@mpgd/cli 0.39.0 → 0.40.0

package/dist/asset-pack-build.js

@@ -107,7 +107,7 @@ function planAssetFiles(asset, rootPath, delivery) {
             { role: 'texture', entryPath: asset.texture },
             { role: 'atlas', entryPath: asset.atlas },
         ]
-        : [{ role: 'texture', entryPath: asset.file }];
+        : [{ role: asset.kind === 'audio' ? 'audio' : 'texture', entryPath: asset.file }];
     return sources.map(({ role, entryPath }) => {
         const media = phaserPackMediaTypeForPath(entryPath);
         if (media === null) {
@@ -119,6 +119,9 @@ function planAssetFiles(asset, rootPath, delivery) {
         if (role === 'atlas' && media.mediaType !== 'application/json') {
             throw new Error(`Atlas metadata sources must be JSON: ${asset.key}/${entryPath}`);
         }
+        if (role === 'audio' && !media.mediaType.startsWith('audio/')) {
+            throw new Error(`Audio sources must use an audio format: ${asset.key}/${entryPath}`);
+        }
         const data = readSourceFile(rootPath, entryPath);
         let method = asset.compression ?? media.defaultMethod;
         let stored;

package/dist/asset-pack-native-audit.d.ts

@@ -0,0 +1,5 @@
+import { type AssetPackTargetReport } from './asset-pack-target.js';
+/** Inspect the actual native release, not only its pre-sync web input.
+* Hash one expanded entry at a time without extracting or executing anything.
+* Bounds: 2 GiB archive, 512 MiB/entry, 4 GiB expanded, 100000 entries. */
+export declare function assertAssetPackNativeArtifact(report: AssetPackTargetReport, artifact: string): Promise<void>;

