npm - @tsdoctor/bundle - Versions diffs - 0.2.3 → 0.3.0 - Mend

@tsdoctor/bundle 0.2.3 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/Bundle.js CHANGED Viewed

@@ -1,15 +1,9 @@
-import { BundleManifestError, decodeBundleManifest } from "./BundleManifest.js";
+import { BundleManifestError, decodeBundleManifest } from "@tsdoctor/manifest";
 import { PackageJsonFile } from "@effected/package-json";
 import { TsconfigLoader } from "@effected/tsconfig-json";
 import { Effect, FileSystem, Option, Schema } from "effect";
 //#region src/Bundle.ts
-/**
-* The sidecar manifest's file name inside a bundle folder.
-*
-* @public
-*/
-const TSDOCTOR_MANIFEST_FILENAME = "tsdoctor.json";
 /** The minimal api.json shape the layer-0 reader validates. */
 const ApiModelHeader = Schema.Struct({ name: Schema.String });
 /**
@@ -124,4 +118,4 @@ function readBundle(descriptor) {
 }
 //#endregion
-export { BundleLayerError, TSDOCTOR_MANIFEST_FILENAME, readApiModelInfo, readBundle };
+export { BundleLayerError, readApiModelInfo, readBundle };

package/BundleAssets.js ADDED Viewed

@@ -0,0 +1,130 @@
+import { isSafeAssetPath } from "./internal/asset-path.js";
+import { Effect, FileSystem, Path, Schema } from "effect";
+import { imageSize } from "image-size";
+//#region src/BundleAssets.ts
+/**
+* Publishing a resolved bundle's Open Graph images into a site's public
+* directory.
+*
+* @remarks
+* `resolveBundle` produces `ResolvedOpenGraphImage` values whose `path` field
+* (when present) is bundle-relative — a location inside the bundle directory,
+* not the site's own output tree. An adapter must copy that file somewhere a
+* built site actually serves and hand back an absolute URL a `<head>` tag can
+* use; `url` images need no copy and pass straight through.
+*
+* @packageDocumentation
+*/
+/**
+* A bundle-relative Open Graph image could not be published: the source file
+* could not be read, or the destination could not be written.
+*
+* @public
+*/
+var BundleAssetError = class extends Schema.TaggedError()("BundleAssetError", {
+	/** The source or destination path at fault. */
+	path: Schema.String,
+	cause: Schema.Defect()
+}) {
+	get message() {
+		return `Could not publish bundle asset ${this.path}`;
+	}
+};
+const bytesEqual = (a, b) => a.byteLength === b.byteLength && a.every((value, index) => value === b[index]);
+/** `imageSize` throws on bytes it cannot parse; that degrades to no measurement, never a failure. */
+function safeSize(bytes) {
+	try {
+		const size = imageSize(bytes);
+		return {
+			...size.width !== void 0 ? { width: size.width } : {},
+			...size.height !== void 0 ? { height: size.height } : {}
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Copy every bundle-relative image into `<publicDir>/tsdoctor/<unscopedName>/`
+* and return every image — bundle-relative or external — as a
+* {@link PublishedOpenGraphImage} carrying an absolute URL.
+*
+* @remarks
+* Identical bytes are not rewritten, so a rebuild over an unchanged image
+* leaves the published file's own metadata (mtime and any framework cache
+* keyed on it) untouched. Width and height are read from the resolved image
+* when the manifest declared them, and measured from the file's bytes only
+* when it did not.
+*
+* @public
+*/
+const publishBundleAssets = Effect.fn("publishBundleAssets")(function* (input) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const out = [];
+	for (const image of input.images) {
+		const common = {
+			...image.type !== void 0 ? { type: image.type.value } : {},
+			...image.width !== void 0 ? { width: image.width } : {},
+			...image.height !== void 0 ? { height: image.height } : {},
+			alt: image.alt.value
+		};
+		if (image.url !== void 0) {
+			out.push({
+				url: image.url,
+				...common
+			});
+			continue;
+		}
+		if (image.path === void 0) return yield* Effect.fail(new BundleAssetError({
+			path: input.bundleDir,
+			cause: "image has no path or url"
+		}));
+		if (!isSafeAssetPath(image.path)) return yield* Effect.fail(new BundleAssetError({
+			path: image.path,
+			cause: `openGraph image path escapes the bundle: "${image.path}"`
+		}));
+		const source = path.join(input.bundleDir, image.path);
+		const bytes = yield* fs.readFile(source).pipe(Effect.mapError((cause) => new BundleAssetError({
+			path: source,
+			cause
+		})));
+		const basename = path.basename(source);
+		const destSegments = [
+			input.publicDir,
+			"tsdoctor",
+			input.unscopedName,
+			...input.subdir ? [input.subdir] : []
+		];
+		const destDir = path.join(...destSegments);
+		const dest = path.join(destDir, basename);
+		const existing = yield* fs.readFile(dest).pipe(Effect.option);
+		if (existing._tag === "None" || !bytesEqual(existing.value, bytes)) {
+			yield* fs.makeDirectory(destDir, { recursive: true }).pipe(Effect.mapError((cause) => new BundleAssetError({
+				path: destDir,
+				cause
+			})));
+			yield* fs.writeFile(dest, bytes).pipe(Effect.mapError((cause) => new BundleAssetError({
+				path: dest,
+				cause
+			})));
+		}
+		const measured = image.width === void 0 || image.height === void 0 ? safeSize(bytes) : void 0;
+		const urlSegments = [
+			"tsdoctor",
+			input.unscopedName,
+			...input.subdir ? [input.subdir] : [],
+			basename
+		];
+		out.push({
+			url: `${input.siteUrl}/${urlSegments.join("/")}`,
+			...image.width === void 0 && measured?.width !== void 0 ? { width: measured.width } : {},
+			...image.height === void 0 && measured?.height !== void 0 ? { height: measured.height } : {},
+			...common
+		});
+	}
+	return out;
+});
+//#endregion
+export { BundleAssetError, publishBundleAssets };

package/BundleDiscovery.js CHANGED Viewed

@@ -1,4 +1,5 @@
-import { TSDOCTOR_MANIFEST_FILENAME, readApiModelInfo, readBundle } from "./Bundle.js";
+import { readApiModelInfo, readBundle } from "./Bundle.js";
+import { TSDOCTOR_MANIFEST_FILENAME } from "@tsdoctor/manifest";
 import { LenientManifest } from "@effected/package-json";
 import { Effect, FileSystem, Option, Path, Schema } from "effect";
 import { GlobPatternOptions } from "@effected/glob";

