@appstrate/core 2.1.0 → 2.1.2

package/package.json

@@ -1,8 +1,10 @@
 {
   "name": "@appstrate/core",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "type": "module",
-  "files": ["src"],
+  "files": [
+    "src"
+  ],
   "exports": {
     "./logger": "./src/logger.ts",
     "./rate-limit": "./src/rate-limit.ts",
@@ -19,7 +21,8 @@
     "./update-check": "./src/update-check.ts",
     "./publish-manifest": "./src/publish-manifest.ts",
     "./dist-tags": "./src/dist-tags.ts",
-    "./version-policy": "./src/version-policy.ts"
+    "./version-policy": "./src/version-policy.ts",
+    "./download": "./src/download.ts"
   },
   "dependencies": {
     "fflate": "^0.8.0",

package/src/download.ts

@@ -0,0 +1,54 @@
+import { computeIntegrity } from "./integrity.ts";
+
+// ─────────────────────────────────────────────
+// Integrity verification
+// ─────────────────────────────────────────────
+
+export interface IntegrityCheckResult {
+  valid: boolean;
+  computed: string;
+}
+
+/** Verify artifact integrity by computing SHA256 hash and comparing to expected value. */
+export function verifyArtifactIntegrity(
+  data: Uint8Array,
+  expectedIntegrity: string,
+): IntegrityCheckResult {
+  const computed = computeIntegrity(data);
+  return { valid: computed === expectedIntegrity, computed };
+}
+
+// ─────────────────────────────────────────────
+// Download filename
+// ─────────────────────────────────────────────
+
+/** Build a consistent download filename: scope-name-version.zip */
+export function buildDownloadFilename(scope: string, name: string, version: string): string {
+  const cleanScope = scope.replace(/^@/, "");
+  return `${cleanScope}-${name}-${version}.zip`;
+}
+
+// ─────────────────────────────────────────────
+// Download response headers
+// ─────────────────────────────────────────────
+
+export interface DownloadHeadersInput {
+  integrity: string;
+  yanked: boolean;
+  scope: string;
+  name: string;
+  version: string;
+}
+
+/** Build standard download response headers (Content-Type, Content-Disposition, X-Integrity, X-Yanked). */
+export function buildDownloadHeaders(meta: DownloadHeadersInput): Record<string, string> {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/zip",
+    "X-Integrity": meta.integrity,
+    "Content-Disposition": `attachment; filename="${buildDownloadFilename(meta.scope, meta.name, meta.version)}"`,
+  };
+  if (meta.yanked) {
+    headers["X-Yanked"] = "true";
+  }
+  return headers;
+}

package/src/validation.ts

@@ -36,10 +36,14 @@ export const serviceRequirementSchema = z.looseObject({
   connectionMode: z.enum(["user", "admin"]).optional(),
 });
 
-export const PACKAGE_REF_REGEX = new RegExp(`^(?:@${SLUG_PATTERN}\\/)?${SLUG_PATTERN}$`);
+// ─────────────────────────────────────────────
+// Base manifest schema — common fields for all package types
+// ─────────────────────────────────────────────
+
+export const scopedNameRegex = new RegExp(`^@${SLUG_PATTERN}\\/${SLUG_PATTERN}$`);
 
-const packageRefString = z.string().min(1).regex(PACKAGE_REF_REGEX, {
-  error: "Must be a valid slug or scoped name (@scope/name)",
+const packageRefString = z.string().min(1).regex(scopedNameRegex, {
+  error: "Must be a scoped name (@scope/name)",
 });
 
 const semverRangeString = z.string().refine((val) => semver.validRange(val) !== null, {
@@ -53,11 +57,6 @@ const registryDependenciesSchema = z
   })
   .optional();
 
-// ─────────────────────────────────────────────
-// Base manifest schema — common fields for all package types
-// ─────────────────────────────────────────────
-
-export const scopedNameRegex = new RegExp(`^@${SLUG_PATTERN}\\/${SLUG_PATTERN}$`);
 export const packageTypeEnum = z.enum(["flow", "skill", "extension"]);
 export type PackageType = z.infer<typeof packageTypeEnum>;
 
@@ -91,8 +90,8 @@ export type FlowJsonSchemaObject = z.infer<typeof jsonSchemaObjectSchema>;
 const flowSharedFields = {
   requires: z.looseObject({
     services: z.array(serviceRequirementSchema),
-    skills: z.array(packageRefString).optional(),
-    extensions: z.array(packageRefString).optional(),
+    skills: z.record(packageRefString, z.string()).optional(),
+    extensions: z.record(packageRefString, z.string()).optional(),
   }),
   input: z
     .object({