@lesliechan721/aw 0.1.0-beta.3

package/dist/authoring/scripts/validate-plugin.mjs

@@ -0,0 +1,4442 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import { createRequire } from 'node:module';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { checkPluginVersions } from './lib/plugin-version-check.mjs';
+import { scanJavaScriptImportSpecifiers } from './lib/javascript-import-scanner.mjs';
+import { assertAuthoringPluginPathFence, assertCanonicalAuthoringPluginRoot, } from './lib/plugin-root.mjs';
+const require = createRequire(import.meta.url);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const authoringRuntimeRoot = path.resolve(__dirname, '..', '..');
+const CLI_PACKAGE_ROOT = path.basename(authoringRuntimeRoot) === 'dist'
+    ? path.dirname(authoringRuntimeRoot)
+    : authoringRuntimeRoot;
+const errors = [];
+const warnings = [];
+let pluginAuthoringCapabilityRegistry = null;
+const SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION = 7;
+const MAX_SKILL_NAME_LEN = 64;
+const MAX_SKILL_DESCRIPTION_LEN = 1024;
+const MAX_SKILL_COMPATIBILITY_LEN = 500;
+const MAX_SKILL_SHORT_DESCRIPTION_LEN = 1024;
+const MAX_SKILL_LINES = 500;
+const MAX_OPENAI_INTERFACE_NAME_LEN = 64;
+const MIN_OPENAI_INTERFACE_DESCRIPTION_LEN = 25;
+const MAX_OPENAI_INTERFACE_DESCRIPTION_LEN = 64;
+const MAX_OPENAI_DEFAULT_PROMPT_LEN = 1024;
+const MAX_OPENAI_DEPENDENCY_TYPE_LEN = 64;
+const MAX_OPENAI_DEPENDENCY_TRANSPORT_LEN = 64;
+const MAX_OPENAI_DEPENDENCY_VALUE_LEN = 1024;
+const MAX_OPENAI_DEPENDENCY_DESCRIPTION_LEN = 1024;
+const MAX_OPENAI_DEPENDENCY_COMMAND_LEN = 1024;
+const MAX_OPENAI_DEPENDENCY_URL_LEN = 1024;
+const CLAUDE_FRONTMATTER_SHELLS = new Set(['bash', 'powershell']);
+const CLAUDE_SLASH_COMMAND_ONLY_FIELDS = new Set([
+    'allowed-tools',
+    'model',
+    'argument-hint',
+    'disable-model-invocation',
+    'shell',
+]);
+const CODEX_POLICY_PRODUCTS = new Set([
+    'atlas',
+    'ATLAS',
+    'chatgpt',
+    'CHATGPT',
+    'codex',
+    'CODEX',
+]);
+const MANIFEST_POLICY_PRODUCTS = new Set(getPluginAuthoringAcceptedValues('plugin-manifest', 'marketplace.policy.products'));
+const MARKETPLACE_AUTHENTICATION_POLICIES = new Set(getPluginAuthoringAcceptedValues('plugin-manifest', 'marketplace.policy.authentication'));
+const MARKETPLACE_INSTALLATION_POLICIES = new Set(getPluginAuthoringAcceptedValues('plugin-manifest', 'marketplace.policy.installation'));
+const PUBLIC_HOOK_EVENTS = new Set(['before_tool', 'after_tool', 'session_start']);
+const PUBLIC_SESSION_START_SOURCES = new Set(['startup', 'resume', 'clear']);
+const PUBLIC_SESSION_START_DEFAULT_MATCHER = 'startup|resume|clear';
+const PUBLIC_HOOK_RENDER_MAP = {
+    claude: {
+        before_tool: 'PreToolUse',
+        after_tool: 'PostToolUse',
+        session_start: 'SessionStart',
+    },
+    codex: {
+        before_tool: 'PreToolUse',
+        after_tool: 'PostToolUse',
+        session_start: 'SessionStart',
+    },
+};
+const NATIVE_HOOK_EVENTS = {
+    claude: new Set([
+        'PreToolUse',
+        'PostToolUse',
+        'PostToolUseFailure',
+        'Notification',
+        'UserPromptSubmit',
+        'SessionStart',
+        'SessionEnd',
+        'Stop',
+        'StopFailure',
+        'SubagentStart',
+        'SubagentStop',
+        'PreCompact',
+        'PostCompact',
+        'PermissionRequest',
+        'PermissionDenied',
+        'Setup',
+        'TeammateIdle',
+        'TaskCreated',
+        'TaskCompleted',
+        'Elicitation',
+        'ElicitationResult',
+        'ConfigChange',
+        'WorktreeCreate',
+        'WorktreeRemove',
+        'InstructionsLoaded',
+        'CwdChanged',
+        'FileChanged',
+    ]),
+    codex: new Set([
+        'PreToolUse',
+        'PermissionRequest',
+        'PostToolUse',
+        'SessionStart',
+        'UserPromptSubmit',
+        'Stop',
+    ]),
+};
+const MATCHERLESS_NATIVE_HOOK_EVENTS = {
+    claude: new Set([
+        'UserPromptSubmit',
+        'Stop',
+        'TeammateIdle',
+        'TaskCreated',
+        'TaskCompleted',
+        'WorktreeCreate',
+        'WorktreeRemove',
+        'CwdChanged',
+    ]),
+    codex: new Set(['UserPromptSubmit', 'Stop']),
+};
+const TEMPLATE_TEXT_FILE_EXTENSIONS = /\.(md|markdown|txt|json|yaml|yml|toml|rules)$/i;
+const SLASH_COMMAND_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const DEFAULT_SLASH_COMMANDS_DIR = 'slash-commands';
+const SCRIPT_NODE_EXTENSIONS = new Set(['.js', '.mjs', '.cjs']);
+const SCRIPT_AUTO_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.sh', '.ps1', '.cmd', '.bat']);
+const SCRIPT_RUNNERS = new Set(['node', 'sh', 'bash', 'pwsh', 'powershell', 'cmd', 'auto']);
+const SCRIPT_OS_SELECTORS = new Set(['default', 'unix', 'windows', 'linux', 'darwin', 'win32']);
+const SCRIPT_LIFECYCLE_EVENTS = new Set(['install', 'upgrade', 'uninstall']);
+const SCRIPT_TIMEOUT_MIN_MS = 1000;
+const SCRIPT_TIMEOUT_MAX_MS = 300000;
+const CONFIG_FIELD_TYPES = new Set(getPluginAuthoringAcceptedValues('config-lifecycle-artifact', 'config.schema.<key>.type'));
+const ARTIFACT_TARGETS = new Set(getPluginAuthoringAcceptedValues('config-lifecycle-artifact', 'artifacts.targets[].target'));
+const ARTIFACT_STATES = new Set(getPluginAuthoringAcceptedValues('config-lifecycle-artifact', 'ArtifactPlan.artifacts[].state'));
+const ARTIFACT_SCOPES = new Set(['user', 'project']);
+const ARTIFACT_KINDS = new Set(['instruction', 'codexRole', 'skill']);
+const ARTIFACT_PROJECT_MANAGED_KINDS = new Set(['instruction', 'agent', 'skill']);
+const ARTIFACT_KIND_BY_TARGET = {
+    'codex.developerInstructionsBlock': 'instruction',
+    'codex.agentRole': 'codexRole',
+    'codex.skill': 'skill',
+    'claude.skill': 'skill',
+    'agent-skills.skill': 'skill',
+};
+const ARTIFACT_PROJECT_MANAGED_KIND_BY_TARGET = {
+    'codex.developerInstructionsBlock': 'instruction',
+    'codex.agentRole': 'agent',
+    'codex.skill': 'skill',
+};
+const PLUGIN_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const PLUGIN_EVAL_SCHEMA_VERSION = 2;
+const PLUGIN_EVAL_CASE_SCHEMA_VERSION = 1;
+const PLUGIN_EVAL_SCOPES = new Set(['user', 'project']);
+const PLUGIN_EVAL_SPLITS = new Set(['train', 'validation', 'sanity', 'all']);
+const PLUGIN_EVAL_TRIGGER_CASE_SPLITS = new Set(['train', 'validation', 'sanity']);
+const PLUGIN_EVAL_COMMAND_SUPPORTS = new Set([
+    'split',
+    'runs',
+    'case',
+    'model',
+    'codexBin',
+    'timeout',
+    'allowEnvironmentSkips',
+]);
+let yamlParser = null;
+let skillFrontmatterCapabilityRegistry = null;
+let pluginVersionCheckResult = null;
+function error(msg) {
+    errors.push(msg);
+}
+function warn(msg) {
+    warnings.push(msg);
+}
+function loadYamlParser(sourceName) {
+    if (yamlParser)
+        return yamlParser;
+    try {
+        yamlParser = require('yaml');
+        return yamlParser;
+    }
+    catch (e) {
+        throw new Error(`${sourceName}: YAML parser dependency "yaml" is not installed; run pnpm install in the agent-workflows repo`);
+    }
+}
+function stripStandaloneTemplateControlLines(content) {
+    return content
+        .replace(/\r\n/g, '\n')
+        .split('\n')
+        .map((line) => {
+        const trimmed = line.trim();
+        if (/^{{[#/^]/.test(trimmed) || /^{{else\b/.test(trimmed)) {
+            return '';
+        }
+        return line;
+    })
+        .join('\n');
+}
+function stripDotSlash(value) {
+    return value.startsWith('./') ? value.slice(2) : value;
+}
+function escapeRegexSegment(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function compileGlob(pattern) {
+    const normalized = pattern.split(path.sep).join('/');
+    let source = '^';
+    for (let index = 0; index < normalized.length; index += 1) {
+        const char = normalized[index];
+        const next = normalized[index + 1];
+        if (char === '*' && next === '*') {
+            source += '.*';
+            index += 1;
+            continue;
+        }
+        if (char === '*') {
+            source += '[^/]*';
+            continue;
+        }
+        if (char === '?') {
+            source += '.';
+            continue;
+        }
+        source += escapeRegexSegment(char);
+    }
+    source += '$';
+    return new RegExp(source);
+}
+function normalizeRelativePath(filePath) {
+    return path.posix.normalize(stripDotSlash(filePath).split(path.sep).join('/'));
+}
+function matchesGlob(filePath, pattern) {
+    return compileGlob(pattern).test(normalizeRelativePath(filePath));
+}
+function isTemplateTextFile(relativePath) {
+    return TEMPLATE_TEXT_FILE_EXTENSIONS.test(relativePath);
+}
+function templateIncludesPath(manifest, relativePath) {
+    const normalized = normalizeRelativePath(relativePath);
+    const include = manifest.buildConfig?.templates?.include;
+    if (!Array.isArray(include) || !isTemplateTextFile(normalized))
+        return false;
+    return include.some((pattern) => matchesGlob(normalized, pattern));
+}
+function resolveTemplateValue(vars, platform) {
+    const resolved = {};
+    for (const [key, entry] of Object.entries(vars)) {
+        if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+            resolved[key] = entry[platform];
+        }
+    }
+    return resolved;
+}
+function replaceConditionalBlocks(input, resolvedVars, tagName) {
+    const pattern = new RegExp(`{{#${tagName}\\s+([a-zA-Z0-9_]+)}}([\\s\\S]*?){{\\/${tagName}}}`, 'g');
+    return input.replace(pattern, (_match, rawKey, blockContent) => {
+        const truthy = resolvedVars[rawKey] === true;
+        if (tagName === 'if') {
+            return truthy ? blockContent : '';
+        }
+        return truthy ? '' : blockContent;
+    });
+}
+function renderTemplate(content, vars, platform) {
+    const resolvedVars = resolveTemplateValue(vars, platform);
+    const withConditionals = replaceConditionalBlocks(replaceConditionalBlocks(content, resolvedVars, 'if'), resolvedVars, 'unless');
+    return withConditionals.replace(/{{([a-zA-Z0-9_]+)}}/g, (_match, rawKey) => {
+        const value = resolvedVars[rawKey];
+        if (value === undefined)
+            return '';
+        return String(value);
+    });
+}
+function renderTemplateForPlatform(manifest, relativePath, content, platform) {
+    if (!templateIncludesPath(manifest, relativePath))
+        return content;
+    const vars = manifest.buildConfig?.templates?.vars ?? {};
+    return renderTemplate(content, vars, platform);
+}
+function renderedContentVariants(manifest, relativePath, content, platforms) {
+    if (!templateIncludesPath(manifest, relativePath)) {
+        return [{ content, platform: null }];
+    }
+    const seen = new Set();
+    const variants = [];
+    for (const platform of platforms) {
+        const rendered = renderTemplateForPlatform(manifest, relativePath, content, platform);
+        if (seen.has(rendered))
+            continue;
+        seen.add(rendered);
+        variants.push({ content: rendered, platform });
+    }
+    return variants;
+}
+function formatYamlError(parseError, lineCounter, sourceName) {
+    let location = '';
+    if (Array.isArray(parseError.pos) && Number.isInteger(parseError.pos[0])) {
+        const linePos = lineCounter.linePos(parseError.pos[0]);
+        location = `:${linePos.line}:${linePos.col}`;
+    }
+    let message = parseError.message || String(parseError);
+    if (parseError.code === 'BLOCK_AS_IMPLICIT_KEY') {
+        message = `${message}; plain scalar values containing ": " must be quoted`;
+    }
+    return `${sourceName}${location}: ${message}`;
+}
+function parseYaml(content, sourceName) {
+    const yaml = loadYamlParser(sourceName);
+    const lineCounter = new yaml.LineCounter();
+    const document = yaml.parseDocument(stripStandaloneTemplateControlLines(content), {
+        lineCounter,
+        prettyErrors: false,
+    });
+    if (document.errors.length > 0) {
+        throw new Error(formatYamlError(document.errors[0], lineCounter, sourceName));
+    }
+    const value = document.toJSON();
+    return value ?? {};
+}
+function parseFrontmatter(content, sourceName) {