package/dist/asset-pack-native-audit.js

@@ -0,0 +1,137 @@
+import { createHash } from 'node:crypto';
+import { lstat, readdir, readFile } from 'node:fs/promises';
+import { basename, extname, join, relative, resolve } from 'node:path';
+import { openPromise } from 'yauzl';
+import { assertAssetPackTargetArtifact, assetPackTargetManifestName, assetPackTargetNamespace, assetPackTargetPolicyName, } from './asset-pack-target.js';
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const manifestSuffix = `/${assetPackTargetNamespace}/${assetPackTargetManifestName}`;
+function expectedNamespace(artifact, namespace) {
+    switch (extname(artifact)) {
+        case '.apk':
+            return namespace === `assets/public/${assetPackTargetNamespace}/`;
+        case '.aab':
+            return namespace === `base/assets/public/${assetPackTargetNamespace}/`;
+        case '.ipa':
+            return new RegExp(`^Payload/[^/]+\\.app/public/${assetPackTargetNamespace}/$`).test(namespace);
+        case '.app':
+            return namespace === `public/${assetPackTargetNamespace}/`;
+        case '.xcarchive':
+            return new RegExp(`^Products/Applications/[^/]+\\.app/public/${assetPackTargetNamespace}/$`).test(namespace);
+        default:
+            return basename(artifact) === 'capacitor-sync' && namespace === `App/App/public/${assetPackTargetNamespace}/`;
+    }
+}
+/** Inspect the actual native release, not only its pre-sync web input.
+ * Hash one expanded entry at a time without extracting or executing anything.
+ * Bounds: 2 GiB archive, 512 MiB/entry, 4 GiB expanded, 100000 entries. */
+export async function assertAssetPackNativeArtifact(report, artifact) {
+    const path = resolve(artifact);
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink()) {
+        throw new Error('Native asset artifact must not be a symbolic link');
+    }
+    if (stat.isDirectory()) {
+        const candidates = [];
+        const pending = [path];
+        let entries = 0;
+        while (pending.length) {
+            const directory = pending.pop();
+            for (const entry of await readdir(directory, { withFileTypes: true })) {
+                if (++entries > 100_000 || entry.isSymbolicLink()) {
+                    throw new Error('Native asset artifact inventory is excessive or contains a symbolic link');
+                }
+                const file = join(directory, entry.name);
+                if (entry.isDirectory()) {
+                    pending.push(file);
+                }
+                else if (entry.name === assetPackTargetManifestName && basename(directory) === assetPackTargetNamespace) {
+                    candidates.push(relative(path, directory));
+                }
+            }
+        }
+        if (candidates.length !== 1) {
+            throw new Error('Native asset artifact requires exactly one packaged pack namespace');
+        }
+        if (!expectedNamespace(path, candidates[0].replaceAll('\\', '/') + '/')) {
+            throw new Error('Native asset namespace is outside the platform web bundle');
+        }
+        await assertAssetPackTargetArtifact(report, path, candidates[0]);
+        return;
+    }
+    if (!stat.isFile() || stat.size > 2 * 1024 ** 3) {
+        throw new Error('Native asset archive is not a bounded regular file');
+    }
+    const localHashes = new Set(report.objects.filter((object) => object.location === 'packaged').map((object) => object.sha256));
+    const remoteHashes = new Set(report.objects.filter((object) => object.location === 'remote' && !localHashes.has(object.sha256)).map((object) => object.sha256));
+    const files = new Map();
+    let expanded = 0;
+    let entryCount = 0;
+    const archive = await openPromise(path, {
+        lazyEntries: true,
+        strictFileNames: true,
+        validateEntrySizes: true,
+    });
+    try {
+        for await (const entry of archive.eachEntry()) {
+            if (++entryCount > 100_000 || entry.uncompressedSize > 512 * 1024 ** 2
+                || expanded + entry.uncompressedSize > 4 * 1024 ** 3) {
+                throw new Error('Native asset archive exceeds its inspection bounds');
+            }
+            if (entry.fileName.endsWith('/')) {
+                continue;
+            }
+            if (files.has(entry.fileName)) {
+                throw new Error('Native asset archive contains duplicate entries');
+            }
+            const stream = await archive.openReadStreamPromise(entry);
+            const hash = createHash('sha256');
+            let bytes = 0;
+            try {
+                for await (const chunk of stream) {
+                    bytes += chunk.length;
+                    if (bytes > entry.uncompressedSize) {
+                        throw new Error('Native asset entry exceeds its declared size');
+                    }
+                    hash.update(chunk);
+                }
+            }
+            finally {
+                stream.destroy();
+            }
+            expanded += bytes;
+            if (bytes !== entry.uncompressedSize) {
+                throw new Error('Native asset entry has a mismatched expanded size');
+            }
+            const sha256 = hash.digest('hex');
+            if (remoteHashes.has(sha256)) {
+                throw new Error(`Remote-only asset object is present in the native package: ${entry.fileName}`);
+            }
+            files.set(entry.fileName, { bytes, sha256 });
+        }
+    }
+    finally {
+        archive.close();
+    }
+    const namespaces = [...files.keys()].filter((name) => name.endsWith(manifestSuffix)).map((name) => name.slice(0, -assetPackTargetManifestName.length));
+    if (namespaces.length !== 1) {
+        throw new Error('Native asset package requires exactly one packaged pack namespace');
+    }
+    const namespace = namespaces[0];
+    if (!expectedNamespace(path, namespace)) {
+        throw new Error('Native asset namespace is outside the platform web bundle');
+    }
+    const namespaceBytes = [...files].filter(([name]) => name.startsWith(namespace)).reduce((sum, [, file]) => sum + file.bytes, 0);
+    if (namespaceBytes !== report.packagedBytes) {
+        throw new Error('Native packaged asset namespace has extra, missing or modified bytes');
+    }
+    for (const name of [assetPackTargetManifestName, assetPackTargetPolicyName]) {
+        if (files.get(namespace + name)?.sha256 !== digest(await readFile(join(report.packagedDir, name)))) {
+            throw new Error('Native packaged asset metadata changed');
+        }
+    }
+    for (const object of report.objects.filter((object) => object.location === 'packaged')) {
+        if (files.get(namespace + object.path)?.sha256 !== object.sha256) {
+            throw new Error('Native packaged asset object changed');
+        }
+    }
+}

