@angelmsger/fx 0.0.0-stage → 0.10.1

package/dist/domain/manifest/rules/environments.js

@@ -0,0 +1,93 @@
+// Cross-field rules of environments.yaml, plus the cross-document checks
+// that a repository's overrides and the release policy only name platforms
+// and environments that exist. An undeclared platform is a contradiction,
+// not a suggestion.
+import { isSemver } from '../../semver.js';
+import { providerForPlatform } from '../providers.js';
+import { serviceRules } from './services.js';
+export function environmentsRules(doc, providers) {
+    const problems = [];
+    if (doc.min_cli !== undefined && !isSemver(doc.min_cli)) {
+        problems.push({ path: 'min_cli', message: 'must be a semantic version' });
+    }
+    if (Object.keys(doc.platforms).length === 0) {
+        problems.push({ path: 'platforms', message: 'must declare at least one platform' });
+    }
+    if (Object.keys(doc.envs).length === 0) {
+        problems.push({ path: 'envs', message: 'must declare at least one environment' });
+    }
+    for (const [envName, env] of Object.entries(doc.envs)) {
+        for (const platform of Object.keys(env.platforms ?? {})) {
+            if (!(platform in doc.platforms)) {
+                problems.push({
+                    path: `envs.${envName}.platforms.${platform}`,
+                    message: `platform "${platform}" is not declared under platforms`,
+                });
+            }
+            const base = doc.platforms[platform];
+            const override = env.platforms?.[platform];
+            if (base?.service || override?.service)
+                problems.push(...serviceRules({
+                    providers,
+                    provider: base?.provider ?? providerForPlatform(providers, platform)?.id,
+                    service: { ...base?.service, ...override?.service },
+                    vars: { ...base?.vars, ...override?.vars },
+                    path: `envs.${envName}.platforms.${platform}.service`,
+                }));
+        }
+    }
+    return problems;
+}
+export function obsReferenceRules(workspace, environments) {
+    const problems = [];
+    workspace.repos.forEach((repo, i) => {
+        for (const [platform, byEnv] of Object.entries(repo.obs?.overrides ?? {})) {
+            const base = `repos[${i}].obs.overrides.${platform}`;
+            if (!(platform in environments.platforms)) {
+                problems.push({
+                    path: base,
+                    message: `platform "${platform}" is not declared in environments.yaml`,
+                });
+                continue;
+            }
+            for (const env of Object.keys(byEnv)) {
+                if (!(env in environments.envs)) {
+                    problems.push({
+                        path: `${base}.${env}`,
+                        message: `environment "${env}" is not declared in environments.yaml`,
+                    });
+                }
+            }
+        }
+    });
+    const known = new Set(workspace.repos.map((repo) => repo.name));
+    for (const [env, value] of Object.entries(environments.envs)) {
+        for (const [platform, coordinate] of Object.entries(value.platforms ?? {})) {
+            for (const repo of Object.keys(coordinate.observations ?? {})) {
+                if (!known.has(repo))
+                    problems.push({
+                        path: `envs.${env}.platforms.${platform}.observations.${repo}`,
+                        message: 'observation must name a shared repository',
+                    });
+            }
+        }
+    }
+    return problems;
+}
+export function releaseReferenceRules(workspace, environments) {
+    const problems = [];
+    const check = (path, env) => {
+        if (env !== undefined && !(env in environments.envs)) {
+            problems.push({ path, message: `environment "${env}" is not declared in environments.yaml` });
+        }
+    };
+    check('release.env', workspace.release?.env);
+    check('release.ci.source_env', workspace.release?.ci?.source_env);
+    check('release.ci.target_env', workspace.release?.ci?.target_env);
+    workspace.repos.forEach((repo, i) => {
+        check(`repos[${i}].release.ci.source_env`, repo.release?.ci?.source_env);
+        check(`repos[${i}].release.ci.target_env`, repo.release?.ci?.target_env);
+    });
+    return problems;
+}
+//# sourceMappingURL=environments.js.map

