@crewx/sdk 0.9.0-rc.126 → 0.9.0-rc.127

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/dist/esm/index.js +164 -164
  2. package/dist/esm/publish/index.js +2 -2
  3. package/dist/index.browser.js +2 -2
  4. package/dist/index.d.ts +2 -2
  5. package/dist/index.js +164 -164
  6. package/dist/mcp-app/index.d.ts +3 -3
  7. package/dist/mcp-app/registry.d.ts +2 -0
  8. package/dist/mcp-app/types.d.ts +4 -1
  9. package/dist/publish/index.js +2 -2
  10. package/dist/ui-plugin/types.d.ts +1 -0
  11. package/package.json +1 -1
package/dist/esm/publish/index.js CHANGED
@@ -1,2 +1,2 @@
1
- import*as et from'crypto';import {createHash}from'crypto';import*as v from'fs';import {constants,readFileSync,existsSync,statSync,readdirSync}from'fs';import*as H from'path';import {join,relative,sep,isAbsolute,resolve}from'path';import*as ui from'js-yaml';import {load}from'js-yaml';import {realpath,stat,readdir,open,lstat}from'fs/promises';import*as Ei from'os';import*as Ti from'tar';import {gunzipSync,gzipSync}from'zlib';var D=class extends Error{constructor(t,i=t,o){super(i);this.code=t;this.currentRevision=o;}code;currentRevision;name="UiRuntimeError"};var wi=/(?:proof|token|secret|password|cookie|authorization|private[_-]?key|stack|exception|plugin[_-]?text)/i,Ci=/(?:url|uri|endpoint|path|file(?:name|path)?|cwd|shell|directory|dir|folder)$/i,vi=/<\/?[A-Za-z][^>]*>/,Vi=/^(?:[A-Za-z]:[\\/]|\\\\|~[\\/]|\/)/,Fi=/^(?:https?|file|ftp|ws|wss):\/\//i;function J(){throw new D("INPUT_INVALID","JSON value is not projection-safe")}function ji(e){let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}var Bi=8,Hi=4;function un(e,n,t,i,o,r){if(n>i&&J(),e===null||typeof e=="string"||typeof e=="boolean")return typeof e=="string"&&(vi.test(e)||Fi.test(e)&&!zi(o,r)||Vi.test(e))&&J(),e;if(typeof e=="number")return Number.isFinite(e)||J(),e;(typeof e!="object"||e===void 0||typeof e=="function"||typeof e=="bigint")&&J();let s=e;t.has(s)&&J(),t.add(s);try{if(Array.isArray(e))return e.map(c=>un(c,n+1,t,i,o,r));ji(s)||J();let a={};for(let[c,p]of Object.entries(e))(wi.test(c)||Ci.test(c))&&J(),a[c]=un(p,n+1,t,i,[...o,c],r);return a}finally{t.delete(s);}}function ae(e,n=0,t=[]){(!Number.isInteger(n)||n<0||n>Hi)&&J(),(!Array.isArray(t)||t.some(o=>typeof o!="string"))&&J();let i=un(e,0,new Set,Bi+n,[],t);return (i===null||Array.isArray(i)||typeof i!="object")&&J(),i}function me(e,n){if(!e||!n)return false;let t=e.split("."),i=n.split(".");return t.length>=i.length&&i.every((o,r)=>t[r]===o)}function zi(e,n){if(e.length===0)return false;let t=e.join(".");return n.some(i=>me(t,i))}function he(e){try{let n=JSON.stringify(e);return n===void 0&&J(),n}catch{J();}}function fn(e){return Array.isArray(e)?e.map(fn):e!==null&&typeof e=="object"?Object.fromEntries(Object.keys(e).sort().map(n=>[n,fn(e[n])])):e}function K(e){return he(fn(e))}function yn(e){return Buffer.byteLength(e,"utf8")}function An(e){return K(e)}var ce="window";var ot=["__proto__","prototype","constructor","proof","token","secret","password","cookie","authorization","private_key","private-key","stack","exception","plugin_text","url","uri","endpoint","path","filename","filepath","cwd","shell","directory","dir","folder"],Gi=new Set(ot),$i=/(?:proof|token|secret|password|cookie|authorization|private[_-]?key|stack|exception|plugin[_-]?text)/i,Wi=/(?:url|uri|endpoint|path|file(?:name|path)?|cwd|shell|directory|dir|folder)$/i;function Ee(e){return Gi.has(e)||$i.test(e)||Wi.test(e)}var je=/^[A-Za-z0-9_]+$/,Ue=/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*$/,_e=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/,gn=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/,In=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/,mn=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/,hn=["blue","violet","emerald","amber","rose","sky","slate","indigo"],En=["inline","panel"];var Ji=1,Ki=/^[a-z][a-zA-Z0-9]*(\.[a-zA-Z0-9]+)+$/,Xi=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/,yt=/^[A-Za-z][A-Za-z0-9_-]{0,63}$/,Yi=/<\/?[A-Za-z][^>]*>/,qi=/^(?:[A-Za-z]:[\\/]|\\\\|~[\\/]|\/)/,Zi=/^(?:https?|file|ftp|ws|wss):\/\//i,Qi=/^\s*(?:javascript|data):/i,rt=/data:[^,\s]*,/i,eo=/(?:https?|file|ftp|ws|wss):\/\//i,no=/javascript:/i,to=/(?:^[\s]*|[\s"'(=])(?:[A-Za-z]:[\\/]|\\\\|~[\\/]|\/)(?=[^\s"'<>])[^\s"'<>]*/,io=["manifestVersion","pluginId","definitionId","version","primitiveSet","activation","schema","layout"],oo=["manifestVersion","pluginId","definitionId","version","name","description","entry","surfaces","size","stateProjection","actions"],ro=["_meta","icon","tone","entryHash","initialState","usage","detailPanel","displayModes","dataPaths","focusedAiDataPaths"],so=["actionId","capability","mutation","inputSchema","resultProjection","backend"],ao=["confirmation","dataInputs","_meta"],co=4*1024,po=["type","handler"],lo=["type","command"],uo=["path"],fo=["hash"],yo=/^[0-9a-f]{64}$/,Ao=/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/,go=/[\r\n]/,Io=16,mo=["card-shell","meta-banner","heading","labeled-text","step-flow","text-list"],$=class extends Error{constructor(t,i=t){super(i);this.code=t;}code;name="UiPluginValidationError"};function d(e,n=e){throw new $(e,n)}function x(e){if(e===null||typeof e!="object"||Array.isArray(e))return false;try{let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}catch{return false}}function S(e,n){return Object.prototype.hasOwnProperty.call(e,n)}function w(e,n,t=[]){let i=new Set([...n,...t]);Object.keys(e).some(o=>!i.has(o))&&d("MANIFEST_INVALID"),n.some(o=>!S(e,o))&&d("MANIFEST_INVALID");}function $e(e,n=false,t=false,i=false){return Yi.test(e)||!i&&Zi.test(e)||qi.test(e)||t&&rt.test(e)||Qi.test(e)&&!(n&&/^\s*data:/i.test(e)&&!rt.test(e))}function ze(e,n=new Set,t=0,i=false,o=false){if(typeof e=="string"){$e(e,i,o)&&d("UNSAFE_VALUE");return}if(!(e===null||typeof e!="object")){(t>8||n.has(e))&&d("MANIFEST_INVALID"),n.add(e);try{if(Array.isArray(e)){for(let r of e)ze(r,n,t+1);return}x(e)||d("MANIFEST_INVALID");for(let[r,s]of Object.entries(e))ze(s,n,t+1,i&&t===0&&(r==="name"||r==="description"),o);}finally{n.delete(e);}}}function Q(e,n){let t=e[n];return typeof t!="string"&&d("MANIFEST_INVALID"),t}function Z(e,n,t){let i=e[n];return (!Number.isSafeInteger(i)||i<t)&&d("MANIFEST_INVALID"),i}function _n(e){return Xi.test(e)||d("MANIFEST_INVALID"),e}function Te(e){return Ki.test(e)||d("TOKEN_INVALID"),e}function ho(e){return yt.test(e)||d("MANIFEST_INVALID"),e}function Eo(e){x(e)||d("MANIFEST_INVALID");let n={};for(let[t,i]of Object.entries(e)){let o=ho(t);x(i)||d("MANIFEST_INVALID");let r=i.type;if(r==="text"){w(i,["type","maxLength"]),n[o]={type:r,maxLength:Z(i,"maxLength",1)};continue}if(r==="text-list"){w(i,["type","max","itemMaxLength"]),n[o]={type:r,max:Z(i,"max",0),itemMaxLength:Z(i,"itemMaxLength",1)};continue}if(r==="step-list"){w(i,["type","min","max","labelMaxLength","detailMaxLength"]);let s=Z(i,"min",0),a=Z(i,"max",1);s>a&&d("MANIFEST_INVALID"),n[o]={type:r,min:s,max:a,labelMaxLength:Z(i,"labelMaxLength",1),detailMaxLength:Z(i,"detailMaxLength",1)};continue}typeof r=="string"&&d("SCHEMA_TYPE_UNSUPPORTED"),d("MANIFEST_INVALID");}return n}function _o(e,n,t){let i=e[n];(!i||i.type!==t)&&d("MANIFEST_INVALID");}function Be(e,n,t){let i=Q(e,"field");return yt.test(i)||d("MANIFEST_INVALID"),_o(n,i,t),i}function To(e,n){x(e)||d("MANIFEST_INVALID");let t=e.primitive;switch(typeof t!="string"&&d("MANIFEST_INVALID"),mo.includes(t)||d("PRIMITIVE_UNKNOWN"),t){case "card-shell":return w(e,["primitive"]),{primitive:t};case "meta-banner":return w(e,["primitive","badgeToken","noticeToken"]),{primitive:t,badgeToken:Te(Q(e,"badgeToken")),noticeToken:Te(Q(e,"noticeToken"))};case "heading":return w(e,["primitive","field"]),{primitive:t,field:Be(e,n,"text")};case "labeled-text":return w(e,["primitive","titleToken","field","variant"]),e.variant!=="callout"&&d("MANIFEST_INVALID"),{primitive:t,titleToken:Te(Q(e,"titleToken")),field:Be(e,n,"text"),variant:"callout"};case "step-flow":return w(e,["primitive","titleToken","field"]),{primitive:t,titleToken:Te(Q(e,"titleToken")),field:Be(e,n,"step-list")};case "text-list":{w(e,["primitive","titleToken","field"],["emptyToken","hideWhenEmpty"]);let i={primitive:t,titleToken:Te(Q(e,"titleToken")),field:Be(e,n,"text-list")};return S(e,"emptyToken")&&(i.emptyToken=Te(Q(e,"emptyToken"))),S(e,"hideWhenEmpty")&&(typeof e.hideWhenEmpty!="boolean"&&d("MANIFEST_INVALID"),i.hideWhenEmpty=e.hideWhenEmpty),i}}return d("MANIFEST_INVALID")}function Po(e,n){return Array.isArray(e)||d("MANIFEST_INVALID"),e.map(t=>To(t,n))}function C(e="v2 manifest exceeds a contract limit"){return d("LIMIT_EXCEEDED",e)}function X(e="initial state is not projection-safe"){return d("INITIAL_STATE_INVALID",e)}function st(e,n){return (typeof e!="string"||e.length===0||e.length>4096||e.trim().length===0||Ao.test(e)||go.test(e))&&d("MANIFEST_INVALID",`${n} is invalid`),($e(e,true,true)||eo.test(e)||no.test(e)||to.test(e))&&d("UNSAFE_VALUE",`${n} contains an unsafe value`),e}function Tn(e,n){return (typeof e!="string"||!_e.test(e))&&d("MANIFEST_INVALID",`${n} is invalid`),e}function Do(e){return (typeof e!="string"||!gn.test(e)||e==="*"||e==="all")&&d("MANIFEST_INVALID","action capability is invalid"),e}function At(e){return (typeof e!="string"||!yo.test(e))&&d("MANIFEST_INVALID","resource hash is invalid"),e}function Pn(e,n=new Set,t=0){if(typeof e=="string"){e.length>4096&&C("v2 manifest string is too long");return}if(!(e===null||typeof e=="boolean")){if(typeof e=="number"){Number.isFinite(e)||d("MANIFEST_INVALID","v2 manifest contains a non-finite number");return}(e===void 0||typeof e=="function"||typeof e=="bigint")&&d("MANIFEST_INVALID","v2 manifest contains a non-JSON value"),typeof e!="object"&&d("MANIFEST_INVALID"),t>8&&C("v2 manifest nesting is too deep"),n.has(e)&&d("MANIFEST_INVALID","v2 manifest contains a cycle"),n.add(e);try{if(Array.isArray(e)){e.length>128&&C("v2 manifest array is too long");for(let i of e)Pn(i,n,t+1);return}x(e)||d("MANIFEST_INVALID","v2 manifest contains a non-plain object");for(let i of Object.values(e))Pn(i,n,t+1);}finally{n.delete(e);}}}function gt(e){return (typeof e!="string"||e.length>4096||!Ue.test(e))&&(typeof e=="string"&&e.length>4096&&C("projection path is too long"),d("MANIFEST_INVALID","projection paths must be canonical exact paths")),e.split(".").some(t=>Ee(t))&&d("MANIFEST_INVALID","projection paths cannot address reserved state keys"),e}function It(e){x(e)||d("MANIFEST_INVALID","projection policy must be an object"),w(e,["allow"]),Array.isArray(e.allow)||d("MANIFEST_INVALID","projection allow must be an array"),e.allow.length>128&&C("projection allowlist is too long");let n=[],t=new Set;for(let i of e.allow){let o=gt(i);t.has(o)&&d("MANIFEST_INVALID","projection allowlist contains a duplicate path"),t.add(o),n.push(o);}return {allow:n}}function bo(e,n){if(e===void 0)return;Array.isArray(e)||d("MANIFEST_INVALID","dataPaths must be an array"),e.length>Io&&C("dataPaths exceed the v2 limit");let t=[],i=new Set;for(let o of e){let r=gt(o);i.has(r)&&d("MANIFEST_INVALID","dataPaths contain a duplicate path"),n.some(s=>me(r,s))||d("MANIFEST_INVALID","dataPaths must be projection-allowed"),i.add(r),t.push(r);}return t}function Pe(e,n,t=Number.MAX_SAFE_INTEGER){return (!Number.isSafeInteger(e)||e<0||e>t)&&d("MANIFEST_INVALID",`${n} is invalid`),e}function at(e,n){return (typeof e!="number"||!Number.isFinite(e))&&d("MANIFEST_INVALID",`${n} is invalid`),e}function Dn(e,n=0,t=new Set){if(typeof e=="string")return (e.length>4096||$e(e))&&d("UNSAFE_VALUE","schema enum contains an unsafe string"),e;if(e===null||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)||d("MANIFEST_INVALID","schema enum contains a non-finite number"),e;(n>8||typeof e!="object"||e===void 0)&&C("schema enum is too deep"),t.has(e)&&d("MANIFEST_INVALID","schema enum contains a cycle"),t.add(e);try{if(Array.isArray(e))return e.length>128&&C("schema enum array is too long"),e.map(o=>Dn(o,n+1,t));x(e)||d("MANIFEST_INVALID","schema enum contains a non-plain object");let i={};for(let[o,r]of Object.entries(e))Ee(o)&&d("MANIFEST_INVALID","schema enum contains a reserved key"),i[o]=Dn(r,n+1,t);return i}finally{t.delete(e);}}function No(e,n){if(e===void 0)return;Array.isArray(e)||d("MANIFEST_INVALID","schema required must be an array"),e.length>64&&C("schema required list is too long");let t=[],i=new Set;for(let o of e)(typeof o!="string"||!Ue.test(o))&&d("MANIFEST_INVALID","schema required contains an invalid key"),o.length>4096&&C("schema required key is too long"),i.has(o)&&d("MANIFEST_INVALID","schema required contains a duplicate key"),n&&!Object.prototype.hasOwnProperty.call(n,o)&&d("MANIFEST_INVALID","schema required references an undeclared property"),i.add(o),t.push(o);return t}function Mo(e,n){let t=n?Ue:je;return e.length>4096&&C("schema property name is too long"),(!t.test(e)||e.split(".").some(i=>Ee(i)))&&d("MANIFEST_INVALID","schema property name is invalid"),e}function bn(e,n=0,t=false){x(e)||d("MANIFEST_INVALID","action inputSchema must be an object"),n>8&&C("action inputSchema is too deep");let i=e.type;i!=="object"&&i!=="string"&&i!=="number"&&i!=="integer"&&i!=="boolean"&&i!=="array"&&i!=="null"&&(typeof i=="string"&&d("SCHEMA_TYPE_UNSUPPORTED","action inputSchema type is unsupported"),d("MANIFEST_INVALID","action inputSchema type is required"));let o=["type","enum"];i==="string"&&o.push("minLength","maxLength"),i==="array"&&o.push("minItems","maxItems","items"),i==="object"&&o.push("minProperties","maxProperties","properties","required","additionalProperties"),(i==="number"||i==="integer")&&o.push("minimum","maximum"),w(e,["type"],o.filter(a=>a!=="type"));let r={type:i};if(S(e,"enum")&&(Array.isArray(e.enum)||d("MANIFEST_INVALID","schema enum must be an array"),e.enum.length>128&&C("schema enum is too long"),r.enum=e.enum.map(a=>Dn(a))),i==="string"&&(S(e,"minLength")&&(r.minLength=Pe(e.minLength,"schema minLength",4096)),S(e,"maxLength")&&(r.maxLength=Pe(e.maxLength,"schema maxLength",4096)),r.minLength!==void 0&&r.maxLength!==void 0&&r.minLength>r.maxLength&&d("MANIFEST_INVALID","schema string length bounds are inverted")),(i==="number"||i==="integer")&&(S(e,"minimum")&&(r.minimum=at(e.minimum,"schema minimum")),S(e,"maximum")&&(r.maximum=at(e.maximum,"schema maximum")),r.minimum!==void 0&&r.maximum!==void 0&&r.minimum>r.maximum&&d("MANIFEST_INVALID","schema numeric bounds are inverted")),i==="array"&&(S(e,"minItems")&&(r.minItems=Pe(e.minItems,"schema minItems",128)),S(e,"maxItems")&&(r.maxItems=Pe(e.maxItems,"schema maxItems",128)),r.minItems!==void 0&&r.maxItems!==void 0&&r.minItems>r.maxItems&&d("MANIFEST_INVALID","schema array length bounds are inverted"),S(e,"items")&&(r.items=bn(e.items,n+1,false))),i==="object"){let a;if(S(e,"properties")){x(e.properties)||d("MANIFEST_INVALID","schema properties must be an object");let p=Object.entries(e.properties);p.length>64&&C("schema properties are too many"),a={};for(let[u,f]of p){let A=Mo(u,t);a[A]=bn(f,n+1,false);}r.properties=a;}S(e,"minProperties")&&(r.minProperties=Pe(e.minProperties,"schema minProperties",64)),S(e,"maxProperties")&&(r.maxProperties=Pe(e.maxProperties,"schema maxProperties",64)),r.minProperties!==void 0&&r.maxProperties!==void 0&&r.minProperties>r.maxProperties&&d("MANIFEST_INVALID","schema object property bounds are inverted");let c=No(e.required,a);c!==void 0&&(r.required=c),S(e,"additionalProperties")&&(e.additionalProperties!==false&&d("MANIFEST_INVALID","schema additionalProperties must be false"),r.additionalProperties=false);}let s=JSON.stringify(r);return (s===void 0||Buffer.byteLength(s,"utf8")>65536)&&C("action inputSchema subtree is too large"),r}function So(e){let n=bn(e,0,true);return (n.type!=="object"||!n.properties)&&d("MANIFEST_INVALID","action inputSchema must declare object properties"),n}function Lo(e){if(x(e)||d("MANIFEST_INVALID","action backend must be an object"),e.type==="core"){w(e,po);let n=e.handler;return (typeof n!="string"||!In.test(n))&&d("MANIFEST_INVALID","core backend handler is invalid"),{type:"core",handler:n}}if(e.type==="skill"){w(e,lo),(!Array.isArray(e.command)||e.command.length===0||e.command.length>16)&&d("MANIFEST_INVALID","skill backend command is invalid");let n=[];for(let t of e.command)(typeof t!="string"||t.length===0||t.length>256||!mn.test(t))&&d("MANIFEST_INVALID","skill backend command token is invalid"),n.push(t);return {type:"skill",command:n}}d("MANIFEST_INVALID","action backend type is unsupported");}function Uo(e){x(e)||d("MANIFEST_INVALID","action must be an object"),w(e,so,ao),S(e,"_meta")&&mt(e._meta);let n=Tn(e.actionId,"actionId"),t=Do(e.capability),i=e.mutation;typeof i!="boolean"&&d("MANIFEST_INVALID","action mutation must be boolean");let o=So(e.inputSchema),r;if(S(e,"dataInputs")){Array.isArray(e.dataInputs)||d("MANIFEST_INVALID","action dataInputs must be an array");let p=o.properties,u=new Set,f=[];for(let A of e.dataInputs)(typeof A!="string"||!S(p,A)||u.has(A))&&d("MANIFEST_INVALID","action dataInputs must be unique declared properties"),u.add(A),f.push(A);r=f;}let s=It(e.resultProjection),a=Lo(e.backend),c;if(S(e,"confirmation")){let p=e.confirmation;p!=="none"&&p!=="native"&&d("MANIFEST_INVALID","action confirmation is invalid"),c=p;}return {actionId:n,capability:t,mutation:i,inputSchema:o,resultProjection:s,backend:a,...r===void 0?{}:{dataInputs:r},...c===void 0?{}:{confirmation:c}}}function Ro(e){return x(e)||d("INITIAL_STATE_INVALID","initialState must be an object"),w(e,uo,fo),e.path!=="ui/state.json"&&d("MANIFEST_INVALID","initialState path is not fixed"),S(e,"hash")?{path:"ui/state.json",hash:At(e.hash)}:{path:"ui/state.json"}}function Oo(e,n){ze(e,new Set,0,true,true),Pn(e),x(e)||d("MANIFEST_INVALID"),w(e,oo,ro),S(e,"_meta")&&mt(e._meta),e.manifestVersion!==2&&d("MANIFEST_INVALID");let t=Tn(e.pluginId,"pluginId"),i=Tn(e.definitionId,"definitionId"),o=Z(e,"version",1),r=st(e.name,"name"),s=st(e.description,"description"),a;S(e,"icon")&&((typeof e.icon!="string"||!/^[a-z][a-z0-9-]{0,63}$/.test(e.icon))&&d("MANIFEST_INVALID","icon is invalid"),a=e.icon);let c;S(e,"tone")&&((typeof e.tone!="string"||!hn.includes(e.tone))&&d("MANIFEST_INVALID","tone is invalid"),c=e.tone),e.entry!=="ui/index.html"&&d("MANIFEST_INVALID","entry path is not fixed");let p;S(e,"entryHash")&&(p=At(e.entryHash));let u;S(e,"initialState")&&(u=Ro(e.initialState));let f;S(e,"usage")&&(e.usage!=="card"&&e.usage!=="window"&&d("MANIFEST_INVALID","usage is invalid"),f=e.usage);let A;S(e,"detailPanel")&&(typeof e.detailPanel!="boolean"&&d("MANIFEST_INVALID","detailPanel is invalid"),A=e.detailPanel);let m;if(S(e,"displayModes")){((f??ce)!==ce||!Array.isArray(e.displayModes)||e.displayModes.length===0)&&d("MANIFEST_INVALID","displayModes are only valid for window Apps");let O=new Set(["inline","floating","focused"]);(new Set(e.displayModes).size!==e.displayModes.length||e.displayModes.some(l=>typeof l!="string"||!O.has(l)))&&d("MANIFEST_INVALID","displayModes are invalid"),m=e.displayModes;}(f??ce)===ce&&A!==void 0&&d("MANIFEST_INVALID","detailPanel is card-only");let g=n.mode??"local";g!=="local"&&g!=="installed"&&g!=="published"&&d("MANIFEST_INVALID","manifest mode is invalid"),g!=="local"&&p===void 0&&d("MANIFEST_INVALID","installed manifests require entryHash"),g!=="local"&&u!==void 0&&u.hash===void 0&&d("MANIFEST_INVALID","installed manifests require initialState.hash"),(!Array.isArray(e.surfaces)||e.surfaces.length===0)&&d("MANIFEST_INVALID","surfaces are invalid"),e.surfaces.length>2&&C("surfaces exceed the v2 limit");let T=[],M=new Set;for(let O of e.surfaces)(typeof O!="string"||!En.includes(O))&&d("MANIFEST_INVALID","surface is unsupported"),M.has(O)&&d("MANIFEST_INVALID","surfaces contain a duplicate"),M.add(O),T.push(O);x(e.size)||d("MANIFEST_INVALID","size must be an object"),w(e.size,["height"]);let L=Z(e.size,"height",1);L>720&&C("size.height exceeds the v2 limit");let y=It(e.stateProjection),I=bo(e.dataPaths,y.allow);Array.isArray(e.actions)||d("MANIFEST_INVALID","actions must be an array"),e.actions.length>32&&C("actions exceed the v2 limit");let P=[],V=new Set;for(let O of e.actions){let l=Uo(O);if(V.has(l.actionId)&&d("MANIFEST_INVALID","actions contain a duplicate actionId"),l.backend.type==="core"&&l.backend.handler==="state.set"){l.mutation||d("MANIFEST_INVALID","state.set actions must be mutations");for(let N of Object.keys(l.inputSchema.properties))y.allow.includes(N)||d("MANIFEST_INVALID","state.set input paths must be projection-allowed");}V.add(l.actionId),P.push(l);}return {manifestVersion:2,pluginId:t,definitionId:i,version:o,name:r,description:s,...a===void 0?{}:{icon:a},...c===void 0?{}:{tone:c},entry:"ui/index.html",...p===void 0?{}:{entryHash:p},...u===void 0?{}:{initialState:u},...f===void 0?{}:{usage:f},...A===void 0?{}:{detailPanel:A},...m===void 0?{}:{displayModes:m},surfaces:T,size:{height:L},stateProjection:y,...I===void 0?{}:{dataPaths:I},actions:P}}function mt(e){x(e)||d("MANIFEST_INVALID","_meta must be an object");let n=JSON.stringify(e);(n===void 0||Buffer.byteLength(n,"utf8")>co)&&C("_meta exceeds the 4 KiB limit");}function ko(e){let n={},t={};for(let r of e.actions){n[r.actionId]={capabilities:[r.capability],inputKeys:Object.keys(r.inputSchema.properties??{}),...r.dataInputs===void 0?{}:{dataInputs:r.dataInputs},resultProjection:r.resultProjection,...r.confirmation===void 0?{}:{confirmation:r.confirmation}};let s=r.backend.type==="skill"||r.backend.type==="core"&&r.backend.handler==="state.set";t[r.actionId]={actionId:r.actionId,mutation:r.mutation,backend:r.backend,launchPolicy:s?"allowed":"denied",...s?{}:{denialCode:"EXEC_DENIED"}};}let i={id:e.definitionId,version:e.version,renderer:"sandbox-html",...e.usage===void 0?{}:{usage:e.usage},...e.detailPanel===void 0?{}:{detailPanel:e.detailPanel},...e.displayModes===void 0?{}:{displayModes:e.displayModes},surfaces:e.surfaces,stateProjection:e.stateProjection,...e.dataPaths===void 0?{}:{dataPaths:e.dataPaths},actions:n},o={entry:{path:"ui/index.html",...e.entryHash===void 0?{}:{hash:e.entryHash}},...e.initialState===void 0?{}:{initialState:e.initialState}};return {manifest:e,definition:i,handlers:t,resources:o}}function Nn(e,n,t,i,o,r){if(typeof e=="string"){let s=o.length>0&&r.some(a=>me(o.join("."),a));return (e.length>4096||$e(e,false,false,s))&&X("state contains an unsafe string"),e}if(e===null||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)||X("state contains a non-finite number"),e;(e===void 0||typeof e!="object"||typeof e=="function"||typeof e=="bigint")&&X("state contains a non-JSON value"),t>8&&X("state is too deep"),n.has(e)&&X("state contains a cycle"),n.add(e);try{let s;if(Array.isArray(e))e.length>128&&X("state array is too long"),s=e.map(c=>Nn(c,n,t+1,65536,o,r));else {x(e)||X("state contains a non-plain object");let c={};for(let[p,u]of Object.entries(e))(p.length>4096||!je.test(p)||Ee(p))&&(p.length>4096&&X("state key is too long"),X("state contains a reserved or invalid key")),c[p]=Nn(u,n,t+1,65536,[...o,p],r);s=c;}let a=JSON.stringify(s);return (a===void 0||Buffer.byteLength(a,"utf8")>i)&&X("state subtree is too large"),s}finally{n.delete(e);}}function Sn(e,n=[]){x(e)||X("initial state must be a JSON object");let t=Nn(e,new Set,0,65536,[],n);return (t===null||Array.isArray(t)||typeof t!="object")&&X(),t}function xo(e,n={}){ze(e),x(e)||d("MANIFEST_INVALID"),w(e,io),e.manifestVersion!==1&&d("MANIFEST_INVALID");let t=_n(Q(e,"pluginId")),i=_n(Q(e,"definitionId")),o=Z(e,"version",1),r=Z(e,"primitiveSet",1),s=n.supportedPrimitiveSet??Ji;(!Number.isSafeInteger(s)||s<1)&&d("MANIFEST_INVALID"),r>s&&d("PRIMITIVE_SET_UNSUPPORTED"),x(e.activation)||d("MANIFEST_INVALID"),w(e.activation,["kind","language"]),e.activation.kind!=="fenced-code"&&d("MANIFEST_INVALID");let a=_n(Q(e.activation,"language")),c=Eo(e.schema),p=Po(e.layout,c);return {manifestVersion:1,pluginId:t,definitionId:i,version:o,primitiveSet:r,activation:{kind:"fenced-code",language:a},schema:c,layout:p}}function wo(e,n={}){return x(e)||d("MANIFEST_INVALID"),Object.hasOwn(e,"lineage")&&d("MANIFEST_INVALID","lineage is only allowed in product bundle indexes"),e.manifestVersion===2?Oo(e,n):xo(e,n)}function ye(e,n={}){try{return wo(e,n)}catch(t){if(t instanceof $)throw t;return d("MANIFEST_INVALID")}}function Ln(e,n={}){let t=ye(e,n);return t.manifestVersion===2?ko(t):t}var Et="SKILL.md",jo=/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;function _t(e){if(e===null||typeof e!