package/BundleFetch.js CHANGED Viewed

@@ -1,5 +1,7 @@
 import { readBundle } from "./Bundle.js";
+import { isSafeAssetPath } from "./internal/asset-path.js";
 import { discoverBundle } from "./BundleDiscovery.js";
+import { decodeBundleManifest } from "@tsdoctor/manifest";
 import { Effect, FileSystem, Option, Path, Schema } from "effect";
 import { GitHubRelease, Repo, RepoRef } from "@effected/github";
 import { NpmRegistry, PackageTarball, PublishedVersion } from "@effected/npm";
@@ -31,6 +33,7 @@ var BundleFetchError = class extends Schema.TaggedError()("BundleFetchError", {
 		"assetAmbiguous",
 		"download",
 		"notABundle",
+		"missingAsset",
 		"cache"
 	]),
 	/** The remote coordinate: `name@version` or `owner/repo@tag#asset`. */
@@ -68,6 +71,21 @@ function validateSegments(source, ref, segments) {
 	}));
 	return Effect.void;
 }
+/**
+* The bundle-relative `openGraph.images[].path` entries a manifest declares,
+* when the manifest at `manifestPath` exists and decodes. A manifest that
+* fails to parse or decode here degrades to no assets — `readBundle` at the
+* end of {@link persistAndRead}'s caller re-reads the cached manifest and
+* surfaces the typed `BundleManifestError` itself; this probe must not fail
+* the fetch on its own.
+*/
+function manifestImagePaths(manifestPath) {
+	return Effect.gen(function* () {
+		const text = yield* (yield* FileSystem.FileSystem).readFileString(manifestPath);
+		const parsed = yield* Effect.try(() => JSON.parse(text));
+		return ((yield* decodeBundleManifest(parsed, manifestPath)).openGraph?.images ?? []).map((image) => image.path).filter((imagePath) => imagePath !== void 0);
+	}).pipe(Effect.orElseSucceed(() => []));
+}
 /** The durable cache directory for one remote bundle coordinate. */
 function bundleCacheDir(segments) {
 	return Effect.gen(function* () {
@@ -134,6 +152,26 @@ function persistAndRead(source, ref, key, extractedDir, cacheDir) {
 			yield* fs.copyFile(layerPath, path.join(cacheDir, fileName)).pipe(Effect.mapError(failCache));
 			files.push(fileName);
 		}
+		const assetPaths = discovered.manifestPath !== void 0 ? yield* manifestImagePaths(discovered.manifestPath) : [];
+		for (const assetPath of assetPaths) {
+			if (!isSafeAssetPath(assetPath)) return yield* Effect.fail(new BundleFetchError({
+				source,
+				reason: "invalidRef",
+				ref,
+				detail: `openGraph image path escapes the bundle: "${assetPath}"`
+			}));
+			const assetSource = path.join(extractedDir, assetPath);
+			if (!(yield* fs.exists(assetSource).pipe(Effect.orElseSucceed(() => false)))) return yield* Effect.fail(new BundleFetchError({
+				source,
+				reason: "missingAsset",
+				ref,
+				detail: `openGraph image declared at "${assetPath}" is not present in the fetched bundle`
+			}));
+			const assetDest = path.join(cacheDir, assetPath);
+			yield* fs.makeDirectory(path.dirname(assetDest), { recursive: true }).pipe(Effect.mapError(failCache));
+			yield* fs.copyFile(assetSource, assetDest).pipe(Effect.mapError(failCache));
+			files.push(assetPath);
+		}
 		yield* cache.set({
 			key,
 			value: utf8Encode(JSON.stringify({ files })),

package/PlatformOverrides.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { BundleManifestError, OpenGraphConfig, RegistryRef, SbomRef } from "./BundleManifest.js";
+import { BundleManifestError, OpenGraphConfig, RegistryRef, SbomRef } from "@tsdoctor/manifest";
 import { Effect, Schema } from "effect";
 //#region src/PlatformOverrides.ts

