@git.zone/tspack 1.1.0 → 1.3.0

package/ts/classes.tspack.ts

@@ -1,7 +1,8 @@
 import * as plugins from './plugins.js';
-import type { ITsPackConfig, ITsPackOptions, ITsPackResult, ITsPackVerifyOptions, ITsPackFileRecord, ITsPackManifest } from './interfaces.js';
+import type { ITsPackConfig, ITsPackOptions, ITsPackResult, ITsPackVerifyOptions, ITsPackFileRecord, ITsPackManifest, ITsPackArtifact,
+  ITsPackBundleOptions, ITsPackBundleResult, ITsPackExtractResult } from './interfaces.js';
 import { packArchive, verifyArchive } from './archive.js';
-import { digestFile, isCommit, isDigest, isPath, isVersion, jsonBytes, limits, noSymlinks, normalizeConfig, object,
+import { digestFile, isCommit, isDigest, isName, isPath, isVersion, jsonBytes, limits, noSymlinks, normalizeConfig, object,
   readJson, requireValue, sha256, validateManifest } from './validation.js';
 export { TsPackError } from './validation.js';
 
@@ -16,6 +17,36 @@ const bundleMetadata = (manifest: Omit<ITsPackManifest, 'artifacts'>, id: string
 export class TsPack {
   constructor(private readonly cwd = process.cwd()) {}
 