package/dist/domain/manifest/rules/environments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.js","sourceRoot":"","sources":["../../../../src/domain/manifest/rules/environments.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,oBAAoB;AAEpB,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAwB,MAAM,iBAAiB,CAAC;AAG5E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,UAAU,iBAAiB,CAC/B,GAAiB,EACjB,SAAsC;IAEtC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ,OAAO,cAAc,QAAQ,EAAE;oBAC7C,OAAO,EAAE,aAAa,QAAQ,mCAAmC;iBAClE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO;gBACpC,QAAQ,CAAC,IAAI,CACX,GAAG,YAAY,CAAC;oBACd,SAAS;oBACT,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE;oBACxE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE;oBACnD,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE;oBAC1C,IAAI,EAAE,QAAQ,OAAO,cAAc,QAAQ,UAAU;iBACtD,CAAC,CACH,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAoB,EAAE,YAA0B;IAChF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAClC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,mBAAmB,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI;oBACV,OAAO,EAAE,aAAa,QAAQ,wCAAwC;iBACvE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE;wBACtB,OAAO,EAAE,gBAAgB,GAAG,wCAAwC;qBACrE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBAClB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,QAAQ,GAAG,cAAc,QAAQ,iBAAiB,IAAI,EAAE;wBAC9D,OAAO,EAAE,2CAA2C;qBACrD,CAAC,CAAC;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAoB,EAAE,YAA0B;IACpF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,GAAuB,EAAQ,EAAE;QAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,GAAG,wCAAwC,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,KAAK,CAAC,uBAAuB,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IAClE,KAAK,CAAC,uBAAuB,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IAClE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAClC,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QACzE,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/domain/manifest/rules/harness.js

@@ -0,0 +1,64 @@
+// Resource rules enforce transport exclusivity and scan authored literals.
+// Findings name fields and constraints without repeating protected values.
+import { scanBoundary } from '../../boundary/scan.js';
+export function harnessRules(doc) {
+    const problems = [];
+    const names = new Set();
+    for (const [index, resource] of doc.mcp.entries()) {
+        const prefix = `mcp[${index}]`;
+        if (names.has(resource.name))
+            problems.push({ path: 'mcp', message: 'resource names must be unique' });
+        names.add(resource.name);
+        problems.push(...resourceProblems(resource).map((p) => ({ ...p, path: `${prefix}.${p.path}` })));
+    }
+    return problems;
+}
+function resourceProblems(resource) {
+    const problems = [];
+    const add = (path, message) => problems.push({ path, message });
+    if (resource.transport === 'stdio') {
+        if (!resource.command)
+            add('command', 'stdio requires a startup vector');
+        if (resource.url !== undefined || resource.headers !== undefined)
+            add('transport', 'stdio cannot declare HTTP fields');
+    }
+    else {
+        if (!isEndpoint(resource.url))
+            add('url', 'HTTP requires an endpoint without credentials, query or fragment');
+        if (resource.command !== undefined || resource.env !== undefined)
+            add('transport', 'HTTP cannot declare stdio fields');
+    }
+    const references = Object.values({ ...resource.env, ...resource.headers }).map((ref) => ref.from_env);
+    for (const name of references) {
+        if (!resource.variables?.[name])
+            add('variables', 'every referenced variable requires human setup instructions');
+    }
+    const literals = [
+        resource.name,
+        resource.description ?? '',
+        ...(resource.command ?? []),
+        resource.url ?? '',
+        ...(resource.check?.command ?? []),
+        JSON.stringify(resource.check?.json ?? null),
+        ...Object.values(resource.variables ?? {}).map((v) => v.instructions),
+    ];
+    if (literals.some((text) => scanBoundary({ text, policy: 'manifest' }).length > 0))
+        add('content', 'protected content is not allowed; use environment references');
+    return problems;
+}
+function isEndpoint(value) {
+    if (!value)
+        return false;
+    try {
+        const url = new URL(value);
+        return (['http:', 'https:'].includes(url.protocol) &&
+            !url.username &&
+            !url.password &&
+            !url.search &&
+            !url.hash);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=harness.js.map

