packtory 0.0.95 → 0.0.97

package/bundle-emitter/registry/registry-client.d.ts

@@ -1,6 +1,8 @@
+import type _npmFetch from 'npm-registry-fetch';
 import type { Maybe } from 'true-myth';
+import type { Clock } from '../../common/clock.ts';
 import type { PublishSettings } from '../../config/publish-settings.ts';
-import type { RegistrySettings } from '../../config/registry-settings.ts';
+import type { NpmOidcPublishAuth, RegistrySettings } from '../../config/registry-settings.ts';
 import { type PublicationOutcome } from '../publication-outcome.ts';
 import { type PackageReleaseMetadata, type PackageVersionDetails, type PackageVersionReleaseMetadata } from './package-metadata-fetcher.ts';
 import type { TarballIntegrity } from './tarball-integrity.ts';
@@ -8,6 +10,7 @@ type PublishManifest = Readonly<Record<string, unknown>> & {
     readonly name: string;
     readonly version: string;
 };
+type PublishLibraryOptions = Readonly<Record<string, unknown>>;
 type PublishPackageArguments = readonly [
     manifest: PublishManifest,
     tarData: Buffer,
@@ -15,6 +18,14 @@ type PublishPackageArguments = readonly [
     publishSettings: PublishSettings,
     stage: boolean
 ];
+export type RegistryClientDependencies = {
+    readonly npmFetch: typeof _npmFetch;
+    readonly publish: (manifest: PublishManifest, tarData: Buffer, options?: PublishLibraryOptions) => Promise<unknown>;
+    readonly fetch: typeof globalThis.fetch;
+    readonly clock: Clock;
+    readonly resolveIdToken: (auth: NpmOidcPublishAuth) => Promise<string>;
+    readonly promptForOneTimePassword?: (() => Promise<string | undefined>) | undefined;
+};
 export type RegistryClient = {
     fetchLatestReleaseMetadata: (packageName: string, config: RegistrySettings) => Promise<Maybe<PackageReleaseMetadata>>;
     fetchVersionReleaseMetadata: (packageName: string, version: string, config: RegistrySettings) => Promise<Maybe<PackageVersionReleaseMetadata>>;
@@ -23,5 +34,6 @@ export type RegistryClient = {
     publishPackage: (...publishArguments: PublishPackageArguments) => Promise<PublicationOutcome>;
     fetchTarball: (tarballUrl: string, tarballIntegrity: TarballIntegrity, config: RegistrySettings) => Promise<Buffer>;
 };
+export declare function createRegistryClient(dependencies: Readonly<RegistryClientDependencies>): RegistryClient;
 export {};
 //# sourceMappingURL=registry-client.d.ts.map

package/bundle-emitter/registry/registry-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-client.d.ts","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-client.ts"],"names":[],"mappings":"AAAA,OAAO,KACK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EACE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC9F,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE5G,OAAO,EAMH,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EACrC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,KAAK,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF,KAAK,OAQA,gBAAuB,GAAG,SAAS;IACpC,QAAQ,EAAE,eAAe;IACzB,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,gBAAgB;IACxB,eAAe,EAAE,eAAe;IAChC,KAAK,EAAE,OAAO;CACjB,CAAC;AAEF,MAAM,MAAM,cAA0B,GAAG;eAS7B,eACkB,EAAE,CACxB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,gBAAgB,KACvB,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC5C,2BAA2B,EAAE,CACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,gBAAgB,KACvB,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACnD,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC7G,mBAAmB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACnG,cAAc,EAAE,CAAC,GAAG,gBAAgB,EAAE,uBAAuB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9F,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACvH,CAAC;AA2CF"}
+{"version":3,"file":"registry-client.d.ts","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC9F,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE5G,OAAO,EAMH,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EACrC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,KAAK,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF,KAAK,qBAAqB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAQ/D,KAAK,uBAAuB,GAAG,SAAS;IACpC,QAAQ,EAAE,eAAe;IACzB,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,gBAAgB;IACxB,eAAe,EAAE,eAAe;IAChC,KAAK,EAAE,OAAO;CACjB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpH,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;CACvF,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,0BAA0B,EAAE,CACxB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,gBAAgB,KACvB,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC5C,2BAA2B,EAAE,CACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,gBAAgB,KACvB,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACnD,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC7G,mBAAmB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACnG,cAAc,EAAE,CAAC,GAAG,gBAAgB,EAAE,uBAAuB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9F,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACvH,CAAC;AA2CF,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,QAAQ,CAAC,0BAA0B,CAAC,GAAG,cAAc,CAsDvG"}