+  private async copyInput(root: string, source: string, destination: string, remaining: number,
+    options: { executable?: boolean; sha256?: string }): Promise<ITsPackFileRecord> {
+    const input = await noSymlinks(root, source);
+    const handle = await plugins.fs.open(input, plugins.nodeFs.constants.O_RDONLY | plugins.nodeFs.constants.O_NOFOLLOW);
+    try {
+      const before = await handle.stat({ bigint: true });
+      requireValue(before.isFile() && before.size <= BigInt(limits.file), 'unsafe_input', 'Expected a bounded regular input file.');
+      requireValue(before.size <= BigInt(remaining), 'unsafe_input', 'Package inputs exceed the total byte limit.');
+      await plugins.fs.mkdir(plugins.path.dirname(destination), { recursive: true });
+      const hash = plugins.crypto.createHash('sha256');
+      let size = 0;
+      const meter = new plugins.stream.Transform({ transform(chunk: Buffer, _encoding, callback) {
+        size += chunk.length;
+        if (size > Number(before.size)) { callback(new Error('Input changed while copying.')); return; }
+        hash.update(chunk); callback(null, chunk);
+      } });
+      await plugins.streamPromises.pipeline(handle.createReadStream({ autoClose: false }), meter,
+        plugins.nodeFs.createWriteStream(destination, { flags: 'wx', mode: 0o600 }));
+      const after = await handle.stat({ bigint: true });
+      const current = await plugins.fs.lstat(input, { bigint: true });
+      requireValue(size === Number(before.size) && ['dev', 'ino', 'size', 'mtimeNs', 'ctimeNs'].every((key) =>
+        before[key as keyof typeof before] === after[key as keyof typeof after] &&
+        before[key as keyof typeof before] === current[key as keyof typeof current]),
+      'integrity', 'Input changed while copying.');
+      const record: ITsPackFileRecord = { sha256: hash.digest('hex'), size, mode: options.executable ? 0o755 : 0o644 };
+      requireValue(!options.sha256 || options.sha256 === record.sha256, 'integrity', 'Input does not match its pinned digest.');
+      return record;
+    } finally { await handle.close(); }
+  }
+
   private async source(root: string, version: string, release: boolean) {
     const run = async (...args: string[]) => (await exec('git', args, { cwd: root, maxBuffer: 4 * 1024 ** 2 })).stdout.trim();
     const commit = await run('rev-parse', 'HEAD');
@@ -41,6 +72,9 @@ export class TsPack {
     const config = normalizeConfig(configArg ?? new plugins.smartconfig.Smartconfig(root).dataFor('@git.zone/tspack', {}), packageJson.name);
     requireValue(config.bundles.every((bundle) => isPath(`${config.name}-${packageJson.version}-${bundle.id}.tar.gz`)),
       'invalid_config', 'Archive names exceed the portable path limit.');
+    const names = [...config.bundles.map((bundle) => `${config.name}-${packageJson.version}-${bundle.id}.tar.gz`),
+      ...(config.assets ?? []).map((asset) => asset.name)].map((name) => name.toLowerCase());
+    requireValue(new Set(names).size === names.length, 'invalid_config', 'Archive and standalone asset names collide.');
     const configurationSha256 = sha256(jsonBytes(config));
     const source = await this.source(root, packageJson.version, optionsArg.release === true);
     const outputRoot = await noSymlinks(root, config.outputDirectory, true);
@@ -64,7 +98,7 @@ export class TsPack {
     await plugins.fs.mkdir(plugins.path.join(stage, 'bundles'));
     try {
       const manifest: ITsPackManifest = {
-        format: 'tspack.release.v1', packageName: packageJson.name, name: config.name, version: packageJson.version,
+        format: config.assets?.length ? 'tspack.release.v2' : 'tspack.release.v1', packageName: packageJson.name, name: config.name, version: packageJson.version,
         sourceCommit: source.commit, sourceDirty: source.dirty, publishable: optionsArg.release === true,
         configurationSha256, artifacts: [],
       };
@@ -74,34 +108,9 @@ export class TsPack {
         await plugins.fs.mkdir(directory);
