@git.zone/tspack 1.1.0

package/dist_ts/validation.js

@@ -0,0 +1,132 @@
+import * as plugins from './plugins.js';
+export const limits = { file: 2 * 1024 ** 3, total: 8 * 1024 ** 3, files: 10_000, json: 16 * 1024 ** 2 };
+export class TsPackError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'TsPackError';
+    }
+}
+export function requireValue(value, code, message) {
+    if (!value)
+        throw new TsPackError(code, message);
+}
+export const sha256 = (value) => plugins.crypto.createHash('sha256').update(value).digest('hex');
+export const isDigest = (value) => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+export const isCommit = (value) => typeof value === 'string' && /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(value);
+export const isName = (value) => typeof value === 'string' && /^[a-z0-9][a-z0-9._-]{0,99}$/.test(value);
+export const isVersion = (value) => typeof value === 'string' && value.length <= 64 && /^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(value);
+export const isPath = (value) => typeof value === 'string' && value.length <= 240 &&
+    /^[a-zA-Z0-9@_+./-]+$/.test(value) && !value.startsWith('/') && value.split('/').every((part) => part && part !== '.' && part !== '..');
+export const jsonBytes = (value) => Buffer.from(JSON.stringify(value, null, 2) + '\n');
+export function object(value, allowed) {
+    requireValue(value && typeof value === 'object' && !Array.isArray(value) && !plugins.util.types.isProxy(value) &&
+        [Object.prototype, null].includes(Object.getPrototypeOf(value)), 'invalid_config', 'Expected a plain record.');
+    requireValue(Reflect.ownKeys(value).every((key) => typeof key === 'string' &&
+        (!allowed || allowed.includes(key)) && Object.getOwnPropertyDescriptor(value, key)?.enumerable &&
+        'value' in Object.getOwnPropertyDescriptor(value, key)), 'invalid_config', 'Unexpected record property.');
+}
+export function normalizeConfig(value, packageName) {
+    object(value, ['schemaVersion', 'name', 'outputDirectory', 'bundles']);
+    const name = value.name ?? packageName.replace(/^@/, '').replace('/', '-');
+    const outputDirectory = value.outputDirectory ?? 'dist_pack';
+    requireValue(value.schemaVersion === 1 && isName(name) && isPath(outputDirectory) &&
+        Array.isArray(value.bundles) && value.bundles.length > 0 && value.bundles.length <= 128, 'invalid_config', 'Invalid tspack configuration.');
+    let count = 0;
+    const bundles = value.bundles.map((bundle) => {
+        object(bundle, ['id', 'files']);
+        requireValue(isName(bundle.id) && Array.isArray(bundle.files) && bundle.files.length > 0, 'invalid_config', 'A bundle requires an identifier and explicit files.');
+        const files = bundle.files.map((file) => {
+            object(file, ['source', 'path', 'executable', 'sha256']);
+            requireValue(isPath(file.source) && isPath(file.path) && file.path !== 'tspack.json' && !file.path.startsWith('tspack.json/') &&
+                (!Object.hasOwn(file, 'executable') || typeof file.executable === 'boolean') &&
+                (!Object.hasOwn(file, 'sha256') || isDigest(file.sha256)), 'invalid_config', 'Invalid bundle file.');
+            return { source: file.source, path: file.path, executable: file.executable === true,
+                ...(file.sha256 ? { sha256: file.sha256 } : {}) };
+        }).sort((a, b) => a.path.localeCompare(b.path, 'en'));
+        count += files.length;
+        requireValue(new Set(files.map((file) => file.path)).size === files.length &&
+            files.every((file) => !files.some((other) => other.path.startsWith(file.path + '/'))), 'invalid_config', 'Bundle paths collide.');
+        return { id: bundle.id, files };
+    }).sort((a, b) => a.id.localeCompare(b.id, 'en'));
+    requireValue(count <= limits.files && new Set(bundles.map((bundle) => bundle.id)).size === bundles.length, 'invalid_config', 'Too many files or duplicate bundle identifiers.');
+    return { schemaVersion: 1, name, outputDirectory, bundles };