package/bundle-emitter/registry/registry-client.js

@@ -1,5 +1,75 @@
-import "../publication-outcome.js";
-import "./oidc-token-exchange.js";
-import "./package-metadata-fetcher.js";
-import "./publish-settings-bridge.js";
+import { publishedToRegistry, stagedForApproval } from "../publication-outcome.js";
+import { createOidcTokenExchanger } from "./oidc-token-exchange.js";
+import { fetchLatestPackageReleaseMetadata, fetchPackageTarball, fetchLatestPackageVersion, fetchPackageVersionReleaseMetadata, fetchStagedPackageVersions } from "./package-metadata-fetcher.js";
+import { buildPublishOptionsForPublishSettings, remapPublishError } from "./publish-settings-bridge.js";
+function isStageIdRecord(response) {
+    return (typeof response === 'object' &&
+        response !== null &&
+        Object.hasOwn(response, 'stageId'));
+}
+function hasStageId(response) {
+    return isStageIdRecord(response) && typeof response.stageId === 'string' && response.stageId.length > 0;
+}
+function readStageId(response) {
+    if (!hasStageId(response)) {
+        throw new Error('npm staged publish succeeded without returning a stage ID');
+    }
+    return response.stageId;
+}
+async function readPublishedPublicationOutcome(publishPromise) {
+    await publishPromise;
+    return publishedToRegistry;
+}
+async function readStagedPublicationOutcome(publishPromise) {
+    return stagedForApproval(readStageId(await publishPromise));
+}
+async function readPublicationOutcome(publishPromise, readOutcome, publishSettings) {
+    try {
+        return await readOutcome(publishPromise);
+    }
+    catch (error) {
+        throw remapPublishError(error, publishSettings);
+    }
+}
+export function createRegistryClient(dependencies) {
+    const { npmFetch, publish, fetch: fetchImplementation, clock, promptForOneTimePassword, resolveIdToken } = dependencies;
+    const oidcExchanger = createOidcTokenExchanger({ fetch: fetchImplementation, clock, resolveIdToken });
+    return {
+        async fetchTarball(tarballUrl, tarballIntegrity, registrySettings) {
+            return fetchPackageTarball(npmFetch, tarballUrl, tarballIntegrity, registrySettings);
+        },
+        async publishPackage(...[manifest, tarData, registrySettings, publishSettings, stage]) {
+            const authOptions = await oidcExchanger.resolveWriteAuthOptions(manifest.name, registrySettings);
+            const publishOptionsFromSettings = buildPublishOptionsForPublishSettings(publishSettings);
+            const publishOptions = {
+                defaultTag: 'latest',
+                ...authOptions,
+                ...publishOptionsFromSettings,
+                ...stage ? { stage: true } : {}
+            };
+            const publishOptionsWithOneTimePassword = {
+                ...publishOptions,
+                otpPrompt: promptForOneTimePassword
+            };
+            const publishOptionsForOneTimePassword = promptForOneTimePassword === undefined
+                ? publishOptions
+                : publishOptionsWithOneTimePassword;
+            const publishPromise = publish(manifest, tarData, publishOptionsForOneTimePassword);
+            const readOutcome = stage ? readStagedPublicationOutcome : readPublishedPublicationOutcome;
+            return readPublicationOutcome(publishPromise, readOutcome, publishSettings);
+        },
+        async fetchLatestVersion(packageName, registrySettings) {
+            return fetchLatestPackageVersion(npmFetch, packageName, registrySettings);
+        },
+        async fetchStagedVersions(packageName, registrySettings) {
+            return fetchStagedPackageVersions(npmFetch, packageName, registrySettings);
+        },
+        async fetchLatestReleaseMetadata(packageName, registrySettings) {
+            return fetchLatestPackageReleaseMetadata(npmFetch, packageName, registrySettings);
+        },
+        async fetchVersionReleaseMetadata(packageName, version, registrySettings) {
+            return fetchPackageVersionReleaseMetadata(npmFetch, packageName, version, registrySettings);
+        }
+    };
+}
 //# sourceMappingURL=registry-client.js.map

