narraeon 0.4.0 → 0.5.1

package/dist/node/runtime/content/CurrentTreeContentLibrary.js

@@ -1,3 +1,4 @@
+import { PackageScriptPermissions } from "../extension/PackageScriptPermissions.js";
 import { randomUUID } from "node:crypto";
 import { readFileSync, unlinkSync } from "node:fs";
 import { link, open, mkdir, readFile, readdir, rename, rm, stat, unlink, } from "node:fs/promises";
@@ -54,18 +55,20 @@ export class CurrentTreeContentLibrary {
         this.#beforePackagePublish = options.beforePackagePublish;
         this.#beforeCurrentTreeReplace = options.beforeCurrentTreeReplace;
     }
-    createPackage(files = []) {
+    createPackage(input) {
         return this.#mutate(async () => {
-            const normalized = normalizeCurrentContentTreeFiles(files, this.#limits);
-            const package_ = await this.#publishNewPackage(normalized);
+            const title = normalizePackageTitle(input.title);
+            const normalized = normalizeCurrentContentTreeFiles(input.files ?? [], this.#limits);
+            const package_ = await this.#publishNewPackage(normalized, title);
             return packageSummary(package_);
         });
     }
-    importPackage(files, options = {}) {
+    importPackage(input, options = {}) {
         return this.#mutate(async () => {
             options.signal?.throwIfAborted();
-            const normalized = normalizeCurrentContentTreeFiles(files, this.#limits);
-            return this.#publishNewPackage(normalized, options.signal);
+            const title = normalizePackageTitle(input.title);
+            const normalized = normalizeCurrentContentTreeFiles(input.files, this.#limits);
+            return this.#publishNewPackage(normalized, title, options.signal);
         });
     }
     copyPackage(localId, options = {}) {
@@ -73,7 +76,7 @@ export class CurrentTreeContentLibrary {
             options.signal?.throwIfAborted();
             const source = await this.readPackage(localId);
             options.signal?.throwIfAborted();
-            return this.#publishNewPackage(source.files, options.signal);
+            return this.#publishNewPackage(source.files, source.title, options.signal);
         });
     }
     deletePackage(localId, options = {}) {
@@ -127,7 +130,38 @@ export class CurrentTreeContentLibrary {
         }
         return packages;
     }
+    async readScriptGrants(localId) {
+        await this.readPackage(localId);
+        return PackageScriptPermissions.read(this.#packageRoot(localId));
+    }
+    async scriptPermissions(localId, enabled) {
+        const lease = await this.acquireOperationLease(localId, { wait: true });
+        try {
+            const root = this.#packageRoot(localId);
+            if (enabled !== undefined)
+                await PackageScriptPermissions.write(root, enabled
+                    ? PackageScriptPermissions.currentGrants(lease.package.files)
+                    : []);
+            return PackageScriptPermissions.status(lease.package.files, await PackageScriptPermissions.read(root));
+        }
+        finally {
+            lease.release();
+        }
+    }
     async readPackage(localId) {
+        const snapshot = await this.#readPackageSnapshot(localId);
+        if (snapshot.metadata.schemaVersion === 2)
+            return snapshot.package;
+        const lease = await this.acquireOperationLease(localId, { wait: true });
+        try {
+            await ensureStoredPackageTitle(this.#packageRoot(localId), localId, lease.package.title);
+            return structuredClone(lease.package);
+        }
+        finally {
+            lease.release();
+        }
+    }
+    async #readPackageSnapshot(localId) {
         const packageRoot = this.#packageRoot(localId);
         const metadata = await readJsonFile(join(packageRoot, localMetadataFileName), () => new CurrentTreeContentPackageNotFoundError(), "The local content-package envelope is damaged");
         if (!isStoredMetadata(metadata) || metadata.localId !== localId) {
@@ -146,18 +180,20 @@ export class CurrentTreeContentLibrary {
                 cause: error,
             });
         }
-        return detail(localId, files, inspectContentPackageCurrentTree(files), metadata.name);
+        const inspection = inspectContentPackageCurrentTree(files);
+        return {
+            metadata,
+            package: detail(localId, effectivePackageTitle(metadata, inspection), files, inspection),
+        };
     }
     /**
-     * Name a package in the local library. The name lives in the package's own
+     * Title a package in the local library. The title lives in the package's own
      * local shell, not in its content, so renaming never touches a document the
      * runtime reads during play.