="object"||Array.isArray(e))return false;let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}function Bo(e){return e.isDirectory()||e.isSymbolicLink()}function Nt(e){try{return existsSync(e)&&statSync(e).isDirectory()}catch{return false}}function Rn(e){let n;try{n=readFileSync(e,"utf8");}catch{return {frontmatter:{},readable:false,valid:false,hasFrontmatter:false}}let t=n.match(jo);if(!t)return {frontmatter:{},readable:true,valid:true,hasFrontmatter:false};try{let i=load(t[1]??"");if(!_t(i))return {frontmatter:{},readable:!0,valid:!1,hasFrontmatter:!0};let o=_t(i.metadata)?i.metadata:void 0;return {frontmatter:{...typeof i.name=="string"?{name:i.name}:{},...typeof(o?.version??i.version)=="string"?{version:o?.version??i.version}:{},...typeof i.description=="string"?{description:i.description}:{}},readable:!0,valid:!0,hasFrontmatter:!0}}catch{return {frontmatter:{},readable:true,valid:false,hasFrontmatter:true}}}function Ho(e){return [join(e,Et),join(e,"skill",Et)]}function Tt(e,n){if(!Nt(e))return null;for(let t of Ho(e)){if(!existsSync(t))continue;let o=Rn(t).frontmatter;return {name:o.name??n,...o.version===void 0?{}:{version:o.version},...o.description===void 0?{}:{description:o.description},skillMdPath:t,dir:e}}return null}function Pt(e){try{return readdirSync(e,{withFileTypes:!0}).filter(Bo)}catch{return []}}function Dt(e,n,t){!e||n.has(e.name)||(n.add(e.name),t.push(e));}function Mt(e){let n=[],t=new Set;for(let i of e)if(Nt(i))for(let o of Pt(i)){if(o.name.startsWith("@")){let r=join(i,o.name);for(let s of Pt(r))Dt(Tt(join(r,s.name),s.name),t,n);continue}Dt(Tt(join(i,o.name),o.name),t,n);}return n.sort((i,o)=>i.name.localeCompare(o.name))}var Go=/^[0-9a-f]{64}$/;function pe(e){let t=e.renderer!==void 0||e.surfaces!==void 0||e.stateProjection!==void 0||e.dataPaths!==void 0||e.usage!==void 0||e.detailPanel!==void 0||e.displayModes!==void 0||e.summaryProjection!==void 0||e.legacy!==void 0||Object.values(e.actions).some(o=>o.resultProjection!==void 0)?{id:e.id,version:e.version,...e.renderer===void 0?{}:{renderer:e.renderer},...e.surfaces===void 0?{}:{surfaces:e.surfaces},...e.stateProjection===void 0?{}:{stateProjection:e.stateProjection},...e.dataPaths===void 0?{}:{dataPaths:e.dataPaths},...e.summaryProjection===void 0?{}:{summaryProjection:e.summaryProjection},...e.legacy===void 0?{}:{legacy:e.legacy},...e.usage===void 0?{}:{usage:e.usage},...e.detailPanel===void 0?{}:{detailPanel:e.detailPanel},...e.displayModes===void 0?{}:{displayModes:e.displayModes},...e.sourceHash===void 0?{}:{sourceHash:e.sourceHash},actions:e.actions}:e.sourceHash===void 0?{id:e.id,version:e.version,actions:e.actions}:{id:e.id,version:e.version,sourceHash:e.sourceHash,actions:e.actions},i=ae(t);return createHash("sha256").update(K(i)).digest("hex")}function de(e){if(!/^\d+$/.test(String(e.version))||e.version<1||e.id.length<1||e.id.length>128)throw new D("DEFINITION_UNSUPPORTED","UI definition is invalid");if(e.sourceHash!==void 0&&(typeof e.sourceHash!="string"||!Go.test(e.sourceHash)))throw new D("DEFINITION_UNSUPPORTED","UI definition source hash is invalid");if(!/^[0-9a-f]{64}$/.test(e.hash)||pe(e)!==e.hash)throw new D("DEFINITION_UNSUPPORTED","UI definition hash is invalid");for(let[n,t]of Object.entries(e.actions)){if(!n||!Array.isArray(t.capabilities)||t.capabilities.some(i=>!Wo(i)))throw new D("DEFINITION_UNSUPPORTED","UI action declaration is invalid");if(t.confirmation!==void 0&&t.confirmation!=="none"&&t.confirmation!=="native")throw new D("DEFINITION_UNSUPPORTED","UI action confirmation is invalid");if(t.inputKeys&&(!Array.isArray(t.inputKeys)||t.inputKeys.some(i=>typeof i!="string"||!i)))throw new D("DEFINITION_UNSUPPORTED","UI action input declaration is invalid");if(t.dataInputs!==void 0&&(!Array.isArray(t.dataInputs)||new Set(t.dataInputs).size!==t.dataInputs.length||t.dataInputs.some(i=>typeof i!="string"||!i||t.inputKeys!==void 0&&!t.inputKeys.includes(i))))throw new D("DEFINITION_UNSUPPORTED","UI action data input declaration is invalid");t.resultProjection&&On(t.resultProjection);}if(e.renderer!==void 0&&(!e.renderer||e.renderer.length>128))throw new D("DEFINITION_UNSUPPORTED","UI definition renderer is invalid");if(e.surfaces&&(!Array.isArray(e.surfaces)||e.surfaces.some(n=>!n||n.length>64)))throw new D("DEFINITION_UNSUPPORTED","UI definition surfaces are invalid");if(e.usage!==void 0&&e.usage!=="card"&&e.usage!=="window")throw new D("DEFINITION_UNSUPPORTED","UI definition usage is invalid");if(e.detailPanel!==void 0&&typeof e.detailPanel!="boolean")throw new D("DEFINITION_UNSUPPORTED","UI definition detailPanel is invalid");if(e.displayModes&&(!Array.isArray(e.displayModes)||e.displayModes.length===0||new Set(e.displayModes).size!==e.displayModes.length||e.displayModes.some(n=>n!=="inline"&&n!=="floating"&&n!=="focused")))throw new D("DEFINITION_UNSUPPORTED","UI definition displayModes are invalid");if(e.usage==="card"&&e.displayModes!==void 0)throw new D("DEFINITION_UNSUPPORTED","Card definitions cannot declare displayModes");if(e.usage==="window"&&e.detailPanel!==void 0)throw new D("DEFINITION_UNSUPPORTED","Window definitions cannot declare detailPanel");if(e.stateProjection&&On(e.stateProjection),e.summaryProjection){On(e.summaryProjection);let n=new Set(e.stateProjection?.allow??[]);if(e.summaryProjection.allow.some(t=>!n.has(t)))throw new D("DEFINITION_UNSUPPORTED","UI summary projection exceeds state projection")}if(e.legacy!==void 0){if(!e.legacy||typeof e.legacy!="object"||Array.isArray(e.legacy)||Object.keys(e.legacy).some(o=>!["readTool","actionTool","hostTools","agentAccess"].includes(o)))throw new D("DEFINITION_UNSUPPORTED","UI legacy metadata is invalid");let n=new Set;for(let[o,r]of [["readTool",e.legacy.readTool],["actionTool",e.legacy.actionTool]])if(r!==void 0){if($o(r,o==="readTool"),n.has(r.name))throw new D("DEFINITION_UNSUPPORTED","UI legacy tool names collide");n.add(r.name);}let t=e.legacy.hostTools;if(t!==void 0){if(!t||typeof t!="object"||Array.isArray(t))throw new D("DEFINITION_UNSUPPORTED","UI legacy host tools are invalid");let o={"doc.open":"crewx_app_html_viewer_open","pty.connect":"crewx_app_terminal_connect"};for(let[r,s]of Object.entries(t)){if(!Object.hasOwn(o,r)||o[r]!==s||typeof s!="string"||!/^[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(s)||n.has(s))throw new D("DEFINITION_UNSUPPORTED","UI legacy host tools are invalid");n.add(s);}}let i=e.legacy.agentAccess;if(i!==void 0&&(!i||typeof i!="object"||Array.isArray(i)||Object.entries(i).some(([o,r])=>!o||!Object.hasOwn(e.actions,o)||r!=="allowed"&&r!=="denied")))throw new D("DEFINITION_UNSUPPORTED","UI legacy agent access is invalid");if(e.legacy.actionTool!==void 0&&(!i||Object.keys(i).length===0))throw new D("DEFINITION_UNSUPPORTED","UI legacy action tool requires its complete agent access map")}if(e.dataPaths!==void 0){let n=new Set(["__proto__","prototype","constructor"]);if(!Array.isArray(e.dataPaths)||e.dataPaths.length>16||new Set(e.dataPaths).size!==e.dataPaths.length||e.dataPaths.some(t=>typeof t!="string"||!/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*$/.test(t)||t.split(".").some(i=>n.has(i))||!(e.stateProjection?.allow??[]).some(i=>me(t,i))))throw new D("DEFINITION_UNSUPPORTED","UI definition dataPaths are invalid")}}function $o(e,n){if(!e||typeof e!="object"||Array.isArray(e))throw new D("DEFINITION_UNSUPPORTED","UI legacy tool metadata is invalid");let t=e,i=["name","description","inputSchema","textFallback","visibility"],o=Object.hasOwn(t,"fixedResult");if(Object.keys(t).some(r=>!i.includes(r)&&!(n&&r==="fixedResult"))||i.some(r=>!Object.hasOwn(t,r))||typeof t.name!="string"||!/^[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(t.name)||typeof t.description!="string"||t.description.trim().length===0||t.description.length>8192||typeof t.textFallback!="string"||t.textFallback.trim().length===0||t.textFallback.length>16384||!t.inputSchema||typeof t.inputSchema!="object"||Array.isArray(t.inputSchema)||!Array.isArray(t.visibility)||t.visibility.length===0||t.visibility.some(r=>r!=="model"&&r!=="app")||new Set(t.visibility).size!==t.visibility.length)throw new D("DEFINITION_UNSUPPORTED","UI legacy tool metadata is invalid");try{let r=ae(t.inputSchema);if(r.type!==void 0&&r.type!=="object")throw new Error("schema type");if(o){if(!n)throw new Error("fixed result location");let s=t.fixedResult;if(!s||typeof s!="object"||Array.isArray(s))throw new Error("fixed result");let a=s;if(Object.keys(a).sort().join(",")!=="argsPolicy,structuredContent"||a.argsPolicy!=="empty-only"&&a.argsPolicy!=="ignore"||!a.structuredContent||typeof a.structuredContent!="object"||Array.isArray(a.structuredContent))throw new Error("fixed result");let c=ae(a.structuredContent);if(yn(he(c))>4*1024)throw new Error("fixed result size")}}catch{throw new D("DEFINITION_UNSUPPORTED","UI legacy tool metadata is not projection-safe")}}function On(e){if(!Array.isArray(e.allow)||e.allow.some(n=>!/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*$/.test(n)))throw new D("DEFINITION_UNSUPPORTED","UI projection policy is invalid")}function Wo(e){return e.length>0&&e.length<=128&&e!=="*"&&e!=="all"&&!/[/*]/.test(e)}var ne=class extends Error{constructor(t,i=t,o=[]){super(i);this.code=t;this.violations=o;}code;violations;name="UiDefinitionLineageError"},St=/^[0-9a-f]{64}$/,Jo=["version","hash","definition"],Ko=["sourceHash","compat"],Xo=["id","version","actions"],Yo=["sourceHash","usage","detailPanel","displayModes","renderer","surfaces","stateProjection","dataPaths","summaryProjection","legacy"],qo=["capabilities"],Zo=["inputKeys","dataInputs","confirmation","resultProjection"];function we(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function kn(e,n,t=[]){let i=new Set([...n,...t]),o=Object.keys(e);return n.every(r=>Object.hasOwn(e,r))&&o.every(r=>i.has(r))}function Ut(e){if(e===null||typeof e!="object"||Object.isFrozen(e))return e;for(let n of Object.values(e))Ut(n);return Object.freeze(e)}function F(e){throw new ne("LINEAGE_INVALID",e)}function Qo(e){throw new ne("LINEAGE_STALE",e)}function Rt(e){if(!we(e)||!kn(e,Xo,Yo)||!we(e.actions))return F("Lineage definition shape is invalid");for(let n of Object.values(e.actions))if(!we(n)||!kn(n,qo,Zo))return F("Lineage action definition shape is invalid");return e}function er(e){if(!we(e)||!kn(e,Jo,Ko))return F("Lineage entry shape is invalid");if(!Number.isSafeInteger(e.version)||e.version<1||typeof e.hash!="string"||!St.test(e.hash))return F("Lineage entry identity is invalid");if(e.sourceHash!==void 0&&(typeof e.sourceHash!="string"||!St.test(e.sourceHash)))return F("Lineage source hash is invalid");if(e.compat!==void 0&&e.compat!=="break")return F("Lineage compatibility marker is invalid");let n=Rt(e.definition);if(n.version!==e.version)return F("Lineage version does not match its definition");if(e.sourceHash!==void 0&&n.sourceHash!==e.sourceHash)return F("Lineage source hash does not match its definition");let t;try{t=pe(n),de({...n,hash:e.hash});}catch{return F("Lineage definition is invalid")}return t!==e.hash?F("Lineage definition hash does not match"):Ut({version:e.version,hash:e.hash,definition:n,...e.sourceHash===void 0?{}:{sourceHash:e.sourceHash},...e.compat===void 0?{}:{compat:e.compat}})}function Lt(e){return e.stateProjection?.allow??[]}function nr(e,n){let t=[],i=new Set(Lt(n));Lt(e).some(a=>!i.has(a))&&t.push("S1_STATE_PROJECTION");let o=new Set(n.dataPaths??[]);(e.dataPaths??[]).some(a=>!o.has(a))&&t.push("S2_DATA_PATHS");for(let[a,c]of Object.entries(e.actions)){let p=n.actions[a];if(p&&(c.confirmation??"native")==="native"&&(p.confirmation??"native")!=="native"){t.push("S3_ACTION_CONFIRMATION");break}}Object.keys(e.legacy?.agentAccess??{}).some(a=>!Object.hasOwn(n.actions,a))&&t.push("S4_LEGACY_AGENT_ACTIONS");let s=e.summaryProjection?.allow;if(s!==void 0){let a=new Set(n.summaryProjection?.allow??[]);s.some(c=>!a.has(c))&&t.push("S5_SUMMARY_PROJECTION");}return t}function tr(e,n){return K(e)===K(n)}function Ot(e,n){if(!Array.isArray(e)||e.length===0)return F("Definition lineage is missing");if(!we(n)||typeof n.hash!="string")return F("Current definition is invalid");let t,i;try{let{hash:a,...c}=n;i=Rt(c),t={...i,hash:a},de(t);}catch{return F("Current definition is invalid")}let o=e.map(er),r=o[0].definition.id;if(o.some(a=>a.definition.id!==r))return F("Lineage definition ids do not match");if(o.some((a,c)=>c>0&&a.version<=o[c-1].version))return F("Lineage generations are not in increasing version order");if(o.some((a,c)=>o.findIndex(p=>p.hash===a.hash)!==c))return F("Lineage contains a duplicate hash");let s=o[o.length-1];if(s.version!==t.version||s.hash!==t.hash||s.definition.id!==t.id||!tr(s.definition,i))return Qo("The last lineage generation does not match the current package");for(let a=0;a<o.length-1;a+=1){if(o.slice(a,-1).some(u=>u.compat==="break"))continue;let p=nr(o[a].definition,t);if(p.length>0)throw new ne("LINEAGE_INVALID",`Lineage compatibility failed: ${p.join(", ")}`,p)}return Object.freeze({entries:Object.freeze(o),current:t})}var ir=new WeakSet;function kt(e){return ir.add(e),e}var le=class extends Error{constructor(t,i=t){super(i);this.code=t;}code;name="McpAppContractError"};function xn(e,n=e){throw new le(e,n)}var xt=["crewx_app_terminal_connect","crewx_app_html_viewer_open"];var We=8*1024*1024;new Set(xt);var rr=4;function wn(e,n=0){try{let t=ae(e,n);return t.type!==void 0&&t.type!=="object"&&xn("TOOL_INVALID","MCP App inputSchema must describe an object"),t}catch(t){if(t instanceof le)throw t;xn("TOOL_INVALID","MCP App inputSchema must be projection-safe JSON");}}function wt(e){if(e.length===0)return wn({type:"object",properties:{},additionalProperties:false});let n=e.map(i=>i.actionId),t=new Map;for(let i of e)t.set(i.actionId,wn(i.inputSchema));return wn(sr(n,t),rr)}function sr(e,n){let t=e.map(i=>({type:"object",properties:{actionId:{type:"string",const:i},input:n.get(i)??{type:"object"}},required:["actionId","input"],additionalProperties:false}));return Object.freeze({type:"object",oneOf:Object.freeze(t),properties:Object.freeze({actionId:Object.freeze({type:"string",enum:Object.freeze([...e])}),input:Object.freeze({type:"object"})}),required:Object.freeze(["actionId","input"]),additionalProperties:false})}var _=class extends Error{constructor(t){super(t);this.code=t;}code;name="AppDiscoveryFsError"},Bt=constants.O_NOFOLLOW,dr=constants.O_NONBLOCK,lr=constants.O_RDONLY|(Bt??0)|(dr??0);function te(e){let n=typeof e=="object"&&e!==null&&"code"in e?String(e.code):"";return n==="ENOENT"?new _("NOT_FOUND"):n==="ELOOP"?new _("PATH_ESCAPED"):n==="EFBIG"||n==="EOVERFLOW"?new _("LIMIT_EXCEEDED"):n==="EACCES"||n==="EPERM"||n==="ENOTDIR"?new _("READ_DENIED"):new _("READ_DENIED")}function ur(e){if(typeof e!="string"||e.length===0||!isAbsolute(e))throw new _("READ_DENIED")}function Ct(e){if(typeof e!="string"||isAbsolute(e)||/[\\\u0000]/.test(e))throw new _("PATH_ESCAPED");if(e==="")return [];let n=e.split("/");if(n.some(t=>t.length===0||t==="."||t===".."))throw new _("PATH_ESCAPED");return n}function Je(e,n){let t=relative(e,n);return t===""||t!==".."&&!t.startsWith(`..${sep}`)&&!isAbsolute(t)}function Ke(e){return {dev:e.dev,ino:e.ino,size:e.size,mtimeNs:e.mtimeNs,ctimeNs:e.ctimeNs}}function Vn(e,n){return e.dev===n.dev&&e.ino===n.ino}function Ht(e,n){return Vn(e,n)&&e.size===n.size&&e.mtimeNs===n.mtimeNs&&e.ctimeNs===n.ctimeNs}async function vt(e){ur(e);let n,t;try{n=await realpath(e),t=await stat(n,{bigint:!0});}catch(i){throw te(i)}if(!t.isDirectory())throw new _("READ_DENIED");return {realRoot:n,identity:Ke(t)}}async function fr(e,n,t){if(t.length<2||t[0]!=="apps"&&t[0]!=="skills")return;let i,o;try{if(i=resolve(e,t[0],t[1]),o=await realpath(i),!(await stat(o,{bigint:!0})).isDirectory())throw new _("READ_DENIED")}catch(r){throw r instanceof _?r:te(r)}if(!Je(n,o))throw new _("PATH_ESCAPED");return o}async function Vt(e,n,t,i){let o,r,s;try{o=await lstat(e,{bigint:!0}),r=await realpath(e),s=await stat(r,{bigint:!0});}catch(a){throw te(a)}if(!Je(n,r)||t!==void 0&&!Je(t,r))throw new _("PATH_ESCAPED");if(!o.isFile()||!s.isFile())throw new _("READ_DENIED");if(!Vn(i,o)||!Vn(i,s)||i.dev!==s.dev)throw new _("PATH_ESCAPED")}async function Cn(e,n){let t,i;try{t=await realpath(e),i=await stat(t,{bigint:!0});}catch{throw new _("PATH_ESCAPED")}if(t!==n.realRoot||!Ht(n.identity,Ke(i)))throw new _("PATH_ESCAPED")}function yr(e){return e.isSymbolicLink()?{name:e.name,kind:"symlink"}:e.isDirectory()?{name:e.name,kind:"directory"}:e.isFile()?{name:e.name,kind:"file"}:{name:e.name,kind:"other"}}var Xe=class{async listDirectory(n,t){let i=Ct(t),o=await vt(n),r=resolve(n,...i),s,a;try{s=await realpath(r),a=await stat(s,{bigint:!0});}catch(c){let p=te(c);if(p.code==="NOT_FOUND")return [];throw p}if(!Je(o.realRoot,s)||!a.isDirectory())throw new _("PATH_ESCAPED");try{let c=await readdir(s,{withFileTypes:!0,encoding:"utf8"});return await Cn(n,o),c.map(yr)}catch(c){let p=te(c);if(p.code==="NOT_FOUND")return [];throw p}}async readdir(n,t){return this.listDirectory(n,t)}async readDirectory(n,t){return this.listDirectory(n,t)}async readVerifiedFile(n,t,i){if(!Number.isSafeInteger(i)||i<0)throw new _("READ_DENIED");if(Bt===void 0)throw new _("UNSUPPORTED");let o=Ct(t),r=await vt(n),s=resolve(n,...o),a=relative(n,s);if(a===".."||a.startsWith(`..${sep}`)||isAbsolute(a))throw new _("PATH_ESCAPED");let c;try{c=await open(s,lr);}catch(p){throw te(p)}try{let p;try{let g=await c.stat({bigint:!0});p=Ke(g);}catch(g){throw te(g)}if(p.size>BigInt(i))throw new _("LIMIT_EXCEEDED");if(p.size>BigInt(Number.MAX_SAFE_INTEGER))throw new _("LIMIT_EXCEEDED");await Cn(n,r);let u=await fr(n,r.realRoot,o);await Vt(s,r.realRoot,u,p);let f=new Uint8Array(new ArrayBuffer(Number(p.size))),A=0;for(;A<f.byteLength;){let g;try{g=(await c.read(f,A,f.byteLength-A,A)).bytesRead;}catch(T){throw te(T)}if(g<=0)throw new _("IDENTITY_CHANGED");A+=g;}let m;try{let g=await c.stat({bigint:!0});m=Ke(g);}catch(g){throw te(g)}if(!Ht(p,m))throw new _("IDENTITY_CHANGED");return await Vt(s,r.realRoot,u,m),await Cn(n,r),new Uint8Array(f)}finally{await c.close().catch(()=>{});}}async readFileVerified(n,t,i){return this.readVerifiedFile(n,t,i)}},zt=new Xe;var jn="crewx_local_app_";function Ar(e){if(typeof e!="string"||!_e.test(e))throw new TypeError("pluginId must be a safe UI plugin identifier");let n=`${jn}${e}`.length+7<=128?e:`hash_${createHash("sha256").update(e,"utf8").digest("hex")}`;return {read:`${jn}${n}_read`,action:`${jn}${n}_action`}}var Gt=["bundled","apps","skills"],gr=256*1024,$n=64,Wn=128,Ir=$n*Wn,mr=2*1024*1024,Bn=32*1024*1024,zn=/^[0-9a-f]{64}$/,hr=new TextDecoder("utf-8",{fatal:true});function ge(e){if(e===null||typeof e!="object"||Array.isArray(e))return false;try{let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}catch{return false}}function Ze(e){return typeof e=="string"&&_e.test(e)?e:void 0}function Er(e,n){return n.length===0||n==="."||n===".."||/[\\/\u0000]/.test(n)?e==="skills"?"skills":"apps":`${e==="skills"?"skills":"apps"}/${n}`}function qt(e){return e.length>0&&e!=="."&&e!==".."&&!/[\\/\u0000]/.test(e)}function Me(e,n){let t=new TextEncoder().encode(e),i=new TextEncoder().encode(n),o=Math.min(t.byteLength,i.byteLength);for(let r=0;r<o;r+=1){let s=t[r]-i[r];if(s!==0)return s}return t.byteLength-i.byteLength}function _r(e){if(typeof e=="string")return {name:e,kind:"directory"};if(e===null||typeof e!="object")return null;let n=e;if(typeof n.name!="string")return null;if(n.kind==="file"||n.kind==="directory"||n.kind==="symlink"||n.kind==="other")return {name:n.name,kind:n.kind};if(n.type==="file"||n.type==="directory"||n.type==="symlink"||n.type==="other")return {name:n.name,kind:n.type};let t=n.isDirectory;if(typeof t=="function"&&t.call(e))return {name:n.name,kind:"directory"};let i=n.isSymbolicLink;if(typeof i=="function"&&i.call(e))return {name:n.name,kind:"symlink"};let o=n.isFile;return typeof o=="function"&&o.call(e)?{name:n.name,kind:"file"}:{name:n.name,kind:"other"}}function Tr(e){if(e instanceof Uint8Array)return new Uint8Array(e);if(e instanceof ArrayBuffer)return new Uint8Array(e.slice(0));if(Array.isArray(e)&&e.every(n=>Number.isInteger(n)&&n>=0&&n<=255))return Uint8Array.from(e);throw new TypeError("filesystem port returned an invalid byte array")}function Zt(e){return hr.decode(e)}function Jn(e){return JSON.parse(Zt(e))}function Pr(e){if(!ge(e))return;let n=Ze(e.pluginId);if(!n)return;let t=Ze(e.definitionId),i=e.version,o=t&&Number.isSafeInteger(i)&&i>=1?`${t}\0${String(i)}`:void 0;return {pluginId:n,...o===void 0?{}:{definitionKey:o}}}function Dr(e){let n=Jn(e);return {value:n,identity:Pr(n)}}function nn(e,n,t,i){let o={code:e,...i===void 0?{}:{pluginId:i},source:n,relativePath:t};return Object.freeze(o)}function $t(e){switch(e){case "ENOENT":return "NOT_FOUND";case "ELOOP":case "EXDEV":return "PATH_ESCAPED";case "EFBIG":case "EOVERFLOW":return "LIMIT_EXCEEDED";case "EACCES":case "EPERM":case "ENOTDIR":return "READ_DENIED";default:return e}}function ue(e){if(e instanceof _)return $t(e.code);if(e!==null&&typeof e=="object"&&"code"in e){let n=e.code;if(typeof n=="string")return $t(n)}}function Ve(e,n){return e==="PATH_ESCAPED"||e==="IDENTITY_CHANGED"||e==="TOCTOU"?"PATH_ESCAPED":e==="LIMIT_EXCEEDED"?"LIMIT_EXCEEDED":n==="manifest"&&e==="NOT_FOUND"?"MANIFEST_MISSING":n==="entry"?"ENTRY_INVALID":n==="initial"?"INITIAL_STATE_INVALID":"MANIFEST_INVALID"}function Wt(e){switch(e.code){case "MANIFEST_INVALID":case "PRIMITIVE_UNKNOWN":case "PRIMITIVE_SET_UNSUPPORTED":case "SCHEMA_TYPE_UNSUPPORTED":case "TOKEN_INVALID":case "UNSAFE_VALUE":return "MANIFEST_INVALID";case "LIMIT_EXCEEDED":return "LIMIT_EXCEEDED";case "INITIAL_STATE_INVALID":return "INITIAL_STATE_INVALID";default:return Qt("UiPluginValidationError",e.code)}}function Qt(e,n){throw new Error(`Unmapped ${e} code: ${String(n)}`)}function Hn(e){switch(e){case "APP_ID_INVALID":case "TOOL_ID_INVALID":case "RESOURCE_URI_INVALID":case "TOOL_INVALID":case "SERIALIZATION_INVALID":return "MANIFEST_INVALID";case "APP_ID_CONFLICT":case "TOOL_ID_CONFLICT":return "DUPLICATE_ID";case "RESOURCE_NOT_FOUND":case "HTML_INVALID":return "ENTRY_INVALID";case "STATE_INVALID":case "STATE_PROJECTION_INVALID":case "BUTTON_INVALID":return "INITIAL_STATE_INVALID";default:return Qt("McpAppContractError",e)}}function Y(e,n){let t=n();return Number.isFinite(t)&&Number.isFinite(e)&&t-e<=5e3}function qe(e,n){let t=Object.keys(e).sort(Me),i=[...n].sort(Me);return t.length===i.length&&t.every((o,r)=>o===i[r])}function Jt(e){if(typeof e!="string"||e.length===0||e.startsWith("/")||/[\\\u0000]/.test(e))return;let n=e.split("/");if(!n.some(t=>t.length===0||t==="."||t===".."))return n}function br(e){let n;try{n=Jn(e);}catch{return}if(!ge(n)||!qe(n,["version","packages"])||n.version!==1||!Array.isArray(n.packages)||n.packages.length>$n)return;let t=new Set,i=new Set,o=0,r=[];for(let s of n.packages){if(!ge(s))return;let a=["packageDir","appId","definition","files"],c=Object.hasOwn(s,"lineage");if(!qe(s,c?[...a,"lineage"]:a))return;let p=Jt(s.packageDir),u=Ze(s.appId);if(!p||p.length!==2||p[0]!=="apps"||!qt(p[1])||!u||t.has(s.packageDir)||!ge(s.definition)||!qe(s.definition,["id","version","hash"]))return;let f=Ze(s.definition.id),A=s.definition.version,m=s.definition.hash;if(!f||!Number.isSafeInteger(A)||A<1||typeof m!="string"||!zn.test(m)||!Array.isArray(s.files)||s.files.length<2||s.files.length>Wn)return;let g=new Set,T=[];for(let M of s.files){if(!ge(M)||!qe(M,["path","sha256"]))return;let L=Jt(M.path);if(!L||typeof M.sha256!