@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/canonical-zip.js

@@ -0,0 +1,314 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CanonicalZipError = exports.CANONICAL_ARCHIVE_FORMAT = void 0;
+exports.validateCanonicalPath = validateCanonicalPath;
+exports.buildCanonicalZip = buildCanonicalZip;
+exports.assertCanonicalZip = assertCanonicalZip;
+exports.readCanonicalZip = readCanonicalZip;
+/**
+ * Canonical ZIP builder (executable-asset design §10.4 / `zip-store-v1`).
+ *
+ * The SINGLE canonical archive format for code-extension packages. Uses JSZip
+ * 3.10.1 (design §7.2). Rules (frozen, verbatim from §10.4):
+ * - regular-file entries only; compression STORE(0); no directory entries,
+ *   extra fields, comments, encryption, data descriptor, ZIP64 or multi-disk.
+ * - entries sorted by UTF-8 byte order of path.
+ * - path is NFC ASCII `[A-Za-z0-9._/-]+`, POSIX relative; no empty / `.` / `..`
+ *   segment, leading slash, backslash, colon, or NUL.
+ * - timestamp fixed `1980-01-01T00:00:00Z`; mode 0644; UTF-8 flag fixed.
+ * - duplicate, case-fold/Unicode collision or central/local-header mismatch is
+ *   fatal.
+ *
+ * Limits (§10.4): archive bytes ≤20 MiB; total uncompressed ≤20 MiB; single
+ * file ≤5 MiB; entries ≤1024; path ≤240 UTF-8 bytes; depth ≤12.
+ *
+ * `archiveDigest = SHA256(raw canonical ZIP bytes)`. The server reconstructs
+ * canonical ZIP bytes and recomputes both archive + package digests; a
+ * non-canonical but semantically equal ZIP is rejected, not normalized silently.
+ *
+ * This file is the ONLY canonical-zip owner; JSZip is wrapped here and never
+ * exposed to callers (design §3.2).
+ */
+const jszip_1 = __importDefault(require("jszip"));
+const shared_1 = require("@nexusclaw/shared");
+/** Canonical archive format literal. */
+exports.CANONICAL_ARCHIVE_FORMAT = 'zip-store-v1';
+/** Fixed canonical timestamp (the ZIP epoch minimum DOS date). */
+const CANONICAL_TIMESTAMP = new Date('1980-01-01T00:00:00Z');
+/** Fixed canonical POSIX mode (readable regular file). */
+const CANONICAL_MODE = 0o644;
+const LIMITS = {
+    archiveBytes: 20 * 1024 * 1024,
+    totalUncompressed: 20 * 1024 * 1024,
+    singleFile: 5 * 1024 * 1024,
+    entries: 1024,
+    pathBytes: 240,
+    depth: 12,
+};
+/**
+ * Path grammar for a canonical ZIP entry (design §10.4): NFC ASCII
+ * `[A-Za-z0-9._/-]+`, POSIX relative, no empty / `.` / `..` segment, no leading
+ * slash, backslash, colon, or NUL.
+ */
+const CANONICAL_PATH_PATTERN = /^[A-Za-z0-9._\/-]+$/;
+/**
+ * Validate one entry path against the canonical grammar + segment rules.
+ * Throws with a stable `code` on violation.
+ */
+function validateCanonicalPath(path) {
+    if (path.length === 0) {
+        throw new CanonicalZipError('PACKAGE_PATH_ESCAPE', 'empty path');
+    }
+    if (Buffer.from(path, 'utf-8').length > LIMITS.pathBytes) {
+        throw new CanonicalZipError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', `path exceeds ${LIMITS.pathBytes}-byte limit: ${path}`);
+    }
+    if (!CANONICAL_PATH_PATTERN.test(path)) {
+        throw new CanonicalZipError('PACKAGE_PATH_ESCAPE', `path contains forbidden characters or is not POSIX-relative ASCII: ${path}`);
+    }
+    if (path.startsWith('/')) {
+        throw new CanonicalZipError('PACKAGE_PATH_ESCAPE', `absolute path forbidden: ${path}`);
+    }
+    const segments = path.split('/');
+    // Depth = number of segments; a single filename is depth 1.
