@serve.zone/appstore 32.27.0 → 33.0.0

package/dist_ts_client/types.d.ts

@@ -1,17 +1,4 @@
-import type * as interfaces from '@serve.zone/interfaces';
-export type TAppStoreFetch = typeof fetch;
-export type TAppStoreSourceMode = 'package' | 'remote';
-export type TAppStoreIndex = interfaces.appstore.IAppStoreIndex;
-export type TAppStoreApp = interfaces.appstore.IAppStoreApp;
-export type TAppStoreAppMeta = interfaces.appstore.IAppStoreAppMeta;
-export type TAppStoreVersionConfig = interfaces.appstore.IAppStoreVersionConfig;
-export type TAppStoreDockerImageSource = interfaces.appstore.IAppStoreDockerImageSource;
-export type TAppStoreRepoManifestSource = interfaces.appstore.IAppStoreRepoManifestSource;
-export type TAppStoreResolvedSource = interfaces.appstore.IAppStoreResolvedSource;
-export type TServezoneAppStoreManifest = interfaces.appstore.IServezoneAppStoreManifest;
-export type TAppStoreStorageRequest = interfaces.appstore.TAppStoreStorageRequest;
-export type TAppStoreStorageClass = interfaces.appstore.IAppStoreStorageClass;
-export type TAppStoreStorageFeatureId = interfaces.appstore.TAppStoreStorageFeatureId;
+import type * as plugins from './plugins.js';
 export type TAppStoreStorageRequestOrigin = 'explicit' | 'legacyVolume' | 'legacyS3';
 export interface IAppStoreStorageLegacyCompatibility {
     /**
@@ -25,11 +12,12 @@ export interface IAppStoreStorageLegacyCompatibility {
         environmentOwnership: 'bindingOverridesTemplate';
     };
 }
+/** The canonical storage handoff a fulfillment adapter receives for one version config. */
 export interface INormalizedAppStoreStorageConfig {
-    storageClasses: Record<string, TAppStoreStorageClass>;
-    storageRequests: TAppStoreStorageRequest[];
+    storageClasses: Record<string, plugins.servezoneInterfaces.appstore.IAppStoreStorageClass>;
+    storageRequests: plugins.servezoneInterfaces.appstore.TAppStoreStorageRequest[];
     requestOrigins: Record<string, TAppStoreStorageRequestOrigin>;
-    requiredFeatureIds: TAppStoreStorageFeatureId[];
+    requiredFeatureIds: plugins.servezoneInterfaces.appstore.TAppStoreStorageFeatureId[];
     legacyCompatibility?: IAppStoreStorageLegacyCompatibility;
 }
 export interface IAppStoreStorageNormalizationOptions {
@@ -39,33 +27,90 @@ export interface IAppStoreStorageNormalizationOptions {
      */
     supportedFeatures: Iterable<string>;
 }
-export interface IAppStoreResolverOptions {
-    source?: TAppStoreSourceMode;
-    baseUrl?: string;
-    fetch?: TAppStoreFetch;
-    resolveDockerDigests?: boolean;
-    requestTimeoutMs?: number;
+export interface IAppStoreCatalogLoaderOptions {
+    /** The catalog signing keys this consumer trusts, shipped with its release, never fetched. */
+    trustedKeys: readonly plugins.servezoneInterfaces.appstore.IAppStoreCatalogTrustedKey[];
+    /** The feature ids this consumer fulfils (`requiresFeatures`), e.g. `appStoreStorageFeatureIds` values. */
+    supportedFeatureIds: Iterable<string>;
+    /**
+     * npm registries asked for the catalog package, in order, as
+     * `appstore.validateAppStoreCatalogRegistries` (`@serve.zone/interfaces`) admits them. Absent or
+     * empty means `appstore.appStoreCatalogDefaultRegistries` (npmjs).
+     */
+    registries?: readonly string[];
+    /** Defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+    /** Defaults to the system clock. */
     now?: () => Date;
+    /** Bound of each registry request, response body included. Defaults to 30 000 ms. */
+    requestTimeoutMs?: number;
+    /** Largest package tarball the loader downloads. Defaults to 32 MiB. */
+    maximumTarballBytes?: number;
+    /** Largest size the loader decompresses a package tarball to. Defaults to 256 MiB. */
+    maximumUnpackedBytes?: number;
 }
-export interface IAppStorePackageData {
-    generatedAt: string;
