@git.zone/tspack 1.1.0

package/.smartconfig.json

@@ -0,0 +1,26 @@
+{
+  "@git.zone/cli": {
+    "schemaVersion": 2,
+    "projectType": "npm",
+    "module": {
+      "githost": "code.foss.global",
+      "gitscope": "git.zone",
+      "gitrepo": "tspack",
+      "description": "Verified executable and asset bundles for GitZone projects.",
+      "npmPackagename": "@git.zone/tspack",
+      "license": "MIT"
+    },
+    "release": {
+      "preflight": { "test": true, "build": true },
+      "targets": {
+        "git": { "enabled": true, "remote": "origin", "pushBranch": true, "pushTags": true },
+        "npm": {
+          "enabled": true,
+          "registries": ["https://verdaccio.lossless.digital", "https://registry.npmjs.org"],
+          "accessLevel": "public",
+          "alreadyPublished": "success"
+        }
+      }
+    }
+  }
+}

package/cli.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+const { runCli } = await import('./dist_ts/index.js');
+await runCli();

package/dist_ts/00_commitinfo_data.d.ts

@@ -0,0 +1,8 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export declare const commitinfo: {
+    name: string;
+    version: string;
+    description: string;
+};

package/dist_ts/00_commitinfo_data.js

@@ -0,0 +1,9 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export const commitinfo = {
+    name: '@git.zone/tspack',
+    version: '1.1.0',
+    description: 'Verified executable and asset bundles for GitZone projects.'
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxrQkFBa0I7SUFDeEIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZEQUE2RDtDQUMzRSxDQUFBIn0=

package/dist_ts/archive.d.ts

@@ -0,0 +1,3 @@
+import type { ITsPackArtifact, ITsPackFileRecord } from './interfaces.js';
+export declare function packArchive(directory: string, output: string, files: Record<string, ITsPackFileRecord>): Promise<void>;
+export declare function verifyArchive(file: string, artifact: ITsPackArtifact, expectedMetadata: unknown): Promise<void>;

package/dist_ts/archive.js

@@ -0,0 +1,60 @@
+import * as plugins from './plugins.js';
+import { limits, requireValue, TsPackError, sha256, jsonBytes } from './validation.js';
+export async function packArchive(directory, output, files) {
+    const tar = new plugins.smartarchive.TarTools().getPackStream();
+    const written = plugins.streamPromises.pipeline(tar, plugins.zlib.createGzip({ level: 6 }), plugins.nodeFs.createWriteStream(output, { flags: 'wx', mode: 0o644 }));
+    void written.catch(() => undefined);
+    try {
+        for (const name of Object.keys(files).sort()) {
+            const file = files[name];
+            const entry = tar.entry({ name, size: file.size, mode: file.mode, mtime: new Date(0), uid: 0, gid: 0, uname: '', gname: '' });
+            await plugins.streamPromises.pipeline(plugins.nodeFs.createReadStream(plugins.path.join(directory, name)), entry);
+        }
+        tar.finalize();
+        await written;
+    }
+    catch (error) {
+        tar.destroy(error instanceof Error ? error : new Error('Archive creation failed.'));
+        await written.catch(() => undefined);
+        throw error;
+    }
+}
+export async function verifyArchive(file, artifact, expectedMetadata) {
+    const extract = new plugins.smartarchive.TarTools().getExtractStream();
+    const seen = new Set();
+    extract.on('entry', (header, entry, next) => {
+        void (async () => {
+            const expected = Object.hasOwn(artifact.files, header.name) ? artifact.files[header.name] : undefined;
+            requireValue(header.type === 'file' && expected && !seen.has(header.name) && header.size === expected.size &&
+                header.mode === expected.mode, 'archive', 'Unexpected, duplicate or changed archive member.');
+            seen.add(header.name);
+            const hash = plugins.crypto.createHash('sha256');
+            const chunks = [];
+            let bytes = 0;
+            for await (const chunk of entry) {
+                requireValue(Buffer.isBuffer(chunk), 'archive', 'Expected binary archive content.');
+                bytes += chunk.length;
+                requireValue(bytes <= expected.size, 'archive', 'Archive member exceeds its declared size.');
+                hash.update(chunk);
+                if (header.name === 'tspack.json') {
+                    requireValue(bytes <= limits.json, 'archive', 'Bundle metadata exceeds its limit.');
+                    chunks.push(chunk);
+                }
+            }
+            requireValue(bytes === expected.size && hash.digest('hex') === expected.sha256, 'integrity', 'Archive member integrity mismatch.');
+            if (header.name === 'tspack.json') {
+                requireValue(sha256(Buffer.concat(chunks)) === sha256(jsonBytes(expectedMetadata)), 'integrity', 'Bundle and artifact-set metadata disagree.');
+            }
+        })().then(() => next(), (error) => extract.destroy(error instanceof Error ? error : new Error('Archive verification failed.')));
+    });
+    try {
+        await plugins.streamPromises.pipeline(plugins.nodeFs.createReadStream(file), plugins.zlib.createGunzip(), extract);
+    }
+    catch (error) {
+        if (error instanceof TsPackError)
+            throw error;
+        throw new TsPackError('archive', 'Invalid or incomplete archive.');
+    }
+    requireValue(seen.size === Object.keys(artifact.files).length, 'archive', 'Archive members are missing.');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXJjaGl2ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2FyY2hpdmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFFeEMsT0FBTyxFQUFFLE1BQU0sRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUV2RixNQUFNLENBQUMsS0FBSyxVQUFVLFdBQVcsQ0FBQyxTQUFpQixFQUFFLE1BQWMsRUFBRSxLQUF3QztJQUMzRyxNQUFNLEdBQUcsR0FBRyxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsYUFBYSxFQUFFLENBQUM7SUFDaEUsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQ3hGLE9BQU8sQ0FBQyxNQUFNLENBQUMsaUJBQWlCLENBQUMsTUFBTSxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzFFLEtBQUssT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNwQyxJQUFJLENBQUM7UUFDSCxLQUFLLE1BQU0sSUFBSSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUM3QyxNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFFLENBQUM7WUFDMUIsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLENBQUMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDOUgsTUFBTSxPQUFPLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3BILENBQUM7UUFDRCxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDZixNQUFNLE9BQU8sQ0FBQztJQUNoQixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLEdBQUcsQ0FBQyxPQUFPLENBQUMsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUM7UUFDcEYsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3JDLE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLGFBQWEsQ0FBQyxJQUFZLEVBQUUsUUFBeUIsRUFBRSxnQkFBeUI7SUFDcEcsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLGdCQUFnQixFQUFFLENBQUM7SUFDdkUsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUMvQixPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEVBQUU7UUFDMUMsS0FBSyxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ2YsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztZQUN0RyxZQUFZLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxNQUFNLElBQUksUUFBUSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsSUFBSTtnQkFDeEcsTUFBTSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxrREFBa0QsQ0FBQyxDQUFDO1lBQ2hHLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3RCLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ2pELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztZQUM1QixJQUFJLEtBQUssR0FBRyxDQUFDLENBQUM7WUFDZCxJQUFJLEtBQUssRUFBRSxNQUFNLEtBQUssSUFBSSxLQUFLLEVBQUUsQ0FBQztnQkFDaEMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsU0FBUyxFQUFFLGtDQUFrQyxDQUFDLENBQUM7Z0JBQ3BGLEtBQUssSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDO2dCQUN0QixZQUFZLENBQUMsS0FBSyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLDJDQUEyQyxDQUFDLENBQUM7Z0JBQzdGLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQ25CLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxhQUFhLEVBQUUsQ0FBQztvQkFDbEMsWUFBWSxDQUFDLEtBQUssSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxvQ0FBb0MsQ0FBQyxDQUFDO29CQUNwRixNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNyQixDQUFDO1lBQ0gsQ0FBQztZQUNELFlBQVksQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsQ0FBQyxNQUFNLEVBQUUsV0FBVyxFQUFFLG9DQUFvQyxDQUFDLENBQUM7WUFDbkksSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLGFBQWEsRUFBRSxDQUFDO2dCQUNsQyxZQUFZLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsNENBQTRDLENBQUMsQ0FBQztZQUNqSixDQUFDO1FBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxLQUFjLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMzSSxDQUFDLENBQUMsQ0FBQztJQUNILElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ3JILENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksV0FBVztZQUFFLE1BQU0sS0FBSyxDQUFDO1FBQzlDLE1BQU0sSUFBSSxXQUFXLENBQUMsU0FBUyxFQUFFLGdDQUFnQyxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUNELFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxTQUFTLEVBQUUsOEJBQThCLENBQUMsQ0FBQztBQUM1RyxDQUFDIn0=