+    if (segments.length > LIMITS.depth) {
+        throw new CanonicalZipError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', `path depth ${segments.length} exceeds limit ${LIMITS.depth}: ${path}`);
+    }
+    for (const seg of segments) {
+        if (seg === '' || seg === '.' || seg === '..') {
+            throw new CanonicalZipError('PACKAGE_PATH_ESCAPE', `path contains empty / '.' / '..' segment: ${path}`);
+        }
+    }
+}
+/** Stable error class for canonical-zip violations (design §20 codes). */
+class CanonicalZipError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'CanonicalZipError';
+    }
+}
+exports.CanonicalZipError = CanonicalZipError;
+function archiveError(code, message) {
+    throw new CanonicalZipError(code, message);
+}
+/**
+ * Parse central-directory metadata before JSZip is allowed to inflate bytes.
+ * This keeps DEFLATE/ZIP64/oversize bomb inputs outside the decompressor and
+ * also proves local/central header identity at the transport boundary.
+ */
+function preflightCanonicalZip(candidateBytes) {
+    const bytes = Buffer.from(candidateBytes.buffer, candidateBytes.byteOffset, candidateBytes.byteLength);
+    const minimumEocd = 22;
+    let eocd = -1;
+    for (let offset = bytes.length - minimumEocd; offset >= Math.max(0, bytes.length - 65557); offset -= 1) {
+        if (bytes.readUInt32LE(offset) === 0x06054b50) {
+            eocd = offset;
+            break;
+        }
+    }
+    if (eocd < 0)
+        archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'ZIP end-of-central-directory record is missing');
+    const disk = bytes.readUInt16LE(eocd + 4);
+    const centralDisk = bytes.readUInt16LE(eocd + 6);
+    const entriesOnDisk = bytes.readUInt16LE(eocd + 8);
+    const entryCount = bytes.readUInt16LE(eocd + 10);
+    const centralSize = bytes.readUInt32LE(eocd + 12);
+    const centralOffset = bytes.readUInt32LE(eocd + 16);
+    const commentLength = bytes.readUInt16LE(eocd + 20);
+    if (disk !== 0 || centralDisk !== 0 || entriesOnDisk !== entryCount) {
+        archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'multi-disk ZIP is forbidden');
+    }
+    if (entryCount === 0xffff || centralSize === 0xffffffff || centralOffset === 0xffffffff) {
+        archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'ZIP64 is forbidden');
+    }
+    if (entryCount > LIMITS.entries) {
+        archiveError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', `entry count ${entryCount} exceeds limit ${LIMITS.entries}`);
+    }
+    if (eocd + minimumEocd + commentLength !== bytes.length || commentLength !== 0) {
+        archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'archive comment or trailing bytes are forbidden');
+    }
+    if (centralOffset + centralSize !== eocd) {
+        archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'central-directory bounds are inconsistent');
+    }
+    let cursor = centralOffset;
+    let totalUncompressed = 0;
+    for (let index = 0; index < entryCount; index += 1) {
+        if (cursor + 46 > eocd || bytes.readUInt32LE(cursor) !== 0x02014b50) {
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'invalid central-directory entry');
+        }
+        const flags = bytes.readUInt16LE(cursor + 8);
+        const method = bytes.readUInt16LE(cursor + 10);
+        const compressedSize = bytes.readUInt32LE(cursor + 20);
+        const uncompressedSize = bytes.readUInt32LE(cursor + 24);
+        const nameLength = bytes.readUInt16LE(cursor + 28);
+        const extraLength = bytes.readUInt16LE(cursor + 30);
+        const entryCommentLength = bytes.readUInt16LE(cursor + 32);
+        const startDisk = bytes.readUInt16LE(cursor + 34);
+        const localOffset = bytes.readUInt32LE(cursor + 42);
+        const end = cursor + 46 + nameLength + extraLength + entryCommentLength;
+        if (end > eocd)
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'truncated central-directory entry');
+        if (startDisk !== 0 || localOffset === 0xffffffff || compressedSize === 0xffffffff || uncompressedSize === 0xffffffff) {
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'ZIP64/multi-disk entry metadata is forbidden');
+        }
+        if (extraLength !== 0 || entryCommentLength !== 0) {
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'entry extra fields/comments are forbidden');
+        }
+        if (uncompressedSize > LIMITS.singleFile) {
+            archiveError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', `single file metadata exceeds ${LIMITS.singleFile}-byte limit`);
+        }
+        totalUncompressed += uncompressedSize;