package/dist/domain/manifest/rules/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../../../src/domain/manifest/rules/harness.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,2EAA2E;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,KAAK,GAAG,CAAC;QAC/B,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3E,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAqB;IAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,GAAG,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;YAC9D,GAAG,CAAC,WAAW,EAAE,kCAAkC,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3B,GAAG,CAAC,KAAK,EAAE,kEAAkE,CAAC,CAAC;QACjF,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS;YAC9D,GAAG,CAAC,WAAW,EAAE,kCAAkC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC5E,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CACtB,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC;YAC7B,GAAG,CAAC,WAAW,EAAE,6DAA6D,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,WAAW,IAAI,EAAE;QAC1B,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,IAAI,EAAE;QAClB,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC;QAC5C,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;KACtE,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAChF,GAAG,CAAC,SAAS,EAAE,8DAA8D,CAAC,CAAC;IACjF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CACL,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1C,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,MAAM;YACX,CAAC,GAAG,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/domain/manifest/rules/members.js

@@ -0,0 +1,36 @@
+// Cross-field rules of the members document: ids are unique and every
+// reference to a person resolves. The reserved id "all" means the whole
+// team and is never listed under people.
+import { isSemver } from '../../semver.js';
+const ALL = 'all';
+export function membersRules(doc) {
+    const problems = [];
+    if (doc.min_cli !== undefined && !isSemver(doc.min_cli)) {
+        problems.push({ path: 'min_cli', message: 'must be a semantic version' });
+    }
+    const ids = new Map();
+    doc.people.forEach((person, i) => {
+        const first = ids.get(person.id);
+        if (first !== undefined)
+            problems.push({ path: `people[${i}].id`, message: `duplicates people[${first}]` });
+        else
+            ids.set(person.id, i);
+    });
+    const check = (path, id) => {
+        if (id !== undefined && id !== ALL && !ids.has(id)) {
+            problems.push({ path, message: `"${id}" is not a person in this document` });
+        }
+    };
+    (doc.areas ?? []).forEach((area, a) => {
+        check(`areas[${a}].lead`, area.lead);
+        (area.scenarios ?? []).forEach((scenario, s) => {
+            const at = `areas[${a}].scenarios[${s}]`;
+            check(`${at}.dev_lead`, scenario.dev_lead);
+            for (const [role, people] of Object.entries(scenario.roles ?? {})) {
+                people.forEach((id, p) => check(`${at}.roles.${role}[${p}]`, id));
+            }
+        });
+    });
+    return problems;
+}
+//# sourceMappingURL=members.js.map

package/dist/domain/manifest/rules/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../../../../src/domain/manifest/rules/members.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,wEAAwE;AACxE,yCAAyC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,MAAM,GAAG,GAAG,KAAK,CAAC;AAElB,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,qBAAqB,KAAK,GAAG,EAAE,CAAC,CAAC;;YAChF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAsB,EAAQ,EAAE;QAC3D,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC;IACF,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACpC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE;YAC7C,MAAM,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC;YACzC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/domain/manifest/rules/services.js

@@ -0,0 +1,33 @@
+// A member obtains their own credential and the flavor is probed, so neither has to
+// be declared; every other accepted setting is part of a complete declaration.
+const OPTIONAL = ['credential_url', 'flavor'];
+export function serviceRules(input) {
+    const { providers, service, vars, path } = input;
+    if (!service)
+        return [];
+    const contract = providers?.find((provider) => provider.id === input.provider)?.settings;
+    if (providers !== undefined && contract === undefined)
+        return [{ path, message: 'provider does not support shared service configuration' }];
+    const problems = [];
+    for (const key of Object.keys(service)) {
+        if (contract !== undefined && !contract.fields.includes(key))
+            problems.push({ path: `${path}.${key}`, message: 'not supported by this provider' });
+        if (vars?.[key] !== undefined && vars[key] !== service[key])
+            problems.push({
+                path: `${path}.${key}`,
+                message: 'conflicts with the legacy variable; keep one shared source',
+            });
+    }
+    if (contract === undefined)
+        return problems;
+    for (const key of contract.fields.filter((field) => !OPTIONAL.includes(field)))
+        if (!service[key])
+            problems.push({ path: `${path}.${key}`, message: 'required for service setup' });
+    if (service.auth_scheme && !contract.authSchemes?.includes(service.auth_scheme))
+        problems.push({
+            path: `${path}.auth_scheme`,
+            message: 'authentication method is not supported by this provider',
+        });
+    return problems;
+}
+//# sourceMappingURL=services.js.map