package/dist_ts/classes.tspack.d.ts

@@ -0,0 +1,11 @@
+import type { ITsPackConfig, ITsPackOptions, ITsPackResult, ITsPackVerifyOptions } from './interfaces.js';
+export { TsPackError } from './validation.js';
+/** Packages explicit code/assets. Compilation, publishing and runtime installation have separate owners. */
+export declare class TsPack {
+    private readonly cwd;
+    constructor(cwd?: string);
+    private source;
+    pack(configArg?: ITsPackConfig, optionsArg?: ITsPackOptions): Promise<ITsPackResult>;
+    private checksums;
+    verify(directoryArg: string, optionsArg?: ITsPackVerifyOptions): Promise<ITsPackResult>;
+}

package/dist_ts/classes.tspack.js

@@ -0,0 +1,181 @@
+import * as plugins from './plugins.js';
+import { packArchive, verifyArchive } from './archive.js';
+import { digestFile, isCommit, isDigest, isPath, isVersion, jsonBytes, limits, noSymlinks, normalizeConfig, object, readJson, requireValue, sha256, validateManifest } from './validation.js';
+export { TsPackError } from './validation.js';
+const exec = plugins.util.promisify(plugins.childProcess.execFile);
+const bundleMetadata = (manifest, id, files) => ({
+    format: 'tspack.bundle.v1', packageName: manifest.packageName, version: manifest.version,
+    id, sourceCommit: manifest.sourceCommit, sourceDirty: manifest.sourceDirty,
+    publishable: manifest.publishable, configurationSha256: manifest.configurationSha256, files,
+});
+/** Packages explicit code/assets. Compilation, publishing and runtime installation have separate owners. */
+export class TsPack {
+    cwd;
+    constructor(cwd = process.cwd()) {
+        this.cwd = cwd;
+    }
+    async source(root, version, release) {
+        const run = async (...args) => (await exec('git', args, { cwd: root, maxBuffer: 4 * 1024 ** 2 })).stdout.trim();
+        const commit = await run('rev-parse', 'HEAD');
+        requireValue(isCommit(commit), 'source_state', 'A committed Git source identity is required.');
+        const dirty = (await run('status', '--porcelain')).length !== 0;
+        if (release) {
+            requireValue(!dirty && await run('rev-parse', `refs/tags/v${version}^{commit}`) === commit, 'source_state', 'Release packaging requires clean source at its matching version tag.');
+        }
+        return { commit, dirty };
+    }
+    async pack(configArg, optionsArg = {}) {
+        object(optionsArg, ['release', 'reuse']);
+        requireValue((optionsArg.release === undefined || typeof optionsArg.release === 'boolean') &&
+            (optionsArg.reuse === undefined || typeof optionsArg.reuse === 'boolean') &&
+            (!optionsArg.reuse || optionsArg.release), 'invalid_config', 'Reuse requires release mode.');
+        const root = await plugins.fs.realpath(this.cwd);
+        const { value: packageJson } = await readJson(plugins.path.join(root, 'package.json'));
+        object(packageJson);
+        requireValue(typeof packageJson.name === 'string' && packageJson.name.length <= 214 && isVersion(packageJson.version), 'invalid_config', 'Package metadata requires a name and version.');
+        const config = normalizeConfig(configArg ?? new plugins.smartconfig.Smartconfig(root).dataFor('@git.zone/tspack', {}), packageJson.name);
+        requireValue(config.bundles.every((bundle) => isPath(`${config.name}-${packageJson.version}-${bundle.id}.tar.gz`)), 'invalid_config', 'Archive names exceed the portable path limit.');
+        const configurationSha256 = sha256(jsonBytes(config));
+        const source = await this.source(root, packageJson.version, optionsArg.release === true);
+        const outputRoot = await noSymlinks(root, config.outputDirectory, true);
+        const releaseName = `${config.name}-${packageJson.version}-${source.commit.slice(0, 12)}`;
+        if (optionsArg.reuse) {
+            const directory = plugins.path.join(outputRoot, releaseName);
+            let exists = true;
+            try {
+                await plugins.fs.lstat(directory);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    exists = false;
+                else
+                    throw error;
+            }
+            if (exists) {
+                const result = await this.verify(directory, { requireRelease: true, expectedSourceCommit: source.commit });
+                requireValue(result.manifest.configurationSha256 === configurationSha256 && result.manifest.packageName === packageJson.name &&
+                    result.manifest.version === packageJson.version, 'integrity', 'Retained release set belongs to another configuration.');
+                return { ...result, reused: true };
+            }
+        }
+        await plugins.fs.mkdir(outputRoot, { recursive: true });
+        const stage = await plugins.fs.mkdtemp(plugins.path.join(outputRoot, '.tspack-'));
+        const assets = plugins.path.join(stage, 'assets');
+        await plugins.fs.mkdir(assets);
+        await plugins.fs.mkdir(plugins.path.join(stage, 'bundles'));
+        try {
+            const manifest = {
+                format: 'tspack.release.v1', packageName: packageJson.name, name: config.name, version: packageJson.version,
+                sourceCommit: source.commit, sourceDirty: source.dirty, publishable: optionsArg.release === true,
+                configurationSha256, artifacts: [],
+            };
+            let total = 0;
+            for (const bundle of config.bundles) {
+                const directory = plugins.path.join(stage, 'bundles', bundle.id);
+                await plugins.fs.mkdir(directory);
+                const files = Object.create(null);
