@forgeax/engine-pack 0.1.21 → 0.1.24

package/src/catalog-builder.ts

@@ -5,8 +5,8 @@ import {
   projectExternalCatalogEntries,
   projectPackageCatalog,
 } from './catalog-projection.js';
-import { loadAssetConfig } from './config.js';
 import { deriveAssetName } from './deriveAssetName.js';
+import { parsePackSourceJson, projectDirectPackJson } from './pack-authoring.js';
 import { resolveAssetSource } from './resolve-asset-source.js';
 import {
   type MetaInventoryDocument,
@@ -138,7 +138,6 @@ function projectMeta(
   rawPath: string,
   cwd: string,
   base: string,
-  assetPaths: Record<string, string>,
   importerPolicy: (importer: string) => CatalogImporterPolicy,
   sourceDeclaration: Extract<ScanSourceDeclaration, { readonly format: 'meta.json' }>,
   sourceIdentityFor: CatalogBuildProjectionOptions['sourceIdentityFor'],
@@ -152,22 +151,12 @@ function projectMeta(
   if (policy.disposition !== 'publish') {
     return { entries: [], error: unsupportedPolicyError(rawPath, meta.importer, policy) };
   }
-  const resolved = resolveAssetSource(rawPath, meta.source, assetPaths);
-  if (!resolved.ok) {
-    return {
-      entries: [],
-      error: {
-        code: 'catalog-meta-schema-invalid',
-        path: rawPath,
-        message: `source resolution failed: ${resolved.error.code} - ${resolved.error.hint}`,
-      },
-    };
-  }
-  const sourcePath = catalogSourcePathFor(cwd, resolved.value, sourceIdentityFor);
+  const resolved = resolveAssetSource(rawPath, meta.source);
+  const sourcePath = catalogSourcePathFor(cwd, resolved, sourceIdentityFor);
   const packageUrl = `${base}/__forgeax-ddc/${meta.subAssets[0]?.guid?.toLowerCase() ?? 'pack'}.pack.json`;
   const declaration: CatalogImportMeta = {
     importer: meta.importer,
-    source: resolved.value,
+    source: resolved,
     sourceRevision: sourceDeclaration.sourceRevision,
     ...(meta.packageId === undefined ? {} : { packageId: meta.packageId }),
     ...(meta.provenance === undefined ? {} : { provenance: meta.provenance }),
@@ -197,7 +186,7 @@ function projectMeta(
   return {
     declaration,
     entries: projectExternalCatalogEntries(meta, sourcePath, packageUrl, meta.subAssets, (output) =>
-      deriveAssetName(resolved.value, meta.subAssets.length, output.name),
+      deriveAssetName(resolved, meta.subAssets.length, output.name),
     ),
   };
 }
@@ -206,7 +195,6 @@ function projectSource(
   path: string,
   cwd: string,
   base: string,
-  assetPaths: Record<string, string>,
   importerPolicy: (importer: string) => CatalogImporterPolicy,
   visibility: CatalogBuildProjectionOptions['visibility'],
   sourceDeclaration: ScanSourceDeclaration,
@@ -214,19 +202,10 @@ function projectSource(
   sourceIdentityFor: CatalogBuildProjectionOptions['sourceIdentityFor'],
 ): { readonly entries: PackIndexEntry[]; readonly error?: CatalogBuildError } {
   if (sourceDeclaration.format === 'pack.ts') {
-    const meta = { ...sourceDeclaration.meta, source: sourcePathFor(cwd, path) };
-    const anchorGuid = meta.subAssets.map((asset) => asset.guid.toLowerCase()).sort()[0];
-    return anchorGuid === undefined
-      ? { entries: [] }
-      : {
-          entries: projectExternalCatalogEntries(
-            meta,
-            catalogSourcePathFor(cwd, path, sourceIdentityFor),
-            `${base}/__forgeax-ddc/${anchorGuid}.pack.json`,
-            meta.subAssets,
-            (output) => deriveAssetName(path, meta.subAssets.length, output.name),
-          ),
-        };
+    // A source declaration is an authoring identity and parameter contract,
+    // not a materialized output set. Dynamic build owns publication after its
+    // fixed-point worklist converges; Catalog scanning must not invent rows.
+    return { entries: [] };
   }
   if (sourceDeclaration.format === 'meta.json') {
     const policy = importerPolicy(sourceDeclaration.value.importer);
@@ -244,7 +223,6 @@ function projectSource(
       path,
       cwd,
       base,
-      assetPaths,
       importerPolicy,
       sourceDeclaration,
       sourceIdentityFor,
@@ -254,6 +232,57 @@ function projectSource(
   }
   const parsed = sourceDeclaration.value;
   const sourcePath = catalogSourcePathFor(cwd, path, sourceIdentityFor);
+  if (parsed.schemaVersion === '3.0.0') {
+    const authoring = parsePackSourceJson(parsed);
+    if (!authoring.ok) {
+      return {
+        entries: [],
+        error: {
+          code: 'catalog-meta-schema-invalid',
+          path,
+          message: `v3 Pack parse failed: ${authoring.error.code}`,
+          expected: 'a valid direct or instance v3 Pack document',
+          actual: authoring.error.code,
+          hint: authoring.error.hint,
+          subjects: [path],
+        },
+      };
+    }
+    if (authoring.value.format !== 'direct') return { entries: [] };
+    const projected = projectDirectPackJson(authoring.value);
+    if (!projected.ok) {
+      return {
+        entries: [],
+        error: {
+          code: 'catalog-meta-schema-invalid',
+          path,
+          message: `v3 Pack projection failed: ${projected.error.code}`,
+          expected: 'direct v3 assets to derive stable AssetGuids',
+          actual: projected.error.code,
+          hint: projected.error.hint,
+          subjects: [path],
+        },
+      };
+    }
+    const provenance = { provider: 'pack', version: '3.0.0' } satisfies ProviderProvenance;
+    return {
+      entries: projectPackageCatalog(
+        projected.value.assets.map((asset, sourceIndex) => ({
+          guid: asset.guid,
+          kind: asset.kind,
+          sourcePath,
+          sourceIndex,
+          sourceKey: asset.sourceKey,
+          refs: asset.refs,
+          execution: 'direct' as const,
+          packageId: projected.value.packageId,
+          provenance,
+          name: deriveAssetName(path, projected.value.assets.length, asset.name),
+        })),
+        `${base}/${sourcePath}`,
+      ),
+    };
+  }
   const provenance =
     parsed.provenance ??
     ({ provider: 'pack', version: parsed.schemaVersion } satisfies ProviderProvenance);
@@ -317,7 +346,6 @@ export async function buildCatalogProjection(
     return empty('degraded', [error]);
   }
   const { paths, declarations: sourceDeclarations } = scanned.value;
-  const { paths: assetPaths } = loadAssetConfig(cwd);
   const entries: PackIndexEntry[] = [];
   const errors: CatalogBuildError[] = [];
   const declarations = new Map<string, CatalogImportMeta>();
@@ -328,7 +356,6 @@ export async function buildCatalogProjection(
       path,
       cwd,
       base,
-      assetPaths,
       options.importerPolicy,
       options.visibility,
       sourceDeclaration,