="string"||!zn.test(M.sha256))return;let y=L.join("/"),I=`${s.packageDir}/${y}`;if(g.has(y)||i.has(I))return;g.add(y),i.add(I),T.push(Object.freeze({path:y,sha256:M.sha256}));}if(!g.has("ui-plugin.json")||!g.has("ui/index.html")||(o+=T.length,o>Ir))return;t.add(s.packageDir),r.push(Object.freeze({packageDir:s.packageDir,appId:u,definition:Object.freeze({id:f,version:A,hash:m}),lineage:Array.isArray(s.lineage)?s.lineage:[],files:Object.freeze(T.sort((M,L)=>Me(M.path,L.path)))}));}return Object.freeze({version:1,packages:Object.freeze(r)})}function Nr(e){return {pluginId:e.appId,definitionKey:`${e.definition.id}\0${String(e.definition.version)}`}}function Ae(e){let n=ue(e);return n==="PATH_ESCAPED"||n==="IDENTITY_CHANGED"||n==="TOCTOU"?"PATH_ESCAPED":n==="LIMIT_EXCEEDED"?"LIMIT_EXCEEDED":"BUNDLE_INTEGRITY"}async function Mr(e,n,t,i,o){let r=[],s=async(a,c)=>{if(!Y(i,o))throw new _("LIMIT_EXCEEDED");if(c>2)throw new _("LIMIT_EXCEEDED");let p=await en(e,n,a);for(let u of p){if(typeof u.name!="string"||u.name.length===0||u.name==="."||u.name===".."||/[\\/\u0000]/.test(u.name))throw new _("PATH_ESCAPED");let f=`${a}/${u.name}`;if(u.kind==="file"){if(r.push(f.slice(t.length+1)),r.length>Wn)throw new _("LIMIT_EXCEEDED")}else if(u.kind==="directory")await s(f,c+1);else throw u.kind==="symlink"?new _("PATH_ESCAPED"):new _("READ_DENIED")}};return await s(t,0),r.sort(Me)}function Sr(e){return e==="ui-plugin.json"?262144:e==="ui/index.html"?We:e==="ui/state.json"?65536:mr}async function Lr(e,n,t,i){if(e===void 0)return {packages:[],diagnostics:[],incomplete:false};let o=[],r=(l,N,q)=>nn(l,"bundled",N,q);if(typeof e.root!="string"||e.root.length===0||typeof e.expectedIndexHash!="string"||!zn.test(e.expectedIndexHash))return o.push(r("BUNDLE_INTEGRITY","bundle-index.json")),{packages:[],diagnostics:o,incomplete:false};let s;try{s=await Qe(n,e.root,"bundle-index.json",gr);}catch(l){return o.push(r(Ae(l),"bundle-index.json")),{packages:[],diagnostics:o,incomplete:false}}let a=createHash("sha256").update(s).digest("hex");if(a!==e.expectedIndexHash)return o.push(r("BUNDLE_INTEGRITY","bundle-index.json")),{packages:[],diagnostics:o,incomplete:false};let c=br(s);if(c===void 0)return o.push(r("BUNDLE_INTEGRITY","bundle-index.json")),{indexHash:a,packages:[],diagnostics:o,incomplete:false};if(!Y(t,i))return o.push(r("LIMIT_EXCEEDED","bundle-index.json")),{indexHash:a,packages:c.packages.map(l=>({indexEntry:l,failureCode:"LIMIT_EXCEEDED"})),diagnostics:o,incomplete:true};let p;try{p=await en(n,e.root,"");}catch(l){return o.push(r(Ae(l),"bundle-index.json")),{indexHash:a,packages:c.packages.map(N=>({indexEntry:N,failureCode:Ae(l)})),diagnostics:o,incomplete:false}}if(!Y(t,i))return o.push(r("LIMIT_EXCEEDED","bundle-index.json")),{indexHash:a,packages:c.packages.map(l=>({indexEntry:l,failureCode:"LIMIT_EXCEEDED"})),diagnostics:o,incomplete:true};let u=p.find(l=>l.name==="bundle-index.json"&&l.kind==="file"),f=p.find(l=>l.name==="apps"&&l.kind==="directory"),A=l=>c.packages.map(N=>({indexEntry:N,failureCode:l}));if(!u)return o.push(r("BUNDLE_INTEGRITY","bundle-index.json")),{indexHash:a,packages:A("BUNDLE_INTEGRITY"),diagnostics:o,incomplete:false};let m=p.filter(l=>l.name!=="bundle-index.json"&&l.name!=="apps");if(m.length>0){let l=m.some(N=>N.kind==="symlink")?"PATH_ESCAPED":"BUNDLE_INTEGRITY";return o.push(r(l,"bundle-index.json")),{indexHash:a,packages:A("BUNDLE_INTEGRITY"),diagnostics:o,incomplete:false}}if(p.some(l=>l.name==="apps"&&l.kind!=="directory"))return o.push(r("PATH_ESCAPED","apps")),{indexHash:a,packages:A("PATH_ESCAPED"),diagnostics:o,incomplete:false};let g=[];if(f)try{g=await en(n,e.root,"apps");}catch(l){return o.push(r(Ae(l),"apps")),{indexHash:a,packages:A(Ae(l)),diagnostics:o,incomplete:false}}if(!Y(t,i))return o.push(r("LIMIT_EXCEEDED","apps")),{indexHash:a,packages:A("LIMIT_EXCEEDED"),diagnostics:o,incomplete:true};if(g.length>$n)return o.push(r("LIMIT_EXCEEDED","apps")),{indexHash:a,packages:A("LIMIT_EXCEEDED"),diagnostics:o,incomplete:true};let T=new Map(c.packages.map(l=>[l.packageDir.slice(5),l])),M=g.filter(l=>!T.has(l.name));for(let l of M)o.push(r(l.kind==="symlink"?"PATH_ESCAPED":"BUNDLE_INTEGRITY",`apps/${l.name}`));if(M.length>0){let l=M.some(N=>N.kind==="symlink")?"PATH_ESCAPED":"BUNDLE_INTEGRITY";return {indexHash:a,packages:A(l),diagnostics:o,incomplete:false}}let L=new Set,y=new Map,I=new Map;for(let l of c.packages){let N=y.get(l.appId)??[];N.push(l),y.set(l.appId,N);let q=`${l.definition.id}\0${String(l.definition.version)}`,W=I.get(q)??[];W.push(l),I.set(q,W);}for(let l of [...y.values(),...I.values()])if(l.length>1)for(let N of l)L.add(N);let P=[],V=s.byteLength,O=false;for(let l of c.packages){if(!Y(t,i)){O=true,P.push({indexEntry:l,failureCode:"LIMIT_EXCEEDED"});continue}let N;try{let k=l.lineage[l.lineage.length-1];if(!k)throw new ne("LINEAGE_INVALID","Definition lineage is missing");if(k.definition.id!==l.definition.id||k.version!==l.definition.version||k.hash!==l.definition.hash)throw new ne("LINEAGE_STALE","Last lineage generation does not match bundle identity");N=Ot(l.lineage,{...k.definition,hash:k.hash}).entries;}catch(k){let E=k instanceof ne?k.code:"LINEAGE_INVALID";o.push(r(E,l.packageDir)),P.push({indexEntry:l,failureCode:E});continue}let q=g.find(k=>k.name===l.packageDir.slice(5));if(!f||!q){P.push({indexEntry:l,failureCode:"BUNDLE_INTEGRITY"});continue}if(q.kind!=="directory"){P.push({indexEntry:l,failureCode:q.kind==="symlink"?"PATH_ESCAPED":"BUNDLE_INTEGRITY"});continue}let W;try{let k=await Mr(n,e.root,l.packageDir,t,i);if(!Y(t,i)){O=!0,P.push({indexEntry:l,failureCode:"LIMIT_EXCEEDED"});continue}let E=l.files.map(z=>z.path);if(k.length!==E.length||k.some((z,ee)=>z!==E[ee])){P.push({indexEntry:l,failureCode:"BUNDLE_INTEGRITY"});continue}W=new Map;let B;for(let z of l.files){if(!Y(t,i)){B="LIMIT_EXCEEDED",O=!0;break}if(V>=Bn){B="LIMIT_EXCEEDED";break}let ee;try{ee=await Qe(n,e.root,`${l.packageDir}/${z.path}`,Sr(z.path));}catch(it){B=Ae(it);break}if(!Y(t,i)){B="LIMIT_EXCEEDED",O=!0;break}if(V+ee.byteLength>Bn){V=Bn,B="LIMIT_EXCEEDED";break}if(V+=ee.byteLength,createHash("sha256").update(ee).digest("hex")!==z.sha256){B="BUNDLE_INTEGRITY";break}W.set(z.path,ee);}if(B!==void 0){P.push({indexEntry:l,failureCode:B});continue}}catch(k){Y(t,i)||(O=true),P.push({indexEntry:l,failureCode:Ae(k)});continue}P.push({indexEntry:l,lineage:N,files:W,...L.has(l)?{failureCode:"DUPLICATE_ID"}:{}});}return {indexHash:a,packages:P,diagnostics:o,incomplete:O}}function Ur(){return globalThis.performance?.now()??Date.now()}function be(e){if(e===null||typeof e!="object"||Object.isFrozen(e))return e;for(let n of Object.values(e))be(n);return Object.freeze(e)}function Kt(e){return Object.freeze(Array.from(e))}async function Gn(e,n,t,i){if(n.pinnedFiles!==void 0){let o=n.pinnedFiles.get(t);if(o===void 0)throw new _("NOT_FOUND");if(o.byteLength>i)throw new _("LIMIT_EXCEEDED");return new Uint8Array(o)}return Qe(e,n.root,`${n.relativePath}/${t}`,i)}function Rr(e,n,t){let i=createHash("sha256"),o=new TextEncoder().encode(K(e)),r=s=>{let a=new Uint8Array(8);new DataView(a.buffer).setBigUint64(0,BigInt(s)),i.update(a);};return r(o.byteLength),i.update(o),r(n.byteLength),i.update(n),r(t.byteLength),i.update(t),i.digest("hex")}function Or(e,n){let t={...e.definition,sourceHash:n},i={...t,hash:pe(t)};try{de(i);}catch{throw new $("MANIFEST_INVALID","normalized definition is invalid")}return i}function kr(e){return e.actions.some(n=>n.backend.type==="core"&&n.backend.handler!=="state.set")}function xr(e){if(typeof e.readVerifiedFile=="function")return e.readVerifiedFile;if(typeof e.readFileVerified=="function")return e.readFileVerified}function wr(e){if(typeof e.listDirectory=="function")return e.listDirectory;if(typeof e.readDirectory=="function")return e.readDirectory;if(typeof e.readdir=="function")return e.readdir}async function Qe(e,n,t,i){let o=xr(e);if(!o)throw new _("READ_DENIED");return Tr(await o.call(e,n,t,i))}async function en(e,n,t){let i=wr(e);if(!i)throw new _("READ_DENIED");let o=await i.call(e,n,t);if(!Array.isArray(o))throw new _("READ_DENIED");return o.map(_r).filter(r=>r!==null)}function Cr(e){let n=[];for(let t of [e.reserved,e.builtin])t&&n.push(t);return e.builtins&&"listMcpApps"in e.builtins?n.push(Xt(e.builtins)):e.builtins&&n.push(e.builtins),e.builtinCatalog&&n.push(Xt(e.builtinCatalog)),n.push({...e.reservedAppIds===void 0?{}:{appIds:e.reservedAppIds},...e.reservedDefinitionIds===void 0?{}:{definitionIds:e.reservedDefinitionIds},...e.reservedToolNames===void 0?{}:{toolNames:e.reservedToolNames}}),n}function Xt(e){let n=[],t=[],i=[];for(let o of e.listMcpApps())typeof o.appId=="string"&&n.push(o.appId),o.definition&&typeof o.definition.id=="string"&&t.push(o.definition.id);for(let o of e.listMcpAppTools())typeof o.name=="string"&&i.push(o.name);return {appIds:n,definitionIds:t,toolNames:i}}function ie(e,n){e.diagnostic||(e.diagnostic=nn(n,e.source,e.relativePath,e.identity?.pluginId));}function vr(e){let n=new Map;for(let i of e){let o=i.identity?.pluginId;if(o===void 0)continue;let r=n.get(o)??[];r.push(i),n.set(o,r);}for(let i of n.values()){if(i.length<2)continue;let o=i.filter(s=>s.provenance!==void 0);if(o.length>0){for(let s of i)s.provenance===void 0&&ie(s,"RESERVED_ID");if(o.length>1)for(let s of o)ie(s,"DUPLICATE_ID");continue}let r=i.filter(s=>s.source==="apps");if(r.length>1){for(let s of r)ie(s,"DUPLICATE_ID");for(let s of i.filter(a=>a.source==="skills"))ie(s,"DUPLICATE_ID");}else for(let s of i.filter(a=>a.source==="skills"))ie(s,"DUPLICATE_ID");}let t=new Map;for(let i of e){if(i.diagnostic?.code==="RESERVED_ID")continue;let o=i.identity?.definitionKey;if(o===void 0)continue;let r=t.get(o)??[];r.push(i),t.set(o,r);}for(let i of t.values())if(i.length>1)for(let o of i)ie(o,"DUPLICATE_ID");}function Vr(e,n,t){let i=new Set,o=new Set,r=new Set,s=new Set(t.map(c=>c.appId)),a=new Set(e.filter(c=>c.source==="bundled"&&c.candidate===void 0).flatMap(c=>c.bundleIdentity===void 0?[]:[c.bundleIdentity.definitionId]));for(let c of Cr(n)){for(let p of c.appIds??[])typeof p=="string"&&i.add(p);for(let p of c.definitionIds??[])typeof p=="string"&&o.add(p);for(let p of c.toolNames??[])typeof p=="string"&&r.add(p);}for(let c of e){let p=c.candidate;if(!p)continue;if(i.has(p.pluginId)||o.has(p.definitionId)){ie(c,"RESERVED_ID");continue}if(c.provenance===void 0&&(s.has(p.pluginId)||a.has(p.definitionId))){ie(c,"RESERVED_ID");continue}[p.toolNames.read,p.toolNames.action].filter(f=>f!==void 0).some(f=>r.has(f))&&ie(c,"DUPLICATE_ID");}}function Fr(e){return [...e].sort((n,t)=>{let i=Gt.indexOf(n.source)-Gt.indexOf(t.source);return i!==0?i:Me(n.relativePath,t.relativePath)})}function b(e,n){e.diagnostic=nn(n,e.source,e.relativePath,e.identity?.pluginId);}async function Yt(e,n,t){if(t.byteLength>262144){b(n,"LIMIT_EXCEEDED");return}let i;try{i=Dr(t);}catch{b(n,"MANIFEST_INVALID");return}if(n.bundleIdentity===void 0)n.identity=i.identity;else if(i.identity?.pluginId!==n.bundleIdentity.appId||i.identity.definitionKey!==`${n.bundleIdentity.definitionId}\0${String(n.bundleIdentity.version)}`){b(n,"BUNDLE_INTEGRITY");return}if(ge(i.value)&&i.value.builtinOnly===true){b(n,"RESERVED_ID");return}let o;try{let E=ye(i.value,{mode:"local"});if(E.manifestVersion!==2)throw new $("MANIFEST_INVALID","workspace App requires v2");o=E;}catch(E){if(E instanceof $){b(n,Wt(E));return}if(E instanceof le){b(n,Hn(E.code));return}if(ge(E)&&typeof E.code=="string"){b(n,Hn(E.code));return}throw E}let r={pluginId:o.pluginId,definitionKey:`${o.definitionId}\0${String(o.version)}`};if(n.bundleIdentity===void 0&&(n.identity=r),o.actions.length>0)try{wt(o.actions.map(E=>({actionId:E.actionId,inputSchema:E.inputSchema})));}catch(E){if(E instanceof le){b(n,Hn(E.code));return}throw E}let s;try{s=await Gn(e,n,"ui/index.html",We);}catch(E){b(n,Ve(ue(E),"entry"));return}if(s.byteLength>We){b(n,"LIMIT_EXCEEDED");return}let a;try{a=Zt(s);}catch{b(n,"ENTRY_INVALID");return}if(s.byteLength===0||a.length===0){b(n,"ENTRY_INVALID");return}let c=createHash("sha256").update(s).digest("hex");if(o.entryHash!==void 0&&o.entryHash!==c){b(n,"ENTRY_INVALID");return}let p={},u,f;if(o.initialState!==void 0){try{u=await Gn(e,n,"ui/state.json",65536);}catch(E){b(n,Ve(ue(E),"initial"));return}if(u.byteLength>65536){b(n,"LIMIT_EXCEEDED");return}try{let E=Jn(u),B=o.dataPaths??[],z=Sn(E,B);p=ae(z,0,B),he(p);}catch{b(n,"INITIAL_STATE_INVALID");return}if(f=createHash("sha256").update(u).digest("hex"),o.initialState.hash!==void 0&&o.initialState.hash!==f){b(n,"INITIAL_STATE_INVALID");return}}let A={...o,entryHash:c,...o.initialState===void 0?{}:{initialState:{path:"ui/state.json",hash:f}}},m=Ln(A),g=Rr(A,s,u??new Uint8Array),T;try{T=Or(m,g);}catch(E){if(E instanceof $){b(n,Wt(E));return}throw E}let M;if(n.bundleLineage!==void 0){let E=n.bundleLineage[n.bundleLineage.length-1];if(!E){b(n,"LINEAGE_INVALID");return}let{legacy:B,summaryProjection:z,...ee}=E.definition,{hash:it,...xi}=T;if(K(ee)!==K(xi)){b(n,"LINEAGE_STALE");return}if(B!==void 0&&(T={...T,legacy:B}),z!==void 0&&(T={...T,summaryProjection:z}),B!==void 0||z!==void 0)try{T={...T,hash:pe(T)},de(T);}catch{b(n,"LINEAGE_INVALID");return}M=n.bundleLineage;}if(n.bundleIdentity!==void 0&&n.bundleIdentity.appId!==o.pluginId){b(n,"BUNDLE_INTEGRITY");return}if(n.bundleIdentity!==void 0&&(n.bundleIdentity.definitionId!==T.id||n.bundleIdentity.version!==T.version||n.bundleIdentity.definitionHash!==T.hash)){b(n,"LINEAGE_STALE");return}let L=Ar(o.pluginId),y=o.actions.length===0?{read:L.read}:L,I=be(m),P=be(A),V=be(T),O=be({...m.handlers}),l=Kt(s),N=u===void 0?void 0:Kt(u),q=Object.freeze({...n.provenance===void 0?{}:{provenance:n.provenance},entry:Object.freeze({path:"ui/index.html",hash:c,bytes:l}),...N===void 0?{}:{initialState:Object.freeze({path:"ui/state.json",hash:f,bytes:N})}}),W={appId:o.pluginId,pluginId:o.pluginId,definitionId:o.definitionId,version:o.version,relativePath:n.relativePath,manifest:P,normalized:I,name:o.name,description:o.description,...o.icon===void 0?{}:{icon:o.icon},...o.tone===void 0?{}:{tone:o.tone},definition:V,handlers:O,resources:q,html:a,entryBytes:l,entryHash:c,initialState:be(p),...N===void 0?{}:{initialStateBytes:N},...f===void 0?{}:{initialStateHash:f},sourceHash:g,toolNames:Object.freeze(y)},k=n.provenance===void 0?{...W,source:n.source}:{...W,provenance:n.provenance,lineage:M??[]};n.candidate=Object.freeze(k),kr(o)&&b(n,"EXEC_DENIED");}async function jr(e,n){try{return await Gn(e,n,"ui-plugin.json",262144)}catch(t){if(ue(t)==="NOT_FOUND")return;b(n,Ve(ue(t),"manifest"));return}}function Br(e,n,t){let i=Fr(e);vr(i);let o=Object.freeze(i.filter(a=>a.candidate!==void 0&&a.diagnostic===void 0).map(a=>a.candidate)),r=Object.freeze(i.filter(a=>a.diagnostic!==void 0).map(a=>a.diagnostic)),s={apps:o,diagnostics:r,complete:n===void 0,...n===void 0?{}:{incompleteReason:n},...t===void 0?{}:{productBundleIndexHash:t}};return Object.defineProperty(s,"candidates",{configurable:false,enumerable:false,get:()=>o}),Object.freeze(s)}function Hr(e){if(e===null||typeof e!="object"&&typeof e!="function")return false;let n=e;return typeof n.readVerifiedFile=="function"||typeof n.readFileVerified=="function"||typeof n.listDirectory=="function"||typeof n.readDirectory=="function"||typeof n.readdir=="function"}function zr(e,n){if(Hr(e))return {fs:e,options:{}};let t=e??n??{};return {fs:t.filesystem??t.fileSystem??t.fs??zt,options:t}}async function ei(e,n,t){if(typeof e!="string"||e.length===0)throw new TypeError("workspaceRoot must be explicit");let{fs:i,options:o}=zr(n,t),r=o.clock??Ur,s=r(),a=[],c=0,p,u=await Lr(o.productBundle,i,s,r);a.push(...u.diagnostics.map(m=>({source:m.source,root:o.productBundle?.root??e,name:"",relativePath:m.relativePath,diagnostic:m})));let f=u.packages.map(m=>m.indexEntry);u.incomplete&&(p="time_limit");for(let m of u.packages){let g=m.indexEntry,T=g.packageDir,M=u.indexHash===void 0?void 0:kt(Object.freeze({kind:"bundled",indexHash:u.indexHash,packageDir:T,appId:g.appId,definitionId:g.definition.id,version:g.definition.version,definitionHash:g.definition.hash,files:g.files})),L={source:"bundled",root:o.productBundle?.root??e,name:T.slice(5),relativePath:T,...M===void 0?{}:{provenance:M},...m.files===void 0?{}:{pinnedFiles:m.files},...m.lineage===void 0?{}:{bundleLineage:m.lineage},bundleIdentity:{appId:g.appId,definitionId:g.definition.id,version:g.definition.version,definitionHash:g.definition.hash},identity:Nr(g)};if(a.push(L),c+=1,m.failureCode!==void 0){b(L,m.failureCode);continue}let y=m.files?.get("ui-plugin.json");if(y===void 0){b(L,"BUNDLE_INTEGRITY");continue}await Yt(i,L,y),L.candidate!==void 0&&L.diagnostic===void 0&&c<64&&!Y(s,r)&&(p="time_limit");}let A=[{source:"apps",directory:"apps"},{source:"skills",directory:"skills"}];for(let m of A){let{source:g,directory:T}=m,M;try{M=await en(i,e,T);}catch(y){if(ue(y)==="NOT_FOUND")continue;a.push({source:g,root:e,name:"",relativePath:g,diagnostic:nn(Ve(ue(y),"manifest"),g,g)});continue}let L=M.filter(y=>y.kind==="directory"||y.kind==="symlink").filter(y=>qt(y.name)).map(y=>({source:g,root:e,name:y.name,relativePath:Er(g,y.name)})).sort((y,I)=>Me(y.relativePath,I.relativePath));for(let y of L){let I={...y};a.push(I);let P;if(g==="skills"&&(P=await jr(i,I),P===void 0))continue;if(c>=64){b(I,"LIMIT_EXCEEDED");continue}if(y.relativePath.split("/").length-1>2){b(I,"LIMIT_EXCEEDED");continue}if(p!==void 0||!Y(s,r)){b(I,"LIMIT_EXCEEDED"),p="time_limit";continue}if(c+=1,P===void 0)try{P=await Qe(i,I.root,`${I.relativePath}/ui-plugin.json`,262144);}catch(O){b(I,Ve(ue(O),"manifest"));continue}await Yt(i,I,P),I.diagnostic===void 0&&c<64&&!Y(s,r)&&(p="time_limit");}}return Vr(a,o,f),Br(a,p,u.indexHash)}var $r=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/;function on(e){let n="screenHash"in e?e.screenHash:void 0,i=("skillHash"in e?e.skillHash:void 0)??(e.relativePath!==void 0&&e.fileBytes!==void 0?Wr(e.relativePath,e.fileBytes):void 0);if(n!==void 0&&i!==void 0){let o=JSON.stringify({screenHash:n,skillHash:i});return createHash("sha256").update(o,"utf8").digest("hex")}if(n!==void 0)return n;if(i!==void 0)return i;throw new TypeError("App definition hash input must contain a screenHash or skill bytes")}function Wr(e,n){let t=new TextEncoder().encode(rn(e)),i=Jr(n),o=new Uint8Array(t.byteLength+1+i.byteLength);return o.set(t,0),o[t.byteLength]=0,o.set(i,t.byteLength+1),createHash("sha256").update(o).digest("hex")}function Jr(e){if(typeof e=="string")return new TextEncoder().encode(e);if(e instanceof Uint8Array)return new Uint8Array(e);if(e instanceof ArrayBuffer)return new Uint8Array(e.slice(0));if(Array.isArray(e)&&e.every(n=>Number.isInteger(n)&&n>=0&&n<=255))return Uint8Array.from(e);throw new TypeError("fileBytes must be UTF-8 text or bytes")}function rn(e){if(typeof e!="string"||e.length===0||isAbsolute(e)||/[\\\u0000]/.test(e))throw new TypeError("relative path must be package-relative");let n=e.split("/").filter(t=>t.length>0&&t!==".").join("/");if(!n||n.split("/").some(t=>t===".."))throw new TypeError("relative path must stay inside the package");return n}function tn(e,n){let t=new TextEncoder().encode(e),i=new TextEncoder().encode(n),o=Math.min(t.byteLength,i.byteLength);for(let r=0;r<o;r+=1){let s=t[r]-i[r];if(s!==0)return s}return t.byteLength-i.byteLength}function ii(e,n){let t=relative(e,n).split(sep).join("/");return !t||t===".."||t.startsWith("../")||isAbsolute(t)?null:rn(t)}function Kr(e){return e==="apps"||e.startsWith("apps/")?"apps":e==="skills"||e.startsWith("skills/")?"skills":e==="node_modules"||e.startsWith("node_modules/")?"node_modules":null}function oi(e){return Object.freeze({packageRoot:e})}function Xr(e){return Object.freeze({id:e.definition.id,version:e.definition.version,hash:e.definition.hash,usage:e.definition.usage??ce,...e.definition.detailPanel===void 0?{}:{detailPanel:e.definition.detailPanel},...e.definition.displayModes===void 0?{}:{displayModes:e.definition.displayModes}})}function ri(e){return {capabilities:Object.freeze([...e]),origin:"local",ownership:"unknown",shareability:"unknown",sharingAvailability:"unavailable"}}function Yr(e,n){let t=e.candidate,i=t.provenance!==void 0,o=n&&!i?["screen","skill"]:["screen"],r=Xr(t),s=on(n?{screenHash:r.hash,skillHash:n.skillHash}:{screenHash:r.hash}),a=t.description||n?.skill.description||"",c=String(t.version),p={appId:t.pluginId,name:t.name,description:a,version:c,...ri(o),definition:r,...n===void 0||i?{}:{skillName:n.skill.name},...i?{provenance:t.provenance}:{localDefinitionRef:oi(e.packageRoot)},definitionHash:s};return {...i?{}:{packageRoot:e.packageRoot},source:i?"bundled":t.source,appId:p.appId,capabilities:o,summary:Object.freeze(p)}}function qr(e){let n=Zr(e.skill.name),t={appId:n,name:e.skill.name,description:e.skill.description??"",...e.skill.version===void 0?{}:{version:e.skill.version},...ri(["skill"]),skillName:e.skill.name,localDefinitionRef:oi(e.packageRoot),definitionHash:on({skillHash:e.skillHash})};return {packageRoot:e.packageRoot,source:e.source,appId:n,capabilities:["skill"],summary:Object.freeze(t)}}function Zr(e){return `skill.${e.replace(/^@/,"").replace(/\//g,".").replace(/[^A-Za-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,122)||"unnamed"}`}function j(e,n,t,i){return Object.freeze({code:e,source:n,relativePath:Qr(t),...i===void 0?{}:{appId:i}})}function Qr(e){if(typeof e!="string"||e.length===0||isAbsolute(e)||/[\\\u0000]/.test(e))return "<unknown>";let n=e.split("/").filter(t=>t.length>0&&t!==".").join("/");return n.split("/").some(t=>t==="..")?"<unknown>":n}function es(e){return j(e.code,e.source,e.relativePath,e.pluginId)}function ns(e,n){let t=ii(e,n.dir);if(!t)return {diagnostic:j("PATH_ESCAPED","node_modules","node_modules")};let i=Kr(t);if(!i)return {diagnostic:j("PATH_ESCAPED","node_modules",t)};let o=Rn(n.skillMdPath);if(!o.readable)return {diagnostic:j("SKILL_READ_FAILED",i,t)};if(!o.valid)return {diagnostic:j("SKILL_INVALID",i,t)};let r=ts(n.dir,n.skillMdPath);if(!r)return {diagnostic:j("PATH_ESCAPED",i,t)};try{let s=new Uint8Array(readFileSync(n.skillMdPath));return {skill:n,packageRoot:t,relativeSkillPath:r,skillHash:on({relativePath:r,fileBytes:s}),source:i}}catch{return {diagnostic:j("SKILL_READ_FAILED",i,t)}}}function ts(e,n){let t=relative(e,n).split(sep).join("/");try{return rn(t)}catch{return null}}function is(e){if(!$r.test(e.appId))return {diagnostic:j("BUILTIN_INVALID","builtin",`builtin/${e.appId||"unknown"}`)};let n=e.definition===void 0?void 0:{id:e.definition.id,version:e.definition.version,hash:e.definition.hash,usage:e.definition.usage??ce,...e.definition.detailPanel===void 0?{}:{detailPanel:e.definition.detailPanel},...e.definition.displayModes===void 0?{}:{displayModes:e.definition.displayModes}},t=n?.hash??createHash("sha256").update(JSON.stringify({appId:e.appId,name:e.name,description:e.description}),"utf8").digest("hex"),i={appId:e.appId,name:e.name,description:e.description,...n===void 0?{}:{version:String(n.version),definition:n},capabilities:["screen"],origin:"builtin",ownership:"unknown",shareability:"forbidden",sharingAvailability:"unavailable",definitionHash:t};return {source:"builtin",appId:e.appId,summary:Object.freeze(i)}}function os(e){return e.builtinCatalog}function rs(e){let n=e.packageRoot??e.relativePath??e.packageRootPath;if(n===void 0)return null;try{return rn(n)}catch{return null}}function ss(e){let n=e.marketplaceContentId;return typeof n=="string"&&n.length>0?n:void 0}function as(e,n,t){let i=n.installed??[],o=new Map;for(let s of i){let a=rs(s);if(!a){t.push(j("INSTALLED_IDENTITY_MISMATCH","installed","installed"));continue}let c=o.get(a);if(c&&JSON.stringify(c)!==JSON.stringify(s)){t.push(j("INSTALLED_IDENTITY_MISMATCH","installed",a));continue}o.set(a,s);}let r=new Map;for(let s of e)s.packageRoot!==void 0&&r.set(s.packageRoot,s);for(let[s,a]of o){let c=r.get(s);if(!c){t.push(j("INSTALLED_MISSING","installed",s,a.appId));continue}let p=ss(a);if(!p){t.push(j("INSTALLED_CONTENT_ID_MISSING","installed",s,a.appId));continue}if(a.appId!==void 0&&a.appId!==c.appId||a.definitionHash!==void 0&&a.definitionHash!==c.summary.definitionHash){t.push(j("INSTALLED_IDENTITY_MISMATCH","installed",s,a.appId));continue}let u={...c.summary,origin:"installed",...a.slug===void 0?{}:{slug:a.slug},marketplaceContentId:p},f=e.indexOf(c);f>=0&&(e[f]={...c,summary:Object.freeze(u)});}}function cs(e,n){let t=new Map;for(let o of e){let r=t.get(o.appId)??