package/dist/domain/manifest/rules/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../../src/domain/manifest/rules/services.ts"],"names":[],"mappings":"AAKA,oFAAoF;AACpF,+EAA+E;AAC/E,MAAM,QAAQ,GAA4B,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AAavE,MAAM,UAAU,YAAY,CAAC,KAAuB;IAClD,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACzF,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QACnD,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAmB,EAAE,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACvF,IAAI,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE;gBACtB,OAAO,EAAE,4DAA4D;aACtE,CAAC,CAAC;IACP,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,GAAG,IAAI,cAAc;YAC3B,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/domain/manifest/rules/tools.js

@@ -0,0 +1,69 @@
+// Cross-field rules of a tools document: names, executables and argument
+// vectors are legible, every tool can be installed somehow, setup steps are
+// well-formed. They run on the bundled defaults, on the team patch, and on
+// the merged result, since a patch can break an entry that was fine alone.
+import { isSemver } from '../../semver.js';
+import { argumentProblem, binaryProblem } from './vectors.js';
+export function toolsRules(doc) {
+    const problems = [];
+    if (doc.min_cli !== undefined && !isSemver(doc.min_cli)) {
+        problems.push({ path: 'min_cli', message: 'must be a semantic version' });
+    }
+    const seen = new Map();
+    doc.tools.forEach((tool, i) => {
+        const at = `tools[${i}]`;
+        const first = seen.get(tool.name);
+        if (first !== undefined)
+            problems.push({ path: `${at}.name`, message: `duplicates tools[${first}]` });
+        else
+            seen.set(tool.name, i);
+        problems.push(...toolRules(tool, at, doc));
+    });
+    return problems;
+}
+function toolRules(tool, at, doc) {
+    const problems = [];
+    const push = (path, message) => {
+        if (message !== undefined)
+            problems.push({ path, message });
+    };
+    push(`${at}.name`, binaryProblem(tool.name));
+    if (tool.binary !== undefined)
+        push(`${at}.binary`, binaryProblem(tool.binary));
+    if (tool.min_version !== undefined && !isSemver(tool.min_version)) {
+        push(`${at}.min_version`, 'must be a semantic version');
+    }
+    const installs = tool.install ?? doc.defaults?.install ?? [];
+    if (installs.length === 0)
+        push(`${at}.install`, 'no install method here or under defaults.install');
+    const vectors = [
+        [`${at}.version_args`, tool.version_args],
+        [`${at}.skill.command`, tool.skill?.command],
+        [`${at}.auth.command`, tool.auth?.command],
+    ];
+    const ids = new Map();
+    (tool.setup ?? []).forEach((step, k) => {
+        const stepAt = `${at}.setup[${k}]`;
+        const first = ids.get(step.id);
+        if (first !== undefined)
+            push(`${stepAt}.id`, `duplicates setup[${first}]`);
+        else
+            ids.set(step.id, k);
+        if (step.kind === 'run' && step.run === undefined)
+            push(`${stepAt}.run`, 'a run step needs a command');
+        if (step.kind === 'run' && step.phase === undefined)
+            push(`${stepAt}.phase`, 'choose prepare for local non-interactive setup or authenticate for personal sign-in');
+        if (step.kind !== 'run' && step.phase !== undefined)
+            push(`${stepAt}.phase`, 'only run steps declare a phase');
+        if (step.kind === 'file' && step.expects === undefined)
+            push(`${stepAt}.expects`, 'a file step needs expects.path');
+        vectors.push([`${stepAt}.run`, step.run]);
+        if ('command' in step.verify)
+            vectors.push([`${stepAt}.verify.command`, step.verify.command]);
+    });
+    for (const [path, vector] of vectors) {
+        (vector ?? []).forEach((arg, j) => push(`${path}[${j}]`, argumentProblem(arg)));
+    }
+    return problems;
+}
+//# sourceMappingURL=tools.js.map

