@arcforges/api-client 1.0.0-ci.9.1 → 1.0.0-ci.92.1

package/NOTICE

@@ -1,13 +1,65 @@
 ArcForges Contracts
 Copyright 2026 ArcForges contributors
 
-@arcforges/api-client 1.0.0-ci.9.1 (Apache-2.0)
+@arcforges/api-client 1.0.0-ci.92.1 (Apache-2.0)
 
 Resolved runtime dependency inventory (dependencies retain their own licences):
-- @arcforges/proto 1.0.0-ci.9.1: Apache-2.0 (pkg:npm/%40arcforges/proto@1.0.0-ci.9.1)
-- @bufbuild/protobuf 2.14.1: (Apache-2.0 AND BSD-3-Clause) (pkg:npm/%40bufbuild/protobuf@2.14.1)
+- @arcforges/proto 1.0.0-ci.92.1: Apache-2.0 (pkg:npm/%40arcforges/proto@1.0.0-ci.92.1)
+- @bufbuild/protobuf 2.15.0: (Apache-2.0 AND BSD-3-Clause) (pkg:npm/%40bufbuild/protobuf@2.15.0)
 - @connectrpc/connect 2.2.0: Apache-2.0 (pkg:npm/%40connectrpc/connect@2.2.0)
 - @connectrpc/connect-web 2.2.0: Apache-2.0 (pkg:npm/%40connectrpc/connect-web@2.2.0)
 
-Third-party dependencies are referenced, not vendored into this package.
-The installed dependency packages supply their original licence and notice files.
+Third-party dependencies are referenced, not vendored into this package. Installed dependencies supply their original licence and notice files.
+
+ArcForges source provenance notices
+
+Generated from reviewed active records. Original licence files and dependency notices remain authoritative.
+
+contract-bindings-r5
+Source: https://github.com/ArcForges/Contracts @ b6795dc55852e16bcd555751a58bd494958e3917
+Material licence: Apache-2.0
+Notice scope: packages
+Copyright 2026 ArcForges contributors.
+Copyright 2008 Google Inc. All rights reserved.
+Copyright 2015, 2019, 2020 gRPC authors.
+Copyright 2021-2026 Buf Technologies, Inc.
+Copyright 2022-2026 The Connect Authors.
+Selected ArcForges contract bindings are generated from Apache-2.0 schemas using Grpc.Tools 2.84.0, protoc-gen-es 2.15.0 and Connect-Kotlin 0.9.0. Shape validators, domain identity adapters and fixture exports use Apache-2.0 repository tooling. Historical protobuf BSD-3-Clause and applicable generator Apache-2.0 attributions are retained. Build tools are not bundled in client packages. Native-grpc-only Android generation remains retired.
+
+protobuf-generator-licence-r1
+Source: https://github.com/protocolbuffers/protobuf @ 35cd01f9fe9afbeea38cc7b979a3b6bfcde82c03
+Material licence: BSD-3-Clause
+Notice scope: packages
+Copyright 2008 Google Inc. All rights reserved.
+Copyright 2008 Google Inc.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+    * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Code generated by the Protocol Buffer compiler is owned by the owner
+of the input file used when generating it.  This code is not
+standalone and requires a support library to be linked with it.  This
+support library is itself covered by the above license.

package/README.md

@@ -12,10 +12,17 @@ const reply = await client.sayHello({ name: "World" }, { timeoutMs: 5000 });
 console.log(reply.message);
 ```
 
+`createPublicGrpcWebTransport` is the public business transport: binary gRPC-Web
+only, unknown fields retained and the shared 100-level nesting bound. It refuses
+`useBinaryFormat`, `jsonOptions` and `binaryOptions` overrides. The declared HTTP
+exception records have strict codecs such as `tryParsePartReceiptJson` and
+`serializePartReceiptJson`; they enforce the schema byte limit, UTF-8, JSON depth 32,
+duplicate-property and integer-lexeme rules before the closed schema check.
+
 The endpoint must serve gRPC-Web. Browser cross-origin access also requires
 server CORS configuration. The demo host binds to loopback for tests.
 
-React Native uses the same proto types and a separately validated Hermes
-transport; this browser client does not claim RN support.
+Android uses the separately published Kotlin artifacts with binary gRPC-Web.
+This package is the TypeScript Web client; it does not provide a mobile runtime.
 
 Apache-2.0. [Source and full setup](https://github.com/ArcForges/Contracts).