package/bundle-emitter/registry/registry-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-client.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-client.ts"],"names":[],"mappings":"AAKA,OAAgF,2BAA2B,CAAC;AAC5G,OAAyC,0BAA0B,CAAC;AACpE,OASO,+BAA+B,CAAC;AACvC,OAAyE,8BAA8B,CAAC"}
+{"version":3,"file":"registry-client.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-client.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAA2B,MAAM,2BAA2B,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACH,iCAAiC,EACjC,mBAAmB,EACnB,yBAAyB,EACzB,kCAAkC,EAClC,0BAA0B,EAI7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qCAAqC,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAgDxG,SAAS,eAAe,CAAC,QAAiB;IACtC,OAAO,CACH,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CACrC,CAAC;AACN,CAAC;AAED,SAAS,UAAU,CAAC,QAAiB;IACjC,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,WAAW,CAAC,QAAiB;IAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,cAA8B;IACzE,MAAM,cAAc,CAAC;IACrB,OAAO,mBAAmB,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,cAA8B;IACtE,OAAO,iBAAiB,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,sBAAsB,CACjC,cAA8B,EAC9B,WAA4E,EAC5E,eAAgC;IAEhC,IAAI,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,iBAAiB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAAkD;IACnF,MAAM,EACF,QAAQ,EACR,OAAO,EACP,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EACL,wBAAwB,EACxB,cAAc,EACjB,GAAG,YAAY,CAAC;IACjB,MAAM,aAAa,GAAG,wBAAwB,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAEtG,OAAO;QACH,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,gBAAgB,EAAE,gBAAgB;YAC7D,OAAO,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QACzF,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,GAAG,CAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,CAAE;YACnF,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACjG,MAAM,0BAA0B,GAAG,qCAAqC,CAAC,eAAe,CAAC,CAAC;YAC1F,MAAM,cAAc,GAA6B;gBAC7C,UAAU,EAAE,QAAQ;gBACpB,GAAG,WAAW;gBACd,GAAG,0BAA0B;gBAC7B,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;aAClC,CAAC;YACF,MAAM,iCAAiC,GAAsC;gBACzE,GAAG,cAAc;gBACjB,SAAS,EAAE,wBAAwB;aACtC,CAAC;YACF,MAAM,gCAAgC,GAAG,wBAAwB,KAAK,SAAS;gBAC3E,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,iCAAiC,CAAC;YACxC,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,gCAAgC,CAAC,CAAC;YACpF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,+BAA+B,CAAC;YAE3F,OAAO,sBAAsB,CAAC,cAAc,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE,gBAAgB;YAClD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE,gBAAgB;YACnD,OAAO,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC/E,CAAC;QAED,KAAK,CAAC,0BAA0B,CAAC,WAAW,EAAE,gBAAgB;YAC1D,OAAO,iCAAiC,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACtF,CAAC;QAED,KAAK,CAAC,2BAA2B,CAAC,WAAW,EAAE,OAAO,EAAE,gBAAgB;YACpE,OAAO,kCAAkC,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAChG,CAAC;KACJ,CAAC;AACN,CAAC"}

package/bundle-emitter/registry/registry-package-path.js

@@ -1 +1,4 @@
+export function toRegistryPackagePath(packageName) {
+    return packageName.replace('/', '%2F');
+}
 //# sourceMappingURL=registry-package-path.js.map

package/bundle-emitter/registry/registry-package-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-package-path.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-package-path.ts"],"names":[],"mappings":""}
+{"version":3,"file":"registry-package-path.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-package-path.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACrD,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC"}

package/bundle-emitter/registry/registry-response-schemas.js

@@ -1,3 +1,51 @@
-import 'zod/mini';
-import "../../common/schema-validation.js";
+import { z } from 'zod/mini';
+import { safeParse } from "../../common/schema-validation.js";
+const packageVersionDetailsSchema = z.object({
+    dist: z.object({
+        tarball: z.string(),
+        integrity: z.optional(z.unknown()),
+        shasum: z.optional(z.unknown())
+    }),
+    gitHead: z.optional(z.string())
+});
+const abbreviatedPackageResponseSchema = z.object({
+    name: z.string(),
+    'dist-tags': z.object({
+        latest: z.optional(z.string())
+    }),
+    versions: z.record(z.string(), packageVersionDetailsSchema)
+});
+const fullPackageResponseSchema = z.object({
+    name: z.string(),
+    'dist-tags': z.object({
+        latest: z.optional(z.string())
+    }),
+    time: z.optional(z.record(z.string(), z.string())),
+    versions: z.record(z.string(), packageVersionDetailsSchema)
+});
+const oidcExchangeResponseSchema = z.object({
+    token: z.string(),
+    expires: z.coerce.date()
+});
+function isRecord(response) {
+    return typeof response === 'object' && response !== null && !Array.isArray(response);
+}
+export function parseAbbreviatedPackageResponse(response) {
+    const result = abbreviatedPackageResponseSchema.safeParse(response);
+    return result.success ? result.data : undefined;
+}
+export function parseFullPackageResponse(response) {
+    const result = fullPackageResponseSchema.safeParse(response);
+    return result.success ? result.data : undefined;
+}
+export function parseOidcExchangeResponse(response) {
+    if (!isRecord(response)) {
+        return { success: false, issues: ['expected object'] };
+    }
+    const result = safeParse(oidcExchangeResponseSchema, response);
+    if (result.success) {
+        return { success: true, data: result.data };
+    }
+    return { success: false, issues: result.error.issues };
+}
 //# sourceMappingURL=registry-response-schemas.js.map

package/bundle-emitter/registry/registry-response-schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-response-schemas.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-response-schemas.ts"],"names":[],"mappings":"AAAA,OAAkB,UAAU,CAAC;AAC7B,OAA0B,mCAAmC,CAAC"}
+{"version":3,"file":"registry-response-schemas.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-response-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAE9D,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KAClC,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;CAC9D,CAAC,CAAC;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CAC3B,CAAC,CAAC;AAqDH,SAAS,QAAQ,CAAC,QAAiB;IAC/B,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,QAAiB;IAC7D,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAiB;IACtD,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE,iBAAiB,CAAE,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC"}

