@uwmd/core 1.1.2 → 1.5.0

package/dist/deal-package-context.js

@@ -0,0 +1,132 @@
+// UW Deal Package JSON context view (RFC 0018 §4).
+//
+// Projects a package into JSON with the full manifest, typed links, and inline
+// UTF-8 content **only** for UW documents and source notes. A connector can
+// therefore pass the actionable underwriting context as ordinary JSON rather
+// than as an opaque archive.
+//
+// This is a *view*, not a second archival encoding. The central rule:
+//
+//   Source evidence is represented by identity and digest only. Its bytes are
+//   NEVER inlined — not as UTF-8, not as base64, not "just this once".
+//
+// Naming a source does not make it available to the recipient, and a context
+// view must never be mistaken for proof that a source was read.
+import { CONTEXT_INLINABLE_ROLES, UWPackageError, UW_PACKAGE_VERSION, validateUWDealPackageManifest, } from './deal-package.js';
+function contextError(code, message, pointer) {
+    return { category: 'package', code, message, ...(pointer ? { pointer } : {}) };
+}
+export function projectUWDealPackageContext(manifest, options = {}) {
+    const manifestErrors = validateUWDealPackageManifest(manifest);
+    if (manifestErrors.length > 0) {
+        throw new UWPackageError('PKGCTX-000', `Manifest is invalid: ${manifestErrors[0].message}`);
+    }
+    const contents = {};
+    const sourceEvidence = {};
+    for (const member of manifest.members) {
+        if (member.role === 'source_evidence') {
+            // Every source-evidence member MUST appear, so the recipient can see what
+            // exists and was withheld rather than silently not knowing about it.
+            const refs = options.references?.[member.id];
+            sourceEvidence[member.id] = refs && refs.length > 0
+                ? { status: 'reference', reference: refs }
+                : { status: 'not_transferred' };
+            continue;
+        }
+        if (!CONTEXT_INLINABLE_ROLES.includes(member.role))
+            continue;
+        const text = options.contents?.[member.id];
+        if (typeof text === 'string') {
+            contents[member.id] = { kind: 'utf8', text };
+        }
+    }
+    return {
+        package_version: UW_PACKAGE_VERSION,
+        package_id: manifest.package_id,
+        members: manifest.members,
+        links: manifest.links ?? [],
+        contents,
+        source_evidence: sourceEvidence,
+        incomplete_evidence_context: true,
+    };
+}
+/**
+ * Validate a context view. Beyond shape, this enforces the §4 rules that make
+ * the view safe to hand to a model:
+ *
+ *   - every `contents` key references a manifest member with an inlinable role;
+ *   - no `contents` key references source evidence or an unlisted member; and
+ *   - every source-evidence member is described, never embedded.
+ */
+export function validateUWDealPackageContext(candidate) {
+    const errors = [];
+    if (typeof candidate !== 'object' || candidate === null || Array.isArray(candidate)) {
+        return [contextError('PKGCTX-001', 'Context must be an object.')];
+    }
+    const ctx = candidate;
+    if (ctx.package_version !== UW_PACKAGE_VERSION) {
+        errors.push(contextError('PKGCTX-002', 'Unsupported package_version.', 'package_version'));
+    }
+    if (!Array.isArray(ctx.members)) {
+        errors.push(contextError('PKGCTX-003', 'members must be an array.', 'members'));
+        return errors;
+    }
+    if (ctx.incomplete_evidence_context !== true) {
+        errors.push(contextError('PKGCTX-004', 'Context must declare incomplete_evidence_context: true — it is not an archival package.', 'incomplete_evidence_context'));
+    }
+    const byId = new Map(ctx.members.map((m) => [m.id, m]));
+    for (const [id, entry] of Object.entries(ctx.contents ?? {})) {
+        const member = byId.get(id);
+        if (!member) {
+            errors.push(contextError('PKGCTX-005', `contents references an unlisted member: ${id}`, `contents.${id}`));
+            continue;
+        }
+        if (member.role === 'source_evidence') {
+            errors.push(contextError('PKGCTX-006', `contents must never inline source evidence: ${id}`, `contents.${id}`));
+            continue;
+        }
+        if (!CONTEXT_INLINABLE_ROLES.includes(member.role)) {
+            errors.push(contextError('PKGCTX-007', `Member role ${member.role} is not inlinable.`, `contents.${id}`));
+        }
+        if (!entry || entry.kind !== 'utf8' || typeof entry.text !== 'string') {
+            errors.push(contextError('PKGCTX-008', 'Content entry must be { kind: "utf8", text }.', `contents.${id}`));
+        }
+    }
+    for (const member of ctx.members) {
+        if (member.role !== 'source_evidence')
+            continue;
+        const descriptor = ctx.source_evidence?.[member.id];
+        if (!descriptor) {
+            errors.push(contextError('PKGCTX-009', `Source evidence member is not described: ${member.id}`, `source_evidence.${member.id}`));
+            continue;
+        }
+        if (descriptor.status !== 'not_transferred' && descriptor.status !== 'reference') {
+            errors.push(contextError('PKGCTX-010', 'Source evidence status must be "not_transferred" or "reference".', `source_evidence.${member.id}.status`));
+        }
+    }
+    return errors;
+}
+/**
+ * Verify inline payloads against their declared byte digests.