[];r.push(o),t.set(o.appId,r);}let i=new Set;for(let o of t.values()){if(o.length<2)continue;let r=o.some(s=>s.source==="builtin")?"builtin":o.some(s=>s.source==="bundled")?"bundled":void 0;if(r!==void 0){let s=o.filter(a=>a.source===r);for(let a of o.filter(c=>c.source!==r))i.add(a),n.push(j("RESERVED_ID",a.source,Xn(a),a.appId));if(s.length>1)for(let a of s)i.add(a),n.push(j("DUPLICATE_ID",a.source,Xn(a),a.appId));continue}for(let s of o)i.add(s),n.push(j("DUPLICATE_ID",s.source,Xn(s),s.appId));}return e.filter(o=>!i.has(o))}function Xn(e){return e.packageRoot??e.summary.provenance?.packageDir??`builtin/${e.appId}`}function ps(e,n){return e.filter(t=>!(t.code==="MANIFEST_MISSING"&&n.has(t.relativePath))).map(es)}function ds(e){return e.filesystem}function ls(e,n){let t=ds(e);return {...t===void 0?{}:{filesystem:t},...e.productBundle===void 0?{}:{productBundle:e.productBundle},...n===void 0?{}:{builtinCatalog:n}}}async function si(e,n={}){if(typeof e!="string"||e.length===0)throw new TypeError("workspaceRoot must be explicit");let t=os(n),i=await ei(e,ls(n,t)),o=[join(e,"skills"),join(e,"node_modules"),join(e,"apps")],r=[],s=[],a=[],c=new Set;for(let y of o)for(let I of Mt([y])){let P=ii(e,I.dir);(P===null||!c.has(P))&&(a.push(I),P!==null&&c.add(P));}for(let y of a){let I=ns(e,y);"diagnostic"in I?r.push(I.diagnostic):s.push(I);}let p=new Map;for(let y of i.apps??i.candidates??[]){let I=y.provenance===void 0?`workspace\0${y.relativePath}`:`bundled\0${y.provenance.indexHash}\0${y.provenance.packageDir}`;p.set(I,{candidate:y,packageRoot:y.relativePath});}let u=new Map(s.map(y=>[y.packageRoot,y])),f=[];for(let y of p.values()){let I=y.candidate.provenance===void 0?u.get(y.packageRoot):void 0,P=Yr(y,I);f.push({...P.packageRoot===void 0?{}:{packageRoot:P.packageRoot},source:P.source,appId:P.appId,summary:P.summary});}let A=new Set([...p.values()].filter(y=>y.candidate.provenance===void 0).map(y=>y.packageRoot));for(let y of s){if(A.has(y.packageRoot))continue;let I=qr(y);f.push({packageRoot:I.packageRoot,source:I.source,appId:I.appId,summary:I.summary});}let m=[...ps(i.diagnostics,new Set(s.map(y=>y.packageRoot))),...r],g=[];if(t)for(let y of t.listMcpApps()){let I=is(y);"diagnostic"in I?m.push(I.diagnostic):g.push(I);}let T=cs([...f,...g],m);as(T,n,m);let M=T.map(y=>y.summary).sort((y,I)=>tn(y.appId,I.appId)),L=[...m].sort((y,I)=>tn(y.relativePath,I.relativePath)||tn(y.code,I.code)||tn(y.appId??"",I.appId??""));return Object.freeze({items:Object.freeze(M),diagnostics:Object.freeze(L)})}function us(e){let n=o=>o.replace(/[.+^${}()|[\]\\]/g,"\\$&"),i=e.split("/").map(o=>o==="**"?".*":o.split("*").map(n).join("[^/]*"));return new RegExp(`^${i.join("\\/")}$`)}function Se(e,n){try{return us(n).test(e)}catch{return false}}function sn(e,...n){let t=e.split("/");if(t.length<n.length)return false;let i=t.length-n.length;return n.every((o,r)=>Se(t[i+r],o))}function fs(e,n){return e.split("/").some(t=>Se(t,n))}var ai=[{label:".env*",test:e=>Se(e,".env*")},{label:".git/",test:(e,n,t)=>t&&e===".git"},{label:"memory/",test:(e,n,t)=>t&&e==="memory"},{label:"*.key",test:e=>Se(e,"*.key")},{label:"*.pem",test:e=>Se(e,"*.pem")},{label:"auth.json",test:e=>e==="auth.json"},{label:"node_modules/",test:(e,n,t)=>t&&e==="node_modules"},{label:"conversations/",test:(e,n,t)=>t&&e==="conversations"},{label:".crewx/threads/",test:(e,n,t)=>t&&sn(n,".crewx","threads")},{label:".crewx/crewx.db",test:(e,n,t)=>!t&&sn(n,".crewx","crewx.db")},{label:".crewx/*.log",test:(e,n,t)=>!t&&sn(n,".crewx","*.log")},{label:".crewx/publish/",test:(e,n,t)=>t&&sn(n,".crewx","publish")},{label:".crewx/",test:(e,n)=>fs(n,".crewx")}];function an(e,n,t){for(let i of ai)if(i.test(e,n,t))return i.label;return null}function Zn(e){let n=[],t=[];function i(o,r,s){let a;try{a=v.readdirSync(o,{withFileTypes:!0});}catch{return}a.sort((c,p)=>c.name.localeCompare(p.name));for(let c of a){let p=r?`${r}/${c.name}`:c.name,u=H.join(o,c.name);if(c.isSymbolicLink()){let f;try{f=v.statSync(u);}catch{t.push({path:p,rule:"symlink"});continue}if(f.isDirectory()){t.push({path:p,rule:s??"symlink-dir"});continue}let A=s??an(c.name,p,false);A?t.push({path:p,rule:A}):t.push({path:p,rule:"symlink"});continue}if(c.isDirectory()){let f=s??an(c.name,p,true);i(u,p,f);continue}if(c.isFile()){let f=s??an(c.name,p,false);f?t.push({path:p,rule:f}):n.push(p);}}}return i(e,"",null),n.sort(),t.sort((o,r)=>o.path<r.path?-1:o.path>r.path?1:0),{included:n,excluded:t}}var ys=[{rule:"token-prefix",regex:/\b(?:sk-|ghp_|xoxb-)[A-Za-z0-9_-]{10,}/},{rule:"private-key",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----/},{rule:"aws-access-key",regex:/\bAKIA[0-9A-Z]{16}\b/}];function As(e){return e.includes(0)}function Qn(e,n,t){let i=[];for(let o of n){let r=H.join(e,o),s;try{let c=t?.get(o);s=c===void 0?v.readFileSync(r):Buffer.from(c);}catch{continue}if(As(s))continue;s.toString("utf8").split(/\r\n|\r|\n/).forEach((c,p)=>{for(let{rule:u,regex:f}of ys)f.test(c)&&i.push({path:o,line:p+1,rule:u});});}return i}var oe=class extends Error{constructor(t,i){super(`publish: [${t}]${i?` ${i}`:""}`);this.code=t;}code;name="PublishError"};function h(e,n){return new oe(e,n)}var li=/^[a-z0-9-]+$/,gs=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,Is=/^[A-Za-z_][A-Za-z0-9_]*$/;function ms(e){let n=H.join(e,"crewx.yaml");if(!v.existsSync(n))return {};let t;try{t=ui.load(v.readFileSync(n,"utf8"));}catch{return {}}if(!t||typeof t!="object")return {};let i=t.metadata;if(!i||typeof i!="object")return {};let o=i;return {name:typeof o.name=="string"?o.name:void 0,version:typeof o.version=="string"?o.version:void 0,description:typeof o.description=="string"?o.description:void 0,requiredEnv:o.requiredEnv,crewxMinVersion:typeof o.crewxMinVersion=="string"?o.crewxMinVersion:void 0}}function hs(e){return et.createHash("sha256").update(e).digest("hex")}function fi(e){let n;try{n=v.lstatSync(e);}catch{throw h("PACKAGE_FILE_INVALID",`file is not readable: ${H.basename(e)}`)}if(n.isSymbolicLink())throw h("PACKAGE_SYMLINK","symlink content is not publishable");if(!n.isFile())throw h("PACKAGE_FILE_INVALID","only regular files are publishable");return et.createHash("sha256").update(new Uint8Array(v.readFileSync(e))).digest("hex")}function Es(e,n){let t=new TextEncoder().encode(e),i=new TextEncoder().encode(n),o=Math.min(t.byteLength,i.byteLength);for(let r=0;r<o;r+=1){let s=t[r]-i[r];if(s!==0)return s}return t.byteLength-i.byteLength}function yi(e){if(typeof e!="string"||e.length===0||e.includes("\\")||e.includes("\0")||H.posix.isAbsolute(e)||e.split("/").some(n=>n===".."||n.length===0))throw h("PACKAGE_PATH_TRAVERSAL","manifest file path must be a non-empty POSIX relative path")}function _s(e){if(!/^(?:apps|skills)\/[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(e))throw h("APP_PACKAGE_ROOT_INVALID","packageRoot must be apps/<safe-id> or skills/<safe-id>")}function Ai(e){if(!gs.test(e))throw new Error(`publish: invalid version "${e}" \u2014 must be semver (e.g. 1.0.0)`)}function gi(e,n,t={}){let i=ms(e),o=i.name??H.basename(e);if(!li.test(o))throw new Error(`publish: invalid name "${o}" \u2014 must match ${li} (lowercase letters, numbers, hyphen only)`);let r=t.version??i.version;if(!r)throw new Error("publish: version is required \u2014 set crewx.yaml metadata.version or pass opts.version");Ai(r);let s=Array.isArray(i.requiredEnv)?i.requiredEnv:[],a=[];for(let u of s){if(typeof u!="string"||!Is.test(u))throw new Error(`publish: requiredEnv must contain names only (no values), got "${String(u)}"`);a.push(u);}let c=n.map(u=>(yi(u),{path:u,sha256:fi(H.join(e,u))})).sort((u,f)=>u.path<f.path?-1:u.path>f.path?1:0),p={name:o,version:r,type:"template",description:i.description??"",files:c,requiredEnv:a};return i.crewxMinVersion&&(p.crewxMinVersion=i.crewxMinVersion),p}function Ts(e){let n=e.toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-+/g,"-").replace(/^-+|-+$/g,"");if(!n)throw h("APP_PACKAGE_ROOT_INVALID","appId cannot produce a marketplace name");return n}function Ii(e,n){if(_s(n.packageRoot),!n.version)throw new Error("publish: version is required for App publishing \u2014 pass opts.version");if(Ai(n.version),typeof n.description!="string")throw new Error("publish: App description must be a string");let t=[...new Set(n.capabilities)].sort();if(t.length===0||t.some(s=>s!=="screen"&&s!=="skill"))throw new Error("publish: App capabilities must contain screen or skill");let i=`${n.packageRoot}/`;if(t.includes("screen")){if(typeof n.definitionId!="string"||n.definitionId.length===0)throw h("APP_UI_MANIFEST_INVALID","screen App manifests require definitionId");for(let s of ["ui-plugin.json","ui/index.html"])if(!n.includedFiles.includes(`${i}${s}`))throw h("APP_UI_MANIFEST_INVALID",`screen App is missing ${s}`)}if(t.includes("skill")&&!n.includedFiles.includes(`${i}SKILL.md`))throw h("APP_SKILL_MISSING","skill capability requires package-root SKILL.md");let o=new Set,r=n.includedFiles.map(s=>{if(yi(s),!s.startsWith(i))throw h("PACKAGE_PATH_TRAVERSAL","App manifest file is outside packageRoot");let a=n.generatedFiles?.get(s);return a!==void 0&&o.add(s),{path:s,sha256:a===void 0?fi(H.join(e,s)):hs(a),...a===void 0?{}:{generated:true}}}).sort((s,a)=>Es(s.path,a.path));if(o.size>0&&(o.size!==1||!o.has(`${i}ui-plugin.json`)))throw new Error("publish: only the generated ui-plugin.json may be present in an App package");return {manifestVersion:1,name:Ts(n.appId),version:n.version,type:"app",description:n.description,appId:n.appId,...n.definitionId===void 0?{}:{definitionId:n.definitionId},...n.definitionHash===void 0?{}:{definitionHash:n.definitionHash},capabilities:t,packageRoot:n.packageRoot,files:r,requiredEnv:[]}}function mi(e){return et.createHash("sha256").update(e).digest("hex")}function Pi(e,n){if(typeof n!="string"||n.length===0||n.includes("\\")||n.includes("\0")||H.posix.isAbsolute(n)||n.split("/").some(o=>o===".."||o.length===0))throw h("PACKAGE_PATH_TRAVERSAL","archive paths must be non-empty POSIX relative paths");let t=H.resolve(e),i=H.resolve(t,...n.split("/"));if(i!==t&&!i.startsWith(`${t}${H.sep}`))throw h("PACKAGE_PATH_TRAVERSAL","archive path escaped its root");return i}function hi(e,n){let t=Pi(e,n),i;try{i=v.lstatSync(t);}catch{throw h("PACKAGE_FILE_INVALID","manifest file is missing")}if(i.isSymbolicLink())throw h("PACKAGE_SYMLINK","symlink content is not publishable");if(!i.isFile())throw h("PACKAGE_FILE_INVALID","only regular files are publishable");return new Uint8Array(v.readFileSync(t))}async function Di(e,n,t={}){let i=H.join(e,".crewx","publish");v.mkdirSync(i,{recursive:true});let o=H.join(i,`${n.name}-${n.version}.tgz`),r=H.join(i,`.${n.name}-${n.version}.${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}.tmp.tgz`),s=v.mkdtempSync(H.join(Ei.tmpdir(),"crewx-publish-"));try{let a=new Set,c=[];for(let p of n.files){if(a.has(p.path))throw h("PACKAGE_PATH_TRAVERSAL","manifest contains duplicate file paths");a.add(p.path);let u=t.generatedFiles?.get(p.path);if(p.generated===!0&&u===void 0)throw h("PACKAGE_GENERATED_FILE_MISSING","generated manifest file bytes are missing");if(t.sourceFileHashes?.has(p.path)){let m=hi(e,p.path);if(t.sourceFileHashes.get(p.path)!==mi(m))throw h("PACKAGE_STAGED_BYTES_MISMATCH","workspace source changed before staging")}let f=u??hi(e,p.path);if(mi(f)!==p.sha256)throw h("PACKAGE_STAGED_BYTES_MISMATCH",`staged bytes differ for ${p.path}`);let A=Pi(s,p.path);v.mkdirSync(H.dirname(A),{recursive:!0}),v.writeFileSync(A,new Uint8Array(f)),c.push(p.path);}v.writeFileSync(H.join(s,"manifest.json"),JSON.stringify(n,null,2)),await Ti.create({gzip:!0,file:r,cwd:s,portable:!0,noMtime:!0},["manifest.json",...c]),v.renameSync(r,o);}finally{try{v.rmSync(r,{force:!0});}catch{}v.rmSync(s,{recursive:true,force:true});}return o}var Le="/api/v1";var bs=201,Ns=200,Ms=409,nt=401,bi={APP_NAME_CONFLICT:"APP_NAME_CONFLICT",CONTENT_SUSPENDED:"PUBLISH_CONTENT_SUSPENDED",CONTENT_REJECTED:"CONTENT_REJECTED",APP_VERSION_MUST_INCREASE:"APP_VERSION_MUST_INCREASE",APP_VERSION_INVALID:"APP_VERSION_INVALID"};function Ss(){return process.env.WI013_FAKE_UPLOAD==="1"}function Ls(e){let n=gunzipSync(new Uint8Array(e)),t=gzipSync(new Uint8Array(n),{level:1});if(Buffer.compare(new Uint8Array(t),new Uint8Array(e))===0)throw new Error("publish: [E_MALFORMED] Re-gzipped upload bytes are identical to the original \u2014 tamper is a no-op");return t}function Us(e){return e.replace(/\/+$/,"")}async function Fe(e){try{return await e.json()}catch{return null}}function Ni(e,n,t){let i=e;if(!i||i.success!==true||i.data===void 0)throw new Error(`publish: [E_MALFORMED] ${n} response envelope is malformed (expected { success: true, data }) \u2014 HTTP ${t}`);return i.data}function Rs(e){if(!e||typeof e!="object"||Array.isArray(e))return;let n=e;if(typeof n.contentId=="string"&&n.contentId.length>0)return n.contentId;if(!n.data||typeof n.data!="object"||Array.isArray(n.data))return;let t=n.data;return typeof t.contentId=="string"&&t.contentId.length>0?t.contentId:void 0}function Os(e){if(!e||typeof e!="object"||Array.isArray(e))return;let n=e;if(typeof n.slug=="string"&&n.slug.length>0)return n.slug;if(!n.data||typeof n.data!="object"||Array.isArray(n.data))return;let t=n.data;return typeof t.slug=="string"&&t.slug.length>0?t.slug:void 0}function Mi(e,n){if(!e||typeof e!="object"||Array.isArray(e))return;let t=e,i=t.data&&typeof t.data=="object"&&!Array.isArray(t.data)?t.data:void 0,o=[t.code,t.message,i?.code,i?.message];for(let r of o){if(typeof r!="string"||!Object.prototype.hasOwnProperty.call(bi,r))continue;let s=r,a=s==="APP_NAME_CONFLICT"?`marketplace name is already in use: ${n}`:void 0;return h(bi[s],a)}}async function ks(e){if(!e.baseUrl.trim())throw new Error("publish: [E_ENV_MISSING] Marketplace base URL is required");if(!e.accessToken.trim())throw new Error("publish: [E_AUTH_EXPIRED] A valid bearer token is required");let n=Us(e.baseUrl),t=e.accessPolicy??"private",i=e.manifest.name,o=e.manifest.type==="app"?e.manifest:void 0,r=o!==void 0,s=o?.appId,a;try{a=await fetch(`${n}${Le}/publisher/items`,{method:"POST",headers:{Authorization:`Bearer ${e.accessToken}`,"Content-Type":"application/json"},body:JSON.stringify({slug:i,displayName:i,description:e.manifest.description,type:e.manifest.type,version:e.manifest.version,accessPolicy:t,...s===void 0?{}:{appId:s}})});}catch{throw new Error("publish: [E_NETWORK] Submit request failed (network)")}let c=await Fe(a),p=Rs(c),u=Os(c),f=r&&u!==void 0?u:i,A;if(a.status===bs)A="created";else if(r&&a.status===Ns){if(p===void 0)throw h("PUBLISH_CONTENT_ID_MISSING","App republish did not return an opaque contentId");A="existing";}else if(a.status===Ms){if(r)throw Mi(c,i)??h("APP_NAME_CONFLICT",`marketplace name is already in use: ${i}`);A="existing";}else throw a.status===nt?new Error("publish: [E_AUTH_EXPIRED] Authentication is expired or missing \u2014 please log in again (HTTP 401)"):new Error(`publish: [E_HTTP] Submit request failed \u2014 HTTP ${a.status}`);let m="not-needed",g=null;if(A==="existing"&&!r){let l;try{l=await fetch(`${n}${Le}/publisher/items`,{method:"GET",headers:{Authorization:`Bearer ${e.accessToken}`}});}catch{throw new Error("publish: [E_NETWORK] Publisher items request failed (network)")}let N=await Fe(l);if(l.status!==200)throw new Error(`publish: [E_HTTP] Publisher items request failed \u2014 HTTP ${l.status}`);let W=Ni(N,"publisher items",l.status)?.items;if(!Array.isArray(W))throw new Error(`publish: [E_MALFORMED] Publisher items response is malformed (expected data.items[]) \u2014 HTTP ${l.status}`);let k=W.find(E=>!E||typeof E!="object"?false:E.slug===i);if(!k||typeof k.version!="string")throw new Error(`publish: [E_MALFORMED] Publisher items response does not contain slug "${i}" \u2014 HTTP ${l.status}`);if(g=k.version,g!==e.manifest.version){let E;try{E=await fetch(`${n}${Le}/publisher/items/${encodeURIComponent(i)}`,{method:"PUT",headers:{Authorization:`Bearer ${e.accessToken}`,"Content-Type":"application/json"},body:JSON.stringify({version:e.manifest.version})});}catch{throw new Error("publish: [E_NETWORK] Version update request failed (network)")}if(!E.ok)throw await Fe(E),E.status===nt?new Error(`publish: [E_AUTH_EXPIRED] Authentication is expired or missing \u2014 please log in again (HTTP ${E.status})`):E.status===403?new Error(`publish: [E_FORBIDDEN] Version update is forbidden; only the item owner can update an existing item (HTTP ${E.status})`):new Error(`publish: [E_HTTP] Version update failed \u2014 HTTP ${E.status}`);m="applied";}}let T=v.readFileSync(e.tgzPath),M=Ss()?Ls(T):T,L=new FormData;L.set("archive",new Blob([new Uint8Array(M)],{type:"application/gzip"}),`${f}-${e.manifest.version}.tgz`);let y=r&&p!==void 0?p:i,I;try{I=await fetch(`${n}${Le}/publisher/items/${encodeURIComponent(y)}/upload`,{method:"POST",headers:{Authorization:`Bearer ${e.accessToken}`},body:L});}catch{throw new Error("publish: [E_NETWORK] Upload request failed (network)")}if(I.status===nt)throw new Error("publish: [E_AUTH_EXPIRED] Authentication is expired or missing \u2014 please log in again (HTTP 401)");if(!I.ok){let l=await Fe(I);if(r){let N=Mi(l,f);if(N)throw N}throw new Error(`publish: [E_HTTP] Upload request failed \u2014 HTTP ${I.status}`)}let P=await Fe(I),V=Ni(P,"upload",I.status),O=typeof V.contentId=="string"&&V.contentId.length>0?V.contentId:p;if(r&&O===void 0)throw h("PUBLISH_CONTENT_ID_MISSING","App upload did not return an opaque contentId");return {slug:f,version:e.manifest.version,...O===void 0?{}:{contentId:O},artifactChecksum:V.artifactChecksum,artifactSizeBytes:V.artifactSizeBytes,submitOutcome:A,versionUpdate:m,serverVersionBefore:g}}var xs=1e4,ws=100*1024*1024;function tt(e){return et.createHash("sha256").update(e).digest("hex")}function Cs(e){if(e===null||typeof e!="object"||Array.isArray(e))return false;let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}function pn(e,n){if(!n||n.includes("\\")||n.includes("\0")||H.posix.isAbsolute(n)||n.split("/").some(r=>r===".."||r.length===0))throw h("PACKAGE_PATH_TRAVERSAL","workspace file path is not a safe relative path");let t=H.resolve(e,...n.split("/")),i=H.resolve(e);if(t!==i&&!t.startsWith(`${i}${H.sep}`))throw h("PACKAGE_PATH_TRAVERSAL","workspace file path escaped the workspace root");let o;try{o=v.lstatSync(t);}catch{throw h("PACKAGE_FILE_INVALID",`workspace file is missing: ${n}`)}if(o.isSymbolicLink())throw h("PACKAGE_SYMLINK",`symlink is not publishable: ${n}`);if(!o.isFile())throw h("PACKAGE_FILE_INVALID",`not a regular file: ${n}`);return new Uint8Array(v.readFileSync(t))}function dn(e,n){return e===n||e.startsWith(`${n}/`)}function vs(e,n){return e.path<n.path?-1:e.path>n.path?1:e.rule.localeCompare(n.rule)}function Li(e,n,t){let i=e??n;if(!Number.isSafeInteger(i)||i<=0)throw new oe("PACKAGE_SIZE_LIMIT",`${t} must be a positive integer`);return i}function Ri(e,n,t,i){let o=Li(t.maxFileCount??t.maxFiles,xs,"max file count"),r=Li(t.maxTotalBytes??t.maxBytes,ws,"max total bytes");if(n.length>o)throw new oe("PACKAGE_SIZE_LIMIT",`package exceeds file count limit (${o})`);let s=0;for(let a of n){let c=i?.get(a);if(c!==void 0?s+=c.byteLength:s+=pn(e,a).byteLength,s>r)throw new oe("PACKAGE_SIZE_LIMIT",`package exceeds byte limit (${r})`)}}function Vs(e){return e.appId!==void 0||e.expectedDefinitionHash!==void 0}function Fs(e){let n=e.appId!==void 0,t=e.expectedDefinitionHash!==void 0;if(!n&&t)throw h("APP_ID_REQUIRED","appId is required with expectedDefinitionHash");if(n&&!t)throw h("APP_DEFINITION_HASH_REQUIRED","expectedDefinitionHash is required with appId");if(!n||!t)throw h("APP_ID_REQUIRED")}function js(e,n){let t=e.filter(i=>i.appId===n);if(t.length===0)throw h("APP_NOT_FOUND",`no publishable App matches ${n}`);if(t.length!==1)throw h("APP_AMBIGUOUS",`more than one App matches ${n}`);return t[0]}function Bs(e){let n=e.localDefinitionRef?.packageRoot;if(!n||!/^(?:apps|skills)\/[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(n))throw h("APP_PACKAGE_ROOT_INVALID","selected App is not rooted in apps/<safe-id> or skills/<safe-id>");return n}function Hs(e,n){let t=[];for(let i of e.excluded)t.push(dn(i.path,n)?i:{path:i.path,rule:"out-of-app-scope"});for(let i of e.included)dn(i,n)||t.push({path:i,rule:"out-of-app-scope"});return t.sort(vs)}function zs(e,n,t,i){let o=`${t}/ui-plugin.json`;if(!i.includes(o))throw h("APP_UI_MANIFEST_INVALID","selected screen App has no package ui-plugin.json");let r=pn(e,o),s=tt(r),a;try{a=JSON.parse(Buffer.from(r).toString("utf8"));}catch{throw h("APP_UI_MANIFEST_INVALID","ui-plugin.json is not valid JSON")}let c;try{let A=ye(a,{mode:"local"});if(A.manifestVersion!==2)throw new Error("screen App requires manifestVersion 2");c=A;}catch(A){throw A instanceof $?h("APP_UI_MANIFEST_INVALID",A.code):h("APP_UI_MANIFEST_INVALID")}if(c.pluginId!==n.appId)throw h("APP_DEFINITION_CONFLICT","ui-plugin.json pluginId no longer matches the selected App");let p=`${t}/ui/index.html`;if(!i.includes(p))throw h("APP_UI_MANIFEST_INVALID","screen entry is outside package scope");let u=tt(pn(e,p)),f=JSON.parse(JSON.stringify(a));if(f.entryHash=u,Object.prototype.hasOwnProperty.call(f,"initialState")){let A=f.initialState;if(!Cs(A)||A.path!=="ui/state.json")throw h("APP_INITIAL_STATE_OUT_OF_SCOPE","initialState must reference ui/state.json inside the package");let m=`${t}/ui/state.json`;if(!i.includes(m))throw h("APP_INITIAL_STATE_OUT_OF_SCOPE","initialState reference is outside the selected package");let g=pn(e,m);f.initialState={...A,hash:tt(g)};}try{let A=ye(f,{mode:"published"});return {bytes:new Uint8Array(Buffer.from(An(A),"utf8")),sourceHash:s}}catch(A){throw A instanceof $?h("APP_UI_MANIFEST_INVALID",A.code):h("APP_UI_MANIFEST_INVALID")}}async function Gs(e,n){let{included:t,excluded:i}=Zn(e);Ri(e,t,n);let o=gi(e,t,{version:n.version}),r=Qn(e,t);return {plan:{manifest:o,included:t,excluded:i,secretFindings:r},archiveOptions:{}}}async function $s(e,n){Fs(n);let t=await si(e),i=js(t.items,n.appId);if(i.definitionHash!==n.expectedDefinitionHash)throw h("APP_DEFINITION_CONFLICT",`definitionHash changed for ${n.appId}`);let o=Bs(i),r=Zn(e);if(r.excluded.some(m=>dn(m.path,o)&&(m.rule==="symlink"||m.rule==="symlink-dir")))throw h("PACKAGE_SYMLINK","selected App package contains a symlink");let s=r.included.filter(m=>dn(m,o)),a=Hs(r,o),c=new Map,p=new Map;if(i.capabilities.includes("screen")){let m=zs(e,i,o,s);c.set(`${o}/ui-plugin.json`,m.bytes),p.set(`${o}/ui-plugin.json`,m.sourceHash);}if(i.capabilities.includes("skill")&&!s.includes(`${o}/SKILL.md`))throw h("APP_SKILL_MISSING","skill capability requires package-root SKILL.md");Ri(e,s,n,c);let u={appId:i.appId,version:n.version??"",description:i.description,capabilities:i.capabilities,packageRoot:o,...i.definition?.id===void 0?{}:{definitionId:i.definition.id},definitionHash:i.definitionHash,includedFiles:s,generatedFiles:c},f=Ii(e,u),A=Qn(e,s,c);return {plan:{manifest:f,included:s,excluded:a,secretFindings:A},archiveOptions:{generatedFiles:c,sourceFileHashes:p}}}async function Oi(e,n){let t=H.resolve(e);if(Vs(n))return $s(t,n);if(n.expectedDefinitionHash!==void 0)throw h("APP_ID_REQUIRED");return Gs(t,n)}async function Ip(e,n={}){return (await Oi(e,n)).plan}function Ws(e){let n=e.map(t=>`${t.path}:${t.line} (${t.rule})`).join(", ");throw new oe("PUBLISH_SECRET_FINDINGS",`aborted \u2014 secret findings must be resolved before packing: ${n}`)}async function ki(e,n={}){let t=H.resolve(e),i=await Oi(t,n);i.plan.secretFindings.length>0&&Ws(i.plan.secretFindings);let o=await Di(t,i.plan.manifest,i.archiveOptions);return {manifest:i.plan.manifest,tgzPath:o}}async function mp(e,n={}){return ki(e,n)}async function hp(e,n){let t=await ki(e,n);if(t.manifest.type!=="app")throw new Error("publish: App pack unexpectedly produced a template manifest");return t}
2
- export{ws as DEFAULT_PUBLISH_MAX_BYTES,xs as DEFAULT_PUBLISH_MAX_FILES,ai as EXCLUDE_RULES,Le as MARKETPLACE_API_PREFIX,oe as PublishError,hp as packApp,ki as packPublish,mp as packTemplate,Ip as planPublish,ks as uploadToMarketplace};
1
