@moewolf/moe-icons-cli 0.0.10 → 0.0.14

package/dist/project/install.js

@@ -1,8 +1,48 @@
 import { join, relative, resolve, dirname, isAbsolute, sep } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
-import { lstatSync, realpathSync, readFileSync as realReadFileSync, readdirSync as realReaddirSync, copyFileSync as realCopyFileSync } from "node:fs";
+import { constants, closeSync, fstatSync, lstatSync, openSync, readSync, realpathSync, readFileSync as realReadFileSync, readdirSync as realReaddirSync, copyFileSync as realCopyFileSync } from "node:fs";
 import { parseInstallMetadata, sha256Bytes } from "./install-metadata.js";
+import { parsePackageInstallMetadata } from "./package-install-metadata.js";
 import { strToU8, zipSync, unzipSync } from "fflate";
+function packageStageRoot(path) {
+    const normalized = path.replace(/\\/g, "/");
+    const match = /^(\.moeicons\/(\.package-stage-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}))\/.+$/.exec(normalized);
+    if (!match || normalized !== path)
+        throw new Error(`unsafe staged install path: ${path}`);
+    return match[1];
+}
+function isStagedInstallFile(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    return Object.getPrototypeOf(value) === Object.prototype &&
+        Object.keys(record).sort().join(",") === "kind,path,sha256" &&
+        record.kind === "staged-file" && typeof record.path === "string" &&
+        typeof record.sha256 === "string" && /^[0-9a-f]{64}$/.test(record.sha256);
+}
+function sha256FileSync(path) {
+    const flags = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0);
+    const descriptor = openSync(path, flags);
+    try {
+        if (!fstatSync(descriptor).isFile())
+            throw new Error(`staged install source is not a regular file: ${path}`);
+        const hash = createHash("sha256");
+        const buffer = Buffer.allocUnsafe(64 * 1024);
+        let position = 0;
+        let count = 1;
+        while (count > 0) {
+            count = readSync(descriptor, buffer, 0, buffer.length, position);
+            if (count === 0)
+                break;
+            hash.update(buffer.subarray(0, count));
+            position += count;
+        }
+        return hash.digest("hex");
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
 /** Shared path boundary for install/update and doctor/init writes. */
 export function safeManagedPath(projectRoot, relative) {
     const normalized = relative.replace(/\\/g, "/");
@@ -57,10 +97,33 @@ export function executeManagedReconcile(projectRoot, writes, removePaths, fs_, o
         if (current !== expected)
             throw new Error(`file changed since planning: ${relative}`);
     };
-    const entries = Object.entries(writes).map(([relative, content]) => ({ ...safe(relative), content }));
+    const stagedSources = new Set();
+    const stagedRoots = new Set();
+    const entries = Object.entries(writes).map(([relative, content]) => {
+        const target = safe(relative);
+        if (typeof content === "string" || content instanceof Uint8Array) {
+            return { ...target, content, afterHash: sha256Bytes(content), stagedSource: undefined };
+        }
+        if (!isStagedInstallFile(content))
+            throw new Error(`invalid managed file content: ${relative}`);
+        const stageRoot = packageStageRoot(content.path);
+        const source = safe(content.path);
+        if (stagedSources.has(source.normalized))
+            throw new Error(`staged file is referenced more than once: ${source.normalized}`);
+        stagedSources.add(source.normalized);