+}
+export function validateFileRecord(value) {
+    object(value, ['sha256', 'size', 'mode']);
+    requireValue(isDigest(value.sha256) && typeof value.size === 'number' && Number.isSafeInteger(value.size) &&
+        value.size >= 0 && value.size <= limits.file && (value.mode === 0o644 || value.mode === 0o755), 'invalid_manifest', 'Invalid file identity.');
+}
+export function validateManifest(value) {
+    object(value, ['format', 'packageName', 'name', 'version', 'sourceCommit', 'sourceDirty', 'publishable', 'configurationSha256', 'artifacts']);
+    requireValue(value.format === 'tspack.release.v1' && typeof value.packageName === 'string' && value.packageName.length <= 214 &&
+        isName(value.name) && isVersion(value.version) && isCommit(value.sourceCommit) &&
+        typeof value.sourceDirty === 'boolean' && typeof value.publishable === 'boolean' &&
+        (!value.publishable || !value.sourceDirty) && isDigest(value.configurationSha256) &&
+        Array.isArray(value.artifacts) && value.artifacts.length > 0 && value.artifacts.length <= 128, 'invalid_manifest', 'Invalid artifact-set manifest.');
+    const ids = new Set();
+    const names = new Set();
+    let total = 0;
+    let count = 0;
+    for (const artifact of value.artifacts) {
+        object(artifact, ['id', 'name', 'sha256', 'size', 'files']);
+        requireValue(isName(artifact.id) && !ids.has(artifact.id) &&
+            isPath(artifact.name) && artifact.name === `${value.name}-${value.version}-${artifact.id}.tar.gz` && !names.has(artifact.name) &&
+            isDigest(artifact.sha256) && typeof artifact.size === 'number' && Number.isSafeInteger(artifact.size) &&
+            artifact.size > 0 && artifact.size <= limits.total, 'invalid_manifest', 'Invalid archive identity.');
+        ids.add(artifact.id);
+        names.add(artifact.name);
+        object(artifact.files);
+        requireValue(Object.hasOwn(artifact.files, 'tspack.json') && Object.keys(artifact.files).length > 1, 'invalid_manifest', 'Bundle metadata or selected files are missing.');
+        for (const [name, record] of Object.entries(artifact.files)) {
+            requireValue(isPath(name), 'invalid_manifest', 'Invalid archive member path.');
+            validateFileRecord(record);
+            total += record.size;
+            count++;
+        }
+    }
+    requireValue(total <= limits.total && count <= limits.files + 128, 'invalid_manifest', 'Artifact set exceeds its limits.');
+}
+export async function noSymlinks(root, relative, allowMissing = false) {
+    requireValue(isPath(relative), 'unsafe_input', 'A canonical project-relative path is required.');
+    let current = root;
+    for (const part of relative.split('/')) {
+        current = plugins.path.join(current, part);
+        try {
+            requireValue(!(await plugins.fs.lstat(current)).isSymbolicLink(), 'unsafe_input', 'Symlink paths are not package inputs or outputs.');
+        }
+        catch (error) {
+            if (allowMissing && error.code === 'ENOENT')
+                break;
+            throw error;
+        }
+    }
+    return plugins.path.join(root, relative);
+}
+export async function readJson(file) {
+    const stat = await plugins.fs.lstat(file);
+    requireValue(stat.isFile() && stat.size <= limits.json, 'invalid_manifest', 'Expected bounded regular JSON metadata.');
+    const bytes = await plugins.fs.readFile(file);
+    requireValue(bytes.length <= limits.json, 'invalid_manifest', 'JSON metadata exceeds its limit.');
+    try {
+        return { value: JSON.parse(bytes.toString('utf8')), bytes };
+    }
+    catch {
+        throw new TsPackError('invalid_manifest', 'Invalid JSON metadata.');
+    }
+}
+export async function digestFile(file) {
+    const stat = await plugins.fs.lstat(file);
+    requireValue(stat.isFile() && stat.size <= limits.total, 'integrity', 'Expected a bounded regular artifact file.');
+    const hash = plugins.crypto.createHash('sha256');
+    let size = 0;