+ import*as it from'crypto';import {createHash}from'crypto';import*as v from'fs';import {constants,readFileSync,existsSync,statSync,readdirSync}from'fs';import*as H from'path';import {join,relative,sep,isAbsolute,resolve}from'path';import*as fi from'js-yaml';import {load}from'js-yaml';import {realpath,stat,readdir,open,lstat}from'fs/promises';import*as _i from'os';import*as Pi from'tar';import {gunzipSync,gzipSync}from'zlib';var b=class extends Error{constructor(t,i=t,o){super(i);this.code=t;this.currentRevision=o;}code;currentRevision;name="UiRuntimeError"};var wi=/(?:proof|token|secret|password|cookie|authorization|private[_-]?key|stack|exception|plugin[_-]?text)/i,Ci=/(?:url|uri|endpoint|path|file(?:name|path)?|cwd|shell|directory|dir|folder)$/i,vi=/<\/?[A-Za-z][^>]*>/,ji=/^(?:[A-Za-z]:[\\/]|\\\\|~[\\/]|\/)/,Vi=/^(?:https?|file|ftp|ws|wss):\/\//i;function K(){throw new b("INPUT_INVALID","JSON value is not projection-safe")}function Fi(e){let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}var Bi=8,Hi=4;function fn(e,n,t,i,o,r){if(n>i&&K(),e===null||typeof e=="string"||typeof e=="boolean")return typeof e=="string"&&(vi.test(e)||Vi.test(e)&&!zi(o,r)||ji.test(e))&&K(),e;if(typeof e=="number")return Number.isFinite(e)||K(),e;(typeof e!="object"||e===void 0||typeof e=="function"||typeof e=="bigint")&&K();let s=e;t.has(s)&&K(),t.add(s);try{if(Array.isArray(e))return e.map(c=>fn(c,n+1,t,i,o,r));Fi(s)||K();let a={};for(let[c,p]of Object.entries(e))(wi.test(c)||Ci.test(c))&&K(),a[c]=fn(p,n+1,t,i,[...o,c],r);return a}finally{t.delete(s);}}function ae(e,n=0,t=[]){(!Number.isInteger(n)||n<0||n>Hi)&&K(),(!Array.isArray(t)||t.some(o=>typeof o!="string"))&&K();let i=fn(e,0,new Set,Bi+n,[],t);return (i===null||Array.isArray(i)||typeof i!="object")&&K(),i}function me(e,n){if(!e||!n)return false;let t=e.split("."),i=n.split(".");return t.length>=i.length&&i.every((o,r)=>t[r]===o)}function zi(e,n){if(e.length===0)return false;let t=e.join(".");return n.some(i=>me(t,i))}function he(e){try{let n=JSON.stringify(e);return n===void 0&&K(),n}catch{K();}}function yn(e){return Array.isArray(e)?e.map(yn):e!==null&&typeof e=="object"?Object.fromEntries(Object.keys(e).sort().map(n=>[n,yn(e[n])])):e}function X(e){return he(yn(e))}function An(e){return Buffer.byteLength(e,"utf8")}function gn(e){return X(e)}var ce="window";var st=["__proto__","prototype","constructor","proof","token","secret","password","cookie","authorization","private_key","private-key","stack","exception","plugin_text","url","uri","endpoint","path","filename","filepath","cwd","shell","directory","dir","folder"],Gi=new Set(st),$i=/(?:proof|token|secret|password|cookie|authorization|private[_-]?key|stack|exception|plugin[_-]?text)/i,Wi=/(?:url|uri|endpoint|path|file(?:name|path)?|cwd|shell|directory|dir|folder)$/i;function Ee(e){return Gi.has(e)||$i.test(e)||Wi.test(e)}var Fe=/^[A-Za-z0-9_]+$/,Ue=/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*$/,_e=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/,In=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/,mn=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/,hn=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/,En=["blue","violet","emerald","amber","rose","sky","slate","indigo"],_n=["inline","panel"];var Ji=1,Ki=/^[a-z][a-zA-Z0-9]*(\.[a-zA-Z0-9]+)+$/,Xi=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/,gt=/^[A-Za-z][A-Za-z0-9_-]{0,63}$/,Yi=/<\/?[A-Za-z][^>]*>/,qi=/^(?:[A-Za-z]:[\\/]|\\\\|~[\\/]|\/)/,Zi=/^(?:https?|file|ftp|ws|wss):\/\//i,Qi=/^\s*(?:javascript|data):/i,at=/data:[^,\s]*,/i,eo=/(?:https?|file|ftp|ws|wss):\/\//i,no=/javascript:/i,to=/(?:^[\s]*|[\s"'(=])(?:[A-Za-z]:[\\/]|\\\\|~[\\/]|\/)(?=[^\s"'<>])[^\s"'<>]*/,io=["manifestVersion","pluginId","definitionId","version","primitiveSet","activation","schema","layout"],oo=["manifestVersion","pluginId","definitionId","version","name","description","entry","surfaces","size","stateProjection","actions"],ro=["_meta","icon","tone","entryHash","initialState","usage","detailPanel","displayModes","summaryProjection","dataPaths","focusedAiDataPaths"],so=["actionId","capability","mutation","inputSchema","resultProjection","backend"],ao=["confirmation","dataInputs","_meta"],co=4*1024,po=["type","handler"],lo=["type","command"],uo=["path"],fo=["hash"],yo=/^[0-9a-f]{64}$/,Ao=/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/,go=/[\r\n]/,Io=16,mo=["card-shell","meta-banner","heading","labeled-text","step-flow","text-list"],$=class extends Error{constructor(t,i=t){super(i);this.code=t;}code;name="UiPluginValidationError"};function d(e,n=e){throw new $(e,n)}function k(e){if(e===null||typeof e!="object"||Array.isArray(e))return false;try{let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}catch{return false}}function S(e,n){return Object.prototype.hasOwnProperty.call(e,n)}function x(e,n,t=[]){let i=new Set([...n,...t]);Object.keys(e).some(o=>!i.has(o))&&d("MANIFEST_INVALID"),n.some(o=>!S(e,o))&&d("MANIFEST_INVALID");}function $e(e,n=false,t=false,i=false){return Yi.test(e)||!i&&Zi.test(e)||qi.test(e)||t&&at.test(e)||Qi.test(e)&&!(n&&/^\s*data:/i.test(e)&&!at.test(e))}function ze(e,n=new Set,t=0,i=false,o=false){if(typeof e=="string"){$e(e,i,o)&&d("UNSAFE_VALUE");return}if(!(e===null||typeof e!="object")){(t>8||n.has(e))&&d("MANIFEST_INVALID"),n.add(e);try{if(Array.isArray(e)){for(let r of e)ze(r,n,t+1);return}k(e)||d("MANIFEST_INVALID");for(let[r,s]of Object.entries(e))ze(s,n,t+1,i&&t===0&&(r==="name"||r==="description"),o);}finally{n.delete(e);}}}function Q(e,n){let t=e[n];return typeof t!="string"&&d("MANIFEST_INVALID"),t}function Z(e,n,t){let i=e[n];return (!Number.isSafeInteger(i)||i<t)&&d("MANIFEST_INVALID"),i}function Tn(e){return Xi.test(e)||d("MANIFEST_INVALID"),e}function Te(e){return Ki.test(e)||d("TOKEN_INVALID"),e}function ho(e){return gt.test(e)||d("MANIFEST_INVALID"),e}function Eo(e){k(e)||d("MANIFEST_INVALID");let n={};for(let[t,i]of Object.entries(e)){let o=ho(t);k(i)||d("MANIFEST_INVALID");let r=i.type;if(r==="text"){x(i,["type","maxLength"]),n[o]={type:r,maxLength:Z(i,"maxLength",1)};continue}if(r==="text-list"){x(i,["type","max","itemMaxLength"]),n[o]={type:r,max:Z(i,"max",0),itemMaxLength:Z(i,"itemMaxLength",1)};continue}if(r==="step-list"){x(i,["type","min","max","labelMaxLength","detailMaxLength"]);let s=Z(i,"min",0),a=Z(i,"max",1);s>a&&d("MANIFEST_INVALID"),n[o]={type:r,min:s,max:a,labelMaxLength:Z(i,"labelMaxLength",1),detailMaxLength:Z(i,"detailMaxLength",1)};continue}typeof r=="string"&&d("SCHEMA_TYPE_UNSUPPORTED"),d("MANIFEST_INVALID");}return n}function _o(e,n,t){let i=e[n];(!i||i.type!==t)&&d("MANIFEST_INVALID");}function Be(e,n,t){let i=Q(e,"field");return gt.test(i)||d("MANIFEST_INVALID"),_o(n,i,t),i}function To(e,n){k(e)||d("MANIFEST_INVALID");let t=e.primitive;switch(typeof t!="string"&&d("MANIFEST_INVALID"),mo.includes(t)||d("PRIMITIVE_UNKNOWN"),t){case "card-shell":return x(e,["primitive"]),{primitive:t};case "meta-banner":return x(e,["primitive","badgeToken","noticeToken"]),{primitive:t,badgeToken:Te(Q(e,"badgeToken")),noticeToken:Te(Q(e,"noticeToken"))};case "heading":return x(e,["primitive","field"]),{primitive:t,field:Be(e,n,"text")};case "labeled-text":return x(e,["primitive","titleToken","field","variant"]),e.variant!=="callout"&&d("MANIFEST_INVALID"),{primitive:t,titleToken:Te(Q(e,"titleToken")),field:Be(e,n,"text"),variant:"callout"};case "step-flow":return x(e,["primitive","titleToken","field"]),{primitive:t,titleToken:Te(Q(e,"titleToken")),field:Be(e,n,"step-list")};case "text-list":{x(e,["primitive","titleToken","field"],["emptyToken","hideWhenEmpty"]);let i={primitive:t,titleToken:Te(Q(e,"titleToken")),field:Be(e,n,"text-list")};return S(e,"emptyToken")&&(i.emptyToken=Te(Q(e,"emptyToken"))),S(e,"hideWhenEmpty")&&(typeof e.hideWhenEmpty!="boolean"&&d("MANIFEST_INVALID"),i.hideWhenEmpty=e.hideWhenEmpty),i}}return d("MANIFEST_INVALID")}function Po(e,n){return Array.isArray(e)||d("MANIFEST_INVALID"),e.map(t=>To(t,n))}function w(e="v2 manifest exceeds a contract limit"){return d("LIMIT_EXCEEDED",e)}function Y(e="initial state is not projection-safe"){return d("INITIAL_STATE_INVALID",e)}function ct(e,n){return (typeof e!="string"||e.length===0||e.length>4096||e.trim().length===0||Ao.test(e)||go.test(e))&&d("MANIFEST_INVALID",`${n} is invalid`),($e(e,true,true)||eo.test(e)||no.test(e)||to.test(e))&&d("UNSAFE_VALUE",`${n} contains an unsafe value`),e}function Pn(e,n){return (typeof e!="string"||!_e.test(e))&&d("MANIFEST_INVALID",`${n} is invalid`),e}function Do(e){return (typeof e!="string"||!In.test(e)||e==="*"||e==="all")&&d("MANIFEST_INVALID","action capability is invalid"),e}function It(e){return (typeof e!="string"||!yo.test(e))&&d("MANIFEST_INVALID","resource hash is invalid"),e}function Dn(e,n=new Set,t=0){if(typeof e=="string"){e.length>4096&&w("v2 manifest string is too long");return}if(!(e===null||typeof e=="boolean")){if(typeof e=="number"){Number.isFinite(e)||d("MANIFEST_INVALID","v2 manifest contains a non-finite number");return}(e===void 0||typeof e=="function"||typeof e=="bigint")&&d("MANIFEST_INVALID","v2 manifest contains a non-JSON value"),typeof e!="object"&&d("MANIFEST_INVALID"),t>8&&w("v2 manifest nesting is too deep"),n.has(e)&&d("MANIFEST_INVALID","v2 manifest contains a cycle"),n.add(e);try{if(Array.isArray(e)){e.length>128&&w("v2 manifest array is too long");for(let i of e)Dn(i,n,t+1);return}k(e)||d("MANIFEST_INVALID","v2 manifest contains a non-plain object");for(let i of Object.values(e))Dn(i,n,t+1);}finally{n.delete(e);}}}function mt(e){return (typeof e!="string"||e.length>4096||!Ue.test(e))&&(typeof e=="string"&&e.length>4096&&w("projection path is too long"),d("MANIFEST_INVALID","projection paths must be canonical exact paths")),e.split(".").some(t=>Ee(t))&&d("MANIFEST_INVALID","projection paths cannot address reserved state keys"),e}function bn(e){k(e)||d("MANIFEST_INVALID","projection policy must be an object"),x(e,["allow"]),Array.isArray(e.allow)||d("MANIFEST_INVALID","projection allow must be an array"),e.allow.length>128&&w("projection allowlist is too long");let n=[],t=new Set;for(let i of e.allow){let o=mt(i);t.has(o)&&d("MANIFEST_INVALID","projection allowlist contains a duplicate path"),t.add(o),n.push(o);}return {allow:n}}function bo(e,n){if(e===void 0)return;Array.isArray(e)||d("MANIFEST_INVALID","dataPaths must be an array"),e.length>Io&&w("dataPaths exceed the v2 limit");let t=[],i=new Set;for(let o of e){let r=mt(o);i.has(r)&&d("MANIFEST_INVALID","dataPaths contain a duplicate path"),n.some(s=>me(r,s))||d("MANIFEST_INVALID","dataPaths must be projection-allowed"),i.add(r),t.push(r);}return t}function Pe(e,n,t=Number.MAX_SAFE_INTEGER){return (!Number.isSafeInteger(e)||e<0||e>t)&&d("MANIFEST_INVALID",`${n} is invalid`),e}function pt(e,n){return (typeof e!="number"||!Number.isFinite(e))&&d("MANIFEST_INVALID",`${n} is invalid`),e}function Nn(e,n=0,t=new Set){if(typeof e=="string")return (e.length>4096||$e(e))&&d("UNSAFE_VALUE","schema enum contains an unsafe string"),e;if(e===null||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)||d("MANIFEST_INVALID","schema enum contains a non-finite number"),e;(n>8||typeof e!="object"||e===void 0)&&w("schema enum is too deep"),t.has(e)&&d("MANIFEST_INVALID","schema enum contains a cycle"),t.add(e);try{if(Array.isArray(e))return e.length>128&&w("schema enum array is too long"),e.map(o=>Nn(o,n+1,t));k(e)||d("MANIFEST_INVALID","schema enum contains a non-plain object");let i={};for(let[o,r]of Object.entries(e))Ee(o)&&d("MANIFEST_INVALID","schema enum contains a reserved key"),i[o]=Nn(r,n+1,t);return i}finally{t.delete(e);}}function No(e,n){if(e===void 0)return;Array.isArray(e)||d("MANIFEST_INVALID","schema required must be an array"),e.length>64&&w("schema required list is too long");let t=[],i=new Set;for(let o of e)(typeof o!="string"||!Ue.test(o))&&d("MANIFEST_INVALID","schema required contains an invalid key"),o.length>4096&&w("schema required key is too long"),i.has(o)&&d("MANIFEST_INVALID","schema required contains a duplicate key"),n&&!Object.prototype.hasOwnProperty.call(n,o)&&d("MANIFEST_INVALID","schema required references an undeclared property"),i.add(o),t.push(o);return t}function Mo(e,n){let t=n?Ue:Fe;return e.length>4096&&w("schema property name is too long"),(!t.test(e)||e.split(".").some(i=>Ee(i)))&&d("MANIFEST_INVALID","schema property name is invalid"),e}function Mn(e,n=0,t=false){k(e)||d("MANIFEST_INVALID","action inputSchema must be an object"),n>8&&w("action inputSchema is too deep");let i=e.type;i!=="object"&&i!=="string"&&i!=="number"&&i!=="integer"&&i!=="boolean"&&i!=="array"&&i!=="null"&&(typeof i=="string"&&d("SCHEMA_TYPE_UNSUPPORTED","action inputSchema type is unsupported"),d("MANIFEST_INVALID","action inputSchema type is required"));let o=["type","enum"];i==="string"&&o.push("minLength","maxLength"),i==="array"&&o.push("minItems","maxItems","items"),i==="object"&&o.push("minProperties","maxProperties","properties","required","additionalProperties"),(i==="number"||i==="integer")&&o.push("minimum","maximum"),x(e,["type"],o.filter(a=>a!=="type"));let r={type:i};if(S(e,"enum")&&(Array.isArray(e.enum)||d("MANIFEST_INVALID","schema enum must be an array"),e.enum.length>128&&w("schema enum is too long"),r.enum=e.enum.map(a=>Nn(a))),i==="string"&&(S(e,"minLength")&&(r.minLength=Pe(e.minLength,"schema minLength",4096)),S(e,"maxLength")&&(r.maxLength=Pe(e.maxLength,"schema maxLength",4096)),r.minLength!==void 0&&r.maxLength!==void 0&&r.minLength>r.maxLength&&d("MANIFEST_INVALID","schema string length bounds are inverted")),(i==="number"||i==="integer")&&(S(e,"minimum")&&(r.minimum=pt(e.minimum,"schema minimum")),S(e,"maximum")&&(r.maximum=pt(e.maximum,"schema maximum")),r.minimum!==void 0&&r.maximum!==void 0&&r.minimum>r.maximum&&d("MANIFEST_INVALID","schema numeric bounds are inverted")),i==="array"&&(S(e,"minItems")&&(r.minItems=Pe(e.minItems,"schema minItems",128)),S(e,"maxItems")&&(r.maxItems=Pe(e.maxItems,"schema maxItems",128)),r.minItems!==void 0&&r.maxItems!==void 0&&r.minItems>r.maxItems&&d("MANIFEST_INVALID","schema array length bounds are inverted"),S(e,"items")&&(r.items=Mn(e.items,n+1,false))),i==="object"){let a;if(S(e,"properties")){k(e.properties)||d("MANIFEST_INVALID","schema properties must be an object");let p=Object.entries(e.properties);p.length>64&&w("schema properties are too many"),a={};for(let[u,f]of p){let A=Mo(u,t);a[A]=Mn(f,n+1,false);}r.properties=a;}S(e,"minProperties")&&(r.minProperties=Pe(e.minProperties,"schema minProperties",64)),S(e,"maxProperties")&&(r.maxProperties=Pe(e.maxProperties,"schema maxProperties",64)),r.minProperties!==void 0&&r.maxProperties!==void 0&&r.minProperties>r.maxProperties&&d("MANIFEST_INVALID","schema object property bounds are inverted");let c=No(e.required,a);c!==void 0&&(r.required=c),S(e,"additionalProperties")&&(e.additionalProperties!==false&&d("MANIFEST_INVALID","schema additionalProperties must be false"),r.additionalProperties=false);}let s=JSON.stringify(r);return (s===void 0||Buffer.byteLength(s,"utf8")>65536)&&w("action inputSchema subtree is too large"),r}function So(e){let n=Mn(e,0,true);return (n.type!=="object"||!n.properties)&&d("MANIFEST_INVALID","action inputSchema must declare object properties"),n}function Lo(e){if(k(e)||d("MANIFEST_INVALID","action backend must be an object"),e.type==="core"){x(e,po);let n=e.handler;return (typeof n!="string"||!mn.test(n))&&d("MANIFEST_INVALID","core backend handler is invalid"),{type:"core",handler:n}}if(e.type==="skill"){x(e,lo),(!Array.isArray(e.command)||e.command.length===0||e.command.length>16)&&d("MANIFEST_INVALID","skill backend command is invalid");let n=[];for(let t of e.command)(typeof t!="string"||t.length===0||t.length>256||!hn.test(t))&&d("MANIFEST_INVALID","skill backend command token is invalid"),n.push(t);return {type:"skill",command:n}}d("MANIFEST_INVALID","action backend type is unsupported");}function Uo(e){k(e)||d("MANIFEST_INVALID","action must be an object"),x(e,so,ao),S(e,"_meta")&&ht(e._meta);let n=Pn(e.actionId,"actionId"),t=Do(e.capability),i=e.mutation;typeof i!="boolean"&&d("MANIFEST_INVALID","action mutation must be boolean");let o=So(e.inputSchema),r;if(S(e,"dataInputs")){Array.isArray(e.dataInputs)||d("MANIFEST_INVALID","action dataInputs must be an array");let p=o.properties,u=new Set,f=[];for(let A of e.dataInputs)(typeof A!="string"||!S(p,A)||u.has(A))&&d("MANIFEST_INVALID","action dataInputs must be unique declared properties"),u.add(A),f.push(A);r=f;}let s=bn(e.resultProjection),a=Lo(e.backend),c;if(S(e,"confirmation")){let p=e.confirmation;p!=="none"&&p!=="native"&&d("MANIFEST_INVALID","action confirmation is invalid"),c=p;}return {actionId:n,capability:t,mutation:i,inputSchema:o,resultProjection:s,backend:a,...r===void 0?{}:{dataInputs:r},...c===void 0?{}:{confirmation:c}}}function Ro(e){return k(e)||d("INITIAL_STATE_INVALID","initialState must be an object"),x(e,uo,fo),e.path!=="ui/state.json"&&d("MANIFEST_INVALID","initialState path is not fixed"),S(e,"hash")?{path:"ui/state.json",hash:It(e.hash)}:{path:"ui/state.json"}}function Oo(e,n){ze(e,new Set,0,true,true),Dn(e),k(e)||d("MANIFEST_INVALID"),x(e,oo,ro),S(e,"_meta")&&ht(e._meta),e.manifestVersion!==2&&d("MANIFEST_INVALID");let t=Pn(e.pluginId,"pluginId"),i=Pn(e.definitionId,"definitionId"),o=Z(e,"version",1),r=ct(e.name,"name"),s=ct(e.description,"description"),a;S(e,"icon")&&((typeof e.icon!="string"||!/^[a-z][a-z0-9-]{0,63}$/.test(e.icon))&&d("MANIFEST_INVALID","icon is invalid"),a=e.icon);let c;S(e,"tone")&&((typeof e.tone!="string"||!En.includes(e.tone))&&d("MANIFEST_INVALID","tone is invalid"),c=e.tone),e.entry!=="ui/index.html"&&d("MANIFEST_INVALID","entry path is not fixed");let p;S(e,"entryHash")&&(p=It(e.entryHash));let u;S(e,"initialState")&&(u=Ro(e.initialState));let f;S(e,"usage")&&(e.usage!=="card"&&e.usage!=="window"&&d("MANIFEST_INVALID","usage is invalid"),f=e.usage);let A;S(e,"detailPanel")&&(typeof e.detailPanel!="boolean"&&d("MANIFEST_INVALID","detailPanel is invalid"),A=e.detailPanel);let m;if(S(e,"displayModes")){((f??ce)!==ce||!Array.isArray(e.displayModes)||e.displayModes.length===0)&&d("MANIFEST_INVALID","displayModes are only valid for window Apps");let l=new Set(["inline","floating","focused"]);(new Set(e.displayModes).size!==e.displayModes.length||e.displayModes.some(T=>typeof T!="string"||!l.has(T)))&&d("MANIFEST_INVALID","displayModes are invalid"),m=e.displayModes;}(f??ce)===ce&&A!==void 0&&d("MANIFEST_INVALID","detailPanel is card-only");let g=n.mode??"local";g!=="local"&&g!=="installed"&&g!=="published"&&d("MANIFEST_INVALID","manifest mode is invalid"),g!=="local"&&p===void 0&&d("MANIFEST_INVALID","installed manifests require entryHash"),g!=="local"&&u!==void 0&&u.hash===void 0&&d("MANIFEST_INVALID","installed manifests require initialState.hash"),(!Array.isArray(e.surfaces)||e.surfaces.length===0)&&d("MANIFEST_INVALID","surfaces are invalid"),e.surfaces.length>2&&w("surfaces exceed the v2 limit");let P=[],M=new Set;for(let l of e.surfaces)(typeof l!="string"||!_n.includes(l))&&d("MANIFEST_INVALID","surface is unsupported"),M.has(l)&&d("MANIFEST_INVALID","surfaces contain a duplicate"),M.add(l),P.push(l);k(e.size)||d("MANIFEST_INVALID","size must be an object"),x(e.size,["height"]);let L=Z(e.size,"height",1);L>720&&w("size.height exceeds the v2 limit");let y=bn(e.stateProjection),I=e.summaryProjection===void 0?void 0:bn(e.summaryProjection);I!==void 0&&I.allow.some(l=>!y.allow.includes(l))&&d("MANIFEST_INVALID","summaryProjection must be a subset of stateProjection.allow");let D=bo(e.dataPaths,y.allow);Array.isArray(e.actions)||d("MANIFEST_INVALID","actions must be an array"),e.actions.length>32&&w("actions exceed the v2 limit");let j=[],C=new Set;for(let l of e.actions){let T=Uo(l);if(C.has(T.actionId)&&d("MANIFEST_INVALID","actions contain a duplicate actionId"),T.backend.type==="core"&&T.backend.handler==="state.set"){T.mutation||d("MANIFEST_INVALID","state.set actions must be mutations");for(let z of Object.keys(T.inputSchema.properties))y.allow.includes(z)||d("MANIFEST_INVALID","state.set input paths must be projection-allowed");}C.add(T.actionId),j.push(T);}return {manifestVersion:2,pluginId:t,definitionId:i,version:o,name:r,description:s,...a===void 0?{}:{icon:a},...c===void 0?{}:{tone:c},entry:"ui/index.html",...p===void 0?{}:{entryHash:p},...u===void 0?{}:{initialState:u},...f===void 0?{}:{usage:f},...A===void 0?{}:{detailPanel:A},...m===void 0?{}:{displayModes:m},surfaces:P,size:{height:L},stateProjection:y,...I===void 0?{}:{summaryProjection:I},...D===void 0?{}:{dataPaths:D},actions:j}}function ht(e){k(e)||d("MANIFEST_INVALID","_meta must be an object");let n=JSON.stringify(e);(n===void 0||Buffer.byteLength(n,"utf8")>co)&&w("_meta exceeds the 4 KiB limit");}function ko(e){let n={},t={};for(let r of e.actions){n[r.actionId]={capabilities:[r.capability],inputKeys:Object.keys(r.inputSchema.properties??{}),...r.dataInputs===void 0?{}:{dataInputs:r.dataInputs},resultProjection:r.resultProjection,...r.confirmation===void 0?{}:{confirmation:r.confirmation}};let s=r.backend.type==="skill"||r.backend.type==="core"&&r.backend.handler==="state.set";t[r.actionId]={actionId:r.actionId,mutation:r.mutation,backend:r.backend,launchPolicy:s?"allowed":"denied",...s?{}:{denialCode:"EXEC_DENIED"}};}let i={id:e.definitionId,version:e.version,renderer:"sandbox-html",...e.usage===void 0?{}:{usage:e.usage},...e.detailPanel===void 0?{}:{detailPanel:e.detailPanel},...e.displayModes===void 0?{}:{displayModes:e.displayModes},surfaces:e.surfaces,stateProjection:e.stateProjection,...e.summaryProjection===void 0?{}:{summaryProjection:e.summaryProjection},...e.dataPaths===void 0?{}:{dataPaths:e.dataPaths},actions:n},o={entry:{path:"ui/index.html",...e.entryHash===void 0?{}:{hash:e.entryHash}},...e.initialState===void 0?{}:{initialState:e.initialState}};return {manifest:e,definition:i,handlers:t,resources:o}}function Sn(e,n,t,i,o,r){if(typeof e=="string"){let s=o.length>0&&r.some(a=>me(o.join("."),a));return (e.length>4096||$e(e,false,false,s))&&Y("state contains an unsafe string"),e}if(e===null||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)||Y("state contains a non-finite number"),e;(e===void 0||typeof e!="object"||typeof e=="function"||typeof e=="bigint")&&Y("state contains a non-JSON value"),t>8&&Y("state is too deep"),n.has(e)&&Y("state contains a cycle"),n.add(e);try{let s;if(Array.isArray(e))e.length>128&&Y("state array is too long"),s=e.map(c=>Sn(c,n,t+1,65536,o,r));else {k(e)||Y("state contains a non-plain object");let c={};for(let[p,u]of Object.entries(e))(p.length>4096||!Fe.test(p)||Ee(p))&&(p.length>4096&&Y("state key is too long"),Y("state contains a reserved or invalid key")),c[p]=Sn(u,n,t+1,65536,[...o,p],r);s=c;}let a=JSON.stringify(s);return (a===void 0||Buffer.byteLength(a,"utf8")>i)&&Y("state subtree is too large"),s}finally{n.delete(e);}}function Un(e,n=[]){k(e)||Y("initial state must be a JSON object");let t=Sn(e,new Set,0,65536,[],n);return (t===null||Array.isArray(t)||typeof t!="object")&&Y(),t}function xo(e,n={}){ze(e),k(e)||d("MANIFEST_INVALID"),x(e,io),e.manifestVersion!==1&&d("MANIFEST_INVALID");let t=Tn(Q(e,"pluginId")),i=Tn(Q(e,"definitionId")),o=Z(e,"version",1),r=Z(e,"primitiveSet",1),s=n.supportedPrimitiveSet??Ji;(!Number.isSafeInteger(s)||s<1)&&d("MANIFEST_INVALID"),r>s&&d("PRIMITIVE_SET_UNSUPPORTED"),k(e.activation)||d("MANIFEST_INVALID"),x(e.activation,["kind","language"]),e.activation.kind!=="fenced-code"&&d("MANIFEST_INVALID");let a=Tn(Q(e.activation,"language")),c=Eo(e.schema),p=Po(e.layout,c);return {manifestVersion:1,pluginId:t,definitionId:i,version:o,primitiveSet:r,activation:{kind:"fenced-code",language:a},schema:c,layout:p}}function wo(e,n={}){return k(e)||d("MANIFEST_INVALID"),Object.hasOwn(e,"lineage")&&d("MANIFEST_INVALID","lineage is only allowed in product bundle indexes"),e.manifestVersion===2?Oo(e,n):xo(e,n)}function ye(e,n={}){try{return wo(e,n)}catch(t){if(t instanceof $)throw t;return d("MANIFEST_INVALID")}}function Rn(e,n={}){let t=ye(e,n);return t.manifestVersion===2?ko(t):t}var _t="SKILL.md",Fo=/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;function Tt(e){if(e===null||typeof e!