@notegen/plugin-cli 0.1.0

package/dist/lib/scaffold.js

@@ -0,0 +1,230 @@
+import { spawn } from 'node:child_process';
+import { lstat, mkdir, readdir, rm, rmdir } from 'node:fs/promises';
+import { basename, join, resolve } from 'node:path';
+import { diagnostic, DiagnosticError } from './diagnostics.js';
+import { pathExists, writeFileExclusive } from './files.js';
+import { parsePluginManifest } from './manifest.js';
+function json(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function projectSlug(directory) {
+    const normalized = basename(resolve(directory))
+        .normalize('NFKD')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return normalized || 'notegen-plugin';
+}
+function commandSource(id) {
+    const commandId = `${id}.hello`;
+    return `import type { PluginActivate } from '@notegen/plugin-api'\n\nexport const activate: PluginActivate = async (context) => {\n  context.commands.handle('${commandId}', async () => {\n    await context.ui.showNotice('Hello from ${id}')\n  })\n}\n`;
+}
+function editorStatisticsSource(id) {
+    return `import type { ActiveEditorContext, PluginActivate } from '@notegen/plugin-api'\n\nfunction formatSize(editor: ActiveEditorContext | null): string {\n  if (!editor) return 'No active editor'\n  return editor.size.lines + ' lines · ' + editor.size.utf16Length + ' characters'\n}\n\nexport const activate: PluginActivate = async (context) => {\n  const statusId = '${id}.status'\n  const update = async () => {\n    const editor = await context.editor.getActiveEditor()\n    await context.ui.statusBar.update(statusId, {\n      visible: editor !== null,\n      text: formatSize(editor),\n      accessibleLabel: formatSize(editor),\n    })\n  }\n\n  context.editor.onDidChangeActiveEditor(update)\n  context.editor.onDidChangeContent(update)\n  await update()\n}\n`;
+}
+function templateFiles(options) {
+    const template = options.template ?? 'command';
+    const packageManager = options.packageManager ?? 'pnpm';
+    const source = template === 'editor-statistics'
+        ? editorStatisticsSource(options.id)
+        : commandSource(options.id);
+    const commandId = `${options.id}.hello`;
+    const manifest = template === 'editor-statistics'
+        ? {
+            manifestVersion: 1,
+            id: options.id,
+            name: options.name,
+            description: options.description ?? 'Show statistics for the active NoteGen editor.',
+            version: '0.1.0',
+            apiVersion: options.apiVersion ?? '^0.1.0',
+            minAppVersion: options.minAppVersion ?? '0.37.0',
+            platforms: ['desktop'],
+            entry: 'dist/main.js',
+            activationEvents: ['onEditor:markdown'],
+            permissions: {
+                'editor.read': {
+                    scope: 'active-editor',
+                    description: 'Read the active editor size to display live statistics.',
+                },
+            },
+            contributes: {
+                statusBar: [{ id: `${options.id}.status`, alignment: 'right' }],
+            },
+            license: 'MIT',
+        }
+        : {
+            manifestVersion: 1,
+            id: options.id,
+            name: options.name,
+            description: options.description ?? 'A NoteGen command plugin.',
+            version: '0.1.0',
+            apiVersion: options.apiVersion ?? '^0.1.0',
+            minAppVersion: options.minAppVersion ?? '0.37.0',
+            platforms: ['desktop'],
+            entry: 'dist/main.js',
+            activationEvents: [`onCommand:${commandId}`],
+            permissions: {},
+            contributes: {
+                commands: [{
+                        id: commandId,
+                        title: 'Say hello',
+                        description: 'Show a notice from this plugin.',
+                    }],
+            },
+            license: 'MIT',
+        };
+    const scripts = {
+        dev: 'notegen-plugin dev',
+        build: 'tsc -p tsconfig.json --noEmit && notegen-plugin build',
+        validate: 'tsc -p tsconfig.json --noEmit && notegen-plugin validate',