+    const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!match)
+        return null;
+    return parseYaml(match[1], sourceName);
+}
+function loadPluginAuthoringCapabilityRegistry() {
+    if (pluginAuthoringCapabilityRegistry)
+        return pluginAuthoringCapabilityRegistry;
+    const registryPath = [
+        path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'plugin-authoring-capabilities.json'),
+        path.resolve(__dirname, '..', '..', 'dist', 'src', 'utils', 'plugin-authoring-capabilities.json'),
+    ].find((candidate) => fs.existsSync(candidate));
+    if (!registryPath) {
+        throw new Error('Plugin authoring capability registry not found in the built CLI.');
+    }
+    const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+    if (!registry || registry.schemaVersion !== 1 || !registry.surfaces) {
+        throw new Error(`Invalid plugin authoring capability registry: ${registryPath}`);
+    }
+    pluginAuthoringCapabilityRegistry = registry;
+    return registry;
+}
+function getPluginAuthoringAcceptedValues(surface, field) {
+    const entry = loadPluginAuthoringCapabilityRegistry().surfaces[surface]?.entries
+        ?.find((candidate) => candidate.field === field);
+    if (!entry || !Array.isArray(entry.acceptedValues)) {
+        throw new Error(`Plugin authoring capability ${surface}.${field} has no accepted values.`);
+    }
+    return entry.acceptedValues;
+}
+function loadSkillFrontmatterCapabilityRegistry() {
+    if (skillFrontmatterCapabilityRegistry)
+        return skillFrontmatterCapabilityRegistry;
+    const registryPath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'skill-frontmatter-capabilities.json');
+    if (!fs.existsSync(registryPath)) {
+        throw new Error(`Skill frontmatter capability registry not found: ${registryPath}`);
+    }
+    const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+    if (!registry ||
+        registry.schemaVersion !== 1 ||
+        !registry.profiles ||
+        !registry.fields) {
+        throw new Error(`Invalid Skill frontmatter capability registry: ${registryPath}`);
+    }
+    skillFrontmatterCapabilityRegistry = registry;
+    return registry;
+}
+async function tryLoadCliManifestTools() {
+    const manifestModulePath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'manifest.js');
+    const runtimeProjectionModulePath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'catalog-runtime-projection.js');
+    if (!fs.existsSync(manifestModulePath) || !fs.existsSync(runtimeProjectionModulePath))
+        return null;
+    try {
+        const [manifestModule, runtimeProjectionModule] = await Promise.all([
+            import(pathToFileURL(manifestModulePath).href),
+            import(pathToFileURL(runtimeProjectionModulePath).href),
+        ]);
+        if (manifestModule.SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION
+            !== SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION) {
+            return null;
+        }
+        return {
+            assertPluginInputTree: manifestModule.assertPluginInputTree ?? null,
+            validateSourcePluginManifest: manifestModule.validateSourcePluginManifest ?? null,
+            readPluginManifest: manifestModule.readPluginManifest ?? null,
+            discoverPlugins: manifestModule.discoverPlugins ?? null,
+            createRuntimeResolver: runtimeProjectionModule.createCatalogRuntimeImportResolver ?? null,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function tryLoadCliSkillValidationTools() {
+    const modulePath = path.join(CLI_PACKAGE_ROOT, 'dist', 'src', 'utils', 'skill-validation.js');
+    if (!fs.existsSync(modulePath))
+        return null;
+    try {
+        const mod = await import(pathToFileURL(modulePath).href);
+        if (typeof mod.parseSkillFrontmatter !== 'function'
+            || typeof mod.validateSkillFrontmatter !== 'function'
+            || typeof mod.validateCodexMetadata !== 'function') {
+            return null;
+        }
+        return {
+            parseSkillFrontmatter: mod.parseSkillFrontmatter,
+            validateSkillFrontmatter: mod.validateSkillFrontmatter,
+            validateCodexMetadata: mod.validateCodexMetadata,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function findRepoRootCandidate(pluginDir) {
+    let currentPath = path.dirname(pluginDir);
+    while (true) {
+        if (fs.lstatSync(path.join(currentPath, '.git'), { throwIfNoEntry: false })) {
+            return currentPath;
+        }
+        const parentPath = path.dirname(currentPath);
+        if (parentPath === currentPath)
+            return null;
+        currentPath = parentPath;
+    }
+}
+function discoverCanonicalRepoRoot(repoRootCandidate) {
+    if (!repoRootCandidate)
+        return null;
+    const result = spawnSync('git', ['rev-parse', '--show-toplevel'], {
+        cwd: repoRootCandidate,
+        encoding: 'utf8',
+    });
+    if (result.status !== 0 || !result.stdout.trim())
+        return null;
+    const repoRoot = path.resolve(result.stdout.trim());
+    return fs.realpathSync(repoRoot) === fs.realpathSync(repoRootCandidate)
+        ? repoRoot
+        : null;
+}
+function resolveCanonicalRepoRoot(pluginDir, pluginName, repoRoot) {
+    if (!repoRoot)
+        return null;
+    return fs.realpathSync(pluginDir) === path.join(fs.realpathSync(repoRoot), 'plugins', pluginName)
+        ? repoRoot
+        : null;
+}
+// ---------------------------------------------------------------------------
+// Lightweight manifest checks (fallback when CLI not built)
+// ---------------------------------------------------------------------------
+const STRICT_SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|(?:[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))(?:\.(?:0|[1-9]\d*|(?:[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+function parseStrictSemVer(value) {
+    const stringValue = String(value);
+    const match = stringValue.match(STRICT_SEMVER_PATTERN);
+    if (!match)
+        return null;
+    return {
+        raw: stringValue,
+        major: Number(match[1]),
+        minor: Number(match[2]),
+        patch: Number(match[3]),
+        prerelease: match[4] ? match[4].split('.') : [],
+        build: match[5] ? match[5].split('.') : [],
+    };
+}
+function comparePrereleaseIdentifier(left, right) {
+    const leftNumeric = /^\d+$/.test(left);
+    const rightNumeric = /^\d+$/.test(right);
+    if (leftNumeric && rightNumeric) {
+        return Number(left) - Number(right);
+    }
+    if (leftNumeric)
+        return -1;
+    if (rightNumeric)
+        return 1;
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+}
+function compareStrictSemVer(left, right) {
+    const leftVersion = parseStrictSemVer(left);
+    const rightVersion = parseStrictSemVer(right);
+    if (!leftVersion || !rightVersion) {
+        throw new Error('compareStrictSemVer requires strict SemVer inputs.');
+    }
+    for (const key of ['major', 'minor', 'patch']) {
+        if (leftVersion[key] !== rightVersion[key]) {
+            return leftVersion[key] - rightVersion[key];
+        }
+    }
+    const leftPrerelease = leftVersion.prerelease;
+    const rightPrerelease = rightVersion.prerelease;
+    if (leftPrerelease.length === 0 && rightPrerelease.length === 0) {
+        return 0;
+    }
+    if (leftPrerelease.length === 0) {
+        return 1;
+    }
+    if (rightPrerelease.length === 0) {
+        return -1;
+    }
+    const maxLength = Math.max(leftPrerelease.length, rightPrerelease.length);
+    for (let index = 0; index < maxLength; index += 1) {
+        const leftIdentifier = leftPrerelease[index];
+        const rightIdentifier = rightPrerelease[index];
+        if (leftIdentifier === undefined)
+            return -1;
+        if (rightIdentifier === undefined)
+            return 1;
+        const result = comparePrereleaseIdentifier(leftIdentifier, rightIdentifier);
+        if (result !== 0) {
+            return result;
+        }
+    }
+    return 0;
+}
+function validateStrictSemVerString(value, fieldName) {
+    if (value === undefined) {
+        error(`Invalid ${fieldName}: expected a strict SemVer 2.0.0 string. Received undefined.`);
+        return null;
+    }
+    if (typeof value !== 'string' || !STRICT_SEMVER_PATTERN.test(value)) {
+        error(`Invalid ${fieldName}: expected a strict SemVer 2.0.0 string. Received ${JSON.stringify(value)}.`);
+        return null;
+    }
+    return value;
+}
+function validateManifestLightweight(manifest) {
+    const input = expectRecord(manifest, 'plugin manifest');
+    if (!input)
+        return;
+    if (Object.prototype.hasOwnProperty.call(input, 'commands')) {
+        error('top-level "commands" has been removed; use "slashCommands" instead');
+    }
+    validateAllowedKeys(input, 'plugin manifest', [
+        'name',
+        'version',
+        'description',
+        'dependencies',
+        'compatibility',
+        'skills',
+        'slashCommands',
+        'mcpServers',
+        'apps',
+        'distributions',
+        'marketplace',
+        'interface',
+        'extensions',
+        'buildConfig',
+        'scripts',
+        'config',
+        'artifacts',
+    ]);
+    if (manifest.dependencies !== undefined) {
+        if (!Array.isArray(manifest.dependencies)) {
+            error('dependencies must be an array');
+        }
+        else if (manifest.dependencies.length > 64) {
+            error('dependencies must contain at most 64 direct plugin dependencies');
+        }
+        else {
+            const seen = new Set();
+            for (const [index, dependency] of manifest.dependencies.entries()) {
+                if (typeof dependency !== 'string' || !PLUGIN_NAME_PATTERN.test(dependency)) {
+                    error(`dependencies[${index}] must be an ASCII lowercase hyphen-case plugin name`);
+                    continue;
+                }
+                if (dependency === manifest.name) {
+                    error(`plugin "${manifest.name}" cannot depend on itself`);
+                }
+                if (seen.has(dependency)) {
+                    error(`dependencies contains duplicate plugin "${dependency}"`);
+                }
+                seen.add(dependency);
+            }
+        }
+    }
+    for (const field of ['name', 'version', 'description', 'marketplace']) {
+        if (!manifest[field]) {
+            error(`Missing required field: ${field}`);
+        }
+    }
+    if (manifest.name && !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(manifest.name)) {
+        error(`manifest name "${manifest.name}" is not lowercase-hyphen-case`);
+    }
+    if (manifest.version) {
+        const pluginVersion = parseStrictSemVer(manifest.version);
+        if (!pluginVersion) {
+            error(`manifest.version must be a strict SemVer 2.0.0 string, got "${manifest.version}"`);
+        }
+        else if (pluginVersion.prerelease.length > 0 || pluginVersion.build.length > 0) {
+            error('manifest.version must be a stable SemVer without prerelease or build metadata');
+        }
+    }
+    if (manifest.marketplace) {
+        const mp = manifest.marketplace;
+        if (!mp.category)
+            error('marketplace.category is required');
+        if (typeof mp.strict !== 'boolean')
+            error('marketplace.strict must be a boolean');
+        if (!mp.policy || !mp.policy.installation)
+            error('marketplace.policy.installation is required');
+        else if (!MARKETPLACE_INSTALLATION_POLICIES.has(mp.policy.installation))
+            error(`marketplace.policy.installation must be one of ${[...MARKETPLACE_INSTALLATION_POLICIES].map((value) => JSON.stringify(value)).join(', ')}`);
+        if (!mp.policy || !mp.policy.authentication)
+            error('marketplace.policy.authentication is required');
+        else if (!MARKETPLACE_AUTHENTICATION_POLICIES.has(mp.policy.authentication))
+            error('marketplace.policy.authentication must be "ON_INSTALL" or "ON_USE"');
+        validateManifestPolicyProducts(mp.policy?.products);