+                for (const file of bundle.files) {
+                    const input = await noSymlinks(root, file.source);
+                    const handle = await plugins.fs.open(input, plugins.nodeFs.constants.O_RDONLY | plugins.nodeFs.constants.O_NOFOLLOW);
+                    try {
+                        const before = await handle.stat({ bigint: true });
+                        requireValue(before.isFile() && before.size <= BigInt(limits.file), 'unsafe_input', 'Expected a bounded regular input file.');
+                        total += Number(before.size);
+                        requireValue(total <= limits.total, 'unsafe_input', 'Package inputs exceed the total byte limit.');
+                        const destination = plugins.path.join(directory, file.path);
+                        await plugins.fs.mkdir(plugins.path.dirname(destination), { recursive: true });
+                        const hash = plugins.crypto.createHash('sha256');
+                        let size = 0;
+                        const meter = new plugins.stream.Transform({ transform(chunk, _encoding, callback) {
+                                size += chunk.length;
+                                if (size > Number(before.size)) {
+                                    callback(new Error('Input changed while copying.'));
+                                    return;
+                                }
+                                hash.update(chunk);
+                                callback(null, chunk);
+                            } });
+                        await plugins.streamPromises.pipeline(handle.createReadStream({ autoClose: false }), meter, plugins.nodeFs.createWriteStream(destination, { flags: 'wx', mode: 0o600 }));
+                        const after = await handle.stat({ bigint: true });
+                        const current = await plugins.fs.lstat(input, { bigint: true });
+                        requireValue(size === Number(before.size) && ['dev', 'ino', 'size', 'mtimeNs', 'ctimeNs'].every((key) => before[key] === after[key] &&
+                            before[key] === current[key]), 'integrity', 'Input changed while copying.');
+                        const record = { sha256: hash.digest('hex'), size, mode: (file.executable ? 0o755 : 0o644) };
+                        requireValue(!file.sha256 || file.sha256 === record.sha256, 'integrity', 'Input does not match its pinned digest.');
+                        files[file.path] = record;
+                    }
+                    finally {
+                        await handle.close();
+                    }
+                }
+                const metadata = jsonBytes(bundleMetadata(manifest, bundle.id, files));
+                requireValue(metadata.length <= limits.json, 'invalid_config', 'Bundle metadata exceeds its limit.');
+                await plugins.fs.writeFile(plugins.path.join(directory, 'tspack.json'), metadata, { flag: 'wx' });
+                files['tspack.json'] = { sha256: sha256(metadata), size: metadata.length, mode: 0o644 };
+                const name = `${config.name}-${packageJson.version}-${bundle.id}.tar.gz`;
+                await packArchive(directory, plugins.path.join(assets, name), files);
+                manifest.artifacts.push({ id: bundle.id, name, ...await digestFile(plugins.path.join(assets, name)), files });
+            }
+            const finalSource = await this.source(root, packageJson.version, optionsArg.release === true);
+            requireValue(finalSource.commit === source.commit && finalSource.dirty === source.dirty, 'source_state', 'Source identity changed while packaging.');
+            validateManifest(manifest);
+            const metadata = jsonBytes(manifest);
+            const manifestSha256 = sha256(metadata);
+            await plugins.fs.writeFile(plugins.path.join(assets, 'tspack-manifest.json'), metadata, { flag: 'wx' });
+            await plugins.fs.writeFile(plugins.path.join(assets, 'SHA256SUMS.txt'), this.checksums(manifest, manifestSha256), { flag: 'wx' });
+            await this.verify(assets, { expectedManifestSha256: manifestSha256 });
+            const name = optionsArg.release ? releaseName : `${releaseName}-qualification-${manifestSha256.slice(0, 16)}`;
+            const output = plugins.path.join(outputRoot, name);
+            let exists = true;
+            try {
+                await plugins.fs.lstat(output);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    exists = false;
+                else
+                    throw error;
+            }
+            requireValue(!exists, 'exists', 'A sealed set already occupies this output; use verified release reuse or a separate output directory.');
+            await plugins.fs.rename(assets, output);
+            return { directory: output, manifest, manifestSha256, reused: false };
+        }
+        finally {
+            await plugins.fs.rm(stage, { recursive: true, force: true });
+        }
+    }
+    checksums(manifest, manifestSha256) {
+        return [...manifest.artifacts.map((artifact) => [artifact.name, artifact.sha256]), ['tspack-manifest.json', manifestSha256]]
+            .sort(([a], [b]) => a.localeCompare(b, 'en')).map(([name, hash]) => `${hash}  ${name}`).join('\n') + '\n';
+    }
+    async verify(directoryArg, optionsArg = {}) {
+        object(optionsArg, ['expectedManifestSha256', 'expectedSourceCommit', 'requireRelease']);
+        requireValue((optionsArg.expectedManifestSha256 === undefined || isDigest(optionsArg.expectedManifestSha256)) &&
