@grimoire-rs/indexer 0.2.2 → 0.3.1

package/dist/templates.js

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 The Grimoire Authors
+// The scaffold's tiny template engine, shared by `init` and `ci`. Both write
+// files into somebody else's repository from the same `templates/` tree, so
+// they read and substitute through one implementation.
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { CliError, EXIT } from "./cli/exit.js";
+/** Scaffold templates ship beside `dist/`, so this resolves identically from `src/` and `dist/`. */
+export const TEMPLATE_DIR = fileURLToPath(new URL("../templates/", import.meta.url));
+/** `{{name}}`, but never GitHub Actions' `${{ ... }}` — hence the `$` lookbehind. */
+const PLACEHOLDER = /(?<!\$)\{\{\s*([A-Za-z_]\w*)\s*\}\}/g;
+export function readTemplate(rel) {
+    const file = path.join(TEMPLATE_DIR, rel);
+    try {
+        return fs.readFileSync(file, "utf8");
+    }
+    catch {
+        throw new CliError(`scaffold template ${rel} is missing from ${TEMPLATE_DIR} — the installed package is incomplete`, EXIT.unavailable);
+    }
+}
+/**
+ * Substitute `{{key}}` placeholders. Single pass: a value that itself
+ * contains a placeholder is left alone, so a composed block (the enrich
+ * steps, say) has to be rendered before it is handed in as a value.
+ */
+export function render(template, vars, rel) {
+    return template.replace(PLACEHOLDER, (match, key) => {
+        if (!(key in vars)) {
+            throw new CliError(`scaffold template ${rel} references unknown placeholder {{${key}}}`);
+        }
+        return vars[key];
+    });
+}
+/** Read and substitute in one step — the common case. */
+export function fromTemplate(rel, vars) {
+    return render(readTemplate(rel), vars, rel);
+}
+//# sourceMappingURL=templates.js.map

package/dist/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC,6EAA6E;AAC7E,4EAA4E;AAC5E,uDAAuD;AACvD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE/C,oGAAoG;AACpG,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAErF,qFAAqF;AACrF,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAE3D,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAChB,qBAAqB,GAAG,oBAAoB,YAAY,wCAAwC,EAChG,IAAI,CAAC,WAAW,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,IAA4B,EAAE,GAAW;IAChF,OAAO,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC1D,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,qBAAqB,GAAG,qCAAqC,GAAG,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAW,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,IAA4B;IACpE,OAAO,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC"}

package/dist/validate/adapters/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../src/validate/adapters/files.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMtC;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CAgCnB"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../src/validate/adapters/files.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMtC;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CA0CnB"}

package/dist/validate/adapters/files.js

@@ -29,9 +29,19 @@ export async function readIndexFile(root, relative) {
     if (!contained(base, target)) {
         return { kind: "error", reason: "path escapes the index root" };
     }
-    const stat = await lstat(target).catch(() => null);
-    if (stat === null)
-        return { kind: "missing" };
+    // Only a genuinely absent path is "missing". Every other errno used to
+    // collapse into it, and "missing" now means "an owner deleted this" — so an
+    // EACCES or EIO on a file that also exists in the committed tree, which is
+    // what an ordinary *modification* looks like, would be authorized as a
+    // deletion with its ref, registry host and owner id never read. Neither
+    // template can reach that state, so this closes a fail-open on fault rather
+    // than a live exploit.
+    const stat = await lstat(target).catch((err) => err);
+    if (stat instanceof Error) {
+        if (stat.code === "ENOENT" || stat.code === "ENOTDIR")
+            return { kind: "missing" };
+        return { kind: "error", reason: `cannot read: ${stat.code ?? "unknown error"}` };
+    }
     if (stat.isSymbolicLink()) {
         return { kind: "error", reason: "symlinks are not accepted" };
     }

package/dist/validate/adapters/files.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../src/validate/adapters/files.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAOzD,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,QAAgB;IAEhB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,IAAI,EAAE,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC3E,IAAI,IAAI,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,kBAAkB,QAAQ,EAAE,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../src/validate/adapters/files.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAOzD,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,QAAgB;IAEhB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,IAAI,EAAE,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAClE,CAAC;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,4EAA4E;IAC5E,uBAAuB;IACvB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAA0B,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5E,IAAI,IAAI,YAAY,KAAK,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,IAAI,CAAC,IAAI,IAAI,eAAe,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC3E,IAAI,IAAI,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,kBAAkB,QAAQ,EAAE,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC"}