+    }
+    for (const field of ['skills', 'slashCommands', 'mcpServers', 'apps']) {
+        if (manifest[field] && !manifest[field].startsWith('./')) {
+            error(`${field} path must start with "./", got "${manifest[field]}"`);
+        }
+    }
+    const claudeCommands = manifest.buildConfig?.manifestOverrides?.claude?.commands;
+    if (claudeCommands !== undefined) {
+        error('buildConfig.manifestOverrides.claude.commands has been removed; use "slashCommands" instead');
+    }
+    for (const platform of ['claude', 'codex']) {
+        const rules = manifest.buildConfig?.fileRules?.[platform];
+        if (!rules)
+            continue;
+        for (const pattern of [...(rules.include ?? []), ...(rules.exclude ?? [])]) {
+            const normalized = String(pattern).replace(/\\/g, '/').replace(/^\.\//, '');
+            if (normalized === 'commands' || normalized.startsWith('commands/')) {
+                error(`buildConfig.fileRules.${platform} no longer accepts legacy "commands/**" source rules; use "slashCommands" instead`);
+            }
+        }
+    }
+    validateExtensionsLightweight(manifest.extensions);
+    validatePlatformFieldSupport(manifest);
+}
+function validatePortableNativeArtifactCapabilityLightweight(manifest) {
+    if (manifest.distributions?.agentSkills === undefined)
+        return;
+    const hasOtherNativeDeclaration = Boolean(manifest.skills
+        || manifest.slashCommands
+        || manifest.mcpServers
+        || manifest.apps
+        || (manifest.extensions?.instructions?.length ?? 0) > 0
+        || (manifest.extensions?.permissions?.length ?? 0) > 0
+        || (manifest.extensions?.hooks?.length ?? 0) > 0
+        || (manifest.extensions?.nativeHooks?.claude?.length ?? 0) > 0
+        || (manifest.extensions?.nativeHooks?.codex?.length ?? 0) > 0
+        || (manifest.extensions?.agents?.length ?? 0) > 0);
+    const hasPresentNativeArtifact = (manifest.artifacts?.targets ?? []).some((target) => (target?.platform === 'claude' || target?.platform === 'codex')
+        && Array.isArray(target.states)
+        && target.states.includes('present'));
+    if (!hasOtherNativeDeclaration && !hasPresentNativeArtifact) {
+        const message = 'Invalid plugin manifest: portable-only plugins are not supported in V1. Declare at least one non-empty native capability.';
+        if (!errors.includes(message))
+            error(message);
+    }
+}
+function normalizeManifestProductToken(value) {
+    return String(value).trim().toUpperCase().replace(/[\s-]+/g, '_');
+}
+function resolveSupportedPlatforms(manifest) {
+    const products = manifest.marketplace?.policy?.products;
+    if (!Array.isArray(products) || products.length === 0) {
+        return new Set(['claude', 'codex']);
+    }
+    const supported = new Set();
+    for (const product of products) {
+        const normalized = normalizeManifestProductToken(product);
+        if (normalized === 'CLAUDE')
+            supported.add('claude');
+        if (normalized === 'CODEX')
+            supported.add('codex');
+    }
+    return supported;
+}
+function supportsManifestPlatform(manifest, platform) {
+    return resolveSupportedPlatforms(manifest).has(platform);
+}
+function formatManifestProductsForError(manifest) {
+    const products = manifest.marketplace?.policy?.products;
+    if (!Array.isArray(products) || products.length === 0) {
+        return 'marketplace.policy.products=[]';
+    }
+    const normalized = [...new Set(products.map(normalizeManifestProductToken))];
+    return `marketplace.policy.products=[${normalized.join(', ')}]`;
+}
+function platformProductName(platform) {
+    return platform === 'claude' ? 'CLAUDE' : 'CODEX';
+}
+function pluginNameForError(manifest) {
+    return typeof manifest.name === 'string' && manifest.name.trim()
+        ? manifest.name.trim()
+        : '<unknown>';
+}
+function assertPlatformFieldSupported(manifest, fieldPath, requiredPlatform) {
+    if (supportsManifestPlatform(manifest, requiredPlatform))
+        return;
+    error(`Invalid plugin "${pluginNameForError(manifest)}": ${fieldPath} requires ${platformProductName(requiredPlatform)} support, but ${formatManifestProductsForError(manifest)}.`);
+}
+function hasNonEmptyOverride(value) {
+    return isRecord(value) && Object.keys(value).length > 0;
+}
+function validateManifestPolicyProducts(products) {
+    if (products === undefined)
+        return;
+    if (!Array.isArray(products)) {
+        error('marketplace.policy.products must be an array');
+        return;
+    }
+    for (const [index, product] of products.entries()) {
+        const fieldName = `marketplace.policy.products[${index}]`;
+        if (typeof product !== 'string' || product.trim() === '') {
+            error(`${fieldName} must be a non-empty string`);
+            continue;
+        }
+        const normalized = normalizeManifestProductToken(product);
+        if (!MANIFEST_POLICY_PRODUCTS.has(normalized)) {
+            error(`${fieldName} must be one of "CODEX" or "CLAUDE"`);
+        }
+    }
+}
+function validatePlatformFieldSupport(manifest) {
+    if (manifest.buildConfig?.fileRules?.claude !== undefined) {
+        assertPlatformFieldSupported(manifest, 'buildConfig.fileRules.claude', 'claude');
+    }
+    if (manifest.buildConfig?.fileRules?.codex !== undefined) {
+        assertPlatformFieldSupported(manifest, 'buildConfig.fileRules.codex', 'codex');
+    }
+    if (manifest.buildConfig?.manifestOverrides?.claude !== undefined) {
+        assertPlatformFieldSupported(manifest, 'buildConfig.manifestOverrides.claude', 'claude');
+    }
+    if (manifest.buildConfig?.manifestOverrides?.codex !== undefined) {
+        assertPlatformFieldSupported(manifest, 'buildConfig.manifestOverrides.codex', 'codex');
+    }
+    if (manifest.apps) {
+        assertPlatformFieldSupported(manifest, 'apps', 'codex');
+    }
+    if (Array.isArray(manifest.extensions?.nativeHooks?.claude) && manifest.extensions.nativeHooks.claude.length > 0) {
+        assertPlatformFieldSupported(manifest, 'extensions.nativeHooks.claude', 'claude');
+    }
+    if (Array.isArray(manifest.extensions?.nativeHooks?.codex) && manifest.extensions.nativeHooks.codex.length > 0) {
+        assertPlatformFieldSupported(manifest, 'extensions.nativeHooks.codex', 'codex');
+    }
+    for (const [fieldName, entries] of [
+        ['extensions.instructions', manifest.extensions?.instructions],
+        ['extensions.permissions', manifest.extensions?.permissions],
+        ['extensions.hooks', manifest.extensions?.hooks],
+        ['extensions.agents', manifest.extensions?.agents],
+    ]) {
+        if (!Array.isArray(entries))
+            continue;
+        entries.forEach((entry, index) => {
+            if (!isRecord(entry.agentOverrides))
+                return;
+            for (const platform of ['claude', 'codex']) {
+                if (hasNonEmptyOverride(entry.agentOverrides[platform])) {
+                    assertPlatformFieldSupported(manifest, `${fieldName}[${index}].agentOverrides.${platform}`, platform);
+                }
+            }
+        });
+    }
+    if (!Array.isArray(manifest.artifacts?.targets))
+        return;
+    manifest.artifacts.targets.forEach((target, index) => {
+        if (target?.platform === 'claude' || target?.platform === 'codex') {
+            assertPlatformFieldSupported(manifest, `artifacts.targets[${index}].platform`, target.platform);
+        }
+    });
+}
+function isTemplateAsset(manifest, relativePath) {
+    return templateIncludesPath(manifest, relativePath);
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function validateAllowedKeys(record, fieldName, allowedKeys) {
+    for (const key of Object.keys(record)) {
+        if (!allowedKeys.includes(key)) {
+            error(`${fieldName} has unknown field "${key}"`);
+        }
+    }
+}
+function validateManifestString(value, fieldName) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        error(`${fieldName} must be a non-empty string`);
+        return null;
+    }
+    return value;
+}
+function validatePublicHookEvent(value, fieldName) {
+    const event = validateManifestString(value, fieldName);
+    if (!event)
+        return null;
+    if (event === 'session_stop') {
+        error(`${fieldName}: public event "session_stop" has been removed; use extensions.nativeHooks.claude[].event = "Stop" or "SessionEnd", or extensions.nativeHooks.codex[].event = "Stop"`);
+        return null;
+    }
+    if (!PUBLIC_HOOK_EVENTS.has(event)) {
+        error(`${fieldName}: unsupported public hook event "${event}"`);
+        return null;
+    }
+    return event;
+}
+function normalizePublicSessionStartMatcher(matcher, fieldName) {
+    if (matcher === undefined)
+        return PUBLIC_SESSION_START_DEFAULT_MATCHER;
+    if (typeof matcher !== 'string' || matcher.trim() === '') {
+        error(`${fieldName} must be a non-empty string`);
+        return null;
+    }
+    const selected = new Set();
+    for (const part of matcher.split('|')) {
+        if (!PUBLIC_SESSION_START_SOURCES.has(part)) {
+            error(`${fieldName}: public session_start only allows startup, resume, clear, or their "|" union`);
+            return null;
+        }
+        selected.add(part);
+    }
+    return ['startup', 'resume', 'clear'].filter((part) => selected.has(part)).join('|');
+}
+function validatePublicHookMatcher(event, matcher, fieldName) {
+    if (matcher === undefined)
+        return event === 'session_start' ? PUBLIC_SESSION_START_DEFAULT_MATCHER : undefined;
+    if (typeof matcher !== 'string' || matcher.trim() === '') {
+        error(`${fieldName} must be a non-empty string`);
+        return null;
+    }
+    if (event === 'session_start') {
+        return normalizePublicSessionStartMatcher(matcher, fieldName);
+    }
+    return matcher;
+}
+function validateNativeHookEvent(value, platform, fieldName) {
+    const event = validateManifestString(value, fieldName);
+    if (!event)
+        return null;
+    if (!NATIVE_HOOK_EVENTS[platform].has(event)) {
+        error(`${fieldName}: unsupported ${platform} hook event "${event}"`);
+        return null;
+    }
+    return event;
+}
+function validateNativeHookMatcher(event, platform, matcher, fieldName) {
+    if (matcher === undefined)
+        return undefined;
+    if (typeof matcher !== 'string' || matcher.trim() === '') {
+        error(`${fieldName} must be a non-empty string`);
+        return null;
+    }
+    if (MATCHERLESS_NATIVE_HOOK_EVENTS[platform].has(event)) {
+        error(`${fieldName}: ${platform} event "${event}" does not allow matcher`);
+        return null;
+    }
+    return matcher;
+}
+function validateHookAgentOverrides(value, baseHook, fieldName, duplicateCollector) {
+    if (value === undefined) {
+        for (const platform of ['claude', 'codex']) {
+            duplicateCollector(platform, baseHook);
+        }
+        return;
+    }
+    const overrides = expectRecord(value, fieldName);
+    if (!overrides)
+        return;
+    validateAllowedKeys(overrides, fieldName, ['claude', 'codex']);
+    for (const platform of ['claude', 'codex']) {
+        const override = overrides[platform];
+        if (override === null)
+            continue;
+        if (override === undefined) {
+            duplicateCollector(platform, baseHook);
+            continue;
+        }
+        const overrideRecord = expectRecord(override, `${fieldName}.${platform}`);
+        if (!overrideRecord)
+            continue;
+        validateAllowedKeys(overrideRecord, `${fieldName}.${platform}`, ['event', 'matcher', 'command']);
+        const event = overrideRecord.event === undefined
+            ? baseHook.event
+            : validatePublicHookEvent(overrideRecord.event, `${fieldName}.${platform}.event`);
+        const matcherValue = overrideRecord.matcher === undefined
+            ? baseHook.matcher
+            : overrideRecord.matcher;
+        const matcher = event
+            ? validatePublicHookMatcher(event, matcherValue, `${fieldName}.${platform}.matcher`)
