@nextclaw/app-runtime 0.9.14 → 0.10.0

package/dist/controllers/publish.controller.js

@@ -20,6 +20,13 @@ var PublishCommand = class {
 			}, null, 2)}\n`);
 			return;
 		}
+		if (result.item.publishStatus === "pending") {
+			write(`Submitted ${result.item.name} (${result.item.appId}) ${result.item.latestVersion} for review.\n`);
+			write("Status: pending\n");
+			write("The app will appear in the App Marketplace after approval.\n");
+			write("Manage submissions: https://platform.nextclaw.io/apps\n");
+			return;
+		}
 		write(`${result.created ? "Published" : "Updated"} ${result.item.name} (${result.item.appId}) ${result.item.latestVersion}\n`);
 		write(`Distribution: ${result.distribution.path} (${result.distribution.mode})\n`);
 		if (result.item.webUrl) write(`Details: ${result.item.webUrl}\n`);

package/dist/controllers/publish.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.controller.js","names":[],"sources":["../../src/controllers/publish.controller.ts"],"sourcesContent":["import { AppPublishService } from \"#app-runtime/services/app-publish.service.js\";\n\nexport class PublishCommand {\n  constructor(\n    private readonly publishService: AppPublishService = new AppPublishService(),\n  ) {}\n\n  run = async (params: {\n    appDirectory: string;\n    metadataPath?: string;\n    apiBaseUrl?: string;\n    token?: string;\n    mode?: \"source\" | \"bundle\";\n    json: boolean;\n    write: (text: string) => void;\n  }): Promise<void> => {\n    const { appDirectory, metadataPath, apiBaseUrl, token, mode, json, write } = params;\n    const result = await this.publishService.publish({\n      appDirectory,\n      metadataPath,\n      apiBaseUrl,\n      token,\n      mode,\n    });\n    if (json) {\n      write(`${JSON.stringify({ ok: true, publish: result }, null, 2)}\\n`);\n      return;\n    }\n    write(\n      `${result.created ? \"Published\" : \"Updated\"} ${result.item.name} (${result.item.appId}) ${result.item.latestVersion}\\n`,\n    );\n    write(`Distribution: ${result.distribution.path} (${result.distribution.mode})\\n`);\n    if (result.item.webUrl) {\n      write(`Details: ${result.item.webUrl}\\n`);\n    }\n    write(`Install: ${result.item.install.command}\\n`);\n  };\n}\n"],"mappings":";;AAEA,IAAa,iBAAb,MAA4B;CAC1B,YACE,iBAAqD,IAAI,mBAAmB,EAC5E;AADiB,OAAA,iBAAA;;CAGnB,MAAM,OAAO,WAQQ;EACnB,MAAM,EAAE,cAAc,cAAc,YAAY,OAAO,MAAM,MAAM,UAAU;EAC7E,MAAM,SAAS,MAAM,KAAK,eAAe,QAAQ;GAC/C;GACA;GACA;GACA;GACA;GACD,CAAC;AACF,MAAI,MAAM;AACR,SAAM,GAAG,KAAK,UAAU;IAAE,IAAI;IAAM,SAAS;IAAQ,EAAE,MAAM,EAAE,CAAC,IAAI;AACpE;;AAEF,QACE,GAAG,OAAO,UAAU,cAAc,UAAU,GAAG,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,cAAc,IACrH;AACD,QAAM,iBAAiB,OAAO,aAAa,KAAK,IAAI,OAAO,aAAa,KAAK,KAAK;AAClF,MAAI,OAAO,KAAK,OACd,OAAM,YAAY,OAAO,KAAK,OAAO,IAAI;AAE3C,QAAM,YAAY,OAAO,KAAK,QAAQ,QAAQ,IAAI"}
+{"version":3,"file":"publish.controller.js","names":[],"sources":["../../src/controllers/publish.controller.ts"],"sourcesContent":["import { AppPublishService } from \"#app-runtime/services/app-publish.service.js\";\n\nexport class PublishCommand {\n  constructor(\n    private readonly publishService: AppPublishService = new AppPublishService(),\n  ) {}\n\n  run = async (params: {\n    appDirectory: string;\n    metadataPath?: string;\n    apiBaseUrl?: string;\n    token?: string;\n    mode?: \"source\" | \"bundle\";\n    json: boolean;\n    write: (text: string) => void;\n  }): Promise<void> => {\n    const { appDirectory, metadataPath, apiBaseUrl, token, mode, json, write } = params;\n    const result = await this.publishService.publish({\n      appDirectory,\n      metadataPath,\n      apiBaseUrl,\n      token,\n      mode,\n    });\n    if (json) {\n      write(`${JSON.stringify({ ok: true, publish: result }, null, 2)}\\n`);\n      return;\n    }\n    if (result.item.publishStatus === \"pending\") {\n      write(\n        `Submitted ${result.item.name} (${result.item.appId}) ${result.item.latestVersion} for review.\\n`,\n      );\n      write(\"Status: pending\\n\");\n      write(\"The app will appear in the App Marketplace after approval.\\n\");\n      write(\"Manage submissions: https://platform.nextclaw.io/apps\\n\");\n      return;\n    }\n    write(\n      `${result.created ? \"Published\" : \"Updated\"} ${result.item.name} (${result.item.appId}) ${result.item.latestVersion}\\n`,\n    );\n    write(`Distribution: ${result.distribution.path} (${result.distribution.mode})\\n`);\n    if (result.item.webUrl) {\n      write(`Details: ${result.item.webUrl}\\n`);\n    }\n    write(`Install: ${result.item.install.command}\\n`);\n  };\n}\n"],"mappings":";;AAEA,IAAa,iBAAb,MAA4B;CAC1B,YACE,iBAAqD,IAAI,mBAAmB,EAC5E;AADiB,OAAA,iBAAA;;CAGnB,MAAM,OAAO,WAQQ;EACnB,MAAM,EAAE,cAAc,cAAc,YAAY,OAAO,MAAM,MAAM,UAAU;EAC7E,MAAM,SAAS,MAAM,KAAK,eAAe,QAAQ;GAC/C;GACA;GACA;GACA;GACA;GACD,CAAC;AACF,MAAI,MAAM;AACR,SAAM,GAAG,KAAK,UAAU;IAAE,IAAI;IAAM,SAAS;IAAQ,EAAE,MAAM,EAAE,CAAC,IAAI;AACpE;;AAEF,MAAI,OAAO,KAAK,kBAAkB,WAAW;AAC3C,SACE,aAAa,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,cAAc,gBACnF;AACD,SAAM,oBAAoB;AAC1B,SAAM,+DAA+D;AACrE,SAAM,0DAA0D;AAChE;;AAEF,QACE,GAAG,OAAO,UAAU,cAAc,UAAU,GAAG,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,cAAc,IACrH;AACD,QAAM,iBAAiB,OAAO,aAAa,KAAK,IAAI,OAAO,aAAa,KAAK,KAAK;AAClF,MAAI,OAAO,KAAK,OACd,OAAM,YAAY,OAAO,KAAK,OAAO,IAAI;AAE3C,QAAM,YAAY,OAAO,KAAK,QAAQ,QAAQ,IAAI"}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
+import { AppBundleChecksums, AppBundleExtractResult, AppBundleMetadata, AppBundlePackResult, AppDistributionMode } from "./types/app-bundle.types.js";
+import { AppArtifactValidationExpectation, AppArtifactValidationResult, AppArtifactValidationService } from "./services/app-artifact-validation.service.js";
 import { AppComponentKind, AppComponentManifest, AppComponentManifestBundle, AppComponentManifestSummary, AppComponentReference, AppCoreWasmMainManifest, AppDocumentAccessMode, AppDocumentAccessScope, AppMainManifest, AppManifest, AppManifestBundle, AppManifestSummary, AppPermissions, AppResolvedComponent, AppStandaloneManifest, AppStandaloneManifestBundle, AppStandaloneManifestSummary, AppUiManifest, AppWasiHttpComponentMainManifest, isAppComponentManifestBundle, isAppStandaloneManifestBundle } from "./types/app-manifest.types.js";
 import { AppManifestService } from "./services/app-manifest.service.js";
-import { AppBundleChecksums, AppBundleExtractResult, AppBundleMetadata, AppBundlePackResult, AppDistributionMode } from "./types/app-bundle.types.js";
 import { AppBundleService } from "./services/app-bundle.service.js";
 import { AppDocumentGrantMap, AppDocumentGrantMutationResult, AppDocumentGrantState, AppInstalledPermissionState, AppPermissionSummary, ResolvedDocumentGrant, ResolvedPermissions } from "./types/app-permissions.types.js";
 import { AppPermissionsService } from "./services/app-permissions.service.js";
@@ -26,14 +27,14 @@ import { AppRuntimeCommandResult, AppRuntimeDoctorResult, AppRuntimeToolStatus,
 import { AppBuildResult, AppBuildService } from "./services/app-build.service.js";
 import { AppRegistryConfigService } from "./services/app-registry-config.service.js";
 import { AppRemoteRegistryClientService } from "./services/app-remote-registry-client.service.js";
-import { AppActivationResult, AppInfoResult, AppInstallResult, AppLaunchResolution, AppRollbackResult, AppUninstallResult, AppUpdateResult, InstalledAppListItem } from "./types/app-installation.types.js";