-    jsonFiles: Record<string, unknown>;
-    textFiles: Record<string, string>;
-}
-export interface IAppStoreSourceInfo {
-    source: TAppStoreSourceMode;
-    packageName: string;
-    packageVersion: string;
-    baseUrl?: string;
+/** Options of one load. */
+export interface IAppStoreCatalogLoadOptions {
+    /**
+     * Aborting it (the consumer stopping) ends the load at once, in-flight requests included, and
+     * rejects it with the signal's reason.
+     */
+    signal?: AbortSignal;
 }
-export interface IResolvedAppStoreApp {
-    appStoreApp: TAppStoreApp;
-    appMeta: TAppStoreAppMeta;
-    configsByVersion: Map<string, TAppStoreVersionConfig>;
+/** What a consumer stored with its last-known-good envelope text, to restore it at start. */
+export interface IAppStoreCatalogStoredRecord {
+    origin: plugins.servezoneInterfaces.appstore.TAppStoreCatalogOrigin;
+    /** When the consumer first activated it. */
+    loadedAt: string;
 }
-export interface IParsedDockerImageReference {
+/** What one registry answered during a load. */
+export interface IAppStoreCatalogRegistryReport {
     registry: string;
-    repository: string;
-    tag: string;
-    digest?: string;
+    outcome: plugins.servezoneInterfaces.appstore.TAppStoreCatalogAttemptOutcome;
+    /** The package version the registry's `latest` dist-tag named, once read. */
+    packageVersion?: string;
+    /** Why a `refused` or `failed` answer ended. */
+    message?: string;
+}
+interface IAppStoreCatalogJudgementBase {
+    /** The attempt as a consumer records it in its catalog status (`lastAttempt`). */
+    attempt: plugins.servezoneInterfaces.appstore.IAppStoreCatalogAttempt;
+}
+/** A verified catalog that succeeds the active one; the consumer stores it as last-known-good. */
+export interface IAppStoreCatalogActivation extends IAppStoreCatalogJudgementBase {
+    outcome: 'activated';
+    envelope: plugins.servezoneInterfaces.appstore.IAppStoreCatalogEnvelope;
+    /** The status `active` member for the activated catalog. */
+    active: plugins.servezoneInterfaces.appstore.IAppStoreCatalogActiveState;
+}
+/** The candidate is the active catalog. */
+export interface IAppStoreCatalogUnchanged extends IAppStoreCatalogJudgementBase {
+    outcome: 'unchanged';
+}
+/** The candidate was read and refused; the active catalog stays in place. */
+export interface IAppStoreCatalogRefused extends IAppStoreCatalogJudgementBase {
+    outcome: 'refused';
+    /** The status `refused` member. */
+    refused: plugins.servezoneInterfaces.appstore.IAppStoreCatalogRefusalRecord;
+}
+/** No candidate could be read: transport, integrity or packaging failed. */
+export interface IAppStoreCatalogFailure extends IAppStoreCatalogJudgementBase {
+    outcome: 'failed';
+    message: string;
+}
+/** The judgement of one candidate envelope against the active catalog. */
+export type TAppStoreCatalogJudgement = IAppStoreCatalogActivation | IAppStoreCatalogUnchanged | IAppStoreCatalogRefused;
+/** The result of one registry load: the judgement of the best answer and every registry's answer. */
+export type TAppStoreCatalogLoadResult = (TAppStoreCatalogJudgement | IAppStoreCatalogFailure) & {
+    registries: IAppStoreCatalogRegistryReport[];
+};
+/** A stored catalog that verifies today: the consumer activates it at start. */
+export interface IAppStoreCatalogRestored {
+    outcome: 'restored';
+    envelope: plugins.servezoneInterfaces.appstore.IAppStoreCatalogEnvelope;
+    /** The status `active` member: `origin` and `loadedAt` as stored, `keyId` as verified now. */
+    active: plugins.servezoneInterfaces.appstore.IAppStoreCatalogActiveState;
 }
+/** The result of restoring a stored catalog: restored, or refused and left inactive. */
+export type TAppStoreCatalogRestoreResult = IAppStoreCatalogRestored | IAppStoreCatalogRefused;
+export {};