+        if (totalUncompressed > LIMITS.totalUncompressed) {
+            archiveError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', `total uncompressed metadata exceeds ${LIMITS.totalUncompressed}-byte limit`);
+        }
+        if ((flags & 0x0001) !== 0)
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'encrypted ZIP entries are forbidden');
+        if ((flags & 0x0008) !== 0)
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'ZIP data descriptors are forbidden');
+        if (method !== 0)
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'only STORE(0) compression is canonical');
+        const nameBytes = bytes.subarray(cursor + 46, cursor + 46 + nameLength);
+        const path = nameBytes.toString('utf8');
+        if (!Buffer.from(path, 'utf8').equals(nameBytes)) {
+            archiveError('PACKAGE_PATH_ESCAPE', 'entry path is not valid UTF-8');
+        }
+        validateCanonicalPath(path);
+        if (localOffset + 30 > centralOffset || bytes.readUInt32LE(localOffset) !== 0x04034b50) {
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'local ZIP header is missing or out of bounds');
+        }
+        const localFlags = bytes.readUInt16LE(localOffset + 6);
+        const localMethod = bytes.readUInt16LE(localOffset + 8);
+        const localCompressedSize = bytes.readUInt32LE(localOffset + 18);
+        const localUncompressedSize = bytes.readUInt32LE(localOffset + 22);
+        const localNameLength = bytes.readUInt16LE(localOffset + 26);
+        const localExtraLength = bytes.readUInt16LE(localOffset + 28);
+        const localName = bytes.subarray(localOffset + 30, localOffset + 30 + localNameLength);
+        if (localFlags !== flags || localMethod !== method || localCompressedSize !== compressedSize
+            || localUncompressedSize !== uncompressedSize || localExtraLength !== 0
+            || !localName.equals(nameBytes)) {
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'central/local ZIP header mismatch');
+        }
+        const localDataEnd = localOffset + 30 + localNameLength + compressedSize;
+        if (localDataEnd > centralOffset)
+            archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'entry data exceeds local-file area');
+        cursor = end;
+    }
+    if (cursor !== eocd)
+        archiveError('PACKAGE_ARCHIVE_NON_CANONICAL', 'central-directory size/count mismatch');
+}
+/**
+ * Build a canonical ZIP archive from a set of entries (design §10.4).
+ *
+ * Entries are validated, de-duplicated (case-fold + Unicode collision fatal),
+ * sorted by UTF-8 byte order, and emitted with STORE compression, the fixed
+ * timestamp, mode 0644, and no extra fields. The result includes the SHA-256
+ * digest over the raw canonical bytes.
+ */
+async function buildCanonicalZip(entries) {
+    if (entries.length === 0) {
+        throw new CanonicalZipError('PACKAGE_INVENTORY_MISSING', 'canonical zip requires at least one entry');
+    }
+    if (entries.length > LIMITS.entries) {
+        throw new CanonicalZipError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', `entry count ${entries.length} exceeds limit ${LIMITS.entries}`);
+    }
+    // Validate each path + collect; detect duplicates (exact + case-fold + NFC).
+    const seenExact = new Set();
+    const seenFolded = new Set();
+    let totalUncompressed = 0;
+    const normalized = [];
+    for (const entry of entries) {
+        validateCanonicalPath(entry.path);
+        if (seenExact.has(entry.path)) {
+            throw new CanonicalZipError('PACKAGE_ARCHIVE_COLLISION', `duplicate path: ${entry.path}`);
+        }
+        const folded = entry.path.normalize('NFC').toLowerCase();
+        if (seenFolded.has(folded)) {
+            throw new CanonicalZipError('PACKAGE_ARCHIVE_COLLISION', `case-fold/Unicode collision on path: ${entry.path}`);
+        }
+        seenExact.add(entry.path);
+        seenFolded.add(folded);
+        const entryBytes = entry.bytes.byteLength;
+        if (entryBytes > LIMITS.singleFile) {
+            throw new CanonicalZipError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', `single file ${entry.path} (${entryBytes} bytes) exceeds ${LIMITS.singleFile}-byte limit`);
+        }
+        totalUncompressed += entryBytes;
+        normalized.push({ path: entry.path, bytes: entry.bytes });
+    }
+    if (totalUncompressed > LIMITS.totalUncompressed) {
+        throw new CanonicalZipError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', `total uncompressed ${totalUncompressed} exceeds ${LIMITS.totalUncompressed}-byte limit`);
+    }
+    // Sort entries by UTF-8 byte order of path (deterministic).