package/dist/asset-pack-publish.d.ts

@@ -0,0 +1,43 @@
+export interface AssetPackPublicationOptions {
+  /** Fresh stage-target output with packaged/ and remote/ children. */
+  readonly deployment: string;
+  readonly endpoint: string;
+  readonly bucket: string;
+  readonly prefix: string;
+  readonly region?: string;
+  readonly dryRun?: boolean;
+  /** Explicit local protocol fixture opt-in; HTTPS remains the production default. */
+  readonly allowHttpLoopback?: boolean;
+  readonly accessKeyEnv?: string;
+  readonly secretKeyEnv?: string;
+  readonly sessionTokenEnv?: string;
+  readonly maxObjectBytes?: number;
+  readonly maxTotalBytes?: number;
+  readonly maxObjects?: number;
+  readonly requestTimeoutMs?: number;
+  readonly timeoutMs?: number;
+  readonly signal?: AbortSignal;
+}
+export interface AssetPackPublicationReport {
+  readonly dryRun: boolean;
+  readonly endpoint: string;
+  readonly bucket: string;
+  readonly prefix: string;
+  readonly manifestSha256: string;
+  readonly plannedBytes: number;
+  /** Object body bytes only, not HTTP headers, retries or physical wire bytes. */
+  readonly uploadedBytes: number;
+  readonly objects: readonly {
+    readonly key: string;
+    readonly bytes: number;
+    readonly sha256: string;
+    readonly action: 'planned' | 'uploaded' | 'reused';
+  }[];
+}
+export declare class AssetPackPublicationError extends Error {
+  readonly code: 'config' | 'source' | 'integrity' | 'limit' | 'collision' | 's3' | 'timeout' | 'cancelled';
+  constructor(code: 'config' | 'source' | 'integrity' | 'limit' | 'collision' | 's3' | 'timeout' | 'cancelled', message: string);
+}
+/** The deployment tool owns all storage credentials; no ambient AWS profile or
+* credentials provider chain is consulted, and SDK errors never reach logs. */
+export declare function publishAssetPacks(options: AssetPackPublicationOptions): Promise<AssetPackPublicationReport>;

