@wasm-oj/organizer 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 JacobLinCool
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,5 @@
+# `@wasm-oj/organizer`
+
+Schemas and publication utilities for problem collections, contest projections, and immutable
+judge packages. The Organizer boundary validates schema, paths, size, digest, and deployability; it
+does not compile, run, score, or assess a reference solution.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,302 @@
+# Third-party notices
+
+This file covers third-party software distributed by the WASM-OJ code and
+toolchain packages, including the content-addressed compiler and runtime assets
+mirrored under `public/toolchains`. The WASM-OJ source code is licensed under the MIT License in
+`LICENSE`; that license does not replace the terms of any component listed
+below.
+
+The canonical machine-readable component, distribution, source-revision, and
+license-file inventory is `licenses/components.json`. Its verifier binds every
+listed file to a SHA-256 digest and rejects unlisted toolchain or license files.
+
+## JavaScript runtime dependency
+
+### N-API keyring
+
+- Component: `@napi-rs/keyring` 1.3.0
+- Source revision: `Brooooooklyn/keyring-node@e46be75c3ba8d5fde6b88a17c6153b87ffe4b946`
+- Source: <https://github.com/Brooooooklyn/keyring-node/tree/e46be75c3ba8d5fde6b88a17c6153b87ffe4b946>
+- License: MIT
+- License material: `licenses/napi-rs-keyring-MIT.txt`
+
+The `woj` CLI stores remote access tokens in the operating system credential
+store through this native binding. It does not provide a plaintext fallback.
+
+### es-module-lexer
+
+- Component: `es-module-lexer` 2.3.1
+- npm integrity: `sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==`
+- Source revision: `guybedford/es-module-lexer@2b2e6209bac5c06c6ba457f9730014613e1128fb`
+- Source: <https://github.com/guybedford/es-module-lexer/tree/2b2e6209bac5c06c6ba457f9730014613e1128fb>
+- License: MIT
+- License material: `licenses/es-module-lexer-MIT.txt`
+
+WASM-OJ uses es-module-lexer inside the browser runner Worker to reject every
+static or dynamic transitive import before loading a content-pinned runtime
+driver plug-in.
+
+### fflate
+
+- Component: `fflate` 0.8.3
+- Source revision: `101arrowz/fflate@v0.8.3`
+- Source: <https://github.com/101arrowz/fflate/tree/v0.8.3>
+- License: MIT
+- License material: `licenses/fflate-MIT.txt`
+
+WASM-OJ uses fflate for bounded dependency archive extraction and to verify the
+canonical Go module `h1:` hash over module ZIP entries.
+
+### Wasmer JavaScript SDK
+
+- Component: `@wasmer/sdk` 0.10.0
+- npm integrity: `sha512-YQ+s5tGag6P/I8kp9BTH+XhjoS9UFvWiZJvnWEEovClHffhYToKhprWr4UJG7wLP7c/2HQpGkF7ZrjoUvKjdmA==`
+- Source revision: `wasmerio/wasmer-js@93b8b738ebd3ee57e118da0f0eb795b97d5b999e`
+- Locked Rust graph: `Cargo.lock` SHA-256
+  `d352926f3f05e3d4308c4e261711d07db568e5c2b4387067180f920da074791f`
+- Source: <https://github.com/wasmerio/wasmer-js/tree/93b8b738ebd3ee57e118da0f0eb795b97d5b999e>
+- License: MIT
+- License material: `licenses/wasmer-sdk-MIT.txt`,
+  `licenses/wasmer-sdk-dependencies.html`, and
+  `licenses/wasmer-sdk-dependencies.json`
+
+WASM-OJ consumes the official npm artifact without patching the installed
+package. The generated dependency report covers every package in the pinned
+normal Cargo dependency graph selected for `wasm32-unknown-unknown`; its compact
+inventory binds all 332 package identities and the exact HTML report digest.
+
+## Distributed toolchain assets
+
+### TypeScript-Go
+
+- Distributed asset: `typescript-7.0.2.wasm.gz.bin`
+- Compressed SHA-256: `06e58ce887d95d1895055699b8dc96a1cde7d1f2baa48de40f9b790e3271dc16`
+- Expanded Wasm SHA-256: `27c931087b3b0cc48804f3749b07eb710538c4ab175969db8a8ff680e6ec4fde`
+- Source revision: `microsoft/typescript-go@2bd066d87f5bafd315be9f40889d0a60b9e58e0b`
+- Source: <https://github.com/microsoft/typescript-go/tree/2bd066d87f5bafd315be9f40889d0a60b9e58e0b>
+- Build runtime: Go 1.26.3 standard library (`GOOS=wasip1`, `GOARCH=wasm`)
+- Licenses: TypeScript-Go Apache-2.0; Go standard library BSD-3-Clause
+- License and attribution material: `licenses/Apache-2.0.txt`,
+  `licenses/typescript-go-NOTICE.txt`, and
+  `licenses/go-BSD-3-Clause.txt`
+
+The TypeScript-Go notice is carried from the exact pinned source revision
+(normalized from CRLF to LF without changing its text). The Go license is from
+the exact `go1.26.3` source tag used by the reproducible build script.
+
+### Go compiler toolchain
+
+- Distributed assets: `go-1.26.5-wasip1.webc.gz.bin`,
+  `go-1.26.5-wasip1.stdlib.gz.bin`, and
+  `go-1.26.5-wasip1.manifest.json`
+- Source: <https://go.dev/dl/go1.26.5.src.tar.gz>
+- Source archive SHA-256:
+  `495be4bc87176ac567392e5b4116abd98466d33d7b49d41e764ccc6976b2dc42`
+- License: BSD-3-Clause
+- License material: `licenses/go-BSD-3-Clause.txt`
+
+WASM-OJ packages the standard Go `compile` and `link` commands plus the matching
+349-package `GOOS=wasip1 GOARCH=wasm` standard library. The stored license is
+byte-identical to `go/LICENSE` in the exact Go 1.26.5 source distribution.
+
+### Java compiler toolchain
+
+- Distributed assets: `java-teavm-0.13.1.wasi.compiler.webc.gz.bin`,
+  `java-teavm-0.13.1.compile-classlib.bin`, and
+  `java-teavm-0.13.1.runtime-classlib.bin`
+- TeaVM Java compiler source: <https://github.com/konsoletyper/teavm-javac/tree/7e4a44cf521694a4e326e33850dd8aec165eb5c9>
+- TeaVM core source: `konsoletyper/teavm@b3a245b7d9034ff35cdfab2def057a3d4f256efb`
+  plus the pinned WASI compiler and math-intrinsic patch
+- Compiler package compressed SHA-256:
+  `129f1f51d591e58954f88787d36396b856a9a68ba3ae9c9d14f20bd67c2c7722`
+- Compiler package expanded SHA-256:
+  `f8f86761cf31062565187e4a66f73b6903f257fe84c0ce70ea1cd28441b6c2e9`
+- Licenses: TeaVM Apache-2.0; OpenJDK class library GPL-2.0 with Classpath
+  Exception
+- License material: `licenses/Apache-2.0.txt` and
+  `licenses/openjdk-21-GPL-2.0-with-Classpath-exception.txt`
+
+The compiler emits standalone `wasip1` modules. The class-library archives are
+mounted only during compilation and are not included in submitted artifacts.