+ *
+ * Kept separate from `validateUWDealPackageContext` because it needs a digest
+ * function the caller supplies — core does not import a hashing implementation
+ * here, and the browser and Node paths differ. A context whose inline bytes do
+ * not match the manifest is a verification failure, not a shape error.
+ */
+export async function verifyContextContentDigests(ctx, sha256Hex) {
+    const errors = [];
+    const byId = new Map(ctx.members.map((m) => [m.id, m]));
+    const encoder = new TextEncoder();
+    for (const [id, entry] of Object.entries(ctx.contents ?? {})) {
+        const member = byId.get(id);
+        if (!member)
+            continue; // already reported by shape validation
+        const actual = `sha256:${await sha256Hex(encoder.encode(entry.text))}`;
+        if (actual !== member.sha256) {
+            errors.push(contextError('PKGCTX-011', `Inline content digest does not match the manifest for ${id}.`, `contents.${id}`));
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=deal-package-context.js.map

package/dist/deal-package-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deal-package-context.js","sourceRoot":"","sources":["../src/deal-package-context.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,6BAA6B;AAC7B,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,gEAAgE;AAEhE,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,kBAAkB,EAIlB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAkC3B,SAAS,YAAY,CAAC,IAAY,EAAE,OAAe,EAAE,OAAgB;IACnE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAA+B,EAC/B,UAAiC,EAAE;IAEnC,MAAM,cAAc,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,wBAAwB,cAAc,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,QAAQ,GAAqC,EAAE,CAAC;IACtD,MAAM,cAAc,GAA+C,EAAE,CAAC;IAEtE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACtC,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBACjD,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC1C,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO;QACL,eAAe,EAAE,kBAAkB;QACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;QAC3B,QAAQ;QACR,eAAe,EAAE,cAAc;QAC/B,2BAA2B,EAAE,IAAI;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAkB;IAC7D,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,SAAiC,CAAC;IAE9C,IAAI,GAAG,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,2BAA2B,EAAE,SAAS,CAAC,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,GAAG,CAAC,2BAA2B,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,YAAY,CACtB,YAAY,EACZ,yFAAyF,EACzF,6BAA6B,CAC9B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,2CAA2C,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3G,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,YAAY,CACtB,YAAY,EACZ,+CAA+C,EAAE,EAAE,EACnD,YAAY,EAAE,EAAE,CACjB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,eAAe,MAAM,CAAC,IAAI,oBAAoB,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,+CAA+C,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;YAAE,SAAS;QAChD,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,YAAY,CACtB,YAAY,EACZ,4CAA4C,MAAM,CAAC,EAAE,EAAE,EACvD,mBAAmB,MAAM,CAAC,EAAE,EAAE,CAC/B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjF,MAAM,CAAC,IAAI,CAAC,YAAY,CACtB,YAAY,EACZ,kEAAkE,EAClE,mBAAmB,MAAM,CAAC,EAAE,SAAS,CACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,GAAyB,EACzB,SAAiD;IAEjD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,uCAAuC;QAC9D,MAAM,MAAM,GAAG,UAAU,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,YAAY,CACtB,YAAY,EACZ,yDAAyD,EAAE,GAAG,EAC9D,YAAY,EAAE,EAAE,CACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/deal-package-zip.d.ts

@@ -0,0 +1,36 @@
+import { UW_PACKAGE_VERSION, type UWDealPackageManifest } from './deal-package.js';
+import type { ProtocolError } from './protocol.js';
+import { type ZipSafetyLimits } from './zip-safety.js';
+export declare const PACKAGE_MANIFEST_PATH: "manifest.json";
+export interface UWDealPackageInput {
+    manifest: UWDealPackageManifest;
+    /** Member path → exact bytes. Every declared member must be present. */
+    payloads: Record<string, Uint8Array>;
+}
+export interface UWDealPackageDecoded {
+    manifest: UWDealPackageManifest;
+    payloads: Record<string, Uint8Array>;
+}
+export type UWPackageDecodeOptions = ZipSafetyLimits;
+export type PackageVerificationStatus = 'verified' | 'failed' | 'unverifiable';
+export interface PackageVerification {
+    status: PackageVerificationStatus;
+    errors: ProtocolError[];
+    /** Members whose semantic digest could not be checked by this implementation. */
+    unverifiable_members: string[];
+}
+export declare function encodeUWDealPackageZip(input: UWDealPackageInput): Promise<Uint8Array>;
+export declare function decodeUWDealPackageZip(input: Uint8Array, options?: UWPackageDecodeOptions): UWDealPackageDecoded;
+/**
+ * Verify a decoded package.
