@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/compiler/schema-to-typescript.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SchemaTypeGenerationError = void 0;
+exports.schemaToTypeExpression = schemaToTypeExpression;
+/** Deterministic Draft 2020-12 JSON Schema -> TypeScript type expressions. */
+class SchemaTypeGenerationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SchemaTypeGenerationError';
+    }
+}
+exports.SchemaTypeGenerationError = SchemaTypeGenerationError;
+function literal(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'string' || typeof value === 'boolean' || typeof value === 'number') {
+        if (typeof value === 'number' && !Number.isFinite(value))
+            throw new SchemaTypeGenerationError('schema literal must be finite');
+        return JSON.stringify(value);
+    }
+    throw new SchemaTypeGenerationError('enum/const values must be scalar JSON values');
+}
+function resolvePointer(root, pointer) {
+    if (!pointer.startsWith('#/'))
+        throw new SchemaTypeGenerationError(`only local JSON Pointer $ref is supported: ${pointer}`);
+    let current = root;
+    for (const raw of pointer.slice(2).split('/')) {
+        const segment = raw.replace(/~1/g, '/').replace(/~0/g, '~');
+        if (!current || typeof current !== 'object' || !(segment in current)) {
+            throw new SchemaTypeGenerationError(`unresolved local $ref: ${pointer}`);
+        }
+        current = current[segment];
+    }
+    if (!current || typeof current !== 'object' || Array.isArray(current)) {
+        throw new SchemaTypeGenerationError(`$ref target is not a schema object: ${pointer}`);
+    }
+    return current;
+}
+function expression(schema, root, refs, depth) {
+    if (depth > 12)
+        throw new SchemaTypeGenerationError('schema type depth exceeds 12');
+    if (typeof schema.$ref === 'string') {
+        if (refs.has(schema.$ref))
+            throw new SchemaTypeGenerationError(`recursive $ref is forbidden: ${schema.$ref}`);
+        const next = new Set(refs);
+        next.add(schema.$ref);
+        return expression(resolvePointer(root, schema.$ref), root, next, depth + 1);
+    }
+    if ('const' in schema)
+        return literal(schema.const);
+    if (Array.isArray(schema.enum)) {
+        if (schema.enum.length === 0)
+            throw new SchemaTypeGenerationError('enum must be non-empty');
+        return schema.enum.map(literal).join(' | ');
+    }
+    for (const unionKey of ['oneOf', 'anyOf']) {
+        const branches = schema[unionKey];
+        if (Array.isArray(branches)) {
+            if (branches.length === 0)
+                throw new SchemaTypeGenerationError(`${unionKey} must be non-empty`);
+            return branches.map((branch) => {
+                if (!branch || typeof branch !== 'object' || Array.isArray(branch))
+                    throw new SchemaTypeGenerationError(`${unionKey} branch must be an object`);
+                return `(${expression(branch, root, refs, depth + 1)})`;
+            }).join(' | ');
+        }
+    }
+    if (Array.isArray(schema.allOf)) {
+        if (schema.allOf.length === 0)
+            throw new SchemaTypeGenerationError('allOf must be non-empty');
+        return schema.allOf.map((branch) => {
+            if (!branch || typeof branch !== 'object' || Array.isArray(branch))
+                throw new SchemaTypeGenerationError('allOf branch must be an object');
+            return `(${expression(branch, root, refs, depth + 1)})`;
+        }).join(' & ');
+    }
+    switch (schema.type) {
+        case 'string': return 'string';
+        case 'number':
+        case 'integer': return 'number';
+        case 'boolean': return 'boolean';
+        case 'null': return 'null';
+        case 'array': {
+            const items = schema.items;
+            if (!items || typeof items !== 'object' || Array.isArray(items))
+                throw new SchemaTypeGenerationError('array schema requires one object items schema');
+            return `ReadonlyArray<${expression(items, root, refs, depth + 1)}>`;
+        }
+        case 'object': {
+            if (schema.additionalProperties !== false)
+                throw new SchemaTypeGenerationError('object schema requires additionalProperties:false');
+            const properties = schema.properties;
+            if (properties !== undefined && (!properties || typeof properties !== 'object' || Array.isArray(properties))) {
+                throw new SchemaTypeGenerationError('properties must be an object');
+            }
+            const requiredValues = schema.required ?? [];
+            if (!Array.isArray(requiredValues) || !requiredValues.every((entry) => typeof entry === 'string')) {
+                throw new SchemaTypeGenerationError('required must be a string array');