package/index.d.ts CHANGED Viewed

@@ -1,11 +1,12 @@
+import { Crypto, Effect, FileSystem, Option, Path, PlatformError, Schema } from "effect";
 import { PackageManifest } from "@effected/package-json";
 import { CompilerOptions, ResolvedTsconfig } from "@effected/tsconfig-json";
-import { Crypto, Effect, FileSystem, Option, Path, PlatformError, Schema } from "effect";
 import { GitHubRelease } from "@effected/github";
 import { NpmRegistry, PackageTarball, RegistryTarget } from "@effected/npm";
 import { Cache } from "@effected/store";
 import { AppDirs } from "@effected/xdg";
 import { JsoncCanonicalizeError } from "@effected/jsonc";
+//#region ../manifest/dist/dev/pkg/index.d.ts
 //#region src/BundleManifest.d.ts
 /**
  * The registry protocol families this reader knows how to do more than link
@@ -266,14 +267,83 @@ declare class BundleManifestError extends BundleManifestError_base {
  * @public
  */
 declare function decodeBundleManifest(input: unknown, path?: string): Effect.Effect<BundleManifest, BundleManifestError>;
-//#endregion
-//#region src/Bundle.d.ts
+/**
+ * The manifest spec version this package reads and writes.
+ *
+ * @public
+ */
+declare const MANIFEST_SPEC: 1;
 /**
  * The sidecar manifest's file name inside a bundle folder.
  *
  * @public
  */
 declare const TSDOCTOR_MANIFEST_FILENAME = "tsdoctor.json";
+/**
+ * Encode a {@link (BundleManifest:type)} into the JSON-ready value a writer
+ * serializes as `tsdoctor.json`.
+ *
+ * @remarks
+ * The writer's boundary. Going through the schema rather than
+ * `JSON.stringify` means an emitted file is by construction what
+ * {@link decodeBundleManifest} accepts.
+ *
+ * @public
+ */
+declare function encodeBundleManifest(manifest: BundleManifest): Effect.Effect<unknown, BundleManifestError>;
+//#endregion
+//#region src/ManifestSource.d.ts
+/**
+ * The shape an author checks in as a `tsdoctor.json` SOURCE file, at a
+ * package root (the leaf tier) or a workspace root (the project tier).
+ *
+ * @remarks
+ * `BundleManifest` minus `spec` and `project`: a source file never declares
+ * its own spec version, and it never declares its inherited tier — the
+ * bundler supplies both when it flattens the hierarchy at emit time. Decoded
+ * only by writers; readers never see this shape.
+ *
+ * @public
+ */
+declare const ManifestSource: Schema.Struct<{
+  readonly name: Schema.optionalKey<Schema.String>;
+  readonly tagline: Schema.optionalKey<Schema.String>;
+  readonly description: Schema.optionalKey<Schema.String>;
+  readonly openGraph: Schema.optionalKey<Schema.Struct<{
+    readonly images: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly path: Schema.optionalKey<Schema.String>;
+      readonly url: Schema.optionalKey<Schema.String>;
+      readonly type: Schema.optionalKey<Schema.String>;
+      readonly width: Schema.optionalKey<Schema.Int>;
+      readonly height: Schema.optionalKey<Schema.Int>;
+      readonly alt: Schema.optionalKey<Schema.String>;
+    }>>>;
+    readonly themeColor: Schema.optionalKey<Schema.String>;
+  }>>;
+  readonly sbom: Schema.optionalKey<Schema.Struct<{
+    readonly path: Schema.String;
+    readonly format: Schema.optionalKey<Schema.String>;
+  }>>;
+  readonly registries: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+    readonly type: Schema.String;
+    readonly name: Schema.String;
+    readonly url: Schema.String;
+  }>>>;
+}>;
+/**
+ * The decoded type of {@link (ManifestSource:variable)}.
+ *
+ * @public
+ */
+type ManifestSource = typeof ManifestSource.Type;
+/**
+ * Decode an unknown value into a {@link (ManifestSource:type)}.
+ *
+ * @public
+ */
+declare function decodeManifestSource(input: unknown, path?: string): Effect.Effect<ManifestSource, BundleManifestError>;
+//#endregion
+//#region src/Bundle.d.ts
 /**
  * The subset of a `<name>.api.json` model this package reads: the package
  * name from the model's own metadata.
@@ -387,6 +457,283 @@ declare function readApiModelInfo(modelPath: string): Effect.Effect<ApiModelInfo
  */
 declare function readBundle(descriptor: BundleDescriptor): Effect.Effect<Bundle, BundleLayerError | BundleManifestError, FileSystem.FileSystem | Path.Path>;
 //#endregion
+//#region src/PlatformOverrides.d.ts
+/**
+ * The `manifest.platform` tier: a data-override object a consumer passes
+ * through platform options (e.g. `ApiExtractorPlugin(options)`), sitting at
+ * the TOP of the tier ranking.
+ *
+ * @remarks
+ * Same field surface as the authored manifest tiers — name, tagline,
+ * description, openGraph, sbom, registries — with no `spec` field (it is not
+ * a file with an independent version) and no `project` block (it is a single
+ * tier, not a flattened hierarchy). Lets a user with ONLY an api.json declare
+ * identity/OG/registries declaratively; the resolver does the merging.
+ *
+ * @public
+ */
+declare const PlatformOverrides: Schema.Struct<{
+  /** Human display name override. */
+  readonly name: Schema.optionalKey<Schema.String>;
+  /** Tagline override. */
+  readonly tagline: Schema.optionalKey<Schema.String>;
+  /** Description override. */
+  readonly description: Schema.optionalKey<Schema.String>;
+  /** Open Graph override. */
+  readonly openGraph: Schema.optionalKey<Schema.Struct<{
+    readonly images: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly path: Schema.optionalKey<Schema.String>;
+      readonly url: Schema.optionalKey<Schema.String>;
+      readonly type: Schema.optionalKey<Schema.String>;
+      readonly width: Schema.optionalKey<Schema.Int>;
+      readonly height: Schema.optionalKey<Schema.Int>;
+      readonly alt: Schema.optionalKey<Schema.String>;
+    }>>>;
+    readonly themeColor: Schema.optionalKey<Schema.String>;
+  }>>;
+  /** SBOM pointer override. */
+  readonly sbom: Schema.optionalKey<Schema.Struct<{
+    readonly path: Schema.String;
+    readonly format: Schema.optionalKey<Schema.String>;
+  }>>;
+  /** Registries override. */
+  readonly registries: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+    readonly type: Schema.String;
+    readonly name: Schema.String;
+    readonly url: Schema.String;
+  }>>>;
+}>;
+/**
+ * The decoded type of {@link (PlatformOverrides:variable)}.
+ *
+ * @public
+ */
+type PlatformOverrides = typeof PlatformOverrides.Type;
+/**
+ * Decode an unknown value into a {@link (PlatformOverrides:type)}.
+ *
+ * @remarks
+ * For adapters decoding raw platform options. Failures share
+ * {@link BundleManifestError} — the platform tier is manifest data by another
+ * route, and a caller handles both boundaries with one tag.
+ *
+ * @public
+ */
+declare function decodePlatformOverrides(input: unknown): Effect.Effect<PlatformOverrides, BundleManifestError>;
+//#endregion
+//#region src/BundleResolver.d.ts
+/**
+ * Where a resolved field's value came from, highest-ranked tier first.
+ *
+ * @remarks
+ * The first six values are the spec's tier ladder. `"tsconfig"` is this
