@alchemy.run/pkg 0.0.0-placeholder → 2.0.0-beta.79

package/LICENSE

@@ -0,0 +1,201 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,5 @@
+Alchemy
+Copyright 2026 Functionless Corp.
+
+This product includes software developed by third parties. See
+THIRD_PARTY_LICENSES.md for attribution and license details.

package/README.md

@@ -0,0 +1,117 @@
+# @alchemy.run/pkg
+
+Preview packages for pull requests. A Cloudflare Worker registry that verifies every publication against the GitHub Actions run that produced it, plus the `pkg` CLI that packs workspace packages and publishes them from CI.
+
+Install URLs look like `https://pkg.alchemy.run/<name>/<tag>`, where `<tag>` is a commit SHA, a short SHA, `branch:<name>`, or `pr:<number>`:
+
+```sh
+pnpm install https://pkg.alchemy.run/alchemy/pr:1516
+pnpm install https://pkg.alchemy.run/alchemy/branch:main
+pnpm install https://pkg.alchemy.run/alchemy/163c051
+```
+
+## How a publication flows
+
+Every publication is a GitHub Actions **run**. The registry never trusts what a client says about commits, branches, or pull requests; it resolves the run through the GitHub API and derives every tag from that.
+
+1. One workflow runs on `push` and `pull_request`, builds the workspace, runs `pkg pack`, uploads the manifest as an artifact with `actions/upload-artifact`, and runs `pkg publish`. It needs no permissions and no secrets, so fork pull requests run it exactly like everything else.
+2. `pkg pack` prints the artifact name, `pkg-manifest-<sha256 of the manifest>`, as the `artifact-name` step output for the upload. Only the job's runtime token can add artifacts to the run, and the runner exposes that token to actions alone, which is why the upload is its own step. The artifact is GitHub's record that this run vouched for exactly these package hashes.
+3. Requests name the run they come from (repository, run id, attempt) and nothing else. The registry fetches the run through the App, requires it to be in progress, lists its artifacts, and refuses any manifest whose hash is not vouched for. Someone naming another run can only ever get that run's own manifest accepted, which changes nothing.
+4. One idempotent publish either answers with the tarballs it lacks, which the CLI uploads before publishing again, or points the tags, posts a "Preview packages" check run on the commit, and for pull requests updates the sticky comment. The manifest's `head` has to be the run's head commit, so a `pull_request` job must check out `github.event.pull_request.head.sha` rather than the merge commit.
+5. A run from a fork gets only the `pr:<number>` tag. Commit and branch tags are shared by every publisher, and a fork can run any commit, including one the repository already published, so it may not write them.
+
+## The `pkg` CLI
+
+```sh
+pkg pack \
+  --group 'alchemy=./packages/alchemy' \
+  --group '@alchemy.run[Collapsed]=./packages/{better-auth,pkg}' \
+  --group '@distilled.cloud[Collapsed]=./submodules/distilled/packages/*' \
+  --registry https://pkg.alchemy.run \
+  --out .pkg
+
+pkg publish --dir .pkg --registry https://pkg.alchemy.run
+```
+
+| Flag         | Command         | Default                                     |
+| ------------ | --------------- | ------------------------------------------- |
+| `--group`    | `pack`          | required, repeatable                        |
+| `--registry` | `pack`, `publish` | `PKG_REGISTRY` env var, then `https://pkg.alchemy.run` |
+| `--out`      | `pack`          | `.pkg`                                      |
+| `--dir`      | `publish`       | `.pkg`                                      |
+
+A group is `NAME=GLOB` or `NAME[Collapsed]=GLOB`. Globs support `*` as a whole path segment and `{a,b}` alternatives, so `./submodules/distilled/packages/{core,aws}` lists exactly those two. Repeat `--group` with the same name to add more directories to one group. `Collapsed` renders that group inside a closed `<details>` block in the install comment, for long lists of secondary packages.
+
+For each non-private package under a group's glob, `pack`:
+
+- packs in dependency order and rewrites every dependency on another packed package to that package's immutable tarball URL, `https://<registry>/<name>/-/<sha256>.tgz`, so a tarball's bytes depend only on its source and its dependencies' bytes and identical builds deduplicate across commits, pull requests, and repositories;
+- repacks with fixed timestamps and no ownership so identical inputs hash identically, letting the registry skip uploads it already has;
+- writes `pkg-manifest.json` describing the groups and each tarball's name, group, SHA-256, and size.
+
+`publish` must run inside a GitHub Actions job, after the workflow has uploaded the manifest artifact. It refuses a directory packed for a different registry. `pack` alone is useful to inspect what would be published.
+
+Under a `pull_request` event, check out `github.event.pull_request.head.sha` before packing. The default checkout is a synthetic merge commit that does not match the run's head, and `pack` fails early when it detects that.
+
+## Deploying the registry
+
+The registry is one call in a Stack. It declares the Worker, the R2 bucket, the D1 index, and a KV cache under the id you give it, as `Pkg/Worker`, `Pkg/Bucket`, `Pkg/Database`, and `Pkg/Cache`:
+
+```ts
+import { PkgRegistry } from "@alchemy.run/pkg/Registry";
+
+const registry = yield* PkgRegistry("Pkg", {
+  worker: { domain: "pkg.alchemy.run" },
+  github: {
