@arcforge/err 2.0.130 → 2.0.132

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@arcforge/err",
-    "version": "2.0.130",
+    "version": "2.0.132",
     "description": "Structured Axon errors — the code map every user-facing failure is rendered from.",
     "type": "module",
     "private": false,
@@ -15,7 +15,7 @@
         "deploy": "echo \"This package is published ONLY by apps/tui/scripts/release.ts, which pins workspace:* deps to concrete versions first. Publishing it directly ships an unresolvable dependency.\" && exit 1"
     },
     "dependencies": {
-        "@arcforge/types": "2.0.130"
+        "@arcforge/types": "2.0.132"
     },
     "devDependencies": {
         "@types/bun": "latest",

package/src/map.ts

@@ -1495,6 +1495,47 @@ export const errorMap = {
         source: "manifest",
         severity: "fatal",
     },
+    // ── README assets (build/project/bundle/assets.ts) ──────────────────────
+    ASSET_TYPE_REFUSED: {
+        code: "AX-PROJECT-038",
+        title: "Unsupported Asset Type",
+        description: "A file in assets/ is not a type the registry serves. Images (png, jpg, jpeg, webp, gif) and video (mp4, webm, mov) are accepted. SVG is deliberately refused: it is an executable document that would be served from our own storage origin, so a published SVG is a script-injection surface for every visitor reading that README.",
+        source: "manifest",
+        severity: "fatal",
+        expected: true,
+    },
+    ASSET_TOO_LARGE: {
+        code: "AX-PROJECT-039",
+        title: "Asset Exceeds Size Limit",
+        description: "A single file in assets/ is over the per-asset limit. Assets exist to illustrate a README, not to distribute media — compress the file or link to it externally.",
+        source: "manifest",
+        severity: "fatal",
+        expected: true,
+    },
+    ASSETS_BUDGET_EXCEEDED: {
+        code: "AX-PROJECT-040",
+        title: "Assets Exceed Total Budget",
+        description: "The assets/ folder as a whole is over budget for one published version. Every version stores its own copy of every asset, so the total is what determines how much a package costs to host forever.",
+        source: "manifest",
+        severity: "fatal",
+        expected: true,
+    },
+    ASSET_PATH_INVALID: {
+        code: "AX-PROJECT-041",
+        title: "Unsafe Asset Path",
+        description: "An entry under assets/ is a symlink, or its name escapes the assets directory. Both are refused: a published asset must be a real file that lands where its name says it does, or extraction on the server could write outside the target directory.",
+        source: "manifest",
+        severity: "fatal",
+        expected: true,
+    },
+    ASSET_UNREADABLE: {
+        code: "AX-PROJECT-042",
+        title: "Asset Could Not Be Processed",
+        description: "A file in assets/ has an image extension but could not be decoded, so it is either corrupt or not the format its name claims. Publishing it would ship a broken image into a README.",
+        source: "manifest",
+        severity: "fatal",
+        expected: true,
+    },
     PORT_UNAVAILABLE: {
         code: "AX-PROJECT-031",
         title: "No Free Port",