package/dist_ts_client/types.js

@@ -1,2 +1,2 @@
 export {};
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19jbGllbnQvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGllbnQvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist_ts_testing/fixtures.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Test fixtures for App Store catalog consumers (`@serve.zone/appstore/testing`), never part of the
+ * runtime entry: a throwaway signing key, a catalog, its signed envelope, the npm package tarball
+ * carrying it, a registry stub and a `fetch` serving it. A consumer's tests drive
+ * `AppStoreCatalogLoader` against these exactly as against a registry.
+ */
+import * as plugins from './plugins.js';
+type TCatalog = plugins.servezoneInterfaces.appstore.IAppStoreCatalog;
+type TEnvelope = plugins.servezoneInterfaces.appstore.IAppStoreCatalogEnvelope;
+type TVersionConfig = plugins.servezoneInterfaces.appstore.TAppStoreCatalogVersionConfig;
+type TSigningKey = plugins.servezoneInterfacesRuntime.IAppStoreCatalogSigningKey;
+type TTrustedKey = plugins.servezoneInterfaces.appstore.IAppStoreCatalogTrustedKey;
+/** A throwaway catalog signing key and the trusted-key record a consumer under test is given. */
+export interface IAppStoreTestSigningKey {
+    signingKey: TSigningKey;
+    trustedKey: TTrustedKey;
+}
+export interface IAppStoreTestVersion {
+    version: string;
+    config: TVersionConfig;
+    withdrawn?: plugins.servezoneInterfaces.appstore.IAppStoreCatalogWithdrawal;
+}
+export interface IAppStoreTestApp {
+    info: plugins.servezoneInterfaces.appstore.IServezoneAppStoreAppInfo;
+    /** Defaults to the highest version that is not withdrawn (the highest one when all are). */
+    latestVersion?: string;
+    upgradeStrategy?: plugins.servezoneInterfaces.appstore.TAppStoreCatalogUpgradeStrategy;
+    versions: IAppStoreTestVersion[];
+}
+export interface IAppStoreTestCatalogOptions {
+    revision: number;
+    /** Defaults to `2026-10-08T12:00:00.000Z`. */
+    publishedAt?: string;
+    /** Defaults to 40 times `c`. */
+    sourceRevision?: string;
+    apps: IAppStoreTestApp[];
+}
+/** One registry origin's answers: the `latest` version manifest and the tarball it names. */
+export interface IAppStoreTestRegistryStub {
+    /** The `latest` version manifest body; `null` answers 404. */
+    manifest: unknown;
+    tarball?: Uint8Array<ArrayBuffer>;
+    /** Never answers until the request is aborted. */
+    hang?: boolean;
+    /** Answers every request with this HTTP status. */
+    status?: number;
+}
+/** A fresh throwaway key; nothing about it is ever stored. */
+export declare const createAppStoreTestSigningKey: () => Promise<IAppStoreTestSigningKey>;
+/** A version config the contract accepts: a digest-pinned `example/<name>` image and one web port. */
+export declare const createAppStoreTestVersionConfig: (nameArg: string, imageDigitArg: string, overridesArg?: Partial<TVersionConfig>) => TVersionConfig;
+/** A catalog the contract accepts, apps in id order, each version with its config digest; throws otherwise. */
+export declare const createAppStoreTestCatalog: (optionsArg: IAppStoreTestCatalogOptions) => Promise<TCatalog>;
+/** The signed envelope of a test catalog, as the publisher would ship it. */
+export declare const signAppStoreTestCatalog: (catalogArg: TCatalog, keyArg: IAppStoreTestSigningKey) => Promise<TEnvelope>;
+export interface IAppStoreTestTarballOptions {
+    /** Defaults to `33.0.0`. */
+    packageVersion?: string;
+    /** Bytes of a filler `dist_catalog/catalog.json` entry ahead of the envelope; defaults to 0. */
+    fillerBytes?: number;
+}
+/**
+ * The gzip-compressed npm package tarball (`package/…`) of `@serve.zone/appstore`, carrying
+ * `envelopeTextArg` at the envelope's package path, or no envelope for `null`.
+ */
+export declare const createAppStoreTestPackageTarball: (envelopeTextArg: string | null, optionsArg?: IAppStoreTestTarballOptions) => Promise<Uint8Array<ArrayBuffer>>;
+/** The npm `dist.integrity` of a tarball. */
+export declare const computeAppStoreTestIntegrity: (bytesArg: Uint8Array) => string;
+export interface IAppStoreTestRegistryOptions {
+    /** Defaults to the tarball's true integrity. */
+    integrity?: string;
+    /** Defaults to `33.0.0`. */
+    packageVersion?: string;
+}
+/** A registry stub at `originArg` whose `latest` names `tarballArg`. */
+export declare const createAppStoreTestRegistry: (originArg: string, tarballArg: Uint8Array<ArrayBuffer>, optionsArg?: IAppStoreTestRegistryOptions) => IAppStoreTestRegistryStub;
+/**
+ * A `fetch` serving one stub per registry origin: the `latest` manifest of
+ * `@serve.zone/appstore` and its tarball. An origin without a stub fails like an unreachable host;
+ * a hanging stub rejects once the request's signal aborts.
+ */
+export declare const createAppStoreTestFetch: (registriesArg: Record<string, IAppStoreTestRegistryStub>) => typeof fetch;
+export {};