      */
-    renamePackage(localId, name, options = {}) {
+    renamePackage(localId, title, options = {}) {
         return this.#mutate(async () => {
-            const trimmed = name.trim();
-            if (!validPackageName(trimmed))
-                throw new CurrentTreeContentLibraryError("A content-package name must contain 1 to 160 characters and no line breaks");
+            const normalizedTitle = normalizePackageTitle(title);
             const lease = await this.acquireOperationLease(localId, {
                 wait: options.waitForLease !== false,
             });
@@ -167,20 +203,11 @@ export class CurrentTreeContentLibrary {
                 const metadata = await readJsonFile(join(packageRoot, localMetadataFileName), () => new CurrentTreeContentPackageNotFoundError(), "The local content-package envelope is damaged");
                 if (!isStoredMetadata(metadata) || metadata.localId !== localId)
                     throw new CurrentTreeContentLibraryError("The local content-package envelope is damaged");
-                const temporaryPath = join(packageRoot, `.local-${randomUUID()}.tmp`);
-                try {
-                    await writeDurableNewFile(temporaryPath, serialize({
-                        schemaVersion: 1,
-                        localId,
-                        name: trimmed,
-                    }));
-                    await rename(temporaryPath, join(packageRoot, localMetadataFileName));
-                    await syncDirectory(packageRoot);
-                }
-                catch (error) {
-                    await rm(temporaryPath, { force: true }).catch(() => undefined);
-                    throw error;
-                }
+                await writeStoredLocalMetadata(packageRoot, {
+                    schemaVersion: 2,
+                    localId,
+                    title: normalizedTitle,
+                });
                 return packageSummary(await this.readPackage(localId));
             }
             finally {
@@ -246,7 +273,7 @@ export class CurrentTreeContentLibrary {
         }
         let released = false;
         try {
-            const package_ = await this.readPackage(localId);
+            const package_ = (await this.#readPackageSnapshot(localId)).package;
             return {
                 package: structuredClone(package_),
                 replace: async (files, options = {}) => {
@@ -254,7 +281,7 @@ export class CurrentTreeContentLibrary {
                         throw new CurrentTreeContentPackageBusyError();
                     options.signal?.throwIfAborted();
                     const normalized = normalizeCurrentContentTreeFiles(files, this.#limits);
-                    return this.#replaceNormalizedCurrentTree(localId, normalized, options.signal);
+                    return this.#replaceNormalizedCurrentTree(localId, package_.title, normalized, options.signal);
                 },
                 release: () => {
                     if (released)
@@ -269,12 +296,13 @@ export class CurrentTreeContentLibrary {
             throw error;
         }
     }
-    async #replaceNormalizedCurrentTree(localId, normalized, signal) {
+    async #replaceNormalizedCurrentTree(localId, title, normalized, signal) {
         const packageRoot = this.#packageRoot(localId);
         const temporaryPath = join(packageRoot, `.current-tree-${randomUUID()}.tmp`);
         const previousPath = join(packageRoot, currentTreePreviousFileName);
         try {
             signal?.throwIfAborted();
+            await ensureStoredPackageTitle(packageRoot, localId, title);
             await writeDurableNewFile(temporaryPath, serialize({
                 schemaVersion: 1,
                 files: normalized,
@@ -319,9 +347,9 @@ export class CurrentTreeContentLibrary {
                 ? error.message
                 : "Unable to replace the content package's current tree atomically", { cause: error });
         }
-        return detail(localId, normalized, inspectContentPackageCurrentTree(normalized));
+        return detail(localId, title, normalized, inspectContentPackageCurrentTree(normalized));
     }
-    async #publishNewPackage(normalized, signal) {
+    async #publishNewPackage(normalized, title, signal) {
         const localId = `package-${randomUUID()}`;
         const stagingPath = join(this.#stagingRoot, localId);
         const finalPath = join(this.#packagesRoot, localId);
@@ -333,8 +361,9 @@ export class CurrentTreeContentLibrary {
             signal?.throwIfAborted();
             await mkdir(stagingPath, { mode: 0o700 });
             await writeDurableNewFile(join(stagingPath, localMetadataFileName), serialize({
-                schemaVersion: 1,
+                schemaVersion: 2,
                 localId,
+                title,
             }));
             await writeDurableNewFile(join(stagingPath, currentTreeFileName), serialize({