+
+### QuickJS-ng
+
+- Distributed asset: `quickjs-0.15.1.wasm.gz.bin`
+- Compressed SHA-256: `8c7f0588210490e7d77f198fc91f72c1b94787ab4c359c4786ca59a363c4f5e8`
+- Expanded Wasm SHA-256: `956bf2b3700690e1817034eb8e063cfd9781c66b4bffa244ef4f9445656ccfa1`
+- Source revision: `quickjs-ng/quickjs@fd0a0210b7be00957751871e7e01b8291268fc29`
+- Source: <https://github.com/quickjs-ng/quickjs/tree/fd0a0210b7be00957751871e7e01b8291268fc29>
+- Build SDK: [WASI SDK 24.0 release archive for arm64 macOS](https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-24/wasi-sdk-24.0-arm64-macos.tar.gz),
+  SHA-256 `aeae999396d5f5caa5ce419f52e83c35869d5fd21d40af80acba2c80f51b0b3a`
+- WASI SDK source revision: `WebAssembly/wasi-sdk@d2bea01edcc46f731156a817f710cdd9fc9c1c19`
+- LLVM and compiler-rt source revision: `llvm/llvm-project@26a1d6601d727a96f4301d0d8647b5a42760ae0c`
+- WASI libc source revision: `WebAssembly/wasi-libc@b9ef79d7dbd47c6c5bafdae760823467c2f60b70`
+- Sources: <https://github.com/WebAssembly/wasi-sdk/tree/d2bea01edcc46f731156a817f710cdd9fc9c1c19>,
+  <https://github.com/llvm/llvm-project/tree/26a1d6601d727a96f4301d0d8647b5a42760ae0c>, and
+  <https://github.com/WebAssembly/wasi-libc/tree/b9ef79d7dbd47c6c5bafdae760823467c2f60b70>
+- Licenses: QuickJS-ng and the WASM-OJ adapter MIT; LLVM compiler-rt
+  Apache-2.0 WITH LLVM-exception plus the third-party terms collected in its
+  license; WASI libc Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT, with
+  separately licensed dlmalloc, cloudlibc-derived, and musl-derived portions
+- License and attribution material: `licenses/quickjs-ng-MIT.txt`,
+  `licenses/wasi-sdk-24.0-Apache-2.0-LLVM-exception.txt`,
+  `licenses/wasi-sdk-24.0-compiler-rt-LICENSE.txt`,
+  `licenses/wasi-libc-b9ef79d-LICENSE.txt`,
+  `licenses/wasi-libc-b9ef79d-Apache-2.0.txt`,
+  `licenses/wasi-libc-b9ef79d-MIT.txt`,
+  `licenses/wasi-libc-b9ef79d-cloudlibc-BSD-2-Clause.txt`,
+  `licenses/wasi-libc-b9ef79d-dlmalloc-CC0-NOTICE.txt`, and
+  `licenses/wasi-libc-b9ef79d-emmalloc-NOTICE.txt`, and
+  `licenses/wasi-libc-b9ef79d-musl-MIT.txt`
+
+The reproducible build links `crt1-command.o`, `libm.a`,
+`libwasi-emulated-signal.a`, `libc.a`, and
+`libclang_rt.builtins-wasm32.a` from that one digest-verified SDK archive.
+Linker tracing confirms that the selected allocator is dlmalloc, not emmalloc.
+WASM-OJ distributes the resulting stripped Wasm runtime, not the host Clang, LLD,
+or strip executables. The build script nevertheless verifies those executables
+and every linked archive by SHA-256 before compiling.
+
+### Rust compiler and standard libraries
+
+- Distributed assets: `rust-1.91.1-dev.webc.gz.bin` and
+  `rust-1.91.1-dev.manifest.json`
+- Build source: `olimpiadi-informatica/wasm-compilers@ae62cab6adf0665377d19ffa39daeaf758290431`
+- Build artifact: GitHub Actions run `26545267884`, `rust.tar.br` SHA-256
+  `ba0096d05275954d852a3fb3a9c4c9438dad501f8e428b867c0b88cfa7301c14`
+- Linker payload: `@yowasp/clang@22.0.0-git20542-10`, npm archive SHA-256
+  `6230ea1afa9691fa065935cf68c01642ff9b31c183fe8ac64cdfda025df06009`;
+  its exact source revisions and license closure are recorded in the following
+  “Clang, LLD, libc++, and WASI libc” section
+- Rust source submodule: `rust-lang/rust@ed61e7d7e242494fb7057f2657300d9e77bb4fcb`
+- LLVM source submodule: `llvm/llvm-project@87f0227cb60147a26a1eeb4fb06e3b505e9c7261`
+- GCC source submodule: `gcc-mirror/gcc@ae91b5dd14920ff9671db8ff80c0d763d25f977f`
+- Source: <https://github.com/olimpiadi-informatica/wasm-compilers/tree/ae62cab6adf0665377d19ffa39daeaf758290431>
+- Build repository license: Apache-2.0
+- Rust license: MIT OR Apache-2.0; LLVM license: Apache-2.0 WITH LLVM-exception
+- `libloading` 0.8.8: ISC; Cargo.lock checksum
+  `07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667`
+- GCC libstdc++ runtime components: GPL-3.0 with GCC Runtime Library
+  Exception 3.1
+- License and attribution texts: `licenses/rust-MIT.txt`,
+  `licenses/Apache-2.0.txt`, `licenses/LLVM-exception.txt`,
+  `licenses/rust-COPYRIGHT.txt`, `licenses/rust-COPYRIGHT.html`,
+  `licenses/rust-COPYRIGHT-library.html`, `licenses/libloading-ISC.txt`,
+  `licenses/GPL-3.0.txt`, and
+  `licenses/GCC-Runtime-Library-Exception-3.1.txt`
+
+The pinned build repository contains its complete Rust/LLVM source revisions,
+the applied `rust.patch`, and the GitHub workflow used for the pinned artifact.
+That workflow builds libstdc++ from the pinned GCC submodule before building
+LLVM and rustc. The custom `rust.tar.br` omits Rust's generated binary-release
+notices, so WASM-OJ carries the complete `COPYRIGHT.html` and
+`COPYRIGHT-library.html` from the official Rust 1.91.1 release for the exact
+`ed61e7d7e` source revision. The official release archive used to source those
+notices is `rustc-1.91.1-x86_64-unknown-linux-gnu.tar.xz`, SHA-256
+`4b4c596fc5268435c310a79c2e231a5a3567572c930ac0740ef9e147e83baf4e`.