+        pack: 'notegen-plugin pack',
+    };
+    return new Map([
+        ['.gitignore', 'node_modules/\n.notegen/\n'],
+        ['plugin.json', json(manifest)],
+        ['package.json', json({
+                name: projectSlug(options.directory),
+                version: '0.1.0',
+                private: true,
+                type: 'module',
+                scripts,
+                notegen: { source: 'src/main.ts' },
+                devDependencies: {
+                    '@notegen/plugin-api': '^0.1.0',
+                    '@notegen/plugin-cli': '^0.1.0',
+                    typescript: '^5.8.3',
+                },
+                packageManager: packageManager === 'pnpm' ? 'pnpm@10.20.0' : undefined,
+            })],
+        ['tsconfig.json', json({
+                compilerOptions: {
+                    target: 'ES2022',
+                    module: 'ESNext',
+                    moduleResolution: 'Bundler',
+                    lib: ['ES2022'],
+                    strict: true,
+                    noEmit: true,
+                    isolatedModules: true,
+                    verbatimModuleSyntax: true,
+                    skipLibCheck: true,
+                },
+                include: ['src/**/*.ts'],
+            })],
+        ['src/main.ts', source],
+    ]);
+}
+function generatedParentDirectories(paths) {
+    const directories = new Set();
+    for (const path of paths) {
+        const segments = path.split('/');
+        segments.pop();
+        while (segments.length > 0) {
+            directories.add(segments.join('/'));
+            segments.pop();
+        }
+    }
+    return [...directories].sort((left, right) => (right.split('/').length - left.split('/').length));
+}
+async function runInstall(directory, packageManager, output) {
+    await new Promise((resolvePromise, reject) => {
+        const child = spawn(packageManager, ['install'], {
+            cwd: directory,
+            stdio: output === undefined ? 'inherit' : ['inherit', 'pipe', 'pipe'],
+            shell: process.platform === 'win32',
+        });
+        if (output !== undefined) {
+            child.stdout?.on('data', (chunk) => output.write(chunk));
+            child.stderr?.on('data', (chunk) => output.write(chunk));
+        }
+        child.once('error', reject);
+        child.once('exit', (code, signal) => {
+            if (code === 0) {
+                resolvePromise();
+                return;
+            }
+            reject(new DiagnosticError(diagnostic({
+                code: 'create.install_failed',
+                message: signal
+                    ? `${packageManager} install was interrupted by ${signal}`
+                    : `${packageManager} install exited with code ${code ?? 'unknown'}`,
+                path: directory,
+            })));
+        });
+    });
+}
+export async function createPluginProject(options) {
+    if (options.template !== undefined && !['command', 'editor-statistics'].includes(options.template)) {
+        throw new DiagnosticError(diagnostic({
+            code: 'create.invalid-template',
+            message: `Unsupported plugin template: ${options.template}`,
+        }));
+    }
+    if (options.packageManager !== undefined && !['pnpm', 'npm'].includes(options.packageManager)) {
+        throw new DiagnosticError(diagnostic({
+            code: 'create.invalid-package-manager',
+            message: `Unsupported package manager: ${options.packageManager}`,
+        }));
+    }
+    const files = templateFiles(options);
+    const manifestSource = files.get('plugin.json');
+    if (manifestSource === undefined) {
+        throw new DiagnosticError(diagnostic({
+            code: 'create.template-invalid',
+            message: 'Plugin template did not produce plugin.json',
+        }));
+    }
+    parsePluginManifest(manifestSource);
+    const directory = resolve(options.directory);
+    const existed = await pathExists(directory);
+    if (existed) {
+        const metadata = await lstat(directory);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+            throw new DiagnosticError(diagnostic({