+        stagedRoots.add(stageRoot);
+        const stat = lstatSync(source.target);
+        if (stat.isSymbolicLink() || !stat.isFile())
+            throw new Error(`staged install source is not a regular file: ${source.normalized}`);
+        if (sha256FileSync(source.target) !== content.sha256)
+            throw new Error(`staged install source checksum mismatch: ${source.normalized}`);
+        return { ...target, content, afterHash: content.sha256, stagedSource: source.target };
+    });
+    const cleanupStages = [...stagedRoots].sort();
     const removals = [...new Set(removePaths)].map(safe).filter((item) => !Object.hasOwn(writes, item.normalized));
     for (const item of [...entries, ...removals]) {
-        if (item.normalized.toLowerCase().startsWith(".moeicons/.reconcile-"))
+        const lowered = item.normalized.toLowerCase();
+        if (lowered.startsWith(".moeicons/.reconcile-") || lowered.startsWith(".moeicons/.package-stage-"))
             throw new Error(`managed path overlaps transaction control: ${item.normalized}`);
     }
     const allPaths = [...entries, ...removals].map((item) => item.normalized.toLowerCase()).sort();
@@ -89,12 +152,14 @@ export function executeManagedReconcile(projectRoot, writes, removePaths, fs_, o
     const backedUp = [];
     const installed = [];
     let preserveBackup = false;
+    const afterHashes = new Map(entries.map((entry) => [entry.normalized, entry.afterHash]));
     const journal = {
         version: 1, operationId, committed: false,
+        cleanupStages,
         entries: [...removals, ...entries].map((item) => ({
             path: item.normalized,
             before: fs_.existsSync(item.target) ? sha256Bytes(fs_.readFileSync(item.target)) : null,
-            after: Object.hasOwn(writes, item.normalized) ? sha256Bytes(writes[item.normalized]) : null,
+            after: afterHashes.get(item.normalized) ?? null,
         })),
     };
     const journalPath = join(backupRoot, "recovery.json");
@@ -111,7 +176,12 @@ export function executeManagedReconcile(projectRoot, writes, removePaths, fs_, o
             const staged = join(stagingRoot, entry.normalized);
             fs_.mkdirSync(join(staged, ".."), { recursive: true });
             safe(`${stagingRelative}/${entry.normalized}`);
-            fs_.writeFileSync(staged, entry.content);
+            if (entry.stagedSource)
+                fs_.copyFileSync(entry.stagedSource, staged);
+            else
+                fs_.writeFileSync(staged, entry.content);
+            if (sha256FileSync(staged) !== entry.afterHash)
+                throw new Error(`staged install copy checksum mismatch: ${entry.normalized}`);
         }
         // Persist the entire intent before the first destructive rename. Recovery
         // infers completed renames from hashes, so no per-rename journal gap exists.
@@ -140,7 +210,7 @@ export function executeManagedReconcile(projectRoot, writes, removePaths, fs_, o
             fs_.mkdirSync(join(entry.target, ".."), { recursive: true });
             safe(entry.normalized);
             fs_.renameSync(staged, entry.target);
-            installed.push({ target: entry.target, hash: sha256Bytes(entry.content), relative: entry.normalized });
+            installed.push({ target: entry.target, hash: entry.afterHash, relative: entry.normalized });
         }
         journal.committed = true;
         safe(backupRelative);
@@ -201,6 +271,11 @@ export function executeManagedReconcile(projectRoot, writes, removePaths, fs_, o
     // after any backup bytes have already been removed.
