@noodleseed/one 0.111.0 → 0.112.0

package/node_modules/@noodle-borg/app-package/dist/limits.d.ts

@@ -0,0 +1,29 @@
+/** App Package V1 source and artifact amplification limits. */
+export declare const APP_PACKAGE_V1_MAX_IDENTIFIER_CHARS = 200;
+export declare const APP_PACKAGE_V1_MAX_PROSE_CHARS = 4000;
+export declare const APP_PACKAGE_V1_MAX_USE_WHEN = 32;
+export declare const APP_PACKAGE_V1_MAX_WORKFLOWS = 32;
+export declare const APP_PACKAGE_V1_MAX_WORKFLOW_STEPS = 64;
+export declare const APP_PACKAGE_V1_MAX_BOUNDARIES = 64;
+export declare const APP_PACKAGE_V1_MAX_EXAMPLES = 64;
+export declare const APP_PACKAGE_V1_MAX_SCHEMA_FIELDS = 64;
+export declare const APP_PACKAGE_V1_MAX_PROMPT_ARGUMENTS = 64;
+export declare const APP_PACKAGE_V1_MAX_AUTHORIZATION_VALUES = 128;
+export declare const APP_PACKAGE_V1_MAX_SURFACE_ITEMS = 256;
+export declare const APP_PACKAGE_V1_MAX_CANONICAL_BYTES: number;
+/** Canonical compiler bounds mirrored by the dependency-free Agent Kit validator. */
+export declare const APP_PACKAGE_V1_VALIDATION_LIMITS: Readonly<{
+    identifierChars: 200;
+    proseChars: 4000;
+    useWhen: 32;
+    workflows: 32;
+    workflowSteps: 64;
+    boundaries: 64;
+    examples: 64;
+    surfaceItems: 256;
+    schemaFields: 64;
+    promptArguments: 64;
+    authorizationValues: 128;
+    artifactBytes: number;
+}>;
+//# sourceMappingURL=limits.d.ts.map

package/node_modules/@noodle-borg/app-package/dist/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,eAAO,MAAM,mCAAmC,MAAM,CAAC;AACvD,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AACpD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,eAAO,MAAM,iCAAiC,KAAK,CAAC;AACpD,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAChD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AACnD,eAAO,MAAM,mCAAmC,KAAK,CAAC;AACtD,eAAO,MAAM,uCAAuC,MAAM,CAAC;AAC3D,eAAO,MAAM,gCAAgC,MAAM,CAAC;AACpD,eAAO,MAAM,kCAAkC,QAAa,CAAC;AAE7D,qFAAqF;AACrF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;EAa3C,CAAC"}

package/node_modules/@noodle-borg/app-package/dist/limits.js

@@ -0,0 +1,29 @@
+/** App Package V1 source and artifact amplification limits. */
+export const APP_PACKAGE_V1_MAX_IDENTIFIER_CHARS = 200;
+export const APP_PACKAGE_V1_MAX_PROSE_CHARS = 4_000;
+export const APP_PACKAGE_V1_MAX_USE_WHEN = 32;
+export const APP_PACKAGE_V1_MAX_WORKFLOWS = 32;
+export const APP_PACKAGE_V1_MAX_WORKFLOW_STEPS = 64;
+export const APP_PACKAGE_V1_MAX_BOUNDARIES = 64;
+export const APP_PACKAGE_V1_MAX_EXAMPLES = 64;
+export const APP_PACKAGE_V1_MAX_SCHEMA_FIELDS = 64;
+export const APP_PACKAGE_V1_MAX_PROMPT_ARGUMENTS = 64;
+export const APP_PACKAGE_V1_MAX_AUTHORIZATION_VALUES = 128;
+export const APP_PACKAGE_V1_MAX_SURFACE_ITEMS = 256;
+export const APP_PACKAGE_V1_MAX_CANONICAL_BYTES = 256 * 1024;
+/** Canonical compiler bounds mirrored by the dependency-free Agent Kit validator. */
+export const APP_PACKAGE_V1_VALIDATION_LIMITS = Object.freeze({
+    identifierChars: APP_PACKAGE_V1_MAX_IDENTIFIER_CHARS,
+    proseChars: APP_PACKAGE_V1_MAX_PROSE_CHARS,
+    useWhen: APP_PACKAGE_V1_MAX_USE_WHEN,
+    workflows: APP_PACKAGE_V1_MAX_WORKFLOWS,
+    workflowSteps: APP_PACKAGE_V1_MAX_WORKFLOW_STEPS,
+    boundaries: APP_PACKAGE_V1_MAX_BOUNDARIES,
+    examples: APP_PACKAGE_V1_MAX_EXAMPLES,
+    surfaceItems: APP_PACKAGE_V1_MAX_SURFACE_ITEMS,
+    schemaFields: APP_PACKAGE_V1_MAX_SCHEMA_FIELDS,
+    promptArguments: APP_PACKAGE_V1_MAX_PROMPT_ARGUMENTS,
+    authorizationValues: APP_PACKAGE_V1_MAX_AUTHORIZATION_VALUES,
+    artifactBytes: APP_PACKAGE_V1_MAX_CANONICAL_BYTES,
+});
+//# sourceMappingURL=limits.js.map