+
+WASM-OJ copies the matching `wasm32-wasip1-threads` sysroot, replaces rustc's
+WASI `random_get` and `clock_time_get` imports with deterministic internal
+implementations, and packages the transformed atom and sysroot together with
+the verified YoWASP LLVM linker atom and resources into one WebC. The provenance
+manifest records source-rustc, transformed-rustc, linker archive, linker core,
+and linker-resource SHA-256 digests. These transformations and the generated
+WebC do not relicense Rust or any third-party component identified by the exact
+Rust COPYRIGHT reports and YoWASP source closure carried here.
+
+### Clang, LLD, libc++, PCH, and WASI libc
+
+- Distributed assets: `clang-22.0.0-git20542-10.webc.gz.bin`, the matching
+  debug/release libc++ PCH payloads, and their admission manifest
+- Clang source artifact: `@yowasp/clang@22.0.0-git20542-10`, npm archive
+  SHA-256 `6230ea1afa9691fa065935cf68c01642ff9b31c183fe8ac64cdfda025df06009`
+- YoWASP source revision: `YoWASP/clang@944dd7c774954180e621cc8e12984023a7f8bcbe`
+- LLVM source revision: `YoWASP/llvm-project@97196c8eeb1d495fa43bb8af2fb26af5ef5b89fb`
+- WASI libc source revision: `WebAssembly/wasi-libc@ac020b86fd44bafe60aa4fa12f407d16e3731329`
+- Sources: <https://github.com/YoWASP/clang/tree/944dd7c774954180e621cc8e12984023a7f8bcbe>
+  and <https://github.com/YoWASP/llvm-project/tree/97196c8eeb1d495fa43bb8af2fb26af5ef5b89fb>
+- LLVM license: Apache-2.0 WITH LLVM-exception
+- WASI libc license: Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,
+  with separately licensed portions identified by the upstream notice
+- License and attribution texts: `licenses/LLVM-exception.txt`,
+  `licenses/Apache-2.0.txt`, `licenses/wasi-libc-ac020b86-LICENSE.txt`,
+  `licenses/wasi-libc-ac020b86-musl-fts-BSD-3-Clause.txt`,
+  `licenses/wasi-sdk-24.0-Apache-2.0-LLVM-exception.txt`,
+  `licenses/wasi-libc-b9ef79d-Apache-2.0.txt`,
+  `licenses/wasi-libc-b9ef79d-MIT.txt`,
+  `licenses/wasi-libc-b9ef79d-cloudlibc-BSD-2-Clause.txt`,
+  `licenses/wasi-libc-b9ef79d-dlmalloc-CC0-NOTICE.txt`,
+  `licenses/wasi-libc-b9ef79d-emmalloc-NOTICE.txt`, and
+  `licenses/wasi-libc-b9ef79d-musl-MIT.txt`
+
+The published npm manifest incorrectly says `ISC` and omits a license file.
+The exact source revision's root `LICENSE.txt` and npm README both explicitly
+license the package under Apache-2.0. WASM-OJ does not redistribute the npm
+JavaScript wrapper: the packaging script digest-verifies and extracts only the
+LLVM core and LLVM/WASI resource payload, whose complete upstream license terms
+are carried above. The common Apache, MIT, cloudlibc, dlmalloc, emmalloc, and
+musl terms are byte-identical between the pinned `ac020b86` and `b9ef79d7`
+source trees, so the inventory reuses the exact digest-bound `b9ef79d7` copies;
+the revision-specific root and musl-fts notices remain separate. The generated
+WebC and pinned command manifests do not relicense those payloads.
+
+### CPython 3.14.6 for WASI P1
+
+- Distributed assets: `python-3.14.6-wasip1.webc.gz.bin` and its provenance
+  manifest `python-3.14.6-wasip1.manifest.json`
+- Official source archive: <https://www.python.org/ftp/python/3.14.6/Python-3.14.6.tar.xz>,
+  SHA-256 `143b1dddefaec3bd2e21e3b839b34a2b7fb9842272883c576420d605e9f30c63`
+- Official SPDX document: <https://www.python.org/ftp/python/3.14.6/Python-3.14.6.tar.xz.spdx.json>,
+  SHA-256 `1f5d394856783fa77e1f1db280f84eabf693bffc1fb06a747f7116de9f99f3bd`
+- Expanded WebC SHA-256:
+  `454ffc53936aa13a0d7f4afbb5bd50ada339c8ebd04bbf27ea19e4104cf43207`
+- Distributed gzip SHA-256:
+  `218cd20ac4abb443e0700816010a615a345a43eae623a0232da2227135a6c7a6`
+- Provenance manifest SHA-256:
+  `054eccad04a7cee7ba1661062142ef0d639976850981eab8fc785f48eb26129e`
+- Deterministically exported `WOJFS002` runtime archive SHA-256:
+  `44d894f91487f20c2bb04fe496a9343db37d8720fb706472c2b4a7f3300db039`
+- CPython license: Python Software Foundation License Version 2 and the
+  historical notices reproduced with it
+- License text: `licenses/cpython-3.14.6-PSF-2.0.txt`
+- Bundled third-party source: Expat 2.8.1 (MIT), HACL* revision
+  `8ba599b2f6c9701b3dc961db895b0856a2210f76` (MIT), and libmpdec 2.5.1
+  (BSD-2-Clause); their exact notices are
+  `licenses/cpython-expat-2.8.1-MIT.txt`,
+  `licenses/cpython-hacl-star-8ba599b-MIT.txt`, and
+  `licenses/cpython-libmpdec-2.5.1-BSD-2-Clause.txt`.
+- Build toolchain: WASI SDK 24.0 revision
+  `d2bea01edcc46f731156a817f710cdd9fc9c1c19`, LLVM revision
+  `26a1d6601d727a96f4301d0d8647b5a42760ae0c`, and wasi-libc revision
+  `b9ef79d7dbd47c6c5bafdae760823467c2f60b70`.
+
+WASM-OJ compiles this package from the pinned official sources, disables
+`_socket`, removes test/development-only standard-library roots, canonicalizes
+build-only sysconfig paths, and packages the complete source SPDX document and
+applicable CPython, third-party, compiler-rt, WASI SDK, and wasi-libc notices
+inside the WebC. The build does not consume or redistribute the retired Wasmer
+Registry CPython/WASIX package, and WASM-OJ's MIT license does not apply to these
+third-party contents.
+
+## WASM-OJ runtime-core dependency closure
+
+The browser runner embeds `wasm-oj-runtime-core` and its locked normal
+dependency graph for the `wasm32-unknown-unknown` target with the `web` feature.
