@moewolf/moe-icons-cli 0.0.10 → 0.0.14

package/dist/core/pro-small-package-download.js

@@ -0,0 +1,301 @@
+import * as fs from 'node:fs';
+import { join } from 'node:path';
+import { cacheArtifact } from './cache.js';
+import { downloadArtifact } from '../project/download.js';
+import { parseCandidateSet, sha256 } from './small-pack/candidate-set.cjs';
+import { readSelectedCandidate, consumeSelectedPackages, planSelectedPackages, verifySelectedPackage } from './small-package-selection.js';
+const API_DEFAULT = 'https://api.moeicons.com';
+const VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:alpha|beta)(?:\.(?:0|[1-9]\d*))?)?$/;
+const SHA = /^[a-f0-9]{64}$/;
+const COMMIT = /^[a-f0-9]{40}$/;
+function check(ok, message) { if (!ok)
+    throw new Error(`Pro package download: ${message}`); }
+function readPrivateCache(file, maximum, exact) {
+    let handle;
+    try {
+        const entry = fs.lstatSync(file);
+        check(entry.isFile() && !entry.isSymbolicLink(), 'cached object must be a regular non-link file');
+        if (process.platform !== 'win32') {
+            check((entry.mode & 0o077) === 0 && (typeof process.getuid !== 'function' || entry.uid === process.getuid()), 'Pro cache permissions or owner are unsafe');
+        }
+        handle = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    try {
+        const stat = fs.fstatSync(handle);
+        check(stat.isFile() && stat.size > 0 && stat.size <= maximum && (exact === undefined || stat.size === exact), 'cached object size/type invalid');
+        if (process.platform !== 'win32')
+            check((stat.mode & 0o077) === 0 && (typeof process.getuid !== 'function' || stat.uid === process.getuid()), 'Pro cache permissions or owner changed');
+        const bytes = Buffer.alloc(stat.size + 1);
+        let count = 0;
+        while (count < bytes.length) {
+            const read = fs.readSync(handle, bytes, count, bytes.length - count, count);
+            if (!read)
+                break;
+            count += read;
+        }
+        check(count === stat.size, 'cache changed during bounded read');
+        return bytes.subarray(0, count);
+    }
+    finally {
+        fs.closeSync(handle);
+    }
+}
+function privateCacheIo() {
+    return {
+        mkdirSync(path) {
+            fs.mkdirSync(path, { recursive: true, mode: 0o700 });
+            if (process.platform !== 'win32')
+                fs.chmodSync(path, 0o700);
+        },
+        writeFileSync(path, bytes) { fs.writeFileSync(path, bytes, { mode: 0o600 }); },
+        renameSync: fs.renameSync,
+        existsSync: fs.existsSync,
+        rmSync: fs.rmSync,
+        readFileSync: fs.readFileSync,
+        readdirSync: fs.readdirSync,
+    };
+}
+function resolveApiBase(value) {
+    const base = new URL(value ?? API_DEFAULT);
+    const loopback = base.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(base.hostname);
+    check((base.protocol === 'https:' || loopback) && !base.username && !base.password && !base.search && !base.hash && base.pathname === '/', 'API base must be HTTPS or loopback HTTP');
+    return base;
+}
+function authorizedFetch(fetchFn, apiBase, accessToken) {
+    check(typeof accessToken === 'string' && accessToken.length > 0 && accessToken.length <= 8192 && !/[\r\n]/.test(accessToken), 'authenticated Pro access token required');
+    return async (input, init) => {
+        const address = input instanceof Request ? input.url : input instanceof URL ? input.href : String(input);
+        if (new URL(address).origin !== apiBase.origin)
+            throw new Error('Pro package download: refusing to send credentials outside the configured API origin');
+        const headers = new Headers(input instanceof Request ? input.headers : undefined);
+        new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
+        headers.set('Authorization', `Bearer ${accessToken}`);
+        return await fetchFn(input, { ...init, headers });
+    };
+}
+function identityUrl(apiBase, version, packageSetSha256) {