                 schemaVersion: 1,
@@ -357,7 +386,7 @@ export class CurrentTreeContentLibrary {
                 cause: error,
             });
         }
-        return detail(localId, normalized, inspectContentPackageCurrentTree(normalized));
+        return detail(localId, title, normalized, inspectContentPackageCurrentTree(normalized));
     }
     #packageRoot(localId) {
         if (!localIdPattern.test(localId)) {
@@ -445,9 +474,9 @@ export class CurrentTreeContentLibrary {
         }
     }
 }
-function detail(localId, files, inspection, name) {
+function detail(localId, title, files, inspection) {
     return {
-        ...summary(localId, inspection, name),
+        ...summary(localId, title, inspection),
         files: files.map((file) => ({ ...file })),
         documents: structuredClone(inspection.documents),
         issues: structuredClone(inspection.issues),
@@ -455,12 +484,10 @@ function detail(localId, files, inspection, name) {
         control: structuredClone(inspection.control),
     };
 }
-function summary(localId, inspection, name) {
+function summary(localId, title, inspection) {
     return {
         localId,
-        // An author-chosen name wins; without one the name still tracks whatever
-        // the package currently contains.
-        displayName: name ?? inspection.displayName,
+        title,
         status: inspection.status,
         documentCount: inspection.documents.length,
         issueCount: inspection.issues.length,
@@ -469,7 +496,7 @@ function summary(localId, inspection, name) {
 function packageSummary(package_) {
     return {
         localId: package_.localId,
-        displayName: package_.displayName,
+        title: package_.title,
         status: package_.status,
         documentCount: package_.documentCount,
         issueCount: package_.issueCount,
@@ -575,6 +602,33 @@ function normalizeLimits(input) {
     }
     return limits;
 }
+async function ensureStoredPackageTitle(packageRoot, localId, title) {
+    const metadata = await readJsonFile(join(packageRoot, localMetadataFileName), () => new CurrentTreeContentPackageNotFoundError(), "The local content-package envelope is damaged");
+    if (!isStoredMetadata(metadata) || metadata.localId !== localId)
+        throw new CurrentTreeContentLibraryError("The local content-package envelope is damaged");
+    if (metadata.schemaVersion === 2) {
+        if (metadata.title !== title)
+            throw new CurrentTreeContentLibraryError("The content-package title changed while its current tree was locked");
+        return;
+    }
+    await writeStoredLocalMetadata(packageRoot, {
+        schemaVersion: 2,
+        localId,
+        title,
+    });
+}
+async function writeStoredLocalMetadata(packageRoot, metadata) {
+    const temporaryPath = join(packageRoot, `.local-${randomUUID()}.tmp`);
+    try {
+        await writeDurableNewFile(temporaryPath, serialize(metadata));
+        await rename(temporaryPath, join(packageRoot, localMetadataFileName));
+        await syncDirectory(packageRoot);
+    }
+    catch (error) {
+        await rm(temporaryPath, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
 async function writeDurableNewFile(path, contents) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
     const handle = await open(path, "wx", 0o600);
@@ -607,17 +661,45 @@ async function readJsonFile(path, missing, invalidMessage) {
     }
 }
 function isStoredMetadata(value) {
+    return isStoredLocalMetadata(value) || isLegacyStoredLocalMetadata(value);
+}
+function isStoredLocalMetadata(value) {
+    return (isPlainObject(value) &&
+        Object.keys(value).length === 3 &&
+        value.schemaVersion === 2 &&
+        typeof value.localId === "string" &&
+        localIdPattern.test(value.localId) &&
+        typeof value.title === "string" &&
+        validPackageTitle(value.title));
+}
+function isLegacyStoredLocalMetadata(value) {
     return (isPlainObject(value) &&
         Object.keys(value).length === (value.name === undefined ? 2 : 3) &&
         value.schemaVersion === 1 &&
         typeof value.localId === "string" &&
         localIdPattern.test(value.localId) &&
         (value.name === undefined ||
-            (typeof value.name === "string" && validPackageName(value.name))));
-}
-const packageNamePattern = /^[^\r\n]{1,160}$/u;
-function validPackageName(name) {
-    return packageNamePattern.test(name);
+            (typeof value.name === "string" && validPackageTitle(value.name))));
+}
+function effectivePackageTitle(metadata, inspection) {
+    if (metadata.schemaVersion === 2)
+        return metadata.title;
+    return metadata.name ?? legacyContentDerivedTitle(inspection);
+}
+function legacyContentDerivedTitle(inspection) {
+    return (inspection.documents.find(({ id }) => id === "situation.current")?.title ??