+The complete generated license report, including the selected license text for
+every dependency, is `licenses/runtime-core-dependencies.html`. Its compact,
+machine-verifiable package inventory and report digest are recorded in
+`licenses/runtime-core-dependencies.json`. Both files are generated with pinned
+`cargo-about` 0.9.1 and are verified against `crates/runtime-core/Cargo.lock`.
+
+## Vendored Rust crates
+
+WASM-OJ's source tree also contains patched source copies used to build the
+runtime and packaging tools:
+
+- `vendor/shared-buffer`: MIT OR Apache-2.0; see
+  `vendor/shared-buffer/LICENSE_MIT.md` and
+  `vendor/shared-buffer/LICENSE_APACHE.md`.
+- `vendor/virtual-fs`: MIT; see `vendor/virtual-fs/LICENSE`.
+
+These vendored sources are build inputs and are not included in the npm package
+allowlist.

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { BROWSER_COLLECTION_SCHEMA, BROWSER_PROBLEM_SCHEMA, MANAGED_COLLECTION_SCHEMA, parseManagedCollectionContract, parseManagedCollectionSource, parseManagedCollectionV2, parseManagedCollectionValueV2, parseProblemCollectionIndex, parseStandaloneProblemBundle, problemCollectionRevision, verifyProblemBundleBytes, verifyProblemCollectionRevision } from '@wasm-oj/core';
+
+declare function runCollectionCli(arguments_: readonly string[]): Promise<void>;
+
+export { runCollectionCli };

package/dist/index.js

@@ -0,0 +1,546 @@
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import os from "node:os";
+import { BROWSER_COLLECTION_SCHEMA, BROWSER_COLLECTION_SCHEMA as BROWSER_COLLECTION_SCHEMA$1, BROWSER_PROBLEM_SCHEMA, BROWSER_PROBLEM_SCHEMA as BROWSER_PROBLEM_SCHEMA$1, MANAGED_COLLECTION_SCHEMA, MANAGED_COLLECTION_SCHEMA as MANAGED_COLLECTION_SCHEMA$1, assertJudgeDataMatchesPracticePublic, canonicalJsonBytes, contestPublicProjectionBytes, deriveJudgeData, derivePracticePublic, encodeJudgePackage, parseManagedCollectionContract, parseManagedCollectionSource, parseManagedCollectionSource as parseManagedCollectionSource$1, parseManagedCollectionV2, parseManagedCollectionV2 as parseManagedCollectionV2$1, parseManagedCollectionValueV2, parseProblemCollectionIndex, parseProblemCollectionIndex as parseProblemCollectionIndex$1, parseStandaloneProblemBundle, parseStandaloneProblemBundle as parseStandaloneProblemBundle$1, problemCollectionRevision, problemCollectionRevision as problemCollectionRevision$1, validateJudgePackage, verifyProblemBundleBytes, verifyProblemBundleBytes as verifyProblemBundleBytes$1, verifyProblemCollectionRevision, verifyProblemCollectionRevision as verifyProblemCollectionRevision$1 } from "@wasm-oj/core";
+//#region src/path-safety.ts
+/** Resolve only the operating system's own temporary-directory alias. */
+async function canonicalizeSystemTemporaryPrefix(value) {
+	const absolute = path.resolve(value);
+	const temporary = path.resolve(os.tmpdir());
+	if (absolute !== temporary && !absolute.startsWith(`${temporary}${path.sep}`)) return absolute;
+	const canonicalTemporary = await realpath(temporary);
+	return path.join(canonicalTemporary, path.relative(temporary, absolute));
+}
+/** True only when the absolute path's existing components do not traverse links. */
+async function anchoredPathHasNoSymlink(value) {
+	const anchored = await canonicalizeSystemTemporaryPrefix(path.resolve(value));
+	const root = path.parse(anchored).root;
+	let current = root;
+	for (const segment of path.relative(root, anchored).split(path.sep).filter(Boolean)) {
+		current = path.join(current, segment);
+		try {
+			if ((await lstat(current)).isSymbolicLink()) return false;
+		} catch (error) {
+			if (error.code === "ENOENT") return true;
+			throw error;
+		}
+	}
+	return true;
+}
+//#endregion
+//#region src/collection-cli.ts
+var SOURCE_SCHEMA = "wasm-oj-browser-collection-source-v1";
+var DEFAULT_INDEX_PATH = "collection/index.json";
+var DEFAULT_SOURCE_PATH = "collection/source.json";
+var INDEX_MAX_BYTES = 524288;
+var COLLECTION_SOURCE_MAX_BYTES = 2097152;
+var STATEMENT_MAX_BYTES = 2097152;
+var PUBLIC_BUNDLE_MAX_BYTES = 8388608;
+var AUTHORING_BUNDLE_MAX_BYTES = 33554432;
+var MANAGED_MAX_BYTES = 2097152;
+var JUDGE_PACKAGE_MAX_BYTES = 33554432;
+function fail(message) {
+	throw new Error(message);
+}
+function normalizedRelativePath(value, label) {
+	if (typeof value !== "string" || !value || value.startsWith("/") || value.includes("\\") || value.includes("\0") || value.endsWith("/")) return fail(`${label} must be a normalized relative POSIX path.`);
+	if (value.split("/").some((segment) => !segment || segment === "." || segment === "..")) return fail(`${label} must be a normalized relative POSIX path.`);
+	return value;
+}
+function portableOutputPath(value, label) {
+	const relative = normalizedRelativePath(value, label);
+	if (relative.split("/").some((segment) => !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(segment))) return fail(`${label} must use only portable ASCII path segments.`);
+	return relative;
+}
+function resolveInside(root, relativeValue, label) {
+	const relative = normalizedRelativePath(relativeValue, label);
+	return path.join(root, ...relative.split("/"));
+}
+function collisionKey(value) {
+	return value.normalize("NFC").toLocaleLowerCase("en-US");
+}
+async function assertRepositoryRoot(root) {
+	const anchoredRoot = await canonicalizeSystemTemporaryPrefix(path.resolve(root));
+	if (!await anchoredPathHasNoSymlink(anchoredRoot)) fail("repository root must not traverse a symbolic link.");
+	const metadata = await lstat(anchoredRoot);
+	if (metadata.isSymbolicLink() || !metadata.isDirectory()) fail("repository root must be a real directory.");
+}
+async function readBoundedRepositoryFile(options, relativeValue, label, maximumBytes, expectedBytes) {
+	const file = resolveInside(options.root, relativeValue, label);
+	if (!await anchoredPathHasNoSymlink(file)) fail(`${label} must not traverse a symbolic link.`);
+	let handle;
+	try {
+		handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+	} catch (error) {
+		throw new Error(`${label} must be a readable regular file.`, { cause: error });
+	}
+	try {
+		const metadata = await handle.stat();
+		if (!metadata.isFile() || metadata.size > maximumBytes || expectedBytes !== void 0 && metadata.size !== expectedBytes) fail(`${label} is outside its allowed byte limit.`);
+		return new Uint8Array(await handle.readFile());
+	} finally {
+		await handle.close();
+	}
+}