+            : null;
+        const command = overrideRecord.command === undefined
+            ? baseHook.command
+            : validateManifestString(overrideRecord.command, `${fieldName}.${platform}.command`);
+        if (event && matcher !== null && command) {
+            duplicateCollector(platform, { event, matcher, command });
+        }
+    }
+}
+function validateHookEntryLightweight(entry, fieldName, duplicateCollector) {
+    const input = expectRecord(entry, fieldName);
+    if (!input)
+        return;
+    validateAllowedKeys(input, fieldName, ['event', 'matcher', 'command', 'agentOverrides']);
+    const event = validatePublicHookEvent(input.event, `${fieldName}.event`);
+    const matcher = event
+        ? validatePublicHookMatcher(event, input.matcher, `${fieldName}.matcher`)
+        : null;
+    const command = validateManifestString(input.command, `${fieldName}.command`);
+    if (!event || matcher === null || !command)
+        return;
+    validateHookAgentOverrides(input.agentOverrides, { event, matcher, command }, `${fieldName}.agentOverrides`, duplicateCollector);
+}
+function validateNativeHookEntryLightweight(entry, platform, fieldName, duplicateCollector) {
+    const input = expectRecord(entry, fieldName);
+    if (!input)
+        return;
+    validateAllowedKeys(input, fieldName, ['event', 'matcher', 'command']);
+    const event = validateNativeHookEvent(input.event, platform, `${fieldName}.event`);
+    const matcher = event
+        ? validateNativeHookMatcher(event, platform, input.matcher, `${fieldName}.matcher`)
+        : null;
+    const command = validateManifestString(input.command, `${fieldName}.command`);
+    if (!event || matcher === null || !command)
+        return;
+    duplicateCollector(platform, { event, matcher, command, native: true });
+}
+function validateExtensionsLightweight(extensions) {
+    if (extensions === undefined)
+        return;
+    const input = expectRecord(extensions, 'extensions');
+    if (!input)
+        return;
+    validateAllowedKeys(input, 'extensions', ['instructions', 'permissions', 'hooks', 'nativeHooks', 'agents']);
+    const seenHooks = {
+        claude: new Set(),
+        codex: new Set(),
+    };
+    const collectHook = (platform, hook) => {
+        const event = hook.native ? hook.event : PUBLIC_HOOK_RENDER_MAP[platform][hook.event];
+        const matcher = hook.matcher === '*' ? undefined : hook.matcher;
+        const key = JSON.stringify([event, matcher ?? null, hook.command]);
+        if (seenHooks[platform].has(key)) {
+            error(`extensions has duplicate ${platform} hook for event "${event}" and command "${hook.command}"`);
+        }
+        seenHooks[platform].add(key);
+    };
+    if (input.hooks !== undefined) {
+        if (!Array.isArray(input.hooks)) {
+            error('extensions.hooks must be an array');
+        }
+        else {
+            input.hooks.forEach((entry, index) => validateHookEntryLightweight(entry, `extensions.hooks[${index}]`, collectHook));
+        }
+    }
+    if (input.nativeHooks !== undefined) {
+        const nativeHooks = expectRecord(input.nativeHooks, 'extensions.nativeHooks');
+        if (nativeHooks) {
+            validateAllowedKeys(nativeHooks, 'extensions.nativeHooks', ['claude', 'codex']);
+            for (const platform of ['claude', 'codex']) {
+                if (nativeHooks[platform] === undefined)
+                    continue;
+                if (!Array.isArray(nativeHooks[platform])) {
+                    error(`extensions.nativeHooks.${platform} must be an array`);
+                    continue;
+                }
+                nativeHooks[platform].forEach((entry, index) => validateNativeHookEntryLightweight(entry, platform, `extensions.nativeHooks.${platform}[${index}]`, collectHook));
+            }
+        }
+    }
+}
+function expectRecord(value, fieldName) {
+    if (!isRecord(value)) {
+        error(`${fieldName} must be an object`);
+        return null;
+    }
+    return value;
+}
+function validateNonEmptyString(value, fieldName, maxLength) {
+    if (typeof value !== 'string') {
+        error(`${fieldName} must be a string`);
+        return null;
+    }
+    const trimmed = value.trim();
+    if (trimmed.length === 0) {
+        error(`${fieldName} must not be empty`);
+        return null;
+    }
+    if (maxLength !== undefined && countCharacters(trimmed) > maxLength) {
+        error(`${fieldName} must be <= ${maxLength} characters`);
+    }
+    return trimmed;
+}
+function isPathInsideOrEqual(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (relative !== '..' &&
+        !relative.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(relative));
+}
+function validateRealPathBoundary(boundary, candidate, fieldName, boundaryName) {
+    const canonicalBoundary = fs.realpathSync(boundary);
+    const canonicalCandidate = fs.realpathSync(candidate);
+    if (!isPathInsideOrEqual(canonicalBoundary, canonicalCandidate)) {
+        error(`${fieldName} must stay inside the ${boundaryName}`);
+        return false;
+    }
+    return true;
+}
+function validateEvalRelativeFile(evalDir, value, fieldName) {
+    const relativePath = validateNonEmptyString(value, fieldName);
+    if (!relativePath)
+        return null;
+    const normalized = stripDotSlash(relativePath).split('\\').join('/');
+    if (path.isAbsolute(normalized) || normalized.split('/').includes('..')) {
+        error(`${fieldName} must stay inside the Skill eval directory`);
+        return null;
+    }
+    const absolutePath = path.resolve(evalDir, normalized);
+    const relativeToRoot = path.relative(evalDir, absolutePath);
+    if (relativeToRoot.startsWith('..') || path.isAbsolute(relativeToRoot)) {
+        error(`${fieldName} must stay inside the Skill eval directory`);
+        return null;
+    }
+    if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile()) {
+        error(`${fieldName} does not exist: ${normalized}`);
+        return null;
+    }
+    if (!validateRealPathBoundary(evalDir, absolutePath, fieldName, 'Skill eval directory')) {
+        return null;
+    }
+    return absolutePath;
+}
+function validateEvalWorkspacePath(value, fieldName, options = {}) {
+    const raw = validateNonEmptyString(value, fieldName);
+    if (!raw)
+        return null;
+    const treePattern = options.allowTreePattern === true && raw.endsWith('/**');
+    const candidate = treePattern ? raw.slice(0, -3) : raw;
+    if (candidate === '' ||
+        candidate.includes('\0') ||
+        candidate.includes('\\') ||
+        candidate.includes('*') ||
+        candidate.includes('?') ||
+        candidate.includes('[') ||
+        candidate.includes(']') ||
+        path.isAbsolute(candidate) ||
+        path.posix.normalize(candidate) !== candidate ||
+        candidate.split('/').includes('..')) {
+        error(`${fieldName} must be a normalized POSIX path inside the eval workspace`);
+        return null;
+    }
+    const firstSegment = candidate.split('/')[0];
+    if (firstSegment === '.git' || firstSegment === '.agents' || firstSegment === '.codex') {
+        error(`${fieldName} must not target an eval control directory`);
+        return null;
+    }
+    return raw;
+}
+function evalWorkspacePathMatchesPattern(relativePath, pattern) {
+    if (pattern.endsWith('/**')) {
+        const prefix = pattern.slice(0, -3);
+        return relativePath === prefix || relativePath.startsWith(`${prefix}/`);
+    }
+    return relativePath === pattern;
+}
+function validateConversationCaseCorpus(evalDir, suite, fieldName) {
+    const casesPath = validateEvalRelativeFile(evalDir, suite.cases, `${fieldName}.cases`);
+    if (!casesPath)
+        return;
+    let document;
+    try {
+        document = JSON.parse(fs.readFileSync(casesPath, 'utf8'));
+    }
+    catch (e) {
+        error(`${fieldName}.cases is not valid JSON: ${e.message}`);
+        return;
+    }
+    const corpus = expectRecord(document, `${fieldName}.cases document`);
+    if (!corpus)
+        return;
+    const skillName = validateNonEmptyString(corpus.skill_name, `${fieldName}.cases.skill_name`);
+    if (skillName && skillName !== suite.skill) {
+        error(`${fieldName}.cases.skill_name must match ${JSON.stringify(suite.skill)}`);
+    }
+    if (!Array.isArray(corpus.evals) || corpus.evals.length === 0) {
+        error(`${fieldName}.cases.evals must be a non-empty array`);
+        return;
+    }
+    const ids = new Set();
+    corpus.evals.forEach((value, caseIndex) => {
+        const caseField = `${fieldName}.cases.evals[${caseIndex}]`;
+        const entry = expectRecord(value, caseField);
+        if (!entry)
+            return;
+        const id = validateNonEmptyString(entry.id, `${caseField}.id`);
+        if (id && ids.has(id)) {
+            error(`${fieldName}.cases has duplicate case id ${JSON.stringify(id)}`);
+        }
+        else if (id) {
+            ids.add(id);
+        }
+        validateNonEmptyString(entry.prompt, `${caseField}.prompt`);
+        const sandbox = entry.sandbox === undefined
+            ? 'read-only'
+            : validateNonEmptyString(entry.sandbox, `${caseField}.sandbox`);
+        if (sandbox && sandbox !== 'read-only' && sandbox !== 'workspace-write') {
+            error(`${caseField}.sandbox must be "read-only" or "workspace-write"`);
+        }
+        if (!Array.isArray(entry.scripted_replies)) {
+            error(`${caseField}.scripted_replies must be an array`);
+        }
+        else {
+            entry.scripted_replies.forEach((reply, replyIndex) => {
+                const replyField = `${caseField}.scripted_replies[${replyIndex}]`;
+                if (typeof reply === 'string')
+                    return;
+                const replyEntry = expectRecord(reply, replyField);
+                if (!replyEntry)
+                    return;
+                if (!Array.isArray(replyEntry.answers_by_index) || replyEntry.answers_by_index.some((answer) => typeof answer !== 'string')) {
+                    error(`${replyField}.answers_by_index must be an array of strings`);
+                }
+                if (replyEntry.expected_question_count !== undefined &&
+                    (!Number.isInteger(replyEntry.expected_question_count) ||
+                        replyEntry.expected_question_count < 0)) {
+                    error(`${replyField}.expected_question_count must be a non-negative integer`);
+                }
+                validateNonEmptyString(replyEntry.unexpected_question_answer, `${replyField}.unexpected_question_answer`);
+            });
+        }
+        validateNonEmptyString(entry.expected_output, `${caseField}.expected_output`);
+        if (entry.workspace_files !== undefined) {
+            const workspaceFiles = expectRecord(entry.workspace_files, `${caseField}.workspace_files`);
+            if (workspaceFiles) {
+                const workspaceFileEntries = Object.entries(workspaceFiles);
+                if (workspaceFileEntries.length === 0) {
+                    error(`${caseField}.workspace_files must contain at least one file`);
+                }
+                workspaceFileEntries.forEach(([relativePath, content]) => {
+                    validateEvalWorkspacePath(relativePath, `${caseField}.workspace_files.${relativePath}`, { allowTreePattern: false });
+                    validateNonEmptyString(content, `${caseField}.workspace_files.${relativePath}`);
+                });
+            }
+        }
+        const review = expectRecord(entry.review, `${caseField}.review`);
+        if (review) {
+            if (!Array.isArray(review.checks) || review.checks.length === 0 || review.checks.some((check) => typeof check !== 'string' || check.trim() === '')) {
+                error(`${caseField}.review.checks must be a non-empty array of strings`);
+            }
+            if (review.workspace_unchanged !== undefined &&
+                typeof review.workspace_unchanged !== 'boolean') {