+            }
+            const required = new Set(requiredValues);
+            const entries = Object.entries((properties ?? {}))
+                .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+                .map(([name, child]) => {
+                if (!child || typeof child !== 'object' || Array.isArray(child))
+                    throw new SchemaTypeGenerationError(`property ${name} must be a schema object`);
+                return `readonly ${JSON.stringify(name)}${required.has(name) ? '' : '?'}: ${expression(child, root, refs, depth + 1)};`;
+            });
+            for (const name of required) {
+                if (!Object.prototype.hasOwnProperty.call(properties ?? {}, name))
+                    throw new SchemaTypeGenerationError(`required property is not declared: ${name}`);
+            }
+            return `{ ${entries.join(' ')} }`;
+        }
+        default:
+            throw new SchemaTypeGenerationError(`unsupported or missing schema type: ${String(schema.type)}`);
+    }
+}
+function schemaToTypeExpression(schema) {
+    if (!schema || typeof schema !== 'object' || Array.isArray(schema)) {
+        throw new SchemaTypeGenerationError('schema root must be an object');
+    }
+    const root = schema;
+    if (root.type !== 'object')
+        throw new SchemaTypeGenerationError('action input/output schema root must have type:object');
+    return expression(root, root, new Set(), 0);
+}
+//# sourceMappingURL=schema-to-typescript.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/compiler/schema-to-typescript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-to-typescript.js","sourceRoot":"","sources":["../../src/compiler/schema-to-typescript.ts"],"names":[],"mappings":";;;AAwGA,wDAOC;AA/GD,8EAA8E;AAC9E,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AALD,8DAKC;AAID,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,CAAC,CAAC;QAC/H,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,yBAAyB,CAAC,8CAA8C,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe;IACnD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,8CAA8C,OAAO,EAAE,CAAC,CAAC;IAC5H,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,yBAAyB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,IAAiB,EAAE,KAAa;IAChF,IAAI,KAAK,GAAG,EAAE;QAAE,MAAM,IAAI,yBAAyB,CAAC,8BAA8B,CAAC,CAAC;IACpF,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,IAAI,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,yBAAyB,CAAC,GAAG,QAAQ,oBAAoB,CAAC,CAAC;YAChG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,yBAAyB,CAAC,GAAG,QAAQ,2BAA2B,CAAC,CAAC;gBAChJ,OAAO,IAAI,UAAU,CAAC,MAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;YACpE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACjC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,CAAC,CAAC;YAC1I,OAAO,IAAI,UAAU,CAAC,MAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;QACpE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC/B,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC,CAAC,OAAO,QAAQ,CAAC;QAChC,KAAK,SAAS,CAAC,CAAC,OAAO,SAAS,CAAC;QACjC,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;QAC3B,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,yBAAyB,CAAC,+CAA+C,CAAC,CAAC;YACtJ,OAAO,iBAAiB,UAAU,CAAC,KAAe,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;QAChF,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,MAAM,CAAC,oBAAoB,KAAK,KAAK;gBAAE,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;YACpI,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YACrC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC7G,MAAM,IAAI,yBAAyB,CAAC,8BAA8B,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAClG,MAAM,IAAI,yBAAyB,CAAC,iCAAiC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAA0B,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;iBAC1E,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;gBACrB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,yBAAyB,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;gBACjJ,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,KAAe,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;YACpI,CAAC,CAAC,CAAC;YACL,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,CAAC;oBAAE,MAAM,IAAI,yBAAyB,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;YACvJ,CAAC;YACD,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QACpC,CAAC;QACD;YACE,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CAAC,MAAe;IACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,MAAgB,CAAC;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,yBAAyB,CAAC,uDAAuD,CAAC,CAAC;IACzH,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/index.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Pure compiler interfaces for code-authoring (executable-asset design §3.2 / §7).