+async function assertOutputPathSafe(options, relativeValue, label) {
+	const output = resolveInside(options.root, relativeValue, label);
+	if (!await anchoredPathHasNoSymlink(output)) fail(`${label} must not traverse a symbolic link.`);
+	let metadata;
+	try {
+		metadata = await lstat(output);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+	if (metadata.isSymbolicLink() || !metadata.isFile()) fail(`${label} must replace only a regular file.`);
+}
+async function existingPathIdentity(options, relativeValue, label) {
+	const file = resolveInside(options.root, relativeValue, label);
+	if (!await anchoredPathHasNoSymlink(file)) fail(`${label} must not traverse a symbolic link.`);
+	try {
+		const metadata = await lstat(file, { bigint: true });
+		if (metadata.isSymbolicLink()) fail(`${label} must not be a symbolic link.`);
+		return `${metadata.dev}:${metadata.ino}`;
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	}
+}
+async function assertNoFilesystemAliases(options, inputs, outputs) {
+	const inputIdentities = /* @__PURE__ */ new Map();
+	for (const input of inputs) {
+		const identity = await existingPathIdentity(options, input, `declared input '${input}'`);
+		if (identity !== void 0 && !inputIdentities.has(identity)) inputIdentities.set(identity, input);
+	}
+	const outputIdentities = /* @__PURE__ */ new Map();
+	for (const output of outputs) {
+		const identity = await existingPathIdentity(options, output, `generated output '${output}'`);
+		if (identity === void 0) continue;
+		const input = inputIdentities.get(identity);
+		if (input !== void 0) fail(`generated output '${output}' aliases declared input '${input}' on this filesystem.`);
+		const priorOutput = outputIdentities.get(identity);
+		if (priorOutput !== void 0) fail(`generated outputs '${priorOutput}' and '${output}' alias on this filesystem.`);
+		outputIdentities.set(identity, output);
+	}
+}
+async function ensureOutputParent(options, relativeValue) {
+	const relativeParent = path.posix.dirname(normalizedRelativePath(relativeValue, "output path"));
+	if (relativeParent === ".") return;
+	let current = options.root;
+	for (const segment of relativeParent.split("/")) {
+		current = path.join(current, segment);
+		try {
+			const metadata = await lstat(current);
+			if (metadata.isSymbolicLink() || !metadata.isDirectory()) fail(`output directory '${relativeParent}' must contain only real directories.`);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+			try {
+				await mkdir(current);
+			} catch (mkdirError) {
+				if (mkdirError.code !== "EEXIST") throw mkdirError;
+				const metadata = await lstat(current);
+				if (metadata.isSymbolicLink() || !metadata.isDirectory()) fail(`output directory '${relativeParent}' must contain only real directories.`);
+			}
+		}
+	}
+}
+async function atomicRepositoryWrite(options, relativeValue, bytes) {
+	const output = resolveInside(options.root, relativeValue, "output path");
+	await ensureOutputParent(options, relativeValue);
+	const temporary = `${output}.${process.pid}.${crypto.randomUUID()}.tmp`;
+	try {
+		await writeFile(temporary, bytes, {
+			flag: "wx",
+			mode: 420
+		});
+		await rename(temporary, output);
+	} finally {
+		await rm(temporary, { force: true });
+	}
+}
+function parseOptions(arguments_) {
+	const [commandValue, ...rest] = arguments_;
+	if (commandValue !== "build" && commandValue !== "verify") return fail("Usage: woj organizer collection <build|verify> [repository-root] [--index path] [--source path] [--managed path] [--managed-source path]");
+	let root = ".";
+	let indexPath = DEFAULT_INDEX_PATH;
+	let sourcePath = DEFAULT_SOURCE_PATH;
+	let managedPath;
+	let managedSourcePath;
+	let sawRoot = false;
+	for (let index = 0; index < rest.length; index += 1) {
+		const argument = rest[index];
+		if (argument === "--index" || argument === "--source" || argument === "--managed" || argument === "--managed-source") {
+			const value = rest[index + 1];
+			if (!value) return fail(`${argument} requires a path.`);
+			if (argument === "--index") indexPath = portableOutputPath(value, "index path");
+			else if (argument === "--source") sourcePath = normalizedRelativePath(value, "source path");
+			else if (argument === "--managed") managedPath = portableOutputPath(value, "managed contract path");
+			else managedSourcePath = normalizedRelativePath(value, "managed source path");
+			index += 1;
+			continue;
+		}
+		if (argument?.startsWith("-")) return fail(`Unknown option '${argument}'.`);
+		if (sawRoot || !argument) return fail("Only one repository root may be provided.");
+		root = argument;
+		sawRoot = true;
+	}
+	if (commandValue !== "build" && managedSourcePath) return fail("--managed-source is only valid for build.");
+	if (commandValue === "build" && managedPath && !managedSourcePath) return fail("--managed requires --managed-source when building.");
+	if (commandValue === "build" && collisionKey(indexPath) === collisionKey(sourcePath)) return fail("--index and --source must not be the same input and output path.");
+	if (commandValue === "build" && managedPath !== void 0 && managedSourcePath !== void 0 && collisionKey(managedPath) === collisionKey(managedSourcePath)) return fail("--managed and --managed-source must not be the same input and output path.");
+	return {
+		command: commandValue,
+		root: path.resolve(root),
+		indexPath,
+		sourcePath,
+		...managedPath ? { managedPath } : {},
+		...managedSourcePath ? { managedSourcePath } : {}
+	};
+}
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys(value, expected, label) {
+	const actual = Object.keys(value).sort();
+	const sortedExpected = [...expected].sort();
+	if (JSON.stringify(actual) !== JSON.stringify(sortedExpected)) fail(`${label} must contain exactly: ${sortedExpected.join(", ")}.`);
+}
+function parseAuthoredCollection(value) {
+	if (!isRecord(value)) return fail("collection/source.json must be an object.");
+	exactKeys(value, [
+		"schema",
+		"localization",
+		"problems"
+	], "collection source");
+	if (value.schema !== SOURCE_SCHEMA) return fail(`collection source schema must be '${SOURCE_SCHEMA}'.`);
+	if (!isRecord(value.localization)) return fail("collection localization must be an object.");
+	exactKeys(value.localization, ["defaultLocale", "supportedLocales"], "collection localization");
+	if (value.localization.defaultLocale !== "zh-TW" || JSON.stringify(value.localization.supportedLocales) !== JSON.stringify(["zh-TW", "en"])) return fail("collection localization must declare zh-TW followed by en.");