+    const url = new URL('/v1/icon-library/pro/package-set', apiBase);
+    url.searchParams.set('version', version);
+    if (packageSetSha256)
+        url.searchParams.set('packageSetSha256', packageSetSha256);
+    return url.href;
+}
+function assetUrl(apiBase, identity, path) {
+    const url = new URL(`/v1/icon-library/pro/package-set/${path}`, apiBase);
+    url.searchParams.set('version', identity.fullVersion);
+    url.searchParams.set('packageSetSha256', identity.packageSetSha256);
+    return url.href;
+}
+export async function fetchProPackageSetIdentity(options) {
+    check(options.version === 'stable' || VERSION.test(options.version), 'requested Pro version is invalid');
+    if (options.version === 'stable')
+        check(options.packageSetSha256 === undefined, 'stable lookup cannot include a package-set digest');
+    else
+        check(SHA.test(options.packageSetSha256 ?? ''), 'exact Pro version lookup requires a package-set digest');
+    const apiBase = resolveApiBase(options.apiBaseUrl);
+    const fetchFn = authorizedFetch(options.fetchFn ?? globalThis.fetch, apiBase, options.accessToken);
+    const result = await downloadArtifact(identityUrl(apiBase, options.version, options.packageSetSha256), {
+        maxBytes: 16 * 1024,
+        timeoutMs: 120000,
+        maxRedirects: 0,
+        allowedHosts: [apiBase.host],
+        ...(apiBase.protocol === 'http:' ? { allowHttpLoopback: true } : {}),
+        userAgent: 'moeicons/small-package',
+    }, { fetchFn, ...(options.signal ? { signal: options.signal } : {}) });
+    if (!result.ok)
+        throw new Error(`Pro package-set identity: ${result.code}: ${result.message}`);
+    let raw;
+    try {
+        raw = JSON.parse(Buffer.from(result.bytes).toString('utf8'));
+    }
+    catch {
+        throw new Error('Pro package-set identity: invalid JSON');
+    }
+    check(raw !== null && typeof raw === 'object' && !Array.isArray(raw), 'identity object required');
+    const value = raw;
+    const fields = ['schemaVersion', 'tier', 'fullVersion', 'sourceCommit', 'generatorCommit', 'packageSetSha256', 'candidateRootSha256', 'candidateRootBytes', 'updatedAt'];
+    check(Object.keys(value).sort().join(',') === [...fields].sort().join(','), 'identity fields differ from the Pro package-set contract');
+    check(value.schemaVersion === 1 && value.tier === 'pro' && typeof value.fullVersion === 'string' && VERSION.test(value.fullVersion), 'Pro version identity invalid');
+    check(options.version === 'stable' || value.fullVersion === options.version, 'identity version differs from request');
+    check(typeof value.sourceCommit === 'string' && COMMIT.test(value.sourceCommit), 'Source commit invalid');
+    check(typeof value.generatorCommit === 'string' && COMMIT.test(value.generatorCommit), 'Generator commit invalid');
+    check(typeof value.packageSetSha256 === 'string' && SHA.test(value.packageSetSha256), 'package-set digest invalid');
+    check(options.packageSetSha256 === undefined || value.packageSetSha256 === options.packageSetSha256, 'identity package-set digest differs from request');
+    check(typeof value.candidateRootSha256 === 'string' && SHA.test(value.candidateRootSha256), 'candidate root digest invalid');
+    check(Number.isSafeInteger(value.candidateRootBytes) && Number(value.candidateRootBytes) > 0 && Number(value.candidateRootBytes) <= 1024 ** 2, 'candidate root size invalid');
+    check(typeof value.updatedAt === 'string' && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(value.updatedAt) && !Number.isNaN(Date.parse(value.updatedAt)), 'identity timestamp invalid');
+    return { ...value, networkBytes: result.bytes.length };
+}
+export async function fetchProStablePackageSet(options) {
+    return fetchProPackageSetIdentity({ ...options, version: 'stable' });
+}
+export async function downloadProSelectedPackages(options) {
+    options.signal?.throwIfAborted();