package/bundle-emitter/registry/tarball-integrity.d.ts

@@ -2,4 +2,5 @@ export type TarballIntegrity = {
     readonly integrity: string | undefined;
     readonly shasum: string | undefined;
 };
+export declare function assertTarballIntegrity(tarball: Buffer, tarballIntegrity: TarballIntegrity): void;
 //# sourceMappingURL=tarball-integrity.d.ts.map

package/bundle-emitter/registry/tarball-integrity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tarball-integrity.d.ts","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/tarball-integrity.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,CAAC"}
+{"version":3,"file":"tarball-integrity.d.ts","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/tarball-integrity.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,CAAC;AA0BF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAQhG"}

package/bundle-emitter/registry/tarball-integrity.js

@@ -1,2 +1,32 @@
-import 'ssri';
+import ssri from 'ssri';
+const sha1HexPattern = /^[a-f0-9]{40}$/u;
+function assertIntegrityMetadataMatches(tarball, integrity) {
+    try {
+        ssri.checkData(tarball, integrity, { strict: true, error: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Downloaded tarball failed dist.integrity verification: ${message}`, { cause: error });
+    }
+}
+function assertShasumMetadataMatches(tarball, shasum) {
+    if (!sha1HexPattern.test(shasum)) {
+        throw new Error(`Registry returned invalid dist.shasum "${shasum}"`);
+    }
+    try {
+        ssri.checkData(tarball, ssri.fromHex(shasum, 'sha1'), { error: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Downloaded tarball failed dist.shasum verification: ${message}`, { cause: error });
+    }
+}
+export function assertTarballIntegrity(tarball, tarballIntegrity) {
+    if (tarballIntegrity.integrity !== undefined) {
+        assertIntegrityMetadataMatches(tarball, tarballIntegrity.integrity);
+    }
+    if (tarballIntegrity.shasum !== undefined) {
+        assertShasumMetadataMatches(tarball, tarballIntegrity.shasum);
+    }
+}
 //# sourceMappingURL=tarball-integrity.js.map

package/bundle-emitter/registry/tarball-integrity.js.map

@@ -1 +1 @@
-{"version":3,"file":"tarball-integrity.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/tarball-integrity.ts"],"names":[],"mappings":"AAAA,OAAiB,MAAM,CAAC;AAOD"}
+{"version":3,"file":"tarball-integrity.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/tarball-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAOxB,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,SAAS,8BAA8B,CAAC,OAAe,EAAE,SAAiB;IACtE,IAAI,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,0DAA0D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3G,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe,EAAE,MAAc;IAChE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,uDAAuD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,gBAAkC;IACtF,IAAI,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3C,8BAA8B,CAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,2BAA2B,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;AACL,CAAC"}

package/bundle-emitter/registry/validate-tarball-host.js

@@ -1,2 +1,27 @@
-import "./registry-auth-config.js";
+import { npmRegistryUrl } from "./registry-auth-config.js";
+function resolveConfiguredOrigin(registrySettings) {
+    const configuredUrl = new URL(registrySettings.registryUrl ?? npmRegistryUrl);
+    return configuredUrl.origin;
+}
+function parseTarballOrigin(tarballUrl) {
+    try {
+        const parsedUrl = new URL(tarballUrl);
+        return parsedUrl.origin;
+    }
+    catch {
+        throw new TypeError(`Registry returned an invalid tarball URL: "${tarballUrl}"`);
+    }
+}
+function buildMismatchMessage(tarballOrigin, configuredOrigin) {
+    return (`Refusing to download tarball from "${tarballOrigin}" because it differs from the configured registry origin ` +
+        `"${configuredOrigin}". A tampered registry response could redirect the request and exfiltrate ` +
+        'publish credentials.');
+}
+export function assertTarballOriginMatchesRegistry(tarballUrl, registrySettings) {
+    const tarballOrigin = parseTarballOrigin(tarballUrl);
+    const configuredOrigin = resolveConfiguredOrigin(registrySettings);
+    if (tarballOrigin !== configuredOrigin) {
+        throw new Error(buildMismatchMessage(tarballOrigin, configuredOrigin));
+    }
+}
 //# sourceMappingURL=validate-tarball-host.js.map