+import { AppActivationResult, AppInfoResult, AppInstallProgressHandler, AppInstallProgressPhase, AppInstallResult, AppLaunchResolution, AppRollbackResult, AppUninstallResult, AppUpdateResult, InstalledAppListItem } from "./types/app-installation.types.js";
 import { AppInstallationService } from "./services/app-installation.service.js";
 import { InfoCommand } from "./controllers/info.controller.js";
 import { InstallCommand } from "./controllers/install.controller.js";
 import { ListCommand } from "./controllers/list.controller.js";
 import { PackCommand } from "./controllers/pack.controller.js";
 import { PermissionsCommand } from "./controllers/permissions.controller.js";
-import { AppMarketplaceMetadata, AppPublishFile, AppPublishPayload, AppPublishResult, DEFAULT_APP_MARKETPLACE_API_BASE } from "./types/app-publish.types.js";
+import { AppMarketplaceMetadata, AppMarketplaceVisuals, AppPublishFile, AppPublishPayload, AppPublishResult, DEFAULT_APP_MARKETPLACE_API_BASE } from "./types/app-publish.types.js";
 import { AppMarketplaceClientService } from "./services/app-marketplace-client.service.js";
 import { AppMarketplaceMetadataService } from "./services/app-marketplace-metadata.service.js";
 import { PlatformAuthStateService, PlatformPublishAuthState } from "./services/platform-auth-state.service.js";
@@ -48,4 +49,4 @@ import { ValidatePublishCommand } from "./controllers/validate-publish.controlle
 import { WasmtimeWasiHttpComponentHandle, WasmtimeWasiHttpComponentService, WasmtimeWasiHttpComponentStartOptions } from "./services/wasmtime-wasi-http-component.service.js";
 import { AppHostHandle, AppHostService, AppHostStartOptions } from "./services/app-host.service.js";
 import { UiServerService } from "./services/ui-server.service.js";
-export { AppActivationResult, AppBuildResult, AppBuildService, AppBundleChecksums, AppBundleExtractResult, AppBundleMetadata, AppBundlePackResult, AppBundleService, AppComponentKind, AppComponentManifest, AppComponentManifestBundle, AppComponentManifestSummary, AppComponentReference, AppCoreWasmMainManifest, AppDistributionMode, AppDocumentAccessMode, AppDocumentAccessScope, AppDocumentGrantMap, AppDocumentGrantMutationResult, AppDocumentGrantState, AppGrantService, AppHomeService, AppHostHandle, AppHostService, AppHostStartOptions, AppInfoResult, AppInstallResult, AppInstallSourceKind, AppInstallationService, AppInstalledPermissionState, AppInstanceService, AppLaunchResolution, AppMainManifest, AppManifest, AppManifestBundle, AppManifestService, AppManifestSummary, AppMarketplaceClientService, AppMarketplaceMetadata, AppMarketplaceMetadataService, AppPermissionSummary, AppPermissions, AppPermissionsService, AppPublishFile, AppPublishPayload, AppPublishResult, AppPublishService, AppPublishValidationResult, AppPublishValidationService, AppPublishValidationWarning, AppPublishValidationWarningCode, AppPublisher, AppRegistry, AppRegistryAppRecord, AppRegistryConfig, AppRegistryConfigService, AppRegistryConfigSnapshot, AppRegistryInstalledVersion, AppRegistryService, AppRemoteRegistryClientService, AppRemoteRegistryDocument, AppRemoteRegistryResolution, AppRemoteRegistryVersion, AppResolvedComponent, AppRollbackResult, AppRunResult, AppRuntimeCliService, AppRuntimeCommandResult, AppRuntimeDoctorResult, AppRuntimeOptionsService, AppRuntimeToolStatus, AppRuntimeToolchainService, AppScaffoldFile, AppScaffoldResult, AppScaffoldService, AppScaffoldTemplate, AppStandaloneManifest, AppStandaloneManifestBundle, AppStandaloneManifestSummary, AppTsHttpLiteScaffoldTemplateService, AppTsHttpScaffoldTemplateService, AppUiManifest, AppUninstallResult, AppUpdateResult, AppWasiHttpComponentMainManifest, BuildCliOptions, CreateCliOptions, CreateCommand, DEFAULT_APP_MARKETPLACE_API_BASE, DEFAULT_APP_REGISTRY_URL, GrantCliOptions, GrantCommand, HostBridgeServer, InfoCommand, InstallCliOptions, InstallCommand, InstalledAppListItem, JsonOnlyCliOptions, ListCommand, MainRunRequest, MainRunResult, MainRunnerService, PackCliOptions, PackCommand, PermissionsCommand, PlatformAuthStateService, PlatformPublishAuthState, PublishCliOptions, PublishCommand, RegistryCommand, ResolvedDocumentGrant, ResolvedPermissions, RevokeCliOptions, RevokeCommand, RuntimeCliOptions, UiServerService, UninstallCliOptions, UninstallCommand, UpdateCliOptions, UpdateCommand, ValidatePublishCommand, WasmDocumentSummaryInput, WasmMainRunnerService, WasmSidecarClientService, WasmtimeWasiHttpComponentHandle, WasmtimeWasiHttpComponentService, WasmtimeWasiHttpComponentStartOptions, isAppComponentManifestBundle, isAppStandaloneManifestBundle };
+export { AppActivationResult, AppArtifactValidationExpectation, AppArtifactValidationResult, AppArtifactValidationService, AppBuildResult, AppBuildService, AppBundleChecksums, AppBundleExtractResult, AppBundleMetadata, AppBundlePackResult, AppBundleService, AppComponentKind, AppComponentManifest, AppComponentManifestBundle, AppComponentManifestSummary, AppComponentReference, AppCoreWasmMainManifest, AppDistributionMode, AppDocumentAccessMode, AppDocumentAccessScope, AppDocumentGrantMap, AppDocumentGrantMutationResult, AppDocumentGrantState, AppGrantService, AppHomeService, AppHostHandle, AppHostService, AppHostStartOptions, AppInfoResult, AppInstallProgressHandler, AppInstallProgressPhase, AppInstallResult, AppInstallSourceKind, AppInstallationService, AppInstalledPermissionState, AppInstanceService, AppLaunchResolution, AppMainManifest, AppManifest, AppManifestBundle, AppManifestService, AppManifestSummary, AppMarketplaceClientService, AppMarketplaceMetadata, AppMarketplaceMetadataService, AppMarketplaceVisuals, AppPermissionSummary, AppPermissions, AppPermissionsService, AppPublishFile, AppPublishPayload, AppPublishResult, AppPublishService, AppPublishValidationResult, AppPublishValidationService, AppPublishValidationWarning, AppPublishValidationWarningCode, AppPublisher, AppRegistry, AppRegistryAppRecord, AppRegistryConfig, AppRegistryConfigService, AppRegistryConfigSnapshot, AppRegistryInstalledVersion, AppRegistryService, AppRemoteRegistryClientService, AppRemoteRegistryDocument, AppRemoteRegistryResolution, AppRemoteRegistryVersion, AppResolvedComponent, AppRollbackResult, AppRunResult, AppRuntimeCliService, AppRuntimeCommandResult, AppRuntimeDoctorResult, AppRuntimeOptionsService, AppRuntimeToolStatus, AppRuntimeToolchainService, AppScaffoldFile, AppScaffoldResult, AppScaffoldService, AppScaffoldTemplate, AppStandaloneManifest, AppStandaloneManifestBundle, AppStandaloneManifestSummary, AppTsHttpLiteScaffoldTemplateService, AppTsHttpScaffoldTemplateService, AppUiManifest, AppUninstallResult, AppUpdateResult, AppWasiHttpComponentMainManifest, BuildCliOptions, CreateCliOptions, CreateCommand, DEFAULT_APP_MARKETPLACE_API_BASE, DEFAULT_APP_REGISTRY_URL, GrantCliOptions, GrantCommand, HostBridgeServer, InfoCommand, InstallCliOptions, InstallCommand, InstalledAppListItem, JsonOnlyCliOptions, ListCommand, MainRunRequest, MainRunResult, MainRunnerService, PackCliOptions, PackCommand, PermissionsCommand, PlatformAuthStateService, PlatformPublishAuthState, PublishCliOptions, PublishCommand, RegistryCommand, ResolvedDocumentGrant, ResolvedPermissions, RevokeCliOptions, RevokeCommand, RuntimeCliOptions, UiServerService, UninstallCliOptions, UninstallCommand, UpdateCliOptions, UpdateCommand, ValidatePublishCommand, WasmDocumentSummaryInput, WasmMainRunnerService, WasmSidecarClientService, WasmtimeWasiHttpComponentHandle, WasmtimeWasiHttpComponentService, WasmtimeWasiHttpComponentStartOptions, isAppComponentManifestBundle, isAppStandaloneManifestBundle };