     if (fs_.existsSync(backupRoot)) {
         try {
+            for (const stageRoot of cleanupStages) {
+                const stage = safe(stageRoot).target;
+                if (fs_.existsSync(stage))
+                    fs_.rmSync(stage, { recursive: true, force: true });
+            }
             safe(backupRelative);
             fs_.rmSync(backupRoot, { recursive: true, force: true });
         }
@@ -230,7 +305,13 @@ export function recoverManagedReconcile(projectRoot, fs_) {
         if (journal.version !== 1 || name !== `.reconcile-backup-${journal.operationId}` || !Array.isArray(journal.entries) || journal.entries.some((entry) => !entry || typeof entry.path !== "string" || !hashOrNull(entry.before) || !hashOrNull(entry.after))) {
             throw new Error(`invalid recovery journal; originals retained at ${backupRoot}`);
         }
-        if (journal.entries.some((entry) => entry.path.toLowerCase().startsWith(".moeicons/.reconcile-")) || new Set(journal.entries.map((entry) => entry.path.toLowerCase())).size !== journal.entries.length)
+        if (journal.cleanupStages !== undefined && (!Array.isArray(journal.cleanupStages) || journal.cleanupStages.some((path) => typeof path !== "string" || !/^\.moeicons\/\.package-stage-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(path)) || new Set(journal.cleanupStages).size !== journal.cleanupStages.length))
+            throw new Error(`unsafe recovery journal at ${backupRoot}`);
+        const cleanupStages = (journal.cleanupStages ?? []).map((path) => safeManagedPath(projectRoot, path).target);
+        if (journal.entries.some((entry) => {
+            const path = entry.path.toLowerCase();
+            return path.startsWith(".moeicons/.reconcile-") || path.startsWith(".moeicons/.package-stage-");
+        }) || new Set(journal.entries.map((entry) => entry.path.toLowerCase())).size !== journal.entries.length)
             throw new Error(`unsafe recovery journal at ${backupRoot}`);
         const entries = journal.entries.map((entry) => ({ ...entry, target: safeManagedPath(projectRoot, entry.path).target, backup: safeManagedPath(projectRoot, `.moeicons/${name}/files/${entry.path}`).target }));
         const committed = safeManagedPath(projectRoot, `.moeicons/${name}/committed`).target;
@@ -264,6 +345,9 @@ export function recoverManagedReconcile(projectRoot, fs_) {
         const staging = safeManagedPath(projectRoot, `.moeicons/.reconcile-staging-${journal.operationId}`).target;
         if (fs_.existsSync(staging))
             fs_.rmSync(staging, { recursive: true, force: true });
+        for (const stage of cleanupStages)
+            if (fs_.existsSync(stage))
+                fs_.rmSync(stage, { recursive: true, force: true });
         fs_.rmSync(backupRoot, { recursive: true, force: true });
         recovered++;
     }
@@ -323,9 +407,14 @@ export function createInstallPlan(targetRoot, files) {
         seen.add(folded);
         const content = files[rel];
         if (content !== undefined) {
-            items.push(typeof content === "string"
-                ? { kind: "write", path: join(targetRoot, rel), rel, content }
-                : { kind: "write", path: join(targetRoot, rel), rel, bytes: content });
+            if (typeof content === "string")
+                items.push({ kind: "write", path: join(targetRoot, rel), rel, content });
+            else if (content instanceof Uint8Array)
+                items.push({ kind: "write", path: join(targetRoot, rel), rel, bytes: content });
+            else if (isStagedInstallFile(content))
+                items.push({ kind: "write", path: join(targetRoot, rel), rel, staged: content });
+            else
+                throw new Error(`invalid install file content: ${rel}`);
         }
     }
     return { root: targetRoot, items };
@@ -404,6 +493,9 @@ export function executeInstallPlan(plan, fs_) {
             }
             current = dirname(current);
         }