package/bundle-emitter/registry/validate-tarball-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-tarball-host.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/validate-tarball-host.ts"],"names":[],"mappings":"AACA,OAA+B,2BAA2B,CAAC"}
+{"version":3,"file":"validate-tarball-host.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/validate-tarball-host.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,SAAS,uBAAuB,CAAC,gBAA4C;IACzE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC9E,OAAO,aAAa,CAAC,MAAM,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC1C,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,SAAS,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;IACrF,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,aAAqB,EAAE,gBAAwB;IACzE,OAAO,CACH,sCAAsC,aAAa,2DAA2D;QAC9G,IAAI,gBAAgB,4EAA4E;QAChG,sBAAsB,CACzB,CAAC;AACN,CAAC;AAED,MAAM,UAAU,kCAAkC,CAC9C,UAAkB,EAClB,gBAA4C;IAE5C,MAAM,aAAa,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAEnE,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3E,CAAC;AACL,CAAC"}

package/bundle-emitter/release-artifact-canonicalizer.js

@@ -1,6 +1,32 @@
-import 'remeda';
-import 'true-myth/result';
-import "../common/package-layout.js";
-import "../common/stable-json.js";
-import "../sbom/sbom-canonicalizer.js";
+import { isPlainObject } from 'remeda';
+import { tryOr } from 'true-myth/result';
+import { bundleRelativePath, packageManifestFilePath } from "../common/package-layout.js";
+import { serializeStableJson } from "../common/stable-json.js";
+import { canonicalizeSbomInFileSet } from "../sbom/sbom-canonicalizer.js";
+function canonicalizeManifestContent(content) {
+    const parsedResult = tryOr(undefined, function () {
+        return JSON.parse(content);
+    });
+    if (parsedResult.isErr) {
+        return content;
+    }
+    const parsed = parsedResult.value;
+    if (!isPlainObject(parsed)) {
+        return content;
+    }
+    const withoutGitHead = { ...parsed };
+    delete withoutGitHead.gitHead;
+    return serializeStableJson(withoutGitHead);
+}
+function canonicalizePackageManifestInFileSet(files) {
+    return files.map(function (file) {
+        if (bundleRelativePath(file.filePath) !== packageManifestFilePath) {
+            return file;
+        }
+        return { ...file, content: canonicalizeManifestContent(file.content) };
+    });
+}
+export function canonicalizeReleaseArtifactFiles(files) {
+    return canonicalizePackageManifestInFileSet(canonicalizeSbomInFileSet(files));
+}
 //# sourceMappingURL=release-artifact-canonicalizer.js.map

package/bundle-emitter/release-artifact-canonicalizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-artifact-canonicalizer.js","sourceRoot":"","sources":["../../../../source/bundle-emitter/release-artifact-canonicalizer.ts"],"names":[],"mappings":"AAAA,OAA8B,QAAQ,CAAC;AACvC,OAAsB,kBAAkB,CAAC;AACzC,OAA4D,6BAA6B,CAAC;AAC1F,OAAoC,0BAA0B,CAAC;AAE/D,OAA0C,+BAA+B,CAAC"}
+{"version":3,"file":"release-artifact-canonicalizer.js","sourceRoot":"","sources":["../../../../source/bundle-emitter/release-artifact-canonicalizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,SAAS,2BAA2B,CAAC,OAAe;IAChD,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,EAAE;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IACrC,OAAO,cAAc,CAAC,OAAO,CAAC;IAC9B,OAAO,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,oCAAoC,CAAC,KAAiC;IAC3E,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,IAAI;QAC3B,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,uBAAuB,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAiC;IAC9E,OAAO,oCAAoC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AAClF,CAAC"}

package/checks/check-runner.d.ts

@@ -0,0 +1,18 @@
+import type { ChecksSettings, PackageChecksSettings, PackageConfigsByName } from '../config/config.ts';
+import type { AnalyzedBundle } from '../dead-code-eliminator/analyzed-bundle.ts';
+import type { PublishedPackageWithManifest } from '../published-package/published-package.ts';
+import type { AllCheckRules } from './rules/registry.ts';
+export type CheckRunnerDependencies = {
+    readonly rules: AllCheckRules;
+};
+type CheckRunnerInput = {
+    readonly bundles: readonly AnalyzedBundle[];
+    readonly publishedPackages: ReadonlyMap<string, PublishedPackageWithManifest> | undefined;
+    readonly settings: ChecksSettings | undefined;
+    readonly perPackageSettings: ReadonlyMap<string, PackageChecksSettings | undefined>;
+    readonly packageConfigs: PackageConfigsByName;
+};
+export type CheckRunner = (input: CheckRunnerInput) => Promise<readonly string[]>;
+export declare function createCheckRunner(dependencies: CheckRunnerDependencies): CheckRunner;
+export {};
+//# sourceMappingURL=check-runner.d.ts.map

package/checks/check-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-runner.d.ts","sourceRoot":"","sources":["../../../../source/checks/check-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACvG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAC9F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CACjC,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,4BAA4B,CAAC,GAAG,SAAS,CAAC;IAC1F,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC,CAAC;IACpF,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAElF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,uBAAuB,GAAG,WAAW,CASpF"}