package/dist/index.js

@@ -1,3 +1,4 @@
+import { AppArtifactValidationService } from "./services/app-artifact-validation.service.js";
 import { AppManifestService } from "./services/app-manifest.service.js";
 import { isAppComponentManifestBundle, isAppStandaloneManifestBundle } from "./types/app-manifest.types.js";
 import { AppBundleService } from "./services/app-bundle.service.js";
@@ -43,4 +44,4 @@ import { AppPublishValidationService } from "./services/app-publish-validation.s
 import { ValidatePublishCommand } from "./controllers/validate-publish.controller.js";
 import { AppRuntimeOptionsService } from "./services/app-runtime-options.service.js";
 import { AppRuntimeCliService } from "./services/app-runtime-cli.service.js";
-export { AppBuildService, AppBundleService, AppGrantService, AppHomeService, AppHostService, AppInstallationService, AppInstanceService, AppManifestService, AppMarketplaceClientService, AppMarketplaceMetadataService, AppPermissionsService, AppPublishService, AppPublishValidationService, AppRegistryConfigService, AppRegistryService, AppRemoteRegistryClientService, AppRuntimeCliService, AppRuntimeOptionsService, AppRuntimeToolchainService, AppScaffoldService, AppTsHttpLiteScaffoldTemplateService, AppTsHttpScaffoldTemplateService, CreateCommand, DEFAULT_APP_MARKETPLACE_API_BASE, DEFAULT_APP_REGISTRY_URL, GrantCommand, HostBridgeServer, InfoCommand, InstallCommand, ListCommand, MainRunnerService, PackCommand, PermissionsCommand, PlatformAuthStateService, PublishCommand, RegistryCommand, RevokeCommand, UiServerService, UninstallCommand, UpdateCommand, ValidatePublishCommand, WasmMainRunnerService, WasmSidecarClientService, WasmtimeWasiHttpComponentService, isAppComponentManifestBundle, isAppStandaloneManifestBundle };
+export { AppArtifactValidationService, AppBuildService, AppBundleService, AppGrantService, AppHomeService, AppHostService, AppInstallationService, AppInstanceService, AppManifestService, AppMarketplaceClientService, AppMarketplaceMetadataService, AppPermissionsService, AppPublishService, AppPublishValidationService, AppRegistryConfigService, AppRegistryService, AppRemoteRegistryClientService, AppRuntimeCliService, AppRuntimeOptionsService, AppRuntimeToolchainService, AppScaffoldService, AppTsHttpLiteScaffoldTemplateService, AppTsHttpScaffoldTemplateService, CreateCommand, DEFAULT_APP_MARKETPLACE_API_BASE, DEFAULT_APP_REGISTRY_URL, GrantCommand, HostBridgeServer, InfoCommand, InstallCommand, ListCommand, MainRunnerService, PackCommand, PermissionsCommand, PlatformAuthStateService, PublishCommand, RegistryCommand, RevokeCommand, UiServerService, UninstallCommand, UpdateCommand, ValidatePublishCommand, WasmMainRunnerService, WasmSidecarClientService, WasmtimeWasiHttpComponentService, isAppComponentManifestBundle, isAppStandaloneManifestBundle };

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.9.14";
+var version = "0.10.0";
 //#endregion
 export { version };
 

package/dist/services/app-artifact-validation.service.d.ts

@@ -0,0 +1,46 @@
+import { AppBundleChecksums, AppBundleMetadata, AppDistributionMode } from "../types/app-bundle.types.js";
+
+//#region src/services/app-artifact-validation.service.d.ts
+type AppArtifactValidationExpectation = {
+  appId: string;
+  name: string;
+  version: string;
+  distributionMode: AppDistributionMode;
+  manifest?: unknown;
+};
+type AppArtifactValidationResult = {
+  archive: Record<string, Uint8Array>;
+  artifactSha256: string;
+  metadata: AppBundleMetadata;
+  checksums: AppBundleChecksums;
+  manifest: Record<string, unknown>;
+};
+declare class AppArtifactValidationService {
+  validate: (params: {
+    bytes: Uint8Array;
+    expected?: AppArtifactValidationExpectation;
+  }) => Promise<AppArtifactValidationResult>;
+  private readCentralEntries;
+  private readCentralDirectory;
+  private readCentralEntry;
+  private findEocdOffset;
+  private assertRegularFile;
+  private normalizeArchive;
+  private normalizeEntry;
+  private assertCentralEntriesMatchArchive;
+  private readMetadata;
+  private readChecksums;
+  private verifyChecksums;
+  private assertManifestContract;
+  private assertStandaloneEntry;
+  private assertExpectedContract;
+  private readJsonEntry;
+  private decodeUtf8;
+  private sha256;
+  private toJsonValue;
+  private isJsonSubset;
+  private isRecord;
+}
+//#endregion
+export { AppArtifactValidationExpectation, AppArtifactValidationResult, AppArtifactValidationService };
+//# sourceMappingURL=app-artifact-validation.service.d.ts.map