package/build-identity.json

@@ -0,0 +1,146 @@
+{
+  "schema": "arcforges.build-identity.v1",
+  "owner": "Contracts",
+  "artifact": {
+    "id": "@arcforges/api-client",
+    "version": "1.0.0-ci.92.1"
+  },
+  "build": {
+    "sourceCommit": "e6c4a77f3ba48d70de4bf524623985b29278c784",
+    "dirty": false,
+    "kind": "ci",
+    "buildId": "35797272606.1",
+    "runId": "35797272606",
+    "runAttempt": 1,
+    "pipelineRun": "https://github.com/ArcForges/Contracts/actions/runs/35797272606",
+    "sourceDateEpoch": 1790119475
+  },
+  "axes": {
+    "AppVersion": {
+      "status": "not-applicable",
+      "reason": "Contracts distributes libraries, not an installed product."
+    },
+    "ContractSet": {
+      "status": "present",
+      "values": [
+        {
+          "subject": "arcforges.events",
+          "version": "1",
+          "source": {
+            "path": "public/proto/arcforges/events/v1/events.proto",
+            "sha256": "ea0ac740c06bbb5b81724b4a7e601110424cabc4940b07e579cf97d852880f43"
+          },
+          "descriptorSha256": "f735938a31ead03abb331db2dd04dd12ace5335b6793e47feaeb4c5623386aba"
+        },
+        {
+          "subject": "arcforges.foundation",
+          "version": "1",
+          "source": {
+            "path": "public/proto/arcforges/foundation/v1/foundation.proto",
+            "sha256": "ceda869bf2998ca4bc21c4b7504c365a4662e7f28183e6db81660592d5bcdb3f"
+          },
+          "descriptorSha256": "f735938a31ead03abb331db2dd04dd12ace5335b6793e47feaeb4c5623386aba"
+        },
+        {
+          "subject": "arcforges.hello",
+          "version": "1",
+          "source": {
+            "path": "public/proto/arcforges/hello/v1/hello.proto",
+            "sha256": "92489f89d1898a3d3bbea56c72116416cd0152ae8866c98745739437020c67d9"
+          },
+          "descriptorSha256": "f735938a31ead03abb331db2dd04dd12ace5335b6793e47feaeb4c5623386aba"
+        },
+        {
+          "subject": "arcforges.publicapi",
+          "version": "1",
+          "source": {
+            "path": "public/proto/arcforges/publicapi/v1/content.proto",
+            "sha256": "a352f31e0bcee5e5523e59cb6bcfe2af04423e78389c67fc0d8d0ab52f104dee"
+          },
+          "descriptorSha256": "f735938a31ead03abb331db2dd04dd12ace5335b6793e47feaeb4c5623386aba"
+        },
+        {
+          "subject": "json:PackageInventory",
+          "version": "1",
+          "source": {
+            "path": "public/http/v1/inventory.schema.json",
+            "sha256": "2d17acc663de43ff847e522ddb16f32b1e7ec356df7db7dcafe8342d3fb014ce"
+          }
+        },
+        {
+          "subject": "json:PartReceipt",
+          "version": "1",
+          "source": {
+            "path": "public/http/v1/schema.json",
+            "sha256": "8d4c1282c0f93452a0304e44c832179d4c6f65fa563ae53517aa324af87105ce"
+          }
+        }
+      ]
+    },
+    "CapabilityVersion": {
+      "status": "not-produced",
+      "reason": "The selected contract records do not declare implemented product capabilities.",
+      "producer": "WP09 and product capability owners"
+    },
+    "NativeFormatVersion": {
+      "status": "not-produced",
+      "reason": "No portable product format exists here.",
+      "producer": "WP18/28, WP34 and WP38"
+    },
+    "StorageSchemaVersion": {
+      "status": "not-produced",
+      "reason": "Contracts owns no implemented migration set.",
+      "producer": "WP07/21 and product storage owners"
+    },
+    "NativeAbiVersion": {
+      "status": "not-applicable",
+      "reason": "These packages contain no first-party native C boundary."
+    },
+    "PolicySchemaVersion": {
+      "status": "not-produced",
+      "reason": "The selected schemas contain no implemented product policy declaration.",
+      "producer": "WP03 and WP44"
+    },
+    "ExtensionProtocolVersion": {
+      "status": "not-applicable",
+      "reason": "This package closure contains no extension protocol."
