensions/handle";
-import { ArchiveGuardrailError, type ArchiveGuardrailLimits, type ZipEntry } from "./archive-guardrails.js";
-import { type IngestLimitError, type IngestUnsupportedContentTypeError } from "./ingest-limits.js";
-import { type ManifestError, type ResolvedManifest } from "./manifest-policy.js";
-import type { Version } from "@agentxm/extension-model/unstable/version-constraints";
-import { FilteredPackageError } from "./filtered-package-validation.js";
-export interface DeclaredPublishIdentity {
-    readonly owner: Handle;
-    readonly type: ExtensionType;
-    readonly name: ExtensionName;
-    readonly version: Version;
-}
-export interface PublishArchiveInput {
-    readonly archiveBytes: Uint8Array;
-    readonly archiveContentType?: string;
-    readonly clientIntegrity?: string;
-}
-export interface NormalizePublishInputArgs {
-    readonly declaredIdentity: DeclaredPublishIdentity;
-    readonly archive: PublishArchiveInput;
-    readonly digestHeader?: string;
-    readonly readEntry?: (archiveBytes: Uint8Array, entry: ZipEntry) => Effect.Effect<Uint8Array, ArchiveGuardrailError>;
-    readonly guardrailLimits?: ArchiveGuardrailLimits;
-}
-export interface PublishInput {
-    readonly owner: Handle;
-    readonly type: ExtensionType;
-    readonly name: ExtensionName;
-    readonly version: Version;
-    readonly archiveBytes: Uint8Array;
-    readonly archiveContentType: string;
-    readonly manifest: ResolvedManifest;
-    readonly clientIntegrity?: string;
-    readonly digestHeader?: string;
-}
-export declare const defaultReadEntry: (archiveBytes: Uint8Array, entry: ZipEntry) => Effect.Effect<Uint8Array, ArchiveGuardrailError>;
-export declare const normalizePublishInput: (args: NormalizePublishInputArgs) => Effect.Effect<PublishInput, IngestLimitError | IngestUnsupportedContentTypeError | ArchiveGuardrailError | ManifestError | FilteredPackageError>;
-//# sourceMappingURL=input-normalization.d.ts.map

package/dist/src/unstable/publish/input-normalization.js

@@ -1,125 +0,0 @@
-import * as Effect from "effect/Effect";
-import { inflateRawSync } from "node:zlib";
-import { ArchiveGuardrailError, ZIP_LOCAL_SIGNATURE, validateArchive, } from "./archive-guardrails.js";
-import { enforceArchiveContentType, enforceArchiveSizeLimit, } from "./ingest-limits.js";
-import { resolveManifest, validateDeclaredManifestAlignment, } from "./manifest-policy.js";
-import { FilteredPackageError, validateFilteredPackage } from "./filtered-package-validation.js";
-const LOCAL_FILE_HEADER_SIZE = 30;
-export const defaultReadEntry = (archiveBytes, entry) => Effect.gen(function* () {
-    const { localHeaderOffset, compressedSize, compressionMethod, fileName } = entry;
-    if (localHeaderOffset + LOCAL_FILE_HEADER_SIZE > archiveBytes.length) {
-        return yield* new ArchiveGuardrailError({
-            code: "malformed_archive",
-            message: `Local file header for entry "${fileName}" exceeds archive bounds.`,
-            entry: fileName,
-        });
-    }
-    const view = new DataView(archiveBytes.buffer, archiveBytes.byteOffset, archiveBytes.byteLength);
-    const signature = view.getUint32(localHeaderOffset, true);
-    if (signature !== ZIP_LOCAL_SIGNATURE) {
-        return yield* new ArchiveGuardrailError({
-            code: "malformed_archive",
-            message: `Invalid local file header signature for entry "${fileName}".`,
-            entry: fileName,
-        });
-    }
-    const fileNameLength = view.getUint16(localHeaderOffset + 26, true);
-    const extraFieldLength = view.getUint16(localHeaderOffset + 28, true);
-    const dataStart = localHeaderOffset + LOCAL_FILE_HEADER_SIZE + fileNameLength + extraFieldLength;
-    if (dataStart + compressedSize > archiveBytes.length) {
-        return yield* new ArchiveGuardrailError({
-            code: "malformed_archive",
-            message: `Compressed data for entry "${fileName}" exceeds archive bounds.`,
-            entry: fileName,
-        });
-    }
-    const compressedData = archiveBytes.slice(dataStart, dataStart + compressedSize);
-    if (compressionMethod === 0) {
-        return compressedData;
-    }
-    if (compressionMethod === 8) {
-        // Cap actual decompression at the declared (guardrail-validated) size so a
-        // small deflate stream cannot expand into a memory bomb, and route any
-        // inflate throw into the typed error channel instead of an uncaught defect.