+ *
+ * The ONLY compiler/static/schema/inventory implementation shared by the CLI
+ * local build and the backend server recompile. Implementations arrive in
+ * Phase 3; this file freezes the public surface so CLI and backend can depend
+ * on the same types before the bodies exist.
+ *
+ * No Nest, TypeORM, network, database, credential or runtime execution
+ * dependency (design §3.2).
+ */
+import type { JsonValue } from '@nexusclaw/shared';
+export { buildManifestInventory, type InventoryEntry, type InventoryFile, type InventoryManifest, type InventoryResult, } from './package/manifest-inventory';
+export { assertSafeArchivePath, assertNoPathCollisions, assertRegularFile, } from './package/archive-safety';
+export { schemaToTypeExpression, SchemaTypeGenerationError, } from './compiler/schema-to-typescript';
+export { buildCanonicalZip, assertCanonicalZip, readCanonicalZip, CanonicalZipError, type CanonicalZipEntryInput, type CanonicalZipReadResult, } from './package/canonical-zip';
+export { buildWorkforceBundleInventory, type WorkforceBundleInventoryResult, } from './package/workforce-bundle-inventory';
+export { compileAction, FROZEN_COMPILER_OPTIONS, COMPILER_STAMP } from './compiler/code-action-compiler';
+export { computeDescriptorHash, computePublishedChecksum, computeLocalBuildDigest, type DescriptorHashInput, type PublishedChecksumInput, } from './compiler/checksums';
+export { analyzeDeniedConstructs } from './analysis/code-static-analysis';
+export { extractCapabilities, compareCapabilities, type CapabilityExtractionResult, type DeclaredCapabilities, } from './analysis/capability-extractor';
+export { validateSchemaDefinition, validateWithFrozenSchema, createFrozenAjv, type SchemaValidationResult, } from './schema/code-schema-loader';
+export { parseLocalRunnerLockV1, type LocalRunnerLockV1, } from './runtime/local-runner-lock';
+/** A diagnostic emitted by the compiler or static analyzer. */
+export interface AuthoringDiagnostic {
+    code: string;
+    severity: 'error' | 'warning' | 'info';
+    file?: string;
+    line?: number;
+    column?: number;
+    jsonPath?: string;
+    ruleId?: string;
+    message: string;
+    fixHint?: string;
+}
+/** Frozen TypeScript compiler options (design §7.2). Implemented Phase 3. */
+export interface CodeActionCompilerOptions {
+    readonly typescriptVersion: '5.9.3';
+    readonly target: string;
+    readonly module: string;
+    readonly strict: boolean;
+    readonly noEmitOnError: boolean;
+}
+/** Result of compiling a single ACTION source (design §7 / §10.3). */
+export interface CompileActionResult {
+    readonly success: boolean;
+    /** Deterministic server-produced CommonJS for the ACTION source only. */
+    readonly compiledCode: string;
+    readonly sourceHash: `sha256:${string}`;
+    readonly compiledHash: `sha256:${string}`;
+    readonly compilerOptionsHash: `sha256:${string}`;
+    readonly sdkDeclarationHash: `sha256:${string}`;
+    readonly diagnostics: ReadonlyArray<AuthoringDiagnostic>;
+}
+/** Pure compiler interface — strict semantic typecheck + deterministic compile. */
+export interface CodeActionCompiler {
+    readonly options: CodeActionCompilerOptions;
+    compile(args: {
+        sourcePath: string;
+        source: string;
+        inputSchema: JsonValue;
+        outputSchema: JsonValue;
+        sdkDeclarations: string;
+    }): Promise<CompileActionResult>;
+}
+/** Pure JSON-Schema loader/validator (AJV Draft 2020-12, design §9). */
+export interface CodeSchemaLoader {
+    validate(args: {
+        schema: JsonValue;
+        instance: JsonValue;
+    }): Promise<{
+        valid: boolean;
+        diagnostics: ReadonlyArray<AuthoringDiagnostic>;
+    }>;
+}