package/checks/check-runner.js

@@ -1 +1,9 @@
+export function createCheckRunner(dependencies) {
+    return async function runChecks(input) {
+        const issues = await Promise.all(dependencies.rules.map(async function (rule) {
+            return await rule.run(input);
+        }));
+        return issues.flat();
+    };
+}
 //# sourceMappingURL=check-runner.js.map

package/checks/check-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-runner.js","sourceRoot":"","sources":["../../../../source/checks/check-runner.ts"],"names":[],"mappings":""}
+{"version":3,"file":"check-runner.js","sourceRoot":"","sources":["../../../../source/checks/check-runner.ts"],"names":[],"mappings":"AAmBA,MAAM,UAAU,iBAAiB,CAAC,YAAqC;IACnE,OAAO,KAAK,UAAU,SAAS,CAAC,KAAK;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,WAAW,IAAI;YACvC,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CACL,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;AACN,CAAC"}

package/checks/rule.d.ts

@@ -0,0 +1,42 @@
+import { z, type ZodMiniType } from 'zod/mini';
+import type { AnalyzedBundle } from '../dead-code-eliminator/analyzed-bundle.ts';
+import type { PublishedPackageWithManifest } from '../published-package/published-package.ts';
+export declare const enabledOnlyGlobalSchema: z.ZodMiniObject<{
+    enabled: z.ZodMiniBoolean<boolean>;
+}, z.core.$strict>;
+export declare const emptyPerPackageSchema: z.ZodMiniObject<{}, z.core.$strict>;
+export declare const pathAllowListGlobalSchema: z.ZodMiniObject<{
+    allowList: z.ZodMiniOptional<z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>>;
+    enabled: z.ZodMiniBoolean<boolean>;
+}, z.core.$strict>;
+export declare const pathAllowListPerPackageSchema: z.ZodMiniObject<{
+    allowList: z.ZodMiniOptional<z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>>;
+}, z.core.$strict>;
+type RuleGlobalConfig = {
+    readonly enabled: boolean;
+};
+type MainPackageJsonShape = {
+    readonly dependencies?: Readonly<Record<string, string>> | undefined;
+    readonly devDependencies?: Readonly<Record<string, string>> | undefined;
+    readonly peerDependencies?: Readonly<Record<string, string>> | undefined;
+};
+export type RulePackageConfig = {
+    readonly bundleDependencies?: readonly string[] | undefined;
+    readonly bundlePeerDependencies?: readonly string[] | undefined;
+    readonly mainPackageJson?: MainPackageJsonShape | undefined;
+};
+export type RuleRunInput<TName extends string, TGlobal extends RuleGlobalConfig, TPerPackage> = {
+    readonly bundles: readonly AnalyzedBundle[];
+    readonly publishedPackages?: ReadonlyMap<string, PublishedPackageWithManifest> | undefined;
+    readonly settings: Readonly<Partial<Readonly<Record<TName, TGlobal | undefined>>>> | undefined;
+    readonly perPackageSettings: ReadonlyMap<string, Readonly<Partial<Readonly<Record<TName, TPerPackage | undefined>>>> | undefined>;
+    readonly packageConfigs?: Readonly<Record<string, RulePackageConfig>>;
+};
+export type CheckRuleDefinition<TName extends string, TGlobal extends RuleGlobalConfig, TPerPackage> = {
+    readonly name: TName;
+    readonly globalSchema: ZodMiniType<TGlobal>;
+    readonly perPackageSchema: ZodMiniType<TPerPackage>;
+    readonly run: (input: RuleRunInput<TName, TGlobal, TPerPackage>) => Promise<readonly string[]>;
+};
+export {};
+//# sourceMappingURL=rule.d.ts.map

package/checks/rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.d.ts","sourceRoot":"","sources":["../../../../source/checks/rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAE9F,eAAO,MAAM,uBAAuB;;kBAA2C,CAAC;AAChF,eAAO,MAAM,qBAAqB,qCAAqB,CAAC;AAMxD,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;kBAAqC,CAAC;AAEhF,KAAK,gBAAgB,GAAG;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,KAAK,oBAAoB,GAAG;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,YAAY,CAAC,KAAK,SAAS,MAAM,EAAE,OAAO,SAAS,gBAAgB,EAAE,WAAW,IAAI;IAC5F,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,4BAA4B,CAAC,GAAG,SAAS,CAAC;IAC3F,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CACpC,MAAM,EACN,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAClF,CAAC;IACF,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;CACzE,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,KAAK,SAAS,MAAM,EAAE,OAAO,SAAS,gBAAgB,EAAE,WAAW,IAAI;IACnG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CAClG,CAAC"}