+    for await (const chunk of plugins.nodeFs.createReadStream(file)) {
+        size += chunk.length;
+        requireValue(size <= stat.size, 'integrity', 'Artifact changed while reading.');
+        hash.update(chunk);
+    }
+    requireValue(size === stat.size, 'integrity', 'Artifact size changed while reading.');
+    return { sha256: hash.digest('hex'), size };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3ZhbGlkYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFHeEMsTUFBTSxDQUFDLE1BQU0sTUFBTSxHQUFHLEVBQUUsSUFBSSxFQUFFLENBQUMsR0FBRyxJQUFJLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxFQUFFLEdBQUcsSUFBSSxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQ3pHLE1BQU0sT0FBTyxXQUFZLFNBQVEsS0FBSztJQUNSO0lBQTVCLFlBQTRCLElBQVksRUFBRSxPQUFlO1FBQ3ZELEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQURXLFNBQUksR0FBSixJQUFJLENBQVE7UUFFdEMsSUFBSSxDQUFDLElBQUksR0FBRyxhQUFhLENBQUM7SUFDNUIsQ0FBQztDQUNGO0FBQ0QsTUFBTSxVQUFVLFlBQVksQ0FBQyxLQUFjLEVBQUUsSUFBWSxFQUFFLE9BQWU7SUFDeEUsSUFBSSxDQUFDLEtBQUs7UUFBRSxNQUFNLElBQUksV0FBVyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQztBQUNuRCxDQUFDO0FBQ0QsTUFBTSxDQUFDLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBc0IsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNsSCxNQUFNLENBQUMsTUFBTSxRQUFRLEdBQUcsQ0FBQyxLQUFjLEVBQW1CLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQ3ZILE1BQU0sQ0FBQyxNQUFNLFFBQVEsR0FBRyxDQUFDLEtBQWMsRUFBbUIsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDeEksTUFBTSxDQUFDLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLDZCQUE2QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNsSSxNQUFNLENBQUMsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQW1CLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxFQUFFLElBQUkscUNBQXFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQ25LLE1BQU0sQ0FBQyxNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBbUIsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxJQUFJLEdBQUc7SUFDekcsc0JBQXNCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxJQUFJLElBQUksS0FBSyxHQUFHLElBQUksSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDO0FBQzFJLE1BQU0sQ0FBQyxNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUM7QUFFaEcsTUFBTSxVQUFVLE1BQU0sQ0FBQyxLQUFjLEVBQUUsT0FBMkI7SUFDaEUsWUFBWSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztRQUM1RyxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDO0lBQ2pILFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUTtRQUN4RSxDQUFDLENBQUMsT0FBTyxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxFQUFFLFVBQVU7UUFDOUYsT0FBTyxJQUFJLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFFLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSw2QkFBNkIsQ0FBQyxDQUFDO0FBQy9HLENBQUM7QUFFRCxNQUFNLFVBQVUsZUFBZSxDQUFDLEtBQWMsRUFBRSxXQUFtQjtJQUNqRSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsZUFBZSxFQUFFLE1BQU0sRUFBRSxpQkFBaUIsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3ZFLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxJQUFJLElBQUksV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQztJQUMzRSxNQUFNLGVBQWUsR0FBRyxLQUFLLENBQUMsZUFBZSxJQUFJLFdBQVcsQ0FBQztJQUM3RCxZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxlQUFlLENBQUM7UUFDL0UsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLEdBQUcsRUFDekYsZ0JBQWdCLEVBQUUsK0JBQStCLENBQUMsQ0FBQztJQUNuRCxJQUFJLEtBQUssR0FBRyxDQUFDLENBQUM7SUFDZCxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQWUsRUFBRSxFQUFFO1FBQ3BELE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUNoQyxZQUFZLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQ3RGLGdCQUFnQixFQUFFLHFEQUFxRCxDQUFDLENBQUM7UUFDM0UsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFhLEVBQUUsRUFBRTtZQUMvQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUN6RCxZQUFZLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssYUFBYSxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDO2dCQUMzSCxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsWUFBWSxDQUFDLElBQUksT0FBTyxJQUFJLENBQUMsVUFBVSxLQUFLLFNBQVMsQ0FBQztnQkFDNUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxzQkFBc0IsQ0FBQyxDQUFDO1lBQ3ZHLE9BQU8sRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVUsS0FBSyxJQUFJO2dCQUNqRixHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQWdCLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUNoRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDdEQsS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDdEIsWUFBWSxDQUFDLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsTUFBTTtZQUN4RSxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUN2RixnQkFBZ0IsRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO1FBQzNDLE9BQU8sRUFBRSxFQUFFLEVBQUUsTUFBTSxDQUFDLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUNsQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDbEQsWUFBWSxDQUFDLEtBQUssSUFBSSxNQUFNLENBQUMsS0FBSyxJQUFJLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsTUFBTSxFQUN2RyxnQkFBZ0IsRUFBRSxpREFBaUQsQ0FBQyxDQUFDO0lBQ3ZFLE9BQU8sRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLElBQUksRUFBRSxlQUFlLEVBQUUsT0FBTyxFQUFFLENBQUM7QUFDOUQsQ0FBQztBQUVELE1BQU0sVUFBVSxrQkFBa0IsQ0FBQyxLQUFjO0lBQy9DLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDMUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLElBQUksT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7UUFDdkcsS0FBSyxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksS0FBSyxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsRUFDaEcsa0JBQWtCLEVBQUUsd0JBQXdCLENBQUMsQ0FBQztBQUNoRCxDQUFDO0FBRUQsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEtBQWM7SUFDN0MsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFFBQVEsRUFBRSxhQUFhLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxxQkFBcUIsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzlJLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLG1CQUFtQixJQUFJLE9BQU8sS0FBSyxDQUFDLFdBQVcsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFNLElBQUksR0FBRztRQUMzSCxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLFNBQVMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksUUFBUSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUM7UUFDOUUsT0FBTyxLQUFLLENBQUMsV0FBVyxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssQ0FBQyxXQUFXLEtBQUssU0FBUztRQUNoRixDQUFDLENBQUMsS0FBSyxDQUFDLFdBQVcsSUFBSSxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLG1CQUFtQixDQUFDO1FBQ2pGLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxLQUFLLENBQUMsU0FBUyxDQUFDLE1BQU0sSUFBSSxHQUFHLEVBQy9GLGtCQUFrQixFQUFFLGdDQUFnQyxDQUFDLENBQUM7SUFDdEQsTUFBTSxHQUFHLEdBQUcsSUFBSSxHQUFHLEVBQUUsQ0FBQztJQUN0QixNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBRSxDQUFDO0lBQ3hCLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLEtBQUssTUFBTSxRQUFRLElBQUksS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUM1RCxZQUFZLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUN2RCxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssR0FBRyxLQUFLLENBQUMsSUFBSSxJQUFJLEtBQUssQ0FBQyxPQUFPLElBQUksUUFBUSxDQUFDLEVBQUUsU0FBUyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO1lBQzlILFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUM7WUFDckcsUUFBUSxDQUFDLElBQUksR0FBRyxDQUFDLElBQUksUUFBUSxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsS0FBSyxFQUFFLGtCQUFrQixFQUFFLDJCQUEyQixDQUFDLENBQUM7UUFDdkcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7UUFBQyxLQUFLLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMvQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZCLFlBQVksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsYUFBYSxDQUFDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsRUFDakcsa0JBQWtCLEVBQUUsZ0RBQWdELENBQUMsQ0FBQztRQUN4RSxLQUFLLE1BQU0sQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM1RCxZQUFZLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLGtCQUFrQixFQUFFLDhCQUE4QixDQUFDLENBQUM7WUFDL0Usa0JBQWtCLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDM0IsS0FBSyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUM7WUFBQyxLQUFLLEVBQUUsQ0FBQztRQUNoQyxDQUFDO0lBQ0gsQ0FBQztJQUNELFlBQVksQ0FBQyxLQUFLLElBQUksTUFBTSxDQUFDLEtBQUssSUFBSSxLQUFLLElBQUksTUFBTSxDQUFDLEtBQUssR0FBRyxHQUFHLEVBQUUsa0JBQWtCLEVBQUUsa0NBQWtDLENBQUMsQ0FBQztBQUM3SCxDQUFDO0FBRUQsTUFBTSxDQUFDLEtBQUssVUFBVSxVQUFVLENBQUMsSUFBWSxFQUFFLFFBQWdCLEVBQUUsWUFBWSxHQUFHLEtBQUs7SUFDbkYsWUFBWSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsRUFBRSxjQUFjLEVBQUUsZ0RBQWdELENBQUMsQ0FBQztJQUNqRyxJQUFJLE9BQU8sR0FBRyxJQUFJLENBQUM7SUFDbkIsS0FBSyxNQUFNLElBQUksSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdkMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQztRQUMzQyxJQUFJLENBQUM7WUFDSCxZQUFZLENBQUMsQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxjQUFjLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0RBQWtELENBQUMsQ0FBQztRQUN4SSxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksWUFBWSxJQUFLLEtBQStCLENBQUMsSUFBSSxLQUFLLFFBQVE7Z0JBQUUsTUFBTTtZQUM5RSxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUM7QUFDM0MsQ0FBQztBQUVELE1BQU0sQ0FBQyxLQUFLLFVBQVUsUUFBUSxDQUFDLElBQVk7SUFDekMsTUFBTSxJQUFJLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUMxQyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLElBQUksQ0FBQyxJQUFJLElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxrQkFBa0IsRUFBRSx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ3ZILE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDOUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxrQkFBa0IsRUFBRSxrQ0FBa0MsQ0FBQyxDQUFDO0lBQ2xHLElBQUksQ0FBQztRQUFDLE9BQU8sRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQ3BFLE1BQU0sQ0FBQztRQUFDLE1BQU0sSUFBSSxXQUFXLENBQUMsa0JBQWtCLEVBQUUsd0JBQXdCLENBQUMsQ0FBQztJQUFDLENBQUM7QUFDaEYsQ0FBQztBQUVELE1BQU0sQ0FBQyxLQUFLLFVBQVUsVUFBVSxDQUFDLElBQVk7SUFDM0MsTUFBTSxJQUFJLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUMxQyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLElBQUksQ0FBQyxJQUFJLElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxXQUFXLEVBQUUsMkNBQTJDLENBQUMsQ0FBQztJQUNuSCxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNqRCxJQUFJLElBQUksR0FBRyxDQUFDLENBQUM7SUFDYixJQUFJLEtBQUssRUFBRSxNQUFNLEtBQUssSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDaEUsSUFBSSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDckIsWUFBWSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsSUFBSSxFQUFFLFdBQVcsRUFBRSxpQ0FBaUMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDckIsQ0FBQztJQUNELFlBQVksQ0FBQyxJQUFJLEtBQUssSUFBSSxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUUsc0NBQXNDLENBQUMsQ0FBQztJQUN0RixPQUFPLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFDOUMsQ0FBQyJ9

package/license.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Task Venture Capital GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@git.zone/tspack",
+  "version": "1.1.0",
+  "description": "Verified executable and asset bundles for GitZone projects.",
+  "type": "module",
+  "main": "dist_ts/index.js",
+  "typings": "dist_ts/index.d.ts",
+  "exports": {
+    ".": "./dist_ts/index.js"
+  },
+  "bin": {
+    "tspack": "./cli.js"
+  },
+  "dependencies": {
+    "@push.rocks/smartarchive": "5.3.0",
+    "@push.rocks/smartconfig": "6.2.2"
+  },
+  "devDependencies": {
+    "@git.zone/tsbuild": "4.4.2",
+    "@git.zone/tsrun": "2.0.6",
+    "@git.zone/tstest": "4.0.0",
+    "@types/node": "26.4.0"
+  },
+  "files": [
+    "ts/**/*",
+    "dist_ts/**/*",
+    "cli.js",
+    ".smartconfig.json",
+    "readme.md",
+    "license.md"
+  ],
+  "author": "Task Venture Capital GmbH",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://code.foss.global/git.zone/tspack.git"
+  },
+  "homepage": "https://code.foss.global/git.zone/tspack",
+  "bugs": {
+    "url": "https://community.foss.global/"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsbuild tsfolders",
+    "test": "tstest test/ --verbose --logfile --timeout 60"
+  }
+}

package/readme.md

@@ -0,0 +1,181 @@
+# @git.zone/tspack
+
+TsPack packages compiled executables and supporting assets into verified tar.gz
+bundles. It records each file's digest and executable role, seals the complete
+artifact set, and verifies archive contents without extracting filesystem paths.
