Build checked portable package artifacts and shared runtime assets

src/execution-world/files.ts

@@ -99,6 +99,13 @@ export interface ArtifactResponse {
   headers: Record<string, string>;
   body: Uint8Array;
 }
+/** Shared runtime imports use content identity, independent of the importing package/world.
+ * The file remains covered by every importing implementation's checked manifest. */
+export function contentArtifactUrl(file: Pick<ArtifactFile, "path" | "digest">): string {
+  if (!/^[0-9a-f]{64}$/.test(file.digest)) fail(file.path, "Invalid content digest");
+  artifactPath(file.path);
+  return `/__quixos/artifacts/content/${file.digest}/${encodeURIComponent(path.basename(file.path))}`;
+}
 /** This registry is placed behind the workspace gateway's existing authentication.
  * Lookup uses an explicit URL table; request paths never become filesystem paths. */
 export class BrowserArtifactGateway {
@@ -124,6 +131,14 @@ export class BrowserArtifactGateway {
           )
             fail(url, "Conflicting browser asset route");
           this.routes.set(url, { revision: manifest.packageRevisionId, file: Object.freeze({ ...file }) });
+          // Exact shared-file names are a packaging convention, never a path lookup capability.
+          if (file.path.startsWith("share/quixos/shared/")) {
+            const contentUrl = contentArtifactUrl(file);
+            const existing = this.routes.get(contentUrl);
+            if (existing && (existing.file.bytes !== file.bytes || existing.file.mediaType !== file.mediaType))
+              fail(contentUrl, "Conflicting shared asset metadata");
+            this.routes.set(contentUrl, { revision: manifest.packageRevisionId, file: Object.freeze({ ...file }) });
+          }
         }
         entries.push({
           url: prefix + implementation.path.split("/").map(encodeURIComponent).join("/"),