@crewx/sdk 0.9.0-rc.127 → 0.9.0-rc.129

package/dist/repository/thread.repository.d.ts

@@ -12,6 +12,24 @@ export interface ThreadCreationOptions {
     createdById?: string | null;
     createdByTaskId?: string | null;
 }
+export interface CreateAppLaunchThreadInput {
+    threadId: string;
+    workspaceId: string;
+    platform: string;
+    title: string;
+    appId: string;
+    createdById: string | null;
+    initialAgentId?: string;
+}
+export type CreateAppLaunchThreadResult = {
+    status: 'created';
+    thread: ThreadRow;
+} | {
+    status: 'existing';
+    thread: ThreadRow;
+} | {
+    status: 'conflict';
+};
 export type ThreadOriginFilter = 'direct' | 'delegated' | 'all';
 type ThreadOriginScope = Exclude<ThreadOriginFilter, 'all'>;
 export interface ThreadTitleMetadataPatch {
@@ -48,6 +66,7 @@ export declare class ThreadRepository extends BaseSqliteRepository {
     explainFindAllThreadsPlan(workspaceId?: string, createdByKind?: ThreadActorKind): string[];
     findThreadsByIdsOrTitles(ids: string[], workspaceId?: string): ThreadRow[];
     findThreadById(threadId: string, workspaceId?: string): ThreadRow | undefined;
+    createAppLaunchThread(input: CreateAppLaunchThreadInput): CreateAppLaunchThreadResult;
     threadExists(threadId: string, workspaceId?: string): boolean;
     aggregateTaskStats(threadId: string, workspaceId?: string): {
         taskCount: number;

package/dist/skills/index.d.ts

@@ -1,8 +1,15 @@
+import type { ProductAppBundleInput, WorkspaceAppDiagnostic } from '../mcp-app/discovery.js';
 import type { SkillDefinition, SkillFrontmatterReadResult } from './types.js';
 export declare function findEntrypoint(dir: string, skillName: string): string | undefined;
 export declare function readSkillFrontmatter(filePath: string): SkillFrontmatterReadResult;
 export declare function discover(searchDirs: readonly string[]): SkillDefinition[];
 export declare function resolve(name: string, searchDirs: readonly string[]): SkillDefinition;
+export interface BundledSkillDiscoveryResult {
+    readonly skills: readonly SkillDefinition[];
+    readonly diagnostics: readonly WorkspaceAppDiagnostic[];
+}
+export declare function discoverBundledProductSkills(productBundle: ProductAppBundleInput | undefined): Promise<BundledSkillDiscoveryResult>;
 export declare const discoverSkills: typeof discover;
 export declare const resolveSkill: typeof resolve;
+export type { ProductAppBundleInput } from '../mcp-app/discovery.js';
 export type { SkillDefinition, SkillFrontmatter, SkillFrontmatterReadResult } from './types.js';