package/src/cli-asset.ts

@@ -26,8 +26,8 @@ import {
 import { readSourceInventory } from './evidence/source-inventory.js';
 import { isValidAssetGuidString } from './guid.js';
 import { parsePackV2 } from './index.js';
-import { scan } from './scanner.js';
-import { isRecord, projectScriptablePackMeta } from './scriptable-pack.js';
+import { projectScriptablePackMeta } from './pack-authoring.js';
+import { type ScanSourceDeclaration, scanInventory } from './scanner.js';
 import { loadScriptablePack } from './scriptable-pack-node.js';
 
 export interface PackEntry {
@@ -51,6 +51,10 @@ interface ScanErrShape {
   detail?: unknown;
 }
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
 function emitError(ctx: AssetCtx, err: ScanErrShape): number {
   const payload: Record<string, unknown> = {
     code: err.code,
@@ -66,7 +70,7 @@ export async function scanEntries(
   roots: readonly string[],
   ctx: AssetCtx,
 ): Promise<{ ok: true; value: PackEntry[] } | { ok: false }> {
-  const result = await scan(roots);
+  const result = await scanInventory(roots);
   if (!result.ok) {
     emitError(ctx, {
       code: result.error.code,
@@ -77,94 +81,73 @@ export async function scanEntries(
     return { ok: false };
   }
   const entries: PackEntry[] = [];
-  // Two file kinds carry GUID-addressed entries (disk schema SSOT, AGENTS.md
-  // §Disk schema): `.pack.json` (`internal-text-package`) holds top-level
-  // `assets[]`, while every `*.meta.json` sidecar (including
-  // any `*.meta.json` regardless of source extension (top-level `importer`), all of
-  // kind `external-asset-package`) holds `subAssets[]`. The CLI surface
-  // must enumerate both so that `scan` / `lookup` mirror what the
-  // build-time catalog builder folds into `pack-index.json` (otherwise
-  // the same disk schema yields different entity counts on the two
-  // surfaces — observed regression in feat-20260517 sandbox T-2.B1).
-  const packPaths = result.value.filter((p) => p.endsWith('.pack.json'));
-  const metaPaths = result.value.filter((p) => p.endsWith('.meta.json'));
-  for (const packPath of packPaths) {
-    let parsed: unknown;
-    try {
-      const raw = await readFile(packPath, 'utf-8');
-      parsed = JSON.parse(raw);
-    } catch {
-      continue;
-    }
-    const packObj = parsed as { assets?: { guid?: unknown; kind?: unknown; name?: unknown }[] };
-    if (!Array.isArray(packObj.assets)) continue;
-    for (const asset of packObj.assets) {
-      if (typeof asset.guid === 'string' && typeof asset.kind === 'string') {
-        entries.push({
-          guid: asset.guid,
-          kind: asset.kind,
-          sourcePath: packPath,
-          ...(typeof asset.name === 'string' ? { name: asset.name } : {}),
-        });
+  // The scanner is the single identity projection for Pack JSON. ScriptablePack
+  // source modules deliberately contribute no rows until a build generation.
+  for (const declaration of result.value.declarations.values()) {
+    if (declaration.format !== 'meta.json') continue;
+    const sourcePath = declaration.sourcePath;
+    const assets = declaration.value.subAssets;
+    for (const asset of assets) {
+      if (!isRecord(asset) || typeof asset.guid !== 'string' || typeof asset.kind !== 'string') {
+        continue;
       }
+      const name =
+        typeof asset.name === 'string'
+          ? asset.name
+          : typeof asset.sourceKey === 'string'
+            ? asset.sourceKey
+            : undefined;
+      entries.push({
+        guid: asset.guid,
+        kind: asset.kind,
+        sourcePath,
+        ...(name === undefined ? {} : { name }),
+      });
     }
   }
-  for (const metaPath of metaPaths) {
-    let parsed: unknown;
-    try {