+ *
+ * Three-state on purpose, matching the receipt verifier. A member whose
+ * representation this implementation cannot canonicalize is **unverifiable**,
+ * not failed — an unsupported representation is not evidence of tampering, and
+ * collapsing the two would teach users to ignore the distinction.
+ */
+export declare function verifyUWDealPackage(decoded: UWDealPackageDecoded, options?: {
+    semanticDigestOf?: (member: string, bytes: Uint8Array) => Promise<string | null>;
+}): Promise<PackageVerification>;
+export { UW_PACKAGE_VERSION };
+//# sourceMappingURL=deal-package-zip.d.ts.map

package/dist/deal-package-zip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deal-package-zip.d.ts","sourceRoot":"","sources":["../src/deal-package-zip.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,kBAAkB,EAGlB,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEzE,eAAO,MAAM,qBAAqB,EAAG,eAAwB,CAAC;AAa9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACtC;AAED,MAAM,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAErD,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,QAAQ,GAAG,cAAc,CAAC;AAE/E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,yBAAyB,CAAC;IAClC,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,iFAAiF;IACjF,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AASD,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CA6B3F;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE,sBAA2B,GACnC,oBAAoB,CAsCtB;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAAO,GACjG,OAAO,CAAC,mBAAmB,CAAC,CA8B9B;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/deal-package-zip.js

@@ -0,0 +1,132 @@
+// UW Deal Package ZIP codec (RFC 0018 §3).
+//
+// The ZIP is the archival encoding; the JSON context is a view of it. A
+// canonical encoder emits entries in lexicographic path order with fixed
+// timestamps, so the same package always produces the same bytes — ZIP entry
+// order and mtimes are not semantic and must not leak into a digest.
+//
+// Decoding inspects the archive before inflating anything, using the same
+// shared safe-ZIP rules as the CSV bundle. Extraction to disk is not this
+// module's business and never happens here.
+import { unzipSync, zipSync } from 'fflate';
+import { UWPackageError, UW_PACKAGE_VERSION, assertUWDealPackageManifest, validateUWDealPackageManifest, } from './deal-package.js';
+import { sha256BytesHex } from './integrity.js';
+import { inspectZipSafety } from './zip-safety.js';
+export const PACKAGE_MANIFEST_PATH = 'manifest.json';
+// Same constant the CSV bundle uses. One day past the DOS epoch on purpose:
+// fflate converts to *local* time, so 1980-01-01T00:00Z underflows the
+// 1980-2099 range in any negative-offset timezone.
+//
+// Caveat inherited from that choice: because the conversion is local, the
+// encoded DOS timestamp — and therefore the archive bytes — can differ between
+// machines in different timezones. Encoding is deterministic on a given host,
+// which is what the ordering guarantee needs; cross-timezone byte identity
+// would require a UTC-fixed field fflate does not expose.