package/node_modules/@noodle-borg/app-package/dist/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AACvD,MAAM,CAAC,MAAM,8BAA8B,GAAG,KAAK,CAAC;AACpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AACpD,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAChD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AACnD,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AACtD,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAC3D,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AACpD,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,GAAG,IAAI,CAAC;AAE7D,qFAAqF;AACrF,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5D,eAAe,EAAE,mCAAmC;IACpD,UAAU,EAAE,8BAA8B;IAC1C,OAAO,EAAE,2BAA2B;IACpC,SAAS,EAAE,4BAA4B;IACvC,aAAa,EAAE,iCAAiC;IAChD,UAAU,EAAE,6BAA6B;IACzC,QAAQ,EAAE,2BAA2B;IACrC,YAAY,EAAE,gCAAgC;IAC9C,YAAY,EAAE,gCAAgC;IAC9C,eAAe,EAAE,mCAAmC;IACpD,mBAAmB,EAAE,uCAAuC;IAC5D,aAAa,EAAE,kCAAkC;CAClD,CAAC,CAAC"}

package/node_modules/@noodle-borg/app-package/dist/schema.d.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+import type { AppPackageArtifactV1 } from './types.js';
+/** Serializable, strict, safe App Package V1 projection. */
+export declare const appPackageArtifactV1Schema: z.ZodType<AppPackageArtifactV1>;
+//# sourceMappingURL=schema.d.ts.map

package/node_modules/@noodle-borg/app-package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAkKvD,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CA+BnE,CAAC"}