package/dist/domain/manifest/rules/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../../src/domain/manifest/rules/tools.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAE3E,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,MAAM,UAAU,UAAU,CAAC,GAAc;IACvC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,KAAK,GAAG,EAAE,CAAC,CAAC;;YAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,IAAU,EAAE,EAAU,EAAE,GAAc;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,OAA2B,EAAQ,EAAE;QAC/D,IAAI,OAAO,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,4BAA4B,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,kDAAkD,CAAC,CAAC;IAE5E,MAAM,OAAO,GAA8C;QACzD,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC;QACzC,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5C,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;KAC3C,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE,oBAAoB,KAAK,GAAG,CAAC,CAAC;;YACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAC/C,IAAI,CAAC,GAAG,MAAM,MAAM,EAAE,4BAA4B,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YACjD,IAAI,CACF,GAAG,MAAM,QAAQ,EACjB,qFAAqF,CACtF,CAAC;QACJ,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YACjD,IAAI,CAAC,GAAG,MAAM,QAAQ,EAAE,gCAAgC,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YACpD,IAAI,CAAC,GAAG,MAAM,UAAU,EAAE,gCAAgC,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,SAAS,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/domain/manifest/rules/vectors.js

@@ -0,0 +1,44 @@
+// Legibility rules for anything the manifest asks fx to execute. A binary
+// is a plain name, never a path or an interpreter; an argument is a plain
+// word or a plain flag. These keep a manifest readable at a glance; the
+// security boundary is trust-on-first-use in the toolchain, not this file.
+const PLAIN_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const PLAIN_FLAG = /^--?[A-Za-z][A-Za-z0-9-]*(?:=[A-Za-z0-9._@/:-]+)?$/;
+const INTERPRETERS = new Set([
+    'ash',
+    'bash',
+    'bun',
+    'csh',
+    'dash',
+    'deno',
+    'env',
+    'eval',
+    'fish',
+    'ksh',
+    'node',
+    'nohup',
+    'osascript',
+    'perl',
+    'php',
+    'python',
+    'python2',
+    'python3',
+    'ruby',
+    'sh',
+    'tclsh',
+    'xargs',
+    'zsh',
+]);
+export function binaryProblem(name) {
+    if (!PLAIN_NAME.test(name))
+        return 'must be a plain executable name without path or shell syntax';
+    if (INTERPRETERS.has(name))
+        return `must not be an interpreter (${name})`;
+    return undefined;
+}
+export function argumentProblem(arg) {
+    if (PLAIN_NAME.test(arg) || PLAIN_FLAG.test(arg))
+        return undefined;
+    return `"${arg}" is not a plain word or flag`;
+}
+//# sourceMappingURL=vectors.js.map

package/dist/domain/manifest/rules/vectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vectors.js","sourceRoot":"","sources":["../../../../src/domain/manifest/rules/vectors.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,2EAA2E;AAE3E,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAClD,MAAM,UAAU,GAAG,oDAAoD,CAAC;AACxE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,OAAO;IACP,WAAW;IACX,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,MAAM;IACN,IAAI;IACJ,OAAO;IACP,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,8DAA8D,CAAC;IAClG,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,+BAA+B,IAAI,GAAG,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,IAAI,GAAG,+BAA+B,CAAC;AAChD,CAAC"}