+ * package's one addition: the spec passes tsconfig compiler options through
+ * as a resolved field but its ladder has no source that names the tsconfig
+ * layer, so the union carries one.
+ *
+ * @public
+ */
+type ProvenanceSource = "manifest.platform" | "manifest.leaf" | "manifest.project" | "packageJson" | "apiModel" | "tsconfig" | "inferred";
+/**
+ * A resolved value carrying its provenance.
+ *
+ * @remarks
+ * Provenance is load-bearing: a field is user-overridden iff its source
+ * outranks the derivation that would otherwise supply it, an `inferred`
+ * field tracks upstream changes while an authored field is pinned, and the
+ * change-detection fingerprints hash value AND source together so an
+ * override flip is a visible diff.
+ *
+ * @public
+ */
+interface Provenanced<A> {
+  /** The resolved value. */
+  readonly value: A;
+  /** The tier that supplied it. */
+  readonly source: ProvenanceSource;
+}
+/**
+ * One Open Graph image after resolution: authored fields passed through,
+ * `type` and `alt` filled by the documented inference rules when absent.
+ *
+ * @public
+ */
+interface ResolvedOpenGraphImage {
+  /** Bundle-relative asset path, when the image is bundle-supplied. */
+  readonly path?: string;
+  /** Absolute external URL, when the image is external. */
+  readonly url?: string;
+  /** MIME type — authored, or inferred from the file extension. */
+  readonly type?: Provenanced<string>;
+  /** Pixel width, as authored. */
+  readonly width?: number;
+  /** Pixel height, as authored. */
+  readonly height?: number;
+  /** Alt text — authored, or inferred (tagline → description → `"<name> API documentation"`); never empty. */
+  readonly alt: Provenanced<string>;
+}
+/**
+ * The Open Graph block after resolution.
+ *
+ * @public
+ */
+interface ResolvedOpenGraph {
+  /** Resolved images, first-declared-wins per OG array semantics. */
+  readonly images: ReadonlyArray<ResolvedOpenGraphImage>;
+  /** Embed accent color, when authored. */
+  readonly themeColor?: string;
+}
+/**
+ * A bundle's manifest data resolved across the six tiers, every field
+ * carrying value + provenance.
+ *
+ * @remarks
+ * Fields that no tier supplies are absent — with two floors: `name` always
+ * resolves (the api.json model always has one) and every resolved image's
+ * `alt` always resolves (the inference chain bottoms out on `name`).
+ *
+ * @public
+ */
+interface ResolvedBundle {
+  /** Display name: platform → leaf manifest → package.json → api.json model. */
+  readonly name: Provenanced<string>;
+  /** Package version, from package.json. */
+  readonly version?: Provenanced<string>;
+  /** Tagline: platform → leaf manifest → project tier. */
+  readonly tagline?: Provenanced<string>;
+  /** Description: platform → leaf manifest → package.json. */
+  readonly description?: Provenanced<string>;
+  /** The project identity block, when the manifest carries one. */
+  readonly project?: Provenanced<ProjectIdentity>;
+  /** Open Graph block: platform → leaf manifest, with per-image inference applied. */
+  readonly openGraph?: Provenanced<ResolvedOpenGraph>;
+  /** SBOM pointer: platform → leaf manifest. */
+  readonly sbom?: Provenanced<SbomRef>;
+  /** Registries: platform → leaf manifest. */
+  readonly registries?: Provenanced<ReadonlyArray<RegistryRef>>;
+  /** Runtime dependencies from package.json, key-sorted. Feeds the type registry's rendering scope. */
+  readonly dependencies?: Provenanced<Readonly<Record<string, string>>>;
+  /** Peer dependencies from package.json, key-sorted. Feeds the type registry's rendering scope. */
+  readonly peerDependencies?: Provenanced<Readonly<Record<string, string>>>;
+  /** Extends-resolved compiler options from tsconfig.json. Feeds the Twoslash environment. */
+  readonly compilerOptions?: Provenanced<CompilerOptions.Type>;
+}
+/**
+ * The parsed layers {@link resolveBundle} resolves — plain optional fields,
+ * so pure call sites (and tests) need no `Option` wrapping.
+ *
+ * @public
+ */
+interface ResolveBundleInput {
+  /** Layer 0: the model header (required — the one layer a bundle must have). */
+  readonly apiModel: ApiModelInfo;
+  /** Layer 1: the package.json manifest, when present. */
+  readonly packageJson?: PackageManifest;
+  /** Layer 2: the extends-resolved tsconfig, when present. */
+  readonly tsconfig?: ResolvedTsconfig;
+  /** Layer 3: the tsdoctor.json sidecar manifest, when present. */
+  readonly manifest?: BundleManifest;
+  /** The `manifest.platform` tier, from platform options. */
+  readonly platform?: PlatformOverrides;
+}
+/**
+ * Resolve a bundle's layers into a {@link ResolvedBundle}, pure.
+ *
+ * @remarks
+ * Highest tier wins per FIELD: `manifest.platform` → `manifest.leaf` →
+ * `manifest.project` → `packageJson` → `apiModel` → `inferred`. The project
+ * tier participates only in the fields it carries site/project identity for
+ * (tagline); the display `name` chain deliberately skips it — a project name
+ * outranking every leaf's own name would render each package in a monorepo
+ * under the same title, and the spec's `og:title` derivation reads
+ * `leaf name/tagline ← package name`. Inference (image `alt` and MIME
+ * `type`) runs on the RESOLVED tagline/description, so a tagline change at
+ * any tier propagates into inferred alt text.
+ *
+ * @public
+ */
+declare function resolveBundle(input: ResolveBundleInput): ResolvedBundle;
+/**
+ * Resolve a read {@link Bundle}, unwrapping its `Option` layers.
+ *
+ * @public
+ */
+declare function resolveBundleFrom(bundle: Bundle, platform?: PlatformOverrides): ResolvedBundle;
+//#endregion
+//#region src/BundleAssets.d.ts
+declare const BundleAssetError_base: Schema.Class<BundleAssetError, Schema.TaggedStruct<"BundleAssetError", {
+  /** The source or destination path at fault. */
+  readonly path: Schema.String;
+  readonly cause: Schema.Defect;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A bundle-relative Open Graph image could not be published: the source file
+ * could not be read, or the destination could not be written.
+ *
+ * @public
+ */
+declare class BundleAssetError extends BundleAssetError_base {
+  get message(): string;
+}
+/**
+ * One Open Graph image after publication: an absolute URL a `<head>` tag can
+ * use directly, plus whatever facts are known about it.
+ *
+ * @public
+ */
+interface PublishedOpenGraphImage {
+  /** Absolute (or, when `siteUrl` is `""`, root-relative) URL. */
+  readonly url: string;
+  readonly type?: string;
+  readonly width?: number;
+  readonly height?: number;
+  readonly alt: string;
+}
+/**
+ * Input to {@link publishBundleAssets}.
+ *
+ * @public
+ */
+interface PublishBundleAssetsInput {
+  /** The bundle directory a resolved image's `path` is relative to. */
+  readonly bundleDir: string;
+  readonly images: ReadonlyArray<ResolvedOpenGraphImage>;