+    appId: Config.String("GH_APP_ID"),
+    privateKey: Config.Redacted("GH_APP_PRIVATE_KEY"),
+  },
+  policy: {
+    repos: ["alchemy-run/alchemy", "alchemy-run/distilled"],
+    ttl: Duration.weeks(1),
+    maxPackageSize: ByteSize.megabytes(100),
+  },
+  aliases: { "pkg.distilled.cloud": "@distilled.cloud" },
+});
+```
+
+| Option                  | Default                  | Meaning                                                                                  |
+| ----------------------- | ------------------------ | ---------------------------------------------------------------------------------------- |
+| `worker`                | `{}`                     | Any Worker prop except `main`, `env`, and `crons`, which the registry owns               |
+| `github.appId`          | required                 | The App id, read at deploy time and bound to the Worker                                  |
+| `github.privateKey`     | required                 | The App's private key PEM, bound as a secret                                             |
+| `github.apiUrl`         | `https://api.github.com` | GitHub API origin                                                                        |
+| `policy.repos`          | required                 | Repositories allowed to publish, as `owner/name`                                         |
+| `policy.ttl`            | one week                 | How long a publication lives                                                             |
+| `policy.maxPackageSize` | unlimited                | Upper bound on a single tarball                                                          |
+| `aliases`               | `{}`                     | Hostname to package scope, so `pkg.distilled.cloud/core/<sha>` serves `@distilled.cloud/core` |
+| `cron`                  | `0 * * * *`              | Schedule of the expiry sweep                                                             |
+
+The package ships the Worker's bundle entry, so no separate entry file is needed. The options are encoded into a `PKG_SETTINGS` json binding at deploy time and decoded back inside the isolate, and the App credentials are bound as `PKG_GITHUB_APP_ID` and `PKG_GITHUB_APP_PRIVATE_KEY` and read lazily on the first GitHub call. The App needs `checks: write`, `pull_requests: write`, and `actions: read` on every repository in `policy.repos`.
+
+The KV namespace caches what the Worker learns from GitHub, shared by every isolate: resolved runs for a minute, so the uploads that follow a publish do not repeat the lookup, and installation tokens until shortly before they expire, so one mint per repository serves about an hour. Everything in it is re-derivable, and a KV failure falls through to GitHub.
+
+`alchemy dev` runs the Worker locally with the bucket, database, and cache emulated; the GitHub calls still go to the real API.
+
+## HTTP API
+
+The contract lives in `@alchemy.run/pkg/Protocol` as an Effect `HttpApi`. The Worker implements it with `HttpApiBuilder`; the CLI calls it through `HttpApiClient`, so requests and typed errors are shared rather than duplicated.
+
+| Route                                     | Purpose                                                                                  |
+| ----------------------------------------- | ---------------------------------------------------------------------------------------- |
+| `POST /api/publish`                       | Body `{ run, manifest }`. Answers `409 MissingTarballs` with what to upload, or the tags |
+| `PUT /api/tarballs/:name/:sha256?repo&runId&attempt` | Content-addressed upload, streamed into R2 with the hash verified by R2      |
+| `GET /api/health`                         | `{ ok: true }`                                                                           |
+| `GET /<name>/<tag>`                       | 302 to the tarball the tag points at                                                     |
+| `GET /<name>/-/<sha256>.tgz`              | The immutable tarball                                                                    |
+
+`run` is `{ repo, runId, attempt }`. Errors are `BadRequest` (400), `Forbidden` (403), `RunNotInProgress` (409), `MissingTarballs` (409), `PackageTooLarge` (413), and `Upstream` (502) for GitHub failures.
+
+## Policy
+
+`repos` lists the repositories allowed to publish. A publication may contain any package; every package gets the commit, short commit, `branch:<name>`, and `pr:<number>` tags of the run that produced it, and nothing in the manifest can name a different commit. A package built from a submodule is therefore tagged with the publishing repository's commit; dependency links between tarballs use content URLs and do not involve commits at all.
+
+## Cleanup
+
+The registry keeps one table: `tags(package, tag, sha256, expires_at, linked_prs)`. A tarball lives in R2 for as long as any row points at it.
+
+Every publication of a tag refreshes `expires_at` to now plus `ttl`. Rows produced by pull request runs also record the pull request in `linked_prs`; a commit tag shared by several pull requests records all of them. The sweep re-checks rows that are about to expire: while any linked pull request is open the row is extended by `ttl`, and once they are all closed or merged the expiry is pinned to the latest close time plus `ttl`. Branch publications simply expire `ttl` after the push. The sweep then deletes expired rows, tarballs no row points at, and uploads older than a day that never got tagged.