+const FIXED_MTIME = new Date('1980-01-02T00:00:00.000Z');
+function pkgError(code, message, pointer) {
+    return { category: 'package', code, message, ...(pointer ? { pointer } : {}) };
+}
+const decoder = new TextDecoder('utf-8', { fatal: true });
+const encoder = new TextEncoder();
+export async function encodeUWDealPackageZip(input) {
+    const manifest = assertUWDealPackageManifest(input.manifest);
+    const files = {};
+    for (const member of manifest.members) {
+        const payload = input.payloads[member.path];
+        if (!payload) {
+            throw new UWPackageError('PKGZIP-001', `Declared member has no payload: ${member.path}`);
+        }
+        const actual = `sha256:${await sha256BytesHex(payload)}`;
+        if (actual !== member.sha256) {
+            // Encoding a package whose manifest already disagrees with its bytes
+            // would mint a broken artifact, so this fails at write time.
+            throw new UWPackageError('PKGZIP-002', `Member ${member.id} digest does not match its payload (manifest ${member.sha256}, actual ${actual}).`);
+        }
+        files[member.path] = [payload, { mtime: FIXED_MTIME, level: 9 }];
+    }
+    files[PACKAGE_MANIFEST_PATH] = [
+        encoder.encode(`${JSON.stringify(manifest, null, 2)}\n`),
+        { mtime: FIXED_MTIME, level: 9 },
+    ];
+    // Lexicographic order makes the archive byte-deterministic.
+    const ordered = {};
+    for (const path of Object.keys(files).sort())
+        ordered[path] = files[path];
+    return zipSync(ordered);
+}
+export function decodeUWDealPackageZip(input, options = {}) {
+    inspectZipSafety(input, options, (violation, message) => {
+        throw new UWPackageError(`PKG_${violation}`, message);
+    });
+    let entries;
+    try {
+        entries = unzipSync(input);
+    }
+    catch (error) {
+        throw new UWPackageError('PKGZIP-003', `ZIP could not be read: ${String(error)}`);
+    }
+    const manifestBytes = entries[PACKAGE_MANIFEST_PATH];
+    if (!manifestBytes) {
+        throw new UWPackageError('PKGZIP-004', `Package is missing ${PACKAGE_MANIFEST_PATH}.`);
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(decoder.decode(manifestBytes));
+    }
+    catch (error) {
+        throw new UWPackageError('PKGZIP-005', `${PACKAGE_MANIFEST_PATH} is invalid: ${String(error)}`);
+    }
+    const errors = validateUWDealPackageManifest(manifest);
+    if (errors.length > 0) {
+        throw new UWPackageError(errors[0].code, errors.map((e) => e.message).join('; '));
+    }
+    const typed = manifest;
+    const payloads = {};
+    for (const member of typed.members) {
+        const bytes = entries[member.path];
+        if (!bytes) {
+            throw new UWPackageError('PKGZIP-006', `Declared member is absent from the archive: ${member.path}`);
+        }
+        payloads[member.path] = bytes;
+    }
+    return { manifest: typed, payloads };
+}
+/**
+ * Verify a decoded package.
+ *
+ * Three-state on purpose, matching the receipt verifier. A member whose
+ * representation this implementation cannot canonicalize is **unverifiable**,
+ * not failed — an unsupported representation is not evidence of tampering, and
+ * collapsing the two would teach users to ignore the distinction.
+ */
+export async function verifyUWDealPackage(decoded, options = {}) {
+    const errors = [];
+    const unverifiable = [];
+    for (const member of decoded.manifest.members) {
+        const bytes = decoded.payloads[member.path];
+        if (!bytes) {
+            errors.push(pkgError('PKGVER-001', `Member payload missing: ${member.path}`, member.id));
+            continue;
+        }
+        const actual = `sha256:${await sha256BytesHex(bytes)}`;
+        if (actual !== member.sha256) {
+            errors.push(pkgError('PKGVER-002', `Member ${member.id} byte digest does not match the manifest.`, member.id));
+            continue;
+        }
+        if (member.semantic_digest) {
+            const computed = options.semanticDigestOf
+                ? await options.semanticDigestOf(member.id, bytes)
+                : null;
+            if (computed === null) {
+                unverifiable.push(member.id);
+            }
+            else if (computed !== member.semantic_digest) {
+                errors.push(pkgError('PKGVER-003', `Member ${member.id} semantic digest does not match.`, member.id));
+            }
+        }
+    }
+    const status = errors.length > 0 ? 'failed' : unverifiable.length > 0 ? 'unverifiable' : 'verified';
+    return { status, errors, unverifiable_members: unverifiable };
+}
+export { UW_PACKAGE_VERSION };
+//# sourceMappingURL=deal-package-zip.js.map