+  /** The site's static-asset root (e.g. `docs/public`). */
+  readonly publicDir: string;
+  /** The site's absolute origin; `""` yields root-relative URLs. */
+  readonly siteUrl: string;
+  /** The route segment a package's published assets are namespaced under. */
+  readonly unscopedName: string;
+  /**
+   * An additional route segment inserted after `unscopedName`, for a site
+   * that publishes more than one build of the same package (e.g. one
+   * version per `VersionConfig`) under one public directory.
+   *
+   * @remarks
+   * Without it, two versions of the same package that both carry an
+   * `openGraph` image publish to the identical
+   * `tsdoctor/<unscopedName>/<basename>` route and overwrite each other on
+   * every build — differing bytes defeat the identical-bytes skip, and
+   * whichever version built last wins for every version's pages.
+   */
+  readonly subdir?: string;
+}
+/**
+ * Copy every bundle-relative image into `<publicDir>/tsdoctor/<unscopedName>/`
+ * and return every image — bundle-relative or external — as a
+ * {@link PublishedOpenGraphImage} carrying an absolute URL.
+ *
+ * @remarks
+ * Identical bytes are not rewritten, so a rebuild over an unchanged image
+ * leaves the published file's own metadata (mtime and any framework cache
+ * keyed on it) untouched. Width and height are read from the resolved image
+ * when the manifest declared them, and measured from the file's bytes only
+ * when it did not.
+ *
+ * @public
+ */
+declare const publishBundleAssets: (input: PublishBundleAssetsInput) => Effect.Effect<readonly PublishedOpenGraphImage[], BundleAssetError, FileSystem.FileSystem | Path.Path>;
+//#endregion
 //#region src/BundleDiscovery.d.ts
 declare const BundleDiscoveryError_base: Schema.Class<BundleDiscoveryError, Schema.TaggedStruct<"BundleDiscoveryError", {
   /** The directory (or file) the failure is about. */
@@ -493,7 +840,7 @@ declare const BundleFetchError_base: Schema.Class<BundleFetchError, Schema.Tagge
   /** Which fetcher failed. */
   readonly source: Schema.Literals<readonly ["npm", "github"]>;
   /** What went wrong, structurally. */
-  readonly reason: Schema.Literals<readonly ["invalidRef", "versionNotFound", "releaseNotFound", "assetNotFound", "assetAmbiguous", "download", "notABundle", "cache"]>;
+  readonly reason: Schema.Literals<readonly ["invalidRef", "versionNotFound", "releaseNotFound", "assetNotFound", "assetAmbiguous", "download", "notABundle", "missingAsset", "cache"]>;
   /** The remote coordinate: `name@version` or `owner/repo@tag#asset`. */
   readonly ref: Schema.String;
   /** Human context for the failure. */
@@ -606,209 +953,6 @@ declare function fetchNpmBundle(options: FetchNpmBundleOptions): Effect.Effect<B
  */
 declare function fetchGitHubReleaseBundle(options: FetchGitHubReleaseBundleOptions): Effect.Effect<Bundle, BundleFetchError | BundleLayerError | BundleManifestError, GitHubRelease | PackageTarball | Cache | AppDirs | FileSystem.FileSystem | Path.Path>;
 //#endregion
-//#region src/PlatformOverrides.d.ts
-/**
- * The `manifest.platform` tier: a data-override object a consumer passes
- * through platform options (e.g. `ApiExtractorPlugin(options)`), sitting at
- * the TOP of the tier ranking.
- *
- * @remarks
- * Same field surface as the authored manifest tiers — name, tagline,
- * description, openGraph, sbom, registries — with no `spec` field (it is not
- * a file with an independent version) and no `project` block (it is a single
- * tier, not a flattened hierarchy). Lets a user with ONLY an api.json declare
- * identity/OG/registries declaratively; the resolver does the merging.
- *
- * @public
- */
-declare const PlatformOverrides: Schema.Struct<{
-  /** Human display name override. */
-  readonly name: Schema.optionalKey<Schema.String>;
-  /** Tagline override. */
-  readonly tagline: Schema.optionalKey<Schema.String>;
-  /** Description override. */
-  readonly description: Schema.optionalKey<Schema.String>;
-  /** Open Graph override. */
-  readonly openGraph: Schema.optionalKey<Schema.Struct<{
-    readonly images: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-      readonly path: Schema.optionalKey<Schema.String>;
-      readonly url: Schema.optionalKey<Schema.String>;
-      readonly type: Schema.optionalKey<Schema.String>;
-      readonly width: Schema.optionalKey<Schema.Int>;
-      readonly height: Schema.optionalKey<Schema.Int>;
-      readonly alt: Schema.optionalKey<Schema.String>;
-    }>>>;
-    readonly themeColor: Schema.optionalKey<Schema.String>;
-  }>>;
-  /** SBOM pointer override. */
-  readonly sbom: Schema.optionalKey<Schema.Struct<{
-    readonly path: Schema.String;
-    readonly format: Schema.optionalKey<Schema.String>;
-  }>>;
-  /** Registries override. */
-  readonly registries: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-    readonly type: Schema.String;
-    readonly name: Schema.String;
-    readonly url: Schema.String;
-  }>>>;
-}>;
-/**
- * The decoded type of {@link (PlatformOverrides:variable)}.
- *
- * @public
- */
-type PlatformOverrides = typeof PlatformOverrides.Type;
-/**
- * Decode an unknown value into a {@link (PlatformOverrides:type)}.
- *
- * @remarks
- * For adapters decoding raw platform options. Failures share
- * {@link BundleManifestError} — the platform tier is manifest data by another
- * route, and a caller handles both boundaries with one tag.
- *
- * @public
- */
-declare function decodePlatformOverrides(input: unknown): Effect.Effect<PlatformOverrides, BundleManifestError>;
-//#endregion
-//#region src/BundleResolver.d.ts
-/**
- * Where a resolved field's value came from, highest-ranked tier first.
- *
- * @remarks
- * The first six values are the spec's tier ladder. `"tsconfig"` is this
- * package's one addition: the spec passes tsconfig compiler options through
- * as a resolved field but its ladder has no source that names the tsconfig
- * layer, so the union carries one.
- *
- * @public
- */
-type ProvenanceSource = "manifest.platform" | "manifest.leaf" | "manifest.project" | "packageJson" | "apiModel" | "tsconfig" | "inferred";
-/**
- * A resolved value carrying its provenance.
- *
- * @remarks
- * Provenance is load-bearing: a field is user-overridden iff its source
- * outranks the derivation that would otherwise supply it, an `inferred`
- * field tracks upstream changes while an authored field is pinned, and the
- * change-detection fingerprints hash value AND source together so an
- * override flip is a visible diff.
- *
- * @public
- */
-interface Provenanced<A> {
-  /** The resolved value. */
-  readonly value: A;
-  /** The tier that supplied it. */
-  readonly source: ProvenanceSource;
-}
-/**
- * One Open Graph image after resolution: authored fields passed through,
- * `type` and `alt` filled by the documented inference rules when absent.
- *
- * @public
- */
-interface ResolvedOpenGraphImage {