+/** Manifest-derived package inventory (design §10.2). Implemented Phase 3. */
+export interface PackageInventoryEntry {
+    readonly path: string;
+    readonly rawFileDigest: `sha256:${string}`;
+    readonly semanticEntryDigest: `sha256:${string}`;
+}
+export interface PackageInventoryResult {
+    readonly entries: ReadonlyArray<PackageInventoryEntry>;
+    readonly packageDigest: `sha256:${string}`;
+    readonly portableBundleDigest?: `sha256:${string}`;
+}
+/** Pure manifest-derived inventory builder. */
+export interface ManifestInventoryBuilder {
+    build(args: {
+        manifestPath: string;
+        manifest: JsonValue;
+        readFile: (relativePath: string) => Promise<Uint8Array>;
+    }): Promise<PackageInventoryResult>;
+}
+/** Canonical ZIP archive (design §10.4, `zip-store-v1`). Implemented Phase 3. */
+export interface CanonicalZipArchive {
+    readonly archiveDigest: `sha256:${string}`;
+    readonly format: 'zip-store-v1';
+    readonly bytes: Uint8Array;
+}
+/** Pure canonical-zip builder (STORE only, fixed timestamp/mode/order). */
+export interface CanonicalZipBuilder {
+    build(args: {
+        entries: ReadonlyArray<{
+            path: string;
+            bytes: Uint8Array;
+        }>;
+    }): Promise<CanonicalZipArchive>;
+}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/index.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseLocalRunnerLockV1 = exports.createFrozenAjv = exports.validateWithFrozenSchema = exports.validateSchemaDefinition = exports.compareCapabilities = exports.extractCapabilities = exports.analyzeDeniedConstructs = exports.computeLocalBuildDigest = exports.computePublishedChecksum = exports.computeDescriptorHash = exports.COMPILER_STAMP = exports.FROZEN_COMPILER_OPTIONS = exports.compileAction = exports.buildWorkforceBundleInventory = exports.CanonicalZipError = exports.readCanonicalZip = exports.assertCanonicalZip = exports.buildCanonicalZip = exports.SchemaTypeGenerationError = exports.schemaToTypeExpression = exports.assertRegularFile = exports.assertNoPathCollisions = exports.assertSafeArchivePath = exports.buildManifestInventory = void 0;
+var manifest_inventory_1 = require("./package/manifest-inventory");
+Object.defineProperty(exports, "buildManifestInventory", { enumerable: true, get: function () { return manifest_inventory_1.buildManifestInventory; } });
+var archive_safety_1 = require("./package/archive-safety");
+Object.defineProperty(exports, "assertSafeArchivePath", { enumerable: true, get: function () { return archive_safety_1.assertSafeArchivePath; } });
+Object.defineProperty(exports, "assertNoPathCollisions", { enumerable: true, get: function () { return archive_safety_1.assertNoPathCollisions; } });
+Object.defineProperty(exports, "assertRegularFile", { enumerable: true, get: function () { return archive_safety_1.assertRegularFile; } });
+var schema_to_typescript_1 = require("./compiler/schema-to-typescript");
+Object.defineProperty(exports, "schemaToTypeExpression", { enumerable: true, get: function () { return schema_to_typescript_1.schemaToTypeExpression; } });
+Object.defineProperty(exports, "SchemaTypeGenerationError", { enumerable: true, get: function () { return schema_to_typescript_1.SchemaTypeGenerationError; } });
+var canonical_zip_1 = require("./package/canonical-zip");
+Object.defineProperty(exports, "buildCanonicalZip", { enumerable: true, get: function () { return canonical_zip_1.buildCanonicalZip; } });
+Object.defineProperty(exports, "assertCanonicalZip", { enumerable: true, get: function () { return canonical_zip_1.assertCanonicalZip; } });
+Object.defineProperty(exports, "readCanonicalZip", { enumerable: true, get: function () { return canonical_zip_1.readCanonicalZip; } });