package/checks/rule.js

@@ -1,3 +1,13 @@
-import 'zod/mini';
-import "../config/base-validations.js";
+import { z } from 'zod/mini';
+import { nonEmptyStringSchema } from "../config/base-validations.js";
+export const enabledOnlyGlobalSchema = z.strictObject({ enabled: z.boolean() });
+export const emptyPerPackageSchema = z.strictObject({});
+const pathAllowListShape = {
+    allowList: z.optional(z.readonly(z.array(nonEmptyStringSchema)))
+};
+export const pathAllowListGlobalSchema = z.strictObject({
+    enabled: z.boolean(),
+    ...pathAllowListShape
+});
+export const pathAllowListPerPackageSchema = z.strictObject(pathAllowListShape);
 //# sourceMappingURL=rule.js.map

package/checks/rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../../../source/checks/rule.ts"],"names":[],"mappings":"AAAA,OAAoC,UAAU,CAAC;AAC/C,OAAqC,+BAA+B,CAAC"}
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../../../source/checks/rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAoB,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAExD,MAAM,kBAAkB,GAAG;IACvB,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;CACnE,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,GAAG,kBAAkB;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC"}

package/checks/rules/duplicate-detection.js

@@ -1,2 +1,24 @@
-import "./duplicate-messages.js";
+import { formatPathLevelMessage, formatSharedDeclarationsMessage } from "./duplicate-messages.js";
+const minimumOwnerCountForDuplicate = 2;
+export function hasMultipleOwners(owners) {
+    return owners.length >= minimumOwnerCountForDuplicate;
+}
+export function duplicateMessage(filePath, owners) {
+    const allOwnersHaveNoBindings = owners.every(function (owner) {
+        return owner.survivingBindings.size === 0;
+    });
+    if (allOwnersHaveNoBindings) {
+        return formatPathLevelMessage(filePath, owners);
+    }
+    const [firstOwner, ...remainingOwners] = owners;
+    const sharedDeclarations = remainingOwners.reduce(function (declarations, owner) {
+        return new Set(Array.from(declarations).filter(function (declaration) {
+            return owner.survivingBindings.has(declaration);
+        }));
+    }, new Set(firstOwner.survivingBindings));
+    if (sharedDeclarations.size === 0) {
+        return undefined;
+    }
+    return formatSharedDeclarationsMessage(filePath, sharedDeclarations, owners);
+}
 //# sourceMappingURL=duplicate-detection.js.map

package/checks/rules/duplicate-detection.js.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate-detection.js","sourceRoot":"","sources":["../../../../../source/checks/rules/duplicate-detection.ts"],"names":[],"mappings":"AAAA,OAAwE,yBAAyB,CAAC"}
+{"version":3,"file":"duplicate-detection.js","sourceRoot":"","sources":["../../../../../source/checks/rules/duplicate-detection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAKlG,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAExC,MAAM,UAAU,iBAAiB,CAAC,MAA4B;IAC1D,OAAO,MAAM,CAAC,MAAM,IAAI,6BAA6B,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAsB;IACrE,MAAM,uBAAuB,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK;QACxD,OAAO,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,IAAI,uBAAuB,EAAE,CAAC;QAC1B,OAAO,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,CAAE,UAAU,EAAE,GAAG,eAAe,CAAE,GAAG,MAAM,CAAC;IAClD,MAAM,kBAAkB,GAAG,eAAe,CAAC,MAAM,CAAc,UAAU,YAAY,EAAE,KAAK;QACxF,OAAO,IAAI,GAAG,CACV,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,UAAU,WAAW;YACjD,OAAO,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC,CACL,CAAC;IACN,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1C,IAAI,kBAAkB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,+BAA+B,CAAC,QAAQ,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC"}

package/checks/rules/duplicate-messages.js

@@ -1 +1,23 @@
+function ownerNames(owners) {
+    const bundleNames = owners.map(function (owner) {
+        return owner.bundleName;
+    });
+    return bundleNames.toSorted(function (left, right) {
+        return left.localeCompare(right);
+    });
+}
+export function formatSharedDeclarationsMessage(filePath, sharedDeclarations, owners) {
+    const ownersList = ownerNames(owners).join(', ');
+    const sortedDeclarations = Array.from(sharedDeclarations).toSorted(function (left, right) {
+        return left.localeCompare(right);
+    });
+    const lines = [`File "${filePath}" has shared declarations across multiple packages:`];
+    for (const declaration of sortedDeclarations) {
+        lines.push(`  - "${declaration}" → ${ownersList}`);
+    }
+    return lines.join('\n');
+}
+export function formatPathLevelMessage(filePath, owners) {
+    return `File "${filePath}" is included in multiple packages: ${ownerNames(owners).join(', ')}`;
+}
 //# sourceMappingURL=duplicate-messages.js.map