-      const raw = await readFile(metaPath, 'utf-8');
-      parsed = JSON.parse(raw);
-    } catch {
+  const names = new Map<string, string>();
+  for (const declaration of result.value.declarations.values()) {
+    if (declaration.format !== 'pack.json') continue;
+    if (declaration.value.schemaVersion === '3.0.0') {
+      for (const [sourceKey, asset] of Object.entries(declaration.value.assets ?? {})) {
+        if (isRecord(asset) && typeof asset.name === 'string') {
+          names.set(`${declaration.sourcePath}:${sourceKey}`, asset.name);
+        }
+      }
       continue;
     }
-    const metaObj = parsed as {
-      subAssets?: { guid?: unknown; kind?: unknown; name?: unknown; sourceKey?: unknown }[];
-    };
-    if (!Array.isArray(metaObj.subAssets)) continue;
-    for (const sub of metaObj.subAssets) {
-      if (typeof sub.guid === 'string' && typeof sub.kind === 'string') {
-        const name =
-          typeof sub.name === 'string'
-            ? sub.name
-            : typeof sub.sourceKey === 'string'
-              ? sub.sourceKey
-              : undefined;
-        entries.push({
-          guid: sub.guid,
-          kind: sub.kind,
-          sourcePath: metaPath,
-          ...(name === undefined ? {} : { name }),
-        });
+    for (const asset of declaration.value.assets) {
+      if (typeof asset.name === 'string') {
+        names.set(`${declaration.sourcePath}:${asset.guid.toLowerCase()}`, asset.name);
       }
     }
   }
-  for (const sourcePath of result.value.filter((path) => path.endsWith('.pack.ts'))) {
-    const loaded = await loadScriptablePack(sourcePath, { metadataOnly: true });
-    if (!loaded.ok) {
-      emitError(ctx, loaded.error);
-      return { ok: false };
-    }
-    const meta = projectScriptablePackMeta(loaded.value, sourcePath);
-    for (const sub of meta.subAssets) {
-      entries.push({ guid: sub.guid, kind: sub.kind, sourcePath });
-    }
-  }
-  const firstByGuid = new Map<string, PackEntry>();
-  for (const entry of entries) {
-    const guid = entry.guid.toLowerCase();
-    const first = firstByGuid.get(guid);
-    if (first !== undefined) {
-      emitError(ctx, {
-        code: 'pack-guid-collision',
-        expected:
-          'one author declaration per GUID across Meta, Pack v2, and ScriptablePack sources',
-        hint: 'allocate a new durable GUID through the asset authoring gateway, then rerun verify',
-        detail: { guid, paths: [first.sourcePath, entry.sourcePath] },
-      });
-      return { ok: false };
-    }
-    firstByGuid.set(guid, entry);
+  for (const inventoryEntry of result.value.inventory) {
+    const declaration = result.value.declarations.get(inventoryEntry.sourcePath) as
+      | ScanSourceDeclaration
+      | undefined;
+    const namedByKey =
+      inventoryEntry.sourceKey === undefined
+        ? names.get(`${inventoryEntry.sourcePath}:${inventoryEntry.guid.toLowerCase()}`)
+        : names.get(`${inventoryEntry.sourcePath}:${inventoryEntry.sourceKey}`);
+    const name =
+      namedByKey ?? names.get(`${inventoryEntry.sourcePath}:${inventoryEntry.guid.toLowerCase()}`);
+    entries.push({
+      guid: inventoryEntry.guid,
+      kind: inventoryEntry.kind,
+      sourcePath: inventoryEntry.sourcePath,
+      ...(name === undefined ? {} : { name }),
+      ...(declaration?.format === 'pack.json' &&
+      declaration.value.schemaVersion === '3.0.0' &&
+      inventoryEntry.sourceKey !== undefined &&
+      name === undefined
+        ? { name: inventoryEntry.sourceKey }
+        : {}),
+    });
   }
+  entries.sort((left, right) =>
+    `${left.sourcePath}:${left.guid}`.localeCompare(`${right.sourcePath}:${right.guid}`),
+  );
   return { ok: true, value: entries };
 }
 