+        inspection.documents[0]?.title ??
+        "Untitled content package");
+}
+const packageTitlePattern = /^[^\r\n]{1,160}$/u;
+function validPackageTitle(title) {
+    return packageTitlePattern.test(title);
+}
+function normalizePackageTitle(title) {
+    const normalized = title.trim();
+    if (!validPackageTitle(normalized))
+        throw new CurrentTreeContentLibraryError("A content-package title must contain 1 to 160 characters and no line breaks");
+    return normalized;
 }
 function isStoredCurrentTree(value) {
     return (isPlainObject(value) &&

package/dist/node/runtime/content/FileNativeContentTree.js

@@ -1,6 +1,6 @@
+import { readPackageFollowups } from "./PackageFollowups.js";
 import { parseDocument } from "yaml";
 import { WorldDocumentStore, } from "../world/WorldDocumentStore.js";
-const maxOpeningBytes = 64 * 1024;
 export function isContentPackageWorldDocumentPath(path) {
     return path.startsWith("world/");
 }
@@ -35,11 +35,10 @@ export function inspectContentPackageCurrentTree(files, options = {}) {
         const openingFile = openingFiles[0];
         if (openingFile.encoding !== undefined ||
             openingFile.contents.trim().length === 0 ||
-            Buffer.byteLength(openingFile.contents, "utf8") > maxOpeningBytes ||
             Buffer.from(openingFile.contents, "utf8").toString("utf8") !==
                 openingFile.contents) {
             opening = "invalid";
-            issue(issues, "invalid_opening", "opening.md", "The introduction must be non-empty, well-formed UTF-8 text no larger than 64 KiB");
+            issue(issues, "invalid_opening", "opening.md", "The introduction must be non-empty, well-formed UTF-8 text");
         }
         else
             opening = "valid";
@@ -66,9 +65,16 @@ export function inspectContentPackageCurrentTree(files, options = {}) {
         const frame = parseRestrictedYaml("control/frame.yaml", frameSource, issues);
         if (isRecord(frame) &&
             frame.format === "narraeon.world-frame/v1" &&
-            Object.keys(frame).every((key) => ["format", "bindings", "instructions", "context"].includes(key)) &&
+            Object.keys(frame).every((key) => [
+                "format",
+                "bindings",
+                "instructions",
+                "context",
+                "maintenance",
+            ].includes(key)) &&
             isRecord(frame.bindings) &&
-            Object.keys(frame.bindings).length === 1) {
+            Object.keys(frame.bindings).length === 1 &&
+            validMaintenance(frame)) {
             worldFrame = "valid";
             const binding = isRecord(frame.bindings)
                 ? frame.bindings.currentSituation
@@ -110,12 +116,14 @@ export function inspectContentPackageCurrentTree(files, options = {}) {
                 issue(issues, "invalid_player_view", "control/player-views.yaml", `${formatProblems.length - maxReportedPlayerViewProblems} more player-view issues were omitted`);
         }
     }
-    const displayName = documents.find(({ id }) => id === "situation.current")?.title ??