package/dist_ts_testing/fixtures.js

@@ -0,0 +1,146 @@
+/**
+ * Test fixtures for App Store catalog consumers (`@serve.zone/appstore/testing`), never part of the
+ * runtime entry: a throwaway signing key, a catalog, its signed envelope, the npm package tarball
+ * carrying it, a registry stub and a `fetch` serving it. A consumer's tests drive
+ * `AppStoreCatalogLoader` against these exactly as against a registry.
+ */
+import * as plugins from './plugins.js';
+import { appStoreCatalogEnvelopePackagePath, appStoreCatalogPackageName } from '../dist_ts_client/catalog.js';
+const tarballPath = '/tarball.tgz';
+/** A fresh throwaway key; nothing about it is ever stored. */
+export const createAppStoreTestSigningKey = async () => {
+    const signingKey = await plugins.servezoneInterfacesRuntime.createAppStoreCatalogSigningKey();
+    return { signingKey, trustedKey: plugins.servezoneInterfacesRuntime.getAppStoreCatalogTrustedKey(signingKey) };
+};
+/** A version config the contract accepts: a digest-pinned `example/<name>` image and one web port. */
+export const createAppStoreTestVersionConfig = (nameArg, imageDigitArg, overridesArg = {}) => ({
+    image: `example/${nameArg}@sha256:${imageDigitArg.repeat(64)}`,
+    targetPorts: [{ name: 'web', port: 8080, protocol: 'http', default: true }],
+    ...overridesArg,
+});
+const compareVersions = (leftArg, rightArg) => {
+    const { data } = plugins.servezoneInterfaces;
+    const left = data.parseReleaseVersion(leftArg);
+    const right = data.parseReleaseVersion(rightArg);
+    if (left === null || right === null)
+        throw new Error(`test catalog versions must be MAJOR.MINOR.PATCH: ${leftArg}, ${rightArg}`);
+    return data.compareReleaseVersions(left, right);
+};
+const defaultLatestVersion = (appArg) => {
+    const available = appArg.versions.filter((versionArg) => versionArg.withdrawn === undefined);
+    const candidates = (available.length > 0 ? available : appArg.versions).map((versionArg) => versionArg.version);
+    const [latest] = [...candidates].sort((leftArg, rightArg) => compareVersions(rightArg, leftArg));
+    if (latest === undefined)
+        throw new Error(`test catalog app '${appArg.info.id}' lists no version`);
+    return latest;
+};
+/** Every feature id the catalog's version configs name. */
+const usedFeatureIds = (catalogArg) => [...new Set(catalogArg.apps.flatMap((appArg) => appArg.versions.flatMap((versionArg) => versionArg.config.requiresFeatures ?? [])))].sort();
+/** A catalog the contract accepts, apps in id order, each version with its config digest; throws otherwise. */
+export const createAppStoreTestCatalog = async (optionsArg) => {
+    const { appstore } = plugins.servezoneInterfaces;
+    const apps = [];
+    const sorted = [...optionsArg.apps].sort((leftArg, rightArg) => leftArg.info.id < rightArg.info.id ? -1 : leftArg.info.id > rightArg.info.id ? 1 : 0);
+    for (const app of sorted) {
+        const versions = [];
+        for (const version of app.versions) {
+            const config = structuredClone(version.config);
+            versions.push({
+                version: version.version,
+                config,
+                configDigest: await appstore.computeAppStoreCatalogConfigDigest(config),
+                ...(version.withdrawn === undefined ? {} : { withdrawn: { ...version.withdrawn } }),
+            });
+        }
+        apps.push({
+            info: structuredClone(app.info),
+            latestVersion: app.latestVersion ?? defaultLatestVersion(app),
+            ...(app.upgradeStrategy === undefined ? {} : { upgradeStrategy: app.upgradeStrategy }),
+            versions,
+        });
+    }
+    const contract = appstore.appStoreCatalogContract;
+    const catalog = {
+        contract: { id: contract.id, major: contract.major, minor: contract.minor },
+        revision: optionsArg.revision,
+        publishedAt: optionsArg.publishedAt ?? '2026-10-08T12:00:00.000Z',
+        sourceRevision: optionsArg.sourceRevision ?? 'c'.repeat(40),
+        apps,
+    };
+    const errors = appstore.validateAppStoreCatalog(catalog, { supportedFeatureIds: usedFeatureIds(catalog) });
+    if (errors.length > 0)
+        throw new Error(`test catalog refused by the contract: ${errors.join('; ')}`);
+    return catalog;
+};