package/node_modules/@noodle-borg/app-package/dist/schema.js

@@ -0,0 +1,188 @@
+import { z } from 'zod';
+import { canonicalJson } from './canonical.js';
+import { APP_PACKAGE_V1_MAX_AUTHORIZATION_VALUES, APP_PACKAGE_V1_MAX_BOUNDARIES, APP_PACKAGE_V1_MAX_CANONICAL_BYTES, APP_PACKAGE_V1_MAX_EXAMPLES, APP_PACKAGE_V1_MAX_IDENTIFIER_CHARS, APP_PACKAGE_V1_MAX_PROMPT_ARGUMENTS, APP_PACKAGE_V1_MAX_PROSE_CHARS, APP_PACKAGE_V1_MAX_SCHEMA_FIELDS, APP_PACKAGE_V1_MAX_SURFACE_ITEMS, APP_PACKAGE_V1_MAX_USE_WHEN, APP_PACKAGE_V1_MAX_WORKFLOW_STEPS, APP_PACKAGE_V1_MAX_WORKFLOWS, } from './limits.js';
+const name = z
+    .string()
+    .max(APP_PACKAGE_V1_MAX_IDENTIFIER_CHARS)
+    .regex(/^[a-z0-9_]+$/);
+const coreName = z.string().regex(/^[a-z0-9_]+$/);
+const boundedName = z
+    .string()
+    .min(1)
+    .max(APP_PACKAGE_V1_MAX_IDENTIFIER_CHARS)
+    .refine((value) => value.trim().length > 0, 'must contain non-whitespace text');
+const prose = z
+    .string()
+    .min(1)
+    .max(APP_PACKAGE_V1_MAX_PROSE_CHARS)
+    .refine((value) => value.trim().length > 0, 'must contain non-whitespace text');
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const capability = z.object({ kind: z.enum(['tool', 'resource', 'prompt']), name }).strict();
+const behavior = z
+    .object({
+    readOnly: z.boolean(),
+    destructive: z.boolean(),
+    idempotent: z.boolean(),
+    openWorld: z.boolean(),
+    confirmationRequired: z.boolean(),
+})
+    .strict();
+const schemaField = z
+    .object({ name, type: prose, required: z.boolean(), description: prose.optional() })
+    .strict();
+const schemaSummary = z
+    .object({
+    type: prose,
+    fields: z.array(schemaField).max(APP_PACKAGE_V1_MAX_SCHEMA_FIELDS).optional(),
+})
+    .strict();
+const asset = z
+    .object({ logicalId: boundedName, alt: prose, darkLogicalId: boundedName.optional() })
+    .strict();
+const branding = z
+    .object({
+    name: prose.optional(),
+    accent: prose.optional(),
+    surface: prose.optional(),
+    surfaceDark: prose.optional(),
+    logo: asset.optional(),
+    mark: asset.optional(),
+    avatar: asset.optional(),
+    radius: z.enum(['none', 'sm', 'md', 'lg']).optional(),
+    density: z.enum(['compact', 'comfortable']).optional(),
+    typography: z.enum(['system', 'serif', 'mono']).optional(),
+    colorScheme: z.enum(['auto', 'light', 'dark']).optional(),
+})
+    .strict();
+const authorization = z
+    .object({
+    requiredScopes: z
+        .array(z
+        .string()
+        .min(1)
+        .max(512)
+        .refine((value) => value.trim().length > 0, 'must contain non-whitespace text'))
+        .min(1)
+        .max(APP_PACKAGE_V1_MAX_AUTHORIZATION_VALUES)
+        .optional(),
+    allowedRoles: z
+        .array(z
+        .string()
+        .min(1)
+        .max(APP_PACKAGE_V1_MAX_IDENTIFIER_CHARS)
+        .refine((value) => value.trim().length > 0, 'must contain non-whitespace text'))
+        .min(1)
+        .max(APP_PACKAGE_V1_MAX_AUTHORIZATION_VALUES)
+        .optional(),
+})
+    .strict()
+    .refine((value) => value.requiredScopes !== undefined || value.allowedRoles !== undefined);
+const visibility = z.union([
+    z.tuple([z.literal('model')]),
+    z.tuple([z.literal('app')]),
+    z.tuple([z.literal('model'), z.literal('app')]),
+]);
+const tool = z
+    .object({
+    kind: z.literal('tool'),
+    name,
+    title: prose.optional(),
+    description: prose,
+    input: schemaSummary,
+    output: schemaSummary.optional(),
+    behavior,
+    visibility,
+    authorization: authorization.optional(),
+    widget: name.optional(),
+})
+    .strict();
+const resource = z
+    .object({
+    kind: z.literal('resource'),
+    name,
+    uri: prose,
+    title: prose.optional(),
+    description: prose.optional(),
+    mimeType: prose.optional(),
+})
+    .strict();
+const prompt = z
+    .object({
+    kind: z.literal('prompt'),
+    name,
+    title: prose.optional(),
+    description: prose.optional(),
+    arguments: z
+        .array(z.object({ name, description: prose.optional(), required: z.boolean() }).strict())
+        .max(APP_PACKAGE_V1_MAX_PROMPT_ARGUMENTS),
+})
+    .strict();
+const widget = z
+    .object({
+    kind: z.literal('widget'),
+    name,
+    title: prose.optional(),
+    description: prose.optional(),
+    tool: name,
+})
+    .strict();
+const skill = z
+    .object({
+    description: prose,
+    useWhen: z.array(prose).min(1).max(APP_PACKAGE_V1_MAX_USE_WHEN),
+    workflows: z
+        .array(z
+        .object({
+        id: name,
+        title: prose,
+        intent: prose.optional(),
+        steps: z
+            .array(z
+            .object({ capability, guidance: prose.optional(), behavior: behavior.optional() })
+            .strict())
+            .min(1)
+            .max(APP_PACKAGE_V1_MAX_WORKFLOW_STEPS),
+    })
+        .strict())
+        .min(1)
+        .max(APP_PACKAGE_V1_MAX_WORKFLOWS),
+    boundaries: z.array(prose).max(APP_PACKAGE_V1_MAX_BOUNDARIES),
+    examples: z
+        .array(z.object({ prompt: prose, workflow: name }).strict())
+        .max(APP_PACKAGE_V1_MAX_EXAMPLES),
+})
+    .strict();
+/** Serializable, strict, safe App Package V1 projection. */
+export const appPackageArtifactV1Schema = z
+    .object({
+    schemaVersion: z.literal('1'),
+    app: z
+        .object({ name: coreName, title: prose, version: prose, branding: branding.optional() })
+        .strict(),
+    skill,
+    surface: z
+        .object({
+        auth: z
+            .object({ required: z.boolean(), kind: z.enum(['oidc', 'federatedOidc']).optional() })
+            .strict(),
+        tools: z.array(tool).max(APP_PACKAGE_V1_MAX_SURFACE_ITEMS),
+        resources: z.array(resource).max(APP_PACKAGE_V1_MAX_SURFACE_ITEMS),
+        prompts: z.array(prompt).max(APP_PACKAGE_V1_MAX_SURFACE_ITEMS),
+        widgets: z.array(widget).max(APP_PACKAGE_V1_MAX_SURFACE_ITEMS),
+    })
+        .strict(),
+    provenance: z
+        .object({
+        sourceManifestSha256: digest,
+        mcpSurfaceSha256: digest,
+        compilerVersion: z.literal('1'),
+    })
+        .strict(),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    if (Buffer.byteLength(canonicalJson(value), 'utf8') > APP_PACKAGE_V1_MAX_CANONICAL_BYTES) {
+        ctx.addIssue({ code: 'custom', message: 'App Package artifact exceeds 256 KiB' });
+    }
+});
+//# sourceMappingURL=schema.js.map