+Object.defineProperty(exports, "CanonicalZipError", { enumerable: true, get: function () { return canonical_zip_1.CanonicalZipError; } });
+var workforce_bundle_inventory_1 = require("./package/workforce-bundle-inventory");
+Object.defineProperty(exports, "buildWorkforceBundleInventory", { enumerable: true, get: function () { return workforce_bundle_inventory_1.buildWorkforceBundleInventory; } });
+var code_action_compiler_1 = require("./compiler/code-action-compiler");
+Object.defineProperty(exports, "compileAction", { enumerable: true, get: function () { return code_action_compiler_1.compileAction; } });
+Object.defineProperty(exports, "FROZEN_COMPILER_OPTIONS", { enumerable: true, get: function () { return code_action_compiler_1.FROZEN_COMPILER_OPTIONS; } });
+Object.defineProperty(exports, "COMPILER_STAMP", { enumerable: true, get: function () { return code_action_compiler_1.COMPILER_STAMP; } });
+var checksums_1 = require("./compiler/checksums");
+Object.defineProperty(exports, "computeDescriptorHash", { enumerable: true, get: function () { return checksums_1.computeDescriptorHash; } });
+Object.defineProperty(exports, "computePublishedChecksum", { enumerable: true, get: function () { return checksums_1.computePublishedChecksum; } });
+Object.defineProperty(exports, "computeLocalBuildDigest", { enumerable: true, get: function () { return checksums_1.computeLocalBuildDigest; } });
+var code_static_analysis_1 = require("./analysis/code-static-analysis");
+Object.defineProperty(exports, "analyzeDeniedConstructs", { enumerable: true, get: function () { return code_static_analysis_1.analyzeDeniedConstructs; } });
+var capability_extractor_1 = require("./analysis/capability-extractor");
+Object.defineProperty(exports, "extractCapabilities", { enumerable: true, get: function () { return capability_extractor_1.extractCapabilities; } });
+Object.defineProperty(exports, "compareCapabilities", { enumerable: true, get: function () { return capability_extractor_1.compareCapabilities; } });
+var code_schema_loader_1 = require("./schema/code-schema-loader");
+Object.defineProperty(exports, "validateSchemaDefinition", { enumerable: true, get: function () { return code_schema_loader_1.validateSchemaDefinition; } });
+Object.defineProperty(exports, "validateWithFrozenSchema", { enumerable: true, get: function () { return code_schema_loader_1.validateWithFrozenSchema; } });
+Object.defineProperty(exports, "createFrozenAjv", { enumerable: true, get: function () { return code_schema_loader_1.createFrozenAjv; } });
+var local_runner_lock_1 = require("./runtime/local-runner-lock");
+Object.defineProperty(exports, "parseLocalRunnerLockV1", { enumerable: true, get: function () { return local_runner_lock_1.parseLocalRunnerLockV1; } });
+//# sourceMappingURL=index.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAaA,mEAMsC;AALpC,4HAAA,sBAAsB,OAAA;AAMxB,2DAIkC;AAHhC,uHAAA,qBAAqB,OAAA;AACrB,wHAAA,sBAAsB,OAAA;AACtB,mHAAA,iBAAiB,OAAA;AAEnB,wEAGyC;AAFvC,8HAAA,sBAAsB,OAAA;AACtB,iIAAA,yBAAyB,OAAA;AAE3B,yDAOiC;AAN/B,kHAAA,iBAAiB,OAAA;AACjB,mHAAA,kBAAkB,OAAA;AAClB,iHAAA,gBAAgB,OAAA;AAChB,kHAAA,iBAAiB,OAAA;AAInB,mFAG8C;AAF5C,2IAAA,6BAA6B,OAAA;AAG/B,wEAAyG;AAAhG,qHAAA,aAAa,OAAA;AAAE,+HAAA,uBAAuB,OAAA;AAAE,sHAAA,cAAc,OAAA;AAC/D,kDAM8B;AAL5B,kHAAA,qBAAqB,OAAA;AACrB,qHAAA,wBAAwB,OAAA;AACxB,oHAAA,uBAAuB,OAAA;AAIzB,wEAA0E;AAAjE,+HAAA,uBAAuB,OAAA;AAChC,wEAKyC;AAJvC,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AAIrB,kEAKqC;AAJnC,8HAAA,wBAAwB,OAAA;AACxB,8HAAA,wBAAwB,OAAA;AACxB,qHAAA,eAAe,OAAA;AAGjB,iEAGqC;AAFnC,2HAAA,sBAAsB,OAAA"}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/archive-safety.d.ts

@@ -0,0 +1,31 @@
+export declare class ArchiveSafetyError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Assert a package-relative path is safe to ship in a canonical archive.