         const files: Record<string, ITsPackFileRecord> = Object.create(null);
         for (const file of bundle.files) {
-          const input = await noSymlinks(root, file.source);
-          const handle = await plugins.fs.open(input, plugins.nodeFs.constants.O_RDONLY | plugins.nodeFs.constants.O_NOFOLLOW);
-          try {
-            const before = await handle.stat({ bigint: true });
-            requireValue(before.isFile() && before.size <= BigInt(limits.file), 'unsafe_input', 'Expected a bounded regular input file.');
-            total += Number(before.size);
-            requireValue(total <= limits.total, 'unsafe_input', 'Package inputs exceed the total byte limit.');
-            const destination = plugins.path.join(directory, file.path);
-            await plugins.fs.mkdir(plugins.path.dirname(destination), { recursive: true });
-            const hash = plugins.crypto.createHash('sha256');
-            let size = 0;
-            const meter = new plugins.stream.Transform({ transform(chunk: Buffer, _encoding, callback) {
-              size += chunk.length;
-              if (size > Number(before.size)) { callback(new Error('Input changed while copying.')); return; }
-              hash.update(chunk); callback(null, chunk);
-            } });
-            await plugins.streamPromises.pipeline(handle.createReadStream({ autoClose: false }), meter,
-              plugins.nodeFs.createWriteStream(destination, { flags: 'wx', mode: 0o600 }));
-            const after = await handle.stat({ bigint: true });
-            const current = await plugins.fs.lstat(input, { bigint: true });
-            requireValue(size === Number(before.size) && ['dev', 'ino', 'size', 'mtimeNs', 'ctimeNs'].every((key) =>
-              before[key as keyof typeof before] === after[key as keyof typeof after] &&
-              before[key as keyof typeof before] === current[key as keyof typeof current]),
-            'integrity', 'Input changed while copying.');
-            const record = { sha256: hash.digest('hex'), size, mode: (file.executable ? 0o755 : 0o644) as 493 | 420 };
-            requireValue(!file.sha256 || file.sha256 === record.sha256, 'integrity', 'Input does not match its pinned digest.');
-            files[file.path] = record;
-          } finally { await handle.close(); }
+          const record = await this.copyInput(root, file.source, plugins.path.join(directory, file.path), limits.total - total, file);
+          total += record.size;
+          files[file.path] = record;
         }
         const metadata = jsonBytes(bundleMetadata(manifest, bundle.id, files));
         requireValue(metadata.length <= limits.json, 'invalid_config', 'Bundle metadata exceeds its limit.');
@@ -111,6 +120,15 @@ export class TsPack {
         await packArchive(directory, plugins.path.join(assets, name), files);
         manifest.artifacts.push({ id: bundle.id, name, ...await digestFile(plugins.path.join(assets, name)), files });
       }
+      for (const asset of config.assets ?? []) {
+        const file = plugins.path.join(assets, asset.name);
+        const record = await this.copyInput(root, asset.source, file, limits.total - total, asset);
+        total += record.size;
+        await plugins.fs.chmod(file, record.mode);
+        manifest.artifacts.push({ kind: 'file', id: asset.id, name: asset.name, sha256: record.sha256,
+          size: record.size, files: { [asset.name]: record } });
+      }
+      manifest.artifacts.sort((a, b) => a.id.localeCompare(b.id, 'en'));
       const finalSource = await this.source(root, packageJson.version, optionsArg.release === true);
       requireValue(finalSource.commit === source.commit && finalSource.dirty === source.dirty, 'source_state', 'Source identity changed while packaging.');
       validateManifest(manifest);
@@ -135,7 +153,8 @@ export class TsPack {
       .sort(([a], [b]) => a!.localeCompare(b!, 'en')).map(([name, hash]) => `${hash}  ${name}`).join('\n') + '\n';
   }
 