+    },
+    "PackageVersion": {
+      "status": "present",
+      "values": [
+        {
+          "subject": "pkg:npm/%40arcforges/proto",
+          "version": "1.0.0-ci.92.1",
+          "source": {
+            "path": "sbom.cdx.json#components",
+            "sha256": "eed9ce9eb5fd29191d6c222746b88c1eb893704ba3a009478d57b93e03701f4d"
+          }
+        },
+        {
+          "subject": "pkg:npm/%40bufbuild/protobuf",
+          "version": "2.15.0",
+          "source": {
+            "path": "sbom.cdx.json#components",
+            "sha256": "eed9ce9eb5fd29191d6c222746b88c1eb893704ba3a009478d57b93e03701f4d"
+          }
+        },
+        {
+          "subject": "pkg:npm/%40connectrpc/connect",
+          "version": "2.2.0",
+          "source": {
+            "path": "sbom.cdx.json#components",
+            "sha256": "eed9ce9eb5fd29191d6c222746b88c1eb893704ba3a009478d57b93e03701f4d"
+          }
+        },
+        {
+          "subject": "pkg:npm/%40connectrpc/connect-web",
+          "version": "2.2.0",
+          "source": {
+            "path": "sbom.cdx.json#components",
+            "sha256": "eed9ce9eb5fd29191d6c222746b88c1eb893704ba3a009478d57b93e03701f4d"
+          }
+        }
+      ]
+    }
+  }
+}

package/dist/gen/http.d.ts

@@ -0,0 +1,2 @@
+export * from "../shapes/gen/PartReceipt.js";
+export * from "../shapes/gen/PackageInventory.js";

package/dist/gen/http.js

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// <auto-generated />
+// Generated by eng/generate_shapes.py; do not edit.
+export * from "../shapes/gen/PartReceipt.js";
+export * from "../shapes/gen/PackageInventory.js";

package/dist/index.d.ts

@@ -1,9 +1,18 @@
+import type { Transport } from "@connectrpc/connect";
 import type { GrpcWebTransportOptions } from "@connectrpc/connect-web";
+/** Caller-owned endpoint, fetch, interceptors and timeout; the wire format is fixed. */
+export type PublicGrpcWebTransportOptions = Omit<GrpcWebTransportOptions, "useBinaryFormat" | "jsonOptions" | "binaryOptions">;
+/**
+ * Creates the public business transport: binary gRPC-Web only, unknown fields
+ * retained and the shared nesting bound. JSON selection is refused.
+ */
+export declare function createPublicGrpcWebTransport(options: PublicGrpcWebTransportOptions): Transport;
 /** Creates the example client using the caller's gRPC-Web endpoint and fetch. */
-export declare function createHelloClient(options: GrpcWebTransportOptions): import("@connectrpc/connect").Client<import("@bufbuild/protobuf/codegenv2").GenService<{
+export declare function createHelloClient(options: PublicGrpcWebTransportOptions): import("@connectrpc/connect").Client<import("@bufbuild/protobuf/codegenv2").GenService<{
     sayHello: {
         methodKind: "unary";
         input: typeof import("@arcforges/proto").SayHelloRequestSchema;
         output: typeof import("@arcforges/proto").SayHelloResponseSchema;
     };
 }>>;
+export * from "./gen/http.js";

package/dist/index.js

@@ -1,8 +1,26 @@
 // SPDX-License-Identifier: Apache-2.0
-import { HelloService } from "@arcforges/proto";
+import { contractBinaryReadOptions, HelloService } from "@arcforges/proto";
 import { createClient } from "@connectrpc/connect";
 import { createGrpcWebTransport } from "@connectrpc/connect-web";
+/**
+ * Creates the public business transport: binary gRPC-Web only, unknown fields
+ * retained and the shared nesting bound. JSON selection is refused.