+ * Throws `ArchiveSafetyError` (design §20 codes) on any violation.
+ *
+ * `rootDir` is the POSIX-normalised package root; `path` must be relative to it
+ * (no leading slash) and must not escape via `..`.
+ */
+export declare function assertSafeArchivePath(path: string): void;
+/**
+ * Assert a file entry is a regular file (not a symlink/hardlink/socket/device).
+ * The caller passes the stat-like metadata; this rejects non-regular files.
+ */
+export declare function assertRegularFile(args: {
+    path: string;
+    isSymbolicLink?: boolean;
+    isBlockDevice?: boolean;
+    isCharacterDevice?: boolean;
+    isFIFO?: boolean;
+    isSocket?: boolean;
+    hardlinkCount?: number;
+}): void;
+/**
+ * Detect case-fold / Unicode collisions across a set of inventory paths.
+ * Throws `PACKAGE_ARCHIVE_COLLISION` if two paths differ only by case or NFC
+ * normalisation (design §10.4).
+ */
+export declare function assertNoPathCollisions(paths: ReadonlyArray<string>): void;

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/archive-safety.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArchiveSafetyError = void 0;
+exports.assertSafeArchivePath = assertSafeArchivePath;
+exports.assertRegularFile = assertRegularFile;
+exports.assertNoPathCollisions = assertNoPathCollisions;
+/**
+ * Archive safety — path/file rejection rules (executable-asset design §10.2 /
+ * §3.3, task 3.3).
+ *
+ * Every inventory path must pass `assertSafeArchivePath` before it enters the
+ * canonical archive. Rejects: absolute / traversal / case-collision /
+ * symlink-name / hardlink-name / device / secret-like / out-of-root paths.
+ *
+ * These are FATAL even when the file is referenced by the manifest (design
+ * §10.2 line 1131): secret-like files (`.env*`, private keys, credential
+ * exports, auth caches), symlinks, hardlinks, sockets, devices and entries
+ * outside root are never shipped.
+ */
+const SECRET_LIKE_PATTERNS = [
+    /(^|\/)\.env(\..*)?$/i, // .env, .env.local, .env.production, ...
+    /(^|\/)(id_rsa|id_ed25519|id_ecdsa|id_dsa)(\.pub)?$/i, // SSH keys
+    /\.(pem|key|p12|pfx|keystore|jks)$/i, // private key / cert material
+    /(^|\/)(credentials|credentials\.json|creds\.json)$/i, // credential exports
+    /\.(oauth2?token|accesstoken|refreshtoken)$/i, // auth caches
+    /(^|\/)\.aws[/_-]/i, // AWS credential files
+    /(^|\/)\.npmrc$/i, // npm tokens
+];
+const FORBIDDEN_BASENAMES = new Set([
+    '.gitignore',
+    '.gitattributes',
+    '.DS_Store',
+    'Thumbs.db',
+]);
+class ArchiveSafetyError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ArchiveSafetyError';
+    }
+}
+exports.ArchiveSafetyError = ArchiveSafetyError;
+/**
+ * Assert a package-relative path is safe to ship in a canonical archive.