-  public async verify(directoryArg: string, optionsArg: ITsPackVerifyOptions = {}): Promise<ITsPackResult> {
+  private async readArtifactSet(directoryArg: string, optionsArg: ITsPackVerifyOptions,
+    bundleId?: string): Promise<ITsPackResult> {
     object(optionsArg, ['expectedManifestSha256', 'expectedSourceCommit', 'requireRelease']);
     requireValue((optionsArg.expectedManifestSha256 === undefined || isDigest(optionsArg.expectedManifestSha256)) &&
       (optionsArg.expectedSourceCommit === undefined || isCommit(optionsArg.expectedSourceCommit)) &&
@@ -151,20 +170,116 @@ export class TsPack {
     requireValue((!optionsArg.expectedManifestSha256 || optionsArg.expectedManifestSha256 === manifestSha256) &&
       (!optionsArg.expectedSourceCommit || optionsArg.expectedSourceCommit === manifest.sourceCommit) &&
       (!optionsArg.requireRelease || manifest.publishable), 'integrity', 'Artifact set does not match its required identity.');
+    const selected = bundleId === undefined ? manifest.artifacts : manifest.artifacts.filter((artifact) => artifact.id === bundleId);
+    requireValue(selected.length > 0, 'invalid_config', 'The requested bundle does not exist.');
     const names = (await plugins.fs.readdir(directory)).sort();
-    requireValue(names.join('\n') === [...manifest.artifacts.map((artifact) => artifact.name), 'tspack-manifest.json', 'SHA256SUMS.txt'].sort().join('\n'),
+    requireValue(names.join('\n') === [...selected.map((artifact) => artifact.name), 'tspack-manifest.json', 'SHA256SUMS.txt'].sort().join('\n'),
       'integrity', 'Artifact directory has an unexpected file set.');
     const checksumPath = plugins.path.join(directory, 'SHA256SUMS.txt');
     const checksumStat = await plugins.fs.lstat(checksumPath);
-    requireValue(checksumStat.isFile() && checksumStat.size <= 32 * 1024 &&
+    requireValue(checksumStat.isFile() && checksumStat.size <= 64 * 1024 &&
       await plugins.fs.readFile(checksumPath, 'utf8') === this.checksums(manifest, manifestSha256), 'integrity', 'Artifact-set checksums disagree.');
-    for (const artifact of manifest.artifacts) {
-      const file = plugins.path.join(directory, artifact.name);
-      const actual = await digestFile(file);
-      requireValue(actual.size === artifact.size && actual.sha256 === artifact.sha256, 'integrity', 'Archive integrity mismatch.');
+    return { directory, manifest, manifestSha256, reused: false };
+  }
+
+  public async verify(directoryArg: string, optionsArg: ITsPackVerifyOptions = {}): Promise<ITsPackResult> {
+    const result = await this.readArtifactSet(directoryArg, optionsArg);
+    for (const artifact of result.manifest.artifacts) {
+      await this.verifyRecord(result.directory, result.manifest, artifact);
+    }
+    return result;
+  }
+
+  private async verifyRecord(directory: string, manifest: ITsPackManifest, artifact: ITsPackArtifact, signal?: AbortSignal): Promise<void> {
+    const file = plugins.path.join(directory, artifact.name);
+    if (artifact.kind !== 'file') {
       const { ['tspack.json']: _metadata, ...files } = artifact.files;
-      await verifyArchive(file, artifact, bundleMetadata(manifest, artifact.id, files));
+      await verifyArchive(file, artifact, bundleMetadata(manifest, artifact.id, files), { signal });
+      return;
+    }
+    signal?.throwIfAborted();
+    requireValue((await plugins.fs.lstat(file)).isFile(), 'integrity', 'Expected a regular standalone artifact.');
+    const handle = await plugins.fs.open(file, plugins.nodeFs.constants.O_RDONLY | plugins.nodeFs.constants.O_NOFOLLOW);
+    try {
+      const before = await handle.stat({ bigint: true });
+      requireValue(before.isFile() && before.size === BigInt(artifact.size), 'integrity', 'Standalone artifact size differs.');
+      const hash = plugins.crypto.createHash('sha256');
+      let size = 0;
+      for await (const chunk of handle.createReadStream({ autoClose: false })) {
+        signal?.throwIfAborted();
+        size += chunk.length;
+        requireValue(size <= artifact.size, 'integrity', 'Standalone artifact grew while reading.');
+        hash.update(chunk);
+      }
+      const after = await handle.stat({ bigint: true });
+      const current = await plugins.fs.lstat(file, { bigint: true });
+      requireValue(size === artifact.size && hash.digest('hex') === artifact.sha256 && current.isFile() &&
