@hasna/instructions 0.6.0 → 0.7.0

package/dist/chunks/package-manager-guard-x70xrwk2.js

@@ -0,0 +1,391 @@
+// @bun
+import"./index-bsan4c16.js";
+
+// src/lib/package-manager-guard.ts
+import { execFileSync } from "child_process";
+import { existsSync, lstatSync, readdirSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "path";
+var SKIP_DIRS = new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  ".next",
+  ".turbo",
+  ".cache"
+]);
+var LOCKFILE_NAMES = new Set([
+  "bun.lock",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "pnpm-lock.yaml",
+  "yarn.lock"
+]);
+var HOME_FILES = [
+  ".npmrc",
+  ".bunfig.toml",
+  "bunfig.toml",
+  ".bashrc",
+  ".bash_profile",
+  ".zshrc",
+  ".zprofile",
+  ".profile"
+];
+var TOKEN_VALUE_PATTERNS = [
+  { re: /npm_[A-Za-z0-9]{36,}/, rule: "literal-npm-token", detail: "literal npm token-like value" },
+  { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, rule: "literal-github-token", detail: "literal GitHub token-like value" },
+  { re: /sk[-]ant-[A-Za-z0-9\-_]{40,}/, rule: "literal-anthropic-key", detail: "literal Anthropic key-like value" },
+  { re: /sk-[A-Za-z0-9]{48,}/, rule: "literal-openai-key", detail: "literal OpenAI key-like value" },
+  { re: /AKIA[0-9A-Z]{16}/, rule: "literal-aws-access-key", detail: "literal AWS access-key-like value" },
+  { re: /xoxb-[0-9]+-[A-Za-z0-9-]+/, rule: "literal-slack-token", detail: "literal Slack token-like value" }
+];
+function scanPackageManagerSecrets(options = {}) {
+  const cwd = options.cwd ? resolve(options.cwd) : process.cwd();
+  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve(cwd, root));
+  const findings = [];
+  let scannedFiles = 0;
+  for (const root of roots) {
+    if (!existsSync(root))
+      continue;
+    const stat = lstatSync(root);
+    if (stat.isFile()) {
+      if (!shouldScanRepoFile(root))
+        continue;
+      const text = readTextFile(root);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname(root)));
+      continue;
+    }
+    if (!stat.isDirectory())
+      continue;
+    const tracked = trackedFiles(root);
+    for (const file of collectRepoFiles(root)) {
+      const rel = toPosix(relative(root, file));
+      const isTracked = tracked.has(rel);
+      const text = readTextFile(file);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(file, text, classifyRepoFile(file), isTracked, root));
+    }
+  }
+  if (options.includeHome) {
+    const home = homedir();
+    for (const name of HOME_FILES) {
+      const file = join(home, name);
+      if (!existsSync(file))
+        continue;
+      const text = readTextFile(file);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(file, text, classifyHomeFile(name), false, home));
+    }
+  }
+  findings.sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.rule.localeCompare(b.rule));
+  return {
+    clean: findings.length === 0,
+    scannedFiles,
+    scannedRoots: roots,
+    findings
+  };
+}
+function collectRepoFiles(root) {
+  const out = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name))
+          continue;
+        visit(join(dir, entry.name));
+        continue;
+      }
+      if (!entry.isFile())
+        continue;
+      const file = join(dir, entry.name);
+      if (shouldScanRepoFile(file))
+        out.push(file);
+    }
+  };
+  visit(root);
+  return out;
+}
+function shouldScanRepoFile(file) {
+  const name = basename(file);
+  return isNpmrcName(name) || isBunConfigName(name) || LOCKFILE_NAMES.has(name);
+}
+function classifyRepoFile(file) {
+  const name = basename(file);
+  if (isNpmrcName(name))
+    return "repo-npmrc";
+  if (isBunConfigName(name))
+    return "bun-config";
+  return "lockfile";
+}
+function classifyHomeFile(name) {
+  if (name === ".npmrc")
+    return "home-npmrc";
+  if (isBunConfigName(name))
+    return "bun-config";
+  return "shell-profile";
+}
+function isBunConfigName(name) {
+  return name === "bunfig.toml" || name === ".bunfig.toml";
+}
+function isNpmrcName(name) {