+        const supplied = Number(item.content !== undefined) + Number(item.bytes !== undefined) + Number(item.staged !== undefined);
+        if (supplied !== 1 || (item.staged !== undefined && !isStagedInstallFile(item.staged)))
+            throw new Error(`invalid install plan content: ${rel}`);
         return { item, rel, target };
     });
     const folded = validated.map((item) => item.rel.toLowerCase());
@@ -416,7 +508,7 @@ export function executeInstallPlan(plan, fs_) {
     const metadataPath = join(project, ".moeicons", "install-metadata.json");
     const priorMetadataText = existsOnDisk(metadataPath) ? realReadFileSync(metadataPath, "utf8") : undefined;
     const prior = priorMetadataText !== undefined
-        ? parseInstallMetadata(priorMetadataText, { allowLocalTest: true })
+        ? parseInstallMetadata(priorMetadataText, { allowLocalTest: true }) ?? parsePackageInstallMetadata(priorMetadataText)
         : undefined;
     if (existsOnDisk(metadataPath) && !prior)
         throw new Error("existing install metadata is invalid; refusing to overwrite project files");
@@ -447,7 +539,7 @@ export function executeInstallPlan(plan, fs_) {
             ? (priorMetadataText === undefined ? undefined : sha256Bytes(priorMetadataText))
             : prior?.managedFiles[rel] ?? (existsOnDisk(target) ? sha256Bytes(realReadFileSync(target)) : undefined),
     ]));
-    executeManagedReconcile(project, Object.fromEntries(validated.map(({ item, rel }) => [rel, item.bytes ?? item.content ?? ""])), staleOwned.map(({ rel }) => rel), reconcileFs, { expectedSha256 });
+    executeManagedReconcile(project, Object.fromEntries(validated.map(({ item, rel }) => [rel, item.staged ?? item.bytes ?? item.content ?? ""])), staleOwned.map(({ rel }) => rel), reconcileFs, { expectedSha256 });
 }
 /**
  * Transactionally replace only generated files. Existing files outside this

package/dist/project/package-install-metadata.d.ts

@@ -0,0 +1,31 @@
+export interface PackageInstallCandidateIdentity {
+    readonly schemaVersion: 1;
+    readonly tier: "free" | "pro";
+    readonly fullVersion: string;
+    readonly sourceCommit: string;
+    readonly generatorCommit: string;
+    readonly packageSetSha256: string;
+    readonly candidateRootSha256: string;
+}
+export interface PackageInstallPin {
+    readonly resourceKey: string;
+    readonly packageSha256: string;
+    readonly dependencies: readonly string[];
+}
+/** Identity for selected package installs; intentionally has no archive digest field. */
+export interface PackageInstallMetadata {
+    readonly schemaVersion: 2;
+    readonly candidate: PackageInstallCandidateIdentity;
+    readonly target: "react" | "vue" | "vanilla" | "assets";
+    readonly resourceKeys: readonly string[];
+    readonly packages: readonly PackageInstallPin[];
+    readonly catalogSha256: string;
+    readonly installedAt: string;
+    readonly managedFiles: Readonly<Record<string, string>>;
+    readonly targetSha256: string;
+    readonly targetFileCount: number;
+    readonly targetByteCount: number;
+    readonly generatedOutputDir?: string;
+}
+export declare function parsePackageInstallMetadata(raw: string): PackageInstallMetadata | undefined;
+export declare function serializePackageInstallMetadata(metadata: PackageInstallMetadata): string;

package/dist/project/package-install-metadata.js

@@ -0,0 +1,99 @@
+import { canonicalBytes } from "../core/small-pack/candidate-set.cjs";
+const SHA256 = /^[a-f0-9]{64}$/;
+const COMMIT = /^[a-f0-9]{40}$/;
+const VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:alpha|beta)(?:\.(?:0|[1-9]\d*))?)?$/;
+const UTC_RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/;
+const TARGETS = new Set(["react", "vue", "vanilla", "assets"]);
+const RESOURCE_KEY = /^(?:metadata\/(?:free|pro)\/(?:common|moe-[a-z0-9]+(?:-[a-z0-9]+)*)|code\/(?:free|pro)\/(?:react|vue|vanilla)\/moe-[a-z0-9]+(?:-[a-z0-9]+)*|shared\/(?:free|pro)\/(?:react|vue|vanilla)|svg\/(?:free|pro)\/moe-[a-z0-9]+(?:-[a-z0-9]+)*|bitmap\/(?:free|pro)\/moe-[a-z0-9]+(?:-[a-z0-9]+)*\/[1-9]\d*x[1-9]\d*\/(?:png|webp))$/;