package/dist/skills/index.js

@@ -1 +1,2 @@
-'use strict';var fs=require('fs'),path=require('path'),jsYaml=require('js-yaml');var d="SKILL.md",v=/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;function m(t){if(t===null||typeof t!="object"||Array.isArray(t))return  false;let e=Object.getPrototypeOf(t);return e===Object.prototype||e===null}function D(t){return t.isDirectory()||t.isSymbolicLink()}function k(t){try{return fs.existsSync(t)&&fs.statSync(t).isDirectory()}catch{return  false}}var F=["index.js","main.js"];function N(t,e){let i=path.join(t,"package.json");if(fs.existsSync(i))try{let n=JSON.parse(fs.readFileSync(i,"utf8"));if(n.bin){let o=typeof n.bin=="string"?n.bin:Object.values(n.bin).find(s=>typeof s=="string");if(o){let s=path.resolve(t,o);if(fs.existsSync(s))return s}}if(typeof n.main=="string"){let o=path.resolve(t,n.main);if(fs.existsSync(o))return o}}catch{}let r=path.resolve(t,`${e}.js`);if(fs.existsSync(r))return r;for(let n of F){let o=path.resolve(t,n);if(fs.existsSync(o))return o}}function R(t){let e;try{e=fs.readFileSync(t,"utf8");}catch{return {frontmatter:{},readable:false,valid:false,hasFrontmatter:false}}let i=e.match(v);if(!i)return {frontmatter:{},readable:true,valid:true,hasFrontmatter:false};try{let r=jsYaml.load(i[1]??"");if(!m(r))return {frontmatter:{},readable:!0,valid:!1,hasFrontmatter:!0};let n=m(r.metadata)?r.metadata:void 0;return {frontmatter:{...typeof r.name=="string"?{name:r.name}:{},...typeof(n?.version??r.version)=="string"?{version:n?.version??r.version}:{},...typeof r.description=="string"?{description:r.description}:{}},readable:!0,valid:!0,hasFrontmatter:!0}}catch{return {frontmatter:{},readable:true,valid:false,hasFrontmatter:true}}}function j(t){return [path.join(t,d),path.join(t,"skill",d)]}function f(t,e){if(!k(t))return null;for(let i of j(t)){if(!fs.existsSync(i))continue;let n=R(i).frontmatter;return {name:n.name??e,...n.version===void 0?{}:{version:n.version},...n.description===void 0?{}:{description:n.description},skillMdPath:i,dir:t}}return null}function u(t){try{return fs.readdirSync(t,{withFileTypes:!0}).filter(D)}catch{return []}}function w(t){return t.length===0||/[\\\u0000]/.test(t)?false:t.split("/").every(e=>e.length>0&&e!=="."&&e!=="..")}function y(t,e,i){!t||e.has(t.name)||(e.add(t.name),i.push(t));}function g(t){let e=[],i=new Set;for(let r of t)if(k(r))for(let n of u(r)){if(n.name.startsWith("@")){let o=path.join(r,n.name);for(let s of u(o))y(f(path.join(o,s.name),s.name),i,e);continue}y(f(path.join(r,n.name),n.name),i,e);}return e.sort((r,n)=>r.name.localeCompare(n.name))}function x(t,e){if(!w(t))throw new Error(`Skill not found: ${t}`);for(let r of e){let n=f(path.join(r,t),t);if(n)return n;for(let o of u(r)){if(!o.name.startsWith("@"))continue;let s=f(path.join(r,o.name,t),t);if(s)return s}}let i=g(e).find(r=>r.name===t);if(i)return i;throw new Error(`Skill not found: ${t}`)}var O=g,P=x;exports.discover=g;exports.discoverSkills=O;exports.findEntrypoint=N;exports.readSkillFrontmatter=R;exports.resolve=x;exports.resolveSkill=P;
+'use strict';var crypto=require('crypto'),fs=require('fs'),promises=require('fs/promises'),path=require('path'),jsYaml=require('js-yaml');var fi=Object.defineProperty;var O=(e,n)=>()=>(e&&(n=e(e=0)),n);var yi=(e,n)=>{for(var t in n)fi(e,t,{get:n[t],enumerable:true});};var I=O(()=>{});var _,cn=O(()=>{I();_=class extends Error{constructor(t,i=t,o){super(i);this.code=t;this.currentRevision=o;}code;currentRevision;name="UiRuntimeError"};});function H(){throw new _("INPUT_INVALID","JSON value is not projection-safe")}function Ti(e){let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}function dn(e,n,t,i,o,r){if(n>i&&H(),e===null||typeof e=="string"||typeof e=="boolean")return typeof e=="string"&&(gi.test(e)||hi.test(e)&&!Ei(o,r)||mi.test(e))&&H(),e;if(typeof e=="number")return Number.isFinite(e)||H(),e;(typeof e!="object"||e===void 0||typeof e=="function"||typeof e=="bigint")&&H();let s=e;t.has(s)&&H(),t.add(s);try{if(Array.isArray(e))return e.map(p=>dn(p,n+1,t,i,o,r));Ti(s)||H();let a={};for(let[p,d]of Object.entries(e))(Ai.test(p)||Ii.test(p))&&H(),a[p]=dn(d,n+1,t,i,[...o,p],r);return a}finally{t.delete(s);}}function ee(e,n=0,t=[]){(!Number.isInteger(n)||n<0||n>Di)&&H(),(!Array.isArray(t)||t.some(o=>typeof o!="string"))&&H();let i=dn(e,0,new Set,_i+n,[],t);return (i===null||Array.isArray(i)||typeof i!="object")&&H(),i}function Ie(e,n){if(!e||!n)return  false;let t=e.split("."),i=n.split(".");return t.length>=i.length&&i.every((o,r)=>t[r]===o)}function Ei(e,n){if(e.length===0)return  false;let t=e.join(".");return n.some(i=>Ie(t,i))}function ge(e){try{let n=JSON.stringify(e);return n===void 0&&H(),n}catch{H();}}function pn(e){return Array.isArray(e)?e.map(pn):e!==null&&typeof e=="object"?Object.fromEntries(Object.keys(e).sort().map(n=>[n,pn(e[n])])):e}function G(e){return ge(pn(e))}function ln(e){return Buffer.byteLength(e,"utf8")}var Ai,Ii,gi,mi,hi,_i,Di,ce=O(()=>{I();cn();Ai=/(?:proof|token|secret|password|cookie|authorization|private[_-]?key|stack|exception|plugin[_-]?text)/i,Ii=/(?:url|uri|endpoint|path|file(?:name|path)?|cwd|shell|directory|dir|folder)$/i,gi=/<\/?[A-Za-z][^>]*>/,mi=/^(?:[A-Za-z]:[\\/]|\\\\|~[\\/]|\/)/,hi=/^(?:https?|file|ftp|ws|wss):\/\//i;_i=8,Di=4;});function me(e){return Ni.has(e)||bi.test(e)||Pi.test(e)}var et,Ni,bi,Pi,Fe,Oe,ne,un,fn,yn,An,In,he=O(()=>{I();et=["__proto__","prototype","constructor","proof","token","secret","password","cookie","authorization","private_key","private-key","stack","exception","plugin_text","url","uri","endpoint","path","filename","filepath","cwd","shell","directory","dir","folder"],Ni=new Set(et),bi=/(?:proof|token|secret|password|cookie|authorization|private[_-]?key|stack|exception|plugin[_-]?text)/i,Pi=/(?:url|uri|endpoint|path|file(?:name|path)?|cwd|shell|directory|dir|folder)$/i;Fe=/^[A-Za-z0-9_]+$/,Oe=/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*$/,ne=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/,un=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/,fn=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/,yn=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/,An=["blue","violet","emerald","amber","rose","sky","slate","indigo"],In=["inline","panel"];});function gn(e){return typeof e=="string"&&nt.includes(e)}var nt,tt=O(()=>{I();he();nt=["text/plain","application/json"];});function Be(e){if(!mn(e))return  false;let n=Object.keys(e);return !(n.some(t=>t!=="in"&&t!=="out")||n.length===0||Object.hasOwn(e,"in")&&!Mi(e.in)||Object.hasOwn(e,"out")&&!Li(e.out))}function Mi(e){return mn(e)?Object.keys(e).every(t=>t==="mediaType"||t==="required")&&Object.hasOwn(e,"mediaType")&&gn(e.mediaType)&&(!Object.hasOwn(e,"required")||typeof e.required=="boolean"):false}function Li(e){return mn(e)?Object.keys(e).every(t=>t==="mediaType"||t==="range")&&Object.hasOwn(e,"mediaType")&&gn(e.mediaType)&&(!Object.hasOwn(e,"range")||typeof e.range=="boolean"):false}function mn(e){if(e===null||typeof e!="object"||Array.isArray(e))return  false;let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}var hn=O(()=>{I();tt();new TextDecoder("utf-8",{fatal:true,ignoreBOM:true});});function te(e){let t=e.renderer!==void 0||e.surfaces!==void 0||e.stateProjection!==void 0||e.dataPaths!==void 0||e.usage!==void 0||e.detailPanel!==void 0||e.displayModes!==void 0||e.summaryProjection!==void 0||e.legacy!==void 0||Object.values(e.actions).some(o=>o.resultProjection!==void 0)?{id:e.id,version:e.version,...e.renderer===void 0?{}:{renderer:e.renderer},...e.surfaces===void 0?{}:{surfaces:e.surfaces},...e.stateProjection===void 0?{}:{stateProjection:e.stateProjection},...e.dataPaths===void 0?{}:{dataPaths:e.dataPaths},...e.summaryProjection===void 0?{}:{summaryProjection:e.summaryProjection},...e.legacy===void 0?{}:{legacy:e.legacy},...e.usage===void 0?{}:{usage:e.usage},...e.detailPanel===void 0?{}:{detailPanel:e.detailPanel},...e.displayModes===void 0?{}:{displayModes:e.displayModes},...e.sourceHash===void 0?{}:{sourceHash:e.sourceHash},actions:e.actions}:e.sourceHash===void 0?{id:e.id,version:e.version,actions:e.actions}:{id:e.id,version:e.version,sourceHash:e.sourceHash,actions:e.actions},i=ee(t);return crypto.createHash("sha256").update(G(i)).digest("hex")}function ie(e){if(!/^\d+$/.test(String(e.version))||e.version<1||e.id.length<1||e.id.length>128)throw new _("DEFINITION_UNSUPPORTED","UI definition is invalid");if(e.sourceHash!==void 0&&(typeof e.sourceHash!="string"||!Si.test(e.sourceHash)))throw new _("DEFINITION_UNSUPPORTED","UI definition source hash is invalid");if(!/^[0-9a-f]{64}$/.test(e.hash)||te(e)!==e.hash)throw new _("DEFINITION_UNSUPPORTED","UI definition hash is invalid");for(let[n,t]of Object.entries(e.actions)){if(!n||!Array.isArray(t.capabilities)||t.capabilities.some(i=>!Ri(i)))throw new _("DEFINITION_UNSUPPORTED","UI action declaration is invalid");if(t.confirmation!==void 0&&t.confirmation!=="none"&&t.confirmation!=="native")throw new _("DEFINITION_UNSUPPORTED","UI action confirmation is invalid");if(t.inputKeys&&(!Array.isArray(t.inputKeys)||t.inputKeys.some(i=>typeof i!="string"||!i)))throw new _("DEFINITION_UNSUPPORTED","UI action input declaration is invalid");if(t.dataInputs!==void 0&&(!Array.isArray(t.dataInputs)||new Set(t.dataInputs).size!==t.dataInputs.length||t.dataInputs.some(i=>typeof i!="string"||!i||t.inputKeys!==void 0&&!t.inputKeys.includes(i))))throw new _("DEFINITION_UNSUPPORTED","UI action data input declaration is invalid");if(t.resultProjection&&Tn(t.resultProjection),t.content!==void 0&&!Be(t.content))throw new _("DEFINITION_UNSUPPORTED","UI action content declaration is invalid");if(t.env!==void 0&&(!Array.isArray(t.env)||t.env.length===0||new Set(t.env).size!==t.env.length||t.env.some(i=>i!=="CREWX_APP_INSTANCE_ID"&&i!=="CREWX_THREAD_ID")))throw new _("DEFINITION_UNSUPPORTED","UI action environment declaration is invalid")}if(e.renderer!==void 0&&(!e.renderer||e.renderer.length>128))throw new _("DEFINITION_UNSUPPORTED","UI definition renderer is invalid");if(e.surfaces&&(!Array.isArray(e.surfaces)||e.surfaces.some(n=>!n||n.length>64)))throw new _("DEFINITION_UNSUPPORTED","UI definition surfaces are invalid");if(e.usage!==void 0&&e.usage!=="card"&&e.usage!=="window")throw new _("DEFINITION_UNSUPPORTED","UI definition usage is invalid");if(e.detailPanel!==void 0&&typeof e.detailPanel!="boolean")throw new _("DEFINITION_UNSUPPORTED","UI definition detailPanel is invalid");if(e.displayModes&&(!Array.isArray(e.displayModes)||e.displayModes.length===0||new Set(e.displayModes).size!==e.displayModes.length||e.displayModes.some(n=>n!=="inline"&&n!=="floating"&&n!=="focused")))throw new _("DEFINITION_UNSUPPORTED","UI definition displayModes are invalid");if(e.usage==="card"&&e.displayModes!==void 0)throw new _("DEFINITION_UNSUPPORTED","Card definitions cannot declare displayModes");if(e.usage==="window"&&e.detailPanel!==void 0)throw new _("DEFINITION_UNSUPPORTED","Window definitions cannot declare detailPanel");if(e.stateProjection&&Tn(e.stateProjection),e.summaryProjection){Tn(e.summaryProjection);let n=new Set(e.stateProjection?.allow??[]);if(e.summaryProjection.allow.some(t=>!n.has(t)))throw new _("DEFINITION_UNSUPPORTED","UI summary projection exceeds state projection")}if(e.legacy!==void 0){if(!e.legacy||typeof e.legacy!="object"||Array.isArray(e.legacy)||Object.keys(e.legacy).some(o=>!["readTool","actionTool","hostTools","agentAccess"].includes(o)))throw new _("DEFINITION_UNSUPPORTED","UI legacy metadata is invalid");let n=new Set;for(let[o,r]of [["readTool",e.legacy.readTool],["actionTool",e.legacy.actionTool]])if(r!==void 0){if(Ui(r,o==="readTool"),n.has(r.name))throw new _("DEFINITION_UNSUPPORTED","UI legacy tool names collide");n.add(r.name);}let t=e.legacy.hostTools;if(t!==void 0){if(!t||typeof t!="object"||Array.isArray(t))throw new _("DEFINITION_UNSUPPORTED","UI legacy host tools are invalid");let o={"doc.open":"crewx_app_html_viewer_open","pty.connect":"crewx_app_terminal_connect"};for(let[r,s]of Object.entries(t)){if(!Object.hasOwn(o,r)||o[r]!==s||typeof s!="string"||!/^[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(s)||n.has(s))throw new _("DEFINITION_UNSUPPORTED","UI legacy host tools are invalid");n.add(s);}}let i=e.legacy.agentAccess;if(i!==void 0&&(!i||typeof i!="object"||Array.isArray(i)||Object.entries(i).some(([o,r])=>!o||!Object.hasOwn(e.actions,o)||r!=="allowed"&&r!=="denied")))throw new _("DEFINITION_UNSUPPORTED","UI legacy agent access is invalid");if(e.legacy.actionTool!==void 0&&(!i||Object.keys(i).length===0))throw new _("DEFINITION_UNSUPPORTED","UI legacy action tool requires its complete agent access map")}if(e.dataPaths!==void 0){let n=new Set(["__proto__","prototype","constructor"]);if(!Array.isArray(e.dataPaths)||e.dataPaths.length>16||new Set(e.dataPaths).size!==e.dataPaths.length||e.dataPaths.some(t=>typeof t!="string"||!/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*$/.test(t)||t.split(".").some(i=>n.has(i))||!(e.stateProjection?.allow??[]).some(i=>Ie(t,i))))throw new _("DEFINITION_UNSUPPORTED","UI definition dataPaths are invalid")}}function Ui(e,n){if(!e||typeof e!