-        documents[0]?.title ??
-        "Untitled content package";
+    try {
+        readPackageFollowups(snapshotFiles);
+    }
+    catch (error) {
+        issue(issues, "invalid_package_followups", "control/followups.yaml", error instanceof Error ? error.message : "Invalid package followups");
+    }
     return {
         status: issues.length === 0 ? "usable" : "needs_repair",
-        displayName,
         documents: documents.sort((a, b) => a.path.localeCompare(b.path)),
         issues,
         opening,
@@ -123,6 +131,15 @@ export function inspectContentPackageCurrentTree(files, options = {}) {
         worldDocumentSnapshot,
     };
 }
+function validMaintenance(frame) {
+    try {
+        worldMaintenanceSettings(frame);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function worldDocumentSnapshotDocuments(snapshot) {
     const documents = [];
     const pendingDirectories = [""];
@@ -387,7 +404,7 @@ function validateFrameContext(value, index, snapshot, issues) {
         }
         // Naming the offending key matters: reporting the kind reads as "this slot
         // does not exist" and sends the author off deleting a valid slot.
-        const unknownKeys = Object.keys(entry.slot).filter((key) => !allowed.includes(key));
+        const unknownKeys = Object.keys(entry.slot).filter((key) => !allowed.includes(key) && key !== "id" && key !== "advisoryBytes");
         if (unknownKeys.length > 0) {
             issue(issues, "invalid_world_frame", "control/frame.yaml", `Slot ${entry.slot.kind} does not accept parameters ${unknownKeys.join(", ")}; it accepts only ${allowed.join(", ")}`);
             continue;
@@ -510,3 +527,4 @@ function issue(issues, code, path, message, documentId) {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+import { worldMaintenanceSettings } from "../prompt/WorldMaintenanceReport.js";

package/dist/node/runtime/content/PackageFollowups.js

@@ -0,0 +1,80 @@
+import { isAlias, isNode, parseDocument, visit } from "yaml";
+import { parseFollowups, parsePlayPresetRegexAsset, } from "../play/FileNativePlayPresetStore.js";
+/** The world owns the copied control tree; source-package metadata is never consulted. */
+export function readPackageFollowups(files) {
+    const source = files.find(({ path }) => path === "control/followups.yaml");
+    const resources = Object.fromEntries(files
+        .filter(({ path, encoding }) => path.startsWith("control/") && encoding === undefined)
+        .map(({ path, contents }) => [path.slice("control/".length), contents]));
+    if (source === undefined)
+        return { followups: [], files: resources };
+    if (source.encoding !== undefined)
+        throw new Error("Package followups must be UTF-8 YAML");
+    const document = parseDocument(source.contents, { uniqueKeys: true });
+    let unsafe = false;
+    visit(document, (_, node) => {
+        if (isAlias(node) ||
+            (isNode(node) &&
+                (node.tag !== undefined || ("anchor" in node && Boolean(node.anchor)))))
+            unsafe = true;
+    });
+    if (unsafe || document.errors.length > 0 || document.warnings.length > 0)
+        throw new Error("Invalid package followups YAML: aliases, tags and duplicate keys are not allowed");
+    const value = document.toJS({ maxAliasCount: 0 });
+    if (!record(value) ||
+        value.format !== "narraeon.package-followups/v1" ||
+        Object.keys(value).some((key) => !["format", "followups"].includes(key)) ||
+        !Array.isArray(value.followups))
+        throw new Error("Expected narraeon.package-followups/v1 with a followups array");
+    const controls = value.followups.map((raw) => {
+        if (!record(raw) ||
+            typeof raw.enabled !== "boolean" ||
+            typeof raw.mount !== "string" ||
+            ![
+                "story",
+                "sidebar",
+                "composer_above",
+                "composer_below",
+                "overlay",
+                "debug",
+            ].includes(raw.mount))
+            throw new Error("Every package followup requires a boolean enabled and valid mount");
+        const { enabled, mount, ...definition } = raw;
+        return { enabled, mount: mount, definition };
+    });
+    const definitions = parseFollowups(controls.map((item) => item.definition), resources);