-  /** Bundle-relative asset path, when the image is bundle-supplied. */
-  readonly path?: string;
-  /** Absolute external URL, when the image is external. */
-  readonly url?: string;
-  /** MIME type — authored, or inferred from the file extension. */
-  readonly type?: Provenanced<string>;
-  /** Pixel width, as authored. */
-  readonly width?: number;
-  /** Pixel height, as authored. */
-  readonly height?: number;
-  /** Alt text — authored, or inferred (tagline → description → `"<name> API documentation"`); never empty. */
-  readonly alt: Provenanced<string>;
-}
-/**
- * The Open Graph block after resolution.
- *
- * @public
- */
-interface ResolvedOpenGraph {
-  /** Resolved images, first-declared-wins per OG array semantics. */
-  readonly images: ReadonlyArray<ResolvedOpenGraphImage>;
-  /** Embed accent color, when authored. */
-  readonly themeColor?: string;
-}
-/**
- * A bundle's manifest data resolved across the six tiers, every field
- * carrying value + provenance.
- *
- * @remarks
- * Fields that no tier supplies are absent — with two floors: `name` always
- * resolves (the api.json model always has one) and every resolved image's
- * `alt` always resolves (the inference chain bottoms out on `name`).
- *
- * @public
- */
-interface ResolvedBundle {
-  /** Display name: platform → leaf manifest → package.json → api.json model. */
-  readonly name: Provenanced<string>;
-  /** Package version, from package.json. */
-  readonly version?: Provenanced<string>;
-  /** Tagline: platform → leaf manifest → project tier. */
-  readonly tagline?: Provenanced<string>;
-  /** Description: platform → leaf manifest → package.json. */
-  readonly description?: Provenanced<string>;
-  /** The project identity block, when the manifest carries one. */
-  readonly project?: Provenanced<ProjectIdentity>;
-  /** Open Graph block: platform → leaf manifest, with per-image inference applied. */
-  readonly openGraph?: Provenanced<ResolvedOpenGraph>;
-  /** SBOM pointer: platform → leaf manifest. */
-  readonly sbom?: Provenanced<SbomRef>;
-  /** Registries: platform → leaf manifest. */
-  readonly registries?: Provenanced<ReadonlyArray<RegistryRef>>;
-  /** Runtime dependencies from package.json, key-sorted. Feeds the type registry's rendering scope. */
-  readonly dependencies?: Provenanced<Readonly<Record<string, string>>>;
-  /** Peer dependencies from package.json, key-sorted. Feeds the type registry's rendering scope. */
-  readonly peerDependencies?: Provenanced<Readonly<Record<string, string>>>;
-  /** Extends-resolved compiler options from tsconfig.json. Feeds the Twoslash environment. */
-  readonly compilerOptions?: Provenanced<CompilerOptions.Type>;
-}
-/**
- * The parsed layers {@link resolveBundle} resolves — plain optional fields,
- * so pure call sites (and tests) need no `Option` wrapping.
- *
- * @public
- */
-interface ResolveBundleInput {
-  /** Layer 0: the model header (required — the one layer a bundle must have). */
-  readonly apiModel: ApiModelInfo;
-  /** Layer 1: the package.json manifest, when present. */
-  readonly packageJson?: PackageManifest;
-  /** Layer 2: the extends-resolved tsconfig, when present. */
-  readonly tsconfig?: ResolvedTsconfig;
-  /** Layer 3: the tsdoctor.json sidecar manifest, when present. */
-  readonly manifest?: BundleManifest;
-  /** The `manifest.platform` tier, from platform options. */
-  readonly platform?: PlatformOverrides;
-}
-/**
- * Resolve a bundle's layers into a {@link ResolvedBundle}, pure.
- *
- * @remarks
- * Highest tier wins per FIELD: `manifest.platform` → `manifest.leaf` →
- * `manifest.project` → `packageJson` → `apiModel` → `inferred`. The project
- * tier participates only in the fields it carries site/project identity for
- * (tagline); the display `name` chain deliberately skips it — a project name
- * outranking every leaf's own name would render each package in a monorepo
- * under the same title, and the spec's `og:title` derivation reads
- * `leaf name/tagline ← package name`. Inference (image `alt` and MIME
- * `type`) runs on the RESOLVED tagline/description, so a tagline change at
- * any tier propagates into inferred alt text.
- *
- * @public
- */
-declare function resolveBundle(input: ResolveBundleInput): ResolvedBundle;
-/**
- * Resolve a read {@link Bundle}, unwrapping its `Option` layers.
- *
- * @public
- */
-declare function resolveBundleFrom(bundle: Bundle, platform?: PlatformOverrides): ResolvedBundle;
-//#endregion
 //#region src/BundleHash.d.ts
 /**
  * Normalize text for hashing: CRLF/CR line endings become LF and trailing
@@ -885,5 +1029,5 @@ declare function hashLayerText(text: string): Effect.Effect<string, PlatformErro
  */
 declare function fingerprintResolvedBundle(resolved: ResolvedBundle): Effect.Effect<Readonly<Record<string, string>>, PlatformError.PlatformError, Crypto.Crypto>;
 //#endregion
-export { type ApiModelInfo, type Bundle, type BundleDescriptor, BundleDiscoveryError, BundleFetchError, BundleLayerError, BundleManifest, BundleManifestError, type BundleOverrides, type DiscoverBundleOptions, type DiscoverBundlesOptions, type FetchGitHubReleaseBundleOptions, type FetchNpmBundleOptions, KNOWN_REGISTRY_TYPES, type KnownRegistryType, OpenGraphConfig, OpenGraphImage, PlatformOverrides, ProjectIdentity, type ProvenanceSource, type Provenanced, RegistryRef, type ResolveBundleInput, type ResolvedBundle, type ResolvedOpenGraph, type ResolvedOpenGraphImage, SbomRef, TSDOCTOR_MANIFEST_FILENAME, decodeBundleManifest, decodePlatformOverrides, discoverBundle, discoverBundles, fetchGitHubReleaseBundle, fetchNpmBundle, fingerprintResolvedBundle, hashJsonValue, hashLayerText, hashText, isKnownRegistryType, loadBundle, loadBundles, normalizeText, readApiModelInfo, readBundle, resolveBundle, resolveBundleFrom };
+export { type ApiModelInfo, type Bundle, BundleAssetError, type BundleDescriptor, BundleDiscoveryError, BundleFetchError, BundleLayerError, BundleManifest, BundleManifestError, type BundleOverrides, type DiscoverBundleOptions, type DiscoverBundlesOptions, type FetchGitHubReleaseBundleOptions, type FetchNpmBundleOptions, KNOWN_REGISTRY_TYPES, type KnownRegistryType, MANIFEST_SPEC, ManifestSource, OpenGraphConfig, OpenGraphImage, PlatformOverrides, ProjectIdentity, type ProvenanceSource, type Provenanced, type PublishBundleAssetsInput, type PublishedOpenGraphImage, RegistryRef, type ResolveBundleInput, type ResolvedBundle, type ResolvedOpenGraph, type ResolvedOpenGraphImage, SbomRef, TSDOCTOR_MANIFEST_FILENAME, decodeBundleManifest, decodeManifestSource, decodePlatformOverrides, discoverBundle, discoverBundles, encodeBundleManifest, fetchGitHubReleaseBundle, fetchNpmBundle, fingerprintResolvedBundle, hashJsonValue, hashLayerText, hashText, isKnownRegistryType, loadBundle, loadBundles, normalizeText, publishBundleAssets, readApiModelInfo, readBundle, resolveBundle, resolveBundleFrom };
 //# sourceMappingURL=index.d.ts.map