="object"||Array.isArray(e))throw new _("DEFINITION_UNSUPPORTED","UI legacy tool metadata is invalid");let t=e,i=["name","description","inputSchema","textFallback","visibility"],o=Object.hasOwn(t,"fixedResult");if(Object.keys(t).some(r=>!i.includes(r)&&!(n&&r==="fixedResult"))||i.some(r=>!Object.hasOwn(t,r))||typeof t.name!="string"||!/^[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(t.name)||typeof t.description!="string"||t.description.trim().length===0||t.description.length>8192||typeof t.textFallback!="string"||t.textFallback.trim().length===0||t.textFallback.length>16384||!t.inputSchema||typeof t.inputSchema!="object"||Array.isArray(t.inputSchema)||!Array.isArray(t.visibility)||t.visibility.length===0||t.visibility.some(r=>r!=="model"&&r!=="app")||new Set(t.visibility).size!==t.visibility.length)throw new _("DEFINITION_UNSUPPORTED","UI legacy tool metadata is invalid");try{let r=ee(t.inputSchema);if(r.type!==void 0&&r.type!=="object")throw new Error("schema type");if(o){if(!n)throw new Error("fixed result location");let s=t.fixedResult;if(!s||typeof s!="object"||Array.isArray(s))throw new Error("fixed result");let a=s;if(Object.keys(a).sort().join(",")!=="argsPolicy,structuredContent"||a.argsPolicy!=="empty-only"&&a.argsPolicy!=="ignore"||!a.structuredContent||typeof a.structuredContent!="object"||Array.isArray(a.structuredContent))throw new Error("fixed result");let p=ee(a.structuredContent);if(ln(ge(p))>4*1024)throw new Error("fixed result size")}}catch{throw new _("DEFINITION_UNSUPPORTED","UI legacy tool metadata is not projection-safe")}}function Tn(e){if(!Array.isArray(e.allow)||e.allow.some(n=>!/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*$/.test(n)))throw new _("DEFINITION_UNSUPPORTED","UI projection policy is invalid")}function Ri(e){return e.length>0&&e.length<=128&&e!=="*"&&e!=="all"&&!/[/*]/.test(e)}var Si,Te=O(()=>{I();ce();cn();hn();Si=/^[0-9a-f]{64}$/;});var it=O(()=>{I();ce();});var Se,ot=O(()=>{I();Se="window";});function c(e,n=e){throw new K(e,n)}function R(e){if(e===null||typeof e!="object"||Array.isArray(e))return  false;try{let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}catch{return  false}}function D(e,n){return Object.prototype.hasOwnProperty.call(e,n)}function C(e,n,t=[]){let i=new Set([...n,...t]);Object.keys(e).some(o=>!i.has(o))&&c("MANIFEST_INVALID"),n.some(o=>!D(e,o))&&c("MANIFEST_INVALID");}function We(e,n=false,t=false,i=false){return xi.test(e)||!i&&ji.test(e)||vi.test(e)||t&&rt.test(e)||Vi.test(e)&&!(n&&/^\s*data:/i.test(e)&&!rt.test(e))}function Ge(e,n=new Set,t=0,i=false,o=false){if(typeof e=="string"){We(e,i,o)&&c("UNSAFE_VALUE");return}if(!(e===null||typeof e!="object")){(t>8||n.has(e))&&c("MANIFEST_INVALID"),n.add(e);try{if(Array.isArray(e)){for(let r of e)Ge(r,n,t+1);return}R(e)||c("MANIFEST_INVALID");for(let[r,s]of Object.entries(e))Ge(s,n,t+1,i&&t===0&&(r==="name"||r==="description"),o);}finally{n.delete(e);}}}function Y(e,n){let t=e[n];return typeof t!="string"&&c("MANIFEST_INVALID"),t}function J(e,n,t){let i=e[n];return (!Number.isSafeInteger(i)||i<t)&&c("MANIFEST_INVALID"),i}function _n(e){return wi.test(e)||c("MANIFEST_INVALID"),e}function _e(e){return Ci.test(e)||c("TOKEN_INVALID"),e}function ro(e){return yt.test(e)||c("MANIFEST_INVALID"),e}function so(e){R(e)||c("MANIFEST_INVALID");let n={};for(let[t,i]of Object.entries(e)){let o=ro(t);R(i)||c("MANIFEST_INVALID");let r=i.type;if(r==="text"){C(i,["type","maxLength"]),n[o]={type:r,maxLength:J(i,"maxLength",1)};continue}if(r==="text-list"){C(i,["type","max","itemMaxLength"]),n[o]={type:r,max:J(i,"max",0),itemMaxLength:J(i,"itemMaxLength",1)};continue}if(r==="step-list"){C(i,["type","min","max","labelMaxLength","detailMaxLength"]);let s=J(i,"min",0),a=J(i,"max",1);s>a&&c("MANIFEST_INVALID"),n[o]={type:r,min:s,max:a,labelMaxLength:J(i,"labelMaxLength",1),detailMaxLength:J(i,"detailMaxLength",1)};continue}typeof r=="string"&&c("SCHEMA_TYPE_UNSUPPORTED"),c("MANIFEST_INVALID");}return n}function ao(e,n,t){let i=e[n];(!i||i.type!==t)&&c("MANIFEST_INVALID");}function He(e,n,t){let i=Y(e,"field");return yt.test(i)||c("MANIFEST_INVALID"),ao(n,i,t),i}function co(e,n){R(e)||c("MANIFEST_INVALID");let t=e.primitive;switch(typeof t!="string"&&c("MANIFEST_INVALID"),oo.includes(t)||c("PRIMITIVE_UNKNOWN"),t){case "card-shell":return C(e,["primitive"]),{primitive:t};case "meta-banner":return C(e,["primitive","badgeToken","noticeToken"]),{primitive:t,badgeToken:_e(Y(e,"badgeToken")),noticeToken:_e(Y(e,"noticeToken"))};case "heading":return C(e,["primitive","field"]),{primitive:t,field:He(e,n,"text")};case "labeled-text":return C(e,["primitive","titleToken","field","variant"]),e.variant!=="callout"&&c("MANIFEST_INVALID"),{primitive:t,titleToken:_e(Y(e,"titleToken")),field:He(e,n,"text"),variant:"callout"};case "step-flow":return C(e,["primitive","titleToken","field"]),{primitive:t,titleToken:_e(Y(e,"titleToken")),field:He(e,n,"step-list")};case "text-list":{C(e,["primitive","titleToken","field"],["emptyToken","hideWhenEmpty"]);let i={primitive:t,titleToken:_e(Y(e,"titleToken")),field:He(e,n,"text-list")};return D(e,"emptyToken")&&(i.emptyToken=_e(Y(e,"emptyToken"))),D(e,"hideWhenEmpty")&&(typeof e.hideWhenEmpty!="boolean"&&c("MANIFEST_INVALID"),i.hideWhenEmpty=e.hideWhenEmpty),i}}return c("MANIFEST_INVALID")}function po(e,n){return Array.isArray(e)||c("MANIFEST_INVALID"),e.map(t=>co(t,n))}function w(e="v2 manifest exceeds a contract limit"){return c("LIMIT_EXCEEDED",e)}function z(e="initial state is not projection-safe"){return c("INITIAL_STATE_INVALID",e)}function st(e,n){return (typeof e!="string"||e.length===0||e.length>4096||e.trim().length===0||no.test(e)||to.test(e))&&c("MANIFEST_INVALID",`${n} is invalid`),(We(e,true,true)||Fi.test(e)||Bi.test(e)||Hi.test(e))&&c("UNSAFE_VALUE",`${n} contains an unsafe value`),e}function Dn(e,n){return (typeof e!="string"||!ne.test(e))&&c("MANIFEST_INVALID",`${n} is invalid`),e}function lo(e){return (typeof e!="string"||!un.test(e)||e==="*"||e==="all")&&c("MANIFEST_INVALID","action capability is invalid"),e}function At(e){return (typeof e!="string"||!eo.test(e))&&c("MANIFEST_INVALID","resource hash is invalid"),e}function En(e,n=new Set,t=0){if(typeof e=="string"){e.length>4096&&w("v2 manifest string is too long");return}if(!(e===null||typeof e=="boolean")){if(typeof e=="number"){Number.isFinite(e)||c("MANIFEST_INVALID","v2 manifest contains a non-finite number");return}(e===void 0||typeof e=="function"||typeof e=="bigint")&&c("MANIFEST_INVALID","v2 manifest contains a non-JSON value"),typeof e!="object"&&c("MANIFEST_INVALID"),t>8&&w("v2 manifest nesting is too deep"),n.has(e)&&c("MANIFEST_INVALID","v2 manifest contains a cycle"),n.add(e);try{if(Array.isArray(e)){e.length>128&&w("v2 manifest array is too long");for(let i of e)En(i,n,t+1);return}R(e)||c("MANIFEST_INVALID","v2 manifest contains a non-plain object");for(let i of Object.values(e))En(i,n,t+1);}finally{n.delete(e);}}}function It(e){return (typeof e!="string"||e.length>4096||!Oe.test(e))&&(typeof e=="string"&&e.length>4096&&w("projection path is too long"),c("MANIFEST_INVALID","projection paths must be canonical exact paths")),e.split(".").some(t=>me(t))&&c("MANIFEST_INVALID","projection paths cannot address reserved state keys"),e}function Nn(e){R(e)||c("MANIFEST_INVALID","projection policy must be an object"),C(e,["allow"]),Array.isArray(e.allow)||c("MANIFEST_INVALID","projection allow must be an array"),e.allow.length>128&&w("projection allowlist is too long");let n=[],t=new Set;for(let i of e.allow){let o=It(i);t.has(o)&&c("MANIFEST_INVALID","projection allowlist contains a duplicate path"),t.add(o),n.push(o);}return {allow:n}}function uo(e,n){if(e===void 0)return;Array.isArray(e)||c("MANIFEST_INVALID","dataPaths must be an array"),e.length>io&&w("dataPaths exceed the v2 limit");let t=[],i=new Set;for(let o of e){let r=It(o);i.has(r)&&c("MANIFEST_INVALID","dataPaths contain a duplicate path"),n.some(s=>Ie(r,s))||c("MANIFEST_INVALID","dataPaths must be projection-allowed"),i.add(r),t.push(r);}return t}function De(e,n,t=Number.MAX_SAFE_INTEGER){return (!Number.isSafeInteger(e)||e<0||e>t)&&c("MANIFEST_INVALID",`${n} is invalid`),e}function at(e,n){return (typeof e!="number"||!Number.isFinite(e))&&c("MANIFEST_INVALID",`${n} is invalid`),e}function bn(e,n=0,t=new Set){if(typeof e=="string")return (e.length>4096||We(e))&&c("UNSAFE_VALUE","schema enum contains an unsafe string"),e;if(e===null||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)||c("MANIFEST_INVALID","schema enum contains a non-finite number"),e;(n>8||typeof e!="object"||e===void 0)&&w("schema enum is too deep"),t.has(e)&&c("MANIFEST_INVALID","schema enum contains a cycle"),t.add(e);try{if(Array.isArray(e))return e.length>128&&w("schema enum array is too long"),e.map(o=>bn(o,n+1,t));R(e)||c("MANIFEST_INVALID","schema enum contains a non-plain object");let i={};for(let[o,r]of Object.entries(e))me(o)&&c("MANIFEST_INVALID","schema enum contains a reserved key"),i[o]=bn(r,n+1,t);return i}finally{t.delete(e);}}function fo(e,n){if(e===void 0)return;Array.isArray(e)||c("MANIFEST_INVALID","schema required must be an array"),e.length>64&&w("schema required list is too long");let t=[],i=new Set;for(let o of e)(typeof o!="string"||!Oe.test(o))&&c("MANIFEST_INVALID","schema required contains an invalid key"),o.length>4096&&w("schema required key is too long"),i.has(o)&&c("MANIFEST_INVALID","schema required contains a duplicate key"),n&&!Object.prototype.hasOwnProperty.call(n,o)&&c("MANIFEST_INVALID","schema required references an undeclared property"),i.add(o),t.push(o);return t}function yo(e,n){let t=n?Oe:Fe;return e.length>4096&&w("schema property name is too long"),(!t.test(e)||e.split(".").some(i=>me(i)))&&c("MANIFEST_INVALID","schema property name is invalid"),e}function Pn(e,n=0,t=false){R(e)||c("MANIFEST_INVALID","action inputSchema must be an object"),n>8&&w("action inputSchema is too deep");let i=e.type;i!=="object"&&i!=="string"&&i!=="number"&&i!=="integer"&&i!=="boolean"&&i!=="array"&&i!=="null"&&(typeof i=="string"&&c("SCHEMA_TYPE_UNSUPPORTED","action inputSchema type is unsupported"),c("MANIFEST_INVALID","action inputSchema type is required"));let o=["type","enum"];i==="string"&&o.push("minLength","maxLength"),i==="array"&&o.push("minItems","maxItems","items"),i==="object"&&o.push("minProperties","maxProperties","properties","required","additionalProperties"),(i==="number"||i==="integer")&&o.push("minimum","maximum"),C(e,["type"],o.filter(a=>a!=="type"));let r={type:i};if(D(e,"enum")&&(Array.isArray(e.enum)||c("MANIFEST_INVALID","schema enum must be an array"),e.enum.length>128&&w("schema enum is too long"),r.enum=e.enum.map(a=>bn(a))),i==="string"&&(D(e,"minLength")&&(r.minLength=De(e.minLength,"schema minLength",4096)),D(e,"maxLength")&&(r.maxLength=De(e.maxLength,"schema maxLength",4096)),r.minLength!==void 0&&r.maxLength!==void 0&&r.minLength>r.maxLength&&c("MANIFEST_INVALID","schema string length bounds are inverted")),(i==="number"||i==="integer")&&(D(e,"minimum")&&(r.minimum=at(e.minimum,"schema minimum")),D(e,"maximum")&&(r.maximum=at(e.maximum,"schema maximum")),r.minimum!==void 0&&r.maximum!==void 0&&r.minimum>r.maximum&&c("MANIFEST_INVALID","schema numeric bounds are inverted")),i==="array"&&(D(e,"minItems")&&(r.minItems=De(e.minItems,"schema minItems",128)),D(e,"maxItems")&&(r.maxItems=De(e.maxItems,"schema maxItems",128)),r.minItems!==void 0&&r.maxItems!==void 0&&r.minItems>r.maxItems&&c("MANIFEST_INVALID","schema array length bounds are inverted"),D(e,"items")&&(r.items=Pn(e.items,n+1,false))),i==="object"){let a;if(D(e,"properties")){R(e.properties)||c("MANIFEST_INVALID","schema properties must be an object");let d=Object.entries(e.properties);d.length>64&&w("schema properties are too many"),a={};for(let[u,y]of d){let b=yo(u,t);a[b]=Pn(y,n+1,false);}r.properties=a;}D(e,"minProperties")&&(r.minProperties=De(e.minProperties,"schema minProperties",64)),D(e,"maxProperties")&&(r.maxProperties=De(e.maxProperties,"schema maxProperties",64)),r.minProperties!==void 0&&r.maxProperties!==void 0&&r.minProperties>r.maxProperties&&c("MANIFEST_INVALID","schema object property bounds are inverted");let p=fo(e.required,a);p!==void 0&&(r.required=p),D(e,"additionalProperties")&&(e.additionalProperties!==false&&c("MANIFEST_INVALID","schema additionalProperties must be false"),r.additionalProperties=false);}let s=JSON.stringify(r);return (s===void 0||Buffer.byteLength(s,"utf8")>65536)&&w("action inputSchema subtree is too large"),r}function Ao(e){let n=Pn(e,0,true);return (n.type!=="object"||!n.properties)&&c("MANIFEST_INVALID","action inputSchema must declare object properties"),n}function Io(e){if(R(e)||c("MANIFEST_INVALID","action backend must be an object"),e.type==="core"){C(e,Yi);let n=e.handler;return (typeof n!="string"||!fn.test(n))&&c("MANIFEST_INVALID","core backend handler is invalid"),{type:"core",handler:n}}if(e.type==="skill"){C(e,Ki,qi),(!Array.isArray(e.command)||e.command.length===0||e.command.length>16)&&c("MANIFEST_INVALID","skill backend command is invalid");let n=[];for(let i of e.command)(typeof i!="string"||i.length===0||i.length>256||!yn.test(i))&&c("MANIFEST_INVALID","skill backend command token is invalid"),n.push(i);let t=D(e,"env")?mo(e.env):void 0;return {type:"skill",command:n,...t===void 0?