+    normalized.sort((a, b) => Buffer.from(a.path, 'utf-8').compare(Buffer.from(b.path, 'utf-8')));
+    const zip = new jszip_1.default();
+    for (const entry of normalized) {
+        zip.file(entry.path, entry.bytes, {
+            compression: 'STORE',
+            date: CANONICAL_TIMESTAMP,
+            unixPermissions: CANONICAL_MODE,
+            // Design §10.4: no directory entries. JSZip auto-creates folder entries
+            // for nested paths unless createFolders is false.
+            createFolders: false,
+            // No comment, no extra.
+        });
+    }
+    const bytes = await zip.generateAsync({
+        type: 'uint8array',
+        compression: 'STORE',
+        // Fixed canonical metadata — no comment, no creator field.
+        comment: '',
+    });
+    if (bytes.byteLength > LIMITS.archiveBytes) {
+        throw new CanonicalZipError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', `archive bytes ${bytes.byteLength} exceeds ${LIMITS.archiveBytes}-byte limit`);
+    }
+    const archiveDigest = (0, shared_1.rawByteDigest)(bytes);
+    return {
+        format: exports.CANONICAL_ARCHIVE_FORMAT,
+        bytes,
+        archiveDigest,
+        entryCount: normalized.length,
+        totalUncompressed,
+    };
+}
+/**
+ * Verify a candidate ZIP is byte-identical to the canonical form (server-side
+ * reconstruction check, design §10.4). A non-canonical but semantically equal
+ * ZIP is rejected, not normalized silently.
+ *
+ * Returns the recomputed archive digest on success; throws on mismatch.
+ */
+async function assertCanonicalZip(candidateBytes, expectedArchiveDigest) {
+    const actualDigest = (0, shared_1.rawByteDigest)(candidateBytes);
+    if (actualDigest !== expectedArchiveDigest) {
+        throw new CanonicalZipError('PACKAGE_ARCHIVE_NON_CANONICAL', `archive digest mismatch: expected ${expectedArchiveDigest}, got ${actualDigest}`);
+    }
+    return actualDigest;
+}
+/** Parse a candidate archive and prove its bytes equal canonical reconstruction. */
+async function readCanonicalZip(candidateBytes) {
+    if (candidateBytes.byteLength > LIMITS.archiveBytes) {
+        throw new CanonicalZipError('PACKAGE_ARCHIVE_LIMIT_EXCEEDED', 'archive exceeds 20 MiB');
+    }
+    preflightCanonicalZip(candidateBytes);
+    let zip;
+    try {
+        zip = await jszip_1.default.loadAsync(candidateBytes, { checkCRC32: true, createFolders: false });
+    }
+    catch {
+        throw new CanonicalZipError('PACKAGE_ARCHIVE_NON_CANONICAL', 'invalid ZIP archive');
+    }
+    const entries = [];
+    for (const [path, file] of Object.entries(zip.files)) {
+        if (file.dir)
+            throw new CanonicalZipError('PACKAGE_ARCHIVE_NON_CANONICAL', `directory entry forbidden: ${path}`);
+        entries.push({ path, bytes: await file.async('uint8array') });
+    }
+    const rebuilt = await buildCanonicalZip(entries);
+    if (!Buffer.from(rebuilt.bytes).equals(Buffer.from(candidateBytes))) {
+        throw new CanonicalZipError('PACKAGE_ARCHIVE_NON_CANONICAL', 'archive bytes differ from canonical reconstruction');
+    }
+    return { entries: entries.sort((a, b) => Buffer.from(a.path).compare(Buffer.from(b.path))), archiveDigest: rebuilt.archiveDigest };
+}
+//# sourceMappingURL=canonical-zip.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/canonical-zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-zip.js","sourceRoot":"","sources":["../../src/package/canonical-zip.ts"],"names":[],"mappings":";;;;;;AAyEA,sDAmCC;AAyHD,8CA0FC;AASD,gDAYC;AAGD,4CAqBC;AA5WD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,kDAA0B;AAC1B,8CAAkD;AAElD,wCAAwC;AAC3B,QAAA,wBAAwB,GAAG,cAAuB,CAAC;AAEhE,kEAAkE;AAClE,MAAM,mBAAmB,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAC7D,0DAA0D;AAC1D,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,MAAM,MAAM,GAAG;IACb,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC9B,iBAAiB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IACnC,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IAC3B,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,GAAG;IACd,KAAK,EAAE,EAAE;CACD,CAAC;AAEX;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAoBrD;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,IAAY;IAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,gBAAgB,MAAM,CAAC,SAAS,gBAAgB,IAAI,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