package/dist/asset-pack-publish.js

@@ -0,0 +1,309 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { HeadObjectCommand, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
+import { NodeHttpHandler } from '@smithy/node-http-handler';
+import { parsePhaserPackEntryPath, validatePhaserPackDeliveryManifest, } from '@mpgd/phaser-assets/pack-format';
+import { assertAssetPackDeliveryPolicy, resolveAssetPackLocations, } from '@mpgd/target-config/asset-packs';
+import { assetPackTargetManifestName, assetPackTargetPolicyName } from './asset-pack-target.js';
+export class AssetPackPublicationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'AssetPackPublicationError';
+    }
+}
+const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const immutableCacheControl = 'public, max-age=31536000, immutable';
+const fail = (code, message) => {
+    throw new AssetPackPublicationError(code, message);
+};
+const positive = (value, maximum, field) => {
+    if (!Number.isSafeInteger(value) || value <= 0 || value > maximum) {
+        fail('config', `Invalid bounded publication option: ${field}`);
+    }
+    return value;
+};
+async function readBounded(path, maximum, signal) {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+        fail('source', 'Publication source must be a regular non-symlink file');
+    }
+    if (stat.size > maximum) {
+        fail('limit', 'Publication source exceeds its byte limit');
+    }
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stream = handle.createReadStream({
+        signal,
+        highWaterMark: 64 * 1024,
+    });
+    const chunks = [];
+    let size = 0;
+    try {
+        for await (const chunk of stream) {
+            const bytes = chunk;
+            size += bytes.length;
+            if (size > maximum) {
+                fail('limit', 'Publication source grew beyond its byte limit');
+            }
+            chunks.push(bytes);
+        }
+    }
+    finally {
+        stream.destroy();
+        await handle.close();
+    }
+    return Buffer.concat(chunks, size);
+}
+async function safeObjectPath(root, path) {
+    parsePhaserPackEntryPath(path);
+    let current = root;
+    for (const component of path.split('/')) {
+        current = join(current, component);
+        if ((await lstat(current)).isSymbolicLink()) {
+            fail('source', 'Publication object path traverses a symbolic link');
+        }
+    }
+    return current;
+}
+function httpStatus(error) {
+    if (typeof error !== 'object' || error === null || !('$metadata' in error)) {
+        return undefined;
+    }
+    const status = error.$metadata?.httpStatusCode;
+    return typeof status === 'number' && Number.isInteger(status) && status >= 100 && status <= 599
+        ? status
+        : undefined;
+}
+/** The deployment tool owns all storage credentials; no ambient AWS profile or
+ * credentials provider chain is consulted, and SDK errors never reach logs. */
+export async function publishAssetPacks(options) {
+    let endpoint;
+    try {
+        endpoint = new URL(options.endpoint);
+    }
+    catch {
+        return fail('config', 'Publication endpoint must be an HTTPS root URL');
+    }
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(endpoint.hostname);
+    if ((endpoint.protocol !== 'https:' && !(options.allowHttpLoopback === true && endpoint.protocol === 'http:' && loopback))
+        || endpoint.pathname !== '/' || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+        fail('config', 'Publication endpoint requires HTTPS without credentials, path, query or fragment (explicit HTTP loopback opt-in available)');
+    }
+    if (!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(options.bucket) || options.bucket.includes('..')
+        || /^\d+\.\d+\.\d+\.\d+$/.test(options.bucket)) {
+        fail('config', 'Publication requires a regular S3 bucket name, not an ARN');
+    }
+    let prefix;
+    try {
+        prefix = parsePhaserPackEntryPath(options.prefix.replace(/\/$/, ''));
+    }
+    catch {
+        return fail('config', 'Publication prefix must be a non-empty normalized relative object path');
+    }
+    const region = options.region ?? 'us-east-1';
+    if (!/^[a-z0-9-]{1,64}$/.test(region)) {
+        fail('config', 'Invalid publication region');
+    }
+    const maxObjectBytes = positive(options.maxObjectBytes ?? 64 * 1024 ** 2, 512 * 1024 ** 2, 'maxObjectBytes');
+    const maxTotalBytes = positive(options.maxTotalBytes ?? 1024 ** 3, Number.MAX_SAFE_INTEGER, 'maxTotalBytes');
+    const maxObjects = positive(options.maxObjects ?? 10_000, 100_000, 'maxObjects');
+    const requestTimeoutMs = positive(options.requestTimeoutMs ?? 10_000, 2 ** 31 - 2, 'requestTimeoutMs');
+    const timeoutMs = positive(options.timeoutMs ?? 120_000, 2 ** 31 - 2, 'timeoutMs');
+    const signal = AbortSignal.any([
+        AbortSignal.timeout(timeoutMs),
+        ...(options.signal === undefined ? [] : [options.signal]),
+    ]);
+    let client;
+    try {
+        const deployment = await realpath(resolve(options.deployment));
+        const metadataRoot = await safeObjectPath(deployment, 'packaged');
+        const remoteRoot = await safeObjectPath(deployment, 'remote');
+        const manifestBytes = await readBounded(join(metadataRoot, assetPackTargetManifestName), 32 * 1024 ** 2, signal);
+        const manifest = validatePhaserPackDeliveryManifest(JSON.parse(manifestBytes.toString('utf8')));
+        const policy = JSON.parse((await readBounded(join(metadataRoot, assetPackTargetPolicyName), 1024 ** 2, signal)).toString('utf8'));
+        assertAssetPackDeliveryPolicy(policy);
+        const locations = resolveAssetPackLocations(policy, manifest.packs);
+        const planned = new Map();
+        for (const pack of manifest.packs) {
+            if (locations[pack.packId] !== 'remote') {
+                continue;
+            }
+            const files = pack.delivery === 'zip'
+                ? [{ ...pack.archive, mediaType: 'application/zip' }]
+                : pack.assets.flatMap((asset) => asset.files);
+            for (const file of files) {
+                const key = `${prefix}/${file.path}`;
+                planned.set(key, {
+                    key,
+                    path: file.path,
+                    bytes: file.bytes,
+                    sha256: file.sha256,
+                    mediaType: file.mediaType,
+                });
+            }
+        }
+        const manifestSha256 = sha(manifestBytes);
+        const snapshotKey = `${prefix}/manifests/${manifestSha256}.json`;
+        const objects = [...planned.values()].sort((a, b) => a.key.localeCompare(b.key));
+        // The immutable snapshot is the final publication marker. There is no
+        // mutable latest pointer and no claim of a cross-object transaction.
+        objects.push({
+            key: snapshotKey,
+            bytes: manifestBytes.length,
+            sha256: manifestSha256,
+            mediaType: 'application/json',
+        });
+        const plannedBytes = objects.reduce((sum, object) => sum + object.bytes, 0);
+        if (objects.length > maxObjects || !Number.isSafeInteger(plannedBytes) || plannedBytes > maxTotalBytes
+            || objects.some((object) => object.bytes > maxObjectBytes)) {
+            fail('limit', 'Publication plan exceeds its object or byte limits');
+        }