+                code: 'create.target_invalid',
+                message: 'The project target must be a real directory',
+                path: directory,
+            }));
+        }
+        const children = await readdir(directory);
+        if (children.length > 0) {
+            throw new DiagnosticError(diagnostic({
+                code: 'create.target_not_empty',
+                message: 'Refusing to create a plugin in a non-empty directory',
+                path: directory,
+            }));
+        }
+    }
+    else {
+        await mkdir(directory, { recursive: true });
+    }
+    const written = [];
+    try {
+        for (const [path, contents] of files) {
+            await writeFileExclusive(join(directory, path), contents);
+            written.push(path);
+        }
+    }
+    catch (error) {
+        for (const path of written.reverse()) {
+            await rm(join(directory, path), { force: true }).catch(() => undefined);
+        }
+        if (!existed) {
+            await rm(directory, { recursive: true, force: true }).catch(() => undefined);
+        }
+        else {
+            for (const path of generatedParentDirectories(files.keys())) {
+                await rmdir(join(directory, ...path.split('/'))).catch(() => undefined);
+            }
+        }
+        throw error;
+    }
+    const packageManager = options.packageManager ?? 'pnpm';
+    if (options.install)
+        await runInstall(directory, packageManager, options.installOutput);
+    return Object.freeze({
+        directory,
+        files: Object.freeze([...files.keys()]),
+        packageManager,
+        installed: options.install === true,
+    });
+}

package/dist/lib/signing.d.ts

@@ -0,0 +1,26 @@
+import { KeyObject } from 'node:crypto';
+export declare const ED25519_PUBLIC_KEY_BYTES = 32;
+export declare const ED25519_SIGNATURE_BYTES = 64;
+export type PrivateKeySource = string | Uint8Array | KeyObject;
+export type PublicKeySource = string | KeyObject;
+export interface PrivateKeyOptions {
+    readonly passphrase?: string | Uint8Array;
+}
+export interface GeneratedPublisherKeyPair {
+    /** PKCS#8 PEM. It is encrypted when a passphrase is supplied. */
+    readonly privateKeyPem: string;
+    /** Raw 32-byte Ed25519 public key encoded with standard padded Base64. */
+    readonly publicKey: string;
+    /** Stable SDK convention; the host treats keyId as signed marketplace metadata. */
+    readonly keyId: string;
+}
+export declare function canonicalJsonBytes(value: unknown): Buffer;
+export declare function createPackageSignatureMessage(manifestValue: unknown, integrityValue: unknown): Buffer;
+export declare function decodePublisherPublicKey(value: string): Buffer;
+export declare function decodePackageSignature(value: string): Buffer;
+export declare function publisherPublicKeyFromPrivate(privateKey: PrivateKeySource, options?: PrivateKeyOptions): string;
+export declare function publisherKeyId(publicKey: PublicKeySource): string;
+export declare function generatePublisherKeyPair(passphrase?: string | Uint8Array): GeneratedPublisherKeyPair;
+export declare function signPackage(manifestValue: unknown, integrityValue: unknown, privateKey: PrivateKeySource, options?: PrivateKeyOptions): string;
+export declare function verifyPackageSignature(manifestValue: unknown, integrityValue: unknown, signatureBase64: string, publicKey: PublicKeySource): boolean;
+export declare function assertPackageSignature(manifestValue: unknown, integrityValue: unknown, signatureBase64: string, publicKey: PublicKeySource): void;

package/dist/lib/signing.js

@@ -0,0 +1,181 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, KeyObject, sign as nodeSign, verify as nodeVerify, } from 'node:crypto';
+import canonicalize from 'canonicalize';
+import { fail } from './diagnostics.js';
+const canonicalizeJson = canonicalize;
+const PACKAGE_SIGNATURE_DOMAIN = Buffer.from('NOTEGEN_PLUGIN_SIGNATURE_V1\0', 'utf8');
+export const ED25519_PUBLIC_KEY_BYTES = 32;
+export const ED25519_SIGNATURE_BYTES = 64;