package/dist/services/app-artifact-validation.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-artifact-validation.service.d.ts","names":[],"sources":["../../src/services/app-artifact-validation.service.ts"],"mappings":";;;KAgCY,gCAAA;EACV,KAAA;EACA,IAAA;EACA,OAAA;EACA,gBAAA,EAAkB,mBAAA;EAClB,QAAA;AAAA;AAAA,KAGU,2BAAA;EACV,OAAA,EAAS,MAAA,SAAe,UAAA;EACxB,cAAA;EACA,QAAA,EAAU,iBAAA;EACV,SAAA,EAAW,kBAAA;EACX,QAAA,EAAU,MAAA;AAAA;AAAA,cAQC,4BAAA;EACX,QAAA,GAAkB,MAAA;IAChB,KAAA,EAAO,UAAA;IACP,QAAA,GAAW,gCAAA;EAAA,MACT,OAAA,CAAQ,2BAAA;EAAA,QA0BJ,kBAAA;EAAA,QAiCA,oBAAA;EAAA,QAmCA,gBAAA;EAAA,QAgEA,cAAA;EAAA,QAiBA,iBAAA;EAAA,QAsBA,gBAAA;EAAA,QAcA,cAAA;EAAA,QAiBA,gCAAA;EAAA,QAuBA,YAAA;EAAA,QA0BA,aAAA;EAAA,QAcA,eAAA;EAAA,QA4BA,sBAAA;EAAA,QA6DA,qBAAA;EAAA,QAiBA,sBAAA;EAAA,QAwBA,aAAA;EAAA,QAkBA,UAAA;EAAA,QAQA,MAAA;EAAA,QAUA,WAAA;EAAA,QAOA,YAAA;EAAA,QAsBA,QAAA;AAAA"}

package/dist/services/app-artifact-validation.service.js

@@ -0,0 +1,250 @@
+import { strFromU8, unzipSync } from "fflate";
+//#region src/services/app-artifact-validation.service.ts
+const MAX_COMPRESSED_BYTES = 25 * 1024 * 1024;
+const MAX_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
+const MAX_FILE_BYTES = 25 * 1024 * 1024;
+const MAX_FILE_COUNT = 2e3;
+const MAX_COMPRESSION_RATIO = 200;
+const CHECKSUMS_PATH = ".napp/checksums.json";
+const BUNDLE_METADATA_PATH = ".napp/bundle.json";
+const ENTRY_MANIFEST_PATH = "manifest.json";
+const ZIP_EOCD_SIGNATURE = 101010256;
+const ZIP_CENTRAL_FILE_SIGNATURE = 33639248;
+const ZIP_EOCD_MIN_BYTES = 22;
+const ZIP_MAX_COMMENT_BYTES = 65535;
+const ZIP_CENTRAL_FILE_HEADER_BYTES = 46;
+var AppArtifactValidationService = class {
+	validate = async (params) => {
+		const { bytes, expected } = params;
+		if (bytes.byteLength === 0 || bytes.byteLength > MAX_COMPRESSED_BYTES) throw new Error(`bundle 压缩体积必须在 1 到 ${MAX_COMPRESSED_BYTES} bytes 之间。`);
+		const artifactSha256 = await this.sha256(bytes);
+		const centralEntries = this.readCentralEntries(bytes);
+		const archive = this.normalizeArchive(unzipSync(bytes));
+		this.assertCentralEntriesMatchArchive(centralEntries, archive);
+		const metadata = this.readMetadata(archive);
+		const checksums = this.readChecksums(archive);
+		await this.verifyChecksums(archive, checksums);
+		const manifest = this.readJsonEntry(archive, ENTRY_MANIFEST_PATH, "manifest.json");
+		this.assertManifestContract({
+			archive,
+			manifest,
+			metadata
+		});
+		if (expected) this.assertExpectedContract({
+			expected,
+			manifest,
+			metadata
+		});
+		return {
+			archive,
+			artifactSha256,
+			metadata,
+			checksums,
+			manifest
+		};
+	};
+	readCentralEntries = (bytes) => {
+		const { centralDirectoryOffset, entryCount, eocdOffset, view } = this.readCentralDirectory(bytes);
+		const entries = [];
+		const names = /* @__PURE__ */ new Set();
+		let cursor = centralDirectoryOffset;
+		let totalUncompressedBytes = 0;
+		for (let index = 0; index < entryCount; index += 1) {
+			const { entry, entryEnd } = this.readCentralEntry({
+				bytes,
+				cursor,
+				eocdOffset,
+				view
+			});
+			if (names.has(entry.name)) throw new Error(`bundle 包含重复路径：${entry.name}`);
+			names.add(entry.name);
+			totalUncompressedBytes += entry.uncompressedSize;
+			if (totalUncompressedBytes > MAX_UNCOMPRESSED_BYTES) throw new Error(`bundle 解压后超过 ${MAX_UNCOMPRESSED_BYTES} bytes 上限。`);
+			entries.push(entry);
+			cursor = entryEnd;
+		}
+		if (cursor !== eocdOffset) throw new Error("bundle central directory 未被精确消费。");
+		return entries;
+	};
+	readCentralDirectory = (bytes) => {
+		const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+		const eocdOffset = this.findEocdOffset(view);
+		const diskNumber = view.getUint16(eocdOffset + 4, true);
+		const centralDirectoryDisk = view.getUint16(eocdOffset + 6, true);
+		const entryCountOnDisk = view.getUint16(eocdOffset + 8, true);
+		const entryCount = view.getUint16(eocdOffset + 10, true);
+		const centralDirectorySize = view.getUint32(eocdOffset + 12, true);
+		const centralDirectoryOffset = view.getUint32(eocdOffset + 16, true);
+		const commentLength = view.getUint16(eocdOffset + 20, true);
+		if (diskNumber !== 0 || centralDirectoryDisk !== 0 || entryCountOnDisk !== entryCount) throw new Error("bundle 不支持跨磁盘 ZIP。");
+		if (entryCount === 65535 || centralDirectorySize === 4294967295 || centralDirectoryOffset === 4294967295) throw new Error("bundle 不支持 Zip64。");
+		if (entryCount === 0 || entryCount > MAX_FILE_COUNT || eocdOffset + ZIP_EOCD_MIN_BYTES + commentLength !== bytes.byteLength || centralDirectoryOffset + centralDirectorySize !== eocdOffset) throw new Error("bundle central directory 无效。");
+		return {
+			centralDirectoryOffset,
+			entryCount,
+			eocdOffset,
+			view
+		};
+	};
+	readCentralEntry = (params) => {
+		const { bytes, cursor, eocdOffset, view } = params;
+		if (cursor + ZIP_CENTRAL_FILE_HEADER_BYTES > eocdOffset || view.getUint32(cursor, true) !== ZIP_CENTRAL_FILE_SIGNATURE) throw new Error("bundle central directory entry 无效。");
+		const versionMadeBy = view.getUint16(cursor + 4, true);
+		const flags = view.getUint16(cursor + 8, true);
+		const compressionMethod = view.getUint16(cursor + 10, true);
+		const compressedSize = view.getUint32(cursor + 20, true);
+		const uncompressedSize = view.getUint32(cursor + 24, true);
+		const nameLength = view.getUint16(cursor + 28, true);
+		const extraLength = view.getUint16(cursor + 30, true);
+		const entryCommentLength = view.getUint16(cursor + 32, true);
+		const externalAttributes = view.getUint32(cursor + 38, true);
+		const entryEnd = cursor + ZIP_CENTRAL_FILE_HEADER_BYTES + nameLength + extraLength + entryCommentLength;
+		if (entryEnd > eocdOffset || nameLength === 0) throw new Error("bundle central directory entry 长度无效。");
+		if ((flags & 1) !== 0 || (flags & 64) !== 0) throw new Error("bundle 不允许加密文件。");
+		if (compressionMethod !== 0 && compressionMethod !== 8) throw new Error(`bundle 不支持压缩方法 ${compressionMethod}。`);
+		const rawName = bytes.subarray(cursor + ZIP_CENTRAL_FILE_HEADER_BYTES, cursor + ZIP_CENTRAL_FILE_HEADER_BYTES + nameLength);
+		const name = this.normalizeEntry(this.decodeUtf8(rawName));
+		this.assertRegularFile({
+			externalAttributes,
+			hostSystem: versionMadeBy >>> 8,
+			name
+		});
+		if (uncompressedSize > MAX_FILE_BYTES) throw new Error(`bundle 单文件超过 ${MAX_FILE_BYTES} bytes 上限：${name}`);
+		if (uncompressedSize > 1024 * 1024 && (compressedSize === 0 || uncompressedSize / compressedSize > MAX_COMPRESSION_RATIO)) throw new Error(`bundle 文件压缩比超过 ${MAX_COMPRESSION_RATIO}:1 上限：${name}`);
+		return {
+			entry: {
+				name,
+				uncompressedSize
+			},
+			entryEnd
+		};
+	};
+	findEocdOffset = (view) => {
+		const minimumOffset = Math.max(0, view.byteLength - ZIP_EOCD_MIN_BYTES - ZIP_MAX_COMMENT_BYTES);
+		for (let offset = view.byteLength - ZIP_EOCD_MIN_BYTES; offset >= minimumOffset; offset -= 1) if (view.getUint32(offset, true) === ZIP_EOCD_SIGNATURE) return offset;
+		throw new Error("bundle 缺少有效 ZIP end-of-central-directory。");
+	};
+	assertRegularFile = (params) => {
+		const { externalAttributes, hostSystem, name } = params;
+		if (name.endsWith("/")) throw new Error(`bundle 不允许目录 entry：${name}`);
+		if (hostSystem === 3) {
+			const fileType = externalAttributes >>> 16 & 61440;
+			if (fileType !== 0 && fileType !== 32768) throw new Error(`bundle 只允许普通文件：${name}`);
+			return;
+		}
+		if ((externalAttributes & 16) !== 0) throw new Error(`bundle 只允许普通文件：${name}`);
+	};
+	normalizeArchive = (archive) => {
+		const normalized = {};
+		for (const [rawName, fileBytes] of Object.entries(archive)) {
+			const name = this.normalizeEntry(rawName);
+			if (Object.hasOwn(normalized, name)) throw new Error(`bundle 包含重复路径：${name}`);
+			normalized[name] = fileBytes;
+		}
+		return normalized;
+	};
+	normalizeEntry = (rawName) => {
+		const normalized = rawName.replace(/\\/g, "/");
+		const segments = normalized.split("/");
+		if (!normalized || normalized.startsWith("/") || normalized.includes("\0") || /^[A-Za-z]:/.test(normalized) || segments.some((segment) => !segment || segment === "." || segment === "..")) throw new Error(`bundle 内包含非法路径：${rawName}`);
+		return segments.join("/");
+	};
+	assertCentralEntriesMatchArchive = (entries, archive) => {
+		const centralPaths = entries.map((entry) => entry.name).sort((left, right) => left.localeCompare(right));
+		const archivePaths = Object.keys(archive).sort((left, right) => left.localeCompare(right));
+		if (centralPaths.length !== archivePaths.length || centralPaths.some((entry, index) => entry !== archivePaths[index])) throw new Error("bundle 解压结果与 central directory 不一致。");
+		for (const entry of entries) if (archive[entry.name]?.byteLength !== entry.uncompressedSize) throw new Error(`bundle 解压后文件大小不一致：${entry.name}`);
+	};
+	readMetadata = (archive) => {
+		const raw = this.readJsonEntry(archive, BUNDLE_METADATA_PATH, "bundle metadata");
+		const distributionMode = raw.distributionMode ?? "bundle";
+		if (raw.bundleFormatVersion !== 1 || distributionMode !== "bundle" && distributionMode !== "source" || typeof raw.appId !== "string" || !raw.appId || typeof raw.name !== "string" || !raw.name || typeof raw.version !== "string" || !raw.version || raw.entryManifest !== ENTRY_MANIFEST_PATH || raw.checksumsFile !== CHECKSUMS_PATH) throw new Error("bundle metadata 无效。");
+		return {
+			...raw,
+			distributionMode
+		};
+	};
+	readChecksums = (archive) => {
+		const raw = this.readJsonEntry(archive, CHECKSUMS_PATH, "bundle checksums");
+		if (raw.algorithm !== "sha256" || !this.isRecord(raw.files)) throw new Error("bundle checksums 无效。");
+		return raw;
+	};
+	verifyChecksums = async (archive, checksums) => {
+		const actualPaths = Object.keys(archive).filter((entry) => entry !== CHECKSUMS_PATH).sort((left, right) => left.localeCompare(right));
+		const checksumPaths = Object.keys(checksums.files).map((entry) => this.normalizeEntry(entry)).sort((left, right) => left.localeCompare(right));
+		if (actualPaths.length !== checksumPaths.length || actualPaths.some((entry, index) => entry !== checksumPaths[index])) throw new Error("bundle checksums 必须精确覆盖所有 artifact 文件。");
+		for (const relativePath of actualPaths) {
+			const expectedHash = checksums.files[relativePath];
+			if (!expectedHash || !/^[a-f0-9]{64}$/.test(expectedHash)) throw new Error(`bundle checksum 格式无效：${relativePath}`);
+			if (await this.sha256(archive[relativePath]) !== expectedHash) throw new Error(`bundle checksum 校验失败：${relativePath}`);
+		}
+	};
+	assertManifestContract = (params) => {
+		const { archive, manifest, metadata } = params;
+		const identity = manifest;
+		if (identity.id !== metadata.appId || identity.name !== metadata.name || identity.version !== metadata.version) throw new Error("bundle metadata 与 manifest.json 身份不一致。");
+		if (identity.schemaVersion === 2) {
+			if (metadata.distributionMode !== "bundle") throw new Error("schema v2 组合包只支持 bundle 分发。");
+			if (!Array.isArray(identity.components) || identity.components.length === 0) throw new Error("schema v2 manifest.components 必须是非空数组。");
+			for (const [index, rawComponent] of identity.components.entries()) {
+				if (!this.isRecord(rawComponent)) throw new Error(`manifest.components[${index}] 必须是对象。`);
+				const kind = rawComponent.kind;
+				const componentPath = rawComponent.path;
+				if (kind !== "panel" && kind !== "service" || typeof componentPath !== "string") throw new Error(`manifest.components[${index}] 无效。`);
+				const manifestPath = `${this.normalizeEntry(componentPath)}/${kind === "panel" ? "panel-app.json" : "service-app.json"}`;
+				if (!archive[manifestPath]) throw new Error(`bundle 缺少组件 manifest：${manifestPath}`);
+			}
+			if (!archive["marketplace.json"]) throw new Error("schema v2 bundle 缺少 marketplace.json。");
+		} else if (identity.schemaVersion === 1) {
+			this.assertStandaloneEntry(archive, identity.main, "main.entry");
+			this.assertStandaloneEntry(archive, identity.ui, "ui.entry");
+		} else throw new Error("manifest.schemaVersion 必须是 1 或 2。");
+		if (identity.icon !== void 0) {
+			if (typeof identity.icon !== "string" || !archive[this.normalizeEntry(identity.icon)]) throw new Error("bundle 缺少 manifest.icon 声明的文件。");
+		}
+	};
+	assertStandaloneEntry = (archive, rawContainer, pathLabel) => {
+		if (!this.isRecord(rawContainer) || typeof rawContainer.entry !== "string") throw new Error(`manifest.${pathLabel} 无效。`);
+		const entry = this.normalizeEntry(rawContainer.entry);
+		if (!archive[entry]) throw new Error(`bundle 缺少 manifest.${pathLabel} 文件：${entry}`);
+	};
+	assertExpectedContract = (params) => {
+		const { expected, manifest, metadata } = params;
+		if (expected.appId !== metadata.appId || expected.name !== metadata.name || expected.version !== metadata.version || expected.distributionMode !== metadata.distributionMode) throw new Error("artifact metadata 与 publish payload 不一致。");
+		if (expected.manifest !== void 0 && !this.isJsonSubset(this.toJsonValue(expected.manifest), manifest)) throw new Error("artifact manifest.json 与 publish payload.manifest 不一致。");
+	};
+	readJsonEntry = (archive, entryPath, label) => {
+		const bytes = archive[entryPath];
+		if (!bytes) throw new Error(`bundle 缺少 ${label}。`);
+		try {
+			return JSON.parse(strFromU8(bytes));
+		} catch (error) {
+			throw new Error(`无法读取 ${label}：${error instanceof Error ? error.message : String(error)}`);
+		}
+	};
+	decodeUtf8 = (bytes) => {
+		try {
+			return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		} catch {
+			throw new Error("bundle 文件名不是有效 UTF-8。");
+		}
+	};
+	sha256 = async (bytes) => {
+		const digest = await globalThis.crypto.subtle.digest("SHA-256", new Uint8Array(bytes));
+		return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+	};
+	toJsonValue = (value) => {
+		const serialized = JSON.stringify(value);
+		return serialized === void 0 ? null : JSON.parse(serialized);
+	};
+	isJsonSubset = (expected, actual) => {
+		if (Array.isArray(expected)) return Array.isArray(actual) && expected.length === actual.length && expected.every((entry, index) => this.isJsonSubset(entry, actual[index]));
+		if (this.isRecord(expected)) return this.isRecord(actual) && Object.entries(expected).every(([key, value]) => Object.hasOwn(actual, key) && this.isJsonSubset(value, actual[key]));
+		return Object.is(expected, actual);
+	};
+	isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+};
+//#endregion
+export { AppArtifactValidationService };
+
+//# sourceMappingURL=app-artifact-validation.service.js.map