="object"||Array.isArray(e))return false;let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}function Bo(e){return e.isDirectory()||e.isSymbolicLink()}function Mt(e){try{return existsSync(e)&&statSync(e).isDirectory()}catch{return false}}function kn(e){let n;try{n=readFileSync(e,"utf8");}catch{return {frontmatter:{},readable:false,valid:false,hasFrontmatter:false}}let t=n.match(Fo);if(!t)return {frontmatter:{},readable:true,valid:true,hasFrontmatter:false};try{let i=load(t[1]??"");if(!Tt(i))return {frontmatter:{},readable:!0,valid:!1,hasFrontmatter:!0};let o=Tt(i.metadata)?i.metadata:void 0;return {frontmatter:{...typeof i.name=="string"?{name:i.name}:{},...typeof(o?.version??i.version)=="string"?{version:o?.version??i.version}:{},...typeof i.description=="string"?{description:i.description}:{}},readable:!0,valid:!0,hasFrontmatter:!0}}catch{return {frontmatter:{},readable:true,valid:false,hasFrontmatter:true}}}function Ho(e){return [join(e,_t),join(e,"skill",_t)]}function Pt(e,n){if(!Mt(e))return null;for(let t of Ho(e)){if(!existsSync(t))continue;let o=kn(t).frontmatter;return {name:o.name??n,...o.version===void 0?{}:{version:o.version},...o.description===void 0?{}:{description:o.description},skillMdPath:t,dir:e}}return null}function Dt(e){try{return readdirSync(e,{withFileTypes:!0}).filter(Bo)}catch{return []}}function bt(e,n,t){!e||n.has(e.name)||(n.add(e.name),t.push(e));}function St(e){let n=[],t=new Set;for(let i of e)if(Mt(i))for(let o of Dt(i)){if(o.name.startsWith("@")){let r=join(i,o.name);for(let s of Dt(r))bt(Pt(join(r,s.name),s.name),t,n);continue}bt(Pt(join(i,o.name),o.name),t,n);}return n.sort((i,o)=>i.name.localeCompare(o.name))}var Go=/^[0-9a-f]{64}$/;function pe(e){let t=e.renderer!==void 0||e.surfaces!==void 0||e.stateProjection!==void 0||e.dataPaths!==void 0||e.usage!==void 0||e.detailPanel!==void 0||e.displayModes!==void 0||e.summaryProjection!==void 0||e.legacy!==void 0||Object.values(e.actions).some(o=>o.resultProjection!==void 0)?{id:e.id,version:e.version,...e.renderer===void 0?{}:{renderer:e.renderer},...e.surfaces===void 0?{}:{surfaces:e.surfaces},...e.stateProjection===void 0?{}:{stateProjection:e.stateProjection},...e.dataPaths===void 0?{}:{dataPaths:e.dataPaths},...e.summaryProjection===void 0?{}:{summaryProjection:e.summaryProjection},...e.legacy===void 0?{}:{legacy:e.legacy},...e.usage===void 0?{}:{usage:e.usage},...e.detailPanel===void 0?{}:{detailPanel:e.detailPanel},...e.displayModes===void 0?{}:{displayModes:e.displayModes},...e.sourceHash===void 0?{}:{sourceHash:e.sourceHash},actions:e.actions}:e.sourceHash===void 0?{id:e.id,version:e.version,actions:e.actions}:{id:e.id,version:e.version,sourceHash:e.sourceHash,actions:e.actions},i=ae(t);return createHash("sha256").update(X(i)).digest("hex")}function de(e){if(!/^\d+$/.test(String(e.version))||e.version<1||e.id.length<1||e.id.length>128)throw new b("DEFINITION_UNSUPPORTED","UI definition is invalid");if(e.sourceHash!==void 0&&(typeof e.sourceHash!="string"||!Go.test(e.sourceHash)))throw new b("DEFINITION_UNSUPPORTED","UI definition source hash is invalid");if(!/^[0-9a-f]{64}$/.test(e.hash)||pe(e)!==e.hash)throw new b("DEFINITION_UNSUPPORTED","UI definition hash is invalid");for(let[n,t]of Object.entries(e.actions)){if(!n||!Array.isArray(t.capabilities)||t.capabilities.some(i=>!Wo(i)))throw new b("DEFINITION_UNSUPPORTED","UI action declaration is invalid");if(t.confirmation!==void 0&&t.confirmation!=="none"&&t.confirmation!=="native")throw new b("DEFINITION_UNSUPPORTED","UI action confirmation is invalid");if(t.inputKeys&&(!Array.isArray(t.inputKeys)||t.inputKeys.some(i=>typeof i!="string"||!i)))throw new b("DEFINITION_UNSUPPORTED","UI action input declaration is invalid");if(t.dataInputs!==void 0&&(!Array.isArray(t.dataInputs)||new Set(t.dataInputs).size!==t.dataInputs.length||t.dataInputs.some(i=>typeof i!="string"||!i||t.inputKeys!==void 0&&!t.inputKeys.includes(i))))throw new b("DEFINITION_UNSUPPORTED","UI action data input declaration is invalid");t.resultProjection&&xn(t.resultProjection);}if(e.renderer!==void 0&&(!e.renderer||e.renderer.length>128))throw new b("DEFINITION_UNSUPPORTED","UI definition renderer is invalid");if(e.surfaces&&(!Array.isArray(e.surfaces)||e.surfaces.some(n=>!n||n.length>64)))throw new b("DEFINITION_UNSUPPORTED","UI definition surfaces are invalid");if(e.usage!==void 0&&e.usage!=="card"&&e.usage!=="window")throw new b("DEFINITION_UNSUPPORTED","UI definition usage is invalid");if(e.detailPanel!==void 0&&typeof e.detailPanel!="boolean")throw new b("DEFINITION_UNSUPPORTED","UI definition detailPanel is invalid");if(e.displayModes&&(!Array.isArray(e.displayModes)||e.displayModes.length===0||new Set(e.displayModes).size!==e.displayModes.length||e.displayModes.some(n=>n!=="inline"&&n!=="floating"&&n!=="focused")))throw new b("DEFINITION_UNSUPPORTED","UI definition displayModes are invalid");if(e.usage==="card"&&e.displayModes!==void 0)throw new b("DEFINITION_UNSUPPORTED","Card definitions cannot declare displayModes");if(e.usage==="window"&&e.detailPanel!==void 0)throw new b("DEFINITION_UNSUPPORTED","Window definitions cannot declare detailPanel");if(e.stateProjection&&xn(e.stateProjection),e.summaryProjection){xn(e.summaryProjection);let n=new Set(e.stateProjection?.allow??[]);if(e.summaryProjection.allow.some(t=>!n.has(t)))throw new b("DEFINITION_UNSUPPORTED","UI summary projection exceeds state projection")}if(e.legacy!==void 0){if(!e.legacy||typeof e.legacy!="object"||Array.isArray(e.legacy)||Object.keys(e.legacy).some(o=>!["readTool","actionTool","hostTools","agentAccess"].includes(o)))throw new b("DEFINITION_UNSUPPORTED","UI legacy metadata is invalid");let n=new Set;for(let[o,r]of [["readTool",e.legacy.readTool],["actionTool",e.legacy.actionTool]])if(r!==void 0){if($o(r,o==="readTool"),n.has(r.name))throw new b("DEFINITION_UNSUPPORTED","UI legacy tool names collide");n.add(r.name);}let t=e.legacy.hostTools;if(t!==void 0){if(!t||typeof t!="object"||Array.isArray(t))throw new b("DEFINITION_UNSUPPORTED","UI legacy host tools are invalid");let o={"doc.open":"crewx_app_html_viewer_open","pty.connect":"crewx_app_terminal_connect"};for(let[r,s]of Object.entries(t)){if(!Object.hasOwn(o,r)||o[r]!==s||typeof s!="string"||!/^[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(s)||n.has(s))throw new b("DEFINITION_UNSUPPORTED","UI legacy host tools are invalid");n.add(s);}}let i=e.legacy.agentAccess;if(i!==void 0&&(!i||typeof i!="object"||Array.isArray(i)||Object.entries(i).some(([o,r])=>!o||!Object.hasOwn(e.actions,o)||r!=="allowed"&&r!=="denied")))throw new b("DEFINITION_UNSUPPORTED","UI legacy agent access is invalid");if(e.legacy.actionTool!==void 0&&(!i||Object.keys(i).length===0))throw new b("DEFINITION_UNSUPPORTED","UI legacy action tool requires its complete agent access map")}if(e.dataPaths!==void 0){let n=new Set(["__proto__","prototype","constructor"]);if(!Array.isArray(e.dataPaths)||e.dataPaths.length>16||new Set(e.dataPaths).size!==e.dataPaths.length||e.dataPaths.some(t=>typeof t!="string"||!/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*$/.test(t)||t.split(".").some(i=>n.has(i))||!(e.stateProjection?.allow??[]).some(i=>me(t,i))))throw new b("DEFINITION_UNSUPPORTED","UI definition dataPaths are invalid")}}function $o(e,n){if(!e||typeof e!="object"||Array.isArray(e))throw new b("DEFINITION_UNSUPPORTED","UI legacy tool metadata is invalid");let t=e,i=["name","description","inputSchema","textFallback","visibility"],o=Object.hasOwn(t,"fixedResult");if(Object.keys(t).some(r=>!i.includes(r)&&!(n&&r==="fixedResult"))||i.some(r=>!Object.hasOwn(t,r))||typeof t.name!="string"||!/^[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(t.name)||typeof t.description!="string"||t.description.trim().length===0||t.description.length>8192||typeof t.textFallback!="string"||t.textFallback.trim().length===0||t.textFallback.length>16384||!t.inputSchema||typeof t.inputSchema!="object"||Array.isArray(t.inputSchema)||!Array.isArray(t.visibility)||t.visibility.length===0||t.visibility.some(r=>r!=="model"&&r!=="app")||new Set(t.visibility).size!==t.visibility.length)throw new b("DEFINITION_UNSUPPORTED","UI legacy tool metadata is invalid");try{let r=ae(t.inputSchema);if(r.type!==void 0&&r.type!=="object")throw new Error("schema type");if(o){if(!n)throw new Error("fixed result location");let s=t.fixedResult;if(!s||typeof s!="object"||Array.isArray(s))throw new Error("fixed result");let a=s;if(Object.keys(a).sort().join(",")!=="argsPolicy,structuredContent"||a.argsPolicy!=="empty-only"&&a.argsPolicy!=="ignore"||!a.structuredContent||typeof a.structuredContent!="object"||Array.isArray(a.structuredContent))throw new Error("fixed result");let c=ae(a.structuredContent);if(An(he(c))>4*1024)throw new Error("fixed result size")}}catch{throw new b("DEFINITION_UNSUPPORTED","UI legacy tool metadata is not projection-safe")}}function xn(e){if(!Array.isArray(e.allow)||e.allow.some(n=>!/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*$/.test(n)))throw new b("DEFINITION_UNSUPPORTED","UI projection policy is invalid")}function Wo(e){return e.length>0&&e.length<=128&&e!=="*"&&e!=="all"&&!/[/*]/.test(e)}var ee=class extends Error{constructor(t,i=t,o=[]){super(i);this.code=t;this.violations=o;}code;violations;name="UiDefinitionLineageError"},Lt=/^[0-9a-f]{64}$/,Jo=["version","hash","definition"],Ko=["sourceHash","compat"],Xo=["id","version","actions"],Yo=["sourceHash","usage","detailPanel","displayModes","renderer","surfaces","stateProjection","dataPaths","summaryProjection","legacy"],qo=["capabilities"],Zo=["inputKeys","dataInputs","confirmation","resultProjection"];function we(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function wn(e,n,t=[]){let i=new Set([...n,...t]),o=Object.keys(e);return n.every(r=>Object.hasOwn(e,r))&&o.every(r=>i.has(r))}function Rt(e){if(e===null||typeof e!="object"||Object.isFrozen(e))return e;for(let n of Object.values(e))Rt(n);return Object.freeze(e)}function V(e){throw new ee("LINEAGE_INVALID",e)}function Qo(e){throw new ee("LINEAGE_STALE",e)}function Ot(e){if(!we(e)||!wn(e,Xo,Yo)||!we(e.actions))return V("Lineage definition shape is invalid");for(let n of Object.values(e.actions))if(!we(n)||!wn(n,qo,Zo))return V("Lineage action definition shape is invalid");return e}function er(e){if(!we(e)||!wn(e,Jo,Ko))return V("Lineage entry shape is invalid");if(!Number.isSafeInteger(e.version)||e.version<1||typeof e.hash!="string"||!Lt.test(e.hash))return V("Lineage entry identity is invalid");if(e.sourceHash!==void 0&&(typeof e.sourceHash!="string"||!Lt.test(e.sourceHash)))return V("Lineage source hash is invalid");if(e.compat!==void 0&&e.compat!=="break")return V("Lineage compatibility marker is invalid");let n=Ot(e.definition);if(n.version!==e.version)return V("Lineage version does not match its definition");if(e.sourceHash!==void 0&&n.sourceHash!==e.sourceHash)return V("Lineage source hash does not match its definition");let t;try{t=pe(n),de({...n,hash:e.hash});}catch{return V("Lineage definition is invalid")}return t!==e.hash?V("Lineage definition hash does not match"):Rt({version:e.version,hash:e.hash,definition:n,...e.sourceHash===void 0?{}:{sourceHash:e.sourceHash},...e.compat===void 0?{}:{compat:e.compat}})}function Ut(e){return e.stateProjection?.allow??[]}function nr(e,n){let t=[],i=new Set(Ut(n));Ut(e).some(a=>!i.has(a))&&t.push("S1_STATE_PROJECTION");let o=new Set(n.dataPaths??[]);(e.dataPaths??[]).some(a=>!o.has(a))&&t.push("S2_DATA_PATHS");for(let[a,c]of Object.entries(e.actions)){let p=n.actions[a];if(p&&(c.confirmation??"native")==="native"&&(p.confirmation??"native")!=="native"){t.push("S3_ACTION_CONFIRMATION");break}}Object.keys(e.legacy?.agentAccess??{}).some(a=>!Object.hasOwn(n.actions,a))&&t.push("S4_LEGACY_AGENT_ACTIONS");let s=e.summaryProjection?.allow;if(s!==void 0){let a=new Set(n.summaryProjection?.allow??[]);s.some(c=>!a.has(c))&&t.push("S5_SUMMARY_PROJECTION");}return t}function tr(e,n){return X(e)===X(n)}function Cn(e,n){if(!Array.isArray(e)||e.length===0)return V("Definition lineage is missing");if(!we(n)||typeof n.hash!="string")return V("Current definition is invalid");let t,i;try{let{hash:a,...c}=n;i=Ot(c),t={...i,hash:a},de(t);}catch{return V("Current definition is invalid")}let o=e.map(er),r=o[0].definition.id;if(o.some(a=>a.definition.id!==r))return V("Lineage definition ids do not match");if(o.some((a,c)=>c>0&&a.version<=o[c-1].version))return V("Lineage generations are not in increasing version order");if(o.some((a,c)=>o.findIndex(p=>p.hash===a.hash)!==c))return V("Lineage contains a duplicate hash");let s=o[o.length-1];if(s.version!==t.version||s.hash!==t.hash||s.definition.id!==t.id||!tr(s.definition,i))return Qo("The last lineage generation does not match the current package");if(t.legacy!==void 0){let a=new Set(Object.keys(t.actions)),c=new Set;for(let u of o)if(u.sourceHash===void 0)for(let f of Object.keys(u.definition.actions))a.has(f)&&c.add(f);let p=Object.keys(t.legacy.agentAccess??{});if(p.length!==c.size||p.some(u=>!c.has(u))){let u="S4_LEGACY_AGENT_ACCESS_COMPLETE";throw new ee("LINEAGE_INVALID",`Lineage compatibility failed: ${u}`,[u])}}for(let a=0;a<o.length-1;a+=1){if(o.slice(a,-1).some(u=>u.compat==="break"))continue;let p=nr(o[a].definition,t);if(p.length>0)throw new ee("LINEAGE_INVALID",`Lineage compatibility failed: ${p.join(", ")}`,p)}return Object.freeze({entries:Object.freeze(o),current:t})}var ir=new WeakSet;function kt(e){return ir.add(e),e}var le=class extends Error{constructor(t,i=t){super(i);this.code=t;}code;name="McpAppContractError"};function vn(e,n=e){throw new le(e,n)}var xt=["crewx_app_terminal_connect","crewx_app_html_viewer_open"],wt=["crewx_listWorkspaces","crewx_queryAgent","crewx_executeAgent","crewx_getTaskResult","crewx_listTasks","crewx_listAgents","callBrowser","openTab","listTabs","closeTab"];var We=8*1024*1024;new Set(xt);new Set(wt);var rr=4;function jn(e,n=0){try{let t=ae(e,n);return t.type!==void 0&&t.type!=="object"&&vn("TOOL_INVALID","MCP App inputSchema must describe an object"),t}catch(t){if(t instanceof le)throw t;vn("TOOL_INVALID","MCP App inputSchema must be projection-safe JSON");}}function Ct(e){if(e.length===0)return jn({type:"object",properties:{},additionalProperties:false});let n=e.map(i=>i.actionId),t=new Map;for(let i of e)t.set(i.actionId,jn(i.inputSchema));return jn(sr(n,t),rr)}function sr(e,n){let t=e.map(i=>({type:"object",properties:{actionId:{type:"string",const:i},input:n.get(i)??{type:"object"}},required:["actionId","input"],additionalProperties:false}));return Object.freeze({type:"object",oneOf:Object.freeze(t),properties:Object.freeze({actionId:Object.freeze({type:"string",enum:Object.freeze([...e])}),input:Object.freeze({type:"object"})}),required:Object.freeze(["actionId","input"]),additionalProperties:false})}var _=class extends Error{constructor(t){super(t);this.code=t;}code;name="AppDiscoveryFsError"},Ht=constants.O_NOFOLLOW,dr=constants.O_NONBLOCK,lr=constants.O_RDONLY|(Ht??0)|(dr??0);function ne(e){let n=typeof e=="object"&&e!==null&&"code"in e?String(e.code):"";return n==="ENOENT"?new _("NOT_FOUND"):n==="ELOOP"?new _("PATH_ESCAPED"):n==="EFBIG"||n==="EOVERFLOW"?new _("LIMIT_EXCEEDED"):n==="EACCES"||n==="EPERM"||n==="ENOTDIR"?new _("READ_DENIED"):new _("READ_DENIED")}function ur(e){if(typeof e!="string"||e.length===0||!isAbsolute(e))throw new _("READ_DENIED")}function vt(e){if(typeof e!="string"||isAbsolute(e)||/[\\\u0000]/.test(e))throw new _("PATH_ESCAPED");if(e==="")return [];let n=e.split("/");if(n.some(t=>t.length===0||t==="."||t===".."))throw new _("PATH_ESCAPED");return n}function Je(e,n){let t=relative(e,n);return t===""||t!==".."&&!t.startsWith(`..${sep}`)&&!isAbsolute(t)}function Ke(e){return {dev:e.dev,ino:e.ino,size:e.size,mtimeNs:e.mtimeNs,ctimeNs:e.ctimeNs}}function Bn(e,n){return e.dev===n.dev&&e.ino===n.ino}function zt(e,n){return Bn(e,n)&&e.size===n.size&&e.mtimeNs===n.mtimeNs&&e.ctimeNs===n.ctimeNs}async function jt(e){ur(e);let n,t;try{n=await realpath(e),t=await stat(n,{bigint:!0});}catch(i){throw ne(i)}if(!t.isDirectory())throw new _("READ_DENIED");return {realRoot:n,identity:Ke(t)}}async function fr(e,n,t){if(t.length<2||t[0]!=="apps"&&t[0]!=="skills")return;let i,o;try{if(i=resolve(e,t[0],t[1]),o=await realpath(i),!(await stat(o,{bigint:!0})).isDirectory())throw new _("READ_DENIED")}catch(r){throw r instanceof _?r:ne(r)}if(!Je(n,o))throw new _("PATH_ESCAPED");return o}async function Vt(e,n,t,i){let o,r,s;try{o=await lstat(e,{bigint:!0}),r=await realpath(e),s=await stat(r,{bigint:!0});}catch(a){throw ne(a)}if(!Je(n,r)||t!==void 0&&!Je(t,r))throw new _("PATH_ESCAPED");if(!o.isFile()||!s.isFile())throw new _("READ_DENIED");if(!Bn(i,o)||!Bn(i,s)||i.dev!==s.dev)throw new _("PATH_ESCAPED")}async function Vn(e,n){let t,i;try{t=await realpath(e),i=await stat(t,{bigint:!0});}catch{throw new _("PATH_ESCAPED")}if(t!==n.realRoot||!zt(n.identity,Ke(i)))throw new _("PATH_ESCAPED")}function yr(e){return e.isSymbolicLink()?{name:e.name,kind:"symlink"}:e.isDirectory()?{name:e.name,kind:"directory"}:e.isFile()?{name:e.name,kind:"file"}:{name:e.name,kind:"other"}}var Xe=class{async listDirectory(n,t){let i=vt(t),o=await jt(n),r=resolve(n,...i),s,a;try{s=await realpath(r),a=await stat(s,{bigint:!0});}catch(c){let p=ne(c);if(p.code==="NOT_FOUND")return [];throw p}if(!Je(o.realRoot,s)||!a.isDirectory())throw new _("PATH_ESCAPED");try{let c=await readdir(s,{withFileTypes:!0,encoding:"utf8"});return await Vn(n,o),c.map(yr)}catch(c){let p=ne(c);if(p.code==="NOT_FOUND")return [];throw p}}async readdir(n,t){return this.listDirectory(n,t)}async readDirectory(n,t){return this.listDirectory(n,t)}async readVerifiedFile(n,t,i){if(!Number.isSafeInteger(i)||i<0)throw new _("READ_DENIED");if(Ht===void 0)throw new _("UNSUPPORTED");let o=vt(t),r=await jt(n),s=resolve(n,...o),a=relative(n,s);if(a===".."||a.startsWith(`..${sep}`)||isAbsolute(a))throw new _("PATH_ESCAPED");let c;try{c=await open(s,lr);}catch(p){throw ne(p)}try{let p;try{let g=await c.stat({bigint:!0});p=Ke(g);}catch(g){throw ne(g)}if(p.size>BigInt(i))throw new _("LIMIT_EXCEEDED");if(p.size>BigInt(Number.MAX_SAFE_INTEGER))throw new _("LIMIT_EXCEEDED");await Vn(n,r);let u=await fr(n,r.realRoot,o);await Vt(s,r.realRoot,u,p);let f=new Uint8Array(new ArrayBuffer(Number(p.size))),A=0;for(;A<f.byteLength;){let g;try{g=(await c.read(f,A,f.byteLength-A,A)).bytesRead;}catch(P){throw ne(P)}if(g<=0)throw new _("IDENTITY_CHANGED");A+=g;}let m;try{let g=await c.stat({bigint:!0});m=Ke(g);}catch(g){throw ne(g)}if(!zt(p,m))throw new _("IDENTITY_CHANGED");return await Vt(s,r.realRoot,u,m),await Vn(n,r),new Uint8Array(f)}finally{await c.close().catch(()=>{});}}async readFileVerified(n,t,i){return this.readVerifiedFile(n,t,i)}},Gt=new Xe;var zn="crewx_local_app_";function Ar(e){if(typeof e!="string"||!_e.test(e))throw new TypeError("pluginId must be a safe UI plugin identifier");let n=`${zn}${e}`.length+7<=128?e:`hash_${createHash("sha256").update(e,"utf8").digest("hex")}`;return {read:`${zn}${n}_read`,action:`${zn}${n}_action`}}var $t=["bundled","apps","skills"],gr=256*1024,Kn=64,Xn=128,Ir=Kn*Xn,mr=2*1024*1024,Gn=32*1024*1024,Wn=/^[0-9a-f]{64}$/,hr=new TextDecoder("utf-8",{fatal:true});function ge(e){if(e===null||typeof e!="object"||Array.isArray(e))return false;try{let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}catch{return false}}function Ze(e){return typeof e=="string"&&_e.test(e)?e:void 0}function Er(e,n){return n.length===0||n==="."||n===".."||/[\\/\u0000]/.test(n)?e==="skills"?"skills":"apps":`${e==="skills"?"skills":"apps"}/${n}`}function Zt(e){return e.length>0&&e!=="."&&e!==".."&&!/[\\/\u0000]/.test(e)}function Me(e,n){let t=new TextEncoder().encode(e),i=new TextEncoder().encode(n),o=Math.min(t.byteLength,i.byteLength);for(let r=0;r<o;r+=1){let s=t[r]-i[r];if(s!==0)return s}return t.byteLength-i.byteLength}function _r(e){if(typeof e=="string")return {name:e,kind:"directory"};if(e===null||typeof e!="object")return null;let n=e;if(typeof n.name!="string")return null;if(n.kind==="file"||n.kind==="directory"||n.kind==="symlink"||n.kind==="other")return {name:n.name,kind:n.kind};if(n.type==="file"||n.type==="directory"||n.type==="symlink"||n.type==="other")return {name:n.name,kind:n.type};let t=n.isDirectory;if(typeof t=="function"&&t.call(e))return {name:n.name,kind:"directory"};let i=n.isSymbolicLink;if(typeof i=="function"&&i.call(e))return {name:n.name,kind:"symlink"};let o=n.isFile;return typeof o=="function"&&o.call(e)?{name:n.name,kind:"file"}:{name:n.name,kind:"other"}}function Tr(e){if(e instanceof Uint8Array)return new Uint8Array(e);if(e instanceof ArrayBuffer)return new Uint8Array(e.slice(0));if(Array.isArray(e)&&e.every(n=>Number.isInteger(n)&&n>=0&&n<=255))return Uint8Array.from(e);throw new TypeError("filesystem port returned an invalid byte array")}function Qt(e){return hr.decode(e)}function Yn(e){return JSON.parse(Qt(e))}function Pr(e){if(!ge(e))return;let n=Ze(e.pluginId);if(!n)return;let t=Ze(e.definitionId),i=e.version,o=t&&Number.isSafeInteger(i)&&i>=1?`${t}\0${String(i)}`:void 0;return {pluginId:n,...o===void 0?{}:{definitionKey:o}}}function Dr(e){let n=Yn(e);return {value:n,identity:Pr(n)}}function nn(e,n,t,i){let o={code:e,...i===void 0?{}:{pluginId:i},source:n,relativePath:t};return Object.freeze(o)}function Wt(e){switch(e){case "ENOENT":return "NOT_FOUND";case "ELOOP":case "EXDEV":return "PATH_ESCAPED";case "EFBIG":case "EOVERFLOW":return "LIMIT_EXCEEDED";case "EACCES":case "EPERM":case "ENOTDIR":return "READ_DENIED";default:return e}}function ue(e){if(e instanceof _)return Wt(e.code);if(e!==null&&typeof e=="object"&&"code"in e){let n=e.code;if(typeof n=="string")return Wt(n)}}function je(e,n){return e==="PATH_ESCAPED"||e==="IDENTITY_CHANGED"||e==="TOCTOU"?"PATH_ESCAPED":e==="LIMIT_EXCEEDED"?"LIMIT_EXCEEDED":n==="manifest"&&e==="NOT_FOUND"?"MANIFEST_MISSING":n==="entry"?"ENTRY_INVALID":n==="initial"?"INITIAL_STATE_INVALID":"MANIFEST_INVALID"}function Jt(e){switch(e.code){case "MANIFEST_INVALID":case "PRIMITIVE_UNKNOWN":case "PRIMITIVE_SET_UNSUPPORTED":case "SCHEMA_TYPE_UNSUPPORTED":case "TOKEN_INVALID":case "UNSAFE_VALUE":return "MANIFEST_INVALID";case "LIMIT_EXCEEDED":return "LIMIT_EXCEEDED";case "INITIAL_STATE_INVALID":return "INITIAL_STATE_INVALID";default:return ei("UiPluginValidationError",e.code)}}function ei(e,n){throw new Error(`Unmapped ${e} code: ${String(n)}`)}function $n(e){switch(e){case "APP_ID_INVALID":case "TOOL_ID_INVALID":case "RESOURCE_URI_INVALID":case "TOOL_INVALID":case "SERIALIZATION_INVALID":return "MANIFEST_INVALID";case "APP_ID_CONFLICT":case "TOOL_ID_CONFLICT":return "DUPLICATE_ID";case "RESOURCE_NOT_FOUND":case "HTML_INVALID":return "ENTRY_INVALID";case "STATE_INVALID":case "STATE_PROJECTION_INVALID":case "BUTTON_INVALID":return "INITIAL_STATE_INVALID";default:return ei("McpAppContractError",e)}}function q(e,n){let t=n();return Number.isFinite(t)&&Number.isFinite(e)&&t-e<=5e3}function qe(e,n){let t=Object.keys(e).sort(Me),i=[...n].sort(Me);return t.length===i.length&&t.every((o,r)=>o===i[r])}function Kt(e){if(typeof e!="string"||e.length===0||e.startsWith("/")||/[\\\u0000]/.test(e))return;let n=e.split("/");if(!n.some(t=>t.length===0||t==="."||t===".."))return n}function br(e){let n;try{n=Yn(e);}catch{return}if(!ge(n)||!qe(n,["version","packages"])||n.version!==1||!Array.isArray(n.packages)||n.packages.length>Kn)return;let t=new Set,i=new Set,o=0,r=[];for(let s of n.packages){if(!ge(s))return;let a=["packageDir","appId","definition","files"],c=Object.hasOwn(s,"lineage");if(!qe(s,c?[...a,"lineage"]:a))return;let p=Kt(s.packageDir),u=Ze(s.appId);if(!p||p.length!==2||p[0]!=="apps"||!Zt(p[1])||!u||t.has(s.packageDir)||!ge(s.definition)||!qe(s.definition,["id","version","hash"]))return;let f=Ze(s.definition.id),A=s.definition.version,m=s.definition.hash;if(!f||!Number.isSafeInteger(A)||A<1||typeof m!="string"||!Wn.test(m)||!Array.isArray(s.files)||s.files.length<2||s.files.length>Xn)return;let g=new Set,P=[];for(let M of s.files){if(!ge(M)||!qe(M,["path","sha256"]))return;let L=Kt(M.path);if(!L||typeof M.sha256!