+            (optionsArg.expectedSourceCommit === undefined || isCommit(optionsArg.expectedSourceCommit)) &&
+            (optionsArg.requireRelease === undefined || typeof optionsArg.requireRelease === 'boolean'), 'invalid_config', 'Invalid verification identity.');
+        const directory = plugins.path.resolve(this.cwd, directoryArg);
+        requireValue((await plugins.fs.lstat(directory)).isDirectory() && await plugins.fs.realpath(directory) === directory, 'unsafe_input', 'A canonical regular artifact directory is required.');
+        const { value, bytes } = await readJson(plugins.path.join(directory, 'tspack-manifest.json'));
+        const manifestSha256 = sha256(bytes);
+        validateManifest(value);
+        const manifest = value;
+        requireValue((!optionsArg.expectedManifestSha256 || optionsArg.expectedManifestSha256 === manifestSha256) &&
+            (!optionsArg.expectedSourceCommit || optionsArg.expectedSourceCommit === manifest.sourceCommit) &&
+            (!optionsArg.requireRelease || manifest.publishable), 'integrity', 'Artifact set does not match its required identity.');
+        const names = (await plugins.fs.readdir(directory)).sort();
+        requireValue(names.join('\n') === [...manifest.artifacts.map((artifact) => artifact.name), 'tspack-manifest.json', 'SHA256SUMS.txt'].sort().join('\n'), 'integrity', 'Artifact directory has an unexpected file set.');
+        const checksumPath = plugins.path.join(directory, 'SHA256SUMS.txt');
+        const checksumStat = await plugins.fs.lstat(checksumPath);
+        requireValue(checksumStat.isFile() && checksumStat.size <= 32 * 1024 &&
+            await plugins.fs.readFile(checksumPath, 'utf8') === this.checksums(manifest, manifestSha256), 'integrity', 'Artifact-set checksums disagree.');
+        for (const artifact of manifest.artifacts) {
+            const file = plugins.path.join(directory, artifact.name);
+            const actual = await digestFile(file);
+            requireValue(actual.size === artifact.size && actual.sha256 === artifact.sha256, 'integrity', 'Archive integrity mismatch.');
+            const { ['tspack.json']: _metadata, ...files } = artifact.files;
+            await verifyArchive(file, artifact, bundleMetadata(manifest, artifact.id, files));
+        }
+        return { directory, manifest, manifestSha256, reused: false };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy50c3BhY2suanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLnRzcGFjay50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4QyxPQUFPLEVBQUUsV0FBVyxFQUFFLGFBQWEsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUMxRCxPQUFPLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxlQUFlLEVBQUUsTUFBTSxFQUNoSCxRQUFRLEVBQUUsWUFBWSxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQzVFLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUU5QyxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ25FLE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBNEMsRUFBRSxFQUFVLEVBQUUsS0FBd0MsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUM5SCxNQUFNLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxXQUFXLEVBQUUsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO0lBQ3hGLEVBQUUsRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLFlBQVksRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLFdBQVc7SUFDMUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxXQUFXLEVBQUUsbUJBQW1CLEVBQUUsUUFBUSxDQUFDLG1CQUFtQixFQUFFLEtBQUs7Q0FDNUYsQ0FBQyxDQUFDO0FBRUgsNEdBQTRHO0FBQzVHLE1BQU0sT0FBTyxNQUFNO0lBQ1k7SUFBN0IsWUFBNkIsTUFBTSxPQUFPLENBQUMsR0FBRyxFQUFFO1FBQW5CLFFBQUcsR0FBSCxHQUFHLENBQWdCO0lBQUcsQ0FBQztJQUU1QyxLQUFLLENBQUMsTUFBTSxDQUFDLElBQVksRUFBRSxPQUFlLEVBQUUsT0FBZ0I7UUFDbEUsTUFBTSxHQUFHLEdBQUcsS0FBSyxFQUFFLEdBQUcsSUFBYyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDMUgsTUFBTSxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQzlDLFlBQVksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsY0FBYyxFQUFFLDhDQUE4QyxDQUFDLENBQUM7UUFDL0YsTUFBTSxLQUFLLEdBQUcsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDO1FBQ2hFLElBQUksT0FBTyxFQUFFLENBQUM7WUFDWixZQUFZLENBQUMsQ0FBQyxLQUFLLElBQUksTUFBTSxHQUFHLENBQUMsV0FBVyxFQUFFLGNBQWMsT0FBTyxXQUFXLENBQUMsS0FBSyxNQUFNLEVBQ3hGLGNBQWMsRUFBRSxzRUFBc0UsQ0FBQyxDQUFDO1FBQzVGLENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFDO0lBQzNCLENBQUM7SUFFTSxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQXlCLEVBQUUsYUFBNkIsRUFBRTtRQUMxRSxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDekMsWUFBWSxDQUFDLENBQUMsVUFBVSxDQUFDLE9BQU8sS0FBSyxTQUFTLElBQUksT0FBTyxVQUFVLENBQUMsT0FBTyxLQUFLLFNBQVMsQ0FBQztZQUN4RixDQUFDLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sVUFBVSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUM7WUFDekUsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxLQUFLLElBQUksVUFBVSxDQUFDLE9BQU8sQ0FBQyxFQUFFLGdCQUFnQixFQUFFLDhCQUE4QixDQUFDLENBQUM7UUFDL0YsTUFBTSxJQUFJLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDakQsTUFBTSxFQUFFLEtBQUssRUFBRSxXQUFXLEVBQUUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztRQUN2RixNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDcEIsWUFBWSxDQUFDLE9BQU8sV0FBVyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksV0FBVyxDQUFDLElBQUksQ0FBQyxNQUFNLElBQUksR0FBRyxJQUFJLFNBQVMsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLEVBQ25ILGdCQUFnQixFQUFFLCtDQUErQyxDQUFDLENBQUM7UUFDckUsTUFBTSxNQUFNLEdBQUcsZUFBZSxDQUFDLFNBQVMsSUFBSSxJQUFJLE9BQU8sQ0FBQyxXQUFXLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLENBQUMsRUFBRSxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDekksWUFBWSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsR0FBRyxNQUFNLENBQUMsSUFBSSxJQUFJLFdBQVcsQ0FBQyxPQUFPLElBQUksTUFBTSxDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUMsRUFDaEgsZ0JBQWdCLEVBQUUsK0NBQStDLENBQUMsQ0FBQztRQUNyRSxNQUFNLG1CQUFtQixHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUN0RCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLFdBQVcsQ0FBQyxPQUFPLEVBQUUsVUFBVSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsQ0FBQztRQUN6RixNQUFNLFVBQVUsR0FBRyxNQUFNLFVBQVUsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLGVBQWUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUN4RSxNQUFNLFdBQVcsR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLElBQUksV0FBVyxDQUFDLE9BQU8sSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUMxRixJQUFJLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNyQixNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLENBQUM7WUFDN0QsSUFBSSxNQUFNLEdBQUcsSUFBSSxDQUFDO1lBQ2xCLElBQUksQ0FBQztnQkFBQyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQUMsQ0FBQztZQUMxQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUFDLElBQUssS0FBK0IsQ0FBQyxJQUFJLEtBQUssUUFBUTtvQkFBRSxNQUFNLEdBQUcsS0FBSyxDQUFDOztvQkFBTSxNQUFNLEtBQUssQ0FBQztZQUFDLENBQUM7WUFDM0csSUFBSSxNQUFNLEVBQUUsQ0FBQztnQkFDWCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLEVBQUUsY0FBYyxFQUFFLElBQUksRUFBRSxvQkFBb0IsRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztnQkFDM0csWUFBWSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsbUJBQW1CLEtBQUssbUJBQW1CLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxXQUFXLEtBQUssV0FBVyxDQUFDLElBQUk7b0JBQzFILE1BQU0sQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLFdBQVcsQ0FBQyxPQUFPLEVBQUUsV0FBVyxFQUFFLHdEQUF3RCxDQUFDLENBQUM7Z0JBQzFILE9BQU8sRUFBRSxHQUFHLE1BQU0sRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUM7WUFDckMsQ0FBQztRQUNILENBQUM7UUFDRCxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3hELE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDbEYsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ2xELE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDL0IsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUM1RCxJQUFJLENBQUM7WUFDSCxNQUFNLFFBQVEsR0FBb0I7Z0JBQ2hDLE1BQU0sRUFBRSxtQkFBbUIsRUFBRSxXQUFXLEVBQUUsV0FBVyxDQUFDLElBQUksRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLE9BQU87Z0JBQzNHLFlBQVksRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLFdBQVcsRUFBRSxVQUFVLENBQUMsT0FBTyxLQUFLLElBQUk7Z0JBQ2hHLG1CQUFtQixFQUFFLFNBQVMsRUFBRSxFQUFFO2FBQ25DLENBQUM7WUFDRixJQUFJLEtBQUssR0FBRyxDQUFDLENBQUM7WUFDZCxLQUFLLE1BQU0sTUFBTSxJQUFJLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDcEMsTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7Z0JBQ2pFLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQ2xDLE1BQU0sS0FBSyxHQUFzQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO2dCQUNyRSxLQUFLLE1BQU0sSUFBSSxJQUFJLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztvQkFDaEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztvQkFDbEQsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsUUFBUSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDO29CQUNySCxJQUFJLENBQUM7d0JBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7d0JBQ25ELFlBQVksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLElBQUksTUFBTSxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLGNBQWMsRUFBRSx3Q0FBd0MsQ0FBQyxDQUFDO3dCQUM5SCxLQUFLLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQzt3QkFDN0IsWUFBWSxDQUFDLEtBQUssSUFBSSxNQUFNLENBQUMsS0FBSyxFQUFFLGNBQWMsRUFBRSw2Q0FBNkMsQ0FBQyxDQUFDO3dCQUNuRyxNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO3dCQUM1RCxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7d0JBQy9FLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDO3dCQUNqRCxJQUFJLElBQUksR0FBRyxDQUFDLENBQUM7d0JBQ2IsTUFBTSxLQUFLLEdBQUcsSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxLQUFhLEVBQUUsU0FBUyxFQUFFLFFBQVE7Z0NBQ3ZGLElBQUksSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDO2dDQUNyQixJQUFJLElBQUksR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7b0NBQUMsUUFBUSxDQUFDLElBQUksS0FBSyxDQUFDLDhCQUE4QixDQUFDLENBQUMsQ0FBQztvQ0FBQyxPQUFPO2dDQUFDLENBQUM7Z0NBQ2hHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7Z0NBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQzs0QkFDNUMsQ0FBQyxFQUFFLENBQUMsQ0FBQzt3QkFDTCxNQUFNLE9BQU8sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFDeEYsT0FBTyxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxXQUFXLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7d0JBQy9FLE1BQU0sS0FBSyxHQUFHLE1BQU0sTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO3dCQUNsRCxNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO3dCQUNoRSxZQUFZLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FDdEcsTUFBTSxDQUFDLEdBQTBCLENBQUMsS0FBSyxLQUFLLENBQUMsR0FBeUIsQ0FBQzs0QkFDdkUsTUFBTSxDQUFDLEdBQTBCLENBQUMsS0FBSyxPQUFPLENBQUMsR0FBMkIsQ0FBQyxDQUFDLEVBQzlFLFdBQVcsRUFBRSw4QkFBOEIsQ0FBQyxDQUFDO3dCQUM3QyxNQUFNLE1BQU0sR0FBRyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBYyxFQUFFLENBQUM7d0JBQzFHLFlBQVksQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRSx5Q0FBeUMsQ0FBQyxDQUFDO3dCQUNwSCxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLE1BQU0sQ0FBQztvQkFDNUIsQ0FBQzs0QkFBUyxDQUFDO3dCQUFDLE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO29CQUFDLENBQUM7Z0JBQ3JDLENBQUM7Z0JBQ0QsTUFBTSxRQUFRLEdBQUcsU0FBUyxDQUFDLGNBQWMsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO2dCQUN2RSxZQUFZLENBQUMsUUFBUSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsSUFBSSxFQUFFLGdCQUFnQixFQUFFLG9DQUFvQyxDQUFDLENBQUM7Z0JBQ3JHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLGFBQWEsQ0FBQyxFQUFFLFFBQVEsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO2dCQUNsRyxLQUFLLENBQUMsYUFBYSxDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQztnQkFDeEYsTUFBTSxJQUFJLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxJQUFJLFdBQVcsQ0FBQyxPQUFPLElBQUksTUFBTSxDQUFDLEVBQUUsU0FBUyxDQUFDO2dCQUN6RSxNQUFNLFdBQVcsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO2dCQUNyRSxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsRUFBRSxNQUFNLENBQUMsRUFBRSxFQUFFLElBQUksRUFBRSxHQUFHLE1BQU0sVUFBVSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDaEgsQ0FBQztZQUNELE1BQU0sV0FBVyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsV0FBVyxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQyxDQUFDO1lBQzlGLFlBQVksQ0FBQyxXQUFXLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxNQUFNLElBQUksV0FBVyxDQUFDLEtBQUssS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLGNBQWMsRUFBRSwwQ0FBMEMsQ0FBQyxDQUFDO1lBQ3JKLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQzNCLE1BQU0sUUFBUSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNyQyxNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDeEMsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsc0JBQXNCLENBQUMsRUFBRSxRQUFRLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUN4RyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxnQkFBZ0IsQ0FBQyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLGNBQWMsQ0FBQyxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7WUFDbEksTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxFQUFFLHNCQUFzQixFQUFFLGNBQWMsRUFBRSxDQUFDLENBQUM7WUFDdEUsTUFBTSxJQUFJLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxHQUFHLFdBQVcsa0JBQWtCLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDOUcsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQ25ELElBQUksTUFBTSxHQUFHLElBQUksQ0FBQztZQUNsQixJQUFJLENBQUM7Z0JBQUMsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUFDLENBQUM7WUFDdkMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFBQyxJQUFLLEtBQStCLENBQUMsSUFBSSxLQUFLLFFBQVE7b0JBQUUsTUFBTSxHQUFHLEtBQUssQ0FBQzs7b0JBQU0sTUFBTSxLQUFLLENBQUM7WUFBQyxDQUFDO1lBQzNHLFlBQVksQ0FBQyxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsdUdBQXVHLENBQUMsQ0FBQztZQUN6SSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztZQUN4QyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsY0FBYyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUN4RSxDQUFDO2dCQUFTLENBQUM7WUFBQyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFBQyxDQUFDO0lBQzdFLENBQUM7SUFFTyxTQUFTLENBQUMsUUFBeUIsRUFBRSxjQUFzQjtRQUNqRSxPQUFPLENBQUMsR0FBRyxRQUFRLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUMsc0JBQXNCLEVBQUUsY0FBYyxDQUFDLENBQUM7YUFDekgsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFFLENBQUMsYUFBYSxDQUFDLENBQUUsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQyxHQUFHLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUM7SUFDaEgsQ0FBQztJQUVNLEtBQUssQ0FBQyxNQUFNLENBQUMsWUFBb0IsRUFBRSxhQUFtQyxFQUFFO1FBQzdFLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQyx3QkFBd0IsRUFBRSxzQkFBc0IsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFDekYsWUFBWSxDQUFDLENBQUMsVUFBVSxDQUFDLHNCQUFzQixLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLHNCQUFzQixDQUFDLENBQUM7WUFDM0csQ0FBQyxVQUFVLENBQUMsb0JBQW9CLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsb0JBQW9CLENBQUMsQ0FBQztZQUM1RixDQUFDLFVBQVUsQ0FBQyxjQUFjLEtBQUssU0FBUyxJQUFJLE9BQU8sVUFBVSxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsRUFDN0YsZ0JBQWdCLEVBQUUsZ0NBQWdDLENBQUMsQ0FBQztRQUNwRCxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQy9ELFlBQVksQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxXQUFXLEVBQUUsSUFBSSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxLQUFLLFNBQVMsRUFDbEgsY0FBYyxFQUFFLHFEQUFxRCxDQUFDLENBQUM7UUFDekUsTUFBTSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsc0JBQXNCLENBQUMsQ0FBQyxDQUFDO1FBQzlGLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN4QixNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUM7UUFDdkIsWUFBWSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsc0JBQXNCLElBQUksVUFBVSxDQUFDLHNCQUFzQixLQUFLLGNBQWMsQ0FBQztZQUN2RyxDQUFDLENBQUMsVUFBVSxDQUFDLG9CQUFvQixJQUFJLFVBQVUsQ0FBQyxvQkFBb0IsS0FBSyxRQUFRLENBQUMsWUFBWSxDQUFDO1lBQy9GLENBQUMsQ0FBQyxVQUFVLENBQUMsY0FBYyxJQUFJLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxXQUFXLEVBQUUsb0RBQW9ELENBQUMsQ0FBQztRQUMzSCxNQUFNLEtBQUssR0FBRyxDQUFDLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUMzRCxZQUFZLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxzQkFBc0IsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFDcEosV0FBVyxFQUFFLGdEQUFnRCxDQUFDLENBQUM7UUFDakUsTUFBTSxZQUFZLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLGdCQUFnQixDQUFDLENBQUM7UUFDcEUsTUFBTSxZQUFZLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUMxRCxZQUFZLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxJQUFJLFlBQVksQ0FBQyxJQUFJLElBQUksRUFBRSxHQUFHLElBQUk7WUFDbEUsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsY0FBYyxDQUFDLEVBQUUsV0FBVyxFQUFFLGtDQUFrQyxDQUFDLENBQUM7UUFDakosS0FBSyxNQUFNLFFBQVEsSUFBSSxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDMUMsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUN6RCxNQUFNLE1BQU0sR0FBRyxNQUFNLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUN0QyxZQUFZLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsSUFBSSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLE1BQU0sRUFBRSxXQUFXLEVBQUUsNkJBQTZCLENBQUMsQ0FBQztZQUM3SCxNQUFNLEVBQUUsQ0FBQyxhQUFhLENBQUMsRUFBRSxTQUFTLEVBQUUsR0FBRyxLQUFLLEVBQUUsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDO1lBQ2hFLE1BQU0sYUFBYSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELE9BQU8sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLENBQUM7SUFDaEUsQ0FBQztDQUNGIn0=