+    check((options.resourceKeys !== undefined) !== (options.resolveResourceKeys !== undefined), 'provide exactly one explicit selection or candidate-based planner');
+    if (options.resourceKeys)
+        check(options.resourceKeys.length > 0 && new Set(options.resourceKeys).size === options.resourceKeys.length, 'explicit unique resource selection required');
+    const expected = options.expected;
+    check(expected.tier === 'pro' && SHA.test(expected.packageSetSha256) && COMMIT.test(expected.sourceCommit) && COMMIT.test(expected.generatorCommit) && VERSION.test(expected.fullVersion), 'exact Pro candidate pin required');
+    if (options.expectedRootSha256 !== undefined)
+        check(SHA.test(options.expectedRootSha256), 'candidate root pin must be lowercase SHA-256');
+    if (options.expectedRootBytes !== undefined)
+        check(Number.isSafeInteger(options.expectedRootBytes) && options.expectedRootBytes > 0 && options.expectedRootBytes <= 1024 ** 2, 'candidate root byte pin is invalid');
+    const apiBase = resolveApiBase(options.apiBaseUrl);
+    const fetchFn = authorizedFetch(options.fetchFn ?? globalThis.fetch, apiBase, options.accessToken);
+    let transferRetryCount = 0;
+    const fetchBytes = async (address, maximum) => {
+        for (let attempt = 0; attempt < 3; attempt++) {
+            options.signal?.throwIfAborted();
+            const result = await downloadArtifact(address, {
+                maxBytes: maximum,
+                timeoutMs: 120000,
+                maxRedirects: 0,
+                allowedHosts: [apiBase.host],
+                ...(apiBase.protocol === 'http:' ? { allowHttpLoopback: true } : {}),
+                userAgent: 'moeicons/small-package',
+            }, { fetchFn, ...(options.signal ? { signal: options.signal } : {}) });
+            if (result.ok)
+                return result.bytes;
+            const transient = result.code === 'NETWORK_ERROR' || result.code === 'HTTP_ERROR' && /\b(?:429|500|502|503|504)\b/.test(result.message);
+            if (!transient || attempt === 2)
+                throw new Error(`Pro package download: ${result.code}: ${result.message}`);
+            transferRetryCount++;
+            await new Promise((resolve, reject) => {
+                const aborted = () => { clearTimeout(timer); options.signal?.removeEventListener('abort', aborted); reject(new Error('Pro package download cancelled')); };
+                const timer = setTimeout(() => { options.signal?.removeEventListener('abort', aborted); resolve(); }, 250 * (attempt + 1));
+                options.signal?.addEventListener('abort', aborted, { once: true });
+                if (options.signal?.aborted)
+                    aborted();
+            });
+        }
+        throw new Error('Pro package download retry budget exhausted');
+    };
+    const cache = join(options.cacheDir, 'small-pack-v1', 'pro');
+    const io = privateCacheIo();
+    const persist = (name, bytes, digest) => cacheArtifact(io, join(cache, name), bytes, digest);
+    const rootName = `candidate-set-${expected.packageSetSha256}.json`;
+    let metadataNetworkBytes = 0;
+    let metadataCacheHits = 0;
+    let rootBytes = readPrivateCache(join(cache, rootName), 1024 ** 2);
+    const rootCached = rootBytes !== undefined;
+    if (rootBytes)
+        metadataCacheHits++;
+    else {
+        rootBytes = await fetchBytes(assetUrl(apiBase, expected, 'root'), 1024 ** 2);
+        metadataNetworkBytes += rootBytes.length;
+    }
+    if (options.expectedRootSha256)
+        check(sha256(rootBytes) === options.expectedRootSha256, 'candidate root differs from authenticated identity');
+    if (options.expectedRootBytes !== undefined)
+        check(rootBytes.length === options.expectedRootBytes, 'candidate root size differs from authenticated identity');
+    const root = parseCandidateSet(rootBytes);
+    for (const key of ['fullVersion', 'tier', 'sourceCommit', 'generatorCommit', 'packageSetSha256'])
+        check(root[key] === expected[key], 'root differs from authenticated Pro identity');