package/dist/validate/index.js

@@ -137,9 +137,24 @@ async function collectReasons(options) {
 async function checkFile(path, identities, options) {
     const read = await readIndexFile(options.prTree, path.file);
     // A path with no file in the PR tree is a deletion by the namespace owner,
-    // whose ownership was already established above.
-    if (read.kind === "missing")
+    // whose ownership was already established above — but only if there was
+    // something there to delete. A path missing from BOTH trees was never real:
+    // that is what a fabricated or shell-mangled changed-path entry looks like,
+    // and treating it as a deletion authorized a merge on the strength of a
+    // file whose ref, owner id and registry host nobody ever read.
+    if (read.kind === "missing") {
+        // `!== "text"`, not `=== "missing"`. Narrowing the adapter's errno
+        // handling made an unreadable base file `{kind:"error"}` rather than
+        // `missing`, and an `=== "missing"` test then fell through to `null` —
+        // "authorized deletion" — for exactly the fault the narrowing was meant
+        // to stop being silent. Only proof that something IS committed there may
+        // authorize removing it.
+        const committed = await readIndexFile(options.root, path.file);
+        if (committed.kind !== "text") {
+            return "present in neither the contribution nor this repository — manual review";
+        }
         return null;
+    }
     if (read.kind === "error")
         return read.reason;
     const parsed = parseMetadataJson(read.text);

package/dist/validate/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAA0B,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAuC7B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAsB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AAEjF,SAAS,SAAS,CAAC,OAAwB;IACzC,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,OAAO,CAAC,OAAwB;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC5C,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,wBAAwB;QACnD,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,QAAQ,CAAC,OAAwB;IACxC,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAwB;IAExB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,CAAC,qBAAsB,KAAe,CAAC,OAAO,EAAE,CAAC;SAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAwB;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,sBAAsB,GAAG,eAAe,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEtD,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,WAAW,CAAC,IAAI,CACd,GAAG,IAAI,mBAAmB,IAAI,2CAA2C,CAC1E,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAE/C,8CAA8C;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE;QACvC,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CACrE,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3E,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1C,gBAAgB,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,gBAAgB,CAAC,IAAI,CACnB,aAAa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,sBAAsB,IAAI,EAAE,CACnE,CAAC;YACF,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEpC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,KAAK,GACT,GAAG,KAAK,IAAI;YACV,CAAC,CAAC,oEAAoE;gBACpE,uEAAuE;gBACvE,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,CAAC,CAAC,cAAc,CACZ,SAAS,EACT,QAAQ,EACR,OAAO,CAAC,MAAM,EACd,QAAQ,CAAC,IAAI,KAAK,MAAM;gBACtB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CACpD,CAAC;QACR,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,gBAAgB,CAAC,IAAI,CACnB,aAAa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEzD,8BAA8B;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAe,EACf,UAA0C,EAC1C,OAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IAE9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;IAE3B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,+BAA+B,CAAC;IAEnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACzD,OAAO,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,KAAK,OAAO,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAC/B,qEAAqE;IACrE,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;QACzE,IAAI,EAAE,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC,0BAA0B,CAAC;QAC7D,SAAS,EAAE,OAAO,CAAC,aAAa;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,wCAAwC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAe,EACf,SAAmB,EACnB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,cAAc;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,oCAAoC,IAAI,CAAC,MAAM,mBAAmB,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,kCAAkC,MAAM,CAAC,MAAM,GAAG,CAAC;IAC1E,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,+BAA+B,SAAS,CAAC,MAAM,mBAAmB,CAAC;IAC5E,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACpD,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAA0B,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAuC7B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAsB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AAEjF,SAAS,SAAS,CAAC,OAAwB;IACzC,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,OAAO,CAAC,OAAwB;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC5C,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,wBAAwB;QACnD,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,QAAQ,CAAC,OAAwB;IACxC,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAwB;IAExB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,CAAC,qBAAsB,KAAe,CAAC,OAAO,EAAE,CAAC;SAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAwB;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,sBAAsB,GAAG,eAAe,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEtD,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,WAAW,CAAC,IAAI,CACd,GAAG,IAAI,mBAAmB,IAAI,2CAA2C,CAC1E,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAE/C,8CAA8C;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE;QACvC,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CACrE,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3E,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1C,gBAAgB,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,gBAAgB,CAAC,IAAI,CACnB,aAAa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,sBAAsB,IAAI,EAAE,CACnE,CAAC;YACF,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEpC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,KAAK,GACT,GAAG,KAAK,IAAI;YACV,CAAC,CAAC,oEAAoE;gBACpE,uEAAuE;gBACvE,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,CAAC,CAAC,cAAc,CACZ,SAAS,EACT,QAAQ,EACR,OAAO,CAAC,MAAM,EACd,QAAQ,CAAC,IAAI,KAAK,MAAM;gBACtB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CACpD,CAAC;QACR,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,gBAAgB,CAAC,IAAI,CACnB,aAAa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEzD,8BAA8B;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAe,EACf,UAA0C,EAC1C,OAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,+DAA+D;IAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,yEAAyE,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IAE9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;IAE3B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,+BAA+B,CAAC;IAEnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACzD,OAAO,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,KAAK,OAAO,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAC/B,qEAAqE;IACrE,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;QACzE,IAAI,EAAE,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC,0BAA0B,CAAC;QAC7D,SAAS,EAAE,OAAO,CAAC,aAAa;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,wCAAwC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAe,EACf,SAAmB,EACnB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,cAAc;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,oCAAoC,IAAI,CAAC,MAAM,mBAAmB,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,kCAAkC,MAAM,CAAC,MAAM,GAAG,CAAC;IAC1E,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,+BAA+B,SAAS,CAAC,MAAM,mBAAmB,CAAC;IAC5E,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACpD,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grimoire-rs/indexer",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "description": "CLI + Astro integration for running your own grim package index",
   "type": "module",
   "license": "Apache-2.0",
@@ -25,7 +25,7 @@
     }
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json && mkdir -p dist/renderer/astro dist/renderer/public && cp -r src/renderer/astro/. dist/renderer/astro/ && cp -r src/renderer/public/. dist/renderer/public/",
+    "build": "tsc -p tsconfig.json && mkdir -p dist/renderer/astro dist/renderer/public && cp -r src/renderer/astro/. dist/renderer/astro/ && cp -r src/renderer/public/. dist/renderer/public/ && node scripts/prune-template-maps.mjs",
     "dev": "npm run build && node scripts/dev.mjs",
     "dev:smoke": "npm run build && node scripts/dev.mjs --smoke",
     "test": "vitest run",