+function lengthFrame(length) {
+    if (!Number.isSafeInteger(length) || length < 0) {
+        fail('signature.invalid-length', 'Signature message length is outside the supported range');
+    }
+    const bytes = Buffer.alloc(8);
+    bytes.writeBigUInt64BE(BigInt(length));
+    return bytes;
+}
+export function canonicalJsonBytes(value) {
+    let serialized;
+    try {
+        serialized = canonicalizeJson(value);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'value is not canonicalizable';
+        fail('signature.invalid-json', `Unable to canonicalize signed JSON: ${message}`);
+    }
+    if (typeof serialized !== 'string') {
+        fail('signature.invalid-json', 'Signed value is not valid canonical JSON');
+    }
+    return Buffer.from(serialized, 'utf8');
+}
+export function createPackageSignatureMessage(manifestValue, integrityValue) {
+    const manifest = canonicalJsonBytes(manifestValue);
+    const integrity = canonicalJsonBytes(integrityValue);
+    return Buffer.concat([
+        PACKAGE_SIGNATURE_DOMAIN,
+        lengthFrame(manifest.byteLength),
+        manifest,
+        lengthFrame(integrity.byteLength),
+        integrity,
+    ]);
+}
+function decodeBase64(value, expectedBytes, label) {
+    const compact = [...value]
+        .filter((character) => !/\p{White_Space}/u.test(character))
+        .join('');
+    let decoded;
+    const paddedStandard = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$(?![\s\S])/u;
+    const unpaddedStandard = /^[A-Za-z0-9+/]*$(?![\s\S])/u;
+    const unpaddedUrlSafe = /^[A-Za-z0-9_-]*$(?![\s\S])/u;
+    if (paddedStandard.test(compact) && compact.length % 4 === 0) {
+        const candidate = Buffer.from(compact, 'base64');
+        if (candidate.toString('base64') === compact)
+            decoded = candidate;
+    }
+    else if (unpaddedStandard.test(compact) && compact.length % 4 !== 1) {
+        const candidate = Buffer.from(compact, 'base64');
+        if (candidate.toString('base64').replace(/=+$/u, '') === compact)
+            decoded = candidate;
+    }
+    else if (unpaddedUrlSafe.test(compact) && compact.length % 4 !== 1) {
+        const candidate = Buffer.from(compact, 'base64url');
+        if (candidate.toString('base64url') === compact)
+            decoded = candidate;
+    }
+    if (!decoded)
+        fail('signature.invalid-base64', `${label} is not valid Base64`, label);
+    if (decoded.byteLength !== expectedBytes) {
+        fail('signature.invalid-length', `${label} must decode to ${expectedBytes} bytes`, label);
+    }
+    return decoded;
+}
+export function decodePublisherPublicKey(value) {
+    return decodeBase64(value, ED25519_PUBLIC_KEY_BYTES, 'publisher public key');
+}
+export function decodePackageSignature(value) {
+    return decodeBase64(value, ED25519_SIGNATURE_BYTES, 'signature.sig');
+}
+function publicKeyObject(source) {
+    if (typeof source !== 'string') {
+        if (source.type !== 'public' || source.asymmetricKeyType !== 'ed25519') {
+            fail('signature.invalid-public-key', 'Publisher public key must be an Ed25519 public key');
+        }
+        return source;
+    }
+    const raw = decodePublisherPublicKey(source);
+    try {
+        return createPublicKey({
+            key: {
+                kty: 'OKP',
+                crv: 'Ed25519',
+                x: raw.toString('base64url'),
+            },
+            format: 'jwk',
+        });
+    }
+    catch {
+        fail('signature.invalid-public-key', 'Unable to import the Ed25519 publisher public key');
+    }
+}
+function privateKeyObject(source, options = {}) {
+    let key;
+    try {
+        key = source instanceof KeyObject
+            ? source
+            : createPrivateKey({
+                key: typeof source === 'string' ? source : Buffer.from(source),
+                format: 'pem',
+                ...(options.passphrase === undefined ? {} : {
+                    passphrase: typeof options.passphrase === 'string' ? options.passphrase : Buffer.from(options.passphrase),
+                }),
+            });
+    }
+    catch {