package/checks/rules/duplicate-messages.js.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate-messages.js","sourceRoot":"","sources":["../../../../../source/checks/rules/duplicate-messages.ts"],"names":[],"mappings":""}
+{"version":3,"file":"duplicate-messages.js","sourceRoot":"","sources":["../../../../../source/checks/rules/duplicate-messages.ts"],"names":[],"mappings":"AAEA,SAAS,UAAU,CAAC,MAA4B;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK;QAC1C,OAAO,KAAK,CAAC,UAAU,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,KAAK;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC3C,QAAgB,EAChB,kBAAuC,EACvC,MAA4B;IAE5B,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,KAAK;QACpF,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAE,SAAS,QAAQ,qDAAqD,CAAE,CAAC;IAEzF,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,QAAQ,WAAW,OAAO,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,MAA4B;IACjF,OAAO,SAAS,QAAQ,uCAAuC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACnG,CAAC"}

package/checks/rules/file-ownership.js

@@ -1 +1,16 @@
+export function collectFileOwnership(bundles) {
+    const ownership = new Map();
+    for (const bundle of bundles) {
+        for (const resource of bundle.contents) {
+            const filePath = resource.fileDescription.inputFilePath;
+            const owners = ownership.get(filePath) ?? [];
+            owners.push({
+                bundleName: bundle.name,
+                survivingBindings: resource.analysis.survivingBindings
+            });
+            ownership.set(filePath, owners);
+        }
+    }
+    return ownership;
+}
 //# sourceMappingURL=file-ownership.js.map

package/checks/rules/file-ownership.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-ownership.js","sourceRoot":"","sources":["../../../../../source/checks/rules/file-ownership.ts"],"names":[],"mappings":""}
+{"version":3,"file":"file-ownership.js","sourceRoot":"","sources":["../../../../../source/checks/rules/file-ownership.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,oBAAoB,CAChC,OAA6D;IAE7D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,aAAa,CAAC;YACxD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACR,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB;aACzD,CAAC,CAAC;YACH,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/checks/rules/max-bundle-size.d.ts

@@ -0,0 +1,13 @@
+import type { CheckRuleDefinition } from '../rule.ts';
+declare function ruleName(): 'maxBundleSize';
+type RuleName = ReturnType<typeof ruleName>;
+type GlobalConfig = {
+    readonly enabled: boolean;
+    readonly bytes?: number | undefined;
+};
+type PerPackageConfig = {
+    readonly bytes?: number | undefined;
+};
+export declare const maxBundleSizeRule: CheckRuleDefinition<RuleName, GlobalConfig, PerPackageConfig>;
+export {};
+//# sourceMappingURL=max-bundle-size.d.ts.map

package/checks/rules/max-bundle-size.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"max-bundle-size.d.ts","sourceRoot":"","sources":["../../../../../source/checks/rules/max-bundle-size.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAgB,MAAM,YAAY,CAAC;AAEpE,iBAAS,QAAQ,IAAI,eAAe,CAEnC;AAID,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAC5C,KAAK,YAAY,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAAE,CAAC;AACxF,KAAK,gBAAgB,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAAE,CAAC;AAgDjE,eAAO,MAAM,iBAAiB,EAAE,mBAAmB,CAAC,QAAQ,EAAE,YAAY,EAAE,gBAAgB,CAW3F,CAAC"}

package/checks/rules/max-bundle-size.js

@@ -1,2 +1,56 @@
-import 'zod/mini';
+import { z } from 'zod/mini';
+function ruleName() {
+    return 'maxBundleSize';
+}
+const byteLimitSchema = z.number().check(z.int(), z.nonnegative());
+function globalSchema() {
+    return z.strictObject({
+        enabled: z.boolean(),
+        bytes: z.optional(byteLimitSchema)
+    });
+}
+function perPackageSchema() {
+    return z.strictObject({
+        bytes: z.optional(byteLimitSchema)
+    });
+}
+function bundleSizeBytes(bundle) {
+    let total = 0;
+    for (const resource of bundle.contents) {
+        total += Buffer.byteLength(resource.fileDescription.content);
+    }
+    return total;
+}
+function checkBundle(bundle, threshold) {
+    if (threshold === undefined) {
+        return [];
+    }
+    const size = bundleSizeBytes(bundle);
+    if (size <= threshold) {
+        return [];
+    }
+    return [`Package "${bundle.name}" exceeds the maximum bundle size: ${size} bytes (limit: ${threshold} bytes)`];
+}
+async function run(input) {
+    const globalConfig = input.settings?.maxBundleSize;
+    if (globalConfig?.enabled !== true) {
+        return [];
+    }
+    return input.bundles.flatMap(function (bundle) {
+        const override = input.perPackageSettings.get(bundle.name)?.maxBundleSize?.bytes;
+        return checkBundle(bundle, override ?? globalConfig.bytes);
+    });
+}
+export const maxBundleSizeRule = {
+    get name() {
+        return ruleName();
+    },
+    get globalSchema() {
+        return globalSchema();
+    },
+    get perPackageSchema() {
+        return perPackageSchema();
+    },
+    run
+};
 //# sourceMappingURL=max-bundle-size.js.map