+  return name === ".npmrc" || name.startsWith(".npmrc.") || name.endsWith(".npmrc");
+}
+function readTextFile(file) {
+  try {
+    const stat = lstatSync(file);
+    if (!stat.isFile() || stat.size > 5000000)
+      return null;
+    const buf = readFileSync(file);
+    if (buf.includes(0))
+      return null;
+    return buf.toString("utf-8");
+  } catch {
+    return null;
+  }
+}
+function scanFile(file, text, surface, tracked, root) {
+  const findings = [];
+  const path = displayPath(file, root);
+  if (surface === "bun-config")
+    return scanBunConfigFile(text, path, tracked);
+  const lines = text.split(/\r?\n/);
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    if (surface === "repo-npmrc" || surface === "home-npmrc") {
+      findings.push(...scanNpmrcLine(line, path, lineNo, surface, tracked));
+    } else if (surface === "shell-profile") {
+      findings.push(...scanShellProfileLine(line, path, lineNo, tracked));
+    } else {
+      findings.push(...scanLockfileLine(line, path, lineNo, tracked));
+    }
+  }
+  return findings;
+}
+function scanNpmrcLine(lineText, path, line, surface, tracked) {
+  const findings = [];
+  const stripped = lineText.trim();
+  if (stripped === "" || stripped.startsWith("#") || stripped.startsWith(";"))
+    return findings;
+  const auth = stripped.match(/(?:^|:)(_[A-Za-z]*(?:auth|password)[A-Za-z]*|password)\s*=\s*(.+)$/i);
+  if (auth) {
+    const value = stripQuotes(stripInlineComment(auth[2].trim()));
+    if (value && !isSafeReference(value)) {
+      findings.push({
+        path,
+        line,
+        rule: "npmrc-literal-auth",
+        surface,
+        severity: "error",
+        tracked,
+        detail: tracked ? "tracked npm auth entry uses a literal value" : "npm auth entry uses a literal value"
+      });
+    }
+  }
+  findings.push(...scanCredentialedUrl(stripped, path, line, surface, tracked));
+  findings.push(...scanKnownTokenPatterns(stripped, path, line, surface, tracked));
+  return findings;
+}
+function scanBunConfigFile(text, path, tracked) {
+  const findings = [];
+  const lines = text.split(/\r?\n/);
+  let inReleaseAgeExcludes = false;
+  let hasMinimumReleaseAge = false;
+  for (let i = 0;i < lines.length; i++) {
+    const lineText = lines[i];
+    const line = i + 1;
+    const stripped = lineText.trim();
+    if (stripped === "" || stripped.startsWith("#"))
+      continue;
+    const releaseAge = stripped.match(/^minimumReleaseAge\s*=\s*(?:"([^"]+)"|'([^']+)'|([0-9]+))\s*(?:#.*)?$/i);
+    if (releaseAge) {
+      hasMinimumReleaseAge = true;
+      const rawValue = releaseAge[1] ?? releaseAge[2] ?? releaseAge[3] ?? "";
+      const value = Number(rawValue);
+      if (!Number.isFinite(value) || value <= 0) {
+        findings.push({
+          path,
+          line,
+          rule: "bun-release-age-disabled",
+          surface: "bun-config",
+          severity: "error",
+          tracked,
+          detail: "Bun release-age quarantine is disabled"
+        });
+      }
+    }
+    const startsReleaseAgeExcludes = /minimumReleaseAgeExcludes/i.test(stripped);
+    const scanExcludes = startsReleaseAgeExcludes || inReleaseAgeExcludes;
+    if (scanExcludes) {
+      const quoted = [...stripped.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]);
+      for (const item of quoted) {
+        if (!isExactHasnaPackageName(item)) {
+          findings.push({
+            path,
+            line,
+            rule: "bun-release-age-broad-exclude",
+            surface: "bun-config",
+            severity: "error",
+            tracked,
+            detail: "Bun release-age exclude must be an exact @hasna package name"
+          });
+        }
+      }
+    }
+    inReleaseAgeExcludes = startsReleaseAgeExcludes ? stripped.includes("[") && !stripped.includes("]") : inReleaseAgeExcludes && !stripped.includes("]");
+    findings.push(...scanKnownTokenPatterns(stripped, path, line, "bun-config", tracked));
+  }
+  if (!hasMinimumReleaseAge) {
+    findings.push({
+      path,