+        ['dev', 'ino', 'size', 'mtimeNs', 'ctimeNs'].every((key) =>
+          before[key as keyof typeof before] === after[key as keyof typeof after] &&
+          before[key as keyof typeof before] === current[key as keyof typeof current]),
+      'integrity', 'Standalone artifact changed or does not match its identity.');
+      signal?.throwIfAborted();
+    } finally { await handle.close(); }
+  }
+
+  private async readBundle(directoryArg: string, bundleIdArg: string,
+    optionsArg: ITsPackBundleOptions): Promise<{ result: ITsPackBundleResult; signal?: AbortSignal }> {
+    object(optionsArg, ['expectedManifestSha256', 'expectedSourceCommit', 'requireRelease', 'signal']);
+    requireValue(isName(bundleIdArg) && isDigest(optionsArg.expectedManifestSha256) &&
+      (optionsArg.signal === undefined || optionsArg.signal instanceof AbortSignal),
+    'invalid_config', 'Bundle consumption requires a selected bundle and trusted manifest digest.');
+    const { signal, ...identity } = optionsArg;
+    signal?.throwIfAborted();
+    const result = await this.readArtifactSet(directoryArg, identity, bundleIdArg);
+    signal?.throwIfAborted();
+    return { result: { ...result, artifact: result.manifest.artifacts.find((artifact) => artifact.id === bundleIdArg)! }, signal };
+  }
+
+  /** Verify a selected-only download: complete metadata plus exactly one archive. */
+  public async verifyBundle(directoryArg: string, bundleIdArg: string,
+    optionsArg: ITsPackBundleOptions): Promise<ITsPackBundleResult> {
+    const { result, signal } = await this.readBundle(directoryArg, bundleIdArg, optionsArg);
+    const { artifact } = result;
+    requireValue(artifact.kind !== 'file', 'invalid_config', 'Selected artifact is a standalone file, not an archive bundle.');
+    await this.verifyRecord(result.directory, result.manifest, artifact, signal);
+    signal?.throwIfAborted();
+    return result;
+  }
+
+  /** Verify one selected archive or standalone file against the complete trusted release identity. */
+  public async verifyArtifact(directoryArg: string, artifactIdArg: string,
+    optionsArg: ITsPackBundleOptions): Promise<ITsPackBundleResult> {
+    const { result, signal } = await this.readBundle(directoryArg, artifactIdArg, optionsArg);
+    await this.verifyRecord(result.directory, result.manifest, result.artifact, signal);
+    signal?.throwIfAborted();
+    return result;
+  }
+
+  /** Extract code/assets into a fresh private directory. The caller owns installation and activation. */
+  public async extractBundle(directoryArg: string, bundleIdArg: string, parentArg: string,
+    optionsArg: ITsPackBundleOptions): Promise<ITsPackExtractResult> {
+    const { result, signal } = await this.readBundle(directoryArg, bundleIdArg, optionsArg);
+    requireValue(result.artifact.kind !== 'file', 'invalid_config', 'Selected artifact is a standalone file, not an archive bundle.');
+    requireValue(typeof parentArg === 'string' && parentArg.length > 0, 'unsafe_input', 'An extraction parent is required.');
+    const parent = plugins.path.resolve(this.cwd, parentArg);
+    requireValue((await plugins.fs.lstat(parent)).isDirectory() && await plugins.fs.realpath(parent) === parent,
+      'unsafe_input', 'Extraction requires an existing canonical parent directory.');
+    signal?.throwIfAborted();
+    const directory = await plugins.fs.mkdtemp(plugins.path.join(parent, '.tspack-extract-'));
+    const owner = await plugins.fs.lstat(directory, { bigint: true });
+    try {
+      const { artifact } = result;
+      const { ['tspack.json']: _metadata, ...files } = artifact.files;
+      await verifyArchive(plugins.path.join(result.directory, artifact.name), artifact,
+        bundleMetadata(result.manifest, artifact.id, files), { destination: directory, signal });
+      signal?.throwIfAborted();
+      return { ...result, sourceDirectory: result.directory, directory };
+    } catch (error) {
+      const current = await plugins.fs.lstat(directory, { bigint: true });
+      requireValue(current.isDirectory() && current.dev === owner.dev && current.ino === owner.ino &&
+        await plugins.fs.realpath(directory) === directory, 'unsafe_input', 'Extraction directory ownership changed; cleanup refused.');
+      await plugins.fs.rm(directory, { recursive: true });
+      throw error;
     }
-    return { directory, manifest, manifestSha256, reused: false };
   }
 }