+        fail('signature.invalid-private-key', 'Unable to import the PKCS#8 publisher private key');
+    }
+    if (key.type !== 'private' || key.asymmetricKeyType !== 'ed25519') {
+        fail('signature.invalid-private-key', 'Publisher private key must be an Ed25519 private key');
+    }
+    return key;
+}
+function rawPublicKey(key) {
+    let exported;
+    try {
+        exported = key.export({ format: 'jwk' });
+    }
+    catch {
+        fail('signature.invalid-public-key', 'Unable to export the Ed25519 publisher public key');
+    }
+    if (exported.kty !== 'OKP' || exported.crv !== 'Ed25519' || typeof exported.x !== 'string') {
+        fail('signature.invalid-public-key', 'Publisher public key is not raw Ed25519 key material');
+    }
+    const raw = Buffer.from(exported.x, 'base64url');
+    if (raw.byteLength !== ED25519_PUBLIC_KEY_BYTES) {
+        fail('signature.invalid-public-key', 'Publisher public key must contain 32 raw bytes');
+    }
+    return raw;
+}
+export function publisherPublicKeyFromPrivate(privateKey, options = {}) {
+    const publicKey = createPublicKey(privateKeyObject(privateKey, options));
+    return rawPublicKey(publicKey).toString('base64');
+}
+export function publisherKeyId(publicKey) {
+    const raw = typeof publicKey === 'string'
+        ? decodePublisherPublicKey(publicKey)
+        : rawPublicKey(publicKeyObject(publicKey));
+    return `ed25519-${createHash('sha256').update(raw).digest('hex')}`;
+}
+export function generatePublisherKeyPair(passphrase) {
+    const generated = generateKeyPairSync('ed25519');
+    const exportedPrivate = passphrase === undefined
+        ? generated.privateKey.export({ type: 'pkcs8', format: 'pem' })
+        : generated.privateKey.export({
+            type: 'pkcs8',
+            format: 'pem',
+            cipher: 'aes-256-cbc',
+            passphrase: typeof passphrase === 'string' ? passphrase : Buffer.from(passphrase),
+        });
+    const publicKey = rawPublicKey(generated.publicKey).toString('base64');
+    return {
+        privateKeyPem: exportedPrivate.toString(),
+        publicKey,
+        keyId: publisherKeyId(publicKey),
+    };
+}
+export function signPackage(manifestValue, integrityValue, privateKey, options = {}) {
+    const key = privateKeyObject(privateKey, options);
+    const signature = nodeSign(null, createPackageSignatureMessage(manifestValue, integrityValue), key);
+    if (signature.byteLength !== ED25519_SIGNATURE_BYTES) {
+        fail('signature.invalid-length', 'Ed25519 signer returned an unexpected signature length');
+    }
+    return signature.toString('base64');
+}
+export function verifyPackageSignature(manifestValue, integrityValue, signatureBase64, publicKey) {
+    const signature = decodePackageSignature(signatureBase64);
+    const key = publicKeyObject(publicKey);
+    return nodeVerify(null, createPackageSignatureMessage(manifestValue, integrityValue), key, signature);
+}
+export function assertPackageSignature(manifestValue, integrityValue, signatureBase64, publicKey) {
+    if (!verifyPackageSignature(manifestValue, integrityValue, signatureBase64, publicKey)) {
+        fail('signature.verification-failed', 'Ed25519 package signature verification failed', 'signature.sig');
+    }
+}

package/dist/lib/strict-json.d.ts

@@ -0,0 +1,26 @@
+export type JsonObject = Record<string, unknown>;
+export interface StrictJsonDocument<T = unknown> {
+    readonly text: string;
+    readonly value: T;
+}
+type JsonContainer = Record<string, unknown> | readonly unknown[];
+/**
+ * Ensures a parsed JSON number used by an integer schema field was written as
+ * an integer token. This mirrors serde's u32/i32/u64 decoding, which rejects
+ * otherwise equivalent floating-point forms such as `1.0` and `1e0`.
+ */
+export declare function assertJsonIntegerToken(container: JsonContainer, key: string | number, path: string, options?: {
+    readonly signed?: boolean;
+}): void;
+/**
+ * Parses standard JSON while rejecting comments, trailing commas, BOMs, trailing
+ * values, invalid UTF-8, and duplicate keys at every object depth.