{}:{env:t}}}c("MANIFEST_INVALID","action backend type is unsupported");}function go(e){R(e)||c("MANIFEST_INVALID","action must be an object"),C(e,Wi,$i),D(e,"_meta")&&gt(e._meta);let n=Dn(e.actionId,"actionId"),t=lo(e.capability),i=e.mutation;typeof i!="boolean"&&c("MANIFEST_INVALID","action mutation must be boolean");let o=Ao(e.inputSchema),r;if(D(e,"dataInputs")){Array.isArray(e.dataInputs)||c("MANIFEST_INVALID","action dataInputs must be an array");let u=o.properties,y=new Set,b=[];for(let g of e.dataInputs)(typeof g!="string"||!D(u,g)||y.has(g))&&c("MANIFEST_INVALID","action dataInputs must be unique declared properties"),y.add(g),b.push(g);r=b;}let s=Nn(e.resultProjection),a=Io(e.backend),p;D(e,"content")&&((a.type!=="skill"||!Be(e.content))&&c("MANIFEST_INVALID","action content declaration is invalid"),p=ho(e.content));let d;if(D(e,"confirmation")){let u=e.confirmation;u!=="none"&&u!=="native"&&c("MANIFEST_INVALID","action confirmation is invalid"),d=u;}return {actionId:n,capability:t,mutation:i,inputSchema:o,resultProjection:s,backend:a,...p===void 0?{}:{content:p},...r===void 0?{}:{dataInputs:r},...d===void 0?{}:{confirmation:d}}}function mo(e){(!Array.isArray(e)||e.length===0)&&c("MANIFEST_INVALID","skill backend env is invalid");let n=new Set,t=[];for(let i of e)(i!=="CREWX_APP_INSTANCE_ID"&&i!=="CREWX_THREAD_ID"||n.has(i))&&c("MANIFEST_INVALID","skill backend env is invalid"),n.add(i),t.push(i);return Object.freeze(t)}function ho(e){return Object.freeze({...e.in===void 0?{}:{in:Object.freeze({...e.in})},...e.out===void 0?{}:{out:Object.freeze({...e.out})}})}function To(e){return R(e)||c("INITIAL_STATE_INVALID","initialState must be an object"),C(e,Zi,Qi),e.path!=="ui/state.json"&&c("MANIFEST_INVALID","initialState path is not fixed"),D(e,"hash")?{path:"ui/state.json",hash:At(e.hash)}:{path:"ui/state.json"}}function _o(e){return (!R(e)||Object.keys(e).length!==1||!D(e,"wasm")||e.wasm!==true)&&c("MANIFEST_INVALID",'runtime must be exactly { "wasm": true }'),{wasm:true}}function Do(e,n){Ge(e,new Set,0,true,true),En(e),R(e)||c("MANIFEST_INVALID"),C(e,Gi,Ji),D(e,"_meta")&&gt(e._meta),e.manifestVersion!==2&&c("MANIFEST_INVALID");let t;D(e,"runtime")&&(t=_o(e.runtime));let i=Dn(e.pluginId,"pluginId"),o=Dn(e.definitionId,"definitionId"),r=J(e,"version",1),s=st(e.name,"name"),a=st(e.description,"description"),p;D(e,"icon")&&((typeof e.icon!="string"||!/^[a-z][a-z0-9-]{0,63}$/.test(e.icon))&&c("MANIFEST_INVALID","icon is invalid"),p=e.icon);let d;D(e,"tone")&&((typeof e.tone!="string"||!An.includes(e.tone))&&c("MANIFEST_INVALID","tone is invalid"),d=e.tone),e.entry!=="ui/index.html"&&c("MANIFEST_INVALID","entry path is not fixed");let u;D(e,"entryHash")&&(u=At(e.entryHash));let y;D(e,"initialState")&&(y=To(e.initialState));let b;D(e,"usage")&&(e.usage!=="card"&&e.usage!=="window"&&c("MANIFEST_INVALID","usage is invalid"),b=e.usage);let g;D(e,"detailPanel")&&(typeof e.detailPanel!="boolean"&&c("MANIFEST_INVALID","detailPanel is invalid"),g=e.detailPanel);let f;if(D(e,"displayModes")){((b??Se)!==Se||!Array.isArray(e.displayModes)||e.displayModes.length===0)&&c("MANIFEST_INVALID","displayModes are only valid for window Apps");let M=new Set(["inline","floating","focused"]);(new Set(e.displayModes).size!==e.displayModes.length||e.displayModes.some(l=>typeof l!="string"||!M.has(l)))&&c("MANIFEST_INVALID","displayModes are invalid"),f=e.displayModes;}(b??Se)===Se&&g!==void 0&&c("MANIFEST_INVALID","detailPanel is card-only");let T=n.mode??"local";T!=="local"&&T!=="installed"&&T!=="published"&&c("MANIFEST_INVALID","manifest mode is invalid"),T!=="local"&&u===void 0&&c("MANIFEST_INVALID","installed manifests require entryHash"),T!=="local"&&y!==void 0&&y.hash===void 0&&c("MANIFEST_INVALID","installed manifests require initialState.hash"),(!Array.isArray(e.surfaces)||e.surfaces.length===0)&&c("MANIFEST_INVALID","surfaces are invalid"),e.surfaces.length>2&&w("surfaces exceed the v2 limit");let k=[],v=new Set;for(let M of e.surfaces)(typeof M!="string"||!In.includes(M))&&c("MANIFEST_INVALID","surface is unsupported"),v.has(M)&&c("MANIFEST_INVALID","surfaces contain a duplicate"),v.add(M),k.push(M);R(e.size)||c("MANIFEST_INVALID","size must be an object"),C(e.size,["height"]);let m=J(e.size,"height",1);m>720&&w("size.height exceeds the v2 limit");let N=Nn(e.stateProjection),S=e.summaryProjection===void 0?void 0:Nn(e.summaryProjection);S!==void 0&&S.allow.some(M=>!N.allow.includes(M))&&c("MANIFEST_INVALID","summaryProjection must be a subset of stateProjection.allow");let B=uo(e.dataPaths,N.allow);Array.isArray(e.actions)||c("MANIFEST_INVALID","actions must be an array"),e.actions.length>32&&w("actions exceed the v2 limit");let x=[],$=new Set;for(let M of e.actions){let l=go(M);if($.has(l.actionId)&&c("MANIFEST_INVALID","actions contain a duplicate actionId"),l.backend.type==="core"&&l.backend.handler==="state.set"){l.mutation||c("MANIFEST_INVALID","state.set actions must be mutations");for(let P of Object.keys(l.inputSchema.properties))N.allow.includes(P)||c("MANIFEST_INVALID","state.set input paths must be projection-allowed");}$.add(l.actionId),x.push(l);}return {manifestVersion:2,pluginId:i,definitionId:o,version:r,name:s,description:a,...p===void 0?{}:{icon:p},...d===void 0?{}:{tone:d},entry:"ui/index.html",...u===void 0?{}:{entryHash:u},...t===void 0?{}:{runtime:t},...y===void 0?{}:{initialState:y},...b===void 0?{}:{usage:b},...g===void 0?{}:{detailPanel:g},...f===void 0?{}:{displayModes:f},surfaces:k,size:{height:m},stateProjection:N,...S===void 0?{}:{summaryProjection:S},...B===void 0?{}:{dataPaths:B},actions:x}}function gt(e){R(e)||c("MANIFEST_INVALID","_meta must be an object");let n=JSON.stringify(e);(n===void 0||Buffer.byteLength(n,"utf8")>Xi)&&w("_meta exceeds the 4 KiB limit");}function Eo(e){let n={},t={};for(let r of e.actions){n[r.actionId]={capabilities:[r.capability],inputKeys:Object.keys(r.inputSchema.properties??{}),...r.dataInputs===void 0?{}:{dataInputs:r.dataInputs},resultProjection:r.resultProjection,...r.confirmation===void 0?{}:{confirmation:r.confirmation},...r.content===void 0?{}:{content:r.content},...r.backend.type!=="skill"||r.backend.env===void 0?{}:{env:r.backend.env}};let s=r.backend.type==="skill"||r.backend.type==="core"&&r.backend.handler==="state.set";t[r.actionId]={actionId:r.actionId,mutation:r.mutation,backend:r.backend,launchPolicy:s?"allowed":"denied",...s?{}:{denialCode:"EXEC_DENIED"}};}let i={id:e.definitionId,version:e.version,renderer:"sandbox-html",...e.usage===void 0?{}:{usage:e.usage},...e.detailPanel===void 0?{}:{detailPanel:e.detailPanel},...e.displayModes===void 0?{}:{displayModes:e.displayModes},surfaces:e.surfaces,stateProjection:e.stateProjection,...e.summaryProjection===void 0?{}:{summaryProjection:e.summaryProjection},...e.dataPaths===void 0?{}:{dataPaths:e.dataPaths},actions:n},o={entry:{path:"ui/index.html",...e.entryHash===void 0?{}:{hash:e.entryHash}},...e.initialState===void 0?{}:{initialState:e.initialState}};return {manifest:e,definition:i,handlers:t,resources:o}}function Mn(e,n,t,i,o,r){if(typeof e=="string"){let s=o.length>0&&r.some(a=>Ie(o.join("."),a));return (e.length>4096||We(e,false,false,s))&&z("state contains an unsafe string"),e}if(e===null||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)||z("state contains a non-finite number"),e;(e===void 0||typeof e!="object"||typeof e=="function"||typeof e=="bigint")&&z("state contains a non-JSON value"),t>8&&z("state is too deep"),n.has(e)&&z("state contains a cycle"),n.add(e);try{let s;if(Array.isArray(e))e.length>128&&z("state array is too long"),s=e.map(p=>Mn(p,n,t+1,65536,o,r));else {R(e)||z("state contains a non-plain object");let p={};for(let[d,u]of Object.entries(e))(d.length>4096||!Fe.test(d)||me(d))&&(d.length>4096&&z("state key is too long"),z("state contains a reserved or invalid key")),p[d]=Mn(u,n,t+1,65536,[...o,d],r);s=p;}let a=JSON.stringify(s);return (a===void 0||Buffer.byteLength(a,"utf8")>i)&&z("state subtree is too large"),s}finally{n.delete(e);}}function On(e,n=[]){R(e)||z("initial state must be a JSON object");let t=Mn(e,new Set,0,65536,[],n);return (t===null||Array.isArray(t)||typeof t!="object")&&z(),t}function No(e,n={}){Ge(e),R(e)||c("MANIFEST_INVALID"),C(e,zi),e.manifestVersion!==1&&c("MANIFEST_INVALID");let t=_n(Y(e,"pluginId")),i=_n(Y(e,"definitionId")),o=J(e,"version",1),r=J(e,"primitiveSet",1),s=n.supportedPrimitiveSet??ki;(!Number.isSafeInteger(s)||s<1)&&c("MANIFEST_INVALID"),r>s&&c("PRIMITIVE_SET_UNSUPPORTED"),R(e.activation)||c("MANIFEST_INVALID"),C(e.activation,["kind","language"]),e.activation.kind!=="fenced-code"&&c("MANIFEST_INVALID");let a=_n(Y(e.activation,"language")),p=so(e.schema),d=po(e.layout,p);return {manifestVersion:1,pluginId:t,definitionId:i,version:o,primitiveSet:r,activation:{kind:"fenced-code",language:a},schema:p,layout:d}}function bo(e,n={}){return R(e)||c("MANIFEST_INVALID"),Object.hasOwn(e,"lineage")&&c("MANIFEST_INVALID","lineage is only allowed in product bundle indexes"),e.manifestVersion===2?Do(e,n):No(e,n)}function $e(e,n={}){try{return bo(e,n)}catch(t){if(t instanceof K)throw t;return c("MANIFEST_INVALID")}}function Sn(e,n={}){let t=$e(e,n);return t.manifestVersion===2?Eo(t):t}var ki,Ci,wi,yt,xi,vi,ji,Vi,rt,Fi,Bi,Hi,zi,Gi,Ji,Wi,$i,Xi,Yi,Ki,qi,Zi,Qi,eo,no,to,io,oo,K,mt=O(()=>{I();ot();ce();hn();he();ki=1,Ci=/^[a-z][a-zA-Z0-9]*(\.[a-zA-Z0-9]+)+$/,wi=/^[A-Za-z][A-Za-z0-9._-]{0,127}$/,yt=/^[A-Za-z][A-Za-z0-9_-]{0,63}$/,xi=/<\/?[A-Za-z][^>]*>/,vi=/^(?:[A-Za-z]:[\\/]|\\\\|~[\\/]|\/)/,ji=/^(?:https?|file|ftp|ws|wss):\/\//i,Vi=/^\s*(?:javascript|data):/i,rt=/data:[^,\s]*,/i,Fi=/(?:https?|file|ftp|ws|wss):\/\//i,Bi=/javascript:/i,Hi=/(?:^[\s]*|[\s"'(=])(?:[A-Za-z]:[\\/]|\\\\|~[\\/]|\/)(?=[^\s"'<>])[^\s"'<>]*/,zi=["manifestVersion","pluginId","definitionId","version","primitiveSet","activation","schema","layout"],Gi=["manifestVersion","pluginId","definitionId","version","name","description","entry","surfaces","size","stateProjection","actions"],Ji=["_meta","icon","tone","entryHash","runtime","initialState","usage","detailPanel","displayModes","summaryProjection","dataPaths","focusedAiDataPaths"],Wi=["actionId","capability","mutation","inputSchema","resultProjection","backend"],$i=["confirmation","dataInputs","content","_meta"],Xi=4*1024,Yi=["type","handler"],Ki=["type","command"],qi=["env"],Zi=["path"],Qi=["hash"],eo=/^[0-9a-f]{64}$/,no=/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/,to=/[\r\n]/,io=16,oo=["card-shell","meta-banner","heading","labeled-text","step-flow","text-list"],K=class extends Error{constructor(t,i=t){super(i);this.code=t;}code;name="UiPluginValidationError"};});var ht=O(()=>{I();it();mt();he();});function Ke(e,n=e){throw new oe(e,n)}var oe,qe=O(()=>{I();oe=class extends Error{constructor(t,i=t){super(i);this.code=t;}code;name="McpAppContractError"};});var Tt=O(()=>{I();});var _t=O(()=>{I();Te();ce();qe();Tt();});function Dt(e,n){return Po.add(e),n!==void 0&&Mo.set(e,n),e}var Po,Mo,Ze=O(()=>{I();Po=new WeakSet,Mo=new WeakMap;});function Re(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function Un(e,n,t=[]){let i=new Set([...n,...t]),o=Object.keys(e);return n.every(r=>Object.hasOwn(e,r))&&o.every(r=>i.has(r))}function bt(e){if(e===null||typeof e!="object"||Object.isFrozen(e))return e;for(let n of Object.values(e))bt(n);return Object.freeze(e)}function j(e){throw new q("LINEAGE_INVALID",e)}function Co(e){throw new q("LINEAGE_STALE",e)}function Pt(e){if(!Re(e)||!Un(e,So,Uo)||!Re(e.actions))return j("Lineage definition shape is invalid");for(let n of Object.values(e.actions))if(!Re(n)||!Un(n,Ro,ko))return j("Lineage action definition shape is invalid");return e}function wo(e){if(!Re(e)||!Un(e,Lo,Oo))return j("Lineage entry shape is invalid");if(!Number.isSafeInteger(e.version)||e.version<1||typeof e.hash!="string"||!Et.test(e.hash))return j("Lineage entry identity is invalid");if(e.sourceHash!==void 0&&(typeof e.sourceHash!="string"||!Et.test(e.sourceHash)))return j("Lineage source hash is invalid");if(e.compat!==void 0&&e.compat!=="break")return j("Lineage compatibility marker is invalid");let n=Pt(e.definition);if(n.version!==e.version)return j("Lineage version does not match its definition");if(e.sourceHash!==void 0&&n.sourceHash!==e.sourceHash)return j("Lineage source hash does not match its definition");let t;try{t=te(n),ie({...n,hash:e.hash});}catch{return j("Lineage definition is invalid")}return t!==e.hash?j("Lineage definition hash does not match"):bt({version:e.version,hash:e.hash,definition:n,...e.sourceHash===void 0?{}:{sourceHash:e.sourceHash},...e.compat===void 0?{}:{compat:e.compat}})}function Nt(e){return e.stateProjection?.allow??[]}function xo(e,n){let t=[],i=new Set(Nt(n));Nt(e).some(a=>!i.has(a))&&t.push("S1_STATE_PROJECTION");let o=new Set(n.dataPaths??[]);(e.dataPaths??[]).some(a=>!o.has(a))&&t.push("S2_DATA_PATHS");for(let[a,p]of Object.entries(e.actions)){let d=n.actions[a];if(d&&(p.confirmation??"native")==="native"&&(d.confirmation??"native")!=="native"){t.push("S3_ACTION_CONFIRMATION");break}}Object.keys(e.legacy?.agentAccess??{}).some(a=>!Object.hasOwn(n.actions,a))&&t.push("S4_LEGACY_AGENT_ACTIONS");let s=e.summaryProjection?.allow;if(s!==void 0){let a=new Set(n.summaryProjection?.allow??