,sEAAsE,IAAI,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,4BAA4B,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,4DAA4D;IAC5D,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,cAAc,QAAQ,CAAC,MAAM,kBAAkB,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,6CAA6C,IAAI,EAAE,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AALD,8CAKC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,OAAe;IACjD,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,cAA0B;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACvG,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,KAAK,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,KAAM,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACxG,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,IAAI,GAAG,MAAM,CAAC;YAAC,MAAM;QAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,YAAY,CAAC,+BAA+B,EAAE,gDAAgD,CAAC,CAAC;IAE9G,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;QACpE,YAAY,CAAC,+BAA+B,EAAE,6BAA6B,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,IAAI,WAAW,KAAK,UAAU,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;QACxF,YAAY,CAAC,+BAA+B,EAAE,oBAAoB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAChC,YAAY,CAAC,gCAAgC,EAAE,eAAe,UAAU,kBAAkB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,IAAI,GAAG,WAAW,GAAG,aAAa,KAAK,KAAK,CAAC,MAAM,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/E,YAAY,CAAC,+BAA+B,EAAE,iDAAiD,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,aAAa,GAAG,WAAW,KAAK,IAAI,EAAE,CAAC;QACzC,YAAY,CAAC,+BAA+B,EAAE,2CAA2C,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,MAAM,GAAG,aAAa,CAAC;IAC3B,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,MAAM,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YACpE,YAAY,CAAC,+BAA+B,EAAE,iCAAiC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,gBAAgB,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACpD,MAAM,kBAAkB,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,GAAG,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;QACxE,IAAI,GAAG,GAAG,IAAI;YAAE,YAAY,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,CAAC;QACnG,IAAI,SAAS,KAAK,CAAC,IAAI,WAAW,KAAK,UAAU,IAAI,cAAc,KAAK,UAAU,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;YACtH,YAAY,CAAC,+BAA+B,EAAE,8CAA8C,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,WAAW,KAAK,CAAC,IAAI,kBAAkB,KAAK,CAAC,EAAE,CAAC;YAClD,YAAY,CAAC,+BAA+B,EAAE,2CAA2C,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,YAAY,CAAC,gCAAgC,EAAE,gCAAgC,MAAM,CAAC,UAAU,aAAa,CAAC,CAAC;QACjH,CAAC;QACD,iBAAiB,IAAI,gBAAgB,CAAC;QACtC,IAAI,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACjD,YAAY,CAAC,gCAAgC,EAAE,uCAAuC,MAAM,CAAC,iBAAiB,aAAa,CAAC,CAAC;QAC/H,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAAE,YAAY,CAAC,+BAA+B,EAAE,qCAAqC,CAAC,CAAC;QACjH,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAAE,YAAY,CAAC,+BAA+B,EAAE,oCAAoC,CAAC,CAAC;QAChH,IAAI,MAAM,KAAK,CAAC;YAAE,YAAY,CAAC,+BAA+B,EAAE,wCAAwC,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,YAAY,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QACvE,CAAC;QACD,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE5B,IAAI,WAAW,GAAG,EAAE,GAAG,aAAa,IAAI,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,UAAU,EAAE,CAAC;YACvF,YAAY,CAAC,+BAA+B,EAAE,8CAA8C,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,mBAAmB,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,qBAAqB,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,GAAG,EAAE,EAAE,WAAW,GAAG,EAAE,GAAG,eAAe,CAAC,CAAC;QACvF,IAAI,UAAU,KAAK,KAAK,IAAI,WAAW,KAAK,MAAM,IAAI,mBAAmB,KAAK,cAAc;eACvF,qBAAqB,KAAK,gBAAgB,IAAI,gBAAgB,KAAK,CAAC;eACpE,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,YAAY,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,GAAG,EAAE,GAAG,eAAe,GAAG,cAAc,CAAC;QACzE,IAAI,YAAY,GAAG,aAAa;YAAE,YAAY,CAAC,+BAA+B,EAAE,oCAAoC,CAAC,CAAC;QACtH,MAAM,GAAG,GAAG,CAAC;IACf,CAAC;IACD,IAAI,MAAM,KAAK,IAAI;QAAE,YAAY,CAAC,+BAA+B,EAAE,uCAAuC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CACrC,OAA8C;IAE9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,EAAE,2CAA2C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,eAAe,OAAO,CAAC,MAAM,kBAAkB,MAAM,CAAC,OAAO,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,EAAE,mBAAmB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACzD,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CACzB,2BAA2B