package/node_modules/@noodle-borg/app-package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,kCAAkC,EAClC,2BAA2B,EAC3B,mCAAmC,EACnC,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,gCAAgC,EAChC,2BAA2B,EAC3B,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAGrB,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,EAAE;KACR,GAAG,CAAC,mCAAmC,CAAC;KACxC,KAAK,CAAC,cAAc,CAAC,CAAC;AACzB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAClD,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,mCAAmC,CAAC;KACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAC;AAClF,MAAM,KAAK,GAAG,CAAC;KACZ,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,8BAA8B,CAAC;KACnC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAC;AAClF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7F,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;KACnF,MAAM,EAAE,CAAC;AACZ,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;CAC9E,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,KAAK,GAAG,CAAC;KACZ,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC;KACrF,MAAM,EAAE,CAAC;AACZ,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE;IACtB,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE;IACxB,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE;IACzB,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE;IACtB,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE;IACtB,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,cAAc,EAAE,CAAC;SACd,KAAK,CACJ,CAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAClF;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,uCAAuC,CAAC;SAC5C,QAAQ,EAAE;IACb,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,mCAAmC,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAClF;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,uCAAuC,CAAC;SAC5C,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;AAC7F,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC;IACzB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC;AACH,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,IAAI;IACJ,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;IACvB,WAAW,EAAE,KAAK;IAClB,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE;IAChC,QAAQ;IACR,UAAU;IACV,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE;CACxB,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3B,IAAI;IACJ,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;IACvB,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,MAAM,GAAG,CAAC;KACb,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,IAAI;IACJ,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;IACvB,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SACxF,GAAG,CAAC,mCAAmC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,MAAM,GAAG,CAAC;KACb,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,IAAI;IACJ,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;IACvB,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,IAAI;CACX,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,KAAK,GAAG,CAAC;KACZ,MAAM,CAAC;IACN,WAAW,EAAE,KAAK;IAClB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC/D,SAAS,EAAE,CAAC;SACT,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE;QACxB,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC;aACE,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;aACjF,MAAM,EAAE,CACZ;aACA,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,iCAAiC,CAAC;KAC1C,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,4BAA4B,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC7D,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC3D,GAAG,CAAC,2BAA2B,CAAC;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,4DAA4D;AAC5D,MAAM,CAAC,MAAM,0BAA0B,GAAoC,CAAC;KACzE,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7B,GAAG,EAAE,CAAC;SACH,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;SACvF,MAAM,EAAE;IACX,KAAK;IACL,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,IAAI,EAAE,CAAC;aACJ,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;aACrF,MAAM,EAAE;QACX,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC;QAC1D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC;QAClE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC;QAC9D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC;KAC/D,CAAC;SACD,MAAM,EAAE;IACX,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,oBAAoB,EAAE,MAAM;QAC5B,gBAAgB,EAAE,MAAM;QACxB,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KAChC,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,GAAG,kCAAkC,EAAE,CAAC;QACzF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC,CAAC,CAAC"}