+      line: 1,
+      rule: "bun-release-age-missing",
+      surface: "bun-config",
+      severity: "error",
+      tracked,
+      detail: "Bun release-age quarantine must be configured with a positive minimumReleaseAge"
+    });
+  }
+  return findings;
+}
+function scanShellProfileLine(lineText, path, line, tracked) {
+  const findings = [];
+  const stripped = lineText.trim();
+  if (stripped === "" || stripped.startsWith("#"))
+    return findings;
+  const assignment = stripped.match(/^(?:export\s+)?(NPM(?:_CONFIG)?_[A-Z0-9_]*TOKEN|NODE_AUTH_TOKEN|NPM_TOKEN)\s*=\s*(.+)$/);
+  if (assignment) {
+    const value = stripQuotes(stripInlineComment(assignment[2].trim()));
+    if (value && !isSafeReference(value)) {
+      findings.push({
+        path,
+        line,
+        rule: "shell-literal-package-token",
+        surface: "shell-profile",
+        severity: "error",
+        tracked,
+        detail: "shell profile package-manager token uses a literal value"
+      });
+    }
+  }
+  findings.push(...scanKnownTokenPatterns(stripped, path, line, "shell-profile", tracked));
+  return findings;
+}
+function scanLockfileLine(lineText, path, line, tracked) {
+  const findings = scanKnownTokenPatterns(lineText, path, line, "lockfile", tracked);
+  if (/(?:^|:)_authToken\s*=\s*/i.test(lineText) && !/\$\{[A-Z0-9_]+\}|\{\{[A-Z0-9_]+\}\}/.test(lineText)) {
+    findings.push({
+      path,
+      line,
+      rule: "lockfile-auth-token",
+      surface: "lockfile",
+      severity: "error",
+      tracked,
+      detail: "lockfile contains package-manager auth token material"
+    });
+  }
+  return findings;
+}
+function scanKnownTokenPatterns(lineText, path, line, surface, tracked) {
+  const findings = [];
+  for (const pattern of TOKEN_VALUE_PATTERNS) {
+    if (pattern.re.test(lineText)) {
+      findings.push({
+        path,
+        line,
+        rule: pattern.rule,
+        surface,
+        severity: "error",
+        tracked,
+        detail: pattern.detail
+      });
+    }
+  }
+  return findings;
+}
+function scanCredentialedUrl(lineText, path, line, surface, tracked) {
+  const findings = [];
+  for (const match of lineText.matchAll(/\bhttps?:\/\/([^/\s#;]+)@/gi)) {
+    const userInfo = match[1];
+    const credentialPart = userInfo.includes(":") ? userInfo.split(":").slice(1).join(":") : userInfo;
+    if (credentialPart && !isSafeReference(credentialPart)) {
+      findings.push({
+        path,
+        line,
+        rule: "package-manager-url-credentials",
+        surface,
+        severity: "error",
+        tracked,
+        detail: "package-manager URL embeds literal credentials"
+      });
+    }
+  }
+  return findings;
+}
+function trackedFiles(root) {
+  try {
+    const output = execFileSync("git", ["-C", root, "ls-files", "-z"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return new Set(output.split("\x00").filter(Boolean).map(toPosix));
+  } catch {
+    return new Set;
+  }
+}
+function isTrackedFile(file) {
+  try {
+    const repoRoot = execFileSync("git", ["-C", dirname(file), "rev-parse", "--show-toplevel"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const rel = toPosix(relative(repoRoot, file));
+    execFileSync("git", ["-C", repoRoot, "ls-files", "--error-unmatch", "--", rel], {
+      stdio: ["ignore", "ignore", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isExactHasnaPackageName(item) {
+  return /^@hasna\/[a-z0-9][a-z0-9._-]*$/.test(item);
+}
+function isSafeReference(value) {
+  const trimmed = stripQuotes(value.trim());
+  return /^\$\{[A-Z][A-Z0-9_]*\}$/.test(trimmed) || /^\$[A-Z][A-Z0-9_]*$/.test(trimmed) || /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(trimmed) || /^%[A-Z][A-Z0-9_]*%$/.test(trimmed);
+}
+function stripQuotes(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function stripInlineComment(value) {
+  return value.replace(/\s[#;].*$/, "").trim();
+}
+function displayPath(file, root) {
+  const home = homedir();
+  if (root === home && (file === home || file.startsWith(home + "/")))