+TsDeno and TsRust own compilation; GitZone and CI own publication.
+
+## Issue Reporting and Security
+
+For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
+
+## Install and configure
+
+Use Node.js 22 or newer in a Git project with a committed `package.json`:
+
+```sh
+pnpm install --save-dev @git.zone/tspack
+```
+
+Add the explicit bundle contents to `.smartconfig.json`. Input files must already
+exist. Add `dist_pack/` to the project's `.gitignore`.
+
+```json
+{
+  "@git.zone/tspack": {
+    "schemaVersion": 1,
+    "name": "example-control",
+    "bundles": [
+      {
+        "id": "linux-amd64",
+        "files": [
+          { "source": "dist_binary/control", "path": "control", "executable": true },
+          { "source": "dist_binary/engine", "path": "engine", "executable": true },
+          { "source": "license.md", "path": "license.md" },
+          { "source": "notices/runtime.txt", "path": "third-party-notices.txt" }
+        ]
+      }
+    ]
+  }
+}
+```
+
+`name` defaults to the package name with its scope separator replaced by a hyphen.
+`outputDirectory` defaults to `dist_pack`. Both are project-relative configuration;
+input and archive paths must be canonical relative paths. A file may specify
+`sha256` to require an upstream digest. Files are mode 0644 unless `executable`
+is true, which records mode 0755. Inputs and their ancestors cannot be symlinks.
+
+There is no implicit directory sweep. Select notices, provenance and source
+materials explicitly according to the component's distribution requirements.
+TsPack does not automatically publish application source, vendor dependencies,
+rebuild runtimes or reject accepted licenses such as LGPL.
+
+## Package and verify
+
+```sh
+# Development artifacts are explicitly marked unpublishable.
+pnpm exec tspack pack
+
+# Release builds require clean Git source at v<package.json version>.
+pnpm exec tspack pack --release
+
+# An alternate JSON file contains the tspack configuration block directly.
+pnpm exec tspack pack --release --config dist_binary/pack-inputs.json
+
+# Verify the complete retained artifact set against a trusted manifest digest.
+pnpm exec tspack verify dist_pack/example-control-1.2.3-COMMITPREFIX \
+  --release --sha256 MANIFEST_SHA256
+```
+
+Commands return one JSON result with the output directory, manifest digest,
+publishable state, reuse state and bundle count. Invalid arguments or failed
+verification return a nonzero exit code.
+
+Each artifact directory contains:
+
+- One `NAME-VERSION-BUNDLE.tar.gz` per configured bundle.
+- `tspack-manifest.json`: package, source, configuration, archive and file identities.
+- `SHA256SUMS.txt`: digests of the manifest and every archive.
+
+Each bundle includes its selected files plus `tspack.json`, which binds the same
+source/configuration identity and selected file records. `tspack.json` is reserved.
+Verification rejects extra or missing assets, duplicate or undeclared archive
+members, links, unexpected modes, changed metadata and digest mismatches. Archive
+verification never writes member paths to disk.
+
+Files are copied into private staging while their bytes and source file identity
+are checked. Archives use sorted members, fixed timestamps and ownership, explicit
+modes and streaming compression. The output directory is published only after the
+whole set verifies. Identical inputs produce identical bytes with the same
+packaging/compression toolchain; this does not claim the compilers themselves are
+reproducible. Failed packaging removes only its own temporary staging directory.
