Verify an agent-to-agent quote handoff

// Generated from the Primitive agent-email example. Review before running.
import { createHash } from "node:crypto";
import { existsSync, mkdirSync, writeFileSync } from "node:fs";
import { dirname, resolve, sep } from "node:path";

const target = resolve("primitive-agent-email");
const url = "https://docs.getmillwork.dev/downloads/primitive-agent-email.json";
const expected = "62418fab4aa0d2026a1f716f215554e5ca31c70278ee8cb0f578beb95a11b8b4";
const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
if (existsSync(target)) throw new Error("Target directory already exists; choose a clean location");
const response = await fetch(url);
if (!response.ok) throw new Error(`Example download failed (HTTP ${response.status})`);
const limit = 1_000_000;
if (Number(response.headers.get("content-length") ?? 0) > limit) {
  await response.body?.cancel();
  throw new Error("Example bundle is too large");
}
if (!response.body) throw new Error("Example download returned no body");
const reader = response.body.getReader();
const chunks = [];
let received = 0;
for (;;) {
  const { done, value } = await reader.read();
  if (done) break;
  received += value.byteLength;
  if (received > limit) {
    await reader.cancel();
    throw new Error("Example bundle is too large");
  }
  chunks.push(value);
}
const bytes = Buffer.concat(chunks);
const bundle = JSON.parse(bytes.toString("utf8"));
if (!Array.isArray(bundle.files) || bundle.files.length !== 55) throw new Error("Unexpected example file inventory");
const seen = new Set();
const contents = [];
for (const { path: name, sha256: digest, content } of bundle.files) {
  if (typeof name !== "string" || !name || name.startsWith("/") || name.includes("\\") || name.split("/").some((part) => !part || part === "." || part === "..") || seen.has(name)) throw new Error("Unsafe or duplicate file path");
  if (typeof digest !== "string" || !/^[0-9a-f]{64}$/.test(digest) || typeof content !== "string") throw new Error("Invalid file entry");
  const path = resolve(target, name);
  if (!path.startsWith(target + sep)) throw new Error("Unsafe target path");
  const data = Buffer.from(content, "utf8");
  if (sha256(data) !== digest) throw new Error(`Checksum mismatch: ${name}`);
  seen.add(name);
  contents.push({ name, digest, path, data });
}
const actual = sha256(contents.map(({ name, digest }) => `${name}\0${digest}\n`).join(""));
if (actual !== expected || bundle.aggregate_sha256 !== expected) throw new Error("Bundle manifest mismatch");
for (const { path, data } of contents) {
  mkdirSync(dirname(path), { recursive: true });
  writeFileSync(path, data, { flag: "wx" });
}
process.stdout.write(`Created ${target} with ${contents.length} checked files.\n`);