package/templates/README.md

@@ -1,6 +1,6 @@
 # {{title}}
 
-A [Grimoire](https://github.com/grimoire-rs/grimoire) package index — a
+A [Grimoire](https://github.com/grimoire-rs/grimoire) package index - a
 static site listing the skills, rules, agents, mcp servers, and bundles
 available in `{{registryHost}}`, served at {{baseUrl}}.
 
@@ -8,41 +8,137 @@ available in `{{registryHost}}`, served at {{baseUrl}}.
 
 | Path | Purpose |
 |---|---|
-| `index/<namespace>/<package>/metadata.json` | One entry per package — the source of truth |
-| `index.config.json` | Site identity: title, base URL, registry, branding |
+| `index/<host>/<namespace>/<package>/metadata.json` | One entry per package - the source of truth |
+| `index.config.json` | Site identity, branding, and the `ci` block the workflows are rendered from |
 | `index-policy.json` | Committed allowlist of registry hosts contributions may point at |
-| `dist/` | Build output (`all.json`, per-path copies, the rendered site) — not committed |
+| `package.json` / `package-lock.json` | The renderer this index runs, pinned |
+| `dist/` | Build output (`all.json`, per-path copies, the rendered site) - not committed |
+
+## Getting set up
+
+```sh
+npm install
+```
+
+That is the whole toolchain. `package-lock.json` pins the exact renderer this
+index builds, validates and deploys with - commit it, because CI installs from
+it with `npm ci` and nothing is resolved on the runner.
+
+## Everyday workflow
+
+| Command | What it does |
+|---|---|
+| `npm run dev` | Serve the index locally with a live preview |
+| `npm run build` | Compile `index/**` into `dist/` and render the site |
+| `npm run validate` | Run the contribution gate over changed paths |
+| `npm run enrich` | Refresh READMEs, logos and version lists from the registry (needs `grim`) |
+| `npm run ci` | Re-render the CI workflows from `index.config.json` |
+| `npm run ci:check` | Fail if the committed workflows have drifted from the config |
+
+### Review a change locally
+
+```sh
+npm run dev
+```
+
+`dev` prints the URL to open once it is up - the site exactly as it deploys.
+A domain-rooted `site` serves at `http://localhost:4321`; a project-Pages
+`site` (`https://<owner>.github.io/<repo>`) serves under a `/<repo>` path
+segment instead, because that is Astro's `base` for that layout too.
+
+Entries under `index/` and the settings in `index.config.json` are read once,
+at start-up, so restart after editing them. The dev server renders through the
+same code path `npm run build` does: what you see is what deploys.
+
+### Test a contribution before you open the pull request
+
+`validate` is the same gate CI runs, and the same exit-code contract - 0
+means eligible for auto-merge, non-zero means a maintainer takes a look -
+but CI reads the forge identity and the PR tree off the platform, so a
+local run has to supply them by hand:
+
+```sh
+npm run validate -- \
+  --root . --pr-tree . \
+  --forge github --author-login <your-github-login> --author-id <your-numeric-id> \
+  -- index/<host>/<your-namespace>/<your-package>/metadata.json
+```
+
+`--root` and `--pr-tree` both point at your own checkout here; CI points
+them at two different checkouts (the trusted base and the PR head) so it
+can also catch a re-registered login trying to inherit someone else's
+package - fine to collapse for a solo sanity check, not something CI does.
+`--author-id` is your numeric forge account id, not your login - find yours
+at `https://api.github.com/users/<your-github-login>`. The gate makes real
+calls to the forge API and to the registry, so it needs network access and
+an entry that is actually yours to pass.
 