+    const pending = [];
+    const candidate = await readSelectedCandidate(rootBytes, expected, async (ref) => {
+        const name = `page-${ref.sha256}.json`;
+        let bytes = readPrivateCache(join(cache, name), ref.sizeBytes, ref.sizeBytes);
+        if (bytes)
+            metadataCacheHits++;
+        else {
+            const index = root.packagePages.findIndex(item => item.filename === ref.filename && item.sha256 === ref.sha256) + 1;
+            check(index > 0, 'page reference is outside the verified root');
+            bytes = await fetchBytes(assetUrl(apiBase, expected, `pages/${index}`), ref.sizeBytes);
+            metadataNetworkBytes += bytes.length;
+            pending.push({ name, bytes, digest: ref.sha256 });
+        }
+        return bytes;
+    });
+    if (!rootCached)
+        persist(rootName, rootBytes, sha256(rootBytes));
+    for (const page of pending)
+        persist(page.name, page.bytes, page.digest);
+    let bootstrapNetworkBytes = 0;
+    const prefetched = new Map();
+    const loadVerifiedPackage = async (row) => {
+        const trusted = candidate.rows.find(item => item.resourceKey === row.resourceKey);
+        check(trusted && trusted.packageSha256 === row.packageSha256 && trusted.compressedBytes === row.compressedBytes, 'bootstrap package is outside the exact candidate rows');
+        const path = join(cache, `${row.packageSha256}.tgz`);
+        const cached = readPrivateCache(path, row.compressedBytes, row.compressedBytes);
+        const bytes = cached ?? await fetchBytes(assetUrl(apiBase, expected, `packages/${row.packageSha256}.tgz`), row.compressedBytes);
+        const files = verifySelectedPackage(trusted, bytes);
+        if (!cached) {
+            bootstrapNetworkBytes += bytes.length;
+            persist(`${row.packageSha256}.tgz`, bytes, row.packageSha256);
+        }
+        prefetched.set(row.packageSha256, { bytes, network: !cached });
+        return files;
+    };
+    const resourceKeys = options.resolveResourceKeys
+        ? await options.resolveResourceKeys(candidate, loadVerifiedPackage)
+        : options.resourceKeys;
+    check(resourceKeys && resourceKeys.length > 0 && new Set(resourceKeys).size === resourceKeys.length, 'candidate planner must return explicit unique resource keys');
+    const selectedRows = planSelectedPackages(candidate, resourceKeys);
+    const prefetchedNetworkDigests = new Set([...prefetched].filter(([, value]) => value.network).map(([digest]) => digest));
+    const report = await consumeSelectedPackages(candidate, resourceKeys, {
+        readCache: row => Promise.resolve(prefetched.get(row.packageSha256)?.bytes ?? readPrivateCache(join(cache, `${row.packageSha256}.tgz`), row.compressedBytes, row.compressedBytes)),
+        writeCache: (row, bytes) => { persist(`${row.packageSha256}.tgz`, bytes, row.packageSha256); return Promise.resolve(); },
+        download: row => fetchBytes(assetUrl(apiBase, expected, `packages/${row.packageSha256}.tgz`), row.compressedBytes),
+        consume: options.consume,
+        ...(options.signal ? { signal: options.signal } : {}),
+    });
+    const prefetchedSelectedNetworkCount = selectedRows.filter(row => prefetchedNetworkDigests.has(row.packageSha256)).length;
+    return {
+        ...report,
+        networkBytes: report.networkBytes + bootstrapNetworkBytes,
+        cacheHits: report.cacheHits - prefetchedSelectedNetworkCount,
+        metadataNetworkBytes,
+        metadataCacheHits,
+        transferRetryCount,
+    };
+}
+export async function downloadProStablePackages(options) {
+    const identity = await fetchProStablePackageSet({
+        accessToken: options.accessToken,
+        ...(options.apiBaseUrl ? { apiBaseUrl: options.apiBaseUrl } : {}),
+        ...(options.fetchFn ? { fetchFn: options.fetchFn } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
+    });
+    const { accessToken, apiBaseUrl, fetchFn, signal, ...rest } = options;
+    const report = await downloadProSelectedPackages({