package/dist/Manifest.d.ts

@@ -0,0 +1,107 @@
+import * as Schema from "effect/Schema";
+/**
+ * An npm package name, scoped or unscoped, under the rules npm applies to
+ * new packages: lowercase, URL-safe, at most 214 characters. Names end up
+ * in R2 keys, install URLs, and the markdown of comments and check runs,
+ * so nothing outside this set is ever accepted from a client.
+ */
+export declare const PackageName: Schema.String;
+/** A display group label for the install comment: `Alchemy`, `@alchemy.run`. */
+export declare const GroupName: Schema.String;
+/**
+ * One packed workspace package inside a `pkg pack` artifact.
+ *
+ * Everything here is data the CLI observed while packing. The registry never
+ * derives a tag from it: every tag comes from the GitHub Actions run that
+ * vouched for the manifest, and R2 verifies uploaded tarball bytes against
+ * the hash they are stored under.
+ */
+export declare const ManifestPackage: Schema.Struct<{
+    readonly name: Schema.String;
+    /** Version from the package manifest at pack time. */
+    readonly version: Schema.String;
+    /** Package directory relative to the workspace root, POSIX separators. */
+    readonly dir: Schema.String;
+    readonly group: Schema.String;
+    /** Tarball file name inside the artifact directory. */
+    readonly file: Schema.String;
+    /** Lowercase hex SHA-256 of the tarball bytes. */
+    readonly sha256: Schema.String;
+    /** Tarball size in bytes. */
+    readonly size: Schema.Number;
+}>;
+export type ManifestPackage = typeof ManifestPackage.Type;
+/** A display group in the install comment, in the order `pkg pack` listed it. */
+export declare const ManifestGroup: Schema.Struct<{
+    readonly name: Schema.String;
+    /** Render the group collapsed in the install comment. */
+    readonly collapsed: Schema.Boolean;
+}>;
+export type ManifestGroup = typeof ManifestGroup.Type;
+/**
+ * The `pkg-manifest.json` written next to the tarballs by `pkg pack` and read
+ * back by `pkg publish`.
+ */
+export declare const Manifest: Schema.Struct<{
+    readonly version: Schema.Literal<1>;
+    readonly groups: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        /** Render the group collapsed in the install comment. */
+        readonly collapsed: Schema.Boolean;
+    }>>;
+    /** Registry origin the tarball dependencies were rewritten against. */
+    readonly registry: Schema.String;
+    /**
+     * HEAD commit of the root repository at pack time. The registry requires
+     * it to be the head of the run that publishes, since that is the commit
+     * every tag names.
+     */
+    readonly head: Schema.String;
+    readonly packages: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        /** Version from the package manifest at pack time. */
+        readonly version: Schema.String;
+        /** Package directory relative to the workspace root, POSIX separators. */
+        readonly dir: Schema.String;
+        readonly group: Schema.String;
+        /** Tarball file name inside the artifact directory. */
+        readonly file: Schema.String;
+        /** Lowercase hex SHA-256 of the tarball bytes. */
+        readonly sha256: Schema.String;
+        /** Tarball size in bytes. */
+        readonly size: Schema.Number;
+    }>>;
+}>;
+export type Manifest = typeof Manifest.Type;
+export declare const ManifestJson: Schema.fromJsonString<Schema.Struct<{
+    readonly version: Schema.Literal<1>;
+    readonly groups: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        /** Render the group collapsed in the install comment. */
+        readonly collapsed: Schema.Boolean;
+    }>>;
+    /** Registry origin the tarball dependencies were rewritten against. */
+    readonly registry: Schema.String;
+    /**
+     * HEAD commit of the root repository at pack time. The registry requires
+     * it to be the head of the run that publishes, since that is the commit
+     * every tag names.
+     */
+    readonly head: Schema.String;
+    readonly packages: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        /** Version from the package manifest at pack time. */
+        readonly version: Schema.String;
+        /** Package directory relative to the workspace root, POSIX separators. */
+        readonly dir: Schema.String;
+        readonly group: Schema.String;
+        /** Tarball file name inside the artifact directory. */
+        readonly file: Schema.String;
+        /** Lowercase hex SHA-256 of the tarball bytes. */
+        readonly sha256: Schema.String;
+        /** Tarball size in bytes. */
+        readonly size: Schema.Number;
+    }>>;
+}>>;
+export declare const MANIFEST_FILE = "pkg-manifest.json";
+//# sourceMappingURL=Manifest.d.ts.map