 ## Contributing a package
 
-Add `index/<namespace>/<package>/metadata.json`, then open a pull request.
-CI runs `grim-indexer validate` on it: a clean run means the entry is
-eligible for auto-merge, a failing one means a maintainer takes a look.
+Add `index/<host>/<your-namespace>/<your-package>/metadata.json` (`<host>`
+is the forge this repo is hosted on, e.g. `github.com`), then open a pull
+request.
 
 ```json
 {
   "schema": 1,
   "name": "{{name}}-example",
   "kind": "skill",
-  "ref": "{{registryHost}}/{{registryAlias}}/skills/{{name}}-example:1.0.0",
+  "ref": "{{registryHost}}/{{registryAlias}}/skills/{{name}}-example",
   "description": "One line describing what this package does.",
-  "owner": { "id": 0, "github": "your-github-login" }
+  "owner": { "id": 12345678, "github": "your-github-login" }
 }
 ```
 
 The directory name must equal `name`, and `kind` is one of `skill`,
-`rule`, `agent`, `mcp`, `bundle`.
+`rule`, `agent`, `mcp`, `bundle`. `ref` names a repository, not a tag or
+digest - the gate resolves it to whatever is published. `owner.id` must be
+your real numeric GitHub account id, not the placeholder above - find yours
+at `https://api.github.com/users/your-github-login`; the gate checks it
+against the forge, not the `github` login, since a login can be
+re-registered by someone else.
 
-## Local development
+## CI
+
+This repo owns and runs its own CI: the workflow files are committed here, not
+called from anywhere else. They are *rendered* from the `ci` block of
+`index.config.json`, so the way to change what CI does is to change the config
+and run `npm run ci`.
+
+| Key | Default | What it changes |
+|---|---|---|
+| `forge` | `github` | Which pipeline is rendered - `github` or `gitlab` |
+| `nodeVersion` | `22` | Node the jobs run on, and the GitLab image tag |
+| `enrich` | `true` | Pull READMEs, logos and version lists from the registry before building |
+| `grimVersion` | `latest` | grim release the enrichment step uses |
+| `autoMerge` | `false` | Squash-merge a pull request the gate passed, then deploy (GitHub only) |
+| `allowManualEdits` | `false` | Own the files by hand; drops the drift guard |
+
+`autoMerge` is off until you turn it on: merging an untrusted contribution
+unattended is your policy to set, not this package's to assume. It is GitHub
+only, and that is not an oversight - GitHub always runs the base branch's copy
+of a `pull_request_target` workflow, so the gate a pull request faces is one it
+cannot edit. On GitLab the merge request supplies its own `.gitlab-ci.yml` and a
+fork's pipeline runs in the fork, so an auto-merge there would act on a verdict
+the contributor wrote. Setting `autoMerge` with `forge: gitlab` is refused
+rather than rendered inert.
+
+A `verify-ci` job re-renders and diffs on every change that can produce
+drift - pushes and pull requests touching `index.config.json`,
+`package.json`, `package-lock.json`, or `.github/workflows/**` - so a
+hand-edit fails CI instead of silently forking. Action pins are excluded
+from that diff, so Renovate may bump `uses: owner/action@<ref>` freely.
+
+To pick up renderer fixes, bump `@grimoire-rs/indexer` the ordinary npm way and
+re-render:
 
 ```sh
-npx @grimoire-rs/indexer build      # index/** -> dist/
-npx @grimoire-rs/indexer validate   # run the contribution gate locally
+npm update @grimoire-rs/indexer
+npm run ci
 ```
 
