stricter checks

tests/package.test.ts

@@ -3,6 +3,7 @@ import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { Host } from "@opencode/plugin/host";
+import { z } from "zod";
 import { build } from "../scripts/build.js";
 import { install } from "../scripts/install.js";
 
@@ -23,13 +24,19 @@ test("packed package has independent native plugins and quota-only TUI discovery
         });
         expect(await unpack.exited).toBe(0);
         const source = join(directory, "package");
-        const manifest = await Bun.file(join(source, "package.json")).json();
+        const manifest = z
+            .object({ exports: z.record(z.string(), z.object({ import: z.string() }).loose()) })
+            .loose()
+            .parse(await Bun.file(join(source, "package.json")).json());
+        const entrypoint = (name: string) =>
+            join(source, z.string().parse(manifest.exports[name]?.import));
         expect(manifest.exports["."]).toBeUndefined();
         expect(await Bun.file(join(source, "index.js")).exists()).toBe(false);
         expect(await Bun.file(join(source, "dist", "index.js")).exists()).toBe(false);
         for (const name of ["agents", "multi-work", "quota"]) {
-            const entrypoint = join(source, manifest.exports[`./${name}`].import);
-            const { default: plugin } = await import(entrypoint);
+            const { default: plugin } = z
+                .object({ default: z.object({ id: z.string() }).loose() })
+                .parse(await import(entrypoint(`./${name}`)));
             expect(plugin.id).toBe(`stanp-opencode.${name}`);
         }
         const config = join(directory, "config");
@@ -42,7 +49,9 @@ test("packed package has independent native plugins and quota-only TUI discovery
             expect(entries.server).toBeDefined();
             expect(entries.tui !== undefined).toBe(name === "quota");
         }
-        const { QuotaRpc } = await import(join(source, manifest.exports["./quota-rpc"].import));
+        const { QuotaRpc } = z
+            .object({ QuotaRpc: z.object({ id: z.string() }).loose() })
+            .parse(await import(entrypoint("./quota-rpc")));
         expect(QuotaRpc.id).toBe("stanp-opencode.quota");
     } finally {
         await rm(directory, { recursive: true, force: true });