[]);s.some(p=>!a.has(p))&&t.push("S5_SUMMARY_PROJECTION");}return t}function vo(e,n){return G(e)===G(n)}function Rn(e,n){if(!Array.isArray(e)||e.length===0)return j("Definition lineage is missing");if(!Re(n)||typeof n.hash!="string")return j("Current definition is invalid");let t,i;try{let{hash:a,...p}=n;i=Pt(p),t={...i,hash:a},ie(t);}catch{return j("Current definition is invalid")}let o=e.map(wo),r=o[0].definition.id;if(o.some(a=>a.definition.id!==r))return j("Lineage definition ids do not match");if(o.some((a,p)=>p>0&&a.version<=o[p-1].version))return j("Lineage generations are not in increasing version order");if(o.some((a,p)=>o.findIndex(d=>d.hash===a.hash)!==p))return j("Lineage contains a duplicate hash");let s=o[o.length-1];if(s.version!==t.version||s.hash!==t.hash||s.definition.id!==t.id||!vo(s.definition,i))return Co("The last lineage generation does not match the current package");if(t.legacy!==void 0){let a=new Set(Object.keys(t.actions)),p=new Set;for(let u of o)if(u.sourceHash===void 0)for(let y of Object.keys(u.definition.actions))a.has(y)&&p.add(y);let d=Object.keys(t.legacy.agentAccess??{});if(d.length!==p.size||d.some(u=>!p.has(u))){let u="S4_LEGACY_AGENT_ACCESS_COMPLETE";throw new q("LINEAGE_INVALID",`Lineage compatibility failed: ${u}`,[u])}}for(let a=0;a<o.length-1;a+=1){if(o.slice(a,-1).some(u=>u.compat==="break"))continue;let d=xo(o[a].definition,t);if(d.length>0)throw new q("LINEAGE_INVALID",`Lineage compatibility failed: ${d.join(", ")}`,d)}return Object.freeze({entries:Object.freeze(o),current:t})}var q,Et,Lo,Oo,So,Uo,Ro,ko,kn=O(()=>{I();Te();ce();q=class extends Error{constructor(t,i=t,o=[]){super(i);this.code=t;this.violations=o;}code;violations;name="UiDefinitionLineageError"},Et=/^[0-9a-f]{64}$/,Lo=["version","hash","definition"],Oo=["sourceHash","compat"],So=["id","version","actions"],Uo=["sourceHash","usage","detailPanel","displayModes","renderer","surfaces","stateProjection","dataPaths","summaryProjection","legacy"],Ro=["capabilities"],ko=["inputKeys","dataInputs","confirmation","resultProjection","content","env"];});var Mt,Lt,Ot=O(()=>{I();Mt=["crewx_app_terminal_connect","crewx_app_html_viewer_open"],Lt=["crewx_listWorkspaces","crewx_queryAgent","crewx_executeAgent","crewx_getTaskResult","crewx_listTasks","crewx_listAgents","callBrowser","openTab","listTabs","closeTab"];});var St=O(()=>{I();Te();Ze();});function Cn(e,n=0){try{let t=ee(e,n);return t.type!==void 0&&t.type!=="object"&&Ke("TOOL_INVALID","MCP App inputSchema must describe an object"),t}catch(t){if(t instanceof oe)throw t;Ke("TOOL_INVALID","MCP App inputSchema must be projection-safe JSON");}}function Ut(e){if(e.length===0)return Cn({type:"object",properties:{},additionalProperties:false});let n=e.map(i=>i.actionId),t=new Map;for(let i of e)t.set(i.actionId,Cn(i.inputSchema));return Cn(Fo(n,t),Vo)}function Fo(e,n){let t=e.map(i=>({type:"object",properties:{actionId:{type:"string",const:i},input:n.get(i)??{type:"object"}},required:["actionId","input"],additionalProperties:false}));return Object.freeze({type:"object",oneOf:Object.freeze(t),properties:Object.freeze({actionId:Object.freeze({type:"string",enum:Object.freeze([...e])}),input:Object.freeze({type:"object"})}),required:Object.freeze(["actionId","input"]),additionalProperties:false})}var ke,Vo,wn=O(()=>{I();_t();Te();ce();Ze();qe();kn();Ot();St();ke=8*1024*1024,new Set(Mt),new Set(Lt),Vo=4;});function re(e){let n=typeof e=="object"&&e!==null&&"code"in e?String(e.code):"";return n==="ENOENT"?new A("NOT_FOUND"):n==="ELOOP"?new A("PATH_ESCAPED"):n==="EFBIG"||n==="EOVERFLOW"?new A("LIMIT_EXCEEDED"):n==="EACCES"||n==="EPERM"||n==="ENOTDIR"?new A("READ_DENIED"):new A("READ_DENIED")}function Wo(e){if(typeof e!="string"||e.length===0||!path.isAbsolute(e))throw new A("READ_DENIED")}function Rt(e){if(typeof e!="string"||path.isAbsolute(e)||/[\\\u0000]/.test(e))throw new A("PATH_ESCAPED");if(e==="")return [];let n=e.split("/");if(n.some(t=>t.length===0||t==="."||t===".."))throw new A("PATH_ESCAPED");return n}function Qe(e,n){let t=path.relative(e,n);return t===""||t!==".."&&!t.startsWith(`..${path.sep}`)&&!path.isAbsolute(t)}function en(e){return {dev:e.dev,ino:e.ino,size:e.size,mtimeNs:e.mtimeNs,ctimeNs:e.ctimeNs}}function jn(e,n){return e.dev===n.dev&&e.ino===n.ino}function jt(e,n){return jn(e,n)&&e.size===n.size&&e.mtimeNs===n.mtimeNs&&e.ctimeNs===n.ctimeNs}async function kt(e){Wo(e);let n,t;try{n=await promises.realpath(e),t=await promises.stat(n,{bigint:!0});}catch(i){throw re(i)}if(!t.isDirectory())throw new A("READ_DENIED");return {realRoot:n,identity:en(t)}}async function $o(e,n,t){if(t.length<2||t[0]!=="apps"&&t[0]!=="skills")return;let i,o;try{if(i=path.resolve(e,t[0],t[1]),o=await promises.realpath(i),!(await promises.stat(o,{bigint:!0})).isDirectory())throw new A("READ_DENIED")}catch(r){throw r instanceof A?r:re(r)}if(!Qe(n,o))throw new A("PATH_ESCAPED");return o}async function Ct(e,n,t,i){let o,r,s;try{o=await promises.lstat(e,{bigint:!0}),r=await promises.realpath(e),s=await promises.stat(r,{bigint:!0});}catch(a){throw re(a)}if(!Qe(n,r)||t!==void 0&&!Qe(t,r))throw new A("PATH_ESCAPED");if(!o.isFile()||!s.isFile())throw new A("READ_DENIED");if(!jn(i,o)||!jn(i,s)||i.dev!==s.dev)throw new A("PATH_ESCAPED")}async function xn(e,n){let t,i;try{t=await promises.realpath(e),i=await promises.stat(t,{bigint:!0});}catch{throw new A("PATH_ESCAPED")}if(t!==n.realRoot||!jt(n.identity,en(i)))throw new A("PATH_ESCAPED")}function Xo(e){return e.isSymbolicLink()?{name:e.name,kind:"symlink"}:e.isDirectory()?{name:e.name,kind:"directory"}:e.isFile()?{name:e.name,kind:"file"}:{name:e.name,kind:"other"}}var A,vt,Go,Jo,be,tn,Vt,Ft,Fn=O(()=>{I();A=class extends Error{constructor(t){super(t);this.code=t;}code;name="AppDiscoveryFsError"},vt=fs.constants.O_NOFOLLOW,Go=fs.constants.O_NONBLOCK,Jo=fs.constants.O_RDONLY|(vt??0)|(Go??0);be=class{async listDirectory(n,t){let i=Rt(t),o=await kt(n),r=path.resolve(n,...i),s,a;try{s=await promises.realpath(r),a=await promises.stat(s,{bigint:!0});}catch(p){let d=re(p);if(d.code==="NOT_FOUND")return [];throw d}if(!Qe(o.realRoot,s)||!a.isDirectory())throw new A("PATH_ESCAPED");try{let p=await promises.readdir(s,{withFileTypes:!0,encoding:"utf8"});return await xn(n,o),p.map(Xo)}catch(p){let d=re(p);if(d.code==="NOT_FOUND")return [];throw d}}async readdir(n,t){return this.listDirectory(n,t)}async readDirectory(n,t){return this.listDirectory(n,t)}async readVerifiedFile(n,t,i){if(!Number.isSafeInteger(i)||i<0)throw new A("READ_DENIED");if(vt===void 0)throw new A("UNSUPPORTED");let o=Rt(t),r=await kt(n),s=path.resolve(n,...o),a=path.relative(n,s);if(a===".."||a.startsWith(`..${path.sep}`)||path.isAbsolute(a))throw new A("PATH_ESCAPED");let p;try{p=await promises.open(s,Jo);}catch(d){throw re(d)}try{let d;try{let f=await p.stat({bigint:!0});d=en(f);}catch(f){throw re(f)}if(d.size>BigInt(i))throw new A("LIMIT_EXCEEDED");if(d.size>BigInt(Number.MAX_SAFE_INTEGER))throw new A("LIMIT_EXCEEDED");await xn(n,r);let u=await $o(n,r.realRoot,o);await Ct(s,r.realRoot,u,d);let y=new Uint8Array(new ArrayBuffer(Number(d.size))),b=0;for(;b<y.byteLength;){let f;try{f=(await p.read(y,b,y.byteLength-b,b)).bytesRead;}catch(T){throw re(T)}if(f<=0)throw new A("IDENTITY_CHANGED");b+=f;}let g;try{let f=await p.stat({bigint:!0});g=en(f);}catch(f){throw re(f)}if(!jt(d,g))throw new A("IDENTITY_CHANGED");return await Ct(s,r.realRoot,u,g),await xn(n,r),new Uint8Array(y)}finally{await p.close().catch(()=>{});}}async readFileVerified(n,t,i){return this.readVerifiedFile(n,t,i)}},tn=new be,Vt=tn,Ft=be;});function xe(e){if(e===null||typeof e!="object"||Array.isArray(e))return  false;try{let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}catch{return  false}}function Ht(e){return typeof e=="string"&&ne.test(e)?e:void 0}function nr(e){return e.length>0&&e!=="."&&e!==".."&&!/[\\/\u0000]/.test(e)}function fe(e,n){let t=new TextEncoder().encode(e),i=new TextEncoder().encode(n),o=Math.min(t.byteLength,i.byteLength);for(let r=0;r<o;r+=1){let s=t[r]-i[r];if(s!==0)return s}return t.byteLength-i.byteLength}function tr(e){if(typeof e=="string")return {name:e,kind:"directory"};if(e===null||typeof e!="object")return null;let n=e;if(typeof n.name!="string")return null;if(n.kind==="file"||n.kind==="directory"||n.kind==="symlink"||n.kind==="other")return {name:n.name,kind:n.kind};if(n.type==="file"||n.type==="directory"||n.type==="symlink"||n.type==="other")return {name:n.name,kind:n.type};let t=n.isDirectory;if(typeof t=="function"&&t.call(e))return {name:n.name,kind:"directory"};let i=n.isSymbolicLink;if(typeof i=="function"&&i.call(e))return {name:n.name,kind:"symlink"};let o=n.isFile;return typeof o=="function"&&o.call(e)?{name:n.name,kind:"file"}:{name:n.name,kind:"other"}}function ir(e){if(e instanceof Uint8Array)return new Uint8Array(e);if(e instanceof ArrayBuffer)return new Uint8Array(e.slice(0));if(Array.isArray(e)&&e.every(n=>Number.isInteger(n)&&n>=0&&n<=255))return Uint8Array.from(e);throw new TypeError("filesystem port returned an invalid byte array")}function or(e){return Qo.decode(e)}function rr(e){return JSON.parse(or(e))}function zt(e){switch(e){case "ENOENT":return "NOT_FOUND";case "ELOOP":case "EXDEV":return "PATH_ESCAPED";case "EFBIG":case "EOVERFLOW":return "LIMIT_EXCEEDED";case "EACCES":case "EPERM":case "ENOTDIR":return "READ_DENIED";default:return e}}function sr(e){if(e instanceof A)return zt(e.code);if(e!==null&&typeof e=="object"&&"code"in e){let n=e.code;if(typeof n=="string")return zt(n)}}function se(e,n){let t=n();return Number.isFinite(t)&&Number.isFinite(e)&&t-e<=5e3}function ar(e){if(typeof e.readVerifiedFile=="function")return e.readVerifiedFile;if(typeof e.readFileVerified=="function")return e.readFileVerified}function cr(e){if(typeof e.listDirectory=="function")return e.listDirectory;if(typeof e.readDirectory=="function")return e.readDirectory;if(typeof e.readdir=="function")return e.readdir}async function Gt(e,n,t,i){let o=ar(e);if(!o)throw new A("READ_DENIED");return ir(await o.call(e,n,t,i))}async function zn(e,n,t){let i=cr(e);if(!i)throw new A("READ_DENIED");let o=await i.call(e,n,t);if(!Array.isArray(o))throw new A("READ_DENIED");return o.map(tr).filter(r=>r!==null)}function dr(e,n,t,i){return Object.freeze({code:e,...{},source:n,relativePath:t})}function pr(e){if(!xe(e))throw new TypeError("productBundle.reservedIds must be an object with appIds and definitionIds arrays");try{let n=Reflect.ownKeys(e);if(n.length!==2||!n.includes("appIds")||!n.includes("definitionIds"))throw new TypeError("productBundle.reservedIds must contain exactly appIds and definitionIds");let t=(i,o)=>{if(!Array.isArray(i))throw new TypeError("productBundle.reservedIds."+o+" must be an array");let r=[];for(let s=0;s<i.length;s+=1){let a=i[s];if(typeof a!="string"||a.length===0)throw new TypeError("productBundle.reservedIds."+o+" must contain non-empty strings");r.push(a);}return Object.freeze([...new Set(r)].sort(fe))};return Object.freeze({appIds:t(e.appIds,"appIds"),definitionIds:t(e.definitionIds,"definitionIds")})}catch(n){throw n instanceof TypeError?n:new TypeError("productBundle.reservedIds must be a valid reservation object")}}function lr(e,n){return e.appIds.length===n.appIds.length&&e.appIds.every((t,i)=>t===n.appIds[i])&&e.definitionIds.length===n.definitionIds.length&&e.definitionIds.every((t,i)=>t===n.definitionIds[i])}function ve(e){return Object.freeze({appIds:Object.freeze([...new Set(e.map(n=>n.appId))].sort(fe)),definitionIds:Object.freeze([...new Set(e.map(n=>n.definition.id))].sort(fe))})}function on(e,n){let t=Object.keys(e).sort(fe),i=[...n].sort(fe);return t.length===i.length&&t.every((o,r)=>o===i[r])}function Jt(e){if(typeof e!="string"||e.length===0||e.startsWith("/")||/[\\\u0000]/.test(e))return;let n=e.split("/");if(!n.some(t=>t.length===0||t==="."||t===".."))return n}function ur(e){let n;try{n=rr(e);}catch{return}if(!xe(n)||!on(n,["version","packages"])||n.version!==1||!Array.isArray(n.packages)||n.packages.length>Gn)return;let t=new Set,i=new Set,o=0,r=[];for(let s of n.packages){if(!xe(s))return;let a=["packageDir","appId","definition","files"],p=Object.hasOwn(s,"lineage"),d=Object.hasOwn(s,"launcher"),u=[...p?["lineage"]:[],...d?["launcher"]:[]];if(!on(s,[...a,...u])||d&&s.launcher!==false)return;let y=Jt(s.packageDir),b=Ht(s.appId);if(!y||y.length!==2||y[0]!=="apps"||!nr(y[1])||!b||t.has(s.packageDir)||!xe(s.definition)||!on(s.definition,["id","version","hash"]))return;let g=Ht(s.definition.id),f=s.definition.version,T=s.definition.hash;if(!g||!Number.isSafeInteger(f)||f<1||typeof T!="string"||!Hn.test(T)||!Array.isArray(s.files)||s.files.length<2||s.files.length>Jn)return;let k=new Set,v=[];for(let m of s.files){if(!xe(m)||!on(m,["path","sha256"]))return;let N=Jt(m.path);if(!N||typeof m.sha256!="string"||!Hn.test(m.sha256))return;let S=N.join("/"),B=`${s.packageDir}/${S}`;if(k.has(S)||i.has(B))return;k.add(S),i.add(B),v.push(Object.freeze({path:S,sha256:m.sha256}));}if(!k.has("ui-plugin.json")||!k.has("ui/index.html")||(o+=v.length,o>Ko))return;t.add(s.packageDir),r.push(Object.freeze({packageDir:s.packageDir,...d?