+        const bytesFor = async (object) => {
+            signal.throwIfAborted();
+            const bytes = object.path === undefined
+                ? manifestBytes
+                : await readBounded(await safeObjectPath(remoteRoot, object.path), object.bytes, signal);
+            if (bytes.length !== object.bytes || sha(bytes) !== object.sha256) {
+                fail('integrity', 'Publication object does not match its pinned manifest bytes and digest');
+            }
+            return bytes;
+        };
+        // Validate every source before the first external write, then revalidate
+        // each object immediately before sending it. Keep only one body resident.
+        for (const object of objects) {
+            await bytesFor(object);
+        }
+        const results = [];
+        if (options.dryRun === true) {
+            for (const object of objects) {
+                results.push({
+                    key: object.key,
+                    bytes: object.bytes,
+                    sha256: object.sha256,
+                    action: 'planned',
+                });
+            }
+        }
+        else {
+            const value = (name, required) => {
+                if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(name)) {
+                    fail('config', 'Credential options must name environment variables');
+                }
+                const result = process.env[name];
+                if ((required && !result) || (result !== undefined && (result.length > 16_384 || /[\s\x00-\x1f\x7f]/.test(result)))) {
+                    fail('config', 'Publication credential environment is missing or invalid');
+                }
+                return result;
+            };
+            const accessKeyId = value(options.accessKeyEnv ?? 'MPGD_ASSETS_S3_ACCESS_KEY_ID', true);
+            const secretAccessKey = value(options.secretKeyEnv ?? 'MPGD_ASSETS_S3_SECRET_ACCESS_KEY', true);
+            const sessionToken = value(options.sessionTokenEnv ?? 'MPGD_ASSETS_S3_SESSION_TOKEN', false);
+            client = new S3Client({
+                endpoint: endpoint.href, region, forcePathStyle: true, followRegionRedirects: false, maxAttempts: 1,
+                requestChecksumCalculation: 'WHEN_REQUIRED', responseChecksumValidation: 'WHEN_REQUIRED',
+                credentials: { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) },
+                requestHandler: new NodeHttpHandler({ connectionTimeout: requestTimeoutMs, socketTimeout: requestTimeoutMs, requestTimeout: requestTimeoutMs }),
+            });
+            const request = async (action) => {
+                for (let attempt = 0; attempt < 2; attempt++) {
+                    const attemptSignal = AbortSignal.any([signal, AbortSignal.timeout(requestTimeoutMs)]);
+                    try {
+                        return await action(attemptSignal);
+                    }
+                    catch (error) {
+                        if (attemptSignal.aborted) {
+                            fail(options.signal?.aborted ? 'cancelled' : 'timeout', 'Asset publication request exceeded its deadline or was cancelled');
+                        }
+                        if (attempt === 0 && [409, 429, 500, 502, 503, 504].includes(httpStatus(error) ?? 0)) {
+                            await delay(100, undefined, { signal });
+                            continue;
+                        }
+                        throw error;
+                    }
+                }
+                return fail('s3', 'Asset publication request exhausted its attempt limit');
+            };
+            const head = async (key) => {
+                try {
+                    return await request((attemptSignal) => client.send(new HeadObjectCommand({ Bucket: options.bucket, Key: key, ChecksumMode: 'ENABLED' }), { abortSignal: attemptSignal }));
+                }
+                catch (error) {
+                    if (httpStatus(error) === 404) {
+                        return undefined;
+                    }
+                    throw error;
+                }
+            };
+            const verifyHead = (object, result) => {
+                if (!result || result.ContentLength !== object.bytes || result.Metadata?.['mpgd-sha256'] !== object.sha256
+                    || result.ChecksumSHA256 !== Buffer.from(object.sha256, 'hex').toString('base64')
+                    || result.ContentType !== object.mediaType || result.CacheControl !== immutableCacheControl) {
+                    fail('collision', 'Stored object does not match immutable bytes, checksum or delivery metadata; use a new revision/prefix');
+                }
+            };
+            for (const object of objects) {
+                const bytes = await bytesFor(object);
+                const existing = await head(object.key);
+                let action;
+                if (existing) {
+                    verifyHead(object, existing);
+                    action = 'reused';
+                }
+                else {
+                    action = 'uploaded';
+                    try {
+                        await request((attemptSignal) => client.send(new PutObjectCommand({
+                            Bucket: options.bucket,
+                            Key: object.key,
+                            Body: bytes,
+                            ContentLength: object.bytes,
+                            ContentType: object.mediaType,
+                            CacheControl: immutableCacheControl,
+                            IfNoneMatch: '*',
+                            ChecksumSHA256: Buffer.from(object.sha256, 'hex').toString('base64'),
+                            Metadata: { 'mpgd-sha256': object.sha256 },
+                        }), { abortSignal: attemptSignal }));
+                    }
+                    catch (error) {
+                        if (httpStatus(error) !== 412) {
+                            throw error;
+                        }
+                        action = 'reused';
+                    }
+                    verifyHead(object, await head(object.key));
+                }
+                results.push({ key: object.key, bytes: object.bytes, sha256: object.sha256, action });
+            }
+        }
+        return {
+            dryRun: options.dryRun === true,
+            endpoint: endpoint.href,
+            bucket: options.bucket,
+            prefix,
+            manifestSha256,
+            plannedBytes,
+            uploadedBytes: results.filter((object) => object.action === 'uploaded').reduce((sum, object) => sum + object.bytes, 0),
+            objects: results,
+        };
+    }
+    catch (error) {
+        if (signal.aborted) {
+            return fail(options.signal?.aborted ? 'cancelled' : 'timeout', 'Asset publication was cancelled or exceeded its deadline');
+        }
+        if (error instanceof AssetPackPublicationError) {
+            throw error;
+        }
+        const status = httpStatus(error);
+        // Do not surface SDK messages, XML responses, signed URLs, headers or causes.
+        return fail(client === undefined ? 'source' : 's3', status === undefined
+            ? 'Asset publication failed'
+            : `Asset publication failed with HTTP ${status}`);
+    }
+    finally {
+        client?.destroy();
+    }
+}