@@ -250,7 +233,9 @@ async function runMeta(rest: string[], ctx: AssetCtx): Promise<number> {
     });
   }
   const cwd = ctx.cwd ?? process.cwd();
-  const loaded = await loadScriptablePack(absolutePath(source, cwd), { metadataOnly: true });
+  const loaded = await loadScriptablePack(absolutePath(source, cwd), {
+    metadataOnly: true,
+  });
   if (!loaded.ok) return emitError(ctx, loaded.error);
   ctx.stdoutWrite(JSON.stringify(projectScriptablePackMeta(loaded.value, source)));
   return 0;

package/src/deriveAssetName.ts

@@ -16,27 +16,28 @@ function baseName(p: string): string {
  *
  * Pure function -- zero IO, zero side effects, browser-safe. Build-time
  * (build-catalog) and runtime (resolveName) share this single source of truth
- * for the XOR name-resolution rules (plan-strategy D-6).
+ * for deterministic asset display-name resolution.
  *
- * Branches:
- *   1. single-asset package (assetCount === 1)      -> baseName(packagePath)
- *   2. multi-asset package + storedName              -> storedName
- *   3. multi-asset package + no storedName (AC-15.1) -> baseName(packagePath)
- *   4. null packagePath + no storedName  (AC-15.2)   -> ''
+ * Resolution contract:
+ *   - an explicit storedName is authoritative;
+ *   - a package path is the fallback when no storedName is present;
+ *   - an asset without a package and without a storedName resolves to ''.
+ *
+ * `assetCount` remains in the signature because callers derive it from their
+ * package model, but it must not erase an explicitly authored name. In
+ * particular, a single authored entry in `Materials.pack.json` resolves to its
+ * entry name rather than temporarily appearing as the package basename.
  */
 export function deriveAssetName(
   packagePath: string | null,
-  assetCount: number,
+  _assetCount: number,
   storedName?: string,
 ): string {
-  if (packagePath === null) {
-    return storedName ?? '';
-  }
-  if (assetCount === 1) {
-    return baseName(packagePath);
-  }
   if (storedName !== undefined) {
     return storedName;
   }
+  if (packagePath === null) {
+    return '';
+  }
   return baseName(packagePath);
 }

package/src/evidence/material-cook.ts

@@ -7,7 +7,7 @@ import type {
   MaterialValue,
   Result,
 } from '@forgeax/engine-types';
-import { err, MATERIAL_TEXTURE_SLOTS, ok } from '@forgeax/engine-types';
+import { deriveStandardLayerPlan, err, MATERIAL_TEXTURE_SLOTS, ok } from '@forgeax/engine-types';
 import { sha256 } from '@noble/hashes/sha2.js';
 import { bytesToHex } from '@noble/hashes/utils.js';
 