+	if (!Array.isArray(value.problems) || value.problems.length < 1 || value.problems.length > 1e3) return fail("collection source must contain between 1 and 1000 problems.");
+	return {
+		schema: SOURCE_SCHEMA,
+		localization: {
+			defaultLocale: "zh-TW",
+			supportedLocales: ["zh-TW", "en"]
+		},
+		problems: value.problems.map((problemValue, index) => {
+			if (!isRecord(problemValue)) return fail(`collection source problem ${index + 1} must be an object.`);
+			exactKeys(problemValue, ["statementPaths", "bundlePath"], `collection source problem ${index + 1}`);
+			if (!isRecord(problemValue.statementPaths)) return fail(`problem ${index + 1} statementPaths must be an object.`);
+			exactKeys(problemValue.statementPaths, ["zh-TW", "en"], `problem ${index + 1} statementPaths`);
+			const statementPaths = {
+				"zh-TW": normalizedRelativePath(problemValue.statementPaths["zh-TW"], `problem ${index + 1} zh-TW statement`),
+				en: normalizedRelativePath(problemValue.statementPaths.en, `problem ${index + 1} English statement`)
+			};
+			if (!statementPaths["zh-TW"].endsWith(".md") || !statementPaths.en.endsWith(".md")) return fail(`problem ${index + 1} statements must be Markdown files.`);
+			return {
+				statementPaths,
+				bundlePath: normalizedRelativePath(problemValue.bundlePath, `problem ${index + 1} bundle`)
+			};
+		})
+	};
+}
+function parseJson(bytes, label) {
+	let text;
+	try {
+		text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch (error) {
+		throw new Error(`${label} is not valid UTF-8.`, { cause: error });
+	}
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		throw new Error(`${label} is not valid JSON.`, { cause: error });
+	}
+}
+async function sha256Hex(bytes) {
+	const digest = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function validatePublishedCollection(options, strict) {
+	const indexBytes = await readBoundedRepositoryFile(options, options.indexPath, "index path", INDEX_MAX_BYTES);
+	const index = parseProblemCollectionIndex$1(parseJson(indexBytes, options.indexPath));
+	await verifyProblemCollectionRevision$1(index);
+	if (strict && !Buffer.from(indexBytes).equals(Buffer.from(canonicalJsonBytes(index)))) fail(`${options.indexPath} is not canonical; run woj organizer collection build.`);
+	const indexDirectory = path.posix.dirname(options.indexPath);
+	for (const entry of index.problems) {
+		for (const [locale, statementPath] of Object.entries(entry.statementPaths)) if ((await readBoundedRepositoryFile(options, statementPath, `problem '${entry.id}' ${locale} statement`, STATEMENT_MAX_BYTES)).byteLength < 1) fail(`problem '${entry.id}' ${locale} statement must contain between 1 byte and 2 MiB.`);
+		const repositoryPath = path.posix.join(indexDirectory, entry.bundle.path);
+		const bytes = await readBoundedRepositoryFile(options, repositoryPath, `problem '${entry.id}' bundle`, PUBLIC_BUNDLE_MAX_BYTES, entry.bundle.bytes);
+		const problem = await verifyProblemBundleBytes$1(bytes, entry);
+		if (strict && !Buffer.from(bytes).equals(Buffer.from(canonicalJsonBytes({
+			schema: BROWSER_PROBLEM_SCHEMA$1,
+			problem
+		})))) fail(`${repositoryPath} is not canonical; run woj organizer collection build.`);
+	}
+	if (strict) await rejectUndeclaredContentAddressedBundles(options, index);
+	if (options.managedPath) await validateManagedContract(options, index);
+	return index;
+}
+async function validateManagedContract(options, index) {
+	const managedPath = options.managedPath;
+	if (!managedPath) fail("managed contract path is required.");
+	const contractBytes = await readBoundedRepositoryFile(options, managedPath, "managed contract path", MANAGED_MAX_BYTES);
+	const contract = parseManagedCollectionV2$1(contractBytes);
+	if (contract.collectionRevision !== index.revision) fail("managed collection revision does not match collection/index.json.");
+	if (JSON.stringify(contract.problems.map((problem) => problem.slug)) !== JSON.stringify(index.problems.map((problem) => problem.id))) fail("managed collection problems must exactly match index order.");
+	const indexDirectory = path.posix.dirname(options.indexPath);
+	for (const [position, publication] of contract.problems.entries()) {
+		const entry = index.problems[position];
+		const practiceBytes = await readBoundedRepositoryFile(options, path.posix.join(indexDirectory, entry.bundle.path), `problem '${entry.id}' bundle`, PUBLIC_BUNDLE_MAX_BYTES, entry.bundle.bytes);
+		const practice = await verifyProblemBundleBytes$1(practiceBytes, entry);
+		const contestBytes = await readPublishedObject(options, indexDirectory, publication.contestPublic, `contest-public '${publication.slug}'`, PUBLIC_BUNDLE_MAX_BYTES);
+		const expectedContestBytes = contestPublicProjectionBytes(practice, entry.bundle.sha256);
+		if (!Buffer.from(contestBytes).equals(Buffer.from(expectedContestBytes))) fail(`contest-public '${publication.slug}' is not the deterministic projection of its practice bundle.`);
+		const packageBytes = await readPublishedObject(options, indexDirectory, publication.judgePackage, `judge package '${publication.slug}'`, JUDGE_PACKAGE_MAX_BYTES);
+		const validatedPackage = await validateJudgePackage(packageBytes, {
+			expectedBytes: publication.judgePackage.bytes,
+			expectedSha256: publication.judgePackage.sha256,
+			memoryLimitBytes: Math.max(...practice.scoring.policies.map((policy) => policy.limits.memoryLimitBytes))
+		});
+		if (JSON.stringify(validatedPackage.manifest.allowedProfiles) !== JSON.stringify(publication.allowedProfiles)) fail(`judge package '${publication.slug}' allowedProfiles disagree with collection/managed.json.`);
+		assertJudgeDataMatchesPracticePublic(validatedPackage.judgeData, practice, Object.keys(publication.allowedProfiles));
+	}
+}
+async function readPublishedObject(options, indexDirectory, object, label, maximumBytes) {
+	const bytes = await readBoundedRepositoryFile(options, path.posix.join(indexDirectory, object.repositoryPath), label, maximumBytes, object.bytes);
+	if (await sha256Hex(bytes) !== object.sha256) fail(`${label} failed integrity verification.`);
+	return bytes;
+}
+async function rejectUndeclaredContentAddressedBundles(options, index) {
+	const indexDirectory = path.posix.dirname(options.indexPath);
+	const relativeDirectory = path.posix.join(indexDirectory, "problems");
+	const directory = resolveInside(options.root, relativeDirectory, "bundle directory");