+
+Limits are 2 GiB per selected file, 8 GiB total uncompressed content, 10,000 selected
+files, 128 bundles, and 16 MiB for JSON metadata. Paths are portable ASCII relative
+names up to 240 characters. The source checkout, selected build tools and local
+filesystem are trusted; these checks do not sandbox malicious project code or a
+concurrent privileged writer. A checksum establishes content identity. Obtain the
+expected manifest digest through a trusted release channel to authenticate it.
+
+## Retain release bytes for retries
+
+Store the entire sealed artifact directory using the CI provider's artifact
+storage **before** publishing any release asset. A retry must restore that exact
+directory and verify it before deciding whether compilation is necessary:
+
+```sh
+pnpm exec tspack pack --release --reuse
+```
+
+If a retained set exists, this command verifies its complete contents and requires
+the same clean tagged source, package/version and configuration. It returns the
+original artifacts even if ignored compiler outputs have since changed. If no
+set exists, it packages the current inputs. A corrupt or mismatched retained set
+fails; it is never silently replaced. Ordinary packaging also refuses an occupied
+output directory. `--reuse` is available only in release mode.
+
+TsPack does not provide remote artifact storage. A workflow must retain and restore
+the directory; rebuilding after losing it cannot reproduce a nondeterministic
+compiler's original bytes. Published assets remain immutable.
+
+## TypeScript API
+
+```typescript
+import { TsPack, type ITsPackConfig } from '@git.zone/tspack';
+
+const packer = new TsPack('/absolute/project');
+const config: ITsPackConfig = {
+  schemaVersion: 1,
+  bundles: [{
+    id: 'linux-amd64',
+    files: [{ source: 'dist_binary/app', path: 'app', executable: true }]
+  }]
+};
+
+const result = await packer.pack(config, { release: true, reuse: true });
+await packer.verify(result.directory, {
+  expectedManifestSha256: result.manifestSha256,
+  expectedSourceCommit: result.manifest.sourceCommit,
+  requireRelease: true
+});
+```
+
+Omit the configuration argument to load `.smartconfig.json`. `TsPackError.code`
+identifies configuration, source, input, archive, integrity or occupied-output
+failures. Unexpected filesystem or Git errors remain ordinary errors at the API
+boundary; the CLI reports them without dumping file contents.
+
+## Development
+
+```sh
+pnpm install
+pnpm build
+pnpm test
+pnpm exec tsbuild check 'test/**/*'
+```
+
+Tests use disposable Git repositories and real archives. The independent archive
+interoperability check requires the system `tar` executable. Tests neither publish
+releases nor operate on production installations.
+
+## License and Legal Information
+
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the repository [license file](./license.md).
+
+**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
+
+### Trademarks
+
+This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.
+
+Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.
+
+### Company Information
+
+Task Venture Capital GmbH<br>
+Registered at District Court Bremen HRB 35230 HB, Germany
+
+For any legal inquiries or further information, please contact us via email at hello@task.vc.
+
+By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.

package/readme.plan.md

@@ -0,0 +1,26 @@
+# tspack implementation
+
+Create the shared owner for packaging existing executables and supporting assets.
+TsDeno and TsRust retain compilation; GitZone and CI retain publication. Pallet
+will consume the published tool instead of maintaining its own archive scripts.
+
+- Expose a typed TsPack API and `tspack pack` / `tspack verify` CLI, configured
+  under `@git.zone/tspack` in `.smartconfig.json`.
+- Package explicit file sets into deterministic streaming tar.gz bundles using
+  SmartArchive's public streaming API. Preserve executable roles, hash every file,
+  reject unsafe paths and changed inputs, and publish output directories atomically.
+- Record package/version, Git source identity, configuration identity, bundle
+  contents and archive hashes in a sealed artifact set. Release mode requires a
+  clean matching tag; development artifacts remain explicitly unpublishable.
+- Verify both archive bytes and every declared member without extracting paths.
+  Reuse a retained sealed release set only after verification; never substitute
+  freshly rebuilt bytes into an existing immutable release.
+- Include only explicitly selected assets/notices. Do not automatically disclose
+  application source, vendor dependency trees or rebuild runtimes for LGPL.
+- Test real archives, deterministic repacking, corruption, unsafe paths, closed
+  file sets, stale/dirty release identities and retained-output reuse. Build and
+  type-check directly, run stable checker gates, release the tool, then consume it.