+ * Throws `ArchiveSafetyError` (design §20 codes) on any violation.
+ *
+ * `rootDir` is the POSIX-normalised package root; `path` must be relative to it
+ * (no leading slash) and must not escape via `..`.
+ */
+function assertSafeArchivePath(path) {
+    if (path.length === 0) {
+        throw new ArchiveSafetyError('PACKAGE_PATH_ESCAPE', 'empty inventory path');
+    }
+    // POSIX-normalise backslashes (reject Windows-style paths).
+    if (path.includes('\\')) {
+        throw new ArchiveSafetyError('PACKAGE_PATH_ESCAPE', `backslash in path: ${path}`);
+    }
+    if (path.includes('\u0000')) {
+        throw new ArchiveSafetyError('PACKAGE_PATH_ESCAPE', `NUL byte in path: ${path}`);
+    }
+    if (path.startsWith('/')) {
+        throw new ArchiveSafetyError('PACKAGE_PATH_ESCAPE', `absolute path: ${path}`);
+    }
+    const segments = path.split('/');
+    for (const seg of segments) {
+        if (seg === '..') {
+            throw new ArchiveSafetyError('PACKAGE_PATH_ESCAPE', `traversal segment in path: ${path}`);
+        }
+        if (seg === '.') {
+            throw new ArchiveSafetyError('PACKAGE_PATH_ESCAPE', `'.' segment in path: ${path}`);
+        }
+    }
+    const basename = segments[segments.length - 1] ?? '';
+    if (FORBIDDEN_BASENAMES.has(basename)) {
+        throw new ArchiveSafetyError('PACKAGE_SECRET_FILE_FORBIDDEN', `forbidden VCS/OS artifact: ${path}`);
+    }
+    for (const pattern of SECRET_LIKE_PATTERNS) {
+        if (pattern.test(path)) {
+            throw new ArchiveSafetyError('PACKAGE_SECRET_FILE_FORBIDDEN', `secret-like file is never shipped even if referenced: ${path}`);
+        }
+    }
+}
+/**
+ * Assert a file entry is a regular file (not a symlink/hardlink/socket/device).
+ * The caller passes the stat-like metadata; this rejects non-regular files.
+ */
+function assertRegularFile(args) {
+    const { path: p } = args;
+    if (args.isSymbolicLink) {
+        throw new ArchiveSafetyError('PACKAGE_SYMLINK_FORBIDDEN', `symlink is never shipped: ${p}`);
+    }
+    if (args.isBlockDevice || args.isCharacterDevice) {
+        throw new ArchiveSafetyError('PACKAGE_PATH_ESCAPE', `device file is never shipped: ${p}`);
+    }
+    if (args.isFIFO || args.isSocket) {
+        throw new ArchiveSafetyError('PACKAGE_PATH_ESCAPE', `socket/FIFO is never shipped: ${p}`);
+    }
+    // A hardlink (link count > 1) inside a package is suspicious — reject.
+    if (typeof args.hardlinkCount === 'number' && args.hardlinkCount > 1) {
+        throw new ArchiveSafetyError('PACKAGE_SYMLINK_FORBIDDEN', `hardlink (nlink=${args.hardlinkCount}) is never shipped: ${p}`);
+    }
+}
+/**
+ * Detect case-fold / Unicode collisions across a set of inventory paths.
+ * Throws `PACKAGE_ARCHIVE_COLLISION` if two paths differ only by case or NFC
+ * normalisation (design §10.4).