+	if (!await anchoredPathHasNoSymlink(directory)) fail("bundle directory must not traverse a symbolic link.");
+	const metadata = await lstat(directory);
+	if (metadata.isSymbolicLink() || !metadata.isDirectory()) fail("bundle directory must be a real directory.");
+	const declared = new Set(index.problems.map((entry) => path.posix.basename(entry.bundle.path)));
+	const entries = await readdir(directory, { withFileTypes: true });
+	const digestPattern = /\.[0-9a-f]{64}\.json$/;
+	const undeclared = entries.filter((entry) => entry.isFile() && digestPattern.test(entry.name) && !declared.has(entry.name)).map((entry) => entry.name).sort();
+	const unsafe = entries.filter((entry) => entry.isSymbolicLink() || !entry.isFile() && !entry.isDirectory()).map((entry) => entry.name).sort();
+	if (unsafe.length > 0) fail(`bundle directory contains unsafe entries: ${unsafe.join(", ")}.`);
+	if (undeclared.length > 0) fail(`undeclared content-addressed bundles: ${undeclared.join(", ")}.`);
+}
+function assertGeneratedSize(bytes, maximumBytes, label) {
+	if (bytes.byteLength > maximumBytes) fail(`${label} exceeds its allowed byte limit.`);
+}
+async function prepareCollection(options) {
+	const source = parseAuthoredCollection(parseJson(await readBoundedRepositoryFile(options, options.sourcePath, "source path", COLLECTION_SOURCE_MAX_BYTES), options.sourcePath));
+	const indexDirectory = path.posix.dirname(options.indexPath);
+	const entries = [];
+	const authoredProblems = [];
+	const practiceProblems = [];
+	const inputs = /* @__PURE__ */ new Set([options.sourcePath]);
+	const outputs = [];
+	for (const [position, authored] of source.problems.entries()) {
+		inputs.add(authored.bundlePath);
+		const authoredBytes = await readBoundedRepositoryFile(options, authored.bundlePath, `problem ${position + 1} source bundle`, AUTHORING_BUNDLE_MAX_BYTES);
+		const problem = parseStandaloneProblemBundle$1(parseJson(authoredBytes, authored.bundlePath));
+		if (problem.number !== position + 1) fail(`problem '${problem.id}' must have number ${position + 1}.`);
+		for (const [locale, statementPath] of Object.entries(authored.statementPaths)) {
+			inputs.add(statementPath);
+			if ((await readBoundedRepositoryFile(options, statementPath, `problem '${problem.id}' ${locale} statement`, STATEMENT_MAX_BYTES)).byteLength < 1) fail(`problem '${problem.id}' ${locale} statement must contain between 1 byte and 2 MiB.`);
+		}
+		authoredProblems.push(problem);
+		const practice = derivePracticePublic(problem);
+		practiceProblems.push(practice);
+		const bundleBytes = canonicalJsonBytes({
+			schema: BROWSER_PROBLEM_SCHEMA$1,
+			problem: practice
+		});
+		assertGeneratedSize(bundleBytes, PUBLIC_BUNDLE_MAX_BYTES, `problem '${problem.id}' public bundle`);
+		const digest = await sha256Hex(bundleBytes);
+		const bundleName = `${String(problem.number).padStart(3, "0")}-${problem.id}.${digest}.json`;
+		outputs.push({
+			path: path.posix.join(indexDirectory, "problems", bundleName),
+			label: `problem '${problem.id}' public bundle output`,
+			bytes: bundleBytes
+		});
+		entries.push({
+			id: problem.id,
+			number: problem.number,
+			title: problem.title,
+			trackId: problem.trackId,
+			track: problem.track,
+			statementPaths: authored.statementPaths,
+			difficulty: problem.difficulty,
+			tags: problem.tags,
+			caseCount: practice.judgeCases.length,
+			bundle: {
+				path: `problems/${bundleName}`,
+				sha256: digest,
+				bytes: bundleBytes.byteLength
+			}
+		});
+	}
+	const withoutRevision = {
+		schema: BROWSER_COLLECTION_SCHEMA$1,
+		problemSchema: BROWSER_PROBLEM_SCHEMA$1,
+		localization: source.localization,
+		problems: entries
+	};
+	const index = parseProblemCollectionIndex$1({
+		...withoutRevision,
+		revision: await problemCollectionRevision$1(withoutRevision)
+	});
+	const indexBytes = canonicalJsonBytes(index);
+	assertGeneratedSize(indexBytes, INDEX_MAX_BYTES, "collection index output");
+	outputs.push({
+		path: options.indexPath,
+		label: "collection index output",
+		bytes: indexBytes
+	});
+	return {
+		index,
+		authoredProblems,
+		practiceProblems,
+		inputs,
+		outputs
+	};
+}
+async function readDeclaredManagedSourceObject(options, object, label, inputs) {
+	inputs.add(object.path);
+	const bytes = await readBoundedRepositoryFile(options, object.path, label, JUDGE_PACKAGE_MAX_BYTES, object.bytes);
+	if (await sha256Hex(bytes) !== object.sha256) fail(`${label} failed declared size or digest verification.`);
+	return bytes;
+}
+async function managedJudgeInput(options, problem, inputs) {
+	if (problem.judge.kind === "text") return { kind: "text" };
+	const artifact = await readDeclaredManagedSourceObject(options, problem.judge.artifact, `${problem.judge.kind} artifact '${problem.slug}'`, inputs);
+	const assets = [];
+	for (const asset of problem.judge.assets) assets.push({
+		guestPath: asset.guestPath,
+		contents: await readDeclaredManagedSourceObject(options, asset, `${problem.judge.kind} asset '${problem.slug}/${asset.path}'`, inputs)
+	});
+	return problem.judge.kind === "checker" ? {
+		kind: "checker",
+		runtimeProfile: problem.judge.artifact.runtimeProfile,
+		artifact,
+		assets,
+		args: problem.judge.args
+	} : {
+		kind: "interactive",
+		runtimeProfile: problem.judge.artifact.runtimeProfile,
+		artifact,
+		assets,
+		args: problem.judge.args,
+		inputPath: problem.judge.inputPath
+	};
+}
+async function prepareManagedCollection(options, built) {
+	const managedSourcePath = options.managedSourcePath;
+	if (!managedSourcePath) fail("managed source path is required.");
+	const inputs = /* @__PURE__ */ new Set([managedSourcePath]);
+	const outputs = [];
+	const sourceBytes = await readBoundedRepositoryFile(options, managedSourcePath, "managed source path", MANAGED_MAX_BYTES);
+	const source = parseManagedCollectionSource$1(parseJson(sourceBytes, managedSourcePath));
+	if (JSON.stringify(source.problems.map((problem) => problem.slug)) !== JSON.stringify(built.index.problems.map((problem) => problem.id))) fail("managed source problems must exactly match collection/index.json order.");
+	const indexDirectory = path.posix.dirname(options.indexPath);
+	const publicationDirectory = path.posix.join(indexDirectory, "managed");
+	const publications = [];
+	for (const [position, sourceProblem] of source.problems.entries()) {
+		const entry = built.index.problems[position];