package/node_modules/@noodle-borg/app-package/dist/sensitive-content.d.ts

@@ -0,0 +1,6 @@
+export interface SensitiveContentFinding {
+    readonly path: string;
+    readonly kind: 'private_key' | 'jwt' | 'github_token' | 'aws_access_key' | 'bearer_credential' | 'scan_limit';
+}
+export declare function sensitiveContentFinding(value: unknown): SensitiveContentFinding | undefined;
+//# sourceMappingURL=sensitive-content.d.ts.map

package/node_modules/@noodle-borg/app-package/dist/sensitive-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-content.d.ts","sourceRoot":"","sources":["../src/sensitive-content.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,KAAK,GACL,cAAc,GACd,gBAAgB,GAChB,mBAAmB,GACnB,YAAY,CAAC;CAClB;AAaD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,SAAS,CAyB3F"}

package/node_modules/@noodle-borg/app-package/dist/sensitive-content.js

@@ -0,0 +1,39 @@
+const PATTERNS = [
+    ['private_key', /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/],
+    [
+        'jwt',
+        /(?:^|[^A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}(?:$|[^A-Za-z0-9_-])/,
+    ],
+    ['github_token', /\b(?:ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{20,})\b/],
+    ['aws_access_key', /\bAKIA[0-9A-Z]{16}\b/],
+    ['bearer_credential', /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}(?:$|[^A-Za-z0-9._~+/=-])/],
+];
+export function sensitiveContentFinding(value) {
+    let visited = 0;
+    const visit = (current, path) => {
+        if (typeof current === 'string') {
+            visited++;
+            if (visited > 10_000)
+                return { path: '', kind: 'scan_limit' };
+            for (const [kind, pattern] of PATTERNS)
+                if (pattern.test(current))
+                    return { path, kind };
+            return undefined;
+        }
+        if (Array.isArray(current))
+            for (let index = 0; index < current.length; index++) {
+                const found = visit(current[index], path ? `${path}.${index}` : String(index));
+                if (found)
+                    return found;
+            }
+        else if (current !== null && typeof current === 'object')
+            for (const key of Object.keys(current).sort()) {
+                const found = visit(current[key], path ? `${path}.${key}` : key);
+                if (found)
+                    return found;
+            }
+        return undefined;
+    };
+    return visit(value, '');
+}
+//# sourceMappingURL=sensitive-content.js.map

package/node_modules/@noodle-borg/app-package/dist/sensitive-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-content.js","sourceRoot":"","sources":["../src/sensitive-content.ts"],"names":[],"mappings":"AAWA,MAAM,QAAQ,GAAyD;IACrE,CAAC,aAAa,EAAE,mDAAmD,CAAC;IACpE;QACE,KAAK;QACL,oGAAoG;KACrG;IACD,CAAC,cAAc,EAAE,0DAA0D,CAAC;IAC5E,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;IAC1C,CAAC,mBAAmB,EAAE,6DAA6D,CAAC;CACrF,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAuC,EAAE;QACpF,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;YACV,IAAI,OAAO,GAAG,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,QAAQ;gBAAE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACxB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC/E,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;aACE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAkC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzE,MAAM,KAAK,GAAG,KAAK,CAChB,OAAmC,CAAC,GAAG,CAAC,EACzC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAC9B,CAAC;gBACF,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC1B,CAAC"}

