Validate, pack, and inspect

Validate the project

fabled module validate .
fabled module validate . --json

Validation reads only the manifest and declared assets. It checks the locked v1 schemas and catalogs, cross-references, hashes and lengths, version ranges, target/capability consent, contribution conditions, settings, storage/migrations, services, and reviewed declarative assets. JSON mode writes one machine-readable result.

Pack deterministically

fabled module pack .
fabled module pack . --output dist/release.zip

Packing validates first, canonicalizes the manifest, includes only declared assets, and writes a deterministic STORE-only ZIP with fixed timestamps. The output includes its SHA-256 digest; keep that digest with the release evidence.

Inspect the artifact

fabled module inspect dist/release.zip
fabled module inspect dist/release.zip --json

Inspect rejects encryption, compression, ZIP64, data descriptors, comments, links, path traversal, duplicate paths, case collisions, undeclared files, and digest/length mismatches. Human output reports the package id and version, entry count, total bytes, and archive SHA-256. Add --json to receive the validated manifest, per-entry byte counts and hashes, complete archive accounting, and warnings. Neither mode executes content.

Archive profile