+        ...rest,
+        accessToken,
+        ...(apiBaseUrl ? { apiBaseUrl } : {}),
+        ...(fetchFn ? { fetchFn } : {}),
+        ...(signal ? { signal } : {}),
+        expected: identity,
+        expectedRootSha256: identity.candidateRootSha256,
+        expectedRootBytes: identity.candidateRootBytes,
+    });
+    return { ...report, metadataNetworkBytes: report.metadataNetworkBytes + identity.networkBytes };
+}
+export async function downloadProVersionPackages(options) {
+    check(VERSION.test(options.fullVersion) && SHA.test(options.expectedPackageSetSha256), 'exact Pro version and package-set pin required');
+    const identity = await fetchProPackageSetIdentity({
+        version: options.fullVersion,
+        packageSetSha256: options.expectedPackageSetSha256,
+        accessToken: options.accessToken,
+        ...(options.apiBaseUrl ? { apiBaseUrl: options.apiBaseUrl } : {}),
+        ...(options.fetchFn ? { fetchFn: options.fetchFn } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
+    });
+    const report = await downloadProSelectedPackages({
+        cacheDir: options.cacheDir,
+        ...(options.resourceKeys ? { resourceKeys: options.resourceKeys } : {}),
+        ...(options.resolveResourceKeys ? { resolveResourceKeys: options.resolveResourceKeys } : {}),
+        consume: options.consume,
+        accessToken: options.accessToken,
+        ...(options.apiBaseUrl ? { apiBaseUrl: options.apiBaseUrl } : {}),
+        ...(options.fetchFn ? { fetchFn: options.fetchFn } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
+        expected: identity,
+        expectedRootSha256: identity.candidateRootSha256,
+        expectedRootBytes: identity.candidateRootBytes,
+    });
+    return { ...report, metadataNetworkBytes: report.metadataNetworkBytes + identity.networkBytes };
+}

package/dist/core/release-descriptor.js

@@ -213,8 +213,12 @@ export const FREE_DOWNLOAD_HOSTS = [
     "release-assets.githubusercontent.com",
 ];
 export function githubReleaseAssetUrl(tag, filename) {
-    if (!tag.startsWith("v"))
-        throw new Error("release tag must be v<fullVersion>");
+    // Legacy Free releases use v<fullVersion>; the bounded package publisher
+    // uses immutable content-addressed/version-pointer tags as well.
+    const version = String.raw `(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:alpha|beta)(?:\.(?:0|[1-9]\d*))?)?`;
+    const validTag = new RegExp(`^(?:v${version}|candidate-set-v1-free-[a-f0-9]{64}|free-package-v1-[a-f0-9]{64}|candidate-version-v1-free-${version})$`);
+    if (!validTag.test(tag))
+        throw new Error("release tag is not a supported Moeicons release tag");
     return `https://github.com/${PUBLIC_FREE_REPO.owner}/${PUBLIC_FREE_REPO.name}/releases/download/${encodeURIComponent(tag)}/${encodeURIComponent(filename)}`;
 }
 export function cacheKey(fullVersion, sha256) {

package/dist/core/selected-resources.js

@@ -169,8 +169,8 @@ export function planSelectedResources(config, catalog, index) {
     const paths = [...chosen].sort();
     const payloadBytes = paths.reduce((sum, p) => sum + index.files[p].compressedSize, 0);
     const expandedBytes = paths.reduce((sum, p) => sum + index.files[p].size, 0);
-    if (paths.length > 20000 || expandedBytes > 512 * 1024 * 1024 || payloadBytes > 512 * 1024 * 1024)
-        return fail("selected resources exceed 20,000 files/512 MiB budget; reduce icons/themes or explicitly use downloadMode=full");
+    if (paths.length > 20000 || expandedBytes > 768 * 1024 * 1024 || payloadBytes > 768 * 1024 * 1024)
+        return fail("selected resources exceed 20,000 files/768 MiB budget; reduce icons/themes or explicitly use downloadMode=full");
     return { paths, payloadBytes, expandedBytes, fallbacks: [...fallbacks].sort() };
 }
 export function verifyResource(bytes, entry, name) {

package/dist/core/small-pack/PIN.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": 2,
+  "sourceCommit": "24d7e9ea5d4ac7c338ee08995ebf09b485950092",
+  "files": {