@@ -56,7 +56,11 @@ export interface MaterialCookReceipt {
   readonly profile: string;
   readonly compilerVersion: string;
   readonly identity: MaterialCookIdentity;
-  readonly derivedInterface: { readonly layoutIdentity: string };
+  readonly derivedInterface: {
+    readonly layoutIdentity: string;
+    /** Build-time Standard physical lowering identity, when the root is Standard. */
+    readonly layerPlanIdentity?: string;
+  };
 }
 
 export interface MaterialParameterContract {
@@ -101,6 +105,36 @@ export interface MaterialCookIdentityExpectation {
   readonly inputDigest?: string;
 }
 
+const STANDARD_ROOT_MODULES = new Set([
+  'forgeax::default-standard-pbr',
+  'forgeax::pbr-skin',
+  'forgeax_material::standard',
+  'forgeax_material::pbr-skin',
+]);
+
+/** Shared ownership predicate for the built-in Standard material root. */
+export function isStandardRootModule(module: string): boolean {
+  return STANDARD_ROOT_MODULES.has(module);
+}
+
+export function isStandardMaterialRecord(record: Pick<CookedMaterialRecord, 'resolved'>): boolean {
+  return record.resolved.passes.some((pass) => isStandardRootModule(pass.program.module));
+}
+
+/**
+ * Recompute the Standard layer identity from the admitted resolved root.
+ * Material admission and runtime loading share this owner so a stale receipt
+ * cannot select a different physical layer plan after cooking.
+ */
+export function materialLayerPlanIdentity(
+  record: Pick<CookedMaterialRecord, 'resolved'>,
+): string | undefined {
+  if (!isStandardMaterialRecord(record)) {
+    return undefined;
+  }
+  return deriveStandardLayerPlan(record.resolved.parameters, record.resolved.passes).identity;
+}
+
 function unique(values: readonly string[]): readonly string[] {
   return [...new Set(values)].sort();
 }
@@ -286,6 +320,16 @@ export function validateMaterialCookReceipt(
   if (derivedInterface.layoutIdentity !== identity.layoutIdentity) {
     return invalid('receipt.derivedInterface.layoutIdentity', derivedInterface.layoutIdentity);
   }
+  if (
+    derivedInterface.layerPlanIdentity !== undefined &&
+    (typeof derivedInterface.layerPlanIdentity !== 'string' ||
+      derivedInterface.layerPlanIdentity.length === 0)
+  ) {
+    return invalid(
+      'receipt.derivedInterface.layerPlanIdentity',
+      derivedInterface.layerPlanIdentity,
+    );
+  }
   for (const field of ['sourceClosure', 'profile', 'compilerVersion']) {
     const fieldValue = candidate[field];
     if (
@@ -320,7 +364,12 @@ export function validateMaterialCookReceipt(
     profile: candidate.profile as string,
     compilerVersion: candidate.compilerVersion as string,
     identity,
-    derivedInterface: { layoutIdentity: derivedInterface.layoutIdentity as string },
+    derivedInterface: {
+      layoutIdentity: derivedInterface.layoutIdentity as string,
+      ...(derivedInterface.layerPlanIdentity === undefined
+        ? {}
+        : { layerPlanIdentity: derivedInterface.layerPlanIdentity as string }),
+    },
   });
 }
 
@@ -380,6 +429,33 @@ export function validateCookedMaterialRecord(
     artifactDigest: artifact.digest as string,
   });
   if (!receiptResult.ok) return receiptResult;
+  const resolved = candidate.resolved as Record<string, unknown>;
+  if (!Array.isArray(resolved.passes)) return invalid('resolved.passes', resolved.passes);
+  if (!Array.isArray(resolved.parameters))
+    return invalid('resolved.parameters', resolved.parameters);
+  if (
+    resolved.values === null ||
+    typeof resolved.values !== 'object' ||
+    Array.isArray(resolved.values)
+  )
+    return invalid('resolved.values', resolved.values);
+  let expectedLayerPlanIdentity: string | undefined;
+  try {
+    expectedLayerPlanIdentity = materialLayerPlanIdentity({
+      resolved: resolved as unknown as CookedMaterialRecord['resolved'],
+    });
+  } catch (error) {
+    return invalid('resolved.layerPlanIdentity', error instanceof Error ? error.message : error);
+  }
+  if (
+    expectedLayerPlanIdentity !== undefined &&
+    receiptResult.value.derivedInterface.layerPlanIdentity !== expectedLayerPlanIdentity
+  ) {
+    return invalid(
+      'receipt.derivedInterface.layerPlanIdentity',
+      receiptResult.value.derivedInterface.layerPlanIdentity,
+    );
+  }
   if (candidate.artifactDigest !== undefined && candidate.artifactDigest !== artifact.digest)
     return invalid('artifactDigest', candidate.artifactDigest);
   if (