package/dist/domain/manifest/rules/workspace.js

@@ -0,0 +1,61 @@
+// Cross-field rules of workspace.yaml that a schema cannot express. Every
+// problem carries the path the reader would look for in the file.
+import { isWindow } from '../../release/window.js';
+import { isSemver } from '../../semver.js';
+import { checkoutPathKey, checkoutPathsOverlap, isWorkspaceCheckoutPath, } from '../../workspace/checkout.js';
+import { serviceRules } from './services.js';
+export function workspaceRules(doc, providers) {
+    const problems = [];
+    for (const [name, binding] of Object.entries(doc.providers ?? {}))
+        problems.push(...serviceRules({
+            providers,
+            provider: binding.provider,
+            service: binding.service,
+            vars: binding.vars,
+            path: `providers.${name}.service`,
+        }));
+    if (doc.min_cli !== undefined && !isSemver(doc.min_cli)) {
+        problems.push({ path: 'min_cli', message: 'must be a semantic version' });
+    }
+    const host = doc.defaults.host ?? doc.providers?.['code-host']?.vars?.['host'];
+    if (host === undefined && doc.repos.some((r) => r.upstream === undefined)) {
+        problems.push({
+            path: 'defaults.host',
+            message: 'a git host is required (defaults.host or providers.code-host.vars.host) unless every repository names its upstream',
+        });
+    }
+    if (doc.release?.since !== undefined && !isWindow(doc.release.since)) {
+        problems.push({ path: 'release.since', message: 'must be a window such as 14d, 48h or 2w' });
+    }
+    const seenNames = new Map();
+    const seenPaths = new Map();
+    doc.repos.forEach((repo, i) => {
+        const first = seenNames.get(repo.name);
+        if (first !== undefined)
+            problems.push({ path: `repos[${i}].name`, message: `duplicates repos[${first}]` });
+        else
+            seenNames.set(repo.name, i);
+        const checkout = checkoutPathKey(repo.path ?? repo.name);
+        if (!isWorkspaceCheckoutPath(repo.path ?? repo.name)) {
+            problems.push({ path: `repos[${i}].path`, message: 'must stay inside the workspace root' });
+        }
+        else {
+            const owner = [...seenPaths].find(([other]) => checkoutPathsOverlap(checkout, other));
+            if (owner !== undefined)
+                problems.push({
+                    path: `repos[${i}].path`,
+                    message: `overlaps the checkout at repos[${owner[1]}]`,
+                });
+            else
+                seenPaths.set(checkout, i);
+        }
+        if (repo.branch === undefined && doc.defaults.branch === undefined) {
+            problems.push({
+                path: `repos[${i}].branch`,
+                message: 'no branch, and defaults.branch is unset',
+            });
+        }
+    });
+    return problems;
+}
+//# sourceMappingURL=workspace.js.map

package/dist/domain/manifest/rules/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../../../src/domain/manifest/rules/workspace.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,kEAAkE;AAElE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAIrC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,SAAsC;IACnF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CACX,GAAG,YAAY,CAAC;YACd,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,aAAa,IAAI,UAAU;SAClC,CAAC,CACH,CAAC;IACJ,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/E,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EACL,oHAAoH;SACvH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,oBAAoB,KAAK,GAAG,EAAE,CAAC,CAAC;;YAChF,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACtF,IAAI,KAAK,KAAK,SAAS;gBACrB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS,CAAC,QAAQ;oBACxB,OAAO,EAAE,kCAAkC,KAAK,CAAC,CAAC,CAAC,GAAG;iBACvD,CAAC,CAAC;;gBACA,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,SAAS,CAAC,UAAU;gBAC1B,OAAO,EAAE,yCAAyC;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/domain/manifest/service.schema.js

@@ -0,0 +1,50 @@
+// Shared service settings are an allowlist of public connection metadata.
+// Personal identities and credentials are never part of this document.
+import * as z from 'zod';
+const publicUrl = z.string().refine((value) => {
+    try {
+        const url = new URL(value);
+        return (['http:', 'https:'].includes(url.protocol) &&
+            !url.username &&
+            !url.password &&
+            !url.search &&
+            !url.hash &&
+            !/[\r\n]/.test(value));
+    }
+    catch {
+        return false;
+    }
+}, 'must be an absolute HTTP(S) URL without credentials, query or fragment');
+const identifier = z
+    .string()
+    .min(1)
+    .regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/);
+export const serviceSchema = z
+    .strictObject({
+    base_url: publicUrl.optional().describe('public service URL; never include credentials'),
+    context: identifier.optional().describe('explicit companion context name'),
+    flavor: z
+        .enum(['cloud', 'datacenter', 'auto'])
+        .optional()
+        .describe('service deployment flavor'),
+    org: identifier.optional().describe('shared organization slug'),
+    auth_scheme: z
+        .enum(['none', 'pat', 'basic', 'token', 'bearer', 'session'])
+        .optional()
+        .describe('authentication method only, `none` where the service takes no sign-in; each member obtains their own credential'),
+    credential_url: publicUrl
+        .optional()
+        .describe('public page explaining where members obtain credentials'),
+})
+    .describe('shared service settings only; usernames, tokens, passwords and sessions are forbidden');
+export function serviceVars(service) {
+    if (!service)
+        return {};
+    const values = Object.fromEntries(Object.entries(service).filter((entry) => typeof entry[1] === 'string'));
+    if (service.base_url) {
+        values['host'] = new URL(service.base_url).host;
+        values['web'] = service.base_url.replace(/\/+$/, '');
+    }
+    return values;
+}
+//# sourceMappingURL=service.schema.js.map