+                error(`${caseField}.review.workspace_unchanged must be boolean`);
+            }
+            const allowedWorkspaceChanges = [];
+            if (review.allowed_workspace_changes !== undefined) {
+                if (!Array.isArray(review.allowed_workspace_changes) ||
+                    review.allowed_workspace_changes.length === 0) {
+                    error(`${caseField}.review.allowed_workspace_changes must be a non-empty array`);
+                }
+                else {
+                    review.allowed_workspace_changes.forEach((pathValue, pathIndex) => {
+                        const normalized = validateEvalWorkspacePath(pathValue, `${caseField}.review.allowed_workspace_changes[${pathIndex}]`, { allowTreePattern: true });
+                        if (normalized)
+                            allowedWorkspaceChanges.push(normalized);
+                    });
+                }
+            }
+            const artifactPaths = [];
+            if (review.artifacts !== undefined) {
+                if (!Array.isArray(review.artifacts) || review.artifacts.length === 0) {
+                    error(`${caseField}.review.artifacts must be a non-empty array`);
+                }
+                else {
+                    review.artifacts.forEach((artifactValue, artifactIndex) => {
+                        const artifactField = `${caseField}.review.artifacts[${artifactIndex}]`;
+                        const artifact = expectRecord(artifactValue, artifactField);
+                        if (!artifact)
+                            return;
+                        validateAllowedKeys(artifact, artifactField, ['path', 'exists', 'contains', 'not_contains', 'json']);
+                        const artifactPath = validateEvalWorkspacePath(artifact.path, `${artifactField}.path`);
+                        if (artifactPath)
+                            artifactPaths.push(artifactPath);
+                        if (artifact.exists !== undefined && typeof artifact.exists !== 'boolean') {
+                            error(`${artifactField}.exists must be boolean`);
+                        }
+                        for (const key of ['contains', 'not_contains']) {
+                            if (artifact[key] !== undefined &&
+                                (!Array.isArray(artifact[key]) || artifact[key].length === 0 || artifact[key].some((fragment) => typeof fragment !== 'string' || fragment.length === 0))) {
+                                error(`${artifactField}.${key} must be a non-empty array of strings`);
+                            }
+                        }
+                        if (artifact.json !== undefined && !isRecord(artifact.json)) {
+                            error(`${artifactField}.json must be an object`);
+                        }
+                    });
+                }
+            }
+            if (new Set(artifactPaths).size !== artifactPaths.length) {
+                error(`${caseField}.review.artifacts contains duplicate paths`);
+            }
+            if (sandbox === 'workspace-write') {
+                if (review.workspace_unchanged !== false) {
+                    error(`${caseField} workspace-write requires review.workspace_unchanged=false`);
+                }
+                if (allowedWorkspaceChanges.length === 0 || artifactPaths.length === 0) {
+                    error(`${caseField} workspace-write requires allowed changes and artifacts`);
+                }
+                const unmatchedArtifact = artifactPaths.find((artifactPath) => !allowedWorkspaceChanges.some((pattern) => evalWorkspacePathMatchesPattern(artifactPath, pattern)));
+                if (unmatchedArtifact) {
+                    error(`${caseField} artifact ${JSON.stringify(unmatchedArtifact)} is outside allowed changes`);
+                }
+            }
+        }
+    });
+}
+function validateTriggerCaseCorpus(evalDir, suite, fieldName) {
+    const casesPath = validateEvalRelativeFile(evalDir, suite.cases, `${fieldName}.cases`);
+    if (!casesPath)
+        return;
+    let document;
+    try {
+        document = JSON.parse(fs.readFileSync(casesPath, 'utf8'));
+    }
+    catch (e) {
+        error(`${fieldName}.cases is not valid JSON: ${e.message}`);
+        return;
+    }
+    const corpus = expectRecord(document, `${fieldName}.cases document`);
+    if (!corpus)
+        return;
+    if (corpus.schemaVersion !== PLUGIN_EVAL_CASE_SCHEMA_VERSION) {
+        error(`${fieldName}.cases.schemaVersion must be ${PLUGIN_EVAL_CASE_SCHEMA_VERSION}`);
+    }
+    if (corpus.skill !== suite.skill) {
+        error(`${fieldName}.cases.skill must match ${JSON.stringify(suite.skill)}`);
+    }
+    if (!Array.isArray(corpus.cases) || corpus.cases.length === 0) {
+        error(`${fieldName}.cases.cases must be a non-empty array`);
+        return;
+    }
+    const ids = new Set();
+    const seenSplits = new Set();
+    let hasWorkspaceFixture = false;
+    corpus.cases.forEach((value, caseIndex) => {
+        const caseField = `${fieldName}.cases.cases[${caseIndex}]`;
+        const entry = expectRecord(value, caseField);
+        if (!entry)
+            return;
+        const id = validateNonEmptyString(entry.id, `${caseField}.id`);
+        if (id && !/^[a-z0-9][a-z0-9_]*$/.test(id)) {
+            error(`${caseField}.id must use lowercase snake_case`);
+        }
+        else if (id && ids.has(id)) {
+            error(`${fieldName}.cases has duplicate case id ${JSON.stringify(id)}`);
+        }
+        else if (id) {
+            ids.add(id);
+        }
+        if (!PLUGIN_EVAL_TRIGGER_CASE_SPLITS.has(entry.split)) {
+            error(`${caseField}.split must be train, validation, or sanity`);
+        }
+        else {
+            seenSplits.add(entry.split);
+        }
+        validateNonEmptyString(entry.query, `${caseField}.query`);
+        const usesLegacyExpectation = entry.should_load_skill !== undefined;
+        const usesRouteExpectation = entry.expected_loaded_skills !== undefined;
+        if (usesLegacyExpectation === usesRouteExpectation) {
+            error(`${caseField} must declare exactly one of should_load_skill or expected_loaded_skills`);
+        }
+        else if (usesLegacyExpectation && typeof entry.should_load_skill !== 'boolean') {
+            error(`${caseField}.should_load_skill must be boolean`);
+        }
+        else if (usesRouteExpectation) {
+            if (!Array.isArray(entry.expected_loaded_skills)) {
+                error(`${caseField}.expected_loaded_skills must be an array`);
+            }
+            else {
+                const expectedSkills = entry.expected_loaded_skills;
+                expectedSkills.forEach((skillName, skillIndex) => {
+                    if (typeof skillName !== 'string' || skillName.trim() === '') {
+                        error(`${caseField}.expected_loaded_skills[${skillIndex}] must be a non-empty string`);
+                    }
+                    else if (!suite.skills.includes(skillName)) {
+                        error(`${caseField}.expected_loaded_skills[${skillIndex}] must name a participant Skill`);
+                    }
+                });
+                if (new Set(expectedSkills).size !== expectedSkills.length) {
+                    error(`${caseField}.expected_loaded_skills must not contain duplicates`);
+                }
+                if (suite.forbidMultipleSkillLoads === true && expectedSkills.length > 1) {
+                    error(`${caseField} expects multiple Skills but the suite forbids multiple Skill loads`);
+                }
+            }
+        }
+        if (suite.observeSpawnAgent === true) {
+            if (typeof entry.should_spawn_agent !== 'boolean') {
+                error(`${caseField}.should_spawn_agent is required when observeSpawnAgent=true`);
+            }
+        }
+        else if (entry.should_spawn_agent !== undefined) {
+            error(`${caseField}.should_spawn_agent requires observeSpawnAgent=true`);
+        }
+        if (entry.workspace_fixture !== undefined) {
+            hasWorkspaceFixture = true;
+            validateNonEmptyString(entry.workspace_fixture, `${caseField}.workspace_fixture`);
+        }
+        if (entry.use_project_rules !== undefined &&
+            typeof entry.use_project_rules !== 'boolean') {
+            error(`${caseField}.use_project_rules must be boolean`);
+        }
+        if (entry.tags !== undefined) {
+            if (!Array.isArray(entry.tags) || entry.tags.length === 0) {
+                error(`${caseField}.tags must be a non-empty array`);
+            }
+            else {
+                entry.tags.forEach((tag, tagIndex) => {
+                    validateNonEmptyString(tag, `${caseField}.tags[${tagIndex}]`);
+                });
+            }
+        }
+    });
+    if (hasWorkspaceFixture && suite.fixtureModule === undefined) {
+        error(`${fieldName}.fixtureModule is required when cases declare workspace_fixture`);
+    }
+    if (Array.isArray(suite.releaseSplits)) {
+        suite.releaseSplits.forEach((split) => {
+            if (split !== 'all' && !seenSplits.has(split)) {
+                error(`${fieldName}.cases has no cases for release split ${JSON.stringify(split)}`);
+            }
+        });
+    }
+}
+function resolveEvalProfilePlugin(pluginDir, ownerManifest, pluginName, fieldName) {
+    if (pluginName === ownerManifest.name) {
+        return { pluginDir, manifest: ownerManifest };
+    }
+    const companionDir = path.join(path.dirname(pluginDir), pluginName);
+    const manifestPath = path.join(companionDir, '.agents-plugin', 'plugin.json');
+    if (!fs.existsSync(manifestPath)) {
+        error(`${fieldName} must reference repo-local plugin "${pluginName}"`);
+        return null;
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    }
+    catch (e) {
+        error(`${fieldName} companion manifest is not valid JSON: ${e.message}`);
+        return null;
+    }
+    if (!isRecord(manifest) || manifest.name !== pluginName) {
+        error(`${fieldName} companion source must declare plugin name "${pluginName}"`);
+        return null;
+    }
+    return { pluginDir: companionDir, manifest };
+}
+function validateOnePluginEvalManifest(pluginDir, pluginManifest, evalDir, expectedSkill) {
+    const evalManifestPath = path.join(evalDir, 'manifest.json');
+    const manifestField = path.relative(pluginDir, evalManifestPath).split(path.sep).join('/');
+    let document;
+    try {
+        document = JSON.parse(fs.readFileSync(evalManifestPath, 'utf8'));
+    }
+    catch (e) {
+        error(`${manifestField} is not valid JSON: ${e.message}`);
+        return;
+    }
+    const manifest = expectRecord(document, manifestField);
+    if (!manifest)
+        return;
+    validateAllowedKeys(manifest, manifestField, ['schemaVersion', 'plugin', 'skill', 'profiles', 'suites']);
+    if (manifest.schemaVersion !== PLUGIN_EVAL_SCHEMA_VERSION) {
+        error(`${manifestField}.schemaVersion must be ${PLUGIN_EVAL_SCHEMA_VERSION}`);
+    }
+    if (manifest.plugin !== pluginManifest.name) {
+        error(`${manifestField}.plugin must match plugin name ${JSON.stringify(pluginManifest.name)}`);
+    }
+    const skill = validateNonEmptyString(manifest.skill, `${manifestField}.skill`);
+    if (skill && skill !== expectedSkill) {
+        error(`${manifestField}.skill must match owning Skill ${JSON.stringify(expectedSkill)}`);
+    }
+    if (skill && !collectDeclaredSkillNames(pluginDir, pluginManifest).all.has(skill)) {
+        error(`${manifestField}.skill must reference a declared static or dynamic skill`);
+    }
+    if (!Array.isArray(manifest.profiles) || manifest.profiles.length === 0) {
+        error(`${manifestField}.profiles must be a non-empty array`);
+        return;
+    }
+    const profilesById = new Map();
+    manifest.profiles.forEach((value, index) => {
+        const fieldName = `${manifestField}.profiles[${index}]`;
+        const profile = expectRecord(value, fieldName);
+        if (!profile)
+            return;