{launcher:false}:{},appId:b,definition:Object.freeze({id:g,version:f,hash:T}),lineage:Array.isArray(s.lineage)?s.lineage:[],files:Object.freeze(v.sort((m,N)=>fe(m.path,N.path)))}));}return Object.freeze({version:1,packages:Object.freeze(r)})}function ue(e){let n=sr(e);return n==="PATH_ESCAPED"||n==="IDENTITY_CHANGED"||n==="TOCTOU"?"PATH_ESCAPED":n==="LIMIT_EXCEEDED"?"LIMIT_EXCEEDED":"BUNDLE_INTEGRITY"}async function fr(e,n,t,i,o){let r=[],s=async(a,p)=>{if(!se(i,o))throw new A("LIMIT_EXCEEDED");if(p>2)throw new A("LIMIT_EXCEEDED");let d=await zn(e,n,a);for(let u of d){if(typeof u.name!="string"||u.name.length===0||u.name==="."||u.name===".."||/[\\/\u0000]/.test(u.name))throw new A("PATH_ESCAPED");let y=`${a}/${u.name}`;if(u.kind==="file"){if(r.push(y.slice(t.length+1)),r.length>Jn)throw new A("LIMIT_EXCEEDED")}else if(u.kind==="directory")await s(y,p+1);else throw u.kind==="symlink"?new A("PATH_ESCAPED"):new A("READ_DENIED")}};return await s(t,0),r.sort(fe)}function yr(e){return e==="ui-plugin.json"?262144:e==="ui/index.html"?ke:e==="ui/state.json"?65536:e.startsWith("ui/assets/")?Zo:qo}async function Wt(e,n,t,i){if(e===void 0)return {packages:[],diagnostics:[],incomplete:false,reservedIds:er};let o=pr(e.reservedIds),r=[],s=(l,P,V)=>dr(l,"bundled",P),a=(l=[],P=false,V)=>({...V===void 0?{}:{indexHash:V},packages:l,diagnostics:r,incomplete:P,reservedIds:o});if(typeof e.root!="string"||e.root.length===0||typeof e.expectedIndexHash!="string"||!Hn.test(e.expectedIndexHash))return r.push(s("BUNDLE_INTEGRITY","bundle-index.json")),a();let p;try{p=await Gt(n,e.root,"bundle-index.json",Yo);}catch(l){return r.push(s(ue(l),"bundle-index.json")),a()}let d=crypto.createHash("sha256").update(p).digest("hex");if(d!==e.expectedIndexHash)return r.push(s("BUNDLE_INTEGRITY","bundle-index.json")),a();let u=ur(p);if(u===void 0)return r.push(s("BUNDLE_INTEGRITY","bundle-index.json")),a();if(!lr(ve(u.packages),o))return r.push(s("BUNDLE_INTEGRITY","bundle-index.json")),a([],false,d);if(!se(t,i))return r.push(s("LIMIT_EXCEEDED","bundle-index.json")),a(u.packages.map(l=>({indexEntry:l,failureCode:"LIMIT_EXCEEDED"})),true,d);let y;try{y=await zn(n,e.root,"");}catch(l){return r.push(s(ue(l),"bundle-index.json")),a(u.packages.map(P=>({indexEntry:P,failureCode:ue(l)})),false,d)}if(!se(t,i))return r.push(s("LIMIT_EXCEEDED","bundle-index.json")),a(u.packages.map(l=>({indexEntry:l,failureCode:"LIMIT_EXCEEDED"})),true,d);let b=y.find(l=>l.name==="bundle-index.json"&&l.kind==="file"),g=y.find(l=>l.name==="apps"&&l.kind==="directory"),f=l=>u.packages.map(P=>({indexEntry:P,failureCode:l}));if(!b)return r.push(s("BUNDLE_INTEGRITY","bundle-index.json")),a(f("BUNDLE_INTEGRITY"),false,d);let T=y.filter(l=>l.name!=="bundle-index.json"&&l.name!=="apps");if(T.length>0){let l=T.some(P=>P.kind==="symlink")?"PATH_ESCAPED":"BUNDLE_INTEGRITY";return r.push(s(l,"bundle-index.json")),a(f("BUNDLE_INTEGRITY"),false,d)}if(y.some(l=>l.name==="apps"&&l.kind!=="directory"))return r.push(s("PATH_ESCAPED","apps")),a(f("PATH_ESCAPED"),false,d);let k=[];if(g)try{k=await zn(n,e.root,"apps");}catch(l){return r.push(s(ue(l),"apps")),a(f(ue(l)),false,d)}if(!se(t,i)||k.length>Gn)return r.push(s("LIMIT_EXCEEDED","apps")),a(f("LIMIT_EXCEEDED"),true,d);let v=new Map(u.packages.map(l=>[l.packageDir.slice(5),l])),m=k.filter(l=>!v.has(l.name));for(let l of m)r.push(s(l.kind==="symlink"?"PATH_ESCAPED":"BUNDLE_INTEGRITY",`apps/${l.name}`));if(m.length>0){let l=m.some(P=>P.kind==="symlink")?"PATH_ESCAPED":"BUNDLE_INTEGRITY";return a(f(l),false,d)}let N=new Set,S=new Map,B=new Map;for(let l of u.packages){let P=S.get(l.appId)??[];P.push(l),S.set(l.appId,P);let V=`${l.definition.id}\0${String(l.definition.version)}`,h=B.get(V)??[];h.push(l),B.set(V,h);}for(let l of [...S.values(),...B.values()])if(l.length>1)for(let P of l)N.add(P);let x=[],$=p.byteLength,M=false;for(let l of u.packages){if(!se(t,i)){M=true,x.push({indexEntry:l,failureCode:"LIMIT_EXCEEDED"});continue}let P;try{let L=l.lineage[l.lineage.length-1];if(!L)throw new q("LINEAGE_INVALID","Definition lineage is missing");if(L.definition.id!==l.definition.id||L.version!==l.definition.version||L.hash!==l.definition.hash)throw new q("LINEAGE_STALE","Last lineage generation does not match bundle identity");P=Rn(l.lineage,{...L.definition,hash:L.hash}).entries;}catch(L){let Z=L instanceof q?L.code:"LINEAGE_INVALID";r.push(s(Z,l.packageDir)),x.push({indexEntry:l,failureCode:Z});continue}let V=k.find(L=>L.name===l.packageDir.slice(5));if(!g||!V){x.push({indexEntry:l,failureCode:"BUNDLE_INTEGRITY"});continue}if(V.kind!=="directory"){x.push({indexEntry:l,failureCode:V.kind==="symlink"?"PATH_ESCAPED":"BUNDLE_INTEGRITY"});continue}let h;try{let L=await fr(n,e.root,l.packageDir,t,i);if(!se(t,i)){M=!0,x.push({indexEntry:l,failureCode:"LIMIT_EXCEEDED"});continue}let Z=l.files.map(X=>X.path);if(L.length!==Z.length||L.some((X,de)=>X!==Z[de])){x.push({indexEntry:l,failureCode:"BUNDLE_INTEGRITY"});continue}h=new Map;let Q;for(let X of l.files){if(!se(t,i)){Q="LIMIT_EXCEEDED",M=!0;break}if($>=Bn){Q="LIMIT_EXCEEDED";break}let de;try{de=await Gt(n,e.root,`${l.packageDir}/${X.path}`,yr(X.path));}catch(ui){Q=ue(ui);break}if(!se(t,i)){Q="LIMIT_EXCEEDED",M=!0;break}if($+de.byteLength>Bn){$=Bn,Q="LIMIT_EXCEEDED";break}if($+=de.byteLength,crypto.createHash("sha256").update(de).digest("hex")!==X.sha256){Q="BUNDLE_INTEGRITY";break}h.set(X.path,de);}if(Q!==void 0){x.push({indexEntry:l,failureCode:Q});continue}}catch(L){se(t,i)||(M=true),x.push({indexEntry:l,failureCode:ue(L)});continue}x.push({indexEntry:l,lineage:P,files:h,...N.has(l)?{failureCode:"DUPLICATE_ID"}:{}});}return a(x,M,d)}var Yo,Gn,Jn,Ko,qo,Zo,Bn,Hn,Qo,er,Wn=O(()=>{I();kn();he();wn();Fn();Yo=256*1024,Gn=64,Jn=128,Ko=Gn*Jn,qo=2*1024*1024,Zo=8*1024*1024,Bn=32*1024*1024,Hn=/^[0-9a-f]{64}$/,Qo=new TextDecoder("utf-8",{fatal:true}),er=Object.freeze({appIds:Object.freeze([]),definitionIds:Object.freeze([])});});var ri={};yi(ri,{AppDiscoveryFsError:()=>A,LOCAL_APP_TOOL_PREFIX:()=>Ir,MCP_APP_WORKSPACE_TOOL_PREFIX:()=>gr,NodeAppDiscoveryFs:()=>be,NodeAppDiscoveryFsAdapter:()=>Ft,WORKSPACE_APP_TOOL_PREFIX:()=>Me,defaultAppDiscoveryFs:()=>tn,defaultNodeAppDiscoveryFs:()=>Vt,deriveWorkspaceAppToolName:()=>mr,deriveWorkspaceAppToolNames:()=>Kn,discoverWorkspaceAppCandidates:()=>Gr,discoverWorkspaceApps:()=>Zn,productAppBundleReservations:()=>ve,scanWorkspaceApps:()=>Jr});function Kn(e){if(typeof e!="string"||!ne.test(e))throw new TypeError("pluginId must be a safe UI plugin identifier");let n=`${Me}${e}`.length+7<=128?e:`hash_${crypto.createHash("sha256").update(e,"utf8").digest("hex")}`;return {read:`${Me}${n}_read`,action:`${Me}${n}_action`}}function mr(e,n="read"){let t=Kn(e);return n==="read"?t.read:t.action}function je(e){if(e===null||typeof e!="object"||Array.isArray(e))return  false;try{let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}catch{return  false}}function Xt(e){return typeof e=="string"&&ne.test(e)?e:void 0}function Tr(e,n){return n.length===0||n==="."||n===".."||/[\\/\u0000]/.test(n)?e==="skills"?"skills":"apps":`${e==="skills"?"skills":"apps"}/${n}`}function _r(e){return e.length>0&&e!=="."&&e!==".."&&!/[\\/\u0000]/.test(e)}function ei(e,n){let t=new TextEncoder().encode(e),i=new TextEncoder().encode(n),o=Math.min(t.byteLength,i.byteLength);for(let r=0;r<o;r+=1){let s=t[r]-i[r];if(s!==0)return s}return t.byteLength-i.byteLength}function Dr(e){if(typeof e=="string")return {name:e,kind:"directory"};if(e===null||typeof e!="object")return null;let n=e;if(typeof n.name!="string")return null;if(n.kind==="file"||n.kind==="directory"||n.kind==="symlink"||n.kind==="other")return {name:n.name,kind:n.kind};if(n.type==="file"||n.type==="directory"||n.type==="symlink"||n.type==="other")return {name:n.name,kind:n.type};let t=n.isDirectory;if(typeof t=="function"&&t.call(e))return {name:n.name,kind:"directory"};let i=n.isSymbolicLink;if(typeof i=="function"&&i.call(e))return {name:n.name,kind:"symlink"};let o=n.isFile;return typeof o=="function"&&o.call(e)?{name:n.name,kind:"file"}:{name:n.name,kind:"other"}}function Er(e){if(e instanceof Uint8Array)return new Uint8Array(e);if(e instanceof ArrayBuffer)return new Uint8Array(e.slice(0));if(Array.isArray(e)&&e.every(n=>Number.isInteger(n)&&n>=0&&n<=255))return Uint8Array.from(e);throw new TypeError("filesystem port returned an invalid byte array")}function ni(e){return hr.decode(e)}function ti(e){return JSON.parse(ni(e))}function Nr(e){if(!je(e))return;let n=Xt(e.pluginId);if(!n)return;let t=Xt(e.definitionId),i=e.version,o=t&&Number.isSafeInteger(i)&&i>=1?`${t}\0${String(i)}`:void 0;return {pluginId:n,...o===void 0?{}:{definitionKey:o}}}function br(e){let n=ti(e);return {value:n,identity:Nr(n)}}function qn(e,n,t,i){let o={code:e,...i===void 0?{}:{pluginId:i},source:n,relativePath:t};return Object.freeze(o)}function Yt(e){switch(e){case "ENOENT":return "NOT_FOUND";case "ELOOP":case "EXDEV":return "PATH_ESCAPED";case "EFBIG":case "EOVERFLOW":return "LIMIT_EXCEEDED";case "EACCES":case "EPERM":case "ENOTDIR":return "READ_DENIED";default:return e}}function ye(e){if(e instanceof A)return Yt(e.code);if(e!==null&&typeof e=="object"&&"code"in e){let n=e.code;if(typeof n=="string")return Yt(n)}}function Ve(e,n){return e==="PATH_ESCAPED"||e==="IDENTITY_CHANGED"||e==="TOCTOU"?"PATH_ESCAPED":e==="LIMIT_EXCEEDED"?"LIMIT_EXCEEDED":n==="manifest"&&e==="NOT_FOUND"?"MANIFEST_MISSING":n==="entry"?"ENTRY_INVALID":n==="initial"?"INITIAL_STATE_INVALID":"MANIFEST_INVALID"}function Kt(e){switch(e.code){case "MANIFEST_INVALID":case "PRIMITIVE_UNKNOWN":case "PRIMITIVE_SET_UNSUPPORTED":case "SCHEMA_TYPE_UNSUPPORTED":case "TOKEN_INVALID":case "UNSAFE_VALUE":return "MANIFEST_INVALID";case "LIMIT_EXCEEDED":return "LIMIT_EXCEEDED";case "INITIAL_STATE_INVALID":return "INITIAL_STATE_INVALID";default:return ii("UiPluginValidationError",e.code)}}function ii(e,n){throw new Error(`Unmapped ${e} code: ${String(n)}`)}function $n(e){switch(e){case "APP_ID_INVALID":case "TOOL_ID_INVALID":case "RESOURCE_URI_INVALID":case "TOOL_INVALID":case "SERIALIZATION_INVALID":return "MANIFEST_INVALID";case "APP_ID_CONFLICT":case "TOOL_ID_CONFLICT":return "DUPLICATE_ID";case "RESOURCE_NOT_FOUND":case "HTML_INVALID":return "ENTRY_INVALID";case "STATE_INVALID":case "STATE_PROJECTION_INVALID":case "BUTTON_INVALID":return "INITIAL_STATE_INVALID";default:return ii("McpAppContractError",e)}}function Xn(e,n){let t=n();return Number.isFinite(t)&&Number.isFinite(e)&&t-e<=5e3}function Pr(e){return {pluginId:e.appId,definitionKey:`${e.definition.id}\0${String(e.definition.version)}`}}function Mr(e,n){let t=n.get("package.json");if(t!==void 0)try{let o=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t));if(je(o)){let r=o.bin,s=typeof r=="string"?r:je(r)?Object.values(r).find(a=>typeof a=="string"):void 0;for(let a of [s,o.main]){if(typeof a!="string")continue;let p=Lr(a);if(p&&n.has(p))return p}}}catch{}return [`${e.slice(e.lastIndexOf("/")+1)}.js`,"index.js","main.js"].find(o=>n.has(o))}function Lr(e){if(e.startsWith("/")||e.includes("\\")||e.includes("\0"))return;let n=e.split("/").filter(t=>t!==".");if(!(n.length===0||n.some(t=>t.length===0||t==="..")))return n.join("/")}function Or(){return globalThis.performance?.now()??Date.now()}function Pe(e){if(e===null||typeof e!="object"||Object.isFrozen(e))return e;for(let n of Object.values(e))Pe(n);return Object.freeze(e)}function qt(e){return Object.freeze(Array.from(e))}async function Yn(e,n,t,i){if(n.pinnedFiles!==void 0){let o=n.pinnedFiles.get(t);if(o===void 0)throw new A("NOT_FOUND");if(o.byteLength>i)throw new A("LIMIT_EXCEEDED");return new Uint8Array(o)}return oi(e,n.root,`${n.relativePath}/${t}`,i)}function Sr(e,n,t){let i=crypto.createHash("sha256"),o=new TextEncoder().encode(G(e)),r=s=>{let a=new Uint8Array(8);new DataView(a.buffer).setBigUint64(0,BigInt(s)),i.update(a);};return r(o.byteLength),i.update(o),r(n.byteLength),i.update(n),r(t.byteLength),i.update(t),i.digest("hex")}function Ur(e,n){let t={...e.definition,sourceHash:n},i={...t,hash:te(t)};try{ie(i);}catch{throw new K("MANIFEST_INVALID","normalized definition is invalid")}return i}function Rr(e){return e.actions.some(n=>n.backend.type==="core"&&n.backend.handler!=="state.set")}function kr(e){if(typeof e.readVerifiedFile=="function")return e.readVerifiedFile;if(typeof e.readFileVerified=="function")return e.readFileVerified}function Cr(e){if(typeof e.listDirectory=="function")return e.listDirectory;if(typeof e.readDirectory=="function")return e.readDirectory;if(typeof e.readdir=="function")return e.readdir}async function oi(e,n,t,i){let o=kr(e);if(!o)throw new A("READ_DENIED");return Er(await o.call(e,n,t,i))}async function wr(e,n,t){let i=Cr(e);if(!i)throw new A("READ_DENIED");let o=await i.call(e,n,t);if(!Array.isArray(o))throw new A("READ_DENIED");return o.map(Dr).filter(r=>r!==null)}function xr(e){let n=[];for(let t of [e.reserved,e.builtin])t&&n.push(t);return e.builtins&&"listMcpApps"in e.builtins?n.push(Zt(e.builtins)):e.builtins&&n.push(e.builtins),e.builtinCatalog&&n.push(Zt(e.builtinCatalog)),n.push({...e.reservedAppIds===void 0?{}:{appIds:e.reservedAppIds},...e.reservedDefinitionIds===void 0?{}:{definitionIds:e.reservedDefinitionIds},...e.reservedToolNames===void 0?