package/dist/domain/manifest/service.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.schema.js","sourceRoot":"","sources":["../../../src/domain/manifest/service.schema.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,uEAAuE;AACvE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CACL,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1C,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,MAAM;YACX,CAAC,GAAG,CAAC,IAAI;YACT,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EAAE,wEAAwE,CAAC,CAAC;AAE7E,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,YAAY,CAAC;IACZ,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IACxF,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAC1E,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;SACrC,QAAQ,EAAE;SACV,QAAQ,CAAC,2BAA2B,CAAC;IACxC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC/D,WAAW,EAAE,CAAC;SACX,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;SAC5D,QAAQ,EAAE;SACV,QAAQ,CACP,iHAAiH,CAClH;IACH,cAAc,EAAE,SAAS;SACtB,QAAQ,EAAE;SACV,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC;KACD,QAAQ,CACP,uFAAuF,CACxF,CAAC;AAMJ,MAAM,UAAU,WAAW,CAAC,OAAoC;IAC9D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,GAA2B,MAAM,CAAC,WAAW,CACvD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAC5B,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/domain/manifest/skill-frontmatter.js

@@ -0,0 +1,21 @@
+// Decode only leading YAML frontmatter; malformed Skill metadata remains unknown.
+import { parse } from 'yaml';
+export function decodeSkillFrontmatter(text) {
+    const block = /^---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/.exec(text);
+    if (block?.[1] === undefined)
+        return {};
+    try {
+        const value = parse(block[1]);
+        if (typeof value !== 'object' || value === null || Array.isArray(value))
+            return {};
+        const fields = value;
+        return Object.fromEntries(['name', 'version', 'description'].flatMap((key) => {
+            const field = fields[key];
+            return typeof field === 'string' && field.trim() ? [[key, field.trim()]] : [];
+        }));
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=skill-frontmatter.js.map

package/dist/domain/manifest/skill-frontmatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-frontmatter.js","sourceRoot":"","sources":["../../../src/domain/manifest/skill-frontmatter.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAQ7B,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,KAAK,GAAG,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnF,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACjD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/domain/manifest/source-repo.js

@@ -0,0 +1,25 @@
+// The manifest repository as a repository of its own workspace: named and
+// placed on the code host by the source a person registered, checked out
+// where fx materialized it. The manifest cannot list where it is kept, so
+// the registry supplies this entry.
+import path from 'node:path';
+import { refFromUrl } from '../workspace/ref.js';
+const GIT_URL = /^(?:ssh:\/\/|git@|https?:\/\/|file:\/\/|git:\/\/)/;
+export function isRepositoryUrl(spec) {
+    return GIT_URL.test(spec) || spec.endsWith('.git');
+}
+export function describeManifestRepo(source, dir, branch) {
+    const isUrl = isRepositoryUrl(source);
+    const ref = isUrl ? refFromUrl(source) : undefined;
+    return {
+        name: ref?.name ?? path.basename(source, '.git'),
+        path: dir,
+        branch,
+        project: ref?.project,
+        ...(isUrl ? { upstream: source } : {}),
+        tags: [],
+        origin: 'manifest',
+        overridden: [],
+    };
+}
+//# sourceMappingURL=source-repo.js.map

package/dist/domain/manifest/source-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-repo.js","sourceRoot":"","sources":["../../../src/domain/manifest/source-repo.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,oCAAoC;AAEpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIjD,MAAM,OAAO,GAAG,mDAAmD,CAAC;AAEpE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,GAAW,EAAE,MAAc;IAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAChD,IAAI,EAAE,GAAG;QACT,MAAM;QACN,OAAO,EAAE,GAAG,EAAE,OAAO;QACrB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC"}