+    return "~/" + toPosix(relative(home, file));
+  if (isAbsolute(root) && file.startsWith(root + "/"))
+    return toPosix(relative(root, file));
+  if (file === home || file.startsWith(home + "/"))
+    return "~/" + toPosix(relative(home, file));
+  return file;
+}
+function toPosix(path) {
+  return path.split("\\").join("/");
+}
+export {
+  scanPackageManagerSecrets
+};

package/dist/chunks/redact-hnq4sc4r.js

@@ -0,0 +1,16 @@
+// @bun
+import {
+  hasSecrets,
+  isSecretVarName,
+  redactContent,
+  redactFormatForTarget,
+  scanSecrets
+} from "./index-35z65jsa.js";
+import"./index-nnwp92tk.js";
+export {
+  scanSecrets,
+  redactFormatForTarget,
+  redactContent,
+  isSecretVarName,
+  hasSecrets
+};

package/dist/chunks/s3-backup-n2z4fwyh.js

@@ -0,0 +1,240 @@
+// @bun
+import {
+  assertSafeInstructionsObjectKey,
+  assertSafeInstructionsObjectVersionId
+} from "./index-arrrx0ed.js";
+import {
+  normalizeInstructionsS3Prefix
+} from "./index-8rb7ng2y.js";
+import"./index-bsan4c16.js";
+
+// src/storage/s3-backup.ts
+var INSTRUCTIONS_BACKUP_MANIFEST_SCHEMA = "hasna.instructions.backup-object/v1";
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
+var SHA256_PATTERN = /^[0-9a-f]{64}$/;
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+function buildInstructionsBackupKeys(prefix, backupId) {
+  const normalizedPrefix = normalizeInstructionsS3Prefix(prefix);
+  const encodedBackupId = encodeBackupId(backupId);
+  const rootKey = `${normalizedPrefix}backups/${encodedBackupId}`;
+  const keys = {
+    rootKey,
+    payloadKey: `${rootKey}/payload`,
+    manifestKey: `${rootKey}/manifest.json`
+  };
+  assertSafeInstructionsObjectKey(keys.payloadKey);
+  assertSafeInstructionsObjectKey(keys.manifestKey);
+  return keys;
+}
+async function planInstructionsBackupPush(input) {
+  const keys = buildInstructionsBackupKeys(input.prefix, input.backupId);
+  return {
+    operation: "push",
+    dryRun: true,
+    noNetwork: true,
+    backupId: input.backupId,
+    ...keys,
+    sha256: sha256(input.bytes),
+    sizeBytes: input.bytes.byteLength,
+    contentType: normalizeContentType(input.contentType)
+  };
+}
+async function pushInstructionsBackup(input) {
+  const plan = await planInstructionsBackupPush(input);
+  const existingManifestBytes = await input.store.get(plan.manifestKey);
+  if (existingManifestBytes) {
+    const existingManifest2 = parseManifest(existingManifestBytes, plan, input.backupId);
+    assertManifestMatchesPayload(existingManifest2, input.bytes);
+    const existingPayload2 = await input.store.get(existingManifest2.payloadKey);
+    if (!existingPayload2)
+      throw new Error("Instructions backup payload object is missing");
+    assertBytesMatch(existingPayload2, existingManifest2.sha256, existingManifest2.sizeBytes, "backup payload integrity");
+    return {
+      status: "existing",
+      manifest: existingManifest2,
+      ...await resolveCurrentVersions(input.store, existingManifest2)
+    };
+  }
+  const payloadCreate = await createImmutableObject(input.store, plan.payloadKey, input.bytes, plan.contentType);
+  if (payloadCreate.status === "existing") {
+    const existingPayload2 = await input.store.get(plan.payloadKey);
+    if (!existingPayload2)
+      throw new Error("Instructions backup payload object is missing");
+    assertBytesMatch(existingPayload2, plan.sha256, plan.sizeBytes, "existing immutable payload");
+  }
+  const manifest = {
+    schema: INSTRUCTIONS_BACKUP_MANIFEST_SCHEMA,
+    app: "instructions",
+    backupId: input.backupId,
+    payloadKey: plan.payloadKey,
+    manifestKey: plan.manifestKey,
+    sha256: plan.sha256,
+    sizeBytes: plan.sizeBytes,
+    contentType: plan.contentType,
+    createdAt: normalizeCreatedAt(input.createdAt)
+  };
+  const manifestCreate = await createImmutableObject(input.store, plan.manifestKey, serializeManifest(manifest), "application/json");
+  if (manifestCreate.status === "created") {
+    const versions = completeCreatedVersions(payloadCreate, manifestCreate);