package/dist_ts/index.d.ts

@@ -0,0 +1,3 @@
+export * from './interfaces.js';
+export * from './classes.tspack.js';
+export { runCli } from './tspack.cli.js';

package/dist_ts/index.js

@@ -0,0 +1,4 @@
+export * from './interfaces.js';
+export * from './classes.tspack.js';
+export { runCli } from './tspack.cli.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLGlCQUFpQixDQUFDIn0=

package/dist_ts/interfaces.d.ts

@@ -0,0 +1,60 @@
+export interface ITsPackFile {
+    /** Project-relative regular input file. Ancestor symlinks are rejected. */
+    source: string;
+    /** Portable relative name inside the bundle. */
+    path: string;
+    executable?: boolean;
+    /** Optional upstream identity, verified before assembly. */
+    sha256?: string;
+}
+export interface ITsPackBundle {
+    id: string;
+    files: ITsPackFile[];
+}
+export interface ITsPackConfig {
+    schemaVersion: 1;
+    /** Defaults to the package name with its scope separator replaced by a hyphen. */
+    name?: string;
+    outputDirectory?: string;
+    bundles: ITsPackBundle[];
+}
+export interface ITsPackOptions {
+    /** Requires clean source at the package's vVERSION tag. */
+    release?: boolean;
+    /** Reuse a verified existing sealed set for this exact tagged source/configuration. */
+    reuse?: boolean;
+}
+export interface ITsPackFileRecord {
+    sha256: string;
+    size: number;
+    mode: 420 | 493;
+}
+export interface ITsPackArtifact {
+    id: string;
+    name: string;
+    sha256: string;
+    size: number;
+    files: Record<string, ITsPackFileRecord>;
+}
+export interface ITsPackManifest {
+    format: 'tspack.release.v1';
+    packageName: string;
+    name: string;
+    version: string;
+    sourceCommit: string;
+    sourceDirty: boolean;
+    publishable: boolean;
+    configurationSha256: string;
+    artifacts: ITsPackArtifact[];
+}
+export interface ITsPackResult {
+    directory: string;
+    manifest: ITsPackManifest;
+    manifestSha256: string;
+    reused: boolean;
+}
+export interface ITsPackVerifyOptions {
+    expectedManifestSha256?: string;
+    expectedSourceCommit?: string;
+    requireRelease?: boolean;
+}

package/dist_ts/interfaces.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJmYWNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2ludGVyZmFjZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist_ts/plugins.d.ts

@@ -0,0 +1,13 @@
+import * as fs from 'node:fs/promises';
+import * as nodeFs from 'node:fs';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import * as stream from 'node:stream';
+import * as streamPromises from 'node:stream/promises';
+import * as zlib from 'node:zlib';
+import * as childProcess from 'node:child_process';
+import * as util from 'node:util';
+export { fs, nodeFs, path, crypto, stream, streamPromises, zlib, childProcess, util };
+import * as smartarchive from '@push.rocks/smartarchive';
+import * as smartconfig from '@push.rocks/smartconfig';
+export { smartarchive, smartconfig };

package/dist_ts/plugins.js

@@ -0,0 +1,16 @@
+// Node native modules
+import * as fs from 'node:fs/promises';
+import * as nodeFs from 'node:fs';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import * as stream from 'node:stream';
+import * as streamPromises from 'node:stream/promises';
+import * as zlib from 'node:zlib';
+import * as childProcess from 'node:child_process';
+import * as util from 'node:util';
+export { fs, nodeFs, path, crypto, stream, streamPromises, zlib, childProcess, util };
+// @push.rocks modules
+import * as smartarchive from '@push.rocks/smartarchive';
+import * as smartconfig from '@push.rocks/smartconfig';
+export { smartarchive, smartconfig };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDdkMsT0FBTyxLQUFLLE1BQU0sTUFBTSxTQUFTLENBQUM7QUFDbEMsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFDbEMsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxLQUFLLGNBQWMsTUFBTSxzQkFBc0IsQ0FBQztBQUN2RCxPQUFPLEtBQUssSUFBSSxNQUFNLFdBQVcsQ0FBQztBQUNsQyxPQUFPLEtBQUssWUFBWSxNQUFNLG9CQUFvQixDQUFDO0FBQ25ELE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sRUFBRSxFQUFFLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLElBQUksRUFBRSxDQUFDO0FBRXRGLHNCQUFzQjtBQUN0QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQyJ9

package/dist_ts/tspack.cli.d.ts

@@ -0,0 +1 @@
+export declare function runCli(args?: string[]): Promise<void>;