="string"||!Wn.test(M.sha256))return;let y=L.join("/"),I=`${s.packageDir}/${y}`;if(g.has(y)||i.has(I))return;g.add(y),i.add(I),P.push(Object.freeze({path:y,sha256:M.sha256}));}if(!g.has("ui-plugin.json")||!g.has("ui/index.html")||(o+=P.length,o>Ir))return;t.add(s.packageDir),r.push(Object.freeze({packageDir:s.packageDir,appId:u,definition:Object.freeze({id:f,version:A,hash:m}),lineage:Array.isArray(s.lineage)?s.lineage:[],files:Object.freeze(P.sort((M,L)=>Me(M.path,L.path)))}));}return Object.freeze({version:1,packages:Object.freeze(r)})}function Nr(e){return {pluginId:e.appId,definitionKey:`${e.definition.id}\0${String(e.definition.version)}`}}function Ae(e){let n=ue(e);return n==="PATH_ESCAPED"||n==="IDENTITY_CHANGED"||n==="TOCTOU"?"PATH_ESCAPED":n==="LIMIT_EXCEEDED"?"LIMIT_EXCEEDED":"BUNDLE_INTEGRITY"}async function Mr(e,n,t,i,o){let r=[],s=async(a,c)=>{if(!q(i,o))throw new _("LIMIT_EXCEEDED");if(c>2)throw new _("LIMIT_EXCEEDED");let p=await en(e,n,a);for(let u of p){if(typeof u.name!="string"||u.name.length===0||u.name==="."||u.name===".."||/[\\/\u0000]/.test(u.name))throw new _("PATH_ESCAPED");let f=`${a}/${u.name}`;if(u.kind==="file"){if(r.push(f.slice(t.length+1)),r.length>Xn)throw new _("LIMIT_EXCEEDED")}else if(u.kind==="directory")await s(f,c+1);else throw u.kind==="symlink"?new _("PATH_ESCAPED"):new _("READ_DENIED")}};return await s(t,0),r.sort(Me)}function Sr(e){return e==="ui-plugin.json"?262144:e==="ui/index.html"?We:e==="ui/state.json"?65536:mr}async function Lr(e,n,t,i){if(e===void 0)return {packages:[],diagnostics:[],incomplete:false};let o=[],r=(l,T,z)=>nn(l,"bundled",T,z);if(typeof e.root!="string"||e.root.length===0||typeof e.expectedIndexHash!="string"||!Wn.test(e.expectedIndexHash))return o.push(r("BUNDLE_INTEGRITY","bundle-index.json")),{packages:[],diagnostics:o,incomplete:false};let s;try{s=await Qe(n,e.root,"bundle-index.json",gr);}catch(l){return o.push(r(Ae(l),"bundle-index.json")),{packages:[],diagnostics:o,incomplete:false}}let a=createHash("sha256").update(s).digest("hex");if(a!==e.expectedIndexHash)return o.push(r("BUNDLE_INTEGRITY","bundle-index.json")),{packages:[],diagnostics:o,incomplete:false};let c=br(s);if(c===void 0)return o.push(r("BUNDLE_INTEGRITY","bundle-index.json")),{indexHash:a,packages:[],diagnostics:o,incomplete:false};if(!q(t,i))return o.push(r("LIMIT_EXCEEDED","bundle-index.json")),{indexHash:a,packages:c.packages.map(l=>({indexEntry:l,failureCode:"LIMIT_EXCEEDED"})),diagnostics:o,incomplete:true};let p;try{p=await en(n,e.root,"");}catch(l){return o.push(r(Ae(l),"bundle-index.json")),{indexHash:a,packages:c.packages.map(T=>({indexEntry:T,failureCode:Ae(l)})),diagnostics:o,incomplete:false}}if(!q(t,i))return o.push(r("LIMIT_EXCEEDED","bundle-index.json")),{indexHash:a,packages:c.packages.map(l=>({indexEntry:l,failureCode:"LIMIT_EXCEEDED"})),diagnostics:o,incomplete:true};let u=p.find(l=>l.name==="bundle-index.json"&&l.kind==="file"),f=p.find(l=>l.name==="apps"&&l.kind==="directory"),A=l=>c.packages.map(T=>({indexEntry:T,failureCode:l}));if(!u)return o.push(r("BUNDLE_INTEGRITY","bundle-index.json")),{indexHash:a,packages:A("BUNDLE_INTEGRITY"),diagnostics:o,incomplete:false};let m=p.filter(l=>l.name!=="bundle-index.json"&&l.name!=="apps");if(m.length>0){let l=m.some(T=>T.kind==="symlink")?"PATH_ESCAPED":"BUNDLE_INTEGRITY";return o.push(r(l,"bundle-index.json")),{indexHash:a,packages:A("BUNDLE_INTEGRITY"),diagnostics:o,incomplete:false}}if(p.some(l=>l.name==="apps"&&l.kind!=="directory"))return o.push(r("PATH_ESCAPED","apps")),{indexHash:a,packages:A("PATH_ESCAPED"),diagnostics:o,incomplete:false};let g=[];if(f)try{g=await en(n,e.root,"apps");}catch(l){return o.push(r(Ae(l),"apps")),{indexHash:a,packages:A(Ae(l)),diagnostics:o,incomplete:false}}if(!q(t,i))return o.push(r("LIMIT_EXCEEDED","apps")),{indexHash:a,packages:A("LIMIT_EXCEEDED"),diagnostics:o,incomplete:true};if(g.length>Kn)return o.push(r("LIMIT_EXCEEDED","apps")),{indexHash:a,packages:A("LIMIT_EXCEEDED"),diagnostics:o,incomplete:true};let P=new Map(c.packages.map(l=>[l.packageDir.slice(5),l])),M=g.filter(l=>!P.has(l.name));for(let l of M)o.push(r(l.kind==="symlink"?"PATH_ESCAPED":"BUNDLE_INTEGRITY",`apps/${l.name}`));if(M.length>0){let l=M.some(T=>T.kind==="symlink")?"PATH_ESCAPED":"BUNDLE_INTEGRITY";return {indexHash:a,packages:A(l),diagnostics:o,incomplete:false}}let L=new Set,y=new Map,I=new Map;for(let l of c.packages){let T=y.get(l.appId)??[];T.push(l),y.set(l.appId,T);let z=`${l.definition.id}\0${String(l.definition.version)}`,W=I.get(z)??[];W.push(l),I.set(z,W);}for(let l of [...y.values(),...I.values()])if(l.length>1)for(let T of l)L.add(T);let D=[],j=s.byteLength,C=false;for(let l of c.packages){if(!q(t,i)){C=true,D.push({indexEntry:l,failureCode:"LIMIT_EXCEEDED"});continue}let T;try{let O=l.lineage[l.lineage.length-1];if(!O)throw new ee("LINEAGE_INVALID","Definition lineage is missing");if(O.definition.id!==l.definition.id||O.version!==l.definition.version||O.hash!==l.definition.hash)throw new ee("LINEAGE_STALE","Last lineage generation does not match bundle identity");T=Cn(l.lineage,{...O.definition,hash:O.hash}).entries;}catch(O){let E=O instanceof ee?O.code:"LINEAGE_INVALID";o.push(r(E,l.packageDir)),D.push({indexEntry:l,failureCode:E});continue}let z=g.find(O=>O.name===l.packageDir.slice(5));if(!f||!z){D.push({indexEntry:l,failureCode:"BUNDLE_INTEGRITY"});continue}if(z.kind!=="directory"){D.push({indexEntry:l,failureCode:z.kind==="symlink"?"PATH_ESCAPED":"BUNDLE_INTEGRITY"});continue}let W;try{let O=await Mr(n,e.root,l.packageDir,t,i);if(!q(t,i)){C=!0,D.push({indexEntry:l,failureCode:"LIMIT_EXCEEDED"});continue}let E=l.files.map(J=>J.path);if(O.length!==E.length||O.some((J,se)=>J!==E[se])){D.push({indexEntry:l,failureCode:"BUNDLE_INTEGRITY"});continue}W=new Map;let B;for(let J of l.files){if(!q(t,i)){B="LIMIT_EXCEEDED",C=!0;break}if(j>=Gn){B="LIMIT_EXCEEDED";break}let se;try{se=await Qe(n,e.root,`${l.packageDir}/${J.path}`,Sr(J.path));}catch(un){B=Ae(un);break}if(!q(t,i)){B="LIMIT_EXCEEDED",C=!0;break}if(j+se.byteLength>Gn){j=Gn,B="LIMIT_EXCEEDED";break}if(j+=se.byteLength,createHash("sha256").update(se).digest("hex")!==J.sha256){B="BUNDLE_INTEGRITY";break}W.set(J.path,se);}if(B!==void 0){D.push({indexEntry:l,failureCode:B});continue}}catch(O){q(t,i)||(C=true),D.push({indexEntry:l,failureCode:Ae(O)});continue}D.push({indexEntry:l,lineage:T,files:W,...L.has(l)?{failureCode:"DUPLICATE_ID"}:{}});}return {indexHash:a,packages:D,diagnostics:o,incomplete:C}}function Ur(){return globalThis.performance?.now()??Date.now()}function be(e){if(e===null||typeof e!="object"||Object.isFrozen(e))return e;for(let n of Object.values(e))be(n);return Object.freeze(e)}function Xt(e){return Object.freeze(Array.from(e))}async function Jn(e,n,t,i){if(n.pinnedFiles!==void 0){let o=n.pinnedFiles.get(t);if(o===void 0)throw new _("NOT_FOUND");if(o.byteLength>i)throw new _("LIMIT_EXCEEDED");return new Uint8Array(o)}return Qe(e,n.root,`${n.relativePath}/${t}`,i)}function Rr(e,n,t){let i=createHash("sha256"),o=new TextEncoder().encode(X(e)),r=s=>{let a=new Uint8Array(8);new DataView(a.buffer).setBigUint64(0,BigInt(s)),i.update(a);};return r(o.byteLength),i.update(o),r(n.byteLength),i.update(n),r(t.byteLength),i.update(t),i.digest("hex")}function Or(e,n){let t={...e.definition,sourceHash:n},i={...t,hash:pe(t)};try{de(i);}catch{throw new $("MANIFEST_INVALID","normalized definition is invalid")}return i}function kr(e){return e.actions.some(n=>n.backend.type==="core"&&n.backend.handler!=="state.set")}function xr(e){if(typeof e.readVerifiedFile=="function")return e.readVerifiedFile;if(typeof e.readFileVerified=="function")return e.readFileVerified}function wr(e){if(typeof e.listDirectory=="function")return e.listDirectory;if(typeof e.readDirectory=="function")return e.readDirectory;if(typeof e.readdir=="function")return e.readdir}async function Qe(e,n,t,i){let o=xr(e);if(!o)throw new _("READ_DENIED");return Tr(await o.call(e,n,t,i))}async function en(e,n,t){let i=wr(e);if(!i)throw new _("READ_DENIED");let o=await i.call(e,n,t);if(!Array.isArray(o))throw new _("READ_DENIED");return o.map(_r).filter(r=>r!==null)}function Cr(e){let n=[];for(let t of [e.reserved,e.builtin])t&&n.push(t);return e.builtins&&"listMcpApps"in e.builtins?n.push(Yt(e.builtins)):e.builtins&&n.push(e.builtins),e.builtinCatalog&&n.push(Yt(e.builtinCatalog)),n.push({...e.reservedAppIds===void 0?{}:{appIds:e.reservedAppIds},...e.reservedDefinitionIds===void 0?{}:{definitionIds:e.reservedDefinitionIds},...e.reservedToolNames===void 0?{}:{toolNames:e.reservedToolNames}}),n}function Yt(e){let n=[],t=[],i=[];for(let o of e.listMcpApps())typeof o.appId=="string"&&n.push(o.appId),o.definition&&typeof o.definition.id=="string"&&t.push(o.definition.id);for(let o of e.listMcpAppTools())typeof o.name=="string"&&i.push(o.name);return {appIds:n,definitionIds:t,toolNames:i}}function te(e,n){e.diagnostic||(e.diagnostic=nn(n,e.source,e.relativePath,e.identity?.pluginId));}function vr(e){let n=new Map;for(let i of e){let o=i.identity?.pluginId;if(o===void 0)continue;let r=n.get(o)??[];r.push(i),n.set(o,r);}for(let i of n.values()){if(i.length<2)continue;let o=i.filter(s=>s.provenance!==void 0);if(o.length>0){for(let s of i)s.provenance===void 0&&te(s,"RESERVED_ID");if(o.length>1)for(let s of o)te(s,"DUPLICATE_ID");continue}let r=i.filter(s=>s.source==="apps");if(r.length>1){for(let s of r)te(s,"DUPLICATE_ID");for(let s of i.filter(a=>a.source==="skills"))te(s,"DUPLICATE_ID");}else for(let s of i.filter(a=>a.source==="skills"))te(s,"DUPLICATE_ID");}let t=new Map;for(let i of e){if(i.diagnostic?.code==="RESERVED_ID")continue;let o=i.identity?.definitionKey;if(o===void 0)continue;let r=t.get(o)??[];r.push(i),t.set(o,r);}for(let i of t.values())if(i.length>1)for(let o of i)te(o,"DUPLICATE_ID");}function jr(e,n,t){let i=new Set,o=new Set,r=new Set,s=new Set(t.map(c=>c.appId)),a=new Set(e.filter(c=>c.source==="bundled"&&c.candidate===void 0).flatMap(c=>c.bundleIdentity===void 0?[]:[c.bundleIdentity.definitionId]));for(let c of Cr(n)){for(let p of c.appIds??[])typeof p=="string"&&i.add(p);for(let p of c.definitionIds??[])typeof p=="string"&&o.add(p);for(let p of c.toolNames??[])typeof p=="string"&&r.add(p);}for(let c of e){let p=c.candidate;if(!p)continue;if(i.has(p.pluginId)||o.has(p.definitionId)){te(c,"RESERVED_ID");continue}if(c.provenance===void 0&&(s.has(p.pluginId)||a.has(p.definitionId))){te(c,"RESERVED_ID");continue}[p.toolNames.read,p.toolNames.action].filter(f=>f!==void 0).some(f=>r.has(f))&&te(c,"DUPLICATE_ID");}}function Vr(e){return [...e].sort((n,t)=>{let i=$t.indexOf(n.source)-$t.indexOf(t.source);return i!==0?i:Me(n.relativePath,t.relativePath)})}function N(e,n){e.diagnostic=nn(n,e.source,e.relativePath,e.identity?.pluginId);}async function qt(e,n,t){if(t.byteLength>262144){N(n,"LIMIT_EXCEEDED");return}let i;try{i=Dr(t);}catch{N(n,"MANIFEST_INVALID");return}if(n.bundleIdentity===void 0)n.identity=i.identity;else if(i.identity?.pluginId!==n.bundleIdentity.appId||i.identity.definitionKey!==`${n.bundleIdentity.definitionId}\0${String(n.bundleIdentity.version)}`){N(n,"BUNDLE_INTEGRITY");return}if(ge(i.value)&&i.value.builtinOnly===true){N(n,"RESERVED_ID");return}let o;try{let E=ye(i.value,{mode:"local"});if(E.manifestVersion!==2)throw new $("MANIFEST_INVALID","workspace App requires v2");o=E;}catch(E){if(E instanceof $){N(n,Jt(E));return}if(E instanceof le){N(n,$n(E.code));return}if(ge(E)&&typeof E.code=="string"){N(n,$n(E.code));return}throw E}let r={pluginId:o.pluginId,definitionKey:`${o.definitionId}\0${String(o.version)}`};if(n.bundleIdentity===void 0&&(n.identity=r),o.actions.length>0)try{Ct(o.actions.map(E=>({actionId:E.actionId,inputSchema:E.inputSchema})));}catch(E){if(E instanceof le){N(n,$n(E.code));return}throw E}let s;try{s=await Jn(e,n,"ui/index.html",We);}catch(E){N(n,je(ue(E),"entry"));return}if(s.byteLength>We){N(n,"LIMIT_EXCEEDED");return}let a;try{a=Qt(s);}catch{N(n,"ENTRY_INVALID");return}if(s.byteLength===0||a.length===0){N(n,"ENTRY_INVALID");return}let c=createHash("sha256").update(s).digest("hex");if(o.entryHash!==void 0&&o.entryHash!==c){N(n,"ENTRY_INVALID");return}let p={},u,f;if(o.initialState!==void 0){try{u=await Jn(e,n,"ui/state.json",65536);}catch(E){N(n,je(ue(E),"initial"));return}if(u.byteLength>65536){N(n,"LIMIT_EXCEEDED");return}try{let E=Yn(u),B=o.dataPaths??[],J=Un(E,B);p=ae(J,0,B),he(p);}catch{N(n,"INITIAL_STATE_INVALID");return}if(f=createHash("sha256").update(u).digest("hex"),o.initialState.hash!==void 0&&o.initialState.hash!==f){N(n,"INITIAL_STATE_INVALID");return}}let A={...o,entryHash:c,...o.initialState===void 0?{}:{initialState:{path:"ui/state.json",hash:f}}},m=Rn(A),g=Rr(A,s,u??new Uint8Array),P;try{P=Or(m,g);}catch(E){if(E instanceof $){N(n,Jt(E));return}throw E}let M;if(n.bundleLineage!==void 0){let E=n.bundleLineage[n.bundleLineage.length-1];if(!E){N(n,"LINEAGE_INVALID");return}let{legacy:B,...J}=E.definition,{hash:se,...un}=P;if(X(J)!==X(un)){N(n,"LINEAGE_STALE");return}if(B!==void 0&&(P={...P,legacy:B}),B!==void 0)try{P={...P,hash:pe(P)},de(P);}catch{N(n,"LINEAGE_INVALID");return}M=n.bundleLineage;}if(n.bundleIdentity!==void 0&&n.bundleIdentity.appId!==o.pluginId){N(n,"BUNDLE_INTEGRITY");return}if(n.bundleIdentity!==void 0&&(n.bundleIdentity.definitionId!==P.id||n.bundleIdentity.version!==P.version||n.bundleIdentity.definitionHash!==P.hash)){N(n,"LINEAGE_STALE");return}let L=Ar(o.pluginId),y=o.actions.length===0?{read:L.read}:L,I=be(m),D=be(A),j=be(P),C=be({...m.handlers}),l=Xt(s),T=u===void 0?void 0:Xt(u),z=Object.freeze({...n.provenance===void 0?{}:{provenance:n.provenance},entry:Object.freeze({path:"ui/index.html",hash:c,bytes:l}),...T===void 0?{}:{initialState:Object.freeze({path:"ui/state.json",hash:f,bytes:T})}}),W={appId:o.pluginId,pluginId:o.pluginId,definitionId:o.definitionId,version:o.version,relativePath:n.relativePath,manifest:D,normalized:I,name:o.name,description:o.description,...o.icon===void 0?{}:{icon:o.icon},...o.tone===void 0?{}:{tone:o.tone},definition:j,handlers:C,resources:z,html:a,entryBytes:l,entryHash:c,initialState:be(p),...T===void 0?{}:{initialStateBytes:T},...f===void 0?{}:{initialStateHash:f},sourceHash:g,toolNames:Object.freeze(y)},O=n.provenance===void 0?{...W,source:n.source}:{...W,provenance:n.provenance,lineage:M??[]};n.candidate=Object.freeze(O),kr(o)&&N(n,"EXEC_DENIED");}async function Fr(e,n){try{return await Jn(e,n,"ui-plugin.json",262144)}catch(t){if(ue(t)==="NOT_FOUND")return;N(n,je(ue(t),"manifest"));return}}function Br(e,n,t){let i=Vr(e);vr(i);let o=Object.freeze(i.filter(a=>a.candidate!==void 0&&a.diagnostic===void 0).map(a=>a.candidate)),r=Object.freeze(i.filter(a=>a.diagnostic!==void 0).map(a=>a.diagnostic)),s={apps:o,diagnostics:r,complete:n===void 0,...n===void 0?{}:{incompleteReason:n},...t===void 0?{}:{productBundleIndexHash:t}};return Object.defineProperty(s,"candidates",{configurable:false,enumerable:false,get:()=>o}),Object.freeze(s)}function Hr(e){if(e===null||typeof e!="object"&&typeof e!="function")return false;let n=e;return typeof n.readVerifiedFile=="function"||typeof n.readFileVerified=="function"||typeof n.listDirectory=="function"||typeof n.readDirectory=="function"||typeof n.readdir=="function"}function zr(e,n){if(Hr(e))return {fs:e,options:{}};let t=e??n??{};return {fs:t.filesystem??t.fileSystem??t.fs??Gt,options:t}}async function ni(e,n,t){if(typeof e!="string"||e.length===0)throw new TypeError("workspaceRoot must be explicit");let{fs:i,options:o}=zr(n,t),r=o.clock??Ur,s=r(),a=[],c=0,p,u=await Lr(o.productBundle,i,s,r);a.push(...u.diagnostics.map(m=>({source:m.source,root:o.productBundle?.root??e,name:"",relativePath:m.relativePath,diagnostic:m})));let f=u.packages.map(m=>m.indexEntry);u.incomplete&&(p="time_limit");for(let m of u.packages){let g=m.indexEntry,P=g.packageDir,M=u.indexHash===void 0?void 0:kt(Object.freeze({kind:"bundled",indexHash:u.indexHash,packageDir:P,appId:g.appId,definitionId:g.definition.id,version:g.definition.version,definitionHash:g.definition.hash,files:g.files})),L={source:"bundled",root:o.productBundle?.root??e,name:P.slice(5),relativePath:P,...M===void 0?{}:{provenance:M},...m.files===void 0?{}:{pinnedFiles:m.files},...m.lineage===void 0?{}:{bundleLineage:m.lineage},bundleIdentity:{appId:g.appId,definitionId:g.definition.id,version:g.definition.version,definitionHash:g.definition.hash},identity:Nr(g)};if(a.push(L),c+=1,m.failureCode!==void 0){N(L,m.failureCode);continue}let y=m.files?.get("ui-plugin.json");if(y===void 0){N(L,"BUNDLE_INTEGRITY");continue}await qt(i,L,y),L.candidate!==void 0&&L.diagnostic===void 0&&c<64&&!q(s,r)&&(p="time_limit");}let A=[{source:"apps",directory:"apps"},{source:"skills",directory:"skills"}];for(let m of A){let{source:g,directory:P}=m,M;try{M=await en(i,e,P);}catch(y){if(ue(y)==="NOT_FOUND")continue;a.push({source:g,root:e,name:"",relativePath:g,diagnostic:nn(je(ue(y),"manifest"),g,g)});continue}let L=M.filter(y=>y.kind==="directory"||y.kind==="symlink").filter(y=>Zt(y.name)).map(y=>({source:g,root:e,name:y.name,relativePath:Er(g,y.name)})).sort((y,I)=>Me(y.relativePath,I.relativePath));for(let y of L){let I={...y};a.push(I);let D;if(g==="skills"&&(D=await Fr(i,I),D===void 0))continue;if(c>=64){N(I,"LIMIT_EXCEEDED");continue}if(y.relativePath.split("/").length-1>2){N(I,"LIMIT_EXCEEDED");continue}if(p!==void 0||!q(s,r)){N(I,"LIMIT_EXCEEDED"),p="time_limit";continue}if(c+=1,D===void 0)try{D=await Qe(i,I.root,`${I.relativePath}/ui-plugin.json`,262144);}catch(C){N(I,je(ue(C),"manifest"));continue}await qt(i,I,D),I.diagnostic===void 0&&c<64&&!q(s,r)&&(p="time_limit");}}return jr(a,o,f),Br(a,p,u.indexHash)}var $r=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/;function on(e){let n="screenHash"in e?e.screenHash:void 0,i=("skillHash"in e?e.skillHash:void 0)??(e.relativePath!==void 0&&e.fileBytes!==void 0?Wr(e.relativePath,e.fileBytes):void 0);if(n!==void 0&&i!==void 0){let o=JSON.stringify({screenHash:n,skillHash:i});return createHash("sha256").update(o,"utf8").digest("hex")}if(n!==void 0)return n;if(i!==void 0)return i;throw new TypeError("App definition hash input must contain a screenHash or skill bytes")}function Wr(e,n){let t=new TextEncoder().encode(rn(e)),i=Jr(n),o=new Uint8Array(t.byteLength+1+i.byteLength);return o.set(t,0),o[t.byteLength]=0,o.set(i,t.byteLength+1),createHash("sha256").update(o).digest("hex")}function Jr(e){if(typeof e=="string")return new TextEncoder().encode(e);if(e instanceof Uint8Array)return new Uint8Array(e);if(e instanceof ArrayBuffer)return new Uint8Array(e.slice(0));if(Array.isArray(e)&&e.every(n=>Number.isInteger(n)&&n>=0&&n<=255))return Uint8Array.from(e);throw new TypeError("fileBytes must be UTF-8 text or bytes")}function rn(e){if(typeof e!="string"||e.length===0||isAbsolute(e)||/[\\\u0000]/.test(e))throw new TypeError("relative path must be package-relative");let n=e.split("/").filter(t=>t.length>0&&t!==".").join("/");if(!n||n.split("/").some(t=>t===".."))throw new TypeError("relative path must stay inside the package");return n}function tn(e,n){let t=new TextEncoder().encode(e),i=new TextEncoder().encode(n),o=Math.min(t.byteLength,i.byteLength);for(let r=0;r<o;r+=1){let s=t[r]-i[r];if(s!==0)return s}return t.byteLength-i.byteLength}function oi(e,n){let t=relative(e,n).split(sep).join("/");return !t||t===".."||t.startsWith("../")||isAbsolute(t)?null:rn(t)}function Kr(e){return e==="apps"||e.startsWith("apps/")?"apps":e==="skills"||e.startsWith("skills/")?"skills":e==="node_modules"||e.startsWith("node_modules/")?"node_modules":null}function ri(e){return Object.freeze({packageRoot:e})}function Xr(e){return Object.freeze({id:e.definition.id,version:e.definition.version,hash:e.definition.hash,usage:e.definition.usage??ce,...e.definition.detailPanel===void 0?{}:{detailPanel:e.definition.detailPanel},...e.definition.displayModes===void 0?{}:{displayModes:e.definition.displayModes},...e.definition.summaryProjection===void 0?{}:{summaryProjection:e.definition.summaryProjection}})}function si(e){return {capabilities:Object.freeze([...e]),origin:"local",ownership:"unknown",shareability:"unknown",sharingAvailability:"unavailable"}}function Yr(e,n){let t=e.candidate,i=t.provenance!==void 0,o=n&&!i?["screen","skill"]:["screen"],r=Xr(t),s=on(n?{screenHash:r.hash,skillHash:n.skillHash}:{screenHash:r.hash}),a=t.description||n?.skill.description||"",c=String(t.version),p={appId:t.pluginId,name:t.name,description:a,version:c,...si(o),definition:r,...n===void 0||i?{}:{skillName:n.skill.name},...i?{provenance:t.provenance}:{localDefinitionRef:ri(e.packageRoot)},definitionHash:s};return {...i?{}:{packageRoot:e.packageRoot},source:i?"bundled":t.source,appId:p.appId,capabilities:o,summary:Object.freeze(p)}}function qr(e){let n=Zr(e.skill.name),t={appId:n,name:e.skill.name,description:e.skill.description??"",...e.skill.version===void 0?{}:{version:e.skill.version},...si(["skill"]),skillName:e.skill.name,localDefinitionRef:ri(e.packageRoot),definitionHash:on({skillHash:e.skillHash})};return {packageRoot:e.packageRoot,source:e.source,appId:n,capabilities:["skill"],summary:Object.freeze(t)}}function Zr(e){return `skill.${e.replace(/^@/,"").replace(/\//g,".").replace(/[^A-Za-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,122)||"unnamed"}`}function F(e,n,t,i){return Object.freeze({code:e,source:n,relativePath:Qr(t),...i===void 0?{}:{appId:i}})}function Qr(e){if(typeof e!="string"||e.length===0||isAbsolute(e)||/[\\\u0000]/.test(e))return "<unknown>";let n=e.split("/").filter(t=>t.length>0&&t!==".").join("/");return n.split("/").some(t=>t==="..")?"<unknown>":n}function es(e){return F(e.code,e.source,e.relativePath,e.pluginId)}function ns(e,n){let t=oi(e,n.dir);if(!t)return {diagnostic:F("PATH_ESCAPED","node_modules","node_modules")};let i=Kr(t);if(!i)return {diagnostic:F("PATH_ESCAPED","node_modules",t)};let o=kn(n.skillMdPath);if(!o.readable)return {diagnostic:F("SKILL_READ_FAILED",i,t)};if(!o.valid)return {diagnostic:F("SKILL_INVALID",i,t)};let r=ts(n.dir,n.skillMdPath);if(!r)return {diagnostic:F("PATH_ESCAPED",i,t)};try{let s=new Uint8Array(readFileSync(n.skillMdPath));return {skill:n,packageRoot:t,relativeSkillPath:r,skillHash:on({relativePath:r,fileBytes:s}),source:i}}catch{return {diagnostic:F("SKILL_READ_FAILED",i,t)}}}function ts(e,n){let t=relative(e,n).split(sep).join("/");try{return rn(t)}catch{return null}}function is(e){if(!$r.test(e.appId))return {diagnostic:F("BUILTIN_INVALID","builtin",`builtin/${e.appId||"unknown"}`)};let n=e.definition===void 0?void 0:{id:e.definition.id,version:e.definition.version,hash:e.definition.hash,usage:e.definition.usage??ce,...e.definition.detailPanel===void 0?{}:{detailPanel:e.definition.detailPanel},...e.definition.displayModes===void 0?{}:{displayModes:e.definition.displayModes},...e.definition.summaryProjection===void 0?{}:{summaryProjection:e.definition.summaryProjection}},t=n?.hash??createHash("sha256").update(JSON.stringify({appId:e.appId,name:e.name,description:e.description}),"utf8").digest("hex"),i={appId:e.appId,name:e.name,description:e.description,...n===void 0?{}:{version:String(n.version),definition:n},capabilities:["screen"],origin:"builtin",ownership:"unknown",shareability:"forbidden",sharingAvailability:"unavailable",definitionHash:t};return {source:"builtin",appId:e.appId,summary:Object.freeze(i)}}function os(e){return e.builtinCatalog}function rs(e){let n=e.packageRoot??e.relativePath??e.packageRootPath;if(n===void 0)return null;try{return rn(n)}catch{return null}}function ss(e){let n=e.marketplaceContentId;return typeof n=="string"&&n.length>0?n:void 0}function as(e,n,t){let i=n.installed??[],o=new Map;for(let s of i){let a=rs(s);if(!a){t.push(F("INSTALLED_IDENTITY_MISMATCH","installed","installed"));continue}let c=o.get(a);if(c&&JSON.stringify(c)!==JSON.stringify(s)){t.push(F("INSTALLED_IDENTITY_MISMATCH","installed",a));continue}o.set(a,s);}let r=new Map;for(let s of e)s.packageRoot!==void 0&&r.set(s.packageRoot,s);for(let[s,a]of o){let c=r.get(s);if(!c){t.push(F("INSTALLED_MISSING","installed",s,a.appId));continue}let p=ss(a);if(!p){t.push(F("INSTALLED_CONTENT_ID_MISSING","installed",s,a.appId));continue}if(a.appId!==void 0&&a.appId!==c.appId||a.definitionHash!==void 0&&a.definitionHash!==c.summary.definitionHash){t.push(F("INSTALLED_IDENTITY_MISMATCH","installed",s,a.appId));continue}let u={...c.summary,origin:"installed",...a.slug===void 0?