+        validateAllowedKeys(profile, fieldName, ['id', 'scope', 'plugins', 'runModel', 'requiredForRelease']);
+        const id = validateNonEmptyString(profile.id, `${fieldName}.id`);
+        if (id && !PLUGIN_NAME_PATTERN.test(id)) {
+            error(`${fieldName}.id must use lowercase kebab-case`);
+        }
+        else if (id && profilesById.has(id)) {
+            error(`${manifestField} has duplicate profile id ${JSON.stringify(id)}`);
+        }
+        if (!PLUGIN_EVAL_SCOPES.has(profile.scope)) {
+            error(`${fieldName}.scope must be user or project`);
+        }
+        const skillOwners = new Map();
+        const installedPlugins = new Set();
+        if (!Array.isArray(profile.plugins) || profile.plugins.length === 0) {
+            error(`${fieldName}.plugins must be a non-empty array`);
+        }
+        else {
+            profile.plugins.forEach((value, pluginIndex) => {
+                const pluginField = `${fieldName}.plugins[${pluginIndex}]`;
+                const installation = expectRecord(value, pluginField);
+                if (!installation)
+                    return;
+                validateAllowedKeys(installation, pluginField, ['name', 'config']);
+                const pluginName = validateNonEmptyString(installation.name, `${pluginField}.name`);
+                if (!pluginName)
+                    return;
+                if (!PLUGIN_NAME_PATTERN.test(pluginName)) {
+                    error(`${pluginField}.name must use lowercase kebab-case`);
+                }
+                if (installedPlugins.has(pluginName)) {
+                    error(`${fieldName}.plugins has duplicate plugin ${JSON.stringify(pluginName)}`);
+                    return;
+                }
+                installedPlugins.add(pluginName);
+                if (installation.config !== undefined && !isRecord(installation.config)) {
+                    error(`${pluginField}.config must be an object`);
+                }
+                const source = resolveEvalProfilePlugin(pluginDir, pluginManifest, pluginName, `${pluginField}.name`);
+                if (!source)
+                    return;
+                for (const skillName of collectDeclaredSkillNames(source.pluginDir, source.manifest).all) {
+                    const existing = skillOwners.get(skillName);
+                    if (existing && existing !== pluginName) {
+                        error(`${fieldName} installs duplicate Skill key ${JSON.stringify(skillName)} ` +
+                            `from plugins ${JSON.stringify(existing)} and ${JSON.stringify(pluginName)}`);
+                    }
+                    else {
+                        skillOwners.set(skillName, pluginName);
+                    }
+                }
+            });
+        }
+        if (!installedPlugins.has(pluginManifest.name)) {
+            error(`${fieldName}.plugins must include owner plugin ${JSON.stringify(pluginManifest.name)}`);
+        }
+        if (typeof profile.runModel !== 'boolean') {
+            error(`${fieldName}.runModel must be boolean`);
+        }
+        if (typeof profile.requiredForRelease !== 'boolean') {
+            error(`${fieldName}.requiredForRelease must be boolean`);
+        }
+        if (profile.scope === 'user' && profile.runModel === true) {
+            error(`${fieldName}: eval schema v2 does not allow real model execution for user scope`);
+        }
+        if (id && PLUGIN_NAME_PATTERN.test(id) && !profilesById.has(id)) {
+            profilesById.set(id, { ...profile, skillOwners });
+        }
+    });
+    if (!manifest.profiles.some((profile) => isRecord(profile) && profile.scope === 'project' && profile.runModel === true)) {
+        error(`${manifestField} must define at least one project profile with runModel=true`);
+    }
+    if (!Array.isArray(manifest.suites) || manifest.suites.length === 0) {
+        error(`${manifestField}.suites must be a non-empty array`);
+        return;
+    }
+    const suiteIds = new Set();
+    manifest.suites.forEach((value, index) => {
+        const fieldName = `${manifestField}.suites[${index}]`;
+        const suite = expectRecord(value, fieldName);
+        if (!suite)
+            return;
+        const id = validateNonEmptyString(suite.id, `${fieldName}.id`);
+        if (id && !PLUGIN_NAME_PATTERN.test(id)) {
+            error(`${fieldName}.id must use lowercase kebab-case`);
+        }
+        else if (id && suiteIds.has(id)) {
+            error(`${manifestField} has duplicate suite id ${JSON.stringify(id)}`);
+        }
+        else if (id) {
+            suiteIds.add(id);
+        }
+        if (suite.kind !== 'command' && suite.kind !== 'conversation' && suite.kind !== 'trigger') {
+            error(`${fieldName}.kind must be command, conversation, or trigger`);
+        }
+        const suiteSkills = new Set();
+        if (!Array.isArray(suite.skills) || suite.skills.length === 0) {
+            error(`${fieldName}.skills must be a non-empty array`);
+        }
+        else {
+            suite.skills.forEach((skillName, skillIndex) => {
+                const skillField = `${fieldName}.skills[${skillIndex}]`;
+                const normalized = validateNonEmptyString(skillName, skillField);
+                if (!normalized)
+                    return;
+                if (!PLUGIN_NAME_PATTERN.test(normalized)) {
+                    error(`${skillField} must use lowercase kebab-case`);
+                }
+                else if (suiteSkills.has(normalized)) {
+                    error(`${fieldName}.skills has duplicate Skill ${JSON.stringify(normalized)}`);
+                }
+                else {
+                    suiteSkills.add(normalized);
+                }
+            });
+        }
+        if (skill && !suiteSkills.has(skill)) {
+            error(`${fieldName}.skills must include owner Skill ${JSON.stringify(skill)}`);
+        }
+        if (!Array.isArray(suite.profiles) || suite.profiles.length === 0) {
+            error(`${fieldName}.profiles must be a non-empty array`);
+        }
+        else {
+            suite.profiles.forEach((profileId, profileIndex) => {
+                const profileField = `${fieldName}.profiles[${profileIndex}]`;
+                if (typeof profileId !== 'string' || profileId.trim() === '') {
+                    error(`${profileField} must be a non-empty string`);
+                    return;
+                }
+                const profile = profilesById.get(profileId);
+                if (!profile) {
+                    error(`${fieldName} references unknown profile ${JSON.stringify(profileId)}`);
+                }
+                else if (profile.runModel !== true) {
+                    error(`${fieldName} cannot execute materialize-only profile ${JSON.stringify(profileId)}`);
+                }
+                if (profile) {
+                    for (const skillName of suiteSkills) {
+                        if (!profile.skillOwners.has(skillName)) {
+                            error(`${fieldName} requires Skill ${JSON.stringify(skillName)}, but profile ` +
+                                `${JSON.stringify(profileId)} does not install a plugin that declares it`);
+                        }
+                    }
+                }
+            });
+        }
+        if (!Number.isInteger(suite.defaultRuns) || suite.defaultRuns <= 0) {
+            error(`${fieldName}.defaultRuns must be a positive integer`);
+        }
+        if (!Number.isInteger(suite.perRunTimeoutMs) || suite.perRunTimeoutMs <= 0) {
+            error(`${fieldName}.perRunTimeoutMs must be a positive integer`);
+        }
+        if (typeof suite.requiredForRelease !== 'boolean') {
+            error(`${fieldName}.requiredForRelease must be boolean`);
+        }
+        if (!Array.isArray(suite.releaseSplits)) {
+            error(`${fieldName}.releaseSplits must be an array`);
+        }
+        else {
+            suite.releaseSplits.forEach((split, splitIndex) => {
+                if (!PLUGIN_EVAL_SPLITS.has(split)) {
+                    error(`${fieldName}.releaseSplits[${splitIndex}] is unsupported`);
+                }
+            });
+        }
+        if (suite.kind === 'command') {
+            validateAllowedKeys(suite, fieldName, [
+                'id', 'kind', 'skills', 'entry', 'cases', 'profiles', 'defaultRuns', 'releaseSplits',
+                'requiredForRelease', 'perRunTimeoutMs', 'suiteTimeoutMs', 'supports',
+            ]);
+            validateEvalRelativeFile(evalDir, suite.entry, `${fieldName}.entry`);
+            if (!Number.isInteger(suite.suiteTimeoutMs) || suite.suiteTimeoutMs <= 0) {
+                error(`${fieldName}.suiteTimeoutMs must be a positive integer`);
+            }
+            else if (suite.suiteTimeoutMs < suite.perRunTimeoutMs) {
+                error(`${fieldName}.suiteTimeoutMs must be greater than or equal to perRunTimeoutMs`);
+            }
+            if (!Array.isArray(suite.supports)) {
+                error(`${fieldName}.supports must be an array`);
+            }
+            else {
+                suite.supports.forEach((support, supportIndex) => {
+                    if (!PLUGIN_EVAL_COMMAND_SUPPORTS.has(support)) {
+                        error(`${fieldName}.supports[${supportIndex}] is unsupported`);
+                    }
+                });
+                if (Array.isArray(suite.releaseSplits) &&
+                    suite.releaseSplits.length > 0 &&
+                    !suite.supports.includes('split')) {
+                    error(`${fieldName} declares releaseSplits but does not support split`);
+                }
+                const supportsCase = suite.supports.includes('case');
+                if (supportsCase && suite.cases === undefined) {
+                    error(`${fieldName}.cases is required when supports includes case`);
+                }
+                else if (!supportsCase && suite.cases !== undefined) {
+                    error(`${fieldName}.cases requires supports to include case`);
+                }
+                if (supportsCase && suite.cases !== undefined) {
+                    const casesPath = validateEvalRelativeFile(evalDir, suite.cases, `${fieldName}.cases`);
+                    if (casesPath) {
+                        try {
+                            const casesDocument = JSON.parse(fs.readFileSync(casesPath, 'utf8'));
+                            if (!isRecord(casesDocument) || casesDocument.skill_name !== skill) {
+                                error(`${fieldName}.cases.skill_name must match ${JSON.stringify(skill)}`);
+                            }
+                            else if (!Array.isArray(casesDocument.evals) || casesDocument.evals.length === 0) {
+                                error(`${fieldName}.cases.evals must be a non-empty array`);
+                            }
+                            else {
+                                const caseIds = new Set();
+                                casesDocument.evals.forEach((entry, caseIndex) => {
+                                    const caseField = `${fieldName}.cases.evals[${caseIndex}]`;
+                                    if (!isRecord(entry) || typeof entry.id !== 'string' || !/^[a-z0-9_]+$/.test(entry.id)) {
+                                        error(`${caseField}.id must use lowercase snake_case`);
+                                    }
+                                    else if (caseIds.has(entry.id)) {
+                                        error(`${fieldName}.cases has duplicate case id ${JSON.stringify(entry.id)}`);
+                                    }
+                                    else {
+                                        caseIds.add(entry.id);
+                                    }
+                                });
+                            }
+                        }
+                        catch (cause) {
+                            error(`${fieldName}.cases is not valid JSON: ${cause.message}`);
+                        }
+                    }
+                }