-## Upgrading CI
-
-The workflows in this repo are thin callers of reusable workflows that
-[grim-indexer](https://github.com/grimoire-rs/indexer) owns. To
-pick up CI fixes, bump the pinned ref in the `uses:` line — nothing needs
-re-scaffolding, and your local edits are never overwritten.
+No CI *definitions* are fetched from outside this repo - no reusable
+workflow, no remote `include:` - so what you review in a diff is exactly
+what runs. The jobs themselves still reach the network: `npm ci` from the
+npm registry, `uses: actions/...@<sha>` from GitHub, and - with `enrich`
+on - a grim release tarball.

package/templates/ci/github-automerge.yml

@@ -0,0 +1,36 @@
+
+  # `needs: validate` is the entire safety condition. The gate's exit code is
+  # the authorization - 0 means "eligible for auto-merge" - and `needs:` is
+  # what turns that into "this job does not start". A cancelled or skipped
+  # gate is not a success either, so both also stop here.
+  #
+  # This job checks nothing out. Contributor content never touches the runner
+  # that holds the write token; the only thing it does with the pull request is
+  # name its number to `gh`.
+  #
+  # `--match-head-commit` closes the window between the two jobs: the gate
+  # judged one head sha, and without this a push landing while it ran would be
+  # what got merged - the contribution reviewed and the contribution merged
+  # would be different commits. Mismatch fails the job, and the next
+  # `synchronize` event re-runs the gate against the new head anyway.
+  automerge:
+    needs: validate
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write # dispatch pages.yml after the merge
+    steps:
+      - name: Merge and deploy
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          set -euo pipefail
+          gh pr merge "$PR" --repo "$REPO" --squash --match-head-commit "$HEAD_SHA"
+          # A push made with GITHUB_TOKEN triggers no workflow, so the merge
+          # this job just made would never build the site. Dispatch it.
+          gh workflow run pages.yml --repo "$REPO" --ref "$BRANCH"

package/templates/ci/github-enrich.yml

@@ -0,0 +1,27 @@
+
+      # The index stores pointers; everything a reader looks at - README,
+      # changelog, logo, version list - lives in the registry, and grim is
+      # what reads a registry. `ci.grimVersion` pins the binary.
+      - name: Install grim
+        env:
+          # Resolved from `ci.grimVersion` when this file was rendered, so
+          # there is no version branch left to take at run time.
+          GRIM_RELEASE_BASE: "{{grimReleaseBase}}"
+        run: |
+          set -euo pipefail
+          tarball="grimoire-$(uname -m)-unknown-linux-gnu.tar.gz"
+          cd "$(mktemp -d)"
+          curl -fsSL --proto '=https' --tlsv1.2 \
+            -O "${GRIM_RELEASE_BASE}/${tarball}" -O "${GRIM_RELEASE_BASE}/${tarball}.sha256"
+          sha256sum -c "${tarball}.sha256"
+          tar -xzf "${tarball}" --strip-components=1 --wildcards -C /usr/local/bin '*/grim'
+          grim --version
+
+      # Enrichment is best-effort by design: a registry outage must degrade
+      # the site to pointers-only, never block a deploy that is otherwise
+      # ready. `enrich` itself keeps any sidecar it fails to refresh. Set
+      # `"enrich": false` in the `ci` block to drop these two steps entirely.
+      - name: Refresh package metadata
+        run: |
+          npm run enrich ||
+            echo "::warning::enrich failed - building without READMEs, logos and version lists"