package/dist/services/app-artifact-validation.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-artifact-validation.service.js","names":[],"sources":["../../src/services/app-artifact-validation.service.ts"],"sourcesContent":["import { strFromU8, unzipSync } from \"fflate\";\nimport type {\n  AppBundleChecksums,\n  AppBundleMetadata,\n  AppDistributionMode,\n} from \"#app-runtime/types/app-bundle.types.js\";\n\nconst MAX_COMPRESSED_BYTES = 25 * 1024 * 1024;\nconst MAX_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;\nconst MAX_FILE_BYTES = 25 * 1024 * 1024;\nconst MAX_FILE_COUNT = 2_000;\nconst MAX_COMPRESSION_RATIO = 200;\nconst CHECKSUMS_PATH = \".napp/checksums.json\";\nconst BUNDLE_METADATA_PATH = \".napp/bundle.json\";\nconst ENTRY_MANIFEST_PATH = \"manifest.json\";\nconst ZIP_EOCD_SIGNATURE = 0x06054b50;\nconst ZIP_CENTRAL_FILE_SIGNATURE = 0x02014b50;\nconst ZIP_EOCD_MIN_BYTES = 22;\nconst ZIP_MAX_COMMENT_BYTES = 0xffff;\nconst ZIP_CENTRAL_FILE_HEADER_BYTES = 46;\n\ntype ArtifactManifestIdentity = {\n  schemaVersion?: unknown;\n  id?: unknown;\n  name?: unknown;\n  version?: unknown;\n  icon?: unknown;\n  main?: unknown;\n  ui?: unknown;\n  components?: unknown;\n};\n\nexport type AppArtifactValidationExpectation = {\n  appId: string;\n  name: string;\n  version: string;\n  distributionMode: AppDistributionMode;\n  manifest?: unknown;\n};\n\nexport type AppArtifactValidationResult = {\n  archive: Record<string, Uint8Array>;\n  artifactSha256: string;\n  metadata: AppBundleMetadata;\n  checksums: AppBundleChecksums;\n  manifest: Record<string, unknown>;\n};\n\ntype ZipCentralEntry = {\n  name: string;\n  uncompressedSize: number;\n};\n\nexport class AppArtifactValidationService {\n  validate = async (params: {\n    bytes: Uint8Array;\n    expected?: AppArtifactValidationExpectation;\n  }): Promise<AppArtifactValidationResult> => {\n    const { bytes, expected } = params;\n    if (bytes.byteLength === 0 || bytes.byteLength > MAX_COMPRESSED_BYTES) {\n      throw new Error(\n        `bundle 压缩体积必须在 1 到 ${MAX_COMPRESSED_BYTES} bytes 之间。`,\n      );\n    }\n    const artifactSha256 = await this.sha256(bytes);\n    const centralEntries = this.readCentralEntries(bytes);\n    const archive = this.normalizeArchive(unzipSync(bytes));\n    this.assertCentralEntriesMatchArchive(centralEntries, archive);\n    const metadata = this.readMetadata(archive);\n    const checksums = this.readChecksums(archive);\n    await this.verifyChecksums(archive, checksums);\n    const manifest = this.readJsonEntry<Record<string, unknown>>(\n      archive,\n      ENTRY_MANIFEST_PATH,\n      \"manifest.json\",\n    );\n    this.assertManifestContract({ archive, manifest, metadata });\n    if (expected) {\n      this.assertExpectedContract({ expected, manifest, metadata });\n    }\n    return { archive, artifactSha256, metadata, checksums, manifest };\n  };\n\n  private readCentralEntries = (bytes: Uint8Array): ZipCentralEntry[] => {\n    const { centralDirectoryOffset, entryCount, eocdOffset, view } =\n      this.readCentralDirectory(bytes);\n    const entries: ZipCentralEntry[] = [];\n    const names = new Set<string>();\n    let cursor = centralDirectoryOffset;\n    let totalUncompressedBytes = 0;\n    for (let index = 0; index < entryCount; index += 1) {\n      const { entry, entryEnd } = this.readCentralEntry({\n        bytes,\n        cursor,\n        eocdOffset,\n        view,\n      });\n      if (names.has(entry.name)) {\n        throw new Error(`bundle 包含重复路径：${entry.name}`);\n      }\n      names.add(entry.name);\n      totalUncompressedBytes += entry.uncompressedSize;\n      if (totalUncompressedBytes > MAX_UNCOMPRESSED_BYTES) {\n        throw new Error(\n          `bundle 解压后超过 ${MAX_UNCOMPRESSED_BYTES} bytes 上限。`,\n        );\n      }\n      entries.push(entry);\n      cursor = entryEnd;\n    }\n    if (cursor !== eocdOffset) {\n      throw new Error(\"bundle central directory 未被精确消费。\");\n    }\n    return entries;\n  };\n\n  private readCentralDirectory = (bytes: Uint8Array) => {\n    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);\n    const eocdOffset = this.findEocdOffset(view);\n    const diskNumber = view.getUint16(eocdOffset + 4, true);\n    const centralDirectoryDisk = view.getUint16(eocdOffset + 6, true);\n    const entryCountOnDisk = view.getUint16(eocdOffset + 8, true);\n    const entryCount = view.getUint16(eocdOffset + 10, true);\n    const centralDirectorySize = view.getUint32(eocdOffset + 12, true);\n    const centralDirectoryOffset = view.getUint32(eocdOffset + 16, true);\n    const commentLength = view.getUint16(eocdOffset + 20, true);\n    if (\n      diskNumber !== 0 ||\n      centralDirectoryDisk !== 0 ||\n      entryCountOnDisk !== entryCount\n    ) {\n      throw new Error(\"bundle 不支持跨磁盘 ZIP。\");\n    }\n    if (\n      entryCount === 0xffff ||\n      centralDirectorySize === 0xffffffff ||\n      centralDirectoryOffset === 0xffffffff\n    ) {\n      throw new Error(\"bundle 不支持 Zip64。\");\n    }\n    if (\n      entryCount === 0 ||\n      entryCount > MAX_FILE_COUNT ||\n      eocdOffset + ZIP_EOCD_MIN_BYTES + commentLength !== bytes.byteLength ||\n      centralDirectoryOffset + centralDirectorySize !== eocdOffset\n    ) {\n      throw new Error(\"bundle central directory 无效。\");\n    }\n    return { centralDirectoryOffset, entryCount, eocdOffset, view };\n  };\n\n  private readCentralEntry = (params: {\n    bytes: Uint8Array;\n    cursor: number;\n    eocdOffset: number;\n    view: DataView;\n  }): { entry: ZipCentralEntry; entryEnd: number } => {\n    const { bytes, cursor, eocdOffset, view } = params;\n    if (\n      cursor + ZIP_CENTRAL_FILE_HEADER_BYTES > eocdOffset ||\n      view.getUint32(cursor, true) !== ZIP_CENTRAL_FILE_SIGNATURE\n    ) {\n      throw new Error(\"bundle central directory entry 无效。\");\n    }\n    const versionMadeBy = view.getUint16(cursor + 4, true);\n    const flags = view.getUint16(cursor + 8, true);\n    const compressionMethod = view.getUint16(cursor + 10, true);\n    const compressedSize = view.getUint32(cursor + 20, true);\n    const uncompressedSize = view.getUint32(cursor + 24, true);\n    const nameLength = view.getUint16(cursor + 28, true);\n    const extraLength = view.getUint16(cursor + 30, true);\n    const entryCommentLength = view.getUint16(cursor + 32, true);\n    const externalAttributes = view.getUint32(cursor + 38, true);\n    const entryEnd =\n      cursor +\n      ZIP_CENTRAL_FILE_HEADER_BYTES +\n      nameLength +\n      extraLength +\n      entryCommentLength;\n    if (entryEnd > eocdOffset || nameLength === 0) {\n      throw new Error(\"bundle central directory entry 长度无效。\");\n    }\n    if ((flags & 0x1) !== 0 || (flags & 0x40) !== 0) {\n      throw new Error(\"bundle 不允许加密文件。\");\n    }\n    if (compressionMethod !== 0 && compressionMethod !== 8) {\n      throw new Error(`bundle 不支持压缩方法 ${compressionMethod}。`);\n    }\n    const rawName = bytes.subarray(\n      cursor + ZIP_CENTRAL_FILE_HEADER_BYTES,\n      cursor + ZIP_CENTRAL_FILE_HEADER_BYTES + nameLength,\n    );\n    const name = this.normalizeEntry(this.decodeUtf8(rawName));\n    this.assertRegularFile({\n      externalAttributes,\n      hostSystem: versionMadeBy >>> 8,\n      name,\n    });\n    if (uncompressedSize > MAX_FILE_BYTES) {\n      throw new Error(\n        `bundle 单文件超过 ${MAX_FILE_BYTES} bytes 上限：${name}`,\n      );\n    }\n    if (\n      uncompressedSize > 1024 * 1024 &&\n      (compressedSize === 0 ||\n        uncompressedSize / compressedSize > MAX_COMPRESSION_RATIO)\n    ) {\n      throw new Error(\n        `bundle 文件压缩比超过 ${MAX_COMPRESSION_RATIO}:1 上限：${name}`,\n      );\n    }\n    return { entry: { name, uncompressedSize }, entryEnd };\n  };\n\n  private findEocdOffset = (view: DataView): number => {\n    const minimumOffset = Math.max(\n      0,\n      view.byteLength - ZIP_EOCD_MIN_BYTES - ZIP_MAX_COMMENT_BYTES,\n    );\n    for (\n      let offset = view.byteLength - ZIP_EOCD_MIN_BYTES;\n      offset >= minimumOffset;\n      offset -= 1\n    ) {\n      if (view.getUint32(offset, true) === ZIP_EOCD_SIGNATURE) {\n        return offset;\n      }\n    }\n    throw new Error(\"bundle 缺少有效 ZIP end-of-central-directory。\");\n  };\n\n  private assertRegularFile = (params: {\n    externalAttributes: number;\n    hostSystem: number;\n    name: string;\n  }): void => {\n    const { externalAttributes, hostSystem, name } = params;\n    if (name.endsWith(\"/\")) {\n      throw new Error(`bundle 不允许目录 entry：${name}`);\n    }\n    if (hostSystem === 3) {\n      const unixMode = externalAttributes >>> 16;\n      const fileType = unixMode & 0xf000;\n      if (fileType !== 0 && fileType !== 0x8000) {\n        throw new Error(`bundle 只允许普通文件：${name}`);\n      }\n      return;\n    }\n    if ((externalAttributes & 0x10) !