+            }
+        }
+        else if (suite.kind === 'conversation' || suite.kind === 'trigger') {
+            const normalizedSuite = { ...suite, skill };
+            const isolation = suite.isolation ?? 'standard';
+            if (isolation !== 'standard' && isolation !== 'strict') {
+                error(`${fieldName}.isolation must be standard or strict`);
+            }
+            if (suite.kind === 'conversation') {
+                validateAllowedKeys(suite, fieldName, [
+                    'id', 'kind', 'skills', 'cases', 'profiles', 'defaultRuns', 'releaseSplits',
+                    'requiredForRelease', 'perRunTimeoutMs', 'isolation',
+                ]);
+                if (Array.isArray(suite.releaseSplits) && suite.releaseSplits.length > 0) {
+                    error(`${fieldName} cannot declare releaseSplits because conversation cases do not support split filtering`);
+                }
+                validateConversationCaseCorpus(evalDir, normalizedSuite, fieldName);
+            }
+            else {
+                validateAllowedKeys(suite, fieldName, [
+                    'id', 'kind', 'skills', 'cases', 'fixtureModule', 'observeSpawnAgent', 'isolation',
+                    'strictNegativeSplits', 'minimumPassRate', 'forbidMultipleSkillLoads',
+                    'profiles', 'defaultRuns', 'releaseSplits',
+                    'requiredForRelease', 'perRunTimeoutMs',
+                ]);
+                if (typeof suite.observeSpawnAgent !== 'boolean') {
+                    error(`${fieldName}.observeSpawnAgent must be boolean`);
+                }
+                if (!Array.isArray(suite.strictNegativeSplits)) {
+                    error(`${fieldName}.strictNegativeSplits must be an array`);
+                }
+                else {
+                    suite.strictNegativeSplits.forEach((split, splitIndex) => {
+                        if (!PLUGIN_EVAL_TRIGGER_CASE_SPLITS.has(split)) {
+                            error(`${fieldName}.strictNegativeSplits[${splitIndex}] is unsupported`);
+                        }
+                    });
+                }
+                if (suite.minimumPassRate !== undefined &&
+                    (typeof suite.minimumPassRate !== 'number' ||
+                        !Number.isFinite(suite.minimumPassRate) ||
+                        suite.minimumPassRate <= 0 ||
+                        suite.minimumPassRate > 1)) {
+                    error(`${fieldName}.minimumPassRate must be greater than 0 and at most 1`);
+                }
+                if (suite.forbidMultipleSkillLoads !== undefined &&
+                    typeof suite.forbidMultipleSkillLoads !== 'boolean') {
+                    error(`${fieldName}.forbidMultipleSkillLoads must be boolean`);
+                }
+                if (suite.fixtureModule !== undefined) {
+                    const fixturePath = validateEvalRelativeFile(evalDir, suite.fixtureModule, `${fieldName}.fixtureModule`);
+                    if (fixturePath && path.extname(fixturePath) !== '.mjs') {
+                        error(`${fieldName}.fixtureModule must reference an .mjs file`);
+                    }
+                }
+                validateTriggerCaseCorpus(evalDir, normalizedSuite, fieldName);
+            }
+        }
+    });
+    if (skill
+        && collectDeclaredSkillNames(pluginDir, pluginManifest).dynamic.has(skill)
+        && !manifest.suites.some((suite) => isRecord(suite) && suite.requiredForRelease === true)) {
+        error(`${manifestField}.suites must include at least one release-required suite for dynamic Skill ${JSON.stringify(skill)}`);
+    }
+}
+function validatePluginEvalManifest(pluginDir, pluginManifest) {
+    const legacyRoot = path.join(pluginDir, 'evals');
+    if (fs.existsSync(legacyRoot)) {
+        error('Plugin-root evals/ is legacy; put evals/ inside its owning static or dynamic Skill directory.');
+    }
+    const skillRoots = [...collectDeclaredSkillNames(pluginDir, pluginManifest).all]
+        .sort()
+        .map((skill) => ({ skill, root: path.join(pluginDir, 'skills', skill) }));
+    const seenSkills = new Set();
+    for (const owner of skillRoots) {
+        const evalDir = path.join(owner.root, 'evals');
+        const manifestPath = path.join(evalDir, 'manifest.json');
+        if (!fs.existsSync(manifestPath))
+            continue;
+        if (seenSkills.has(owner.skill)) {
+            error(`Skill ${JSON.stringify(owner.skill)} has more than one evals/manifest.json owner`);
+            continue;
+        }
+        seenSkills.add(owner.skill);
+        validateOnePluginEvalManifest(pluginDir, pluginManifest, evalDir, owner.skill);
+    }
+}
+function countCharacters(value) {
+    return Array.from(value).length;
+}
+function countLines(value) {
+    if (value.length === 0)
+        return 0;
+    const normalized = value.replace(/\r\n?/g, '\n');
+    const withoutFinalNewline = normalized.endsWith('\n')
+        ? normalized.slice(0, -1)
+        : normalized;
+    return withoutFinalNewline.split('\n').length;
+}
+function sanitizeSingleLine(value) {
+    return value.trim().split(/\s+/).filter(Boolean).join(' ');
+}
+function validateCodexMetadataString(record, key, fieldName, maxLength, required = false) {
+    if (record[key] === undefined) {
+        if (required) {
+            error(`${fieldName}.${key} is required`);
+        }
+        return null;
+    }
+    if (typeof record[key] !== 'string') {
+        error(`${fieldName}.${key} must be a string`);
+        return null;
+    }
+    const sanitized = sanitizeSingleLine(record[key]);
+    if (sanitized.length === 0) {
+        error(`${fieldName}.${key} must not be empty`);
+        return null;
+    }
+    if (countCharacters(sanitized) > maxLength) {
+        error(`${fieldName}.${key} must be <= ${maxLength} characters`);
+    }
+    return sanitized;
+}
+function validateCodexShortDescription(record, fieldName) {
+    const sanitized = validateCodexMetadataString(record, 'short_description', fieldName, MAX_OPENAI_INTERFACE_DESCRIPTION_LEN);
+    if (sanitized !== null &&
+        countCharacters(sanitized) < MIN_OPENAI_INTERFACE_DESCRIPTION_LEN) {
+        error(`${fieldName}.short_description must be >= ${MIN_OPENAI_INTERFACE_DESCRIPTION_LEN} characters`);
+    }
+    return sanitized;
+}
+function validateCodexDefaultPrompt(record, key, fieldName, maxLength, skillReference, required = false) {
+    const sanitized = validateCodexMetadataString(record, key, fieldName, maxLength, required);
+    if (sanitized === null)
+        return null;
+    const mention = `$${skillReference}`;
+    if (!sanitized.includes(mention)) {
+        error(`${fieldName}.${key} must explicitly mention "${mention}"`);
+    }
+    return sanitized;
+}
+function validateCodexBrandColor(record, key, fieldName) {
+    if (record[key] === undefined)
+        return;
+    if (typeof record[key] !== 'string') {
+        error(`${fieldName}.${key} must be a string`);
+        return;
+    }
+    const value = record[key].trim();
+    if (value.length === 0) {
+        error(`${fieldName}.${key} must not be empty`);
+        return;
+    }
+    if (!/^#[0-9a-fA-F]{6}$/.test(value)) {
+        error(`${fieldName}.${key} must match #RRGGBB`);
+    }
+}
+function validateCodexIconPath(record, key, fieldName) {
+    if (record[key] === undefined)
+        return;
+    if (typeof record[key] !== 'string') {
+        error(`${fieldName}.${key} must be a string`);
+        return;
+    }
+    const value = record[key].trim();
+    if (value.length === 0) {
+        error(`${fieldName}.${key} must not be empty`);
+        return;
+    }
+    if (path.isAbsolute(value) || path.win32.isAbsolute(value)) {
+        error(`${fieldName}.${key} must be a relative path under assets/`);
+        return;
+    }
+    const components = value.split('/');
+    if (components.some((component) => component === '..')) {
+        error(`${fieldName}.${key} must be a relative path under assets/`);
+        return;
+    }
+    const normalized = path.posix.normalize(stripDotSlash(value));
+    if (normalized !== 'assets' && !normalized.startsWith('assets/')) {
+        error(`${fieldName}.${key} must be a relative path under assets/`);
+    }
+}
+function validateAllowedTools(value, fieldName, options) {
+    if (typeof value === 'string') {
+        if (value.trim().length === 0) {
+            error(`${fieldName} must not be an empty string`);
+        }
+        return;
+    }
+    if (!options.allowArray) {
+        error(`${fieldName} must be a space-separated string in the Agent Skills portable core profile`);
+        return;
+    }
+    if (!Array.isArray(value)) {
+        error(`${fieldName} must be a string or an array of strings`);
+        return;
+    }
+    for (const [index, item] of value.entries()) {
+        if (typeof item !== 'string') {
+            error(`${fieldName}[${index}] must be a string`);
+        }
+        else if (item.trim().length === 0) {
+            error(`${fieldName}[${index}] must not be empty`);
+        }
+    }
+}
+function isNonEmptyFrontmatterString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function isFrontmatterStringArray(value) {
+    return Array.isArray(value) && value.every(isNonEmptyFrontmatterString);
+}
+function frontmatterValueMatchesType(value, type) {
+    switch (type) {
+        case 'boolean':
+            return typeof value === 'boolean';
+        case 'boolean-or-string':
+            return typeof value === 'boolean' || isNonEmptyFrontmatterString(value);
+        case 'boolean-or-string-or-binary-number':
+            return typeof value === 'boolean'
+                || isNonEmptyFrontmatterString(value)
+                || value === 0
+                || value === 1;
+        case 'object':
+            return value !== null && typeof value === 'object' && !Array.isArray(value);
+        case 'string':
+            return isNonEmptyFrontmatterString(value);
+        case 'string-map':
+            return value !== null && typeof value === 'object' && !Array.isArray(value)
+                && Object.values(value).every((entry) => typeof entry === 'string');
+        case 'string-or-integer':
+            return isNonEmptyFrontmatterString(value)
+                || (typeof value === 'number' && Number.isInteger(value));
+        case 'string-or-string-array':
+            return isNonEmptyFrontmatterString(value) || isFrontmatterStringArray(value);
+        default:
+            return false;
+    }
+}
+function skillFrontmatterProfile(options) {
+    if (options.strictAgentSkills || !options.targetsClaude) {
+        return 'portable-agent-skills';
+    }
+    return options.claudeSkillProfile === 'current'
+        ? 'claude-current'
+        : 'claude-2.1.88';
+}
+function validateSkillFrontmatterCapabilityFields(fm, fieldName, profile) {
+    let registry;
+    try {
+        registry = loadSkillFrontmatterCapabilityRegistry();
+    }
+    catch (registryError) {
+        error(`${fieldName} capability registry error: ${registryError.message}`);
+        return;
+    }
+    for (const [key, value] of Object.entries(fm)) {
+        const capability = registry.fields[key];
+        if (!capability) {
+            error(`${fieldName} [unknown-field] field ${JSON.stringify(key)} is not registered for any supported profile`);
+            continue;
+        }
+        if (!capability.profiles.includes(profile)) {
+            if (profile === 'portable-agent-skills' && capability.owner !== 'agent-skills') {
+                error(`${fieldName} [portable-profile-platform-extension] field ${JSON.stringify(key)} is a Claude Code extension`);
+            }
+            else {
+                const version = capability.introducedVersion
+                    ? `; documented minimum is Claude Code ${capability.introducedVersion}`
+                    : '';
+                error(`${fieldName} [known-field-not-supported-by-target-version] field ${JSON.stringify(key)} is not supported by profile ${JSON.stringify(profile)}${version}`);