{}:{toolNames:e.reservedToolNames}}),n}function Zt(e){let n=[],t=[],i=[];for(let o of e.listMcpApps())typeof o.appId=="string"&&n.push(o.appId),o.definition&&typeof o.definition.id=="string"&&t.push(o.definition.id);for(let o of e.listMcpAppTools())typeof o.name=="string"&&i.push(o.name);return {appIds:n,definitionIds:t,toolNames:i}}function ae(e,n){e.diagnostic||(e.diagnostic=qn(n,e.source,e.relativePath,e.identity?.pluginId));}function vr(e){let n=new Map;for(let i of e){let o=i.identity?.pluginId;if(o===void 0)continue;let r=n.get(o)??[];r.push(i),n.set(o,r);}for(let i of n.values()){if(i.length<2)continue;let o=i.filter(s=>s.provenance!==void 0);if(o.length>0){for(let s of i)s.provenance===void 0&&ae(s,"RESERVED_ID");if(o.length>1)for(let s of o)ae(s,"DUPLICATE_ID");continue}let r=i.filter(s=>s.source==="apps");if(r.length>1){for(let s of r)ae(s,"DUPLICATE_ID");for(let s of i.filter(a=>a.source==="skills"))ae(s,"DUPLICATE_ID");}else for(let s of i.filter(a=>a.source==="skills"))ae(s,"DUPLICATE_ID");}let t=new Map;for(let i of e){if(i.diagnostic?.code==="RESERVED_ID")continue;let o=i.identity?.definitionKey;if(o===void 0)continue;let r=t.get(o)??[];r.push(i),t.set(o,r);}for(let i of t.values())if(i.length>1)for(let o of i)ae(o,"DUPLICATE_ID");}function jr(e,n,t){let i=new Set,o=new Set,r=new Set,s=new Set(t.appIds),a=new Set(t.definitionIds);for(let p of xr(n)){for(let d of p.appIds??[])typeof d=="string"&&i.add(d);for(let d of p.definitionIds??[])typeof d=="string"&&o.add(d);for(let d of p.toolNames??[])typeof d=="string"&&r.add(d);}for(let p of e){let d=p.candidate;if(!d)continue;if(i.has(d.pluginId)||o.has(d.definitionId)){ae(p,"RESERVED_ID");continue}if(p.provenance===void 0&&(s.has(d.pluginId)||a.has(d.definitionId))){ae(p,"RESERVED_ID");continue}[d.toolNames.read,d.toolNames.action].filter(y=>y!==void 0).some(y=>r.has(y))&&ae(p,"DUPLICATE_ID");}}function Vr(e){return [...e].sort((n,t)=>{let i=$t.indexOf(n.source)-$t.indexOf(t.source);return i!==0?i:ei(n.relativePath,t.relativePath)})}function E(e,n){e.diagnostic=qn(n,e.source,e.relativePath,e.identity?.pluginId);}async function Qt(e,n,t){if(t.byteLength>262144){E(n,"LIMIT_EXCEEDED");return}let i;try{i=br(t);}catch{E(n,"MANIFEST_INVALID");return}if(n.bundleIdentity===void 0)n.identity=i.identity;else if(i.identity?.pluginId!==n.bundleIdentity.appId||i.identity.definitionKey!==`${n.bundleIdentity.definitionId}\0${String(n.bundleIdentity.version)}`){E(n,"BUNDLE_INTEGRITY");return}if(je(i.value)&&i.value.builtinOnly===true){E(n,"RESERVED_ID");return}let o;try{let h=$e(i.value,{mode:"local"});if(h.manifestVersion!==2)throw new K("MANIFEST_INVALID","workspace App requires v2");o=h;}catch(h){if(h instanceof K){E(n,Kt(h));return}if(h instanceof oe){E(n,$n(h.code));return}if(je(h)&&typeof h.code=="string"){E(n,$n(h.code));return}throw h}let r={pluginId:o.pluginId,definitionKey:`${o.definitionId}\0${String(o.version)}`};if(n.bundleIdentity===void 0&&(n.identity=r),o.actions.length>0)try{Ut(o.actions.map(h=>({actionId:h.actionId,inputSchema:h.inputSchema})));}catch(h){if(h instanceof oe){E(n,$n(h.code));return}throw h}let s;try{s=await Yn(e,n,"ui/index.html",ke);}catch(h){E(n,Ve(ye(h),"entry"));return}if(s.byteLength>ke){E(n,"LIMIT_EXCEEDED");return}let a;try{a=ni(s);}catch{E(n,"ENTRY_INVALID");return}if(s.byteLength===0||a.length===0){E(n,"ENTRY_INVALID");return}let p=crypto.createHash("sha256").update(s).digest("hex");if(o.entryHash!==void 0&&o.entryHash!==p){E(n,"ENTRY_INVALID");return}let d={},u,y;if(o.initialState!==void 0){try{u=await Yn(e,n,"ui/state.json",65536);}catch(h){E(n,Ve(ye(h),"initial"));return}if(u.byteLength>65536){E(n,"LIMIT_EXCEEDED");return}try{let h=ti(u),L=o.dataPaths??[],Z=On(h,L);d=ee(Z,0,L),ge(d);}catch{E(n,"INITIAL_STATE_INVALID");return}if(y=crypto.createHash("sha256").update(u).digest("hex"),o.initialState.hash!==void 0&&o.initialState.hash!==y){E(n,"INITIAL_STATE_INVALID");return}}let b={...o,entryHash:p,...o.initialState===void 0?{}:{initialState:{path:"ui/state.json",hash:y}}},g=Sn(b),f=Sr(b,s,u??new Uint8Array),T;try{T=Ur(g,f);}catch(h){if(h instanceof K){E(n,Kt(h));return}throw h}let k;if(n.bundleLineage!==void 0){let h=n.bundleLineage[n.bundleLineage.length-1];if(!h){E(n,"LINEAGE_INVALID");return}let{legacy:L,...Z}=h.definition,{hash:Q,...X}=T;if(G(Z)!==G(X)){E(n,"LINEAGE_STALE");return}if(L!==void 0&&(T={...T,legacy:L}),L!==void 0)try{T={...T,hash:te(T)},ie(T);}catch{E(n,"LINEAGE_INVALID");return}k=n.bundleLineage;}if(n.bundleIdentity!==void 0&&n.bundleIdentity.appId!==o.pluginId){E(n,"BUNDLE_INTEGRITY");return}if(n.bundleIdentity!==void 0&&(n.bundleIdentity.definitionId!==T.id||n.bundleIdentity.version!==T.version||n.bundleIdentity.definitionHash!==T.hash)){E(n,"LINEAGE_STALE");return}let v=Kn(o.pluginId),m=o.actions.length===0?{read:v.read}:v,N=Pe(g),S=Pe(b),B=Pe(T),x=Pe({...g.handlers}),$=qt(s),M=u===void 0?void 0:qt(u),l=Object.freeze({...n.provenance===void 0?{}:{provenance:n.provenance},entry:Object.freeze({path:"ui/index.html",hash:p,bytes:$}),...M===void 0?{}:{initialState:Object.freeze({path:"ui/state.json",hash:y,bytes:M})}}),P={appId:o.pluginId,pluginId:o.pluginId,definitionId:o.definitionId,version:o.version,relativePath:n.relativePath,manifest:S,normalized:N,name:o.name,description:o.description,...o.icon===void 0?{}:{icon:o.icon},...o.tone===void 0?{}:{tone:o.tone},definition:B,handlers:x,resources:l,html:a,entryBytes:$,entryHash:p,initialState:Pe(d),...M===void 0?{}:{initialStateBytes:M},...y===void 0?{}:{initialStateHash:y},sourceHash:f,toolNames:Object.freeze(m)},V=n.provenance===void 0?{...P,source:n.source}:{...P,provenance:n.provenance,lineage:k??[]};n.candidate=Object.freeze(V),Rr(o)&&E(n,"EXEC_DENIED");}async function Fr(e,n){try{return await Yn(e,n,"ui-plugin.json",262144)}catch(t){if(ye(t)==="NOT_FOUND")return;E(n,Ve(ye(t),"manifest"));return}}function Br(e,n,t,i=Ar,o=false){let r=Vr(e);vr(r);let s=Object.freeze(r.filter(u=>u.candidate!==void 0&&u.diagnostic===void 0).map(u=>u.candidate)),a=Object.freeze(r.filter(u=>u.diagnostic!==void 0).map(u=>u.diagnostic)),p=o?Object.freeze({...t===void 0?{}:{indexHash:t},diagnostics:Object.freeze(a.filter(u=>u.source==="bundled").map(u=>Object.freeze({...u}))),reservedAppIds:Object.freeze([...i.appIds]),reservedDefinitionIds:Object.freeze([...i.definitionIds])}):void 0,d={apps:s,diagnostics:a,complete:n===void 0,...n===void 0?{}:{incompleteReason:n},...t===void 0?{}:{productBundleIndexHash:t},...p===void 0?{}:{productBundleSnapshotMetadata:p}};return Object.defineProperty(d,"candidates",{configurable:false,enumerable:false,get:()=>s}),Object.freeze(d)}function Hr(e){if(e===null||typeof e!="object"&&typeof e!="function")return  false;let n=e;return typeof n.readVerifiedFile=="function"||typeof n.readFileVerified=="function"||typeof n.listDirectory=="function"||typeof n.readDirectory=="function"||typeof n.readdir=="function"}function zr(e,n){if(Hr(e))return {fs:e,options:n??{}};let t=e??n??{};return {fs:t.filesystem??t.fileSystem??t.fs??tn,options:t}}async function Zn(e,n,t){if(typeof e!="string"||e.length===0)throw new TypeError("workspaceRoot must be explicit");let{fs:i,options:o}=zr(n,t),r=o.clock??Or,s=r(),a=[],p=0,d,u=await Wt(o.productBundle,i,s,r);a.push(...u.diagnostics.map(g=>({source:g.source,root:o.productBundle?.root??e,name:"",relativePath:g.relativePath,diagnostic:g})));let y=u.reservedIds;u.incomplete&&(d="time_limit");for(let g of u.packages){let f=g.indexEntry,T=f.packageDir,k=g.files===void 0?void 0:Mr(T,g.files),v=u.indexHash===void 0?void 0:Dt(Object.freeze({kind:"bundled",launcher:f.launcher!==false,indexHash:u.indexHash,packageDir:T,appId:f.appId,definitionId:f.definition.id,version:f.definition.version,definitionHash:f.definition.hash,files:f.files}),k),m={source:"bundled",root:o.productBundle?.root??e,name:T.slice(5),relativePath:T,...v===void 0?{}:{provenance:v},...g.files===void 0?{}:{pinnedFiles:g.files},...g.lineage===void 0?{}:{bundleLineage:g.lineage},bundleIdentity:{appId:f.appId,definitionId:f.definition.id,version:f.definition.version,definitionHash:f.definition.hash},identity:Pr(f)};if(a.push(m),p+=1,g.failureCode!==void 0){E(m,g.failureCode);continue}let N=g.files?.get("ui-plugin.json");if(N===void 0){E(m,"BUNDLE_INTEGRITY");continue}await Qt(i,m,N),m.candidate!==void 0&&m.diagnostic===void 0&&p<64&&!Xn(s,r)&&(d="time_limit");}let b=[{source:"apps",directory:"apps"},{source:"skills",directory:"skills"}];for(let g of b){let{source:f,directory:T}=g,k;try{k=await wr(i,e,T);}catch(m){if(ye(m)==="NOT_FOUND")continue;a.push({source:f,root:e,name:"",relativePath:f,diagnostic:qn(Ve(ye(m),"manifest"),f,f)});continue}let v=k.filter(m=>m.kind==="directory"||m.kind==="symlink").filter(m=>_r(m.name)).map(m=>({source:f,root:e,name:m.name,relativePath:Tr(f,m.name)})).sort((m,N)=>ei(m.relativePath,N.relativePath));for(let m of v){let N={...m};a.push(N);let S;if(f==="skills"&&(S=await Fr(i,N),S===void 0))continue;if(p>=64){E(N,"LIMIT_EXCEEDED");continue}if(m.relativePath.split("/").length-1>2){E(N,"LIMIT_EXCEEDED");continue}if(d!==void 0||!Xn(s,r)){E(N,"LIMIT_EXCEEDED"),d="time_limit";continue}if(p+=1,S===void 0)try{S=await oi(i,N.root,`${N.relativePath}/ui-plugin.json`,262144);}catch(x){E(N,Ve(ye(x),"manifest"));continue}await Qt(i,N,S),N.diagnostic===void 0&&p<64&&!Xn(s,r)&&(d="time_limit");}}return jr(a,o,y),Br(a,d,u.indexHash,y,o.productBundle!==void 0)}var Ar,Me,Ir,gr,$t,hr,Gr,Jr,si=O(()=>{I();Te();ce();ht();he();wn();qe();Fn();Ze();Wn();Wn();Ar=ve([]),Me="crewx_local_app_",Ir=Me,gr=Me;$t=["bundled","apps","skills"],hr=new TextDecoder("utf-8",{fatal:true});Gr=Zn,Jr=Zn;});I();var ai="SKILL.md",Kr=/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;function ci(e){if(e===null||typeof e!="object"||Array.isArray(e))return  false;let n=Object.getPrototypeOf(e);return n===Object.prototype||n===null}function qr(e){return e.isDirectory()||e.isSymbolicLink()}function li(e){try{return fs.existsSync(e)&&fs.statSync(e).isDirectory()}catch{return  false}}var Zr=["index.js","main.js"];function hc(e,n){let t=path.join(e,"package.json");if(fs.existsSync(t))try{let o=JSON.parse(fs.readFileSync(t,"utf8"));if(o.bin){let r=typeof o.bin=="string"?o.bin:Object.values(o.bin).find(s=>typeof s=="string");if(r){let s=path.resolve(e,r);if(fs.existsSync(s))return s}}if(typeof o.main=="string"){let r=path.resolve(e,o.main);if(fs.existsSync(r))return r}}catch{}let i=path.resolve(e,`${n}.js`);if(fs.existsSync(i))return i;for(let o of Zr){let r=path.resolve(e,o);if(fs.existsSync(r))return r}}function Qr(e){let n;try{n=fs.readFileSync(e,"utf8");}catch{return {frontmatter:{},readable:false,valid:false,hasFrontmatter:false}}let t=n.match(Kr);if(!t)return {frontmatter:{},readable:true,valid:true,hasFrontmatter:false};try{let i=jsYaml.load(t[1]??"");if(!ci(i))return {frontmatter:{},readable:!0,valid:!1,hasFrontmatter:!0};let o=ci(i.metadata)?i.metadata:void 0;return {frontmatter:{...typeof i.name=="string"?{name:i.name}:{},...typeof(o?.version??i.version)=="string"?{version:o?.version??i.version}:{},...typeof i.description=="string"?{description:i.description}:{}},readable:!0,valid:!0,hasFrontmatter:!0}}catch{return {frontmatter:{},readable:true,valid:false,hasFrontmatter:true}}}function es(e){return [path.join(e,ai),path.join(e,"skill",ai)]}function sn(e,n){if(!li(e))return null;for(let t of es(e)){if(!fs.existsSync(t))continue;let o=Qr(t).frontmatter;return {name:o.name??n,...o.version===void 0?{}:{version:o.version},...o.description===void 0?{}:{description:o.description},skillMdPath:t,dir:e}}return null}function Qn(e){try{return fs.readdirSync(e,{withFileTypes:!0}).filter(qr)}catch{return []}}function ns(e){return e.length===0||/[\\\u0000]/.test(e)?false:e.split("/").every(n=>n.length>0&&n!=="."&&n!=="..")}function di(e,n,t){!e||n.has(e.name)||(n.add(e.name),t.push(e));}function an(e){let n=[],t=new Set;for(let i of e)if(li(i))for(let o of Qn(i)){if(o.name.startsWith("@")){let r=path.join(i,o.name);for(let s of Qn(r))di(sn(path.join(r,s.name),s.name),t,n);continue}di(sn(path.join(i,o.name),o.name),t,n);}return n.sort((i,o)=>i.name.localeCompare(o.name))}function ts(e,n){if(!ns(e))throw new Error(`Skill not found: ${e}`);for(let i of n){let o=sn(path.join(i,e),e);if(o)return o;for(let r of Qn(i)){if(!r.name.startsWith("@"))continue;let s=sn(path.join(i,r.name,e),e);if(s)return s}}let t=an(n).find(i=>i.name===e);if(t)return t;throw new Error(`Skill not found: ${e}`)}async function Tc(e){if(!e||e.root===null)return {skills:[],diagnostics:[]};let{discoverWorkspaceApps:n}=await Promise.resolve().then(()=>(si(),ri)),t=await n(e.root,{productBundle:e}),i=[],o=new Set;for(let r of t.apps){let s=r.provenance?.kind==="bundled"?r.provenance.packageDir:void 0;if(!s)continue;let a=path.join(e.root,...s.split("/"));for(let p of an([path.dirname(a)]))path.resolve(p.dir)!==path.resolve(a)||o.has(p.name)||(o.add(p.name),i.push(p));for(let p of [path.join(a,"skill"),path.join(a,"skills")])for(let d of an([p]))o.has(d.name)||(o.add(d.name),i.push(d));}return {skills:i.sort((r,s)=>r.name.localeCompare(s.name)),diagnostics:t.diagnostics.filter(r=>r.source==="bundled")}}var _c=an,Dc=ts;
+exports.discover=an;exports.discoverBundledProductSkills=Tc;exports.discoverSkills=_c;exports.findEntrypoint=hc;exports.readSkillFrontmatter=Qr;exports.resolve=ts;exports.resolveSkill=Dc;