+ */
+export function createPublicGrpcWebTransport(options) {
+    const selected = options;
+    if (selected.useBinaryFormat !== undefined ||
+        selected.jsonOptions !== undefined ||
+        selected.binaryOptions !== undefined) {
+        throw new TypeError("Public ArcForges business calls use binary gRPC-Web with fixed codec options.");
+    }
+    return createGrpcWebTransport({
+        ...options,
+        useBinaryFormat: true,
+        binaryOptions: { ...contractBinaryReadOptions, writeUnknownFields: true },
+    });
+}
 /** Creates the example client using the caller's gRPC-Web endpoint and fetch. */
 export function createHelloClient(options) {
-    return createClient(HelloService, createGrpcWebTransport(options));
+    return createClient(HelloService, createPublicGrpcWebTransport(options));
 }
+export * from "./gen/http.js";

package/dist/shapes/gen/PackageInventory.d.ts

@@ -0,0 +1,24 @@
+export interface PackageInventory {
+    schemaVersion: string;
+    files: InventoryFile[];
+}
+export interface InventoryFile {
+    path: string;
+    size: string;
+    sha256: string;
+}
+export declare function isPackageInventory(value: unknown): value is PackageInventory;
+/** The schema's declared UTF-8 document bound in bytes. */
+export declare const packageInventoryJsonMaxBytes = 4194304;
+/** Parses one strict PackageInventory document; refusal kinds match the C# codec. */
+export declare function tryParsePackageInventoryJson(input: Uint8Array | string): {
+    ok: true;
+    value: PackageInventory;
+} | {
+    ok: false;
+    failure: "tooLarge" | "malformed" | "invalid";
+};
+/** Parses one strict PackageInventory document or throws an error carrying the refusal kind. */
+export declare function parsePackageInventoryJson(input: Uint8Array | string): PackageInventory;
+/** Writes compact UTF-8 in schema property order and refuses output the schema rejects. */
+export declare function serializePackageInventoryJson(value: PackageInventory): Uint8Array;

package/dist/shapes/gen/PackageInventory.js

@@ -0,0 +1,327 @@
+export function isPackageInventory(value) { return check0(value); }
+/** The schema's declared UTF-8 document bound in bytes. */
+export const packageInventoryJsonMaxBytes = 4194304;
+/** Parses one strict PackageInventory document; refusal kinds match the C# codec. */
+export function tryParsePackageInventoryJson(input) {
+    const parsed = strictJson(input, 4194304);
+    if (!parsed.ok)
+        return parsed;
+    return isPackageInventory(parsed.value) ? { ok: true, value: parsed.value } : { ok: false, failure: "invalid" };
+}
+/** Parses one strict PackageInventory document or throws an error carrying the refusal kind. */
+export function parsePackageInventoryJson(input) {
+    const result = tryParsePackageInventoryJson(input);
+    if (!result.ok)
+        throw Object.assign(new Error(`PackageInventory JSON refused: ${result.failure}.`), { failure: result.failure });
+    return result.value;
+}
+/** Writes compact UTF-8 in schema property order and refuses output the schema rejects. */
+export function serializePackageInventoryJson(value) {
+    const bytes = new TextEncoder().encode(JSON.stringify(orderPackageInventory(value)));
+    const result = tryParsePackageInventoryJson(bytes);
+    if (!result.ok)
+        throw Object.assign(new Error(`PackageInventory JSON refused: ${result.failure}.`), { failure: result.failure });
+    return bytes;
+}
+function orderInventoryFile(value) {
+    const out = {};
+    out["path"] = value["path"];
+    out["size"] = value["size"];
+    out["sha256"] = value["sha256"];
+    return out;
+}
+function orderPackageInventory(value) {
+    const out = {};
+    out["schemaVersion"] = value["schemaVersion"];
+    out["files"] = value["files"].map(item => orderInventoryFile(item));
+    return out;
+}
+function check0(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const object = value;
+    for (const key of Object.keys(object)) {
+        switch (key) {
+            case "schemaVersion":
+                if (!check1(object[key]))
+                    return false;
+                break;
+            case "files":
+                if (!check2(object[key]))
+                    return false;
+                break;
+            default: return false;
+        }
+    }
+    if (!Object.prototype.hasOwnProperty.call(object, "schemaVersion"))
+        return false;
+    if (!Object.prototype.hasOwnProperty.call(object, "files"))
+        return false;
+    if (!inventoryRules(value))
+        return false;
+    if (!inventoryRules(value))
+        return false;
+    return true;
+}
+function check1(value) {
+    if (typeof value !== 'string' || !validText(value))