,EAC3B,wCAAwC,KAAK,CAAC,IAAI,EAAE,CACrD,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEvB,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QAC1C,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,eAAe,KAAK,CAAC,IAAI,KAAK,UAAU,mBAAmB,MAAM,CAAC,UAAU,aAAa,CAC1F,CAAC;QACJ,CAAC;QACD,iBAAiB,IAAI,UAAU,CAAC;QAChC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACjD,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,sBAAsB,iBAAiB,YAAY,MAAM,CAAC,iBAAiB,aAAa,CACzF,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACnE,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,eAAK,EAAE,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE;YAChC,WAAW,EAAE,OAAO;YACpB,IAAI,EAAE,mBAAmB;YACzB,eAAe,EAAE,cAAc;YAC/B,wEAAwE;YACxE,kDAAkD;YAClD,aAAa,EAAE,KAAK;YACpB,wBAAwB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC;QACpC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,OAAO;QACpB,2DAA2D;QAC3D,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,iBAAiB,KAAK,CAAC,UAAU,YAAY,MAAM,CAAC,YAAY,aAAa,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,sBAAa,EAAC,KAAK,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE,gCAAwB;QAChC,KAAK;QACL,aAAa;QACb,UAAU,EAAE,UAAU,CAAC,MAAM;QAC7B,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,cAA0B,EAC1B,qBAAyC;IAEzC,MAAM,YAAY,GAAG,IAAA,sBAAa,EAAC,cAAc,CAAC,CAAC;IACnD,IAAI,YAAY,KAAK,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAiB,CACzB,+BAA+B,EAC/B,qCAAqC,qBAAqB,SAAS,YAAY,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,oFAAoF;AAC7E,KAAK,UAAU,gBAAgB,CAAC,cAA0B;IAC/D,IAAI,cAAc,CAAC,UAAU,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QACpD,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,EAAE,wBAAwB,CAAC,CAAC;IAC1F,CAAC;IACD,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACtC,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,eAAK,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,qBAAqB,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAC;QACjH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,oDAAoD,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;AACrI,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/manifest-inventory.d.ts

@@ -0,0 +1,49 @@
+/** A manifest-derived inventory entry. */
+export interface InventoryEntry {
+    /** POSIX-relative path, UTF-8 byte sorted in the result. */
+    readonly path: string;
+    /** Raw file byte digest (SHA-256). */
+    readonly rawFileDigest: `sha256:${string}`;
+    /** Semantic entry digest (RFC 8785 for JSON/typed; raw bytes for .ts/fixtures). */
+    readonly semanticEntryDigest: `sha256:${string}`;
+}
+export interface InventoryResult {
+    readonly entries: ReadonlyArray<InventoryEntry>;
+    /** `<path> NUL <semanticEntryDigest> LF` rows, sorted → SHA-256. */
+    readonly packageDigest: `sha256:${string}`;
+}
+/** A minimal manifest shape the inventory builder consumes. */
+export interface InventoryManifest {
+    /** Path to the manifest itself (e.g. `package.yaml`). */
+    readonly manifestPath: string;
+    /** Typed manifest value (used for the manifest's own semantic digest). */
+    readonly manifestValue: unknown;
+    /** Code artifact source paths (executableArtifacts[].sourcePath). */
+    readonly sourcePaths?: ReadonlyArray<string>;
+    /** Optional agent tool catalog path. */
+    readonly agentToolCatalogPath?: string;
+    /** Input/output schema refs + package-local `$ref`s. */
+    readonly schemaRefs?: ReadonlyArray<string>;
+    /** Declared test paths / fixture refs. */
+    readonly testPaths?: ReadonlyArray<string>;
+    /** Flow payload refs. */
+    readonly flowPayloadRefs?: ReadonlyArray<string>;
+    /** Declared release evidence refs. */
+    readonly releaseEvidenceRefs?: ReadonlyArray<string>;
+}
+/** A file the inventory builder reads. */
+export interface InventoryFile {
+    readonly path: string;
+    readonly bytes: Uint8Array;
+    /** Parsed JSON value, when the file is JSON and already parsed by caller. */
+    readonly parsedJson?: unknown;
+    /** Stat-like metadata for the safety check (optional). */
+    readonly isSymbolicLink?: boolean;
+    readonly hardlinkCount?: number;
+}
+/**
+ * Build the transitive inventory + package digest from a manifest + a file
+ * reader. The file reader returns the bytes for each referenced path; any
+ * missing/escaping/secret-like path is fatal (design §10.2 / §3.3).