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function safeManagedPath(path) {
+    return path.length > 0 && !path.startsWith("/") && !/^[A-Za-z]:/.test(path) &&
+        !path.includes("\\") && path.split("/").every((part) => part && part !== "." && part !== "..") &&
+        ![".git", "node_modules"].includes(path.split("/")[0].toLowerCase());
+}
+function onlyKeys(value, required, optional = []) {
+    const allowed = new Set([...required, ...optional]);
+    return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => allowed.has(key));
+}
+function sortedUniqueStrings(value, pattern) {
+    if (!Array.isArray(value))
+        return false;
+    const strings = [];
+    for (const entry of value) {
+        if (typeof entry !== "string" || (pattern && !pattern.test(entry)))
+            return false;
+        strings.push(entry);
+    }
+    return new Set(strings).size === strings.length && strings.every((entry, index) => index === 0 || strings[index - 1].localeCompare(entry, "en") < 0);
+}
+export function parsePackageInstallMetadata(raw) {
+    try {
+        const bytes = Buffer.from(raw, "utf8");
+        const value = JSON.parse(raw);
+        if (!record(value) || value.schemaVersion !== 2 || !bytes.equals(canonicalBytes(value)))
+            return undefined;
+        if (!onlyKeys(value, ["schemaVersion", "candidate", "target", "resourceKeys", "packages", "catalogSha256", "installedAt", "managedFiles", "targetSha256", "targetFileCount", "targetByteCount"], ["generatedOutputDir"]))
+            return undefined;
+        const candidate = value.candidate;
+        if (!record(candidate) || !onlyKeys(candidate, ["schemaVersion", "tier", "fullVersion", "sourceCommit", "generatorCommit", "packageSetSha256", "candidateRootSha256"]))
+            return undefined;
+        if (candidate.schemaVersion !== 1 || (candidate.tier !== "free" && candidate.tier !== "pro") || typeof candidate.fullVersion !== "string" || !VERSION.test(candidate.fullVersion) ||
+            typeof candidate.sourceCommit !== "string" || !COMMIT.test(candidate.sourceCommit) || typeof candidate.generatorCommit !== "string" || !COMMIT.test(candidate.generatorCommit) ||
+            typeof candidate.packageSetSha256 !== "string" || !SHA256.test(candidate.packageSetSha256) || typeof candidate.candidateRootSha256 !== "string" || !SHA256.test(candidate.candidateRootSha256))
+            return undefined;
+        if (typeof value.target !== "string" || !TARGETS.has(value.target))
+            return undefined;
+        const targetMatchesKey = (key) => {
+            const [kind, , target] = key.split("/");
+            if (kind === "code" || kind === "shared")
+                return target === value.target;
+            if (kind === "svg")
+                return value.target === "assets" || value.target === "vanilla";
+            if (kind === "bitmap")
+                return value.target !== "vanilla";
+            return kind === "metadata";
+        };
+        if (!sortedUniqueStrings(value.resourceKeys, RESOURCE_KEY) || value.resourceKeys.length === 0 || value.resourceKeys.some((key) => key.split("/")[1] !== candidate.tier || !targetMatchesKey(key)))
+            return undefined;
+        if (!Array.isArray(value.packages) || value.packages.length === 0)
+            return undefined;
+        const packages = [];
+        for (const entry of value.packages) {
+            if (!record(entry) || !onlyKeys(entry, ["resourceKey", "packageSha256", "dependencies"]) ||
+                typeof entry.resourceKey !== "string" || !RESOURCE_KEY.test(entry.resourceKey) || entry.resourceKey.split("/")[1] !== candidate.tier || !targetMatchesKey(entry.resourceKey) ||
+                typeof entry.packageSha256 !== "string" || !SHA256.test(entry.packageSha256) || !sortedUniqueStrings(entry.dependencies, SHA256) || entry.dependencies.includes(entry.packageSha256))
+                return undefined;
+            packages.push(entry);
+        }