+    "candidate-set.cjs": "eeb3882a77e2ad29f73a2d741f140750715e9f4a5700ab338b5716013b862732",
+    "tar-read.cjs": "053cd19f14d2a779b9e964e497129aac6a0226d3766797b1f281e230ab41ad49"
+  },
+  "contracts": {
+    "candidate-set-v1.schema.json": "8e0aac41672fd9929e89f669487aaa6c100ea9460eaeb1935542e8393c6139fc"
+  }
+}

package/dist/core/small-pack/candidate-set-v1.schema.json

@@ -0,0 +1,187 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raw.githubusercontent.com/moewolf-dev/moe-icons-code-library/main/schemas/small-pack-candidate-set-v1.schema.json",
+  "title": "Moe Icons small-package candidate-set v1",
+  "description": "Wire shape and per-object budgets for a tier-isolated package-set root or package page. Canonical bytes, digest equality, sorted order, cross-page uniqueness, dependency closure, and package contents are enforced by the executable candidate-set validator.",
+  "oneOf": [
+    { "$ref": "#/$defs/candidateRoot" },
+    { "$ref": "#/$defs/packagePage" }
+  ],
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "commit": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{40}$"
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-(?:alpha|beta)(?:\\.(0|[1-9][0-9]*))?)?$"
+    },
+    "tier": {
+      "enum": ["free", "pro"]
+    },
+    "styleGroupId": {
+      "type": "string",
+      "pattern": "^moe-[a-z0-9]+(?:-[a-z0-9]+)*$"
+    },
+    "target": {
+      "enum": ["react", "vue", "vanilla"]
+    },
+    "candidateRoot": {
+      "type": "object",
+      "required": [
+        "schemaVersion",
+        "fullVersion",
+        "tier",
+        "sourceCommit",
+        "generatorCommit",
+        "packagePageCount",
+        "packagePages",
+        "packageSetSha256"
+      ],
+      "properties": {
+        "schemaVersion": { "const": 1 },
+        "fullVersion": { "$ref": "#/$defs/version" },
+        "tier": { "$ref": "#/$defs/tier" },
+        "sourceCommit": { "$ref": "#/$defs/commit" },
+        "generatorCommit": { "$ref": "#/$defs/commit" },
+        "packagePageCount": { "type": "integer", "minimum": 1, "maximum": 128 },
+        "packagePages": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": { "$ref": "#/$defs/pageReference" }
+        },
+        "packageSetSha256": { "$ref": "#/$defs/sha256" }
+      },
+      "additionalProperties": false
+    },
+    "pageReference": {
+      "type": "object",
+      "required": ["filename", "sha256", "sizeBytes", "packageCount"],
+      "properties": {
+        "filename": { "type": "string", "pattern": "^package-page-(?:free|pro)-[0-9]{4}\\.json$" },
+        "sha256": { "$ref": "#/$defs/sha256" },
+        "sizeBytes": { "type": "integer", "minimum": 1, "maximum": 8388608 },
+        "packageCount": { "type": "integer", "minimum": 1, "maximum": 20000 }
+      },
+      "additionalProperties": false
+    },
+    "packagePage": {
+      "type": "object",
+      "required": ["schemaVersion", "fullVersion", "tier", "packages"],
+      "properties": {
+        "schemaVersion": { "const": 1 },
+        "fullVersion": { "$ref": "#/$defs/version" },
+        "tier": { "$ref": "#/$defs/tier" },
+        "packages": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 20000,
+          "items": { "$ref": "#/$defs/packageRow" }
+        }
+      },
+      "additionalProperties": false
+    },
+    "packageRow": {
+      "type": "object",
+      "required": [
+        "packageSha256",
+        "filename",
+        "kind",
+        "tier",
+        "resourceKey",
+        "fullVersion",
+        "compressedBytes",
+        "expandedBytes",
+        "fileCount",
+        "dependencies"
+      ],
+      "properties": {
+        "packageSha256": { "$ref": "#/$defs/sha256" },
+        "filename": { "type": "string", "pattern": "^packages/[a-f0-9]{64}\\.tgz$" },
+        "kind": { "enum": ["bitmap", "svg", "code", "shared", "metadata", "website"] },
+        "tier": { "$ref": "#/$defs/tier" },
+        "resourceKey": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "fullVersion": { "$ref": "#/$defs/version" },