{}:{slug:a.slug},marketplaceContentId:p},f=e.indexOf(c);f>=0&&(e[f]={...c,summary:Object.freeze(u)});}}function cs(e,n){let t=new Map;for(let o of e){let r=t.get(o.appId)??[];r.push(o),t.set(o.appId,r);}let i=new Set;for(let o of t.values()){if(o.length<2)continue;let r=o.some(s=>s.source==="builtin")?"builtin":o.some(s=>s.source==="bundled")?"bundled":void 0;if(r!==void 0){let s=o.filter(a=>a.source===r);for(let a of o.filter(c=>c.source!==r))i.add(a),n.push(F("RESERVED_ID",a.source,Zn(a),a.appId));if(s.length>1)for(let a of s)i.add(a),n.push(F("DUPLICATE_ID",a.source,Zn(a),a.appId));continue}for(let s of o)i.add(s),n.push(F("DUPLICATE_ID",s.source,Zn(s),s.appId));}return e.filter(o=>!i.has(o))}function Zn(e){return e.packageRoot??e.summary.provenance?.packageDir??`builtin/${e.appId}`}function ps(e,n){return e.filter(t=>!(t.code==="MANIFEST_MISSING"&&n.has(t.relativePath))).map(es)}function ds(e){return e.filesystem}function ls(e,n){let t=ds(e);return {...t===void 0?{}:{filesystem:t},...e.productBundle===void 0?{}:{productBundle:e.productBundle},...n===void 0?{}:{builtinCatalog:n}}}async function ai(e,n={}){if(typeof e!="string"||e.length===0)throw new TypeError("workspaceRoot must be explicit");let t=os(n),i=await ni(e,ls(n,t)),o=[join(e,"skills"),join(e,"node_modules"),join(e,"apps")],r=[],s=[],a=[],c=new Set;for(let y of o)for(let I of St([y])){let D=oi(e,I.dir);(D===null||!c.has(D))&&(a.push(I),D!==null&&c.add(D));}for(let y of a){let I=ns(e,y);"diagnostic"in I?r.push(I.diagnostic):s.push(I);}let p=new Map;for(let y of i.apps??i.candidates??[]){let I=y.provenance===void 0?`workspace\0${y.relativePath}`:`bundled\0${y.provenance.indexHash}\0${y.provenance.packageDir}`;p.set(I,{candidate:y,packageRoot:y.relativePath});}let u=new Map(s.map(y=>[y.packageRoot,y])),f=[];for(let y of p.values()){let I=y.candidate.provenance===void 0?u.get(y.packageRoot):void 0,D=Yr(y,I);f.push({...D.packageRoot===void 0?{}:{packageRoot:D.packageRoot},source:D.source,appId:D.appId,summary:D.summary});}let A=new Set([...p.values()].filter(y=>y.candidate.provenance===void 0).map(y=>y.packageRoot));for(let y of s){if(A.has(y.packageRoot))continue;let I=qr(y);f.push({packageRoot:I.packageRoot,source:I.source,appId:I.appId,summary:I.summary});}let m=[...ps(i.diagnostics,new Set(s.map(y=>y.packageRoot))),...r],g=[];if(t)for(let y of t.listMcpApps()){let I=is(y);"diagnostic"in I?m.push(I.diagnostic):g.push(I);}let P=cs([...f,...g],m);as(P,n,m);let M=P.map(y=>y.summary).sort((y,I)=>tn(y.appId,I.appId)),L=[...m].sort((y,I)=>tn(y.relativePath,I.relativePath)||tn(y.code,I.code)||tn(y.appId??"",I.appId??""));return Object.freeze({items:Object.freeze(M),diagnostics:Object.freeze(L)})}function us(e){let n=o=>o.replace(/[.+^${}()|[\]\\]/g,"\\$&"),i=e.split("/").map(o=>o==="**"?".*":o.split("*").map(n).join("[^/]*"));return new RegExp(`^${i.join("\\/")}$`)}function Se(e,n){try{return us(n).test(e)}catch{return false}}function sn(e,...n){let t=e.split("/");if(t.length<n.length)return false;let i=t.length-n.length;return n.every((o,r)=>Se(t[i+r],o))}function fs(e,n){return e.split("/").some(t=>Se(t,n))}var ci=[{label:".env*",test:e=>Se(e,".env*")},{label:".git/",test:(e,n,t)=>t&&e===".git"},{label:"memory/",test:(e,n,t)=>t&&e==="memory"},{label:"*.key",test:e=>Se(e,"*.key")},{label:"*.pem",test:e=>Se(e,"*.pem")},{label:"auth.json",test:e=>e==="auth.json"},{label:"node_modules/",test:(e,n,t)=>t&&e==="node_modules"},{label:"conversations/",test:(e,n,t)=>t&&e==="conversations"},{label:".crewx/threads/",test:(e,n,t)=>t&&sn(n,".crewx","threads")},{label:".crewx/crewx.db",test:(e,n,t)=>!t&&sn(n,".crewx","crewx.db")},{label:".crewx/*.log",test:(e,n,t)=>!t&&sn(n,".crewx","*.log")},{label:".crewx/publish/",test:(e,n,t)=>t&&sn(n,".crewx","publish")},{label:".crewx/",test:(e,n)=>fs(n,".crewx")}];function an(e,n,t){for(let i of ci)if(i.test(e,n,t))return i.label;return null}function nt(e){let n=[],t=[];function i(o,r,s){let a;try{a=v.readdirSync(o,{withFileTypes:!0});}catch{return}a.sort((c,p)=>c.name.localeCompare(p.name));for(let c of a){let p=r?`${r}/${c.name}`:c.name,u=H.join(o,c.name);if(c.isSymbolicLink()){let f;try{f=v.statSync(u);}catch{t.push({path:p,rule:"symlink"});continue}if(f.isDirectory()){t.push({path:p,rule:s??"symlink-dir"});continue}let A=s??an(c.name,p,false);A?t.push({path:p,rule:A}):t.push({path:p,rule:"symlink"});continue}if(c.isDirectory()){let f=s??an(c.name,p,true);i(u,p,f);continue}if(c.isFile()){let f=s??an(c.name,p,false);f?t.push({path:p,rule:f}):n.push(p);}}}return i(e,"",null),n.sort(),t.sort((o,r)=>o.path<r.path?-1:o.path>r.path?1:0),{included:n,excluded:t}}var ys=[{rule:"token-prefix",regex:/\b(?:sk-|ghp_|xoxb-)[A-Za-z0-9_-]{10,}/},{rule:"private-key",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----/},{rule:"aws-access-key",regex:/\bAKIA[0-9A-Z]{16}\b/}];function As(e){return e.includes(0)}function tt(e,n,t){let i=[];for(let o of n){let r=H.join(e,o),s;try{let c=t?.get(o);s=c===void 0?v.readFileSync(r):Buffer.from(c);}catch{continue}if(As(s))continue;s.toString("utf8").split(/\r\n|\r|\n/).forEach((c,p)=>{for(let{rule:u,regex:f}of ys)f.test(c)&&i.push({path:o,line:p+1,rule:u});});}return i}var ie=class extends Error{constructor(t,i){super(`publish: [${t}]${i?` ${i}`:""}`);this.code=t;}code;name="PublishError"};function h(e,n){return new ie(e,n)}var ui=/^[a-z0-9-]+$/,gs=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,Is=/^[A-Za-z_][A-Za-z0-9_]*$/;function ms(e){let n=H.join(e,"crewx.yaml");if(!v.existsSync(n))return {};let t;try{t=fi.load(v.readFileSync(n,"utf8"));}catch{return {}}if(!t||typeof t!="object")return {};let i=t.metadata;if(!i||typeof i!="object")return {};let o=i;return {name:typeof o.name=="string"?o.name:void 0,version:typeof o.version=="string"?o.version:void 0,description:typeof o.description=="string"?o.description:void 0,requiredEnv:o.requiredEnv,crewxMinVersion:typeof o.crewxMinVersion=="string"?o.crewxMinVersion:void 0}}function hs(e){return it.createHash("sha256").update(e).digest("hex")}function yi(e){let n;try{n=v.lstatSync(e);}catch{throw h("PACKAGE_FILE_INVALID",`file is not readable: ${H.basename(e)}`)}if(n.isSymbolicLink())throw h("PACKAGE_SYMLINK","symlink content is not publishable");if(!n.isFile())throw h("PACKAGE_FILE_INVALID","only regular files are publishable");return it.createHash("sha256").update(new Uint8Array(v.readFileSync(e))).digest("hex")}function Es(e,n){let t=new TextEncoder().encode(e),i=new TextEncoder().encode(n),o=Math.min(t.byteLength,i.byteLength);for(let r=0;r<o;r+=1){let s=t[r]-i[r];if(s!==0)return s}return t.byteLength-i.byteLength}function Ai(e){if(typeof e!="string"||e.length===0||e.includes("\\")||e.includes("\0")||H.posix.isAbsolute(e)||e.split("/").some(n=>n===".."||n.length===0))throw h("PACKAGE_PATH_TRAVERSAL","manifest file path must be a non-empty POSIX relative path")}function _s(e){if(!/^(?:apps|skills)\/[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(e))throw h("APP_PACKAGE_ROOT_INVALID","packageRoot must be apps/<safe-id> or skills/<safe-id>")}function gi(e){if(!gs.test(e))throw new Error(`publish: invalid version "${e}" \u2014 must be semver (e.g. 1.0.0)`)}function Ii(e,n,t={}){let i=ms(e),o=i.name??H.basename(e);if(!ui.test(o))throw new Error(`publish: invalid name "${o}" \u2014 must match ${ui} (lowercase letters, numbers, hyphen only)`);let r=t.version??i.version;if(!r)throw new Error("publish: version is required \u2014 set crewx.yaml metadata.version or pass opts.version");gi(r);let s=Array.isArray(i.requiredEnv)?i.requiredEnv:[],a=[];for(let u of s){if(typeof u!="string"||!Is.test(u))throw new Error(`publish: requiredEnv must contain names only (no values), got "${String(u)}"`);a.push(u);}let c=n.map(u=>(Ai(u),{path:u,sha256:yi(H.join(e,u))})).sort((u,f)=>u.path<f.path?-1:u.path>f.path?1:0),p={name:o,version:r,type:"template",description:i.description??"",files:c,requiredEnv:a};return i.crewxMinVersion&&(p.crewxMinVersion=i.crewxMinVersion),p}function Ts(e){let n=e.toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-+/g,"-").replace(/^-+|-+$/g,"");if(!n)throw h("APP_PACKAGE_ROOT_INVALID","appId cannot produce a marketplace name");return n}function mi(e,n){if(_s(n.packageRoot),!n.version)throw new Error("publish: version is required for App publishing \u2014 pass opts.version");if(gi(n.version),typeof n.description!="string")throw new Error("publish: App description must be a string");let t=[...new Set(n.capabilities)].sort();if(t.length===0||t.some(s=>s!=="screen"&&s!=="skill"))throw new Error("publish: App capabilities must contain screen or skill");let i=`${n.packageRoot}/`;if(t.includes("screen")){if(typeof n.definitionId!="string"||n.definitionId.length===0)throw h("APP_UI_MANIFEST_INVALID","screen App manifests require definitionId");for(let s of ["ui-plugin.json","ui/index.html"])if(!n.includedFiles.includes(`${i}${s}`))throw h("APP_UI_MANIFEST_INVALID",`screen App is missing ${s}`)}if(t.includes("skill")&&!n.includedFiles.includes(`${i}SKILL.md`))throw h("APP_SKILL_MISSING","skill capability requires package-root SKILL.md");let o=new Set,r=n.includedFiles.map(s=>{if(Ai(s),!s.startsWith(i))throw h("PACKAGE_PATH_TRAVERSAL","App manifest file is outside packageRoot");let a=n.generatedFiles?.get(s);return a!==void 0&&o.add(s),{path:s,sha256:a===void 0?yi(H.join(e,s)):hs(a),...a===void 0?{}:{generated:true}}}).sort((s,a)=>Es(s.path,a.path));if(o.size>0&&(o.size!==1||!o.has(`${i}ui-plugin.json`)))throw new Error("publish: only the generated ui-plugin.json may be present in an App package");return {manifestVersion:1,name:Ts(n.appId),version:n.version,type:"app",description:n.description,appId:n.appId,...n.definitionId===void 0?{}:{definitionId:n.definitionId},...n.definitionHash===void 0?{}:{definitionHash:n.definitionHash},capabilities:t,packageRoot:n.packageRoot,files:r,requiredEnv:[]}}function hi(e){return it.createHash("sha256").update(e).digest("hex")}function Di(e,n){if(typeof n!="string"||n.length===0||n.includes("\\")||n.includes("\0")||H.posix.isAbsolute(n)||n.split("/").some(o=>o===".."||o.length===0))throw h("PACKAGE_PATH_TRAVERSAL","archive paths must be non-empty POSIX relative paths");let t=H.resolve(e),i=H.resolve(t,...n.split("/"));if(i!==t&&!i.startsWith(`${t}${H.sep}`))throw h("PACKAGE_PATH_TRAVERSAL","archive path escaped its root");return i}function Ei(e,n){let t=Di(e,n),i;try{i=v.lstatSync(t);}catch{throw h("PACKAGE_FILE_INVALID","manifest file is missing")}if(i.isSymbolicLink())throw h("PACKAGE_SYMLINK","symlink content is not publishable");if(!i.isFile())throw h("PACKAGE_FILE_INVALID","only regular files are publishable");return new Uint8Array(v.readFileSync(t))}async function bi(e,n,t={}){let i=H.join(e,".crewx","publish");v.mkdirSync(i,{recursive:true});let o=H.join(i,`${n.name}-${n.version}.tgz`),r=H.join(i,`.${n.name}-${n.version}.${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}.tmp.tgz`),s=v.mkdtempSync(H.join(_i.tmpdir(),"crewx-publish-"));try{let a=new Set,c=[];for(let p of n.files){if(a.has(p.path))throw h("PACKAGE_PATH_TRAVERSAL","manifest contains duplicate file paths");a.add(p.path);let u=t.generatedFiles?.get(p.path);if(p.generated===!0&&u===void 0)throw h("PACKAGE_GENERATED_FILE_MISSING","generated manifest file bytes are missing");if(t.sourceFileHashes?.has(p.path)){let m=Ei(e,p.path);if(t.sourceFileHashes.get(p.path)!==hi(m))throw h("PACKAGE_STAGED_BYTES_MISMATCH","workspace source changed before staging")}let f=u??Ei(e,p.path);if(hi(f)!==p.sha256)throw h("PACKAGE_STAGED_BYTES_MISMATCH",`staged bytes differ for ${p.path}`);let A=Di(s,p.path);v.mkdirSync(H.dirname(A),{recursive:!0}),v.writeFileSync(A,new Uint8Array(f)),c.push(p.path);}v.writeFileSync(H.join(s,"manifest.json"),JSON.stringify(n,null,2)),await Pi.create({gzip:!0,file:r,cwd:s,portable:!0,noMtime:!0},["manifest.json",...c]),v.renameSync(r,o);}finally{try{v.rmSync(r,{force:!0});}catch{}v.rmSync(s,{recursive:true,force:true});}return o}var Le="/api/v1";var bs=201,Ns=200,Ms=409,ot=401,Ni={APP_NAME_CONFLICT:"APP_NAME_CONFLICT",CONTENT_SUSPENDED:"PUBLISH_CONTENT_SUSPENDED",CONTENT_REJECTED:"CONTENT_REJECTED",APP_VERSION_MUST_INCREASE:"APP_VERSION_MUST_INCREASE",APP_VERSION_INVALID:"APP_VERSION_INVALID"};function Ss(){return process.env.WI013_FAKE_UPLOAD==="1"}function Ls(e){let n=gunzipSync(new Uint8Array(e)),t=gzipSync(new Uint8Array(n),{level:1});if(Buffer.compare(new Uint8Array(t),new Uint8Array(e))===0)throw new Error("publish: [E_MALFORMED] Re-gzipped upload bytes are identical to the original \u2014 tamper is a no-op");return t}function Us(e){return e.replace(/\/+$/,"")}async function Ve(e){try{return await e.json()}catch{return null}}function Mi(e,n,t){let i=e;if(!i||i.success!==true||i.data===void 0)throw new Error(`publish: [E_MALFORMED] ${n} response envelope is malformed (expected { success: true, data }) \u2014 HTTP ${t}`);return i.data}function Rs(e){if(!e||typeof e!="object"||Array.isArray(e))return;let n=e;if(typeof n.contentId=="string"&&n.contentId.length>0)return n.contentId;if(!n.data||typeof n.data!="object"||Array.isArray(n.data))return;let t=n.data;return typeof t.contentId=="string"&&t.contentId.length>0?t.contentId:void 0}function Os(e){if(!e||typeof e!="object"||Array.isArray(e))return;let n=e;if(typeof n.slug=="string"&&n.slug.length>0)return n.slug;if(!n.data||typeof n.data!="object"||Array.isArray(n.data))return;let t=n.data;return typeof t.slug=="string"&&t.slug.length>0?t.slug:void 0}function Si(e,n){if(!e||typeof e!="object"||Array.isArray(e))return;let t=e,i=t.data&&typeof t.data=="object"&&!Array.isArray(t.data)?t.data:void 0,o=[t.code,t.message,i?.code,i?.message];for(let r of o){if(typeof r!="string"||!Object.prototype.hasOwnProperty.call(Ni,r))continue;let s=r,a=s==="APP_NAME_CONFLICT"?`marketplace name is already in use: ${n}`:void 0;return h(Ni[s],a)}}async function ks(e){if(!e.baseUrl.trim())throw new Error("publish: [E_ENV_MISSING] Marketplace base URL is required");if(!e.accessToken.trim())throw new Error("publish: [E_AUTH_EXPIRED] A valid bearer token is required");let n=Us(e.baseUrl),t=e.accessPolicy??"private",i=e.manifest.name,o=e.manifest.type==="app"?e.manifest:void 0,r=o!==void 0,s=o?.appId,a;try{a=await fetch(`${n}${Le}/publisher/items`,{method:"POST",headers:{Authorization:`Bearer ${e.accessToken}`,"Content-Type":"application/json"},body:JSON.stringify({slug:i,displayName:i,description:e.manifest.description,type:e.manifest.type,version:e.manifest.version,accessPolicy:t,...s===void 0?{}:{appId:s}})});}catch{throw new Error("publish: [E_NETWORK] Submit request failed (network)")}let c=await Ve(a),p=Rs(c),u=Os(c),f=r&&u!==void 0?u:i,A;if(a.status===bs)A="created";else if(r&&a.status===Ns){if(p===void 0)throw h("PUBLISH_CONTENT_ID_MISSING","App republish did not return an opaque contentId");A="existing";}else if(a.status===Ms){if(r)throw Si(c,i)??h("APP_NAME_CONFLICT",`marketplace name is already in use: ${i}`);A="existing";}else throw a.status===ot?new Error("publish: [E_AUTH_EXPIRED] Authentication is expired or missing \u2014 please log in again (HTTP 401)"):new Error(`publish: [E_HTTP] Submit request failed \u2014 HTTP ${a.status}`);let m="not-needed",g=null;if(A==="existing"&&!r){let l;try{l=await fetch(`${n}${Le}/publisher/items`,{method:"GET",headers:{Authorization:`Bearer ${e.accessToken}`}});}catch{throw new Error("publish: [E_NETWORK] Publisher items request failed (network)")}let T=await Ve(l);if(l.status!==200)throw new Error(`publish: [E_HTTP] Publisher items request failed \u2014 HTTP ${l.status}`);let W=Mi(T,"publisher items",l.status)?.items;if(!Array.isArray(W))throw new Error(`publish: [E_MALFORMED] Publisher items response is malformed (expected data.items[]) \u2014 HTTP ${l.status}`);let O=W.find(E=>!E||typeof E!="object"?false:E.slug===i);if(!O||typeof O.version!="string")throw new Error(`publish: [E_MALFORMED] Publisher items response does not contain slug "${i}" \u2014 HTTP ${l.status}`);if(g=O.version,g!==e.manifest.version){let E;try{E=await fetch(`${n}${Le}/publisher/items/${encodeURIComponent(i)}`,{method:"PUT",headers:{Authorization:`Bearer ${e.accessToken}`,"Content-Type":"application/json"},body:JSON.stringify({version:e.manifest.version})});}catch{throw new Error("publish: [E_NETWORK] Version update request failed (network)")}if(!E.ok)throw await Ve(E),E.status===ot?new Error(`publish: [E_AUTH_EXPIRED] Authentication is expired or missing \u2014 please log in again (HTTP ${E.status})`):E.status===403?new Error(`publish: [E_FORBIDDEN] Version update is forbidden; only the item owner can update an existing item (HTTP ${E.status})`):new Error(`publish: [E_HTTP] Version update failed \u2014 HTTP ${E.status}`);m="applied";}}let P=v.readFileSync(e.tgzPath),M=Ss()?Ls(P):P,L=new FormData;L.set("archive",new Blob([new Uint8Array(M)],{type:"application/gzip"}),`${f}-${e.manifest.version}.tgz`);let y=r&&p!==void 0?p:i,I;try{I=await fetch(`${n}${Le}/publisher/items/${encodeURIComponent(y)}/upload`,{method:"POST",headers:{Authorization:`Bearer ${e.accessToken}`},body:L});}catch{throw new Error("publish: [E_NETWORK] Upload request failed (network)")}if(I.status===ot)throw new Error("publish: [E_AUTH_EXPIRED] Authentication is expired or missing \u2014 please log in again (HTTP 401)");if(!I.ok){let l=await Ve(I);if(r){let T=Si(l,f);if(T)throw T}throw new Error(`publish: [E_HTTP] Upload request failed \u2014 HTTP ${I.status}`)}let D=await Ve(I),j=Mi(D,"upload",I.status),C=typeof j.contentId=="string"&&j.contentId.length>0?j.contentId:p;if(r&&C===void 0)throw h("PUBLISH_CONTENT_ID_MISSING","App upload did not return an opaque contentId");return {slug:f,version:e.manifest.version,...C===void 0?{}:{contentId:C},artifactChecksum:j.artifactChecksum,artifactSizeBytes:j.artifactSizeBytes,submitOutcome:A,versionUpdate:m,serverVersionBefore:g}}var xs=1e4,ws=100*1024*1024;function rt(e){return it.createHash("sha256").update(e).digest("hex")}function Cs(e){if(e===null||typeof e!="object"||Array.isArray(e))return false;let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}function pn(e,n){if(!n||n.includes("\\")||n.includes("\0")||H.posix.isAbsolute(n)||n.split("/").some(r=>r===".."||r.length===0))throw h("PACKAGE_PATH_TRAVERSAL","workspace file path is not a safe relative path");let t=H.resolve(e,...n.split("/")),i=H.resolve(e);if(t!==i&&!t.startsWith(`${i}${H.sep}`))throw h("PACKAGE_PATH_TRAVERSAL","workspace file path escaped the workspace root");let o;try{o=v.lstatSync(t);}catch{throw h("PACKAGE_FILE_INVALID",`workspace file is missing: ${n}`)}if(o.isSymbolicLink())throw h("PACKAGE_SYMLINK",`symlink is not publishable: ${n}`);if(!o.isFile())throw h("PACKAGE_FILE_INVALID",`not a regular file: ${n}`);return new Uint8Array(v.readFileSync(t))}function dn(e,n){return e===n||e.startsWith(`${n}/`)}function vs(e,n){return e.path<n.path?-1:e.path>n.path?1:e.rule.localeCompare(n.rule)}function Ui(e,n,t){let i=e??n;if(!Number.isSafeInteger(i)||i<=0)throw new ie("PACKAGE_SIZE_LIMIT",`${t} must be a positive integer`);return i}function Oi(e,n,t,i){let o=Ui(t.maxFileCount??t.maxFiles,xs,"max file count"),r=Ui(t.maxTotalBytes??t.maxBytes,ws,"max total bytes");if(n.length>o)throw new ie("PACKAGE_SIZE_LIMIT",`package exceeds file count limit (${o})`);let s=0;for(let a of n){let c=i?.get(a);if(c!==void 0?s+=c.byteLength:s+=pn(e,a).byteLength,s>r)throw new ie("PACKAGE_SIZE_LIMIT",`package exceeds byte limit (${r})`)}}function js(e){return e.appId!==void 0||e.expectedDefinitionHash!==void 0}function Vs(e){let n=e.appId!==void 0,t=e.expectedDefinitionHash!==void 0;if(!n&&t)throw h("APP_ID_REQUIRED","appId is required with expectedDefinitionHash");if(n&&!t)throw h("APP_DEFINITION_HASH_REQUIRED","expectedDefinitionHash is required with appId");if(!n||!t)throw h("APP_ID_REQUIRED")}function Fs(e,n){let t=e.filter(i=>i.appId===n);if(t.length===0)throw h("APP_NOT_FOUND",`no publishable App matches ${n}`);if(t.length!==1)throw h("APP_AMBIGUOUS",`more than one App matches ${n}`);return t[0]}function Bs(e){let n=e.localDefinitionRef?.packageRoot;if(!n||!/^(?:apps|skills)\/[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(n))throw h("APP_PACKAGE_ROOT_INVALID","selected App is not rooted in apps/<safe-id> or skills/<safe-id>");return n}function Hs(e,n){let t=[];for(let i of e.excluded)t.push(dn(i.path,n)?i:{path:i.path,rule:"out-of-app-scope"});for(let i of e.included)dn(i,n)||t.push({path:i,rule:"out-of-app-scope"});return t.sort(vs)}function zs(e,n,t,i){let o=`${t}/ui-plugin.json`;if(!i.includes(o))throw h("APP_UI_MANIFEST_INVALID","selected screen App has no package ui-plugin.json");let r=pn(e,o),s=rt(r),a;try{a=JSON.parse(Buffer.from(r).toString("utf8"));}catch{throw h("APP_UI_MANIFEST_INVALID","ui-plugin.json is not valid JSON")}let c;try{let A=ye(a,{mode:"local"});if(A.manifestVersion!==2)throw new Error("screen App requires manifestVersion 2");c=A;}catch(A){throw A instanceof $?h("APP_UI_MANIFEST_INVALID",A.code):h("APP_UI_MANIFEST_INVALID")}if(c.pluginId!==n.appId)throw h("APP_DEFINITION_CONFLICT","ui-plugin.json pluginId no longer matches the selected App");let p=`${t}/ui/index.html`;if(!i.includes(p))throw h("APP_UI_MANIFEST_INVALID","screen entry is outside package scope");let u=rt(pn(e,p)),f=JSON.parse(JSON.stringify(a));if(f.entryHash=u,Object.prototype.hasOwnProperty.call(f,"initialState")){let A=f.initialState;if(!Cs(A)||A.path!=="ui/state.json")throw h("APP_INITIAL_STATE_OUT_OF_SCOPE","initialState must reference ui/state.json inside the package");let m=`${t}/ui/state.json`;if(!i.includes(m))throw h("APP_INITIAL_STATE_OUT_OF_SCOPE","initialState reference is outside the selected package");let g=pn(e,m);f.initialState={...A,hash:rt(g)};}try{let A=ye(f,{mode:"published"});return {bytes:new Uint8Array(Buffer.from(gn(A),"utf8")),sourceHash:s}}catch(A){throw A instanceof $?h("APP_UI_MANIFEST_INVALID",A.code):h("APP_UI_MANIFEST_INVALID")}}async function Gs(e,n){let{included:t,excluded:i}=nt(e);Oi(e,t,n);let o=Ii(e,t,{version:n.version}),r=tt(e,t);return {plan:{manifest:o,included:t,excluded:i,secretFindings:r},archiveOptions:{}}}async function $s(e,n){Vs(n);let t=await ai(e),i=Fs(t.items,n.appId);if(i.definitionHash!==n.expectedDefinitionHash)throw h("APP_DEFINITION_CONFLICT",`definitionHash changed for ${n.appId}`);let o=Bs(i),r=nt(e);if(r.excluded.some(m=>dn(m.path,o)&&(m.rule==="symlink"||m.rule==="symlink-dir")))throw h("PACKAGE_SYMLINK","selected App package contains a symlink");let s=r.included.filter(m=>dn(m,o)),a=Hs(r,o),c=new Map,p=new Map;if(i.capabilities.includes("screen")){let m=zs(e,i,o,s);c.set(`${o}/ui-plugin.json`,m.bytes),p.set(`${o}/ui-plugin.json`,m.sourceHash);}if(i.capabilities.includes("skill")&&!s.includes(`${o}/SKILL.md`))throw h("APP_SKILL_MISSING","skill capability requires package-root SKILL.md");Oi(e,s,n,c);let u={appId:i.appId,version:n.version??"",description:i.description,capabilities:i.capabilities,packageRoot:o,...i.definition?.id===void 0?{}:{definitionId:i.definition.id},definitionHash:i.definitionHash,includedFiles:s,generatedFiles:c},f=mi(e,u),A=tt(e,s,c);return {plan:{manifest:f,included:s,excluded:a,secretFindings:A},archiveOptions:{generatedFiles:c,sourceFileHashes:p}}}async function ki(e,n){let t=H.resolve(e);if(js(n))return $s(t,n);if(n.expectedDefinitionHash!==void 0)throw h("APP_ID_REQUIRED");return Gs(t,n)}async function hp(e,n={}){return (await ki(e,n)).plan}function Ws(e){let n=e.map(t=>`${t.path}:${t.line} (${t.rule})`).join(", ");throw new ie("PUBLISH_SECRET_FINDINGS",`aborted \u2014 secret findings must be resolved before packing: ${n}`)}async function xi(e,n={}){let t=H.resolve(e),i=await ki(t,n);i.plan.secretFindings.length>0&&Ws(i.plan.secretFindings);let o=await bi(t,i.plan.manifest,i.archiveOptions);return {manifest:i.plan.manifest,tgzPath:o}}async function Ep(e,n={}){return xi(e,n)}async function _p(e,n){let t=await xi(e,n);if(t.manifest.type!=="app")throw new Error("publish: App pack unexpectedly produced a template manifest");return t}
2
+ export{ws as DEFAULT_PUBLISH_MAX_BYTES,xs as DEFAULT_PUBLISH_MAX_FILES,ci as EXCLUDE_RULES,Le as MARKETPLACE_API_PREFIX,ie as PublishError,_p as packApp,xi as packPublish,Ep as packTemplate,hp as planPublish,ks as uploadToMarketplace};