+        if (!packages.every((entry, index) => index === 0 || packages[index - 1].resourceKey.localeCompare(entry.resourceKey, "en") < 0))
+            return undefined;
+        const packageKeys = new Set(packages.map((entry) => entry.resourceKey));
+        const packageDigests = new Set(packages.map((entry) => entry.packageSha256));
+        if (packageDigests.size !== packages.length || value.resourceKeys.some((key) => !packageKeys.has(key)) || packages.some((entry) => entry.dependencies.some((digest) => !packageDigests.has(digest))))
+            return undefined;
+        if (typeof value.catalogSha256 !== "string" || !SHA256.test(value.catalogSha256) || typeof value.targetSha256 !== "string" || !SHA256.test(value.targetSha256))
+            return undefined;
+        if (!Number.isSafeInteger(value.targetFileCount) || Number(value.targetFileCount) < 1 || !Number.isSafeInteger(value.targetByteCount) || Number(value.targetByteCount) < 0)
+            return undefined;
+        if (typeof value.installedAt !== "string" || !UTC_RFC3339.test(value.installedAt) || Number.isNaN(Date.parse(value.installedAt)))
+            return undefined;
+        if (!record(value.managedFiles) || Object.keys(value.managedFiles).length === 0)
+            return undefined;
+        const managedFiles = value.managedFiles;
+        const managedPaths = Object.keys(managedFiles);
+        if (managedPaths.some((path) => !safeManagedPath(path)) || new Set(managedPaths.map((path) => path.toLowerCase())).size !== managedPaths.length ||
+            Object.values(managedFiles).some((hash) => typeof hash !== "string" || !SHA256.test(hash)) || managedFiles[".moeicons/catalog.json"] !== value.catalogSha256)
+            return undefined;
+        if (typeof value.generatedOutputDir !== "undefined" && (typeof value.generatedOutputDir !== "string" || !safeManagedPath(value.generatedOutputDir)))
+            return undefined;
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function serializePackageInstallMetadata(metadata) {
+    return canonicalBytes(metadata).toString("utf8");
+}

package/dist/project/tar-gz.d.ts

@@ -1,13 +1,9 @@
 /**
- * Combined release archives contain all four target trees. The current Pro
- * contract is roughly 60k regular files (9 groups × 554 icons), so the former
- * 20k cap rejected valid official packages. The six-spec bitmap matrix expands
- * to ~205 MiB (tar stream ~257 MiB), so the expanded ceiling covers that with
- * headroom while staying finite for zip-bomb protection. `extractTarGz` enforces
- * the same bound during gunzip via `maxOutputLength`, before the tar stream is
- * materialised.
+ * A release archive is one bounded style-group/target package. Full-tier
+ * archives are retired; extraction enforces this package limit before the tar
+ * stream is materialised.
  */
-export declare const ICON_ARCHIVE_MAX_ENTRIES = 100000;
+export declare const ICON_ARCHIVE_MAX_ENTRIES = 20000;
 export declare const ICON_ARCHIVE_MAX_EXPANDED_BYTES: number;
 /** Build a gzipped POSIX tar from in-memory files (test fixtures and unpacking). */
 export declare function createTarGz(files: Readonly<Record<string, string | Uint8Array>>): Uint8Array;

package/dist/project/tar-gz.js

@@ -2,16 +2,12 @@ import { gzipSync, gunzipSync, createGunzip } from "node:zlib";
 import { Readable } from "node:stream";
 const BLOCK = 512;
 /**
- * Combined release archives contain all four target trees. The current Pro
- * contract is roughly 60k regular files (9 groups × 554 icons), so the former
- * 20k cap rejected valid official packages. The six-spec bitmap matrix expands
- * to ~205 MiB (tar stream ~257 MiB), so the expanded ceiling covers that with
- * headroom while staying finite for zip-bomb protection. `extractTarGz` enforces
- * the same bound during gunzip via `maxOutputLength`, before the tar stream is
- * materialised.
+ * A release archive is one bounded style-group/target package. Full-tier
+ * archives are retired; extraction enforces this package limit before the tar
+ * stream is materialised.