package/node_modules/@noodle-borg/app-package/dist/snapshot.d.ts

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+import type { AppPackageArtifactV1 } from './types.js';
+export declare const APP_PACKAGE_SNAPSHOT_V1_MAX_BYTES: number;
+declare const appPackageRenderedFileV1Schema: z.ZodObject<{
+    target: z.ZodEnum<{
+        codex: "codex";
+        "claude-code": "claude-code";
+    }>;
+    path: z.ZodString;
+    content: z.ZodString;
+    sha256: z.ZodString;
+    byteLength: z.ZodNumber;
+}, z.core.$strict>;
+export type AppPackageRenderedFileV1 = z.output<typeof appPackageRenderedFileV1Schema>;
+export interface AppPackageRenderedBundleV1 {
+    readonly schemaVersion: 1;
+    readonly rendererVersion: string;
+    readonly files: readonly AppPackageRenderedFileV1[];
+    readonly bundleSha256: string;
+}
+export type AppPackageRendererV1 = (input: AppPackageArtifactV1) => AppPackageRenderedBundleV1;
+export type AppPackageRenderedFilesValidatorV1 = (artifact: AppPackageArtifactV1, files: readonly AppPackageRenderedFileV1[]) => void;
+/** Strict persisted sibling schema, including content and metadata hash consistency. */
+export declare const appPackageSnapshotV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    artifact: z.ZodType<AppPackageArtifactV1, unknown, z.core.$ZodTypeInternals<AppPackageArtifactV1, unknown>>;
+    rendererVersion: z.ZodString;
+    files: z.ZodArray<z.ZodObject<{
+        target: z.ZodEnum<{
+            codex: "codex";
+            "claude-code": "claude-code";
+        }>;
+        path: z.ZodString;
+        content: z.ZodString;
+        sha256: z.ZodString;
+        byteLength: z.ZodNumber;
+    }, z.core.$strict>>;
+    snapshotSha256: z.ZodString;
+}, z.core.$strict>;
+export type AppPackageSnapshotV1 = z.output<typeof appPackageSnapshotV1Schema>;
+/** Stable, non-echoing failure for invalid App Package artifact or snapshot data. */
+export declare class AppPackageValidationError extends Error {
+    readonly code: "app_package_invalid";
+    constructor();
+}
+/** Render, validate, and bind the exact deployment package bytes into an immutable snapshot. */
+export declare function createAppPackageSnapshotV1(artifact: AppPackageArtifactV1, render: AppPackageRendererV1, validateFiles?: AppPackageRenderedFilesValidatorV1): AppPackageSnapshotV1;
+/** Parse only a complete, internally consistent snapshot; malformed optional siblings disappear. */
+export declare function parseAppPackageSnapshotV1(value: unknown, validateFiles?: AppPackageRenderedFilesValidatorV1): AppPackageSnapshotV1 | undefined;
+export {};
+//# sourceMappingURL=snapshot.d.ts.map

package/node_modules/@noodle-borg/app-package/dist/snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,eAAO,MAAM,iCAAiC,QAAc,CAAC;AAG7D,QAAA,MAAM,8BAA8B;;;;;;;;;kBAQzB,CAAC;AAEZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEvF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,oBAAoB,KAAK,0BAA0B,CAAC;AAE/F,MAAM,MAAM,kCAAkC,GAAG,CAC/C,QAAQ,EAAE,oBAAoB,EAC9B,KAAK,EAAE,SAAS,wBAAwB,EAAE,KACvC,IAAI,CAAC;AAgBV,wFAAwF;AACxF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;kBA2BrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE/E,qFAAqF;AACrF,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;;CAMhD;AAED,gGAAgG;AAChG,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,oBAAoB,EAC5B,aAAa,CAAC,EAAE,kCAAkC,GACjD,oBAAoB,CAwCtB;AAED,oGAAoG;AACpG,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,aAAa,CAAC,EAAE,kCAAkC,GACjD,oBAAoB,GAAG,SAAS,CAUlC"}