-        const result = yield* Effect.try({
-            try: () => inflateRawSync(compressedData, { maxOutputLength: entry.uncompressedSize }),
-            catch: (error) => {
-                const errorCode = typeof error === "object" &&
-                    error !== null &&
-                    "code" in error &&
-                    typeof error.code === "string"
-                    ? error.code
-                    : "";
-                return errorCode === "ERR_BUFFER_TOO_LARGE"
-                    ? new ArchiveGuardrailError({
-                        code: "decompression_limit_exceeded",
-                        message: `Entry "${fileName}" decompresses beyond its declared size of ${entry.uncompressedSize} bytes.`,
-                        entry: fileName,
-                    })
-                    : new ArchiveGuardrailError({
-                        code: "malformed_archive",
-                        message: `Failed to decompress entry "${fileName}".`,
-                        entry: fileName,
-                    });
-            },
-        });
-        return new Uint8Array(result.buffer, result.byteOffset, result.byteLength);
-    }
-    return yield* new ArchiveGuardrailError({
-        code: "unsupported_compression",
-        message: `Unsupported compression method ${compressionMethod} for entry "${fileName}".`,
-        entry: fileName,
-    });
-});
-export const normalizePublishInput = (args) => Effect.gen(function* () {
-    const { declaredIdentity, archive, digestHeader, guardrailLimits } = args;
-    const entryReader = args.readEntry ?? defaultReadEntry;
-    yield* Effect.fromResult(enforceArchiveContentType(archive.archiveContentType));
-    yield* Effect.fromResult(enforceArchiveSizeLimit(archive.archiveBytes.length));
-    const entries = yield* validateArchive(archive.archiveBytes, guardrailLimits);
-    const manifest = yield* resolveManifest({
-        type: declaredIdentity.type,
-        entries,
-        readEntry: (fileName) => {
-            const entry = entries.find((candidate) => candidate.fileName === fileName);
-            if (entry === undefined) {
-                return Effect.fail(new ArchiveGuardrailError({
-                    code: "malformed_archive",
-                    message: `Entry "${fileName}" not found in archive.`,
-                    entry: fileName,
-                }));
-            }
-            return entryReader(archive.archiveBytes, entry);
-        },
-    });
-    yield* Effect.fromResult(validateDeclaredManifestAlignment(declaredIdentity, manifest.identity));
-    yield* validateFilteredPackage({
-        type: declaredIdentity.type,
-        entries,
-        manifest,
-        readEntry: (fileName) => {
-            const entry = entries.find((candidate) => candidate.fileName === fileName);
-            return entry === undefined
-                ? Effect.fail(new FilteredPackageError({
-                    code: "required_file_missing",
-                    detail: `Filtered package file "${fileName}" is missing.`,
-                    path: fileName,
-                }))
-                : entryReader(archive.archiveBytes, entry);
-        },
-    });
-    return {
-        owner: declaredIdentity.owner,
-        type: declaredIdentity.type,
-        name: declaredIdentity.name,
-        version: declaredIdentity.version,
-        archiveBytes: archive.archiveBytes,
-        archiveContentType: archive.archiveContentType ?? "application/zip",
-        manifest,
-        ...(archive.clientIntegrity === undefined
-            ? {}
-            : { clientIntegrity: archive.clientIntegrity }),
-        ...(digestHeader === undefined ? {} : { digestHeader }),
-    };
-});
-//# sourceMappingURL=input-normalization.js.map