+            }
+            continue;
+        }
+        const expectedType = capability.typeByProfile?.[profile] ?? capability.type;
+        if (!frontmatterValueMatchesType(value, expectedType)) {
+            error(`${fieldName} [known-field-invalid-type-value] field ${JSON.stringify(key)} must have type ${JSON.stringify(expectedType)} in profile ${JSON.stringify(profile)}`);
+            continue;
+        }
+        const acceptedValues = capability.acceptedValuesByProfile?.[profile]
+            ?? capability.acceptedValues;
+        const acceptedValuesCaseInsensitive = capability.acceptedValuesCaseInsensitiveByProfile?.[profile]
+            ?? capability.acceptedValuesCaseInsensitive
+            ?? false;
+        if (typeof value === 'string' &&
+            acceptedValues &&
+            !acceptedValues.includes(acceptedValuesCaseInsensitive ? value.trim().toLowerCase() : value.trim())) {
+            error(`${fieldName} [known-field-invalid-type-value] field ${JSON.stringify(key)} must be one of ${acceptedValues.map((entry) => JSON.stringify(entry)).join(', ')}`);
+        }
+        for (const [requiredKey, requiredValue] of Object.entries(capability.requires ?? {})) {
+            if (fm[requiredKey] !== requiredValue) {
+                error(`${fieldName} [known-field-requires-related-field] field ${JSON.stringify(key)} requires ${JSON.stringify(requiredKey)}=${JSON.stringify(requiredValue)}`);
+            }
+        }
+    }
+    for (const [key, capability] of Object.entries(registry.fields)) {
+        if (capability.required && capability.profiles.includes(profile) && fm[key] === undefined) {
+            error(`${fieldName} [known-field-invalid-type-value] required field ${JSON.stringify(key)} is missing for profile ${JSON.stringify(profile)}`);
+        }
+    }
+}
+function validateSkillFrontmatter(fm, skillName, options) {
+    const fieldName = `skills/${skillName}/SKILL.md frontmatter`;
+    const profile = skillFrontmatterProfile(options);
+    validateSkillFrontmatterCapabilityFields(fm, fieldName, profile);
+    if (fm.name === undefined) {
+        error(`${fieldName} missing "name"`);
+    }
+    else {
+        const name = validateNonEmptyString(fm.name, `${fieldName}.name`, MAX_SKILL_NAME_LEN);
+        if (name) {
+            if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) {
+                error(`${fieldName}.name must use ASCII lowercase hyphen-case`);
+            }
+            if (name !== skillName) {
+                error(`${fieldName}.name "${name}" must match skill directory "${skillName}"`);
+            }
+        }
+    }
+    if (fm.description === undefined) {
+        error(`${fieldName} missing "description"`);
+    }
+    else {
+        validateNonEmptyString(fm.description, `${fieldName}.description`, MAX_SKILL_DESCRIPTION_LEN);
+    }
+    if (fm.license !== undefined) {
+        validateNonEmptyString(fm.license, `${fieldName}.license`);
+    }
+    if (fm.compatibility !== undefined) {
+        validateNonEmptyString(fm.compatibility, `${fieldName}.compatibility`, MAX_SKILL_COMPATIBILITY_LEN);
+    }
+    if (fm.metadata !== undefined) {
+        const metadata = expectRecord(fm.metadata, `${fieldName}.metadata`);
+        if (metadata) {
+            if (profile !== 'claude-current') {
+                for (const [key, value] of Object.entries(metadata)) {
+                    if (typeof value !== 'string') {
+                        error(`${fieldName}.metadata.${key} must be a string`);
+                    }
+                }
+            }
+            if (metadata['short-description'] !== undefined) {
+                validateNonEmptyString(metadata['short-description'], `${fieldName}.metadata.short-description`, MAX_SKILL_SHORT_DESCRIPTION_LEN);
+            }
+        }
+    }
+}
+function isCodexTargeted(manifest) {
+    return supportsManifestPlatform(manifest, 'codex');
+}
+function isClaudeTargeted(manifest) {
+    return supportsManifestPlatform(manifest, 'claude');
+}
+function targetedPlatforms(manifest) {
+    const platforms = [];
+    if (isClaudeTargeted(manifest))
+        platforms.push('claude');
+    if (isCodexTargeted(manifest))
+        platforms.push('codex');
+    return platforms.length > 0 ? platforms : ['claude', 'codex'];
+}
+// ---------------------------------------------------------------------------
+// Supplemental checks (always run — not covered by CLI validator)
+// ---------------------------------------------------------------------------
+function validateNameMatchesDirectory(pluginDir, manifest) {
+    const pluginName = path.basename(pluginDir);
+    if (manifest.name && manifest.name !== pluginName) {
+        error(`manifest name "${manifest.name}" does not match directory name "${pluginName}"`);
+    }
+}
+function validateNoBuildOutputDirs(pluginDir) {
+    if (fs.existsSync(path.join(pluginDir, '.claude-plugin'))) {
+        error('.claude-plugin/ directory must not exist in plugin source (it is a build output)');
+    }
+    if (fs.existsSync(path.join(pluginDir, '.codex-plugin'))) {
+        error('.codex-plugin/ directory must not exist in plugin source (it is a build output)');
+    }
+}
+function validateDeclaredPathsExist(pluginDir, manifest) {
+    for (const field of ['skills', 'slashCommands', 'mcpServers', 'apps']) {
+        if (!manifest[field])
+            continue;
+        const resolved = path.join(pluginDir, manifest[field]);
+        if (!fs.existsSync(resolved)) {
+            error(`${field} points to "${manifest[field]}" but path does not exist: ${resolved}`);
+        }
+    }
+}
+function validateCanonicalSkillLayout(pluginDir, manifest) {
+    if (manifest.skills && normalizeRelativePath(manifest.skills) !== 'skills') {
+        error('skills must be "./skills"');
+    }
+    const pluginReadme = path.join(pluginDir, 'README.md');
+    if (!fs.statSync(pluginReadme, { throwIfNoEntry: false })?.isFile()) {
+        error('Plugin root README.md is required');
+    }
+    else {
+        const content = fs.readFileSync(pluginReadme, 'utf8');
+        if (content.trim() === '')
+            error('Plugin root README.md must not be empty');
+    }
+    const declared = collectDeclaredSkillNames(pluginDir, manifest);
+    const sourceBackedDynamicSkills = (Array.isArray(manifest.artifacts?.targets)
+        ? manifest.artifacts.targets
+        : [])
+        .filter((target) => target &&
+        typeof target === 'object' &&
+        (target.target === 'codex.skill' || target.target === 'claude.skill') &&
+        typeof target.skillKey === 'string' &&
+        Array.isArray(target.sourceDirs) &&
+        target.sourceDirs.length > 0)
+        .map((target) => target.skillKey.trim());
+    for (const skill of new Set([...declared.static, ...sourceBackedDynamicSkills])) {
+        const skillRoot = path.join(pluginDir, 'skills', skill);
+        if (!fs.statSync(skillRoot, { throwIfNoEntry: false })?.isDirectory()) {
+            error(`Skill ${JSON.stringify(skill)} must use source root "./skills/${skill}"`);
+            continue;
+        }
+        const skillReadme = path.join(skillRoot, 'README.md');
+        if (!fs.statSync(skillReadme, { throwIfNoEntry: false })?.isFile()) {
+            error(`skills/${skill}/README.md is required`);
+            continue;
+        }
+        const content = fs.readFileSync(skillReadme, 'utf8');
+        if (content.trim() === '') {
+            error(`skills/${skill}/README.md must not be empty`);
+        }
+    }
+    const portableRoot = manifest.distributions?.agentSkills?.skills;
+    for (const skill of declared.portable) {
+        const skillRoot = path.join(pluginDir, portableRoot, skill);
+        const skillReadme = path.join(skillRoot, 'README.md');
+        if (!fs.statSync(skillReadme, { throwIfNoEntry: false })?.isFile()) {
+            error(`${normalizeRelativePath(path.join(portableRoot, skill, 'README.md'))} is required`);
+            continue;
+        }
+        if (fs.readFileSync(skillReadme, 'utf8').trim() === '') {
+            error(`${normalizeRelativePath(path.join(portableRoot, skill, 'README.md'))} must not be empty`);
+        }
+    }
+}
+function validateDeclaredNativeAssets(pluginDir, manifest) {
+    const defaults = [
+        ['skills', 'skills'],
+        [DEFAULT_SLASH_COMMANDS_DIR, 'slashCommands'],
+        ['.mcp.json', 'mcpServers'],
+        ['.app.json', 'apps'],
+    ];
+    for (const [filename, field] of defaults) {
+        const fullPath = path.join(pluginDir, filename);
+        if (fs.existsSync(fullPath) && !manifest[field]) {
+            if (field === 'skills') {
+                const dynamicSkills = new Set((Array.isArray(manifest.artifacts?.targets) ? manifest.artifacts.targets : [])
+                    .filter((target) => {
+                    if (!target ||
+                        typeof target !== 'object' ||
+                        (target.target !== 'codex.skill' && target.target !== 'claude.skill') ||
+                        typeof target.skillKey !== 'string' ||
+                        !Array.isArray(target.sourceDirs) ||
+                        target.sourceDirs.length === 0)
+                        return false;
+                    return target.sourceDirs.every((sourceDir) => typeof sourceDir === 'string' &&
+                        (normalizeRelativePath(sourceDir) === `skills/${target.skillKey}` ||
+                            normalizeRelativePath(sourceDir).startsWith(`skills/${target.skillKey}/`)));
+                })
+                    .map((target) => target.skillKey));
+                const entries = fs.readdirSync(fullPath, { withFileTypes: true });
+                if (entries.length > 0 &&
+                    entries.every((entry) => entry.isDirectory() && dynamicSkills.has(entry.name))) {
+                    continue;
+                }
+            }
+            error(`"${filename}" exists but manifest does not declare "${field}" — declare it or remove the file`);
+        }
+    }
+}
+function validatePluginVersionContracts(manifest, options) {
+    if (manifest.compatibility === undefined) {
+        error('Invalid compatibility.aw.minVersion: expected a strict SemVer 2.0.0 string. Received undefined.');
+        return;
+    }
+    const compatibility = expectRecord(manifest.compatibility, 'compatibility');
+    if (!compatibility) {
+        return;
+    }
+    validateAllowedKeys(compatibility, 'compatibility', ['aw']);
+    if (compatibility.aw === undefined) {
+        error('Invalid compatibility.aw.minVersion: expected a strict SemVer 2.0.0 string. Received undefined.');
+        return;
+    }
+    const aw = expectRecord(compatibility.aw, 'compatibility.aw');
+    if (!aw) {
+        return;
+    }
+    validateAllowedKeys(aw, 'compatibility.aw', ['minVersion']);
+    const pluginMinVersion = validateStrictSemVerString(aw.minVersion, 'compatibility.aw.minVersion');
+    if (!pluginMinVersion || !options.catalogMinVersion) {
+        return;
+    }
+    if (compareStrictSemVer(pluginMinVersion, options.catalogMinVersion) > 0) {
+        error(`Invalid compatibility.aw.minVersion for plugin "${pluginNameForError(manifest)}": received ${JSON.stringify(pluginMinVersion)}, which is higher than target catalog minimum ${JSON.stringify(options.catalogMinVersion)}.`);
+    }
+}
+function collectDeclaredSkillNames(pluginDir, manifest) {
+    const skillsRoot = typeof manifest.skills === 'string'
+        ? path.join(pluginDir, manifest.skills)
+        : null;
+    const staticSkillNames = skillsRoot && fs.existsSync(skillsRoot)
+        ? fs.readdirSync(skillsRoot, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => entry.name)
+            .sort()
+        : [];
+    const staticSkillNameSet = new Set(staticSkillNames);
+    const artifactTargets = Array.isArray(manifest.artifacts?.targets)
+        ? manifest.artifacts.targets
+        : [];
+    const dynamicSkillNames = artifactTargets
+        .filter((target) => target
+        && typeof target === 'object'
+        && (target.target === 'codex