package/node_modules/@noodle-borg/app-package/dist/snapshot.js

@@ -0,0 +1,160 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { sha256Canonical } from './canonical.js';
+import { appPackageArtifactV1Schema } from './schema.js';
+export const APP_PACKAGE_SNAPSHOT_V1_MAX_BYTES = 1024 * 1024;
+const SHA256 = /^[a-f0-9]{64}$/;
+const appPackageRenderedFileV1Schema = z
+    .object({
+    target: z.enum(['codex', 'claude-code']),
+    path: z.string().min(1),
+    content: z.string().refine((value) => value.trim().length > 0),
+    sha256: z.string().regex(SHA256),
+    byteLength: z.number().int().nonnegative(),
+})
+    .strict();
+const appPackageSnapshotV1Shape = z
+    .object({
+    schemaVersion: z.literal(1),
+    artifact: appPackageArtifactV1Schema,
+    rendererVersion: z
+        .string()
+        .min(1)
+        .max(200)
+        .refine((value) => value.trim() === value),
+    files: z.array(appPackageRenderedFileV1Schema).length(4),
+    snapshotSha256: z.string().regex(SHA256),
+})
+    .strict();
+/** Strict persisted sibling schema, including content and metadata hash consistency. */
+export const appPackageSnapshotV1Schema = appPackageSnapshotV1Shape.superRefine((snapshot, ctx) => {
+    if (serializedBytes(snapshot) > APP_PACKAGE_SNAPSHOT_V1_MAX_BYTES) {
+        ctx.addIssue({ code: 'custom', message: 'App Package snapshot exceeds 1 MiB' });
+    }
+    for (const [index, file] of snapshot.files.entries()) {
+        if (file.byteLength !== Buffer.byteLength(file.content, 'utf8')) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['files', index, 'byteLength'],
+                message: 'rendered file byte length does not match its content',
+            });
+        }
+        if (file.sha256 !== sha256Text(file.content)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['files', index, 'sha256'],
+                message: 'rendered file digest does not match its content',
+            });
+        }
+    }
+    if (snapshot.snapshotSha256 !== snapshotSha256(snapshot)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['snapshotSha256'],
+            message: 'snapshot digest does not match its artifact and rendered file metadata',
+        });
+    }
+});
+/** Stable, non-echoing failure for invalid App Package artifact or snapshot data. */
+export class AppPackageValidationError extends Error {
+    code = 'app_package_invalid';
+    constructor() {
+        super('App Package validation failed: app_package_invalid');
+        this.name = 'AppPackageValidationError';
+    }
+}
+/** Render, validate, and bind the exact deployment package bytes into an immutable snapshot. */
+export function createAppPackageSnapshotV1(artifact, render, validateFiles) {
+    const safeArtifact = deepFreeze(appPackageArtifactV1Schema.parse(artifact));
+    const rendered = render(safeArtifact);
+    if (!Array.isArray(rendered.files))
+        fail();
+    const files = rendered.files.map((file) => Object.freeze({ ...file }));
+    const expectedBundleSha256 = sha256Canonical({
+        sourceManifestSha256: safeArtifact.provenance.sourceManifestSha256,
+        mcpSurfaceSha256: safeArtifact.provenance.mcpSurfaceSha256,
+        files: files.map(({ target, path, sha256 }) => ({ target, path, sha256 })),
+    });
+    if (rendered.schemaVersion !== 1 ||
+        typeof rendered.bundleSha256 !== 'string' ||
+        !SHA256.test(rendered.bundleSha256) ||
+        rendered.bundleSha256 !== expectedBundleSha256 ||
+        files.length !== 4) {
+        fail();
+    }
+    const candidate = {
+        schemaVersion: 1,
+        artifact: safeArtifact,
+        rendererVersion: rendered.rendererVersion,
+        files,
+        snapshotSha256: sha256Canonical({
+            artifact: safeArtifact,
+            rendererVersion: rendered.rendererVersion,
+            files: files.map(({ target, path, sha256, byteLength }) => ({
+                target,
+                path,
+                sha256,
+                byteLength,
+            })),
+        }),
+    };
+    if (serializedBytes(candidate) > APP_PACKAGE_SNAPSHOT_V1_MAX_BYTES)
+        fail();
+    validateFiles?.(safeArtifact, files);
+    const parsed = appPackageSnapshotV1Schema.safeParse(candidate);
+    if (!parsed.success)
+        fail();
+    return deepFreeze(parsed.data);
+}
+/** Parse only a complete, internally consistent snapshot; malformed optional siblings disappear. */
+export function parseAppPackageSnapshotV1(value, validateFiles) {
+    if (serializedBytes(value) > APP_PACKAGE_SNAPSHOT_V1_MAX_BYTES)
+        return undefined;
+    const parsed = appPackageSnapshotV1Schema.safeParse(value);
+    if (!parsed.success)
+        return undefined;
+    try {
+        validateFiles?.(parsed.data.artifact, parsed.data.files);
+        return deepFreeze(parsed.data);
+    }
+    catch {
+        return undefined;
+    }
+}
+function snapshotSha256(snapshot) {
+    return sha256Canonical({
+        artifact: snapshot.artifact,
+        rendererVersion: snapshot.rendererVersion,
+        files: snapshot.files.map(({ target, path, sha256, byteLength }) => ({
+            target,
+            path,
+            sha256,
+            byteLength,
+        })),
+    });
+}
+function serializedBytes(value) {
+    try {
+        const serialized = JSON.stringify(value);
+        return serialized === undefined
+            ? Number.POSITIVE_INFINITY
+            : Buffer.byteLength(serialized, 'utf8');
+    }
+    catch {
+        return Number.POSITIVE_INFINITY;
+    }
+}
+function sha256Text(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function deepFreeze(value) {
+    if (Array.isArray(value))
+        value.forEach(deepFreeze);
+    else if (value !== null && typeof value === 'object')
+        Object.values(value).forEach(deepFreeze);
+    return Object.freeze(value);
+}
+function fail() {
+    throw new AppPackageValidationError();
+}
+//# sourceMappingURL=snapshot.js.map