+ *
+ * The returned value preserves the fields supplied by the author. Callers must
+ * not add schema defaults before passing it to package signing.
+ */
+export declare function parseStrictJsonDocument(input: string | Uint8Array, label?: string): StrictJsonDocument;
+export declare function parseStrictJson(input: string | Uint8Array, label?: string): unknown;
+export declare function isJsonObject(value: unknown): value is JsonObject;
+export declare function parseStrictJsonObject(input: string | Uint8Array, label?: string): JsonObject;
+export {};

package/dist/lib/strict-json.js

@@ -0,0 +1,210 @@
+import { getNodeValue, parseTree, printParseErrorCode, } from 'jsonc-parser';
+import { fail } from './diagnostics.js';
+const integerNumberToken = /^(?:0|[1-9]\d*)$(?![\s\S])/u;
+const signedIntegerNumberToken = /^(?:0|[1-9]\d*|-[1-9]\d*)$(?![\s\S])/u;
+const numberTokens = new WeakMap();
+function decodeJsonInput(input, label) {
+    if (typeof input === 'string')
+        return input;
+    try {
+        // Keeping a BOM in the decoded result lets us reject it just like serde_json.
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(input);
+    }
+    catch {
+        fail('json.invalid-utf8', `${label} must be valid UTF-8`, label);
+    }
+}
+function lineAndColumn(text, offset) {
+    let line = 1;
+    let column = 1;
+    for (let index = 0; index < offset && index < text.length; index += 1) {
+        if (text.charCodeAt(index) === 0x0a) {
+            line += 1;
+            column = 1;
+        }
+        else {
+            column += 1;
+        }
+    }
+    return `${line}:${column}`;
+}
+function propertyPath(segments) {
+    let output = '$';
+    for (const segment of segments) {
+        if (typeof segment === 'number') {
+            output += `[${segment}]`;
+        }
+        else if (/^[A-Za-z_$][A-Za-z0-9_$]*$(?![\s\S])/.test(segment)) {
+            output += `.${segment}`;
+        }
+        else {
+            output += `[${JSON.stringify(segment)}]`;
+        }
+    }
+    return output;
+}
+function assertNoDuplicateKeys(node, text, label, path = []) {
+    if (node.type === 'object') {
+        const keys = new Set();
+        for (const property of node.children ?? []) {
+            const keyNode = property.children?.[0];
+            const valueNode = property.children?.[1];
+            if (!keyNode || typeof keyNode.value !== 'string' || !valueNode)
+                continue;
+            const key = keyNode.value;
+            if (keys.has(key)) {
+                fail('json.duplicate-key', `${label} contains the duplicate object key ${JSON.stringify(key)}`, `${propertyPath([...path, key])} (${lineAndColumn(text, keyNode.offset)})`);
+            }
+            keys.add(key);
+            assertNoDuplicateKeys(valueNode, text, label, [...path, key]);
+        }
+        return;
+    }
+    if (node.type === 'array') {
+        for (const [index, child] of (node.children ?? []).entries()) {
+            assertNoDuplicateKeys(child, text, label, [...path, index]);
+        }
+    }
+}
+function assertValidSyntax(text, label) {
+    if (text.startsWith('\uFEFF')) {
+        fail('json.bom', `${label} must not start with a UTF-8 byte-order mark`, label);
+    }
+    const errors = [];
+    const root = parseTree(text, errors, {
+        allowEmptyContent: false,
+        allowTrailingComma: false,
+        disallowComments: true,
+    });
+    const first = errors[0];
+    if (!root || first) {
+        const message = first
+            ? printParseErrorCode(first.error)
+            : 'JSON document has no root value';
+        const location = first ? lineAndColumn(text, first.offset) : '1:1';
+        fail('json.invalid-syntax', `${label} is not valid strict JSON: ${message}`, `${label}:${location}`);
+    }
+    return root;
+}
+function hasLoneSurrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const unit = value.charCodeAt(index);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                return true;
+            index += 1;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff) {
+            return true;
+        }
+    }
+    return false;
+}
+function assertCompatibleJsonValue(value, label, path = []) {