== 0) {\n      throw new Error(`bundle 只允许普通文件：${name}`);\n    }\n  };\n\n  private normalizeArchive = (\n    archive: Record<string, Uint8Array>,\n  ): Record<string, Uint8Array> => {\n    const normalized: Record<string, Uint8Array> = {};\n    for (const [rawName, fileBytes] of Object.entries(archive)) {\n      const name = this.normalizeEntry(rawName);\n      if (Object.hasOwn(normalized, name)) {\n        throw new Error(`bundle 包含重复路径：${name}`);\n      }\n      normalized[name] = fileBytes;\n    }\n    return normalized;\n  };\n\n  private normalizeEntry = (rawName: string): string => {\n    const normalized = rawName.replace(/\\\\/g, \"/\");\n    const segments = normalized.split(\"/\");\n    if (\n      !normalized ||\n      normalized.startsWith(\"/\") ||\n      normalized.includes(\"\\0\") ||\n      /^[A-Za-z]:/.test(normalized) ||\n      segments.some(\n        (segment) => !segment || segment === \".\" || segment === \"..\",\n      )\n    ) {\n      throw new Error(`bundle 内包含非法路径：${rawName}`);\n    }\n    return segments.join(\"/\");\n  };\n\n  private assertCentralEntriesMatchArchive = (\n    entries: ZipCentralEntry[],\n    archive: Record<string, Uint8Array>,\n  ): void => {\n    const centralPaths = entries\n      .map((entry) => entry.name)\n      .sort((left, right) => left.localeCompare(right));\n    const archivePaths = Object.keys(archive).sort((left, right) =>\n      left.localeCompare(right),\n    );\n    if (\n      centralPaths.length !== archivePaths.length ||\n      centralPaths.some((entry, index) => entry !== archivePaths[index])\n    ) {\n      throw new Error(\"bundle 解压结果与 central directory 不一致。\");\n    }\n    for (const entry of entries) {\n      if (archive[entry.name]?.byteLength !== entry.uncompressedSize) {\n        throw new Error(`bundle 解压后文件大小不一致：${entry.name}`);\n      }\n    }\n  };\n\n  private readMetadata = (\n    archive: Record<string, Uint8Array>,\n  ): AppBundleMetadata => {\n    const raw = this.readJsonEntry<Partial<AppBundleMetadata>>(\n      archive,\n      BUNDLE_METADATA_PATH,\n      \"bundle metadata\",\n    );\n    const distributionMode = raw.distributionMode ?? \"bundle\";\n    if (\n      raw.bundleFormatVersion !== 1 ||\n      (distributionMode !== \"bundle\" && distributionMode !== \"source\") ||\n      typeof raw.appId !== \"string\" ||\n      !raw.appId ||\n      typeof raw.name !== \"string\" ||\n      !raw.name ||\n      typeof raw.version !== \"string\" ||\n      !raw.version ||\n      raw.entryManifest !== ENTRY_MANIFEST_PATH ||\n      raw.checksumsFile !== CHECKSUMS_PATH\n    ) {\n      throw new Error(\"bundle metadata 无效。\");\n    }\n    return { ...raw, distributionMode } as AppBundleMetadata;\n  };\n\n  private readChecksums = (\n    archive: Record<string, Uint8Array>,\n  ): AppBundleChecksums => {\n    const raw = this.readJsonEntry<Partial<AppBundleChecksums>>(\n      archive,\n      CHECKSUMS_PATH,\n      \"bundle checksums\",\n    );\n    if (raw.algorithm !== \"sha256\" || !this.isRecord(raw.files)) {\n      throw new Error(\"bundle checksums 无效。\");\n    }\n    return raw as AppBundleChecksums;\n  };\n\n  private verifyChecksums = async (\n    archive: Record<string, Uint8Array>,\n    checksums: AppBundleChecksums,\n  ): Promise<void> => {\n    const actualPaths = Object.keys(archive)\n      .filter((entry) => entry !== CHECKSUMS_PATH)\n      .sort((left, right) => left.localeCompare(right));\n    const checksumPaths = Object.keys(checksums.files)\n      .map((entry) => this.normalizeEntry(entry))\n      .sort((left, right) => left.localeCompare(right));\n    if (\n      actualPaths.length !== checksumPaths.length ||\n      actualPaths.some((entry, index) => entry !== checksumPaths[index])\n    ) {\n      throw new Error(\"bundle checksums 必须精确覆盖所有 artifact 文件。\");\n    }\n    for (const relativePath of actualPaths) {\n      const expectedHash = checksums.files[relativePath];\n      if (!expectedHash || !/^[a-f0-9]{64}$/.test(expectedHash)) {\n        throw new Error(`bundle checksum 格式无效：${relativePath}`);\n      }\n      const actualHash = await this.sha256(archive[relativePath] as Uint8Array);\n      if (actualHash !== expectedHash) {\n        throw new Error(`bundle checksum 校验失败：${relativePath}`);\n      }\n    }\n  };\n\n  private assertManifestContract = (params: {\n    archive: Record<string, Uint8Array>;\n    manifest: Record<string, unknown>;\n    metadata: AppBundleMetadata;\n  }): void => {\n    const { archive, manifest, metadata } = params;\n    const identity = manifest as ArtifactManifestIdentity;\n    if (\n      identity.id !== metadata.appId ||\n      identity.name !== metadata.name ||\n      identity.version !== metadata.version\n    ) {\n      throw new Error(\"bundle metadata 与 manifest.json 身份不一致。\");\n    }\n    if (identity.schemaVersion === 2) {\n      if (metadata.distributionMode !== \"bundle\") {\n        throw new Error(\"schema v2 组合包只支持 bundle 分发。\");\n      }\n      if (\n        !Array.isArray(identity.components) ||\n        identity.components.length === 0\n      ) {\n        throw new Error(\"schema v2 manifest.components 必须是非空数组。\");\n      }\n      for (const [index, rawComponent] of identity.components.entries()) {\n        if (!this.isRecord(rawComponent)) {\n          throw new Error(`manifest.components[${index}] 必须是对象。`);\n        }\n        const kind = rawComponent.kind;\n        const componentPath = rawComponent.path;\n        if (\n          (kind !== \"panel\" && kind !== \"service\") ||\n          typeof componentPath !== \"string\"\n        ) {\n          throw new Error(`manifest.components[${index}] 无效。`);\n        }\n        const normalizedPath = this.normalizeEntry(componentPath);\n        const manifestPath = `${normalizedPath}/${kind === \"panel\" ? \"panel-app.json\" : \"service-app.json\"}`;\n        if (!archive[manifestPath]) {\n          throw new Error(`bundle 缺少组件 manifest：${manifestPath}`);\n        }\n      }\n      if (!archive[\"marketplace.json\"]) {\n        throw new Error(\"schema v2 bundle 缺少 marketplace.json。\");\n      }\n    } else if (identity.schemaVersion === 1) {\n      this.assertStandaloneEntry(archive, identity.main, \"main.entry\");\n      this.assertStandaloneEntry(archive, identity.ui, \"ui.entry\");\n    } else {\n      throw new Error(\"manifest.schemaVersion 必须是 1 或 2。\");\n    }\n    if (identity.icon !== undefined) {\n      if (\n        typeof identity.icon !== \"string\" ||\n        !archive[this.normalizeEntry(identity.icon)]\n      ) {\n        throw new Error(\"bundle 缺少 manifest.icon 声明的文件。\");\n      }\n    }\n  };\n\n  private assertStandaloneEntry = (\n    archive: Record<string, Uint8Array>,\n    rawContainer: unknown,\n    pathLabel: string,\n  ): void => {\n    if (\n      !this.isRecord(rawContainer) ||\n      typeof rawContainer.entry !== \"string\"\n    ) {\n      throw new Error(`manifest.${pathLabel} 无效。`);\n    }\n    const entry = this.normalizeEntry(rawContainer.entry);\n    if (!archive[entry]) {\n      throw new Error(`bundle 缺少 manifest.${pathLabel} 文件：${entry}`);\n    }\n  };\n\n  private assertExpectedContract = (params: {\n    expected: AppArtifactValidationExpectation;\n    manifest: Record<string, unknown>;\n    metadata: AppBundleMetadata;\n  }): void => {\n    const { expected, manifest, metadata } = params;\n    if (\n      expected.appId !== metadata.appId ||\n      expected.name !== metadata.name ||\n      expected.version !== metadata.version ||\n      expected.distributionMode !== metadata.distributionMode\n    ) {\n      throw new Error(\"artifact metadata 与 publish payload 不一致。\");\n    }\n    if (\n      expected.manifest !== undefined &&\n      !this.isJsonSubset(this.toJsonValue(expected.manifest), manifest)\n    ) {\n      throw new Error(\n        \"artifact manifest.json 与 publish payload.manifest 不一致。\",\n      );\n    }\n  };\n\n  private readJsonEntry = <T>(\n    archive: Record<string, Uint8Array>,\n    entryPath: string,\n    label: string,\n  ): T => {\n    const bytes = archive[entryPath];\n    if (!bytes) {\n      throw new Error(`bundle 缺少 ${label}。`);\n    }\n    try {\n      return JSON.parse(strFromU8(bytes)) as T;\n    } catch (error) {\n      throw new Error(\n        `无法读取 ${label}：${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n  };\n\n  private decodeUtf8 = (bytes: Uint8Array): string => {\n    try {\n      return new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n    } catch {\n      throw new Error(\"bundle 文件名不是有效 UTF-8。