package/dist/deal-package-zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deal-package-zip.js","sourceRoot":"","sources":["../src/deal-package-zip.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,4CAA4C;AAE5C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,2BAA2B,EAC3B,6BAA6B,GAE9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAwB,MAAM,iBAAiB,CAAC;AAEzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAwB,CAAC;AAE9D,4EAA4E;AAC5E,uEAAuE;AACvE,mDAAmD;AACnD,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,0DAA0D;AAC1D,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAwBzD,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe,EAAE,OAAgB;IAC/D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAyB;IACpE,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE7D,MAAM,KAAK,GAA4D,EAAE,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,mCAAmC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,IAAI,cAAc,CACtB,YAAY,EACZ,UAAU,MAAM,CAAC,EAAE,gDAAgD,MAAM,CAAC,MAAM,YAAY,MAAM,IAAI,CACvG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,qBAAqB,CAAC,GAAG;QAC7B,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACxD,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;KACjC,CAAC;IAEF,4DAA4D;IAC5D,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAE,CAAC;IAC3E,OAAO,OAAO,CAAC,OAAgB,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAiB,EACjB,UAAkC,EAAE;IAEpC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE;QACtD,MAAM,IAAI,cAAc,CAAC,OAAO,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,0BAA0B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,sBAAsB,qBAAqB,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,GAAG,qBAAqB,gBAAgB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,KAAK,GAAG,QAAiC,CAAC;IAEhD,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,+CAA+C,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6B,EAC7B,UAAgG,EAAE;IAElG,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,2BAA2B,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,MAAM,CAAC,EAAE,2CAA2C,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/G,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB;gBACvC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC;gBAClD,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;iBAAM,IAAI,QAAQ,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,MAAM,CAAC,EAAE,kCAAkC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IACvF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC;AAChE,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/deal-package.d.ts

@@ -0,0 +1,82 @@
+import { type UWEdgeLayer, type ProtocolError } from './protocol.js';
+export declare const UW_PACKAGE_VERSION: "1.0";
+export declare const UW_PACKAGE_ZIP_CODEC: "uw-deal-package-zip";
+export declare const UW_PACKAGE_ZIP_MEDIA_TYPE: "application/vnd.uwmd.deal-package+zip";
+export declare const UW_PACKAGE_CONTEXT_CODEC: "uw-deal-package-context";
+export declare const UW_PACKAGE_CONTEXT_MEDIA_TYPE: "application/vnd.uwmd.deal-package-context+json";
+/** Roles a member may play. `source_evidence` is never inlined into a context view. */
+export type UWMemberRole = 'underwriting' | 'lease_abstract' | 'source_note' | 'source_evidence' | 'model_encoding';
+export interface UWPackageMember {
+    id: string;
+    path: string;
+    role: UWMemberRole;
+    media_type: string;
+    /** Byte digest. This — not any reference handle — is the member's identity. */
+    sha256: string;
+    /** Present for UW documents whose representation the producer could canonicalize. */
+    semantic_digest?: string;
+    document_profile?: string;
+    [key: string]: unknown;
+}
+export interface UWPackageLink {
+    type: string;
+    from: string;
+    to: string;
+    [key: string]: unknown;
+}
+export interface UWDealPackageManifest {
+    package_version: typeof UW_PACKAGE_VERSION;
+    package_id: string;
+    members: UWPackageMember[];
+    links: UWPackageLink[];
+    [key: string]: unknown;
+}
+/** A typed, namespaced descriptor. A handle says where bytes *might* be found. */
+export interface UWSourceReference {
+    scheme: string;
+    /** The namespace that minted the handle. A foreign authority is unresolvable. */
+    authority?: string;
+    value: string;
+    [key: string]: unknown;
+}
+export interface UWEntityEdge {
+    type: string;
+    from: string;
+    to: string;
+    provenance: Array<{
+        source: string;
+        locator?: string;
+        note?: string;
+    }>;
+}
+export declare class UWPackageError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Roles whose bytes may be inlined into a JSON context view (RFC 0018 §4). */
+export declare const CONTEXT_INLINABLE_ROLES: readonly UWMemberRole[];
+/**
+ * Paths MUST be relative POSIX paths with no traversal components and MUST
+ * resolve to exactly one non-symlink entry. Rejected here as well as at
+ * extraction time, so a malformed manifest fails before any archive is opened.