+        "compressedBytes": { "type": "integer", "minimum": 1, "maximum": 134217728 },
+        "expandedBytes": { "type": "integer", "minimum": 1, "maximum": 134217728 },
+        "fileCount": { "type": "integer", "minimum": 1, "maximum": 100000 },
+        "dependencies": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/sha256" }
+        },
+        "styleGroupId": { "$ref": "#/$defs/styleGroupId" },
+        "target": { "$ref": "#/$defs/target" },
+        "variant": {
+          "type": "object",
+          "required": ["width", "height", "format"],
+          "properties": {
+            "width": { "type": "integer", "minimum": 1, "maximum": 4096 },
+            "height": { "type": "integer", "minimum": 1, "maximum": 4096 },
+            "format": { "enum": ["png", "webp"] }
+          },
+          "additionalProperties": false
+        },
+        "inputSha256": { "$ref": "#/$defs/sha256" }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "kind": { "const": "bitmap" } }, "required": ["kind"] },
+          "then": {
+            "required": ["styleGroupId", "variant"],
+            "not": { "required": ["target"] },
+            "properties": {
+              "resourceKey": { "type": "string", "pattern": "^bitmap/(?:free|pro)/moe-[a-z0-9]+(?:-[a-z0-9]+)*/[1-9][0-9]*x[1-9][0-9]*/(?:png|webp)$" }
+            }
+          }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "svg" } }, "required": ["kind"] },
+          "then": {
+            "required": ["styleGroupId"],
+            "not": { "anyOf": [{ "required": ["target"] }, { "required": ["variant"] }] },
+            "properties": { "compressedBytes": { "type": "integer", "maximum": 33554432 }, "expandedBytes": { "type": "integer", "maximum": 33554432 }, "resourceKey": { "type": "string", "pattern": "^svg/(?:free|pro)/moe-[a-z0-9]+(?:-[a-z0-9]+)*$" } }
+          }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "code" } }, "required": ["kind"] },
+          "then": {
+            "required": ["styleGroupId", "target"],
+            "not": { "required": ["variant"] },
+            "properties": { "compressedBytes": { "type": "integer", "maximum": 33554432 }, "expandedBytes": { "type": "integer", "maximum": 33554432 }, "resourceKey": { "type": "string", "pattern": "^code/(?:free|pro)/(?:react|vue|vanilla)/moe-[a-z0-9]+(?:-[a-z0-9]+)*$" } }
+          }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "shared" } }, "required": ["kind"] },
+          "then": {
+            "required": ["target"],
+            "not": { "anyOf": [{ "required": ["styleGroupId"] }, { "required": ["variant"] }] },
+            "properties": { "compressedBytes": { "type": "integer", "maximum": 33554432 }, "expandedBytes": { "type": "integer", "maximum": 33554432 }, "resourceKey": { "type": "string", "pattern": "^shared/(?:free|pro)/(?:react|vue|vanilla)$" } }
+          }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "metadata" } }, "required": ["kind"] },
+          "then": {
+            "required": ["styleGroupId"],
+            "not": { "anyOf": [{ "required": ["target"] }, { "required": ["variant"] }] },
+            "properties": { "compressedBytes": { "type": "integer", "maximum": 8388608 }, "expandedBytes": { "type": "integer", "maximum": 8388608 }, "resourceKey": { "type": "string", "pattern": "^metadata/(?:free|pro)/moe-[a-z0-9]+(?:-[a-z0-9]+)*$" } }
+          }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "website" } }, "required": ["kind"] },
+          "then": {
+            "required": ["styleGroupId"],
+            "not": { "anyOf": [{ "required": ["target"] }, { "required": ["variant"] }] },
+            "properties": { "compressedBytes": { "type": "integer", "maximum": 33554432 }, "expandedBytes": { "type": "integer", "maximum": 33554432 }, "resourceKey": { "type": "string", "pattern": "^website/(?:free|pro)/moe-[a-z0-9]+(?:-[a-z0-9]+)*$" } }
+          }
+        }
+      ],
+      "additionalProperties": false
+    }
+  }
+}