+/** The signed envelope of a test catalog, as the publisher would ship it. */
+export const signAppStoreTestCatalog = async (catalogArg, keyArg) => await plugins.servezoneInterfacesRuntime.signAppStoreCatalog(catalogArg, [keyArg.signingKey], {
+    supportedFeatureIds: usedFeatureIds(catalogArg),
+});
+const gzip = async (bytesArg) => new Uint8Array(await new Response(new Blob([bytesArg]).stream().pipeThrough(new CompressionStream('gzip'))).arrayBuffer());
+/**
+ * The gzip-compressed npm package tarball (`package/…`) of `@serve.zone/appstore`, carrying
+ * `envelopeTextArg` at the envelope's package path, or no envelope for `null`.
+ */
+export const createAppStoreTestPackageTarball = async (envelopeTextArg, optionsArg = {}) => {
+    const encoder = new TextEncoder();
+    const packageJson = encoder.encode(JSON.stringify({
+        name: appStoreCatalogPackageName,
+        version: optionsArg.packageVersion ?? '33.0.0',
+    }));
+    const filler = new Uint8Array(optionsArg.fillerBytes ?? 0).fill(0x20);
+    const entries = [
+        { header: { name: 'package/package.json', size: packageJson.byteLength }, body: packageJson },
+        { header: { name: 'package/dist_catalog/catalog.json', size: filler.byteLength }, body: filler },
+    ];
+    if (envelopeTextArg !== null) {
+        const envelope = encoder.encode(envelopeTextArg);
+        entries.push({
+            header: { name: `package/${appStoreCatalogEnvelopePackagePath}`, size: envelope.byteLength },
+            body: envelope,
+        });
+    }
+    return await gzip(await plugins.modernTar.packTar(entries));
+};
+/** The npm `dist.integrity` of a tarball. */
+export const computeAppStoreTestIntegrity = (bytesArg) => `sha512-${plugins.crypto.createHash('sha512').update(bytesArg).digest('base64')}`;
+/** A registry stub at `originArg` whose `latest` names `tarballArg`. */
+export const createAppStoreTestRegistry = (originArg, tarballArg, optionsArg = {}) => ({
+    manifest: {
+        name: appStoreCatalogPackageName,
+        version: optionsArg.packageVersion ?? '33.0.0',
+        dist: { tarball: `${originArg}${tarballPath}`, integrity: optionsArg.integrity ?? computeAppStoreTestIntegrity(tarballArg) },
+    },
+    tarball: tarballArg,
+});
+/**
+ * A `fetch` serving one stub per registry origin: the `latest` manifest of
+ * `@serve.zone/appstore` and its tarball. An origin without a stub fails like an unreachable host;
+ * a hanging stub rejects once the request's signal aborts.
+ */
+export const createAppStoreTestFetch = (registriesArg) => async (inputArg, initArg) => {
+    const url = new URL(inputArg instanceof Request ? inputArg.url : inputArg);
+    const stub = registriesArg[url.origin];
+    if (stub === undefined)
+        throw new TypeError(`fetch failed: no registry at ${url.origin}`);
+    const signal = initArg?.signal ?? null;
+    if (stub.hang === true) {
+        return await new Promise((_resolveArg, rejectArg) => {
+            const abort = () => rejectArg(signal?.reason ?? new Error('aborted'));
+            if (signal?.aborted === true)
+                abort();
+            signal?.addEventListener('abort', abort, { once: true });
+        });
+    }
+    if (stub.status !== undefined)
+        return new Response('unavailable', { status: stub.status });
+    if (url.pathname === `/${appStoreCatalogPackageName.replace('/', '%2f')}/latest`) {
+        return stub.manifest === null
+            ? new Response('not found', { status: 404 })
+            : new Response(JSON.stringify(stub.manifest), { headers: { 'content-type': 'application/json' } });
+    }
+    if (url.pathname === tarballPath && stub.tarball !== undefined) {
+        return new Response(new Blob([stub.tarball]));
+    }
+    return new Response('not found', { status: 404 });