package/dist/Manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Manifest.d.ts","sourceRoot":"","sources":["../src/Manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,WAAW,eAOvB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,SAAS,eAErB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;IAE1B,sDAAsD;;IAEtD,0EAA0E;;;IAG1E,uDAAuD;;IAEvD,kDAAkD;;IAElD,6BAA6B;;EAE7B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAC;AAE1D,iFAAiF;AACjF,eAAO,MAAM,aAAa;;IAExB,yDAAyD;;EAEzD,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,QAAQ;;;;QATnB,yDAAyD;;;IAYzD,uEAAuE;;IAEvE;;;;OAIG;;;;QAnCH,sDAAsD;;QAEtD,0EAA0E;;;QAG1E,uDAAuD;;QAEvD,kDAAkD;;QAElD,6BAA6B;;;EA6B7B,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,YAAY;;;;QAxBvB,yDAAyD;;;IAYzD,uEAAuE;;IAEvE;;;;OAIG;;;;QAnCH,sDAAsD;;QAEtD,0EAA0E;;;QAG1E,uDAAuD;;QAEvD,kDAAkD;;QAElD,6BAA6B;;;GAgC4B,CAAC;AAE5D,eAAO,MAAM,aAAa,sBAAsB,CAAC"}

package/dist/Manifest.js

@@ -0,0 +1,58 @@
+import * as Schema from "effect/Schema";
+/**
+ * An npm package name, scoped or unscoped, under the rules npm applies to
+ * new packages: lowercase, URL-safe, at most 214 characters. Names end up
+ * in R2 keys, install URLs, and the markdown of comments and check runs,
+ * so nothing outside this set is ever accepted from a client.
+ */
+export const PackageName = Schema.String.pipe(Schema.check(Schema.isPattern(/^(?:@[a-z0-9-*~][a-z0-9-*._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/), Schema.isMaxLength(214)));
+/** A display group label for the install comment: `Alchemy`, `@alchemy.run`. */
+export const GroupName = Schema.String.pipe(Schema.check(Schema.isPattern(/^[@A-Za-z0-9][A-Za-z0-9 ._@/-]{0,63}$/)));
+/**
+ * One packed workspace package inside a `pkg pack` artifact.
+ *
+ * Everything here is data the CLI observed while packing. The registry never
+ * derives a tag from it: every tag comes from the GitHub Actions run that
+ * vouched for the manifest, and R2 verifies uploaded tarball bytes against
+ * the hash they are stored under.
+ */
+export const ManifestPackage = Schema.Struct({
+    name: PackageName,
+    /** Version from the package manifest at pack time. */
+    version: Schema.String,
+    /** Package directory relative to the workspace root, POSIX separators. */
+    dir: Schema.String,
+    group: GroupName,
+    /** Tarball file name inside the artifact directory. */
+    file: Schema.String,
+    /** Lowercase hex SHA-256 of the tarball bytes. */
+    sha256: Schema.String,
+    /** Tarball size in bytes. */
+    size: Schema.Number,
+});
+/** A display group in the install comment, in the order `pkg pack` listed it. */
+export const ManifestGroup = Schema.Struct({
+    name: GroupName,
+    /** Render the group collapsed in the install comment. */
+    collapsed: Schema.Boolean,
+});
+/**
+ * The `pkg-manifest.json` written next to the tarballs by `pkg pack` and read
+ * back by `pkg publish`.
+ */
+export const Manifest = Schema.Struct({
+    version: Schema.Literal(1),
+    groups: Schema.Array(ManifestGroup),
+    /** Registry origin the tarball dependencies were rewritten against. */
+    registry: Schema.String,
+    /**
+     * HEAD commit of the root repository at pack time. The registry requires
+     * it to be the head of the run that publishes, since that is the commit
+     * every tag names.
+     */
+    head: Schema.String,
+    packages: Schema.Array(ManifestPackage),
+});
+export const ManifestJson = Schema.fromJsonString(Manifest);
+export const MANIFEST_FILE = "pkg-manifest.json";
+//# sourceMappingURL=Manifest.js.map

package/dist/Manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Manifest.js","sourceRoot":"","sources":["../src/Manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC3C,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,SAAS,CACd,4DAA4D,CAC7D,EACD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CACxB,CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACzC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC,CACxE,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,WAAW;IACjB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC,MAAM;IAClB,KAAK,EAAE,SAAS;IAChB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM;CACpB,CAAC,CAAC;AAGH,iFAAiF;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,SAAS;IACf,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC,OAAO;CAC1B,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;IACnC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC"}