+        return false;
+    if (value !== "inventory.v1")
+        return false;
+    return true;
+}
+function check2(value) {
+    if (!Array.isArray(value))
+        return false;
+    if (value.length < 1)
+        return false;
+    if (value.length > 10000)
+        return false;
+    if (!value.every(item => check3(item)))
+        return false;
+    return true;
+}
+function check3(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const object = value;
+    for (const key of Object.keys(object)) {
+        switch (key) {
+            case "path":
+                if (!check4(object[key]))
+                    return false;
+                break;
+            case "size":
+                if (!check5(object[key]))
+                    return false;
+                break;
+            case "sha256":
+                if (!check6(object[key]))
+                    return false;
+                break;
+            default: return false;
+        }
+    }
+    if (!Object.prototype.hasOwnProperty.call(object, "path"))
+        return false;
+    if (!Object.prototype.hasOwnProperty.call(object, "size"))
+        return false;
+    if (!Object.prototype.hasOwnProperty.call(object, "sha256"))
+        return false;
+    return true;
+}
+function check4(value) {
+    if (typeof value !== 'string' || !validText(value))
+        return false;
+    if ((new RegExp("^[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*$", 'u')).exec(value)?.[0] !== value)
+        return false;
+    return true;
+}
+function check5(value) {
+    if (typeof value !== 'string' || !validText(value))
+        return false;
+    if ([...value].length > 20)
+        return false;
+    if ((new RegExp("^(0|[1-9][0-9]*)$", 'u')).exec(value)?.[0] !== value)
+        return false;
+    if (BigInt(value) > 18446744073709551615n)
+        return false;
+    return true;
+}
+function check6(value) {
+    if (typeof value !== 'string' || !validText(value))
+        return false;
+    if ((new RegExp("^[0-9a-f]{64}$", 'u')).exec(value)?.[0] !== value)
+        return false;
+    return true;
+}
+/** Strict UTF-8 JSON: no BOM, comments, trailing commas or duplicate properties; depth <= 32; integer lexemes only. */
+function strictJson(input, maxBytes) {
+    let text;
+    if (typeof input === "string") {
+        if (!validText(input))
+            return { ok: false, failure: "malformed" };
+        if (new TextEncoder().encode(input).byteLength > maxBytes)
+            return { ok: false, failure: "tooLarge" };
+        text = input;
+    }
+    else {
+        if (input.byteLength > maxBytes)
+            return { ok: false, failure: "tooLarge" };
+        try {
+            text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(input);
+        }
+        catch {
+            return { ok: false, failure: "malformed" };
+        }
+    }
+    try {
+        return { ok: true, value: new StrictJsonReader(text).document() };
+    }
+    catch {
+        return { ok: false, failure: "malformed" };
+    }
+}
+class StrictJsonReader {
+    text;
+    index = 0;
+    constructor(text) {
+        this.text = text;
+    }
+    document() {
+        this.space();
+        const value = this.value(0);
+        this.space();
+        if (this.index !== this.text.length)
+            throw new SyntaxError("Trailing JSON content");
+        return value;
+    }
+    value(depth) {
+        switch (this.text[this.index]) {
+            case "{": return this.object(depth + 1);
+            case "[": return this.array(depth + 1);
+            case '"': return this.string();
+            case "t": return this.literal("true", true);
+            case "f": return this.literal("false", false);
+            case "n": return this.literal("null", null);
+            default: return this.number();
+        }
+    }
+    object(depth) {
+        if (depth > 32)
+            throw new SyntaxError("JSON depth exceeded");
+        this.index++;
+        const out = {};
+        const keys = new Set();
+        this.space();
+        if (this.text[this.index] === "}") {
+            this.index++;
+            return out;
+        }
+        for (;;) {
+            this.space();
+            if (this.text[this.index] !== '"')
+                throw new SyntaxError("Expected property name");
+            const key = this.string();
+            if (keys.has(key))
+                throw new SyntaxError("Duplicate JSON property");
+            keys.add(key);
+            this.space();
+            if (this.text[this.index++] !== ":")
+                throw new SyntaxError("Expected colon");
+            this.space();
+            // defineProperty keeps names such as __proto__ as ordinary own properties.