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            fail('json.number-out-of-range', `${label} contains a number outside the JSON range`, propertyPath(path));
+        }
+        return;
+    }
+    if (typeof value === 'string') {
+        if (hasLoneSurrogate(value)) {
+            fail('json.invalid-unicode', `${label} contains an unpaired UTF-16 surrogate`, propertyPath(path));
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const [index, child] of value.entries()) {
+            assertCompatibleJsonValue(child, label, [...path, index]);
+        }
+        return;
+    }
+    if (typeof value === 'object' && value !== null) {
+        for (const [key, child] of Object.entries(value)) {
+            if (hasLoneSurrogate(key)) {
+                fail('json.invalid-unicode', `${label} contains an object key with an unpaired UTF-16 surrogate`, propertyPath([...path, key]));
+            }
+            assertCompatibleJsonValue(child, label, [...path, key]);
+        }
+    }
+}
+function indexNumberTokens(node, value, text) {
+    if (node.type !== 'object' && node.type !== 'array')
+        return;
+    if (typeof value !== 'object' || value === null)
+        return;
+    const direct = new Map();
+    if (node.type === 'object' && !Array.isArray(value)) {
+        const objectValue = value;
+        for (const property of node.children ?? []) {
+            const keyNode = property.children?.[0];
+            const valueNode = property.children?.[1];
+            if (!keyNode || typeof keyNode.value !== 'string' || !valueNode)
+                continue;
+            const key = keyNode.value;
+            if (valueNode.type === 'number') {
+                direct.set(key, text.slice(valueNode.offset, valueNode.offset + valueNode.length));
+            }
+            else {
+                indexNumberTokens(valueNode, objectValue[key], text);
+            }
+        }
+    }
+    else if (node.type === 'array' && Array.isArray(value)) {
+        for (const [index, child] of (node.children ?? []).entries()) {
+            if (child.type === 'number') {
+                direct.set(index, text.slice(child.offset, child.offset + child.length));
+            }
+            else {
+                indexNumberTokens(child, value[index], text);
+            }
+        }
+    }
+    numberTokens.set(value, direct);
+}
+/**
+ * Ensures a parsed JSON number used by an integer schema field was written as
+ * an integer token. This mirrors serde's u32/i32/u64 decoding, which rejects
+ * otherwise equivalent floating-point forms such as `1.0` and `1e0`.
+ */
+export function assertJsonIntegerToken(container, key, path, options = {}) {
+    const token = numberTokens.get(container)?.get(key);
+    if (token === undefined)
+        return;
+    const valid = (options.signed ? signedIntegerNumberToken : integerNumberToken).test(token);
+    if (!valid) {
+        fail('json.expected-integer-token', `${path} must use an integer JSON token without a fraction, exponent, or negative zero`, path);
+    }
+}
+/**
+ * Parses standard JSON while rejecting comments, trailing commas, BOMs, trailing
+ * values, invalid UTF-8, and duplicate keys at every object depth.
+ *
+ * The returned value preserves the fields supplied by the author. Callers must
+ * not add schema defaults before passing it to package signing.
+ */
+export function parseStrictJsonDocument(input, label = 'JSON') {
+    const text = decodeJsonInput(input, label);
+    const root = assertValidSyntax(text, label);
+    assertNoDuplicateKeys(root, text, label);
+    // parseTree has already applied the strict syntax policy. getNodeValue keeps
+    // the same JSON value without a schema-driven normalize/reserialize step.
+    const value = getNodeValue(root);
+    assertCompatibleJsonValue(value, label);
+    indexNumberTokens(root, value, text);
+    return { text, value };
+}
+export function parseStrictJson(input, label = 'JSON') {
+    return parseStrictJsonDocument(input, label).value;
+}
+export function isJsonObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function parseStrictJsonObject(input, label = 'JSON') {
+    const value = parseStrictJson(input, label);
+    if (!isJsonObject(value)) {
+        fail('json.expected-object', `${label} must contain a JSON object`, label);
+    }
+    return value;
+}