package/node_modules/@noodle-borg/app-package/dist/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAGzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,MAAM,8BAA8B,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAkBZ,MAAM,yBAAyB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,0BAA0B;IACpC,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,wFAAwF;AACxF,MAAM,CAAC,MAAM,0BAA0B,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChG,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,iCAAiC,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;gBACpC,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC;gBAChC,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,qFAAqF;AACrF,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,qBAA8B,CAAC;IAE/C;QACE,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,UAAU,0BAA0B,CACxC,QAA8B,EAC9B,MAA4B,EAC5B,aAAkD;IAElD,MAAM,YAAY,GAAG,UAAU,CAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,oBAAoB,GAAG,eAAe,CAAC;QAC3C,oBAAoB,EAAE,YAAY,CAAC,UAAU,CAAC,oBAAoB;QAClE,gBAAgB,EAAE,YAAY,CAAC,UAAU,CAAC,gBAAgB;QAC1D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;KAC3E,CAAC,CAAC;IACH,IACE,QAAQ,CAAC,aAAa,KAAK,CAAC;QAC5B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;QACzC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QACnC,QAAQ,CAAC,YAAY,KAAK,oBAAoB;QAC9C,KAAK,CAAC,MAAM,KAAK,CAAC,EAClB,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,KAAK;QACL,cAAc,EAAE,eAAe,CAAC;YAC9B,QAAQ,EAAE,YAAY;YACtB,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM;gBACN,IAAI;gBACJ,MAAM;gBACN,UAAU;aACX,CAAC,CAAC;SACJ,CAAC;KACM,CAAC;IACX,IAAI,eAAe,CAAC,SAAS,CAAC,GAAG,iCAAiC;QAAE,IAAI,EAAE,CAAC;IAC3E,aAAa,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,IAAI,EAAE,CAAC;IAC5B,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,aAAkD;IAElD,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,iCAAiC;QAAE,OAAO,SAAS,CAAC;IACjF,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC;QACH,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAIvB;IACC,OAAO,eAAe,CAAC;QACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YACnE,MAAM;YACN,IAAI;YACJ,MAAM;YACN,UAAU;SACX,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,UAAU,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,IAAI;IACX,MAAM,IAAI,yBAAyB,EAAE,CAAC;AACxC,CAAC"}