package/dist/ui-instance/errors.d.ts

@@ -1,4 +1,5 @@
-export type UiRuntimeErrorCode = 'UNAUTHENTICATED' | 'INSTANCE_NOT_FOUND' | 'WORKSPACE_MISMATCH' | 'INSTANCE_NOT_ACTIONABLE' | 'DEFINITION_UNSUPPORTED' | 'CAPABILITY_DENIED' | 'INPUT_INVALID' | 'REVISION_CONFLICT' | 'ACTION_UNAVAILABLE' | 'HANDLER_NOT_FOUND' | 'ACTION_IN_FLIGHT' | 'DOMAIN_REJECTED' | 'EXECUTION_FAILED';
+import type { UiContentErrorCode } from '../mcp-app/content-channel.js';
+export type UiRuntimeErrorCode = 'UNAUTHENTICATED' | 'INSTANCE_NOT_FOUND' | 'WORKSPACE_MISMATCH' | 'INSTANCE_NOT_ACTIONABLE' | 'DEFINITION_UNSUPPORTED' | 'CAPABILITY_DENIED' | 'INPUT_INVALID' | 'REVISION_CONFLICT' | 'ACTION_UNAVAILABLE' | 'HANDLER_NOT_FOUND' | 'ACTION_IN_FLIGHT' | 'DOMAIN_REJECTED' | 'EXECUTION_FAILED' | UiContentErrorCode;
 export declare class UiRuntimeError extends Error {
     readonly code: UiRuntimeErrorCode;
     readonly currentRevision?: number | undefined;

package/dist/ui-instance/index.d.ts

@@ -1,4 +1,4 @@
-export type { ActionReceipt, ActionReceiptOutcome, CreateUiInstanceInput, JsonObject, JsonPrimitive, JsonValue, UiActionHandlerContext, UiActionHandlerRegistration, UiActionHandlerResult, UiActionEnvelope, UiActionConfirmation, UiActor, UiDefinition, UiDefinitionAction, UiDefinitionDisplayMode, UiDefinitionInput, UiDefinitionLegacyMetadata, UiDefinitionRef, UiDefinitionUsage, UiProjectionPolicy, UiExecutionContext, UiAuthenticatedActor, UiTaskActorSnapshot, UiAuthenticatedExecutionContext, UiApprovalRequestContext, UiTaskExecutionContext, UiApprovalDecisionProvenance, UiApprovalPendingReceipt, UiApprovalRequestReceiptResult, UiAuthenticatedGrantPolicy, UiServerRuntimeFacade, UiServerRuntimeOptions, UiAgentContextProjection, UiExternalActionHandlerRegistration, UiInstance, UiInstanceStatus, UiLocalGrantPolicy, UiRuntimeFacade, UiRuntimeOptions, UiStateActionHandlerRegistration, } from './types.js';
+export type { ActionReceipt, ActionReceiptOutcome, CreateUiInstanceInput, JsonObject, JsonPrimitive, JsonValue, UiActionHandlerContext, UiActionHandlerRegistration, UiActionHandlerResult, UiActionEnvelope, UiActionConfirmation, UiSkillBackendEnvironmentKey, UiActor, UiDefinition, UiDefinitionAction, UiDefinitionDisplayMode, UiDefinitionInput, UiDefinitionLegacyMetadata, UiDefinitionRef, UiDefinitionUsage, UiProjectionPolicy, UiExecutionContext, UiAuthenticatedActor, UiTaskActorSnapshot, UiAuthenticatedExecutionContext, UiApprovalRequestContext, UiTaskExecutionContext, UiApprovalDecisionProvenance, UiApprovalPendingReceipt, UiApprovalRequestReceiptResult, UiAuthenticatedGrantPolicy, UiServerRuntimeFacade, UiServerRuntimeOptions, UiAgentContextProjection, UiExternalActionHandlerRegistration, UiInstance, UiInstanceStatus, UiLocalGrantPolicy, UiRuntimeFacade, UiRuntimeOptions, UiStateActionHandlerRegistration, } from './types.js';
 export { isUiAuthenticatedActor, resolveUiEffectiveCapabilities } from './types.js';
 export { UiRuntimeError } from './errors.js';
 export type { UiRuntimeErrorCode } from './errors.js';

package/dist/ui-instance/store.d.ts

@@ -99,8 +99,11 @@ export interface UiAuditSnapshotInput {
 export interface UiInstanceReadStore {
     get(instanceId: string): UiInstance | null;
     listByThread(workspaceId: string, threadId: string): UiInstance[];
+    listUnboundByApp(workspaceId: string, appId: string): UiInstance[];
+    getThreadBinding(workspaceId: string, threadId: string): ThreadBinding;
     close(): void;
 }
+type ThreadBinding = 'bound' | 'unbound' | 'conflict';
 export declare function openUiInstanceReadStore(dbPath?: string, resolveDataPaths?: UiInstanceDataPathResolver): UiInstanceReadStore;
 export declare class UiInstanceStore {
     private readonly handle;
@@ -147,6 +150,8 @@ export declare class UiInstanceStore {
         now: number;
     }): UiInstance;
     listByThread(workspaceId: string, threadId: string, resolveDataPaths?: UiInstanceDataPathResolver): UiInstance[];
+    listUnboundByApp(workspaceId: string, appId: string, resolveDataPaths?: UiInstanceDataPathResolver): UiInstance[];
+    getThreadBinding(workspaceId: string, threadId: string): ThreadBinding;
     updateAuditSnapshot(input: UiAuditSnapshotInput): UiInstance | null;
     getReceipt(instanceId: string, requestId: string): ActionReceipt | null;
     listRecentReceipts(instanceId: string, limit: number): ActionReceipt[];

package/dist/ui-instance/types.d.ts

@@ -1,3 +1,4 @@
+import type { ContentFrame, UiActionContentDeclaration, UiContentChannelPort, UiContentRangeRequest } from '../mcp-app/content-channel.js';
 export type JsonPrimitive = string | number | boolean | null;
 export type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
 export interface JsonObject {
@@ -13,12 +14,15 @@ export type UiDefinitionUsage = 'card' | 'window';
 export type UiDefinitionDisplayMode = 'inline' | 'floating' | 'focused';
 export declare const DEFAULT_UI_DEFINITION_USAGE: UiDefinitionUsage;
 export type UiActionConfirmation = 'none' | 'native';
+export type UiSkillBackendEnvironmentKey = 'CREWX_APP_INSTANCE_ID' | 'CREWX_THREAD_ID';
 export interface UiDefinitionAction {
     readonly capabilities: readonly string[];
     readonly inputKeys?: readonly string[];
     readonly dataInputs?: readonly string[];
     readonly confirmation?: UiActionConfirmation;
     readonly resultProjection?: UiProjectionPolicy;
+    readonly content?: UiActionContentDeclaration;
+    readonly env?: readonly UiSkillBackendEnvironmentKey[];
 }
 export interface UiProjectionPolicy {
     allow: readonly string[];
@@ -92,6 +96,15 @@ export interface UiActionEnvelope {
     requestId: string;
     input: JsonObject;
     resolvedDefinition?: UiDefinitionRef;
+    content?: {
+        in?: {
+            readonly ticket: string;
+            readonly sha256: string;
+        };
+        out?: {
+            readonly range?: UiContentRangeRequest;
+        };
+    };
 }
 export type UiActor = {
     kind: 'local';
@@ -194,15 +207,23 @@ export interface UiActionHandlerContext {
     input: JsonObject;
     requestId: string;
     reservationNow?: number;
+    content?: {
+        readonly in?: ContentFrame;
+        readonly out?: {
+            readonly range?: UiContentRangeRequest;
+        };
+    };
 }
 export type UiActionHandlerResult = {
     state?: JsonObject;
     result?: JsonObject;
+    content?: ContentFrame;
 } | {
     outcome: 'rejected' | 'failed';
     errorCode: string;
     state?: JsonObject;
     result?: JsonObject;
+    content?: ContentFrame;
 };
 export interface UiStateActionHandlerRegistration {
     definitionId: string;
@@ -228,6 +249,7 @@ export interface UiRuntimeOptions {
     definitions?: readonly UiDefinition[];
     handlers?: readonly UiActionHandlerRegistration[];
     clock?: () => number;
+    contentChannel?: UiContentChannelPort;
 }
 export interface UiRuntimeFacade {
     resolveDefinition(ref: UiDefinitionRef): UiDefinition | null;
@@ -256,7 +278,9 @@ export interface UiServerRuntimeOptions {
     definitions: readonly UiDefinition[];
     handlers: readonly UiActionHandlerRegistration[];
     grantPolicy: UiAuthenticatedGrantPolicy;
+    verifiedBundles?: readonly import('../mcp-app/agent-access.js').McpAppVerifiedBundleAccessContext[];
     clock?: () => number;
+    contentChannel?: UiContentChannelPort;
 }
 export interface UiServerRuntimeFacade {
     resolveDefinition(ref: UiDefinitionRef): UiDefinition | null;

package/dist/ui-plugin/csp.d.ts

@@ -0,0 +1,25 @@
+export interface UiPluginCspInput {
+    readonly connectDomains?: readonly string[];
+    readonly frameDomains?: readonly string[];
+    readonly resourceDomains?: readonly string[];
+    readonly baseUriDomains?: readonly string[];
+}
+export type UiPluginCspNormalizationErrorCode = 'CSP_AXIS_UNSUPPORTED' | 'CSP_AXIS_UNKNOWN' | 'CSP_LIMIT_EXCEEDED' | 'CSP_ORIGIN_INVALID' | 'CSP_ORIGIN_FORBIDDEN';
+export interface NormalizedUiPluginCsp {
+    readonly declared: boolean;
+    readonly connectDomains: readonly string[];
+    readonly frameDomains: readonly string[];
+    readonly resourceDomains: readonly [];
+    readonly baseUriDomains: readonly [];
+    readonly cspHash: string;
+}
+export interface UiPluginPolicyRuntime {
+    readonly wasm?: boolean;
+}
+export interface UiPluginPolicyHashInput {
+    readonly runtime?: UiPluginPolicyRuntime;
+    readonly cspHash: string;
+    readonly policySchema: number;
+}
+export declare function normalizeUiPluginCsp(input: UiPluginCspInput | undefined): NormalizedUiPluginCsp;
+export declare function policyHash(input: UiPluginPolicyHashInput): string;

package/dist/ui-plugin/types.d.ts

@@ -1,4 +1,6 @@
 import type { JsonObject, JsonValue, UiActionConfirmation, UiDefinitionInput } from '../ui-instance/types.js';
+import type { UiSkillBackendEnvironmentKey } from '../ui-instance/types.js';
+import type { UiActionContentDeclaration } from '../mcp-app/content-channel.js';
 export type UiPluginPrimitive = 'card-shell' | 'meta-banner' | 'heading' | 'labeled-text' | 'step-flow' | 'text-list';
 export type UiPluginSchemaType = 'text' | 'text-list' | 'step-list';
 export interface UiPluginTextSchema {
@@ -99,6 +101,7 @@ export interface UiPluginCoreBackend {
 export interface UiPluginSkillBackend {
     readonly type: 'skill';
     readonly command: readonly string[];
+    readonly env?: readonly UiSkillBackendEnvironmentKey[];
 }
 export type UiPluginBackend = UiPluginCoreBackend | UiPluginSkillBackend;
 export interface UiPluginAction {
@@ -108,6 +111,7 @@ export interface UiPluginAction {
     readonly inputSchema: UiPluginInputSchema;
     readonly resultProjection: UiPluginProjectionPolicy;
     readonly backend: UiPluginBackend;
+    readonly content?: UiActionContentDeclaration;
     readonly dataInputs?: readonly string[];
     readonly confirmation?: UiActionConfirmation;
     readonly _meta?: JsonObject;
@@ -130,6 +134,9 @@ export interface UiPluginManifestV2 {
     readonly tone?: UiPluginTone;
     readonly entry: 'ui/index.html';
     readonly entryHash?: string;
+    readonly runtime?: {
+        readonly wasm: true;
+    };
     readonly initialState?: {
         readonly path: 'ui/state.json';
         readonly hash?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewx/sdk",
-  "version": "0.9.0-rc.127",
+  "version": "0.9.0-rc.129",
   "license": "UNLICENSED",
   "engines": {
     "node": ">=20.19.0"
@@ -172,6 +172,7 @@
     "db:generate": "cd ../.. && drizzle-kit generate --config drizzle.config.ts && node packages/sdk/scripts/post-generate.mjs",
     "db:check": "cd ../.. && drizzle-kit check --config drizzle.config.ts",
     "test": "vitest run --config ./vitest.config.ts",
+    "test:bundle-provenance-dist": "node scripts/check-bundle-provenance-dist.mjs",
     "test:watch": "vitest --config ./vitest.config.ts",
     "lint": "echo 'SDK lint pending' && exit 0"
   }