+ */
+export declare function isSafeMemberPath(path: string): boolean;
+export declare function validateUWDealPackageManifest(candidate: unknown): ProtocolError[];
+export declare function assertUWDealPackageManifest(candidate: unknown): UWDealPackageManifest;
+/**
+ * Project member-layer links into entity-layer edges (RFC 0018 §5).
+ *
+ * Projection is **one-directional and explicit**. Within a package the manifest
+ * *is* the provenance, because every member is content-addressed — so on the
+ * way up we synthesize a provenance entry naming the package and the member ids
+ * it came from. No edge reaches the entity layer without attributable
+ * provenance, and no package is forced to duplicate what its digests prove.
+ *
+ * There is deliberately no inverse. An entity edge must never be projected down
+ * into a package, or a package would stop being a self-contained artifact and
+ * become a partial view of somebody's portfolio graph.
+ */
+export declare function projectPackageLinksToEntityEdges(manifest: UWDealPackageManifest): UWEntityEdge[];
+/** Types valid on a given layer — used by hosts building UI or validators. */
+export declare function edgeTypesForLayer(layer: UWEdgeLayer): string[];
+//# sourceMappingURL=deal-package.d.ts.map

package/dist/deal-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deal-package.d.ts","sourceRoot":"","sources":["../src/deal-package.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,KAAK,WAAW,EAGhB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AAEvB,eAAO,MAAM,kBAAkB,EAAG,KAAc,CAAC;AACjD,eAAO,MAAM,oBAAoB,EAAG,qBAA8B,CAAC;AACnE,eAAO,MAAM,yBAAyB,EAAG,uCAAgD,CAAC;AAC1F,eAAO,MAAM,wBAAwB,EAAG,yBAAkC,CAAC;AAC3E,eAAO,MAAM,6BAA6B,EACxC,gDAAyD,CAAC;AAE5D,uFAAuF;AACvF,MAAM,MAAM,YAAY,GACpB,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,iBAAiB,GACjB,gBAAgB,CAAC;AAErB,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,OAAO,kBAAkB,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAYD,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,EAAE,SAAS,YAAY,EAKzD,CAAC;AAUH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAItD;AAED,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,OAAO,GAAG,aAAa,EAAE,CA2FjF;AAED,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,OAAO,GAAG,qBAAqB,CAMrF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,qBAAqB,GAC9B,YAAY,EAAE,CAsBhB;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,CAE9D"}

package/dist/deal-package.js

@@ -0,0 +1,189 @@
+// UW Deal Package 1.0 — manifest model, validation, and link projection.
+//
+// RFC 0018 §3–§5. A package has one manifest and zero or more member payloads.
+// The manifest is the authoritative inventory: ZIP entry order and timestamps
+// are not semantic, and every member is content-addressed by digest.
+//
+// This module is browser-safe and performs no I/O of any kind. Resolving a
+// reference handle is an explicit host action that happens elsewhere; nothing
+// here may reach the network, and validation never writes to disk.
+import { BUILTIN_EDGE_TYPES, isEdgeTypeValidOnLayer, lookupEdgeType, } from './protocol.js';
+export const UW_PACKAGE_VERSION = '1.0';
+export const UW_PACKAGE_ZIP_CODEC = 'uw-deal-package-zip';
+export const UW_PACKAGE_ZIP_MEDIA_TYPE = 'application/vnd.uwmd.deal-package+zip';
+export const UW_PACKAGE_CONTEXT_CODEC = 'uw-deal-package-context';
+export const UW_PACKAGE_CONTEXT_MEDIA_TYPE = 'application/vnd.uwmd.deal-package-context+json';
+export class UWPackageError extends Error {
+    code;
+    constructor(code, message) {
+        super(`[${code}] ${message}`);
+        this.name = 'UWPackageError';
+        this.code = code;
+    }
+}
+const SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const MEMBER_ROLES = [
+    'underwriting',
+    'lease_abstract',
+    'source_note',
+    'source_evidence',
+    'model_encoding',
+];
+/** Roles whose bytes may be inlined into a JSON context view (RFC 0018 §4). */
+export const CONTEXT_INLINABLE_ROLES = Object.freeze([
+    'underwriting',
+    'lease_abstract',
+    'source_note',
+    'model_encoding',
+]);
+function packageError(code, message, pointer) {
+    return { category: 'package', code, message, ...(pointer ? { pointer } : {}) };
+}
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/**
+ * Paths MUST be relative POSIX paths with no traversal components and MUST
+ * resolve to exactly one non-symlink entry. Rejected here as well as at
+ * extraction time, so a malformed manifest fails before any archive is opened.