+    return { status: "created", manifest, ...versions ? { versions } : {} };
+  }
+  const racedManifestBytes = await input.store.get(plan.manifestKey);
+  if (!racedManifestBytes)
+    throw new Error("Instructions backup manifest object is missing");
+  const existingManifest = parseManifest(racedManifestBytes, plan, input.backupId);
+  assertManifestMatchesPayload(existingManifest, input.bytes);
+  const existingPayload = await input.store.get(existingManifest.payloadKey);
+  if (!existingPayload)
+    throw new Error("Instructions backup payload object is missing");
+  assertBytesMatch(existingPayload, existingManifest.sha256, existingManifest.sizeBytes, "backup payload integrity");
+  return {
+    status: "existing",
+    manifest: existingManifest,
+    ...await resolveCurrentVersions(input.store, existingManifest)
+  };
+}
+async function pullInstructionsBackup(input) {
+  const versions = normalizeReadVersions(input);
+  const keys = buildInstructionsBackupKeys(input.prefix, input.backupId);
+  const manifestBytes = await input.store.get(keys.manifestKey, versions ? { versionId: versions.manifestVersionId } : undefined);
+  if (!manifestBytes)
+    throw new Error("Instructions backup manifest object is missing");
+  const manifest = parseManifest(manifestBytes, keys, input.backupId);
+  const bytes = await input.store.get(manifest.payloadKey, versions ? { versionId: versions.payloadVersionId } : undefined);
+  if (!bytes)
+    throw new Error("Instructions backup payload object is missing");
+  assertBytesMatch(bytes, manifest.sha256, manifest.sizeBytes, "backup payload integrity");
+  if (versions) {
+    const [manifestMetadata, payloadMetadata] = await Promise.all([
+      input.store.head(keys.manifestKey, { versionId: versions.manifestVersionId }),
+      input.store.head(manifest.payloadKey, { versionId: versions.payloadVersionId })
+    ]);
+    if (manifestMetadata?.versionId !== versions.manifestVersionId || payloadMetadata?.versionId !== versions.payloadVersionId) {
+      throw new Error("Instructions backup immutable version authority check failed");
+    }
+    if (payloadMetadata.size !== manifest.sizeBytes) {
+      throw new Error("Instructions backup payload version size check failed");
+    }
+  }
+  return {
+    manifest,
+    bytes,
+    versionPinned: Boolean(versions),
+    ...versions ? { versions } : {}
+  };
+}
+async function verifyInstructionsBackup(input) {
+  const result = await pullInstructionsBackup(input);
+  return {
+    ok: true,
+    backupId: result.manifest.backupId,
+    payloadKey: result.manifest.payloadKey,
+    manifestKey: result.manifest.manifestKey,
+    sha256: result.manifest.sha256,
+    sizeBytes: result.manifest.sizeBytes,
+    versionPinned: result.versionPinned,
+    ...result.versions ? { versions: result.versions } : {}
+  };
+}
+async function createImmutableObject(store, key, bytes, contentType) {
+  if (!store.putIfAbsent) {
+    throw new Error("Instructions object store does not support atomic immutable creation");
+  }
+  return store.putIfAbsent(key, bytes, { contentType });
+}
+function completeCreatedVersions(payload, manifest) {
+  if (!payload.versionId || !manifest.versionId)
+    return;
+  return { payloadVersionId: payload.versionId, manifestVersionId: manifest.versionId };
+}
+async function resolveCurrentVersions(store, manifest) {
+  const [payload, manifestObject] = await Promise.all([
+    store.head(manifest.payloadKey),
+    store.head(manifest.manifestKey)
+  ]);
+  if (!payload?.versionId || !manifestObject?.versionId)
+    return {};
+  return {
+    versions: {
+      payloadVersionId: payload.versionId,
+      manifestVersionId: manifestObject.versionId
+    }
+  };
+}
+function normalizeReadVersions(input) {
+  const payloadVersionId = input.payloadVersionId?.trim();
+  const manifestVersionId = input.manifestVersionId?.trim();
+  if (Boolean(payloadVersionId) !== Boolean(manifestVersionId)) {