+ */
+function assertNoPathCollisions(paths) {
+    const seen = new Map(); // folded key -> original path
+    for (const p of paths) {
+        const folded = p.normalize('NFC').toLowerCase();
+        const prior = seen.get(folded);
+        if (prior !== undefined && prior !== p) {
+            throw new ArchiveSafetyError('PACKAGE_ARCHIVE_COLLISION', `case-fold/Unicode collision: ${prior} vs ${p}`);
+        }
+        seen.set(folded, p);
+    }
+}
+//# sourceMappingURL=archive-safety.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/archive-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-safety.js","sourceRoot":"","sources":["../../src/package/archive-safety.ts"],"names":[],"mappings":";;;AA4CA,sDAoCC;AAMD,8CAuBC;AAOD,wDAaC;AAjID;;;;;;;;;;;;GAYG;AACH,MAAM,oBAAoB,GAA0B;IAClD,sBAAsB,EAAE,yCAAyC;IACjE,qDAAqD,EAAE,WAAW;IAClE,oCAAoC,EAAE,8BAA8B;IACpE,qDAAqD,EAAE,qBAAqB;IAC5E,6CAA6C,EAAE,cAAc;IAC7D,mBAAmB,EAAE,uBAAuB;IAC5C,iBAAiB,EAAE,aAAa;CACjC,CAAC;AAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC1C,YAAY;IACZ,gBAAgB;IAChB,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AALD,gDAKC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,IAAY;IAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,4DAA4D;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wBAAwB,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,CAC1B,+BAA+B,EAC/B,yDAAyD,IAAI,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,IAQjC;IACC,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,6BAA6B,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,uEAAuE;IACvE,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,mBAAmB,IAAI,CAAC,aAAa,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAA4B;IACjE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,8BAA8B;IACtE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAC1B,2BAA2B,EAC3B,gCAAgC,KAAK,OAAO,CAAC,EAAE,CAChD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/canonical-zip.d.ts

@@ -0,0 +1,46 @@
+/** Canonical archive format literal. */
+export declare const CANONICAL_ARCHIVE_FORMAT: "zip-store-v1";
+export interface CanonicalZipEntryInput {
+    readonly path: string;
+    readonly bytes: Uint8Array;
+}
+export interface CanonicalZipBuildResult {
+    readonly format: typeof CANONICAL_ARCHIVE_FORMAT;
+    readonly bytes: Uint8Array;
+    readonly archiveDigest: `sha256:${string}`;
+    readonly entryCount: number;
+    readonly totalUncompressed: number;
+}
+export interface CanonicalZipReadResult {
+    readonly entries: ReadonlyArray<CanonicalZipEntryInput>;
+    readonly archiveDigest: `sha256:${string}`;
+}
+/**
+ * Validate one entry path against the canonical grammar + segment rules.
+ * Throws with a stable `code` on violation.
+ */
+export declare function validateCanonicalPath(path: string): void;
+/** Stable error class for canonical-zip violations (design §20 codes). */
+export declare class CanonicalZipError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Build a canonical ZIP archive from a set of entries (design §10.4).
+ *
+ * Entries are validated, de-duplicated (case-fold + Unicode collision fatal),
+ * sorted by UTF-8 byte order, and emitted with STORE compression, the fixed
+ * timestamp, mode 0644, and no extra fields. The result includes the SHA-256
+ * digest over the raw canonical bytes.
+ */
+export declare function buildCanonicalZip(entries: ReadonlyArray<CanonicalZipEntryInput>): Promise<CanonicalZipBuildResult>;
+/**
+ * Verify a candidate ZIP is byte-identical to the canonical form (server-side
+ * reconstruction check, design §10.4). A non-canonical but semantically equal
+ * ZIP is rejected, not normalized silently.
+ *
+ * Returns the recomputed archive digest on success; throws on mismatch.
+ */
+export declare function assertCanonicalZip(candidateBytes: Uint8Array, expectedArchiveDigest: `sha256:${string}`): Promise<`sha256:${string}`>;
+/** Parse a candidate archive and prove its bytes equal canonical reconstruction. */
+export declare function readCanonicalZip(candidateBytes: Uint8Array): Promise<CanonicalZipReadResult>;