\");\n    }\n  };\n\n  private sha256 = async (bytes: Uint8Array): Promise<string> => {\n    const digest = await globalThis.crypto.subtle.digest(\n      \"SHA-256\",\n      new Uint8Array(bytes),\n    );\n    return [...new Uint8Array(digest)]\n      .map((byte) => byte.toString(16).padStart(2, \"0\"))\n      .join(\"\");\n  };\n\n  private toJsonValue = (value: unknown): unknown => {\n    const serialized = JSON.stringify(value);\n    return serialized === undefined\n      ? null\n      : (JSON.parse(serialized) as unknown);\n  };\n\n  private isJsonSubset = (expected: unknown, actual: unknown): boolean => {\n    if (Array.isArray(expected)) {\n      return (\n        Array.isArray(actual) &&\n        expected.length === actual.length &&\n        expected.every((entry, index) =>\n          this.isJsonSubset(entry, actual[index]),\n        )\n      );\n    }\n    if (this.isRecord(expected)) {\n      return (\n        this.isRecord(actual) &&\n        Object.entries(expected).every(\n          ([key, value]) =>\n            Object.hasOwn(actual, key) && this.isJsonSubset(value, actual[key]),\n        )\n      );\n    }\n    return Object.is(expected, actual);\n  };\n\n  private isRecord = (value: unknown): value is Record<string, unknown> =>\n    Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n"],"mappings":";;AAOA,MAAM,uBAAuB,KAAK,OAAO;AACzC,MAAM,yBAAyB,MAAM,OAAO;AAC5C,MAAM,iBAAiB,KAAK,OAAO;AACnC,MAAM,iBAAiB;AACvB,MAAM,wBAAwB;AAC9B,MAAM,iBAAiB;AACvB,MAAM,uBAAuB;AAC7B,MAAM,sBAAsB;AAC5B,MAAM,qBAAqB;AAC3B,MAAM,6BAA6B;AACnC,MAAM,qBAAqB;AAC3B,MAAM,wBAAwB;AAC9B,MAAM,gCAAgC;AAkCtC,IAAa,+BAAb,MAA0C;CACxC,WAAW,OAAO,WAG0B;EAC1C,MAAM,EAAE,OAAO,aAAa;AAC5B,MAAI,MAAM,eAAe,KAAK,MAAM,aAAa,qBAC/C,OAAM,IAAI,MACR,sBAAsB,qBAAqB,YAC5C;EAEH,MAAM,iBAAiB,MAAM,KAAK,OAAO,MAAM;EAC/C,MAAM,iBAAiB,KAAK,mBAAmB,MAAM;EACrD,MAAM,UAAU,KAAK,iBAAiB,UAAU,MAAM,CAAC;AACvD,OAAK,iCAAiC,gBAAgB,QAAQ;EAC9D,MAAM,WAAW,KAAK,aAAa,QAAQ;EAC3C,MAAM,YAAY,KAAK,cAAc,QAAQ;AAC7C,QAAM,KAAK,gBAAgB,SAAS,UAAU;EAC9C,MAAM,WAAW,KAAK,cACpB,SACA,qBACA,gBACD;AACD,OAAK,uBAAuB;GAAE;GAAS;GAAU;GAAU,CAAC;AAC5D,MAAI,SACF,MAAK,uBAAuB;GAAE;GAAU;GAAU;GAAU,CAAC;AAE/D,SAAO;GAAE;GAAS;GAAgB;GAAU;GAAW;GAAU;;CAGnE,sBAA8B,UAAyC;EACrE,MAAM,EAAE,wBAAwB,YAAY,YAAY,SACtD,KAAK,qBAAqB,MAAM;EAClC,MAAM,UAA6B,EAAE;EACrC,MAAM,wBAAQ,IAAI,KAAa;EAC/B,IAAI,SAAS;EACb,IAAI,yBAAyB;AAC7B,OAAK,IAAI,QAAQ,GAAG,QAAQ,YAAY,SAAS,GAAG;GAClD,MAAM,EAAE,OAAO,aAAa,KAAK,iBAAiB;IAChD;IACA;IACA;IACA;IACD,CAAC;AACF,OAAI,MAAM,IAAI,MAAM,KAAK,CACvB,OAAM,IAAI,MAAM,iBAAiB,MAAM,OAAO;AAEhD,SAAM,IAAI,MAAM,KAAK;AACrB,6BAA0B,MAAM;AAChC,OAAI,yBAAyB,uBAC3B,OAAM,IAAI,MACR,gBAAgB,uBAAuB,YACxC;AAEH,WAAQ,KAAK,MAAM;AACnB,YAAS;;AAEX,MAAI,WAAW,WACb,OAAM,IAAI,MAAM,mCAAmC;AAErD,SAAO;;CAGT,wBAAgC,UAAsB;EACpD,MAAM,OAAO,IAAI,SAAS,MAAM,QAAQ,MAAM,YAAY,MAAM,WAAW;EAC3E,MAAM,aAAa,KAAK,eAAe,KAAK;EAC5C,MAAM,aAAa,KAAK,UAAU,aAAa,GAAG,KAAK;EACvD,MAAM,uBAAuB,KAAK,UAAU,aAAa,GAAG,KAAK;EACjE,MAAM,mBAAmB,KAAK,UAAU,aAAa,GAAG,KAAK;EAC7D,MAAM,aAAa,KAAK,UAAU,aAAa,IAAI,KAAK;EACxD,MAAM,uBAAuB,KAAK,UAAU,aAAa,IAAI,KAAK;EAClE,MAAM,yBAAyB,KAAK,UAAU,aAAa,IAAI,KAAK;EACpE,MAAM,gBAAgB,KAAK,UAAU,aAAa,IAAI,KAAK;AAC3D,MACE,eAAe,KACf,yBAAyB,KACzB,qBAAqB,WAErB,OAAM,IAAI,MAAM,qBAAqB;AAEvC,MACE,eAAe,SACf,yBAAyB,cACzB,2BAA2B,WAE3B,OAAM,IAAI,MAAM,oBAAoB;AAEtC,MACE,eAAe,KACf,aAAa,kBACb,aAAa,qBAAqB,kBAAkB,MAAM,cAC1D,yBAAyB,yBAAyB,WAElD,OAAM,IAAI,MAAM,+BAA+B;AAEjD,SAAO;GAAE;GAAwB;GAAY;GAAY;GAAM;;CAGjE,oBAA4B,WAKwB;EAClD,MAAM,EAAE,OAAO,QAAQ,YAAY,SAAS;AAC5C,MACE,SAAS,gCAAgC,cACzC,KAAK,UAAU,QAAQ,KAAK,KAAK,2BAEjC,OAAM,IAAI,MAAM,qCAAqC;EAEvD,MAAM,gBAAgB,KAAK,UAAU,SAAS,GAAG,KAAK;EACtD,MAAM,QAAQ,KAAK,UAAU,SAAS,GAAG,KAAK;EAC9C,MAAM,oBAAoB,KAAK,UAAU,SAAS,IAAI,KAAK;EAC3D,MAAM,iBAAiB,KAAK,UAAU,SAAS,IAAI,KAAK;EACxD,MAAM,mBAAmB,KAAK,UAAU,SAAS,IAAI,KAAK;EAC1D,MAAM,aAAa,KAAK,UAAU,SAAS,IAAI,KAAK;EACpD,MAAM,cAAc,KAAK,UAAU,SAAS,IAAI,KAAK;EACrD,MAAM,qBAAqB,KAAK,UAAU,SAAS,IAAI,KAAK;EAC5D,MAAM,qBAAqB,KAAK,UAAU,SAAS,IAAI,KAAK;EAC5D,MAAM,WACJ,SACA,gCACA,aACA,cACA;AACF,MAAI,WAAW,cAAc,eAAe,EAC1C,OAAM,IAAI,MAAM,uCAAuC;AAEzD,OAAK,QAAQ,OAAS,MAAM,QAAQ,QAAU,EAC5C,OAAM,IAAI,MAAM,kBAAkB;AAEpC,MAAI,sBAAsB,KAAK,sBAAsB,EACnD,OAAM,IAAI,MAAM,kBAAkB,kBAAkB,GAAG;EAEzD,MAAM,UAAU,MAAM,SACpB,SAAS,+BACT,SAAS,gCAAgC,WAC1C;EACD,MAAM,OAAO,KAAK,eAAe,KAAK,WAAW,QAAQ,CAAC;AAC1D,OAAK,kBAAkB;GACrB;GACA,YAAY,kBAAkB;GAC9B;GACD,CAAC;AACF,MAAI,mBAAmB,eACrB,OAAM,IAAI,MACR,gBAAgB,eAAe,YAAY,OAC5C;AAEH,MACE,mBAAmB,OAAO,SACzB,mBAAmB,KAClB,mBAAmB,iBAAiB,uBAEtC,OAAM,IAAI,MACR,kBAAkB,sBAAsB,QAAQ,OACjD;AAEH,SAAO;GAAE,OAAO;IAAE;IAAM;IAAkB;GAAE;GAAU;;CAGxD,kBAA0B,SAA2B;EACnD,MAAM,gBAAgB,KAAK,IACzB,GACA,KAAK,aAAa,qBAAqB,sBACxC;AACD,OACE,IAAI,SAAS,KAAK,aAAa,oBAC/B,UAAU,eACV,UAAU,EAEV,KAAI,KAAK,UAAU,QAAQ,KAAK,KAAK,mBACnC,QAAO;AAGX,QAAM,IAAI,MAAM,4CAA4C;;CAG9D,qBAA6B,WAIjB;EACV,MAAM,EAAE,oBAAoB,YAAY,SAAS;AACjD,MAAI,KAAK,SAAS,IAAI,CACpB,OAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C,MAAI,eAAe,GAAG;GAEpB,MAAM,WADW,uBAAuB,KACZ;AAC5B,OAAI,aAAa,KAAK,aAAa,MACjC,OAAM,IAAI,MAAM,kBAAkB,OAAO;AAE3C;;AAEF,OAAK,qBAAqB,QAAU,EAClC,OAAM,IAAI,MAAM,kBAAkB,OAAO;;CAI7C,oBACE,YAC+B;EAC/B,MAAM,aAAyC,EAAE;AACjD,OAAK,MAAM,CAAC,SAAS,cAAc,OAAO,QAAQ,QAAQ,EAAE;GAC1D,MAAM,OAAO,KAAK,eAAe,QAAQ;AACzC,OAAI,OAAO,OAAO,YAAY,KAAK,CACjC,OAAM,IAAI,MAAM,iBAAiB,OAAO;AAE1C,cAAW,QAAQ;;AAErB,SAAO;;CAGT,kBAA0B,YAA4B;EACpD,MAAM,aAAa,QAAQ,QAAQ,OAAO,IAAI;EAC9C,MAAM,WAAW,WAAW,MAAM,IAAI;AACtC,MACE,CAAC,cACD,WAAW,WAAW,IAAI,IAC1B,WAAW,SAAS,KAAK,IACzB,aAAa,KAAK,WAAW,IAC7B,SAAS,MACN,YAAY,CAAC,WAAW,YAAY,OAAO,YAAY,KACzD,CAED,OAAM,IAAI,MAAM,kBAAkB,UAAU;AAE9C,SAAO,SAAS,KAAK,IAAI;;CAG3B,oCACE,SACA,YACS;EACT,MAAM,eAAe,QAClB,KAAK,UAAU,MAAM,KAAK,CAC1B,MAAM,MAAM,UAAU,KAAK,cAAc,MAAM,CAAC;EACnD,MAAM,eAAe,OAAO,KAAK,QAAQ,CAAC,MAAM,MAAM,UACpD,KAAK,cAAc,MAAM,CAC1B;AACD,MACE,aAAa,WAAW,aAAa,UACrC,aAAa,MAAM,OAAO,UAAU,UAAU,aAAa,OAAO,CAElE,OAAM,IAAI,MAAM,sCAAsC;AAExD,OAAK,MAAM,SAAS,QAClB,KAAI,QAAQ,MAAM,OAAO,eAAe,MAAM,iBAC5C,OAAM,IAAI,MAAM,qBAAqB,MAAM,OAAO;;CAKxD,gBACE,YACsB;EACtB,MAAM,MAAM,KAAK,cACf,SACA,sBACA,kBACD;EACD,MAAM,mBAAmB,IAAI,oBAAoB;AACjD,MACE,IAAI,wBAAwB,KAC3B,qBAAqB,YAAY,qBAAqB,YACvD,OAAO,IAAI,UAAU,YACrB,CAAC,IAAI,SACL,OAAO,IAAI,SAAS,YACpB,CAAC,IAAI,QACL,OAAO,IAAI,YAAY,YACvB,CAAC,IAAI,WACL,IAAI,kBAAkB,uBACtB,IAAI,kBAAkB,eAEtB,OAAM,IAAI,MAAM,sBAAsB;AAExC,SAAO;GAAE,GAAG;GAAK;GAAkB;;CAGrC,iBACE,YACuB;EACvB,MAAM,MAAM,KAAK,cACf,SACA,gBACA,mBACD;AACD,MAAI,IAAI,cAAc,YAAY,CAAC,KAAK,SAAS,IAAI,MAAM,CACzD,OAAM,IAAI,MAAM,uBAAuB;AAEzC,SAAO;;CAGT,kBAA0B,OACxB,SACA,cACkB;EAClB,MAAM,cAAc,OAAO,KAAK,QAAQ,CACrC,QAAQ,UAAU,UAAU,eAAe,CAC3C,MAAM,MAAM,UAAU,KAAK,cAAc,MAAM,CAAC;EACnD,MAAM,gBAAgB,OAAO,KAAK,UAAU,MAAM,CAC/C,KAAK,UAAU,KAAK,eAAe,MAAM,CAAC,CAC1C,MAAM,MAAM,UAAU,KAAK,cAAc,MAAM,CAAC;AACnD,MACE,YAAY,WAAW,cAAc,UACrC,YAAY,MAAM,OAAO,UAAU,UAAU,cAAc,OAAO,CAElE,OAAM,IAAI,MAAM,yCAAyC;AAE3D,OAAK,MAAM,gBAAgB,aAAa;GACtC,MAAM,eAAe,UAAU,MAAM;AACrC,OAAI,CAAC,gBAAgB,CAAC,iBAAiB,KAAK,aAAa,CACvD,OAAM,IAAI,MAAM,wBAAwB,eAAe;AAGzD,OADmB,MAAM,KAAK,OAAO,QAAQ,cAA4B,KACtD,aACjB,OAAM,IAAI,MAAM,wBAAwB,eAAe;;;CAK7D,0BAAkC,WAItB;EACV,MAAM,EAAE,SAAS,UAAU,aAAa;EACxC,MAAM,WAAW;AACjB,MACE,SAAS,OAAO,SAAS,SACzB,SAAS,SAAS,SAAS,QAC3B,SAAS,YAAY,SAAS,QAE9B,OAAM,IAAI,MAAM,yCAAyC;AAE3D,MAAI,SAAS,kBAAkB,GAAG;AAChC,OAAI,SAAS,qBAAqB,SAChC,OAAM,IAAI,MAAM,8BAA8B;AAEhD,OACE,CAAC,MAAM,QAAQ,SAAS,WAAW,IACnC,SAAS,WAAW,WAAW,EAE/B,OAAM,IAAI,MAAM,yCAAyC;AAE3D,QAAK,MAAM,CAAC,OAAO,iBAAiB,SAAS,WAAW,SAAS,EAAE;AACjE,QAAI,CAAC,KAAK,SAAS,aAAa,CAC9B,OAAM,IAAI,MAAM,uBAAuB,MAAM,UAAU;IAEzD,MAAM,OAAO,aAAa;IAC1B,MAAM,gBAAgB,aAAa;AACnC,QACG,SAAS,WAAW,SAAS,aAC9B,OAAO,kBAAkB,SAEzB,OAAM,IAAI,MAAM,uBAAuB,MAAM,OAAO;IAGtD,MAAM,eAAe,GADE,KAAK,eAAe,cAAc,CAClB,GAAG,SAAS,UAAU,mBAAmB;AAChF,QAAI,CAAC,QAAQ,cACX,OAAM,IAAI,MAAM,wBAAwB,eAAe;;AAG3D,OAAI,CAAC,QAAQ,oBACX,OAAM,IAAI,MAAM,wCAAwC;aAEjD,SAAS,kBAAkB,GAAG;AACvC,QAAK,sBAAsB,SAAS,SAAS,MAAM,aAAa;AAChE,QAAK,sBAAsB,SAAS,SAAS,IAAI,WAAW;QAE5D,OAAM,IAAI,MAAM,oCAAoC;AAEtD,MAAI,SAAS,SAAS,KAAA;OAElB,OAAO,SAAS,SAAS,YACzB,CAAC,QAAQ,KAAK,eAAe,SAAS,KAAK,EAE3C,OAAM,IAAI,MAAM,iCAAiC;;;CAKvD,yBACE,SACA,cACA,cACS;AACT,MACE,CAAC,KAAK,SAAS,aAAa,IAC5B,OAAO,aAAa,UAAU,SAE9B,OAAM,IAAI,MAAM,YAAY,UAAU,MAAM;EAE9C,MAAM,QAAQ,KAAK,eAAe,aAAa,MAAM;AACrD,MAAI,CAAC,QAAQ,OACX,OAAM,IAAI,MAAM,sBAAsB,UAAU,MAAM,QAAQ;;CAIlE,0BAAkC,WAItB;EACV,MAAM,EAAE,UAAU,UAAU,aAAa;AACzC,MACE,SAAS,UAAU,SAAS,SAC5B,SAAS,SAAS,SAAS,QAC3B,SAAS,YAAY,SAAS,WAC9B,SAAS,qBAAqB,SAAS,iBAEvC,OAAM,IAAI,MAAM,2CAA2C;AAE7D,MACE,SAAS,aAAa,KAAA,KACtB,CAAC,KAAK,aAAa,KAAK,YAAY,SAAS,SAAS,EAAE,SAAS,CAEjE,OAAM,IAAI,MACR,yDACD;;CAIL,iBACE,SACA,WACA,UACM;EACN,MAAM,QAAQ,QAAQ;AACtB,MAAI,CAAC,MACH,OAAM,IAAI,MAAM,aAAa,MAAM,GAAG;AAExC,MAAI;AACF,UAAO,KAAK,MAAM,UAAU,MAAM,CAAC;WAC5B,OAAO;AACd,SAAM,IAAI,MACR,QAAQ,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GACxE;;;CAIL,cAAsB,UAA8B;AAClD,MAAI;AACF,UAAO,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC,CAAC,OAAO,MAAM;UACxD;AACN,SAAM,IAAI,MAAM,wBAAwB;;;CAI5C,SAAiB,OAAO,UAAuC;EAC7D,MAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAC5C,WACA,IAAI,WAAW,MAAM,CACtB;AACD,SAAO,CAAC,GAAG,IAAI,WAAW,OAAO,CAAC,CAC/B,KAAK,SAAS,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CACjD,KAAK,GAAG;;CAGb,eAAuB,UAA4B;EACjD,MAAM,aAAa,KAAK,UAAU,MAAM;AACxC,SAAO,eAAe,KAAA,IAClB,OACC,KAAK,MAAM,WAAW;;CAG7B,gBAAwB,UAAmB,WAA6B;AACtE,MAAI,MAAM,QAAQ,SAAS,CACzB,QACE,MAAM,QAAQ,OAAO,IACrB,SAAS,WAAW,OAAO,UAC3B,SAAS,OAAO,OAAO,UACrB,KAAK,aAAa,OAAO,OAAO,OAAO,CACxC;AAGL,MAAI,KAAK,SAAS,SAAS,CACzB,QACE,KAAK,SAAS,OAAO,IACrB,OAAO,QAAQ,SAAS,CAAC,OACtB,CAAC,KAAK,WACL,OAAO,OAAO,QAAQ,IAAI,IAAI,KAAK,aAAa,OAAO,OAAO,KAAK,CACtE;AAGL,SAAO,OAAO,GAAG,UAAU,OAAO;;CAGpC,YAAoB,UAClB,QAAQ,MAAM,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM"}