+            Object.defineProperty(out, key, { value: this.value(depth), enumerable: true, writable: true, configurable: true });
+            this.space();
+            const next = this.text[this.index++];
+            if (next === "}")
+                return out;
+            if (next !== ",")
+                throw new SyntaxError("Expected comma");
+        }
+    }
+    array(depth) {
+        if (depth > 32)
+            throw new SyntaxError("JSON depth exceeded");
+        this.index++;
+        const out = [];
+        this.space();
+        if (this.text[this.index] === "]") {
+            this.index++;
+            return out;
+        }
+        for (;;) {
+            this.space();
+            out.push(this.value(depth));
+            this.space();
+            const next = this.text[this.index++];
+            if (next === "]")
+                return out;
+            if (next !== ",")
+                throw new SyntaxError("Expected comma");
+        }
+    }
+    string() {
+        this.index++;
+        let out = "";
+        for (;;) {
+            const c = this.text[this.index++];
+            if (c === undefined)
+                throw new SyntaxError("Unterminated string");
+            if (c === '"')
+                break;
+            if (c < " ")
+                throw new SyntaxError("Unescaped control character");
+            if (c !== "\\") {
+                out += c;
+                continue;
+            }
+            const e = this.text[this.index++];
+            const simple = { '"': '"', "\\": "\\", "/": "/", b: "\b", f: "\f", n: "\n", r: "\r", t: "\t" };
+            if (e !== undefined && e in simple) {
+                out += simple[e];
+                continue;
+            }
+            if (e !== "u" || !/^[0-9a-fA-F]{4}$/.test(this.text.slice(this.index, this.index + 4)))
+                throw new SyntaxError("Invalid escape");
+            out += String.fromCharCode(parseInt(this.text.slice(this.index, this.index + 4), 16));
+            this.index += 4;
+        }
+        if (!validText(out))
+            throw new SyntaxError("Lone surrogate escape");
+        return out;
+    }
+    number() {
+        const match = /-?(?:0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/y;
+        match.lastIndex = this.index;
+        const found = match.exec(this.text);
+        if (found === null)
+            throw new SyntaxError("Invalid JSON value");
+        this.index = match.lastIndex;
+        // Selected schemas have no fractional numbers; fraction/exponent lexemes never satisfy an integer.
+        return found[1] !== undefined || found[2] !== undefined ? Number.NaN : Number(found[0]);
+    }
+    literal(word, value) {
+        if (this.text.slice(this.index, this.index + word.length) !== word)
+            throw new SyntaxError("Invalid JSON literal");
+        this.index += word.length;
+        return value;
+    }
+    space() {
+        while (this.text[this.index] === " " || this.text[this.index] === "\t" || this.text[this.index] === "\n" || this.text[this.index] === "\r")
+            this.index++;
+    }
+}
+function validText(value) {
+    for (const scalar of value) {
+        const point = scalar.codePointAt(0);
+        if (point >= 0xd800 && point <= 0xdfff)
+            return false;
+    }
+    return true;
+}
+function inventoryRules(value) {
+    const files = value.files;
+    const seen = new Set();
+    let previous;
+    let total = 0n;
+    for (const file of files) {
+        const path = file.path;
+        const folded = path.toUpperCase();
+        if (path.length === 0 || folded === 'INVENTORY.JSON' || folded === 'SIGNATURE.JSON' || seen.has(folded) || (previous !== undefined && previous >= path))
+            return false;
+        for (const segment of path.split('/')) {
+            if (!/^[A-Za-z0-9_.-]+$/.test(segment) || segment === '.' || segment === '..' || segment.endsWith('.') || /^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i.test(segment))
+                return false;
+        }
+        const size = BigInt(file.size);
+        if (size > 134217728n)
+            return false;
+        total += size;
+        if (total > 1073741824n)
+            return false;
+        seen.add(folded);
+        previous = path;
+    }
+    return files.some(file => file.path === 'manifest.json');
+}

package/dist/shapes/gen/PartReceipt.d.ts

@@ -0,0 +1,21 @@
+export interface PartReceipt {
+    partNumber: number;
+    size: string;
+    sha256: string;
+    etag: string;
+}
+export declare function isPartReceipt(value: unknown): value is PartReceipt;
+/** The schema's declared UTF-8 document bound in bytes. */
+export declare const partReceiptJsonMaxBytes = 65536;
+/** Parses one strict PartReceipt document; refusal kinds match the C# codec. */
+export declare function tryParsePartReceiptJson(input: Uint8Array | string): {
+    ok: true;
+    value: PartReceipt;
+} | {
+    ok: false;
+    failure: "tooLarge" | "malformed" | "invalid";
+};
+/** Parses one strict PartReceipt document or throws an error carrying the refusal kind. */
+export declare function parsePartReceiptJson(input: Uint8Array | string): PartReceipt;
+/** Writes compact UTF-8 in schema property order and refuses output the schema rejects. */
+export declare function serializePartReceiptJson(value: PartReceipt): Uint8Array;