package/src/evidence/source-inventory.ts

@@ -2,9 +2,8 @@ import { createHash } from 'node:crypto';
 import { readdir, readFile } from 'node:fs/promises';
 import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import type { SourceDeclarationEvidence } from '@forgeax/engine-types';
+import { parsePackSourceJson, projectDirectPackJson } from '../pack-authoring.js';
 import { SCANNER_BLACKLIST, scan } from '../scanner.js';
-import { projectScriptablePackMeta } from '../scriptable-pack.js';
-import { loadScriptablePack } from '../scriptable-pack-node.js';
 
 /** Project root and GUID used to locate an authoritative source declaration. */
 export interface SourceInventoryRequest {
@@ -150,34 +149,43 @@ export async function readSourceInventory(
   let authored: SourceDeclarationEvidence | undefined;
   for (const path of paths) {
     if (path.endsWith('.pack.ts')) {
-      const loaded = await loadScriptablePack(path, { metadataOnly: true });
-      if (!loaded.ok) continue;
-      const meta = projectScriptablePackMeta(loaded.value, path);
-      if (meta.subAssets.some((asset) => asset.guid.toLowerCase() === guid)) {
-        return { origin: 'sourceMeta', sourcePath: path };
-      }
+      // ScriptablePack source identity is a build result, not a declaration
+      // table. The source index therefore records the source only after the
+      // producer publishes its materialized Pack output.
       continue;
     }
     const raw = await readFile(path, 'utf8').catch(() => undefined);
     if (raw === undefined) continue;
-    let parsed: {
-      readonly assets?: readonly { readonly guid?: unknown }[];
-      readonly source?: unknown;
-      readonly inputFingerprint?: unknown;
-      readonly importSettings?: unknown;
-      readonly subAssets?: readonly { readonly guid?: unknown }[];
-    };
+    let parsed: Record<string, unknown>;
     try {
-      parsed = JSON.parse(raw) as typeof parsed;
+      const value: unknown = JSON.parse(raw);
+      if (value === null || typeof value !== 'object' || Array.isArray(value)) continue;
+      parsed = value as Record<string, unknown>;
     } catch {
       continue;
     }
     if (path.endsWith('.pack.json')) {
-      if (
-        parsed.assets?.some(
+      if (parsed.schemaVersion === '3.0.0') {
+        const direct = parsePackSourceJson(parsed);
+        if (direct.ok && direct.value.format === 'direct') {
+          const projected = projectDirectPackJson(direct.value);
+          if (
+            projected.ok &&
+            projected.value.assets.some((asset) => asset.guid.toLowerCase() === guid)
+          ) {
+            authored = { origin: 'authoredPack', sourcePath: path };
+          }
+        }
+      } else if (
+        Array.isArray(parsed.assets) &&
+        parsed.assets.some(
           (asset) =>
-            typeof asset.guid === 'string' &&
-            (asset.guid === request.guid || asset.guid.toLowerCase() === guid),
+            asset !== null &&
+            typeof asset === 'object' &&
+            !Array.isArray(asset) &&
+            typeof (asset as { readonly guid?: unknown }).guid === 'string' &&
+            ((asset as { readonly guid: string }).guid === request.guid ||
+              (asset as { readonly guid: string }).guid.toLowerCase() === guid),
         )
       ) {
         authored = { origin: 'authoredPack', sourcePath: path };
@@ -185,7 +193,12 @@ export async function readSourceInventory(
       continue;
     }
     if (path.endsWith('.meta.json')) {
-      const source = sourceFromMeta(path, parsed, request.guid, raw);
+      const source = sourceFromMeta(
+        path,
+        parsed as Parameters<typeof sourceFromMeta>[1],
+        request.guid,
+        raw,
+      );
       if (source !== undefined) return source;
     }
   }