package/templates/ci/github-pages.yml

@@ -0,0 +1,64 @@
+{{header}}
+# Builds this index and deploys it to GitHub Pages.
+#
+# Enable it once, in Settings -> Pages -> Source: "GitHub Actions". Until
+# that is set, this workflow runs green and deploys nothing.
+name: pages
+
+on:
+  push:
+    branches: [{{defaultBranch}}]
+  workflow_dispatch:
+
+# Default-deny at the top; every job pays for exactly what it needs.
+permissions: {}
+
+concurrency:
+  group: grim-indexer-pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "{{nodeVersion}}"
+          cache: npm
+
+      # `npm ci` installs exactly package-lock.json, so which renderer builds
+      # this site is a reviewed fact in the repository, not a resolution that
+      # happens on the runner. `--ignore-scripts` because this job runs
+      # MERGED contributor content: a `prepare` script or a lock entry that
+      # arrived through an auto-merged pull request would otherwise execute
+      # here, in the job that publishes the site.
+      - name: Install
+        run: npm ci --ignore-scripts
+{{githubEnrichSteps}}
+      - name: Build index
+        run: npm run build
+
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: dist
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

package/templates/ci/github-publish.yml

@@ -0,0 +1,89 @@
+{{header}}
+# Publishes this repository's own packages to the registry, then announces
+# them into the index that lives beside them - the combined layout
+# `grim-indexer init --with-skills` scaffolds. `publish.toml` says what gets
+# pushed and where; the `ci.publish` key in index.config.json says when.
+#
+# ONE REPOSITORY SETTING is needed and cannot be set from here: Settings ->
+# Actions -> General -> Workflow permissions -> "Allow GitHub Actions to
+# create and approve pull requests". Without it the packages publish and the
+# announce then fails with a 403 opening the pull request.
+name: publish
+
+on:
+{{publishTrigger}}
+  workflow_dispatch:
+
+# Default-deny at the top; the job pays for exactly what it needs.
+permissions: {}
+
+# Serialized against itself. Two publishes racing would both read the same
+# "already published?" answer and both push.
+concurrency:
+  group: grim-indexer-publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Pushing to this repository's own GHCR packages.
+      packages: write
+      # `--announce` opens its pull request against THIS repository, because in
+      # the combined layout this repository is the index.
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # The same pinned-by-config install the enrichment step uses: a release
+      # tarball whose checksum is verified before it runs, at the version
+      # `ci.grimVersion` resolved when this file was rendered.
+      - name: Install grim
+        env:
+          GRIM_RELEASE_BASE: "{{grimReleaseBase}}"
+        run: |
+          set -euo pipefail
+          tarball="grimoire-$(uname -m)-unknown-linux-gnu.tar.gz"
+          cd "$(mktemp -d)"
+          curl -fsSL --proto '=https' --tlsv1.2 \
+            -O "${GRIM_RELEASE_BASE}/${tarball}" -O "${GRIM_RELEASE_BASE}/${tarball}.sha256"
+          sha256sum -c "${tarball}.sha256"
+          tar -xzf "${tarball}" --strip-components=1 --wildcards -C /usr/local/bin '*/grim'
+          grim --version
+
+      # The defaults are the zero-setup GHCR path: the built-in token can push
+      # to this repository's own packages, so nothing has to be configured.
+      # Publishing anywhere else is three repository settings and no edit to
+      # this generated file - set the variables GRIM_REGISTRY_HOST and
+      # GRIM_REGISTRY_USER, and the secret GRIM_REGISTRY_TOKEN.
+      - name: Log in to the registry
+        env:
+          REGISTRY: ${{ vars.GRIM_REGISTRY_HOST || 'ghcr.io' }}
+          REGISTRY_USER: ${{ vars.GRIM_REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.GRIM_REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$REGISTRY_TOKEN" | grim login "$REGISTRY" \
+            -u "$REGISTRY_USER" --password-stdin --allow-insecure-store
+
+      # `--announce` opens the pull request through the REST API, but the
+      # branch it proposes is pushed over git - which reads the token from
+      # git's credential helper, not from the environment.
+      - name: Wire the announce token into git
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh auth setup-git
+
+      # Skip-existing is the default, so a re-run over unchanged versions is a
+      # no-op and only a bumped version pushes. That is what makes triggering
+      # on every default-branch push reasonable.
+      #
+      # THE PULL REQUEST THIS OPENS IS NOT GATED. GitHub runs no workflows on a
+      # pull request opened with the built-in token, so `validate` never fires
+      # on it - review it, or merge it knowing nothing checked it. That is the
+      # standing cost of the combined layout, not a fault in this workflow.
+      - name: Publish and announce
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: grim publish --announce