package/index.js CHANGED Viewed

@@ -1,9 +1,10 @@
-import { BundleManifest, BundleManifestError, KNOWN_REGISTRY_TYPES, OpenGraphConfig, OpenGraphImage, ProjectIdentity, RegistryRef, SbomRef, decodeBundleManifest, isKnownRegistryType } from "./BundleManifest.js";
-import { BundleLayerError, TSDOCTOR_MANIFEST_FILENAME, readApiModelInfo, readBundle } from "./Bundle.js";
+import { BundleLayerError, readApiModelInfo, readBundle } from "./Bundle.js";
+import { BundleAssetError, publishBundleAssets } from "./BundleAssets.js";
 import { BundleDiscoveryError, discoverBundle, discoverBundles, loadBundle, loadBundles } from "./BundleDiscovery.js";
 import { BundleFetchError, fetchGitHubReleaseBundle, fetchNpmBundle } from "./BundleFetch.js";
 import { fingerprintResolvedBundle, hashJsonValue, hashLayerText, hashText, normalizeText } from "./BundleHash.js";
 import { resolveBundle, resolveBundleFrom } from "./BundleResolver.js";
 import { PlatformOverrides, decodePlatformOverrides } from "./PlatformOverrides.js";
+import { BundleManifest, BundleManifestError, KNOWN_REGISTRY_TYPES, MANIFEST_SPEC, ManifestSource, OpenGraphConfig, OpenGraphImage, ProjectIdentity, RegistryRef, SbomRef, TSDOCTOR_MANIFEST_FILENAME, decodeBundleManifest, decodeManifestSource, encodeBundleManifest, isKnownRegistryType } from "@tsdoctor/manifest";
-export { BundleDiscoveryError, BundleFetchError, BundleLayerError, BundleManifest, BundleManifestError, KNOWN_REGISTRY_TYPES, OpenGraphConfig, OpenGraphImage, PlatformOverrides, ProjectIdentity, RegistryRef, SbomRef, TSDOCTOR_MANIFEST_FILENAME, decodeBundleManifest, decodePlatformOverrides, discoverBundle, discoverBundles, fetchGitHubReleaseBundle, fetchNpmBundle, fingerprintResolvedBundle, hashJsonValue, hashLayerText, hashText, isKnownRegistryType, loadBundle, loadBundles, normalizeText, readApiModelInfo, readBundle, resolveBundle, resolveBundleFrom };
+export { BundleAssetError, BundleDiscoveryError, BundleFetchError, BundleLayerError, BundleManifest, BundleManifestError, KNOWN_REGISTRY_TYPES, MANIFEST_SPEC, ManifestSource, OpenGraphConfig, OpenGraphImage, PlatformOverrides, ProjectIdentity, RegistryRef, SbomRef, TSDOCTOR_MANIFEST_FILENAME, decodeBundleManifest, decodeManifestSource, decodePlatformOverrides, discoverBundle, discoverBundles, encodeBundleManifest, fetchGitHubReleaseBundle, fetchNpmBundle, fingerprintResolvedBundle, hashJsonValue, hashLayerText, hashText, isKnownRegistryType, loadBundle, loadBundles, normalizeText, publishBundleAssets, readApiModelInfo, readBundle, resolveBundle, resolveBundleFrom };

package/internal/asset-path.js ADDED Viewed

@@ -0,0 +1,29 @@
+//#region src/internal/asset-path.ts
+/**
+* Shared traversal guard for bundle-relative asset paths.
+*
+* @remarks
+* Not exported from `index.ts` — internal to the package. Both the fetch
+* plane ({@link "../BundleFetch.js"}) and the publish plane
+* ({@link "../BundleAssets.js"}) read a manifest-declared, bundle-relative
+* `openGraph.images[].path` and must reject the same shapes before touching
+* the filesystem: no absolute paths, no `.`/`..` traversal segments, no
+* separators hiding inside a segment.
+*
+* @internal
+*/
+const SAFE_SEGMENT = /^(?!\.{1,2}$)[^/\\\s]+$/;
+/**
+* Whether `assetPath` is a relative path confined to the bundle directory —
+* no leading slash, no `.`/`..` segment, no unsafe characters in any
+* segment.
+*
+* @internal
+*/
+function isSafeAssetPath(assetPath) {
+	if (assetPath.length === 0 || assetPath.startsWith("/") || assetPath.startsWith("\\")) return false;
+	return assetPath.split(/[/\\]/).every((segment) => SAFE_SEGMENT.test(segment));
+}
+//#endregion
+export { isSafeAssetPath };

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
 	"name": "@tsdoctor/bundle",
-	"version": "0.2.3",
+	"version": "0.3.0",
 	"private": false,
 	"description": "The tsdoctor bundle spec: layered bundle discovery, the versioned tsdoctor.json sidecar manifest, provenance-carrying resolution and canonical input hashing for API documentation bundles.",
 	"keywords": [
@@ -48,7 +48,9 @@
 		"@effected/tsconfig-json": "^0.7.0",
 		"@effected/walker": "^0.5.0",
 		"@effected/xdg": "^0.3.0",
-		"effect": "4.0.0-rc.109"
+		"@tsdoctor/manifest": "0.1.0",
+		"effect": "4.0.0-rc.109",
+		"image-size": "^2.0.2"
 	},
 	"engines": {
 		"node": ">=24.11.0"