+
+Global policy now accepts LGPL; its specific obligations remain separate from
+license acceptance. The previous Pallet runtime-reconstruction experiment was
+stopped and its uncommitted distribution prototype removed from active source.

package/ts/00_commitinfo_data.ts

@@ -0,0 +1,8 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export const commitinfo = {
+  name: '@git.zone/tspack',
+  version: '1.1.0',
+  description: 'Verified executable and asset bundles for GitZone projects.'
+}

package/ts/archive.ts

@@ -0,0 +1,60 @@
+import * as plugins from './plugins.js';
+import type { ITsPackArtifact, ITsPackFileRecord } from './interfaces.js';
+import { limits, requireValue, TsPackError, sha256, jsonBytes } from './validation.js';
+
+export async function packArchive(directory: string, output: string, files: Record<string, ITsPackFileRecord>): Promise<void> {
+  const tar = new plugins.smartarchive.TarTools().getPackStream();
+  const written = plugins.streamPromises.pipeline(tar, plugins.zlib.createGzip({ level: 6 }),
+    plugins.nodeFs.createWriteStream(output, { flags: 'wx', mode: 0o644 }));
+  void written.catch(() => undefined);
+  try {
+    for (const name of Object.keys(files).sort()) {
+      const file = files[name]!;
+      const entry = tar.entry({ name, size: file.size, mode: file.mode, mtime: new Date(0), uid: 0, gid: 0, uname: '', gname: '' });
+      await plugins.streamPromises.pipeline(plugins.nodeFs.createReadStream(plugins.path.join(directory, name)), entry);
+    }
+    tar.finalize();
+    await written;
+  } catch (error) {
+    tar.destroy(error instanceof Error ? error : new Error('Archive creation failed.'));
+    await written.catch(() => undefined);
+    throw error;
+  }
+}
+
+export async function verifyArchive(file: string, artifact: ITsPackArtifact, expectedMetadata: unknown): Promise<void> {
+  const extract = new plugins.smartarchive.TarTools().getExtractStream();
+  const seen = new Set<string>();
+  extract.on('entry', (header, entry, next) => {
+    void (async () => {
+      const expected = Object.hasOwn(artifact.files, header.name) ? artifact.files[header.name] : undefined;
+      requireValue(header.type === 'file' && expected && !seen.has(header.name) && header.size === expected.size &&
+        header.mode === expected.mode, 'archive', 'Unexpected, duplicate or changed archive member.');
+      seen.add(header.name);
+      const hash = plugins.crypto.createHash('sha256');
+      const chunks: Buffer[] = [];
+      let bytes = 0;
+      for await (const chunk of entry) {
+        requireValue(Buffer.isBuffer(chunk), 'archive', 'Expected binary archive content.');
+        bytes += chunk.length;
+        requireValue(bytes <= expected.size, 'archive', 'Archive member exceeds its declared size.');
+        hash.update(chunk);
+        if (header.name === 'tspack.json') {
+          requireValue(bytes <= limits.json, 'archive', 'Bundle metadata exceeds its limit.');
+          chunks.push(chunk);
+        }
+      }
+      requireValue(bytes === expected.size && hash.digest('hex') === expected.sha256, 'integrity', 'Archive member integrity mismatch.');
+      if (header.name === 'tspack.json') {
+        requireValue(sha256(Buffer.concat(chunks)) === sha256(jsonBytes(expectedMetadata)), 'integrity', 'Bundle and artifact-set metadata disagree.');
+      }
+    })().then(() => next(), (error: unknown) => extract.destroy(error instanceof Error ? error : new Error('Archive verification failed.')));
+  });
+  try {
+    await plugins.streamPromises.pipeline(plugins.nodeFs.createReadStream(file), plugins.zlib.createGunzip(), extract);
+  } catch (error) {
+    if (error instanceof TsPackError) throw error;
+    throw new TsPackError('archive', 'Invalid or incomplete archive.');
+  }
+  requireValue(seen.size === Object.keys(artifact.files).length, 'archive', 'Archive members are missing.');
+}