  */
-export const ICON_ARCHIVE_MAX_ENTRIES = 100_000;
-export const ICON_ARCHIVE_MAX_EXPANDED_BYTES = 512 * 1024 * 1024;
+export const ICON_ARCHIVE_MAX_ENTRIES = 20_000;
+export const ICON_ARCHIVE_MAX_EXPANDED_BYTES = 128 * 1024 * 1024;
 /** True when a zlib gunzip failure means the bounded output was exceeded. */
 function isOutputLimitError(error) {
     const code = error?.code;
@@ -220,7 +216,7 @@ export async function extractTarGzAsync(bytes, limits, signal) {
         }
         return reader.result();
     }
-    catch (error) {
+    catch {
         return { files: {}, errors: [signal?.aborted ? "archive extraction cancelled" : "invalid gzip"] };
     }
     finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moewolf/moe-icons-cli",
-  "version": "0.0.10",
+  "version": "0.0.14",
   "description": "Moeicons CLI: install React, Vue, Vanilla, or Assets icon targets, manage releases and login, and expose an MCP server.",
   "type": "module",
   "main": "./dist/cli.js",
@@ -39,32 +39,32 @@
     "dev:prepare": "npm --prefix ../moe-icons-clitest run dev:prepare",
     "generate-banner": "node scripts/generate-banner.mjs",
     "sync:config-package": "node scripts/sync-config-package.mjs",
-    "prebuild": "rimraf dist",
-    "build": "tsc -p tsconfig.build.json && node scripts/copy-catalog.mjs && node scripts/copy-config-package.mjs",
+    "prebuild": "node scripts/verify-small-pack-pin.mjs && rimraf dist",
+    "build": "tsc -p tsconfig.build.json && node scripts/copy-catalog.mjs && node scripts/copy-config-package.mjs && node scripts/copy-small-pack.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "eslint src --ext .ts",
-    "test": "vitest run",
+    "test": "vitest run && node --test tests/durable-fallback.test.cjs tests/small-pack-release-guard.test.cjs tests/metered-curl.test.cjs tests/reconcile-package-set-publisher.test.mjs",
     "policy:verify-remote": "node scripts/verify-release-policy-remote.mjs",
     "release:preflight": "node scripts/release-preflight.mjs",
     "release:bump": "node scripts/release-bump.mjs",
-    "prepublishOnly": "npm run release:preflight",
+    "prepublishOnly": "node scripts/verify-small-pack-pin.mjs && npm run release:preflight",
     "format": "prettier --write src tests"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
-    "@typescript-eslint/eslint-plugin": "^7.0.0",
-    "@typescript-eslint/parser": "^7.0.0",
-    "@vue/server-renderer": "^3.5.41",
+    "@typescript-eslint/eslint-plugin": "8.71.2",
+    "@typescript-eslint/parser": "8.71.2",
+    "@vue/server-renderer": "3.5.44",
     "@vue/test-utils": "^2.4.11",
     "eslint": "^8.57.0",
     "eslint-config-prettier": "^9.1.0",
     "figlet": "^1.11.4",
     "happy-dom": "^20.11.1",
     "prettier": "^3.2.0",
-    "sharp": "^0.35.4",
+    "sharp": "0.35.5",
     "typescript": "^5.5.0",
     "vitest": "^4.1.11",
-    "vue": "^3.5.41"
+    "vue": "3.5.44"
   },
   "dependencies": {
     "@babel/parser": "^7.29.8",
@@ -74,5 +74,5 @@
     "fflate": "^0.8.2",
     "jsonc-parser": "^3.3.1"
   },
-  "payloadHash": "39f10c2d8048f41a7fb47fade28d280399eead23a68645c7c4b6bf71243547b0"
+  "payloadHash": "c453cb7f4725db607e0f5ae585dbe2927cf30060ce485c5695809228c5d187f1"
 }