+    throw new Error("Instructions backup payload and manifest version ids must be provided together");
+  }
+  if (!payloadVersionId || !manifestVersionId)
+    return;
+  assertSafeInstructionsObjectVersionId(payloadVersionId);
+  assertSafeInstructionsObjectVersionId(manifestVersionId);
+  return { payloadVersionId, manifestVersionId };
+}
+function encodeBackupId(backupId) {
+  const trimmed = backupId.trim();
+  if (!trimmed || trimmed.length > 128 || trimmed === "." || trimmed === ".." || trimmed.includes("\\") || CONTROL_CHARACTERS.test(trimmed)) {
+    throw new Error("Instructions backup id is invalid");
+  }
+  return encodeURIComponent(trimmed);
+}
+function normalizeContentType(value) {
+  const contentType = value?.trim() || "application/octet-stream";
+  if (contentType.length > 255 || CONTROL_CHARACTERS.test(contentType)) {
+    throw new Error("Instructions backup content type is invalid");
+  }
+  return contentType;
+}
+function normalizeCreatedAt(value) {
+  const date = value ?? new Date;
+  if (!Number.isFinite(date.getTime()))
+    throw new Error("Instructions backup creation timestamp is invalid");
+  return date.toISOString();
+}
+function serializeManifest(manifest) {
+  return encoder.encode(`${JSON.stringify(manifest, null, 2)}
+`);
+}
+function parseManifest(bytes, keys, backupId) {
+  let value;
+  try {
+    value = JSON.parse(decoder.decode(bytes));
+  } catch {
+    throw new Error("Instructions backup manifest is not valid JSON");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Instructions backup manifest is invalid");
+  }
+  const manifest = value;
+  if (manifest.schema !== INSTRUCTIONS_BACKUP_MANIFEST_SCHEMA || manifest.app !== "instructions" || manifest.backupId !== backupId || manifest.payloadKey !== keys.payloadKey || manifest.manifestKey !== keys.manifestKey || typeof manifest.sha256 !== "string" || !SHA256_PATTERN.test(manifest.sha256) || typeof manifest.sizeBytes !== "number" || !Number.isSafeInteger(manifest.sizeBytes) || manifest.sizeBytes < 0 || typeof manifest.contentType !== "string" || !manifest.contentType || typeof manifest.createdAt !== "string" || !Number.isFinite(Date.parse(manifest.createdAt))) {
+    throw new Error("Instructions backup manifest failed validation");
+  }
+  assertSafeInstructionsObjectKey(manifest.payloadKey);
+  assertSafeInstructionsObjectKey(manifest.manifestKey);
+  return manifest;
+}
+function assertManifestMatchesPayload(manifest, bytes) {
+  const digest = sha256(bytes);
+  if (manifest.sha256 !== digest || manifest.sizeBytes !== bytes.byteLength) {
+    throw new Error("Instructions backup is immutable; the existing backup id refers to different bytes");
+  }
+}
+function assertBytesMatch(bytes, expectedSha256, expectedSize, label) {
+  if (bytes.byteLength !== expectedSize || sha256(bytes) !== expectedSha256) {
+    throw new Error(`Instructions ${label} check failed`);
+  }
+}
+function sha256(bytes) {
+  return new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
+}
+export {
+  verifyInstructionsBackup,
+  pushInstructionsBackup,
+  pullInstructionsBackup,
+  planInstructionsBackupPush,
+  buildInstructionsBackupKeys,
+  INSTRUCTIONS_BACKUP_MANIFEST_SCHEMA
+};

package/dist/chunks/s3-config-hhght91k.js

@@ -0,0 +1,14 @@
+// @bun
+import {
+  INSTRUCTIONS_S3_ALIAS_ENV,
+  INSTRUCTIONS_S3_ENV,
+  loadInstructionsS3Config,
+  normalizeInstructionsS3Prefix
+} from "./index-8rb7ng2y.js";
+import"./index-bsan4c16.js";
+export {
+  normalizeInstructionsS3Prefix,
+  loadInstructionsS3Config,
+  INSTRUCTIONS_S3_ENV,
+  INSTRUCTIONS_S3_ALIAS_ENV
+};

package/dist/chunks/s3-object-store-90tgbh6k.js

@@ -0,0 +1,14 @@
+// @bun
+import {
+  assertSafeInstructionsObjectKey,
+  assertSafeInstructionsObjectVersionId,
+  createInstructionsS3ObjectStore,
+  memoryInstructionsObjectStore
+} from "./index-arrrx0ed.js";
+import"./index-bsan4c16.js";
+export {
+  memoryInstructionsObjectStore,
+  createInstructionsS3ObjectStore,
+  assertSafeInstructionsObjectVersionId,
+  assertSafeInstructionsObjectKey
+};