package/ts/interfaces.ts

@@ -13,12 +13,22 @@ export interface ITsPackBundle {
   files: ITsPackFile[];
 }
 
+/** A named release asset whose bytes are published without an archive wrapper. */
+export interface ITsPackAsset {
+  id: string;
+  source: string;
+  name: string;
+  executable?: boolean;
+  sha256?: string;
+}
+
 export interface ITsPackConfig {
   schemaVersion: 1;
   /** Defaults to the package name with its scope separator replaced by a hyphen. */
   name?: string;
   outputDirectory?: string;
   bundles: ITsPackBundle[];
+  assets?: ITsPackAsset[];
 }
 
 export interface ITsPackOptions {
@@ -35,6 +45,8 @@ export interface ITsPackFileRecord {
 }
 
 export interface ITsPackArtifact {
+  /** Omitted for v1-compatible tar.gz bundles; explicit for standalone files in v2 sets. */
+  kind?: 'file';
   id: string;
   name: string;
   sha256: string;
@@ -43,7 +55,7 @@ export interface ITsPackArtifact {
 }
 
 export interface ITsPackManifest {
-  format: 'tspack.release.v1';
+  format: 'tspack.release.v1' | 'tspack.release.v2';
   packageName: string;
   name: string;
   version: string;
@@ -66,3 +78,18 @@ export interface ITsPackVerifyOptions {
   expectedSourceCommit?: string;
   requireRelease?: boolean;
 }
+
+export interface ITsPackBundleOptions extends ITsPackVerifyOptions {
+  /** The caller's trusted digest of the complete release manifest. */
+  expectedManifestSha256: string;
+  signal?: AbortSignal;
+}
+
+export interface ITsPackBundleResult extends ITsPackResult {
+  artifact: ITsPackArtifact;
+}
+
+export interface ITsPackExtractResult extends ITsPackBundleResult {
+  /** Input artifact directory. `directory` is the new private extraction directory. */
+  sourceDirectory: string;
+}

package/ts/tspack.cli.ts

@@ -36,7 +36,9 @@ export async function runCli(args = process.argv.slice(2)): Promise<void> {
       ? await pack.verify(directory, { requireRelease: release, expectedManifestSha256 })
       : (() => { throw new TsPackError('arguments', 'Expected pack or verify with its required arguments.'); })();
     console.log(JSON.stringify({ directory: result.directory, manifestSha256: result.manifestSha256,
-      publishable: result.manifest.publishable, reused: result.reused, bundles: result.manifest.artifacts.length }));
+      publishable: result.manifest.publishable, reused: result.reused,
+      bundles: result.manifest.artifacts.filter((artifact) => artifact.kind !== 'file').length,
+      assets: result.manifest.artifacts.filter((artifact) => artifact.kind === 'file').length }));
   } catch (error) {
     console.error(error instanceof TsPackError ? `tspack: ${error.code}: ${error.message}` : 'tspack: operation failed.');
     process.exitCode = 1;

package/ts/validation.ts

@@ -18,6 +18,8 @@ export const isName = (value: unknown): value is string => typeof value === 'str
 export const isVersion = (value: unknown): value is string => typeof value === 'string' && value.length <= 64 && /^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(value);
 export const isPath = (value: unknown): value is string => typeof value === 'string' && value.length <= 240 &&
   /^[a-zA-Z0-9@_+./-]+$/.test(value) && !value.startsWith('/') && value.split('/').every((part) => part && part !== '.' && part !== '..');
+export const isAssetName = (value: unknown): value is string => isPath(value) && !value.includes('/') &&
+  !['tspack-manifest.json', 'sha256sums.txt', 'tspack.json'].includes(value.toLowerCase());
 export const jsonBytes = (value: unknown) => Buffer.from(JSON.stringify(value, null, 2) + '\n');
 
 export function object(value: unknown, allowed?: readonly string[]): asserts value is Record<string, unknown> {
@@ -28,13 +30,25 @@ export function object(value: unknown, allowed?: readonly string[]): asserts val
     'value' in Object.getOwnPropertyDescriptor(value, key)!), 'invalid_config', 'Unexpected record property.');
 }
 