package/dist/asset-pack-target.d.ts

@@ -0,0 +1,42 @@
+import { type AssetPackDeliveryPolicy, type AssetPackLocation, type AssetPackTargetPolicy } from '@mpgd/target-config/asset-packs';
+export declare const assetPackTargetNamespace = "mpgd-asset-packs";
+export declare const assetPackTargetManifestName = "asset-pack-delivery.json";
+export declare const assetPackTargetPolicyName = "target-policy.json";
+export interface AssetPackTargetReport {
+  readonly outDir: string;
+  readonly packagedDir: string;
+  readonly remoteDir: string;
+  readonly manifestSha256: string;
+  readonly locations: Readonly<Record<string, AssetPackLocation>>;
+  readonly packagedAssetBytes: number;
+  readonly packagedBytes: number;
+  readonly remoteBytes: number;
+  readonly objects: readonly {
+    readonly path: string;
+    readonly bytes: number;
+    readonly sha256: string;
+    readonly location: AssetPackLocation;
+  }[];
+}
+/** Stage verified immutable objects into disjoint packaged/remote roots.
+* The output must not exist: a failed attempt never replaces a deployment. */
+export declare function stageAssetPackTarget(options: {
+  readonly manifestPath: string;
+  readonly root: string;
+  readonly policy: AssetPackDeliveryPolicy;
+  readonly outDir: string;
+}): Promise<AssetPackTargetReport>;
+/** Build from one target's policy without requiring a kit checkout. */
+export declare function assertAssetPackTargetOutput(options: {
+  readonly policy: AssetPackTargetPolicy;
+  readonly baseDir: string;
+  readonly outDir: string;
+}): Promise<void>;
+export declare function buildAssetPackTarget(options: {
+  readonly policy: AssetPackTargetPolicy;
+  readonly baseDir: string;
+  readonly outDir: string;
+}): Promise<AssetPackTargetReport>;
+/** Verify the real bundle's asset namespace and reject byte-identical remote
+* objects copied elsewhere. This does not inspect transformed/embedded data. */
+export declare function assertAssetPackTargetArtifact(report: AssetPackTargetReport, artifactRoot: string, namespacePath?: string): Promise<void>;