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZml4dHVyZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c190ZXN0aW5nL2ZpeHR1cmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7OztHQUtHO0FBQ0gsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLGtDQUFrQyxFQUFFLDBCQUEwQixFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFnRHpHLE1BQU0sV0FBVyxHQUFHLGNBQWMsQ0FBQztBQUVuQyw4REFBOEQ7QUFDOUQsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsS0FBSyxJQUFzQyxFQUFFO0lBQ3ZGLE1BQU0sVUFBVSxHQUFHLE1BQU0sT0FBTyxDQUFDLDBCQUEwQixDQUFDLCtCQUErQixFQUFFLENBQUM7SUFDOUYsT0FBTyxFQUFFLFVBQVUsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLDBCQUEwQixDQUFDLDRCQUE0QixDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDakgsQ0FBQyxDQUFDO0FBRUYsc0dBQXNHO0FBQ3RHLE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLENBQzdDLE9BQWUsRUFDZixhQUFxQixFQUNyQixZQUFZLEdBQTRCLEVBQUUsRUFDMUIsRUFBRSxDQUFDLENBQUM7SUFDcEIsS0FBSyxFQUFFLFdBQVcsT0FBTyxXQUFXLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLEVBQUU7SUFDOUQsV0FBVyxFQUFFLENBQUMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDM0UsR0FBRyxZQUFZO0NBQ2hCLENBQUMsQ0FBQztBQUVILE1BQU0sZUFBZSxHQUFHLENBQUMsT0FBZSxFQUFFLFFBQWdCLEVBQVUsRUFBRTtJQUNwRSxNQUFNLEVBQUUsSUFBSSxFQUFFLEdBQUcsT0FBTyxDQUFDLG1CQUFtQixDQUFDO0lBQzdDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUMvQyxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsbUJBQW1CLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakQsSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLEtBQUssS0FBSyxJQUFJO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxvREFBb0QsT0FBTyxLQUFLLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDakksT0FBTyxJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO0FBQ2xELENBQUMsQ0FBQztBQUVGLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxNQUF3QixFQUFVLEVBQUU7SUFDaEUsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDN0YsTUFBTSxVQUFVLEdBQUcsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDaEgsTUFBTSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxVQUFVLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxlQUFlLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDakcsSUFBSSxNQUFNLEtBQUssU0FBUztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMscUJBQXFCLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxvQkFBb0IsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLDJEQUEyRDtBQUMzRCxNQUFNLGNBQWMsR0FBRyxDQUFDLFVBQW9CLEVBQVksRUFBRSxDQUN4RCxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUM3QyxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztBQUVoRywrR0FBK0c7QUFDL0csTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsS0FBSyxFQUFFLFVBQXVDLEVBQXFCLEVBQUU7SUFDNUcsTUFBTSxFQUFFLFFBQVEsRUFBRSxHQUFHLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQztJQUNqRCxNQUFNLElBQUksR0FBcUIsRUFBRSxDQUFDO0lBQ2xDLE1BQU0sTUFBTSxHQUFHLENBQUMsR0FBRyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFLENBQzdELE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDeEYsS0FBSyxNQUFNLEdBQUcsSUFBSSxNQUFNLEVBQUUsQ0FBQztRQUN6QixNQUFNLFFBQVEsR0FBeUMsRUFBRSxDQUFDO1FBQzFELEtBQUssTUFBTSxPQUFPLElBQUksR0FBRyxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ25DLE1BQU0sTUFBTSxHQUFHLGVBQWUsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDL0MsUUFBUSxDQUFDLElBQUksQ0FBQztnQkFDWixPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87Z0JBQ3hCLE1BQU07Z0JBQ04sWUFBWSxFQUFFLE1BQU0sUUFBUSxDQUFDLGtDQUFrQyxDQUFDLE1BQU0sQ0FBQztnQkFDdkUsR0FBRyxDQUFDLE9BQU8sQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLEVBQUUsR0FBRyxPQUFPLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQzthQUNwRixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQztZQUNSLElBQUksRUFBRSxlQUFlLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQztZQUMvQixhQUFhLEVBQUUsR0FBRyxDQUFDLGFBQWEsSUFBSSxvQkFBb0IsQ0FBQyxHQUFHLENBQUM7WUFDN0QsR0FBRyxDQUFDLEdBQUcsQ0FBQyxlQUFlLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsZUFBZSxFQUFFLEdBQUcsQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUN0RixRQUFRO1NBQ1QsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLFFBQVEsQ0FBQyx1QkFBdUIsQ0FBQztJQUNsRCxNQUFNLE9BQU8sR0FBYTtRQUN4QixRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUssRUFBRTtRQUMzRSxRQUFRLEVBQUUsVUFBVSxDQUFDLFFBQVE7UUFDN0IsV0FBVyxFQUFFLFVBQVUsQ0FBQyxXQUFXLElBQUksMEJBQTBCO1FBQ2pFLGNBQWMsRUFBRSxVQUFVLENBQUMsY0FBYyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzNELElBQUk7S0FDTCxDQUFDO0lBQ0YsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLHVCQUF1QixDQUFDLE9BQU8sRUFBRSxFQUFFLG1CQUFtQixFQUFFLGNBQWMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDM0csSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHlDQUF5QyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNyRyxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUM7QUFFRiw2RUFBNkU7QUFDN0UsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsS0FBSyxFQUFFLFVBQW9CLEVBQUUsTUFBK0IsRUFBc0IsRUFBRSxDQUN6SCxNQUFNLE9BQU8sQ0FBQywwQkFBMEIsQ0FBQyxtQkFBbUIsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLEVBQUU7SUFDNUYsbUJBQW1CLEVBQUUsY0FBYyxDQUFDLFVBQVUsQ0FBQztDQUNoRCxDQUFDLENBQUM7QUFFTCxNQUFNLElBQUksR0FBRyxLQUFLLEVBQUUsUUFBaUMsRUFBb0MsRUFBRSxDQUN6RixJQUFJLFVBQVUsQ0FBQyxNQUFNLElBQUksUUFBUSxDQUFDLElBQUksSUFBSSxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxXQUFXLENBQUMsSUFBSSxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztBQVM3SDs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxLQUFLLEVBQ25ELGVBQThCLEVBQzlCLFVBQVUsR0FBZ0MsRUFBRSxFQUNWLEVBQUU7SUFDcEMsTUFBTSxPQUFPLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQztJQUNsQyxNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDaEQsSUFBSSxFQUFFLDBCQUEwQjtRQUNoQyxPQUFPLEVBQUUsVUFBVSxDQUFDLGNBQWMsSUFBSSxRQUFRO0tBQy9DLENBQUMsQ0FBQyxDQUFDO0lBQ0osTUFBTSxNQUFNLEdBQUcsSUFBSSxVQUFVLENBQUMsVUFBVSxDQUFDLFdBQVcsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDdEUsTUFBTSxPQUFPLEdBQUc7UUFDZCxFQUFFLE1BQU0sRUFBRSxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxJQUFJLEVBQUUsV0FBVyxDQUFDLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUU7UUFDN0YsRUFBRSxNQUFNLEVBQUUsRUFBRSxJQUFJLEVBQUUsbUNBQW1DLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFO0tBQ2pHLENBQUM7SUFDRixJQUFJLGVBQWUsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUM3QixNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ2pELE9BQU8sQ0FBQyxJQUFJLENBQUM7WUFDWCxNQUFNLEVBQUUsRUFBRSxJQUFJLEVBQUUsV0FBVyxrQ0FBa0MsRUFBRSxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsVUFBVSxFQUFFO1lBQzVGLElBQUksRUFBRSxRQUFRO1NBQ2YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sTUFBTSxJQUFJLENBQUMsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0FBQzlELENBQUMsQ0FBQztBQUVGLDZDQUE2QztBQUM3QyxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLFFBQW9CLEVBQVUsRUFBRSxDQUMzRSxVQUFVLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztBQVNwRix3RUFBd0U7QUFDeEUsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FDeEMsU0FBaUIsRUFDakIsVUFBbUMsRUFDbkMsVUFBVSxHQUFpQyxFQUFFLEVBQ2xCLEVBQUUsQ0FBQyxDQUFDO0lBQy9CLFFBQVEsRUFBRTtRQUNSLElBQUksRUFBRSwwQkFBMEI7UUFDaEMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxjQUFjLElBQUksUUFBUTtRQUM5QyxJQUFJLEVBQUUsRUFBRSxPQUFPLEVBQUUsR0FBRyxTQUFTLEdBQUcsV0FBVyxFQUFFLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxTQUFTLElBQUksNEJBQTRCLENBQUMsVUFBVSxDQUFDLEVBQUU7S0FDN0g7SUFDRCxPQUFPLEVBQUUsVUFBVTtDQUNwQixDQUFDLENBQUM7QUFFSDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxhQUF3RCxFQUFnQixFQUFFLENBQ2hILEtBQUssRUFBRSxRQUEyQixFQUFFLE9BQXFCLEVBQXFCLEVBQUU7SUFDOUUsTUFBTSxHQUFHLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxZQUFZLE9BQU8sQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDM0UsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN2QyxJQUFJLElBQUksS0FBSyxTQUFTO1FBQUUsTUFBTSxJQUFJLFNBQVMsQ0FBQyxnQ0FBZ0MsR0FBRyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDMUYsTUFBTSxNQUFNLEdBQUcsT0FBTyxFQUFFLE1BQU0sSUFBSSxJQUFJLENBQUM7SUFDdkMsSUFBSSxJQUFJLENBQUMsSUFBSSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3ZCLE9BQU8sTUFBTSxJQUFJLE9BQU8sQ0FBVyxDQUFDLFdBQVcsRUFBRSxTQUFTLEVBQUUsRUFBRTtZQUM1RCxNQUFNLEtBQUssR0FBRyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLE1BQU0sSUFBSSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQ3RFLElBQUksTUFBTSxFQUFFLE9BQU8sS0FBSyxJQUFJO2dCQUFFLEtBQUssRUFBRSxDQUFDO1lBQ3RDLE1BQU0sRUFBRSxnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDM0QsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVM7UUFBRSxPQUFPLElBQUksUUFBUSxDQUFDLGFBQWEsRUFBRSxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUMzRixJQUFJLEdBQUcsQ0FBQyxRQUFRLEtBQUssSUFBSSwwQkFBMEIsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNqRixPQUFPLElBQUksQ0FBQyxRQUFRLEtBQUssSUFBSTtZQUMzQixDQUFDLENBQUMsSUFBSSxRQUFRLENBQUMsV0FBVyxFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUFDO1lBQzVDLENBQUMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUN2RyxDQUFDO0lBQ0QsSUFBSSxHQUFHLENBQUMsUUFBUSxLQUFLLFdBQVcsSUFBSSxJQUFJLENBQUMsT0FBTyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQy9ELE9BQU8sSUFBSSxRQUFRLENBQUMsSUFBSSxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hELENBQUM7SUFDRCxPQUFPLElBQUksUUFBUSxDQUFDLFdBQVcsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO0FBQ3BELENBQUMsQ0FBQyJ9