-export function normalizeConfig(value: unknown, packageName: string): Required<ITsPackConfig> {
-  object(value, ['schemaVersion', 'name', 'outputDirectory', 'bundles']);
+export function normalizeConfig(value: unknown, packageName: string): Omit<Required<ITsPackConfig>, 'assets'> & Pick<ITsPackConfig, 'assets'> {
+  object(value, ['schemaVersion', 'name', 'outputDirectory', 'bundles', 'assets']);
   const name = value.name ?? packageName.replace(/^@/, '').replace('/', '-');
   const outputDirectory = value.outputDirectory ?? 'dist_pack';
   requireValue(value.schemaVersion === 1 && isName(name) && isPath(outputDirectory) &&
-    Array.isArray(value.bundles) && value.bundles.length > 0 && value.bundles.length <= 128,
+    Array.isArray(value.bundles) && value.bundles.length <= 128 &&
+    (!Object.hasOwn(value, 'assets') || Array.isArray(value.assets)),
   'invalid_config', 'Invalid tspack configuration.');
+  const assetInputs = (value.assets ?? []) as unknown[];
+  requireValue(assetInputs.length + value.bundles.length > 0 && assetInputs.length + value.bundles.length <= 128,
+    'invalid_config', 'A release requires between one and 128 artifacts.');
+  const assets = assetInputs.map((asset) => {
+    object(asset, ['id', 'source', 'name', 'executable', 'sha256']);
+    requireValue(isName(asset.id) && isPath(asset.source) && isAssetName(asset.name) &&
+      (!Object.hasOwn(asset, 'executable') || typeof asset.executable === 'boolean') &&
+      (!Object.hasOwn(asset, 'sha256') || isDigest(asset.sha256)), 'invalid_config', 'Invalid standalone asset.');
+    return { id: asset.id, source: asset.source, name: asset.name, executable: asset.executable === true,
+      ...(asset.sha256 ? { sha256: asset.sha256 as string } : {}) };
+  }).sort((a, b) => a.id.localeCompare(b.id, 'en'));
   let count = 0;
   const bundles = value.bundles.map((bundle: unknown) => {
     object(bundle, ['id', 'files']);
@@ -54,9 +68,12 @@ export function normalizeConfig(value: unknown, packageName: string): Required<I
     'invalid_config', 'Bundle paths collide.');
     return { id: bundle.id, files };
   }).sort((a, b) => a.id.localeCompare(b.id, 'en'));
-  requireValue(count <= limits.files && new Set(bundles.map((bundle) => bundle.id)).size === bundles.length,
+  const ids = [...bundles, ...assets].map((artifact) => artifact.id);
+  requireValue(count + assets.length <= limits.files && new Set(ids).size === ids.length &&
+    new Set(assets.map((asset) => asset.name.toLowerCase())).size === assets.length,
     'invalid_config', 'Too many files or duplicate bundle identifiers.');
-  return { schemaVersion: 1, name, outputDirectory, bundles };
+  // Omit an empty extension so archive-only v1 configuration hashes remain unchanged.
+  return { schemaVersion: 1, name, outputDirectory, bundles, ...(assets.length ? { assets } : {}) };
 }
 
 export function validateFileRecord(value: unknown): asserts value is ITsPackFileRecord {
@@ -68,7 +85,7 @@ export function validateFileRecord(value: unknown): asserts value is ITsPackFile
 