+ */
+export declare function buildManifestInventory(manifest: InventoryManifest, readFile: (path: string) => Promise<InventoryFile>): Promise<InventoryResult>;

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/manifest-inventory.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildManifestInventory = buildManifestInventory;
+/**
+ * Manifest-derived transitive inventory (executable-asset design §10.2, tasks
+ * 3.2 / 3.5).
+ *
+ * Replaces the hardcoded pack allowlist (§10.2 line 1129). The inventory is the
+ * transitive closure of:
+ *  1. the manifest itself (`package.yaml` / `manifest.json`);
+ *  2. every `executableArtifacts[].sourcePath`;
+ *  3. `agentToolCatalogPath`;
+ *  4. every input/output schema ref + package-local `$ref`;
+ *  5. every declared test path / fixture ref;
+ *  6. Flow payload refs;
+ *  7. declared release evidence refs.
+ *
+ * Paths are POSIX-relative, UTF-8 byte sorted. Package digest input is exactly
+ * `<path> NUL <semanticEntryDigest> LF` per entry (§10.2 line 1125-1127).
+ * Unreferenced files are NOT shipped.
+ *
+ * Per-entry semantic digest (§10.1):
+ *  - `.json` → RFC 8785 over the parsed value;
+ *  - typed manifest (`package.yaml`/`manifest.json`) → RFC 8785 over the typed
+ *    manifest;
+ *  - `.ts` and opaque declared fixtures → raw byte digest.
+ */
+const shared_1 = require("@nexusclaw/shared");
+const archive_safety_1 = require("./archive-safety");
+/** Resolve the semantic digest for one entry per §10.1 rules. */
+function semanticDigestFor(path, bytes, parsedJson) {
+    // .json → RFC 8785 over parsed value (caller supplies parsedJson).
+    if (path.endsWith('.json') && parsedJson !== undefined) {
+        return (0, shared_1.canonicalJsonDigest)(parsedJson);
+    }
+    // .ts + opaque fixtures → raw byte digest.
+    return (0, shared_1.rawByteDigest)(bytes);
+}
+/**
+ * Build the transitive inventory + package digest from a manifest + a file
+ * reader. The file reader returns the bytes for each referenced path; any
+ * missing/escaping/secret-like path is fatal (design §10.2 / §3.3).
+ */
+async function buildManifestInventory(manifest, readFile) {
+    // Collect the transitive closure of referenced paths.
+    const referenced = new Set();
+    referenced.add(manifest.manifestPath);
+    for (const p of [
+        ...(manifest.sourcePaths ?? []),
+        ...(manifest.agentToolCatalogPath ? [manifest.agentToolCatalogPath] : []),
+        ...(manifest.schemaRefs ?? []),
+        ...(manifest.testPaths ?? []),
+        ...(manifest.flowPayloadRefs ?? []),
+        ...(manifest.releaseEvidenceRefs ?? []),
+    ]) {
+        referenced.add(p);
+    }
+    // Safety-check every path up front.
+    for (const p of referenced) {
+        (0, archive_safety_1.assertSafeArchivePath)(p);
+    }
+    // Read + digest each referenced file.
+    const entries = [];
+    for (const path of referenced) {
+        const file = await readFile(path);
+        if (file === null || file === undefined) {
+            throw new Error(`PACKAGE_INVENTORY_MISSING: referenced file not found: ${path}`);
+        }
+        // Re-run the safety check on the resolved path (defence in depth) + file type.