package/dist/services/app-bundle.service.d.ts

@@ -1,10 +1,12 @@
-import { AppManifestService } from "./app-manifest.service.js";
 import { AppBundleExtractResult, AppBundlePackResult, AppDistributionMode } from "../types/app-bundle.types.js";
+import { AppArtifactValidationService } from "./app-artifact-validation.service.js";
+import { AppManifestService } from "./app-manifest.service.js";
 
 //#region src/services/app-bundle.service.d.ts
 declare class AppBundleService {
   private readonly manifestService;
-  constructor(manifestService?: AppManifestService);
+  private readonly artifactValidationService;
+  constructor(manifestService?: AppManifestService, artifactValidationService?: AppArtifactValidationService);
   packAppDirectory: (params: {
     appDirectory: string;
     outputPath?: string;
@@ -27,16 +29,10 @@ declare class AppBundleService {
   private shouldExcludeRuntimePath;
   private shouldExcludeSourcePath;
   private assertFileBudgets;
-  private normalizeArchive;
-  private readMetadataFromArchive;
-  private readChecksumsFromArchive;
-  private verifyArchiveChecksums;
-  private readJsonArchiveEntry;
   private buildMetadata;
   private buildChecksums;
   private computeSha256;
   private normalizeBundleFileName;
-  private normalizeArchiveEntry;
   private isMissingFileError;
   private pathExists;
 }

package/dist/services/app-bundle.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-bundle.service.d.ts","names":[],"sources":["../../src/services/app-bundle.service.ts"],"mappings":";;;;cAyBa,gBAAA;EAAA,iBAEQ,eAAA;cAAA,eAAA,GAAiB,kBAAA;EAGpC,gBAAA,GAA0B,MAAA;IACxB,YAAA;IACA,UAAA;IACA,IAAA,GAAO,mBAAA;EAAA,MACL,OAAA,CAAQ,mBAAA;EAkDZ,aAAA,GAAuB,MAAA;IACrB,UAAA;IACA,eAAA;EAAA,MACE,OAAA,CAAQ,sBAAA;EAAA,QAQJ,oBAAA;EAAA,QAkCA,wBAAA;EAAA,QA+CA,mBAAA;EAAA,QAWA,uBAAA;EAAA,QAiBA,mBAAA;EAAA,QAuBA,kBAAA;EAAA,QAeA,YAAA;EAAA,QAYA,qBAAA;EAAA,QAgCA,2BAAA;EAAA,QAuBA,eAAA;EAAA,QAiBA,wBAAA;EAAA,QAYA,uBAAA;EAAA,QAOA,iBAAA;EAAA,QAiBA,gBAAA;EAAA,QAcA,uBAAA;EAAA,QA4BA,wBAAA;EAAA,QAcA,sBAAA;EAAA,QA4BA,oBAAA;EAAA,QAgBA,aAAA;EAAA,QAeA,cAAA;EAAA,QASA,aAAA;EAAA,QAGA,uBAAA;EAAA,QAGA,qBAAA;EAAA,QAaA,kBAAA;EAAA,QAIA,UAAA;AAAA"}
+{"version":3,"file":"app-bundle.service.d.ts","names":[],"sources":["../../src/services/app-bundle.service.ts"],"mappings":";;;;;cA0Ba,gBAAA;EAAA,iBAEQ,eAAA;EAAA,iBACA,yBAAA;cADA,eAAA,GAAiB,kBAAA,EACjB,yBAAA,GAA2B,4BAAA;EAG9C,gBAAA,GAA0B,MAAA;IACxB,YAAA;IACA,UAAA;IACA,IAAA,GAAO,mBAAA;EAAA,MACL,OAAA,CAAQ,mBAAA;EAkDZ,aAAA,GAAuB,MAAA;IACrB,UAAA;IACA,eAAA;EAAA,MACE,OAAA,CAAQ,sBAAA;EAAA,QAQJ,oBAAA;EAAA,QAeA,wBAAA;EAAA,QA+CA,mBAAA;EAAA,QAWA,uBAAA;EAAA,QAiBA,mBAAA;EAAA,QAuBA,kBAAA;EAAA,QAeA,YAAA;EAAA,QAYA,qBAAA;EAAA,QAgCA,2BAAA;EAAA,QAuBA,eAAA;EAAA,QAiBA,wBAAA;EAAA,QAaA,uBAAA;EAAA,QAOA,iBAAA;EAAA,QAiBA,aAAA;EAAA,QAeA,cAAA;EAAA,QASA,aAAA;EAAA,QAGA,uBAAA;EAAA,QAGA,kBAAA;EAAA,QAIA,UAAA;AAAA"}

package/dist/services/app-bundle.service.js

@@ -1,9 +1,10 @@
+import { AppArtifactValidationService } from "./app-artifact-validation.service.js";
 import { AppManifestService } from "./app-manifest.service.js";
 import { isAppComponentManifestBundle, isAppStandaloneManifestBundle } from "../types/app-manifest.types.js";
 import { createHash, randomUUID } from "node:crypto";
 import { access, lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { strToU8, unzipSync, zipSync } from "fflate";
+import { strToU8, zipSync } from "fflate";
 //#region src/services/app-bundle.service.ts
 const MAX_COMPRESSED_BYTES = 25 * 1024 * 1024;
 const MAX_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
@@ -12,8 +13,9 @@ const MAX_FILE_COUNT = 2e3;
 const CHECKSUMS_PATH = ".napp/checksums.json";
 const BUNDLE_METADATA_PATH = ".napp/bundle.json";
 var AppBundleService = class {
-	constructor(manifestService = new AppManifestService()) {
+	constructor(manifestService = new AppManifestService(), artifactValidationService = new AppArtifactValidationService()) {
 		this.manifestService = manifestService;
+		this.artifactValidationService = artifactValidationService;
 	}
 	packAppDirectory = async (params) => {
 		const { appDirectory, outputPath, mode: requestedMode } = params;
@@ -63,22 +65,9 @@ var AppBundleService = class {
 	readValidatedArchive = async (bundlePath) => {
 		const bundleStats = await stat(bundlePath);
 		if (!bundleStats.isFile() || bundleStats.size > MAX_COMPRESSED_BYTES) throw new Error(`bundle 压缩体积超过 ${MAX_COMPRESSED_BYTES} bytes 上限。`);
-		let fileCount = 0;
-		let totalBytes = 0;
-		const archive = unzipSync(new Uint8Array(await readFile(bundlePath)), { filter: (file) => {
-			fileCount += 1;
-			totalBytes += file.originalSize;
-			if (fileCount > MAX_FILE_COUNT) throw new Error(`bundle 文件数超过 ${MAX_FILE_COUNT} 上限。`);
-			if (file.originalSize > MAX_FILE_BYTES) throw new Error(`bundle 单文件超过 ${MAX_FILE_BYTES} bytes 上限：${file.name}`);
-			if (totalBytes > MAX_UNCOMPRESSED_BYTES) throw new Error(`bundle 解压后超过 ${MAX_UNCOMPRESSED_BYTES} bytes 上限。`);
-			return true;
-		} });
-		const normalizedArchive = this.normalizeArchive(archive);
-		const metadata = this.readMetadataFromArchive(normalizedArchive);
-		const checksums = this.readChecksumsFromArchive(normalizedArchive);
-		this.verifyArchiveChecksums(normalizedArchive, checksums);
+		const { archive, metadata, checksums } = await this.artifactValidationService.validate({ bytes: new Uint8Array(await readFile(bundlePath)) });
 		return {
-			archive: normalizedArchive,
+			archive,
 			metadata,
 			checksums
 		};
@@ -210,7 +199,7 @@ var AppBundleService = class {
 		}
 	};
 	shouldExcludeRuntimePath = (relativePath) => {
-		return relativePath.split("/").some((segment) => segment === "node_modules" || segment === ".git" || segment === "coverage" || segment === "tests" || segment === "__tests__" || segment === "fixtures") || /(?:^|\/)\.(?:DS_Store|eslintcache)$/.test(relativePath) || relativePath.endsWith(".map");
+		return relativePath.split("/").some((segment) => segment === "node_modules" || segment === ".git" || segment === "marketplace-assets" || segment === "coverage" || segment === "tests" || segment === "__tests__" || segment === "fixtures") || /(?:^|\/)\.(?:DS_Store|eslintcache)$/.test(relativePath) || relativePath.endsWith(".map");
 	};
 	shouldExcludeSourcePath = (relativePath) => {
 		return this.shouldExcludeRuntimePath(relativePath) || relativePath === ".napp" || relativePath.startsWith(".napp/") || relativePath === "main/dist" || relativePath.startsWith("main/dist/") || relativePath === "main/generated" || relativePath.startsWith("main/generated/");
@@ -225,48 +214,6 @@ var AppBundleService = class {
 		}
 		if (totalBytes > MAX_UNCOMPRESSED_BYTES) throw new Error(`bundle 解压后超过 ${MAX_UNCOMPRESSED_BYTES} bytes 上限。`);
 	};
-	normalizeArchive = (archive) => {
-		const normalizedArchive = {};
-		for (const [entryName, bytes] of Object.entries(archive)) {
-			const normalizedEntry = this.normalizeArchiveEntry(entryName);
-			if (Object.hasOwn(normalizedArchive, normalizedEntry)) throw new Error(`bundle 包含重复路径：${normalizedEntry}`);
-			normalizedArchive[normalizedEntry] = bytes;
-		}
-		return normalizedArchive;
-	};
-	readMetadataFromArchive = (archive) => {
-		const raw = this.readJsonArchiveEntry(archive, BUNDLE_METADATA_PATH, "bundle metadata");
-		const distributionMode = raw.distributionMode === void 0 ? "bundle" : raw.distributionMode;
-		if (raw.bundleFormatVersion !== 1 || distributionMode !== "bundle" && distributionMode !== "source" || typeof raw.appId !== "string" || !raw.appId || typeof raw.name !== "string" || !raw.name || typeof raw.version !== "string" || !raw.version || raw.entryManifest !== "manifest.json" || raw.checksumsFile !== CHECKSUMS_PATH) throw new Error("bundle metadata 无效。");
-		return {
-			...raw,
-			distributionMode
-		};
-	};
-	readChecksumsFromArchive = (archive) => {
-		const raw = this.readJsonArchiveEntry(archive, CHECKSUMS_PATH, "bundle checksums");
-		if (raw.algorithm !== "sha256" || !raw.files || typeof raw.files !== "object") throw new Error("bundle checksums 无效。");
-		return raw;
-	};
-	verifyArchiveChecksums = (archive, checksums) => {
-		const actualPaths = Object.keys(archive).filter((entry) => entry !== CHECKSUMS_PATH).sort((left, right) => left.localeCompare(right));
-		const checksumPaths = Object.keys(checksums.files).map((entry) => this.normalizeArchiveEntry(entry)).sort((left, right) => left.localeCompare(right));
-		if (actualPaths.length !== checksumPaths.length || actualPaths.some((entry, index) => entry !== checksumPaths[index])) throw new Error("bundle checksums 必须精确覆盖所有 artifact 文件。");
-		for (const relativePath of actualPaths) {
-			const expectedHash = checksums.files[relativePath];
-			if (!expectedHash || !/^[a-f0-9]{64}$/.test(expectedHash)) throw new Error(`bundle checksum 格式无效：${relativePath}`);
-			if (this.computeSha256(archive[relativePath]) !== expectedHash) throw new Error(`bundle checksum 校验失败：${relativePath}`);
-		}
-	};
-	readJsonArchiveEntry = (archive, entryPath, label) => {
-		const bytes = archive[entryPath];
-		if (!bytes) throw new Error(`bundle 缺少 ${label}。`);
-		try {
-			return JSON.parse(Buffer.from(bytes).toString("utf-8"));
-		} catch (error) {
-			throw new Error(`无法读取 ${label}：${error instanceof Error ? error.message : String(error)}`);
-		}
-	};
 	buildMetadata = (appId, name, version, distributionMode) => ({
 		bundleFormatVersion: 1,
 		distributionMode,
@@ -282,12 +229,6 @@ var AppBundleService = class {
 	});
 	computeSha256 = (fileBytes) => createHash("sha256").update(Buffer.from(fileBytes)).digest("hex");
 	normalizeBundleFileName = (appId) => appId.replace(/[^a-zA-Z0-9._-]+/g, "-");
-	normalizeArchiveEntry = (entryName) => {
-		const normalized = entryName.replace(/\\/g, "/");
-		const segments = normalized.split("/");
-		if (!normalized || normalized.startsWith("/") || normalized.includes("\0") || /^[A-Za-z]:/.test(normalized) || segments.some((segment) => !segment || segment === "." || segment === "..")) throw new Error(`bundle 内包含非法路径：${entryName}`);
-		return segments.join("/");
-	};
 	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 	pathExists = async (targetPath) => {
 		try {