package/BundleManifest.js DELETED Viewed

@@ -1,183 +0,0 @@
-import { Effect, Schema } from "effect";
-//#region src/BundleManifest.ts
-/**
-* The registry protocol families this reader knows how to do more than link
-* to. `"npm"` means an npm-compatible registry — install commands and tarball
-* fetching work against any instance of it — and `"jsr"` the jsr protocol.
-*
-* @remarks
-* The manifest's `type` field is deliberately NOT constrained to these
-* values: unknown future types must degrade to link-only rendering, not
-* reject the manifest. Use {@link isKnownRegistryType} to branch.
-*
-* @public
-*/
-const KNOWN_REGISTRY_TYPES = ["npm", "jsr"];
-/**
-* Whether a registry `type` value is a protocol family this reader
-* recognizes. `false` means the registry entry should degrade to link-only
-* rendering — it is never a validation failure.
-*
-* @public
-*/
-function isKnownRegistryType(type) {
-	return KNOWN_REGISTRY_TYPES.includes(type);
-}
-/**
-* One registry the documented package is published to.
-*
-* @remarks
-* `type` is the PROTOCOL FAMILY (`"npm"` covers every npm-compatible
-* registry), `name` the human instance label, `url` the package's page on
-* that instance. Unknown `type` values decode successfully and degrade to
-* link-only rendering (see {@link isKnownRegistryType}).
-*
-* @public
-*/
-const RegistryRef = Schema.Struct({
-	/** The protocol family, e.g. `"npm"` or `"jsr"`. Unknown values are accepted. */
-	type: Schema.String,
-	/** The human instance label, e.g. `"npm"` or `"Savvy Web Registry"`. */
-	name: Schema.String,
-	/** The package's URL on that registry instance. */
-	url: Schema.String
-});
-/**
-* One Open Graph image declared by the manifest.
-*
-* @remarks
-* Exactly ONE of `path` (a bundle-relative asset the consuming platform
-* publishes and resolves to a URL) or `url` (an absolute external URL used
-* verbatim) must be present — the schema enforces the XOR. `type` is a MIME
-* type, inferred from the file extension by the resolver when omitted; `alt`
-* has a documented inference chain (tagline → description →
-* `"<name> API documentation"`).
-*
-* @public
-*/
-const OpenGraphImage = Schema.Struct({
-	/** Bundle-relative asset path. Mutually exclusive with `url`. */
-	path: Schema.optionalKey(Schema.String),
-	/** Absolute external URL, used verbatim. Mutually exclusive with `path`. */
-	url: Schema.optionalKey(Schema.String),
-	/** MIME type; inferred from the extension when omitted. */
-	type: Schema.optionalKey(Schema.String),
-	/** Pixel width; 1200×630 (1.91:1) is the cross-platform safe default. */
-	width: Schema.optionalKey(Schema.Int),
-	/** Pixel height. */
-	height: Schema.optionalKey(Schema.Int),
-	/** Alt text; inferred (tagline → description → fallback) when omitted. */
-	alt: Schema.optionalKey(Schema.String)
-}).check(Schema.makeFilter((image) => image.path === void 0 !== (image.url === void 0) ? void 0 : "exactly one of \"path\" or \"url\" must be present", { title: "openGraph image source" }));
-/**
-* The manifest's Open Graph block: the asset-ish pieces only — most OG tags
-* are page-level and derive at render time in the consuming platform.
-*
-* @remarks
-* Multiple images follow OG array semantics: the first declared wins, extras
-* are alternates (e.g. a portrait 1000×1500 variant).
-*
-* @public
-*/
-const OpenGraphConfig = Schema.Struct({
-	/** Declared images, first-wins per OG array semantics. */
-	images: Schema.optionalKey(Schema.Array(OpenGraphImage)),
-	/** Embed accent color (e.g. Discord), a CSS color string. */
-	themeColor: Schema.optionalKey(Schema.String)
-});
-/**
-* A pointer to the bundle's SBOM, computed by the bundler at publish and
-* served as a downloadable static asset.
-*
-* @public
-*/
-const SbomRef = Schema.Struct({
-	/** Bundle-relative path to the SBOM file. */
-	path: Schema.String,
-	/** SBOM format label, e.g. `"spdx-json"`. Unknown values are accepted. */
-	format: Schema.optionalKey(Schema.String)
-});
-/**
-* The inherited project tier, flattened into the emitted manifest by the
-* bundler (a fetched bundle has no parent directory to walk). Kept nested —
-* structurally distinguishable from the leaf fields — because provenance is
-* load-bearing for override detection.
-*
-* @public
-*/
-const ProjectIdentity = Schema.Struct({
-	/** The project display name, e.g. `"Effected"` over leaf `@effected/store`. */
-	name: Schema.optionalKey(Schema.String),
-	/** The project tagline. */
-	tagline: Schema.optionalKey(Schema.String)
-});
-/**
-* The versioned `tsdoctor.json` sidecar manifest — bundle layer 3.
-*
-* @remarks
-* `spec` is the only required field; every other field enriches. Unknown
-* top-level fields are ignored on decode (additive fields are minor spec
-* revisions) and unknown enum-ish values (registry `type`, sbom `format`)
-* degrade gracefully instead of rejecting — an old reader must be able to
-* consume a new bundle.
-*
-* @public
-*/
-const BundleManifest = Schema.Struct({
-	/** The integer spec version. This reader understands spec 1. */
-	spec: Schema.Literal(1),
-	/** Human display name (the npm name is dry; this one is SEO-friendly). */
-	name: Schema.optionalKey(Schema.String),
-	/** Short tagline. */
-	tagline: Schema.optionalKey(Schema.String),
-	/** Long description; overrides the package.json description when present. */
-	description: Schema.optionalKey(Schema.String),
-	/** The inherited project tier, flattened in at emit time. */
-	project: Schema.optionalKey(ProjectIdentity),
-	/** Open Graph assets. */
-	openGraph: Schema.optionalKey(OpenGraphConfig),
-	/** SBOM pointer. */
-	sbom: Schema.optionalKey(SbomRef),
-	/** Registries the package is published to. */
-	registries: Schema.optionalKey(Schema.Array(RegistryRef))
-});
-/**
-* Raised when a present `tsdoctor.json` cannot be parsed or does not satisfy
-* the {@link (BundleManifest:variable)} schema.
-*
-* @remarks
-* Absence of the manifest is NEVER this error — layers enrich, never gate,
-* so a missing sidecar is the normal case and reads as `Option.none()`.
-*
-* @public
-*/
-var BundleManifestError = class extends Schema.TaggedError()("BundleManifestError", {
-	/** The manifest file path, when the failure is tied to a file on disk. */
-	path: Schema.optionalKey(Schema.String),
-	/** The underlying failure (JSON syntax or schema decode), preserved structurally. */
-	cause: Schema.Defect()
-}) {
-	get message() {
-		return `Invalid tsdoctor.json manifest${this.path !== void 0 ? ` at ${this.path}` : ""}`;
-	}
-};
-/**
-* Decode an unknown value into a {@link (BundleManifest:type)}.
-*
-* @remarks
-* The typed boundary for manifest input that has already been parsed from
-* JSON (plugin options, fetched payloads). File-based reading lives in
-* `readBundle`, which routes through this after parsing.
-*
-* @public
-*/
-function decodeBundleManifest(input, path) {
-	return Schema.decodeUnknownEffect(BundleManifest)(input).pipe(Effect.mapError((cause) => new BundleManifestError({
-		...path !== void 0 ? { path } : {},
-		cause
-	})));
-}
-//#endregion
-export { BundleManifest, BundleManifestError, KNOWN_REGISTRY_TYPES, OpenGraphConfig, OpenGraphImage, ProjectIdentity, RegistryRef, SbomRef, decodeBundleManifest, isKnownRegistryType };