+ */
+export function isSafeMemberPath(path) {
+    if (!path || path.includes('\\') || path.includes('\0'))
+        return false;
+    if (path.startsWith('/') || /^[A-Za-z]:/.test(path))
+        return false;
+    return !path.split('/').some((part) => part === '' || part === '.' || part === '..');
+}
+export function validateUWDealPackageManifest(candidate) {
+    const errors = [];
+    if (!isRecord(candidate)) {
+        return [packageError('PKG-001', 'Package manifest must be an object.')];
+    }
+    const manifest = candidate;
+    if (manifest.package_version !== UW_PACKAGE_VERSION) {
+        errors.push(packageError('PKG-002', `Unsupported package_version; expected ${UW_PACKAGE_VERSION}.`, 'package_version'));
+    }
+    if (typeof manifest.package_id !== 'string' || manifest.package_id.length === 0) {
+        errors.push(packageError('PKG-003', 'package_id is required.', 'package_id'));
+    }
+    if (!Array.isArray(manifest.members)) {
+        errors.push(packageError('PKG-004', 'members must be an array.', 'members'));
+        return errors;
+    }
+    if (manifest.links !== undefined && !Array.isArray(manifest.links)) {
+        errors.push(packageError('PKG-005', 'links must be an array.', 'links'));
+    }
+    const seenIds = new Set();
+    const seenPaths = new Set();
+    for (const [idx, member] of manifest.members.entries()) {
+        const at = `members[${idx}]`;
+        if (!isRecord(member)) {
+            errors.push(packageError('PKG-006', 'Member must be an object.', at));
+            continue;
+        }
+        for (const key of ['id', 'path', 'media_type']) {
+            if (typeof member[key] !== 'string' || member[key].length === 0) {
+                errors.push(packageError('PKG-007', `Member ${key} is required.`, `${at}.${key}`));
+            }
+        }
+        if (typeof member.id === 'string') {
+            if (seenIds.has(member.id)) {
+                errors.push(packageError('PKG-008', `Duplicate member id: ${member.id}`, `${at}.id`));
+            }
+            seenIds.add(member.id);
+        }
+        if (typeof member.path === 'string') {
+            if (!isSafeMemberPath(member.path)) {
+                errors.push(packageError('PKG-009', `Unsafe member path: ${member.path}`, `${at}.path`));
+            }
+            if (seenPaths.has(member.path)) {
+                errors.push(packageError('PKG-010', `Duplicate member path: ${member.path}`, `${at}.path`));
+            }
+            seenPaths.add(member.path);
+        }
+        if (!MEMBER_ROLES.includes(member.role)) {
+            errors.push(packageError('PKG-011', `Unknown member role: ${String(member.role)}`, `${at}.role`));
+        }
+        if (typeof member.sha256 !== 'string' || !SHA256_PATTERN.test(member.sha256)) {
+            errors.push(packageError('PKG-012', 'Member sha256 must be `sha256:<64 lowercase hex>`.', `${at}.sha256`));
+        }
+        if (member.semantic_digest !== undefined && !SHA256_PATTERN.test(String(member.semantic_digest))) {
+            errors.push(packageError('PKG-013', 'semantic_digest must be `sha256:<64 lowercase hex>`.', `${at}.semantic_digest`));
+        }
+    }
+    for (const [idx, link] of (manifest.links ?? []).entries()) {
+        const at = `links[${idx}]`;
+        if (!isRecord(link)) {
+            errors.push(packageError('PKG-014', 'Link must be an object.', at));
+            continue;
+        }
+        for (const key of ['type', 'from', 'to']) {
+            if (typeof link[key] !== 'string' || link[key].length === 0) {
+                errors.push(packageError('PKG-015', `Link ${key} is required.`, `${at}.${key}`));
+            }
+        }
+        // Dangling endpoints are the failure that makes a link graph lie, so they
+        // are rejected rather than dropped.
+        for (const end of ['from', 'to']) {
+            const id = link[end];
+            if (typeof id === 'string' && !seenIds.has(id)) {
+                errors.push(packageError('PKG-016', `Link ${end} does not resolve to a member: ${id}`, `${at}.${end}`));
+            }
+        }
+        // An unknown type is preserved; a *known* type used on the wrong layer is
+        // an error, because that is a claim the registry says cannot be true.