+		const practice = built.practiceProblems[position];
+		const authored = built.authoredProblems[position];
+		if (!authored || authored.id !== entry.id) fail(`authoring source for '${entry.id}' is unavailable.`);
+		const contestBytes = contestPublicProjectionBytes(practice, entry.bundle.sha256);
+		assertGeneratedSize(contestBytes, PUBLIC_BUNDLE_MAX_BYTES, `contest-public '${entry.id}' output`);
+		const contestSha256 = await sha256Hex(contestBytes);
+		const contestName = `${String(entry.number).padStart(3, "0")}-${entry.id}.${contestSha256}.contest.json`;
+		outputs.push({
+			path: path.posix.join(publicationDirectory, contestName),
+			label: `contest-public '${entry.id}' output`,
+			bytes: contestBytes
+		});
+		const encoded = await encodeJudgePackage({
+			judgeData: deriveJudgeData(authored, Object.keys(sourceProblem.allowedProfiles)),
+			allowedProfiles: sourceProblem.allowedProfiles,
+			judge: await managedJudgeInput(options, sourceProblem, inputs)
+		});
+		assertGeneratedSize(encoded.bytes, JUDGE_PACKAGE_MAX_BYTES, `judge package '${entry.id}' output`);
+		const validated = await validateJudgePackage(encoded.bytes, {
+			expectedBytes: encoded.bytes.byteLength,
+			expectedSha256: encoded.executionSemanticSha256,
+			memoryLimitBytes: Math.max(...practice.scoring.policies.map((policy) => policy.limits.memoryLimitBytes))
+		});
+		assertJudgeDataMatchesPracticePublic(validated.judgeData, practice, Object.keys(sourceProblem.allowedProfiles));
+		const packageName = `${String(entry.number).padStart(3, "0")}-${entry.id}.${encoded.executionSemanticSha256}.wasmojjudge`;
+		outputs.push({
+			path: path.posix.join(publicationDirectory, packageName),
+			label: `judge package '${entry.id}' output`,
+			bytes: encoded.bytes
+		});
+		publications.push({
+			slug: entry.id,
+			allowedProfiles: sourceProblem.allowedProfiles,
+			contestPublic: {
+				repositoryPath: `managed/${contestName}`,
+				bytes: contestBytes.byteLength,
+				sha256: contestSha256
+			},
+			judgePackage: {
+				repositoryPath: `managed/${packageName}`,
+				bytes: encoded.bytes.byteLength,
+				sha256: encoded.executionSemanticSha256
+			}
+		});
+	}
+	const contract = parseManagedCollectionV2$1(canonicalJsonBytes({
+		schema: MANAGED_COLLECTION_SCHEMA$1,
+		collectionRevision: built.index.revision,
+		problems: publications
+	}));
+	const managedPath = options.managedPath ?? path.posix.join(indexDirectory, "managed.json");
+	const contractBytes = canonicalJsonBytes(contract);
+	assertGeneratedSize(contractBytes, MANAGED_MAX_BYTES, "managed contract output");
+	outputs.push({
+		path: managedPath,
+		label: "managed contract output",
+		bytes: contractBytes
+	});
+	return {
+		inputs,
+		outputs
+	};
+}
+function pathsOverlap(left, right) {
+	const leftKey = collisionKey(left);
+	const rightKey = collisionKey(right);
+	return leftKey === rightKey || leftKey.startsWith(`${rightKey}/`) || rightKey.startsWith(`${leftKey}/`);
+}
+async function writePreparedCollection(options, inputs, outputs) {
+	const outputPaths = /* @__PURE__ */ new Set();
+	for (const output of outputs) {
+		portableOutputPath(output.path, output.label);
+		const key = collisionKey(output.path);
+		if (outputPaths.has(key)) fail(`generated output '${output.path}' has a case-folded or normalized collision.`);
+		outputPaths.add(key);
+		for (const input of inputs) if (pathsOverlap(input, output.path)) fail(`generated output '${output.path}' overlaps declared input '${input}'.`);
+	}
+	await assertNoFilesystemAliases(options, inputs, outputs.map((output) => output.path));
+	await Promise.all(outputs.map((output) => assertOutputPathSafe(options, output.path, output.label)));
+	for (const output of outputs) await atomicRepositoryWrite(options, output.path, output.bytes);
+}
+async function runCollectionCli(arguments_) {
+	const options = parseOptions(arguments_);
+	await assertRepositoryRoot(options.root);
+	let index;
+	if (options.command === "build") {
+		const initialManagedOutput = options.managedSourcePath ? options.managedPath ?? path.posix.join(path.posix.dirname(options.indexPath), "managed.json") : void 0;
+		await assertNoFilesystemAliases(options, /* @__PURE__ */ new Set([options.sourcePath, ...options.managedSourcePath ? [options.managedSourcePath] : []]), [options.indexPath, ...initialManagedOutput ? [initialManagedOutput] : []]);
+		const built = await prepareCollection(options);
+		index = built.index;
+		const managed = options.managedSourcePath ? await prepareManagedCollection(options, built) : void 0;
+		await writePreparedCollection(options, /* @__PURE__ */ new Set([...built.inputs, ...managed?.inputs ?? []]), [...built.outputs, ...managed?.outputs ?? []]);
+	} else index = await validatePublishedCollection(options, true);
+	process.stdout.write(`${options.command} ok: ${index.problems.length} problems, revision ${index.revision}\n`);
+}
+if (process.argv[1] ? import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href : false) runCollectionCli(process.argv.slice(2)).catch((error) => {
+	process.stderr.write(`woj organizer collection: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+export { BROWSER_COLLECTION_SCHEMA, BROWSER_PROBLEM_SCHEMA, MANAGED_COLLECTION_SCHEMA, parseManagedCollectionContract, parseManagedCollectionSource, parseManagedCollectionV2, parseManagedCollectionValueV2, parseProblemCollectionIndex, parseStandaloneProblemBundle, problemCollectionRevision, runCollectionCli, verifyProblemBundleBytes, verifyProblemCollectionRevision };

package/licenses/fflate-MIT.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Arjun Barrett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@wasm-oj/organizer",
+  "version": "0.2.0",
+  "description": "Problem collection and immutable judge-data publication tools for WASM-OJ.",
+  "license": "MIT",
+  "author": "JacobLinCool",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wasm-oj/forge.git",
+    "directory": "packages/organizer"
+  },
+  "homepage": "https://github.com/wasm-oj/forge#readme",
+  "bugs": {
+    "url": "https://github.com/wasm-oj/forge/issues"
+  },
+  "keywords": [
+    "online-judge",
+    "problems",
+    "contest"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md",
+    "licenses"
+  ],
+  "engines": {
+    "node": ">=24.18.0 <25"
+  },
+  "dependencies": {
+    "@wasm-oj/core": "0.2.0"
+  },
+  "scripts": {
+    "build": "node ../../scripts/build-library.mjs --package @wasm-oj/organizer"
+  }
+}