+        (0, archive_safety_1.assertSafeArchivePath)(file.path);
+        (0, archive_safety_1.assertRegularFile)({ path: file.path, isSymbolicLink: file.isSymbolicLink, hardlinkCount: file.hardlinkCount });
+        if (file.path !== path) {
+            throw new Error(`PACKAGE_PATH_ESCAPE: reader returned a different path for ${path}: ${file.path}`);
+        }
+        const rawFileDigest = (0, shared_1.rawByteDigest)(file.bytes);
+        const pathParts = path.split('/');
+        const manifestBaseName = pathParts[pathParts.length - 1];
+        const isTypedManifest = path === manifest.manifestPath && (manifestBaseName === 'package.yaml'
+            || manifestBaseName === 'package.yml'
+            || manifestBaseName === 'package.json'
+            || manifestBaseName === 'manifest.json');
+        const semanticEntryDigest = isTypedManifest
+            ? (0, shared_1.canonicalJsonDigest)(manifest.manifestValue)
+            : semanticDigestFor(path, file.bytes, file.parsedJson);
+        entries.push({ path, rawFileDigest, semanticEntryDigest });
+    }
+    // Case-fold / Unicode collision check across the closure.
+    (0, archive_safety_1.assertNoPathCollisions)(entries.map((e) => e.path));
+    // Sort by UTF-8 byte order of path.
+    entries.sort((a, b) => Buffer.from(a.path, 'utf-8').compare(Buffer.from(b.path, 'utf-8')));
+    // packageDigest = SHA256 of `<path> NUL <semanticEntryDigest> LF` rows.
+    const packageDigest = (0, shared_1.portableBundleDigest)(entries.map((e) => ({ path: e.path, semanticEntryDigest: e.semanticEntryDigest })));
+    return { entries, packageDigest };
+}
+//# sourceMappingURL=manifest-inventory.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/manifest-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-inventory.js","sourceRoot":"","sources":["../../src/package/manifest-inventory.ts"],"names":[],"mappings":";;AA6FA,wDA+DC;AA5JD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,8CAI2B;AAC3B,qDAAoG;AAsCpG,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAiB,EAAE,UAAoB;IAC9E,mEAAmE;IACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,IAAA,4BAAmB,EAAC,UAAmB,CAAC,CAAC;IAClD,CAAC;IACD,2CAA2C;IAC3C,OAAO,IAAA,sBAAa,EAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAaD;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAC1C,QAA2B,EAC3B,QAAkD;IAElD,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI;QACd,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC;KACxC,EAAE,CAAC;QACF,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,oCAAoC;IACpC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAA,sCAAqB,EAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,sCAAsC;IACtC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,+EAA+E;QAC/E,IAAA,sCAAqB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAA,kCAAiB,EAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/G,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,6DAA6D,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,aAAa,GAAG,IAAA,sBAAa,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,gBAAgB,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,IAAI,KAAK,QAAQ,CAAC,YAAY,IAAI,CACxD,gBAAgB,KAAK,cAAc;eAChC,gBAAgB,KAAK,aAAa;eAClC,gBAAgB,KAAK,cAAc;eACnC,gBAAgB,KAAK,eAAe,CACxC,CAAC;QACF,MAAM,mBAAmB,GAAG,eAAe;YACzC,CAAC,CAAC,IAAA,4BAAmB,EAAC,QAAQ,CAAC,aAAsB,CAAC;YACtD,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,0DAA0D;IAC1D,IAAA,uCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnD,oCAAoC;IACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3F,wEAAwE;IACxE,MAAM,aAAa,GAAG,IAAA,6BAAoB,EACxC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CACnF,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/workforce-bundle-inventory.d.ts

@@ -0,0 +1,19 @@
+import type { CanonicalZipEntryInput } from './canonical-zip';
+export interface WorkforceBundleInventoryResult {
+    readonly portableEntries: ReadonlyArray<{
+        readonly path: string;
+        readonly semanticEntryDigest: `sha256:${string}`;
+    }>;
+    readonly archiveEntries: ReadonlyArray<CanonicalZipEntryInput>;
+    readonly portableBundleDigest: `sha256:${string}`;
+    readonly runtimeBindingsDigest: `sha256:${string}`;
+    readonly runtimeBindingsPath: string;
+}
+type StructuredParser = (path: string, bytes: Uint8Array) => unknown;
+/**
+ * Sole pure portable-inventory owner shared by CLI packing and server upload
+ * verification. Runtime bindings travel in the archive but never contribute
+ * to the portable digest; generated `.nexusclaw/` state is forbidden.
+ */
+export declare function buildWorkforceBundleInventory(entries: ReadonlyArray<CanonicalZipEntryInput>, parseStructured: StructuredParser): Promise<WorkforceBundleInventoryResult>;
+export {};