package/dist_ts/tspack.cli.js

@@ -0,0 +1,53 @@
+import { TsPack, TsPackError } from './classes.tspack.js';
+import * as plugins from './plugins.js';
+import { readJson } from './validation.js';
+export async function runCli(args = process.argv.slice(2)) {
+    try {
+        if (args.length === 0 || args[0] === '--help' || args[0] === 'help') {
+            console.log('tspack pack [--release] [--reuse] [--config <json-file>]\ntspack verify <artifact-directory> [--release] [--sha256 <manifest-digest>]');
+            return;
+        }
+        const command = args[0];
+        const values = args.slice(1);
+        const directory = command === 'verify' ? values.shift() : undefined;
+        let release = false;
+        let reuse = false;
+        let configFile;
+        let expectedManifestSha256;
+        const used = new Set();
+        while (values.length) {
+            const option = values.shift();
+            if (used.has(option))
+                throw new TsPackError('arguments', 'Duplicate command option.');
+            used.add(option);
+            if (option === '--release')
+                release = true;
+            else if (option === '--reuse' && command === 'pack')
+                reuse = true;
+            else if ((option === '--config' && command === 'pack') || (option === '--sha256' && command === 'verify')) {
+                const value = values.shift();
+                if (!value || value.startsWith('--'))
+                    throw new TsPackError('arguments', 'Command option requires a value.');
+                if (option === '--config')
+                    configFile = value;
+                else
+                    expectedManifestSha256 = value;
+            }
+            else
+                throw new TsPackError('arguments', 'Unknown command option.');
+        }
+        const pack = new TsPack();
+        const result = command === 'pack'
+            ? await pack.pack(configFile ? (await readJson(plugins.path.resolve(configFile))).value : undefined, { release, reuse })
+            : command === 'verify' && directory && !directory.startsWith('--')
+                ? await pack.verify(directory, { requireRelease: release, expectedManifestSha256 })
+                : (() => { throw new TsPackError('arguments', 'Expected pack or verify with its required arguments.'); })();
+        console.log(JSON.stringify({ directory: result.directory, manifestSha256: result.manifestSha256,
+            publishable: result.manifest.publishable, reused: result.reused, bundles: result.manifest.artifacts.length }));
+    }
+    catch (error) {
+        console.error(error instanceof TsPackError ? `tspack: ${error.code}: ${error.message}` : 'tspack: operation failed.');
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHNwYWNrLmNsaS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3RzcGFjay5jbGkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUMxRCxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4QyxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFFM0MsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN2RCxJQUFJLENBQUM7UUFDSCxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsS0FBSyxRQUFRLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQ3BFLE9BQU8sQ0FBQyxHQUFHLENBQUMsdUlBQXVJLENBQUMsQ0FBQztZQUNySixPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN4QixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzdCLE1BQU0sU0FBUyxHQUFHLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3BFLElBQUksT0FBTyxHQUFHLEtBQUssQ0FBQztRQUNwQixJQUFJLEtBQUssR0FBRyxLQUFLLENBQUM7UUFDbEIsSUFBSSxVQUE4QixDQUFDO1FBQ25DLElBQUksc0JBQTBDLENBQUM7UUFDL0MsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLEVBQUUsQ0FBQztRQUN2QixPQUFPLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNyQixNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxFQUFHLENBQUM7WUFDL0IsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQztnQkFBRSxNQUFNLElBQUksV0FBVyxDQUFDLFdBQVcsRUFBRSwyQkFBMkIsQ0FBQyxDQUFDO1lBQ3RGLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDakIsSUFBSSxNQUFNLEtBQUssV0FBVztnQkFBRSxPQUFPLEdBQUcsSUFBSSxDQUFDO2lCQUN0QyxJQUFJLE1BQU0sS0FBSyxTQUFTLElBQUksT0FBTyxLQUFLLE1BQU07Z0JBQUUsS0FBSyxHQUFHLElBQUksQ0FBQztpQkFDN0QsSUFBSSxDQUFDLE1BQU0sS0FBSyxVQUFVLElBQUksT0FBTyxLQUFLLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLFVBQVUsSUFBSSxPQUFPLEtBQUssUUFBUSxDQUFDLEVBQUUsQ0FBQztnQkFDMUcsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUM3QixJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDO29CQUFFLE1BQU0sSUFBSSxXQUFXLENBQUMsV0FBVyxFQUFFLGtDQUFrQyxDQUFDLENBQUM7Z0JBQzdHLElBQUksTUFBTSxLQUFLLFVBQVU7b0JBQUUsVUFBVSxHQUFHLEtBQUssQ0FBQzs7b0JBQU0sc0JBQXNCLEdBQUcsS0FBSyxDQUFDO1lBQ3JGLENBQUM7O2dCQUFNLE1BQU0sSUFBSSxXQUFXLENBQUMsV0FBVyxFQUFFLHlCQUF5QixDQUFDLENBQUM7UUFDdkUsQ0FBQztRQUNELE1BQU0sSUFBSSxHQUFHLElBQUksTUFBTSxFQUFFLENBQUM7UUFDMUIsTUFBTSxNQUFNLEdBQUcsT0FBTyxLQUFLLE1BQU07WUFDL0IsQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQXNCLENBQUMsQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQztZQUN6SSxDQUFDLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxTQUFTLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQztnQkFDbEUsQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsRUFBRSxjQUFjLEVBQUUsT0FBTyxFQUFFLHNCQUFzQixFQUFFLENBQUM7Z0JBQ25GLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLE1BQU0sSUFBSSxXQUFXLENBQUMsV0FBVyxFQUFFLHNEQUFzRCxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzlHLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYztZQUM3RixXQUFXLEVBQUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxXQUFXLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNuSCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxZQUFZLFdBQVcsQ0FBQyxDQUFDLENBQUMsV0FBVyxLQUFLLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsMkJBQTJCLENBQUMsQ0FBQztRQUN0SCxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztJQUN2QixDQUFDO0FBQ0gsQ0FBQyJ9

package/dist_ts/validation.d.ts

@@ -0,0 +1,32 @@
+import type { ITsPackConfig, ITsPackFileRecord, ITsPackManifest } from './interfaces.js';
+export declare const limits: {
+    file: number;
+    total: number;
+    files: number;
+    json: number;
+};
+export declare class TsPackError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function requireValue(value: unknown, code: string, message: string): asserts value;
+export declare const sha256: (value: string | Buffer) => string;
+export declare const isDigest: (value: unknown) => value is string;
+export declare const isCommit: (value: unknown) => value is string;
+export declare const isName: (value: unknown) => value is string;
+export declare const isVersion: (value: unknown) => value is string;
+export declare const isPath: (value: unknown) => value is string;
+export declare const jsonBytes: (value: unknown) => Buffer<ArrayBuffer>;
+export declare function object(value: unknown, allowed?: readonly string[]): asserts value is Record<string, unknown>;
+export declare function normalizeConfig(value: unknown, packageName: string): Required<ITsPackConfig>;
+export declare function validateFileRecord(value: unknown): asserts value is ITsPackFileRecord;
+export declare function validateManifest(value: unknown): asserts value is ITsPackManifest;
+export declare function noSymlinks(root: string, relative: string, allowMissing?: boolean): Promise<string>;
+export declare function readJson(file: string): Promise<{
+    value: unknown;
+    bytes: Buffer;
+}>;
+export declare function digestFile(file: string): Promise<{
+    sha256: string;
+    size: number;
+}>;