+    for (const definition of definitions)
+        for (const artifact of definition.artifacts) {
+            if (artifact.regex !== undefined)
+                parsePlayPresetRegexAsset(resources[artifact.regex], artifact.regex);
+        }
+    return {
+        followups: definitions.map((definition, index) => ({
+            ...controls[index],
+            definition,
+        })),
+        files: resources,
+    };
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function isPackageFollowupControlPath(path) {
+    return (path === "control/followups.yaml" ||
+        /^control\/(?:prompts\/[A-Za-z0-9._-]+\.md|renderers\/[A-Za-z0-9._-]+\.html|scripts\/[A-Za-z0-9._-]+\.js|regex\/[A-Za-z0-9._-]+\.yaml|assets\/[A-Za-z0-9][A-Za-z0-9._/-]*)$/u.test(path));
+}
+/** Authorization and compilation must freeze the exact same request resource closure. */
+export function packageFollowupResources(definition, files) {
+    const paths = new Set(definition.artifacts.flatMap((artifact) => [
+        artifact.renderer,
+        artifact.regex,
+        ...(artifact.scripts ?? []),
+        ...(artifact.assets ?? []),
+    ].filter((path) => path !== undefined)));
+    return Object.fromEntries([...paths].map((path) => {
+        const source = files[path];
+        if (source === undefined)
+            throw new Error(`Missing package followup resource: ${path}`);
+        return [path, source];
+    }));
+}

package/dist/node/runtime/extension/FrontendExtensionBundle.js

@@ -1,16 +1,18 @@
 import { parsePlayPresetRegexAsset, } from "../play/FileNativePlayPresetStore.js";
-export function projectArtifactForFrontend(artifact, binding, failure = "missing_revision") {
+export function projectArtifactForFrontend(artifact, binding, failure = "missing_revision", packageScriptsEnabled = false) {
     const preset = {
         id: artifact.playPresetId,
         revision: artifact.playPresetRevision,
     };
-    if (binding === null)
+    if (binding === null && artifact.frozenPresentation === undefined)
         return missingBundle(preset, "The frozen play-preset revision is unavailable and cannot be replaced with the current revision", failure);
-    if (binding.id !== artifact.playPresetId ||
-        binding.revision !== artifact.playPresetRevision)
+    if (binding !== null &&
+        (binding.id !== artifact.playPresetId ||
+            binding.revision !== artifact.playPresetRevision))
         return missingBundle(preset, "The play-preset binding does not match the artifact's frozen identity", "invalid_revision");
-    const followup = binding.definition.followups.find(({ id }) => id === artifact.requestId);
-    const declaration = followup?.artifacts.find(({ name }) => name === artifact.output);
+    const followup = binding?.definition.followups.find(({ id }) => id === artifact.requestId);
+    const declaration = artifact.frozenPresentation?.declaration ??
+        followup?.artifacts.find(({ name }) => name === artifact.output);
     if (declaration === undefined)
         return {
             ...missingBundle(preset, "The artifact declaration is missing from the frozen revision"),
@@ -23,8 +25,10 @@ export function projectArtifactForFrontend(artifact, binding, failure = "missing
         };
     try {
         const frozenBinding = {
-            ...binding,
-            scriptsEnabled: artifact.playPresetScriptsEnabled,
+            scriptsEnabled: artifact.requestId.startsWith("package:")
+                ? packageScriptsEnabled && declaration.rendererMode === "app"
+                : artifact.playPresetScriptsEnabled,
+            files: artifact.frozenPresentation?.files ?? binding?.files ?? {},
         };
         const regex = declaration.regex
             ? parsePlayPresetRegexAsset(frozenBinding.files[declaration.regex] ??
@@ -32,8 +36,9 @@ export function projectArtifactForFrontend(artifact, binding, failure = "missing
                     throw new Error("The frozen regex resource does not exist");
                 })(), declaration.regex)
             : [];
-        const renderer = resolveRenderer(declaration, frozenBinding);
-        const mount = frozenBinding.definition.mounts.find(({ channel }) => channel === declaration.channel)?.mount;
+        const renderer = resolveArtifactRenderer(declaration, frozenBinding);
+        const mount = artifact.frozenPresentation?.mount ??