+        if (typeof link.type === 'string' && !isEdgeTypeValidOnLayer(link.type, 'member')) {
+            errors.push(packageError('PKG-017', `Edge type ${link.type} is not valid on the member layer.`, `${at}.type`));
+        }
+    }
+    return errors;
+}
+export function assertUWDealPackageManifest(candidate) {
+    const errors = validateUWDealPackageManifest(candidate);
+    if (errors.length > 0) {
+        throw new UWPackageError(errors[0].code, errors.map((e) => e.message).join('; '));
+    }
+    return candidate;
+}
+/**
+ * Project member-layer links into entity-layer edges (RFC 0018 §5).
+ *
+ * Projection is **one-directional and explicit**. Within a package the manifest
+ * *is* the provenance, because every member is content-addressed — so on the
+ * way up we synthesize a provenance entry naming the package and the member ids
+ * it came from. No edge reaches the entity layer without attributable
+ * provenance, and no package is forced to duplicate what its digests prove.
+ *
+ * There is deliberately no inverse. An entity edge must never be projected down
+ * into a package, or a package would stop being a self-contained artifact and
+ * become a partial view of somebody's portfolio graph.
+ */
+export function projectPackageLinksToEntityEdges(manifest) {
+    const edges = [];
+    for (const link of manifest.links ?? []) {
+        const def = lookupEdgeType(link.type);
+        // Only types the registry declares valid on the entity layer project up.
+        // Member-only types (`abstracts`, `contributes_to`) describe documents and
+        // have no entity-layer meaning.
+        if (!def || !def.layers.includes('entity'))
+            continue;
+        edges.push({
+            type: link.type,
+            from: link.from,
+            to: link.to,
+            provenance: [
+                {
+                    source: manifest.package_id,
+                    locator: `${link.from} → ${link.to}`,
+                    note: `Projected from UW Deal Package member link (${link.type}).`,
+                },
+            ],
+        });
+    }
+    return edges;
+}
+/** Types valid on a given layer — used by hosts building UI or validators. */
+export function edgeTypesForLayer(layer) {
+    return BUILTIN_EDGE_TYPES.filter((d) => d.layers.includes(layer)).map((d) => d.type);
+}
+//# sourceMappingURL=deal-package.js.map

package/dist/deal-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deal-package.js","sourceRoot":"","sources":["../src/deal-package.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,mEAAmE;AAEnE,OAAO,EACL,kBAAkB,EAElB,sBAAsB,EACtB,cAAc,GAEf,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAc,CAAC;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAA8B,CAAC;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,uCAAgD,CAAC;AAC1F,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAkC,CAAC;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GACxC,gDAAyD,CAAC;AAsD5D,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAE/C,MAAM,YAAY,GAA4B;IAC5C,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,gBAAgB;CACjB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC5E,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,IAAY,EAAE,OAAe,EAAE,OAAgB;IACnE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,SAAkB;IAC9D,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,SAAkC,CAAC;IAEpD,IAAI,QAAQ,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,yCAAyC,kBAAkB,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,2BAA2B,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,WAAW,GAAG,GAAG,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAU,EAAE,CAAC;YACxD,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,MAAM,CAAC,GAAG,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5E,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,GAAG,eAAe,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,wBAAwB,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,uBAAuB,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,0BAA0B,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9F,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAoB,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,wBAAwB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,oDAAoD,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,sDAAsD,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAG,SAAS,GAAG,GAAG,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,EAAE,CAAC;YAClD,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,IAAI,CAAC,GAAG,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,GAAG,eAAe,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,oCAAoC;QACpC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAU,EAAE,CAAC;YAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,GAAG,kCAAkC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC,YAAY,CACtB,SAAS,EACT,aAAa,IAAI,CAAC,IAAI,oCAAoC,EAC1D,GAAG,EAAE,OAAO,CACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAkB;IAC5D,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,SAAkC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAA+B;IAE/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,yEAAyE;QACzE,2EAA2E;QAC3E,gCAAgC;QAChC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACrD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,UAAU,EAAE;gBACV;oBACE,MAAM,EAAE,QAAQ,CAAC,UAAU;oBAC3B,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,EAAE;oBACpC,IAAI,EAAE,+CAA+C,IAAI,CAAC,IAAI,IAAI;iBACnE;aACF;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,KAAkB;IAClD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC"}