package/dist_ts_testing/index.d.ts

@@ -0,0 +1 @@
+export * from './fixtures.js';

package/dist_ts_testing/index.js

@@ -0,0 +1,2 @@
+export * from './fixtures.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c190ZXN0aW5nL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsZUFBZSxDQUFDIn0=

package/dist_ts_testing/plugins.d.ts

@@ -0,0 +1,7 @@
+import * as crypto from 'node:crypto';
+export { crypto };
+import * as servezoneInterfaces from '@serve.zone/interfaces';
+import * as servezoneInterfacesRuntime from '@serve.zone/interfaces/runtime';
+export { servezoneInterfaces, servezoneInterfacesRuntime };
+import * as modernTar from 'modern-tar';
+export { modernTar };

package/dist_ts_testing/plugins.js

@@ -0,0 +1,11 @@
+// node native
+import * as crypto from 'node:crypto';
+export { crypto };
+// @serve.zone scope
+import * as servezoneInterfaces from '@serve.zone/interfaces';
+import * as servezoneInterfacesRuntime from '@serve.zone/interfaces/runtime';
+export { servezoneInterfaces, servezoneInterfacesRuntime };
+// third party
+import * as modernTar from 'modern-tar';
+export { modernTar };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3Rlc3RpbmcvcGx1Z2lucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjO0FBQ2QsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFFdEMsT0FBTyxFQUFFLE1BQU0sRUFBRSxDQUFDO0FBRWxCLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssbUJBQW1CLE1BQU0sd0JBQXdCLENBQUM7QUFDOUQsT0FBTyxLQUFLLDBCQUEwQixNQUFNLGdDQUFnQyxDQUFDO0FBRTdFLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSwwQkFBMEIsRUFBRSxDQUFDO0FBRTNELGNBQWM7QUFDZCxPQUFPLEtBQUssU0FBUyxNQUFNLFlBQVksQ0FBQztBQUV4QyxPQUFPLEVBQUUsU0FBUyxFQUFFLENBQUMifQ==

package/package.json

@@ -1,17 +1,19 @@
 {
   "name": "@serve.zone/appstore",
-  "version": "32.27.0",
+  "version": "33.0.0",
   "private": false,
-  "description": "serve.zone App Store metadata, parser, and resolver client.",
+  "description": "serve.zone App Store: the signed runtime catalog and its consumer loader.",
   "type": "module",
   "exports": {
-    ".": "./dist_ts_client/index.js"
+    ".": "./dist_ts_client/index.js",
+    "./catalog.envelope.json": "./dist_catalog/catalog.envelope.json",
+    "./testing": "./dist_ts_testing/index.js"
   },
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "dependencies": {
-    "@push.rocks/smartversion": "^3.1.0",
-    "@serve.zone/interfaces": "32.42.0"
+    "@serve.zone/interfaces": "32.53.0",
+    "modern-tar": "0.8.5"
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^6.0.0",
@@ -20,11 +22,11 @@
     "@types/node": "26.6.3"
   },
   "files": [
-    "apps/**/*",
-    "appstore.json",
-    "appstore.resolved.json",
     "ts_client/**/*",
     "dist_ts_client/**/*",
+    "ts_testing/**/*",
+    "dist_ts_testing/**/*",
+    "dist_catalog/**/*",
     ".smartconfig.json",
     "readme.md",
     "changelog.md",
@@ -46,8 +48,11 @@
     "cloudly"
   ],
   "scripts": {
-    "test": "node scripts/generate-data-module.mjs && tstest test/ --verbose --logfile --timeout 60",
-    "build": "node scripts/generate-data-module.mjs && tsbuild tsfolders",
+    "test": "tstest test/ --verbose --logfile --timeout 60",
+    "build": "tsbuild tsfolders && node dist_ts_publisher/cli.js build",
+    "build:release": "tsbuild tsfolders && node dist_ts_publisher/cli.js build --release",
+    "catalog:lock": "tsbuild tsfolders && node dist_ts_publisher/cli.js lock",
+    "catalog:trustedkey": "tsbuild tsfolders && node dist_ts_publisher/cli.js trusted-key",
     "buildDocs": "tsdoc"
   }
 }