+            binding?.definition.mounts.find(({ channel }) => channel === declaration.channel)?.mount;
         return {
             status: "ready",
             preset,
@@ -44,7 +49,7 @@ export function projectArtifactForFrontend(artifact, binding, failure = "missing
             declaration: declarationView(declaration),
             regex,
             ...(renderer === undefined ? {} : { renderer }),
-            trustedLocalCode: artifact.playPresetScriptsEnabled,
+            trustedLocalCode: frozenBinding.scriptsEnabled,
             fallback: "none",
         };
     }
@@ -125,8 +130,8 @@ function artifactMatchesDeclaration(artifact, declaration) {
         (artifact.rendererRevision ?? undefined) ===
             (declaration.rendererRevision ?? undefined));
 }
-export function projectDebugArtifactForFrontend(artifact, binding, failure = "missing_revision") {
-    return projectArtifactForFrontend(artifact, binding, failure);
+export function projectDebugArtifactForFrontend(artifact, binding, failure = "missing_revision", packageScriptsEnabled = false) {
+    return projectArtifactForFrontend(artifact, binding, failure, packageScriptsEnabled);
 }
 function declarationView(declaration) {
     return {
@@ -145,7 +150,7 @@ function declarationView(declaration) {
         rendererMode: declaration.rendererMode ?? "document",
     };
 }
-function resolveRenderer(declaration, binding) {
+export function resolveArtifactRenderer(declaration, binding) {
     const mode = declaration.rendererMode ?? "document";
     const rendererSource = declaration.renderer
         ? binding.files[declaration.renderer]

package/dist/node/runtime/extension/PackageScriptPermissions.js

@@ -0,0 +1,70 @@
+import { createHash, randomUUID } from "node:crypto";
+import { open, readFile, rename, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { readPackageFollowups, packageFollowupResources, } from "../content/PackageFollowups.js";
+const fileName = "package-script-permissions.json";
+/** Local grants authorize exact resource bytes. They never travel in a portable content tree. */
+export class PackageScriptPermissions {
+    static async read(ownerRoot) {
+        try {
+            const value = JSON.parse(await readFile(join(ownerRoot, fileName), "utf8"));
+            if (typeof value !== "object" ||
+                value === null ||
+                !("schemaVersion" in value) ||
+                value.schemaVersion !== 1 ||
+                !("grants" in value) ||
+                Object.keys(value).length !== 2 ||
+                !Array.isArray(value.grants) ||
+                !value.grants.every((entry) => typeof entry === "string" && /^[a-f0-9]{64}$/u.test(entry)))
+                throw new Error("Invalid local package script permissions");
+            return value.grants;
+        }
+        catch (error) {
+            if (error instanceof Error && "code" in error && error.code === "ENOENT")
+                return [];
+            throw error;
+        }
+    }
+    static async write(ownerRoot, grants) {
+        const path = join(ownerRoot, fileName);
+        const temporary = `${path}.${randomUUID()}.tmp`;
+        try {
+            const file = await open(temporary, "wx", 0o600);
+            try {
+                await file.writeFile(JSON.stringify({ schemaVersion: 1, grants }));
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            await rename(temporary, path);
+            const directory = await open(ownerRoot, "r");
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+    }
+    static fingerprint(files) {
+        return createHash("sha256")
+            .update(JSON.stringify(Object.entries(files).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)))
+            .digest("hex");
+    }
+    static currentGrants(files) {
+        const source = readPackageFollowups(files);
+        return [
+            ...new Set(source.followups.map(({ definition }) => this.fingerprint(packageFollowupResources(definition, source.files)))),
+        ];
+    }
+    static status(files, grants) {
+        const current = this.currentGrants(files);
+        return {
+            enabled: current.length > 0 && current.every((grant) => grants.includes(grant)),
+        };
+    }
+}