 export function validateManifest(value: unknown): asserts value is ITsPackManifest {
   object(value, ['format', 'packageName', 'name', 'version', 'sourceCommit', 'sourceDirty', 'publishable', 'configurationSha256', 'artifacts']);
-  requireValue(value.format === 'tspack.release.v1' && typeof value.packageName === 'string' && value.packageName.length <= 214 &&
+  requireValue(['tspack.release.v1', 'tspack.release.v2'].includes(value.format as string) && typeof value.packageName === 'string' && value.packageName.length <= 214 &&
     isName(value.name) && isVersion(value.version) && isCommit(value.sourceCommit) &&
     typeof value.sourceDirty === 'boolean' && typeof value.publishable === 'boolean' &&
     (!value.publishable || !value.sourceDirty) && isDigest(value.configurationSha256) &&
@@ -78,22 +95,42 @@ export function validateManifest(value: unknown): asserts value is ITsPackManife
   const names = new Set();
   let total = 0;
   let count = 0;
+  let standaloneCount = 0;
   for (const artifact of value.artifacts) {
-    object(artifact, ['id', 'name', 'sha256', 'size', 'files']);
+    object(artifact, ['id', 'name', 'sha256', 'size', 'files', ...(value.format === 'tspack.release.v2' ? ['kind'] : [])]);
+    requireValue(!Object.hasOwn(artifact, 'kind') || artifact.kind === 'file', 'invalid_manifest', 'Invalid artifact kind.');
+    const standalone = artifact.kind === 'file';
     requireValue(isName(artifact.id) && !ids.has(artifact.id) &&
-      isPath(artifact.name) && artifact.name === `${value.name}-${value.version}-${artifact.id}.tar.gz` && !names.has(artifact.name) &&
+      isPath(artifact.name) && (standalone ? isAssetName(artifact.name) : artifact.name === `${value.name}-${value.version}-${artifact.id}.tar.gz`) &&
+      !names.has(artifact.name.toLowerCase()) &&
       isDigest(artifact.sha256) && typeof artifact.size === 'number' && Number.isSafeInteger(artifact.size) &&
-      artifact.size > 0 && artifact.size <= limits.total, 'invalid_manifest', 'Invalid archive identity.');
-    ids.add(artifact.id); names.add(artifact.name);
+      (standalone ? artifact.size >= 0 && artifact.size <= limits.file : artifact.size > 0 && artifact.size <= limits.total),
+    'invalid_manifest', 'Invalid artifact identity.');
+    ids.add(artifact.id); names.add(artifact.name.toLowerCase());
     object(artifact.files);
-    requireValue(Object.hasOwn(artifact.files, 'tspack.json') && Object.keys(artifact.files).length > 1,
+    const fileRecords = artifact.files;
+    const paths = Object.keys(fileRecords);
+    if (standalone) {
+      standaloneCount++;
+      requireValue(paths.length === 1 && paths[0] === artifact.name, 'invalid_manifest', 'A standalone asset requires its exact file record.');
+      const record = fileRecords[artifact.name];
+      validateFileRecord(record);
+      requireValue(record.sha256 === artifact.sha256 && record.size === artifact.size, 'invalid_manifest', 'Standalone file identities disagree.');
+      total += record.size; count++;
+      continue;
+    }
+    requireValue(Object.hasOwn(artifact.files, 'tspack.json') && paths.length > 1,
       'invalid_manifest', 'Bundle metadata or selected files are missing.');
+    requireValue(paths.every((name) => name.split('/').slice(0, -1).every((_part, index, parents) =>
+      !Object.hasOwn(fileRecords, parents.slice(0, index + 1).join('/')))),
+    'invalid_manifest', 'Archive member paths collide.');
     for (const [name, record] of Object.entries(artifact.files)) {
       requireValue(isPath(name), 'invalid_manifest', 'Invalid archive member path.');
       validateFileRecord(record);
       total += record.size; count++;
     }
   }
+  requireValue(value.format === 'tspack.release.v1' || standaloneCount > 0, 'invalid_manifest', 'Manifest v2 requires a standalone asset.');
   requireValue(total <= limits.total && count <= limits.files + 128, 'invalid_manifest', 'Artifact set exceeds its limits.');
 }
 

package/readme.plan.md

@@ -1,26 +0,0 @@
-# tspack implementation
-
-Create the shared owner for packaging existing executables and supporting assets.
-TsDeno and TsRust retain compilation; GitZone and CI retain publication. Pallet
-will consume the published tool instead of maintaining its own archive scripts.
-
-- Expose a typed TsPack API and `tspack pack` / `tspack verify` CLI, configured
-  under `@git.zone/tspack` in `.smartconfig.json`.
-- Package explicit file sets into deterministic streaming tar.gz bundles using
-  SmartArchive's public streaming API. Preserve executable roles, hash every file,
-  reject unsafe paths and changed inputs, and publish output directories atomically.
-- Record package/version, Git source identity, configuration identity, bundle
-  contents and archive hashes in a sealed artifact set. Release mode requires a
-  clean matching tag; development artifacts remain explicitly unpublishable.
-- Verify both archive bytes and every declared member without extracting paths.
-  Reuse a retained sealed release set only after verification; never substitute
-  freshly rebuilt bytes into an existing immutable release.
-- Include only explicitly selected assets/notices. Do not automatically disclose
-  application source, vendor dependency trees or rebuild runtimes for LGPL.
-- Test real archives, deterministic repacking, corruption, unsafe paths, closed
-  file sets, stale/dirty release identities and retained-output reuse. Build and
-  type-check directly, run stable checker gates, release the tool, then consume it.
-
-Global policy now accepts LGPL; its specific obligations remain separate from
-license acceptance. The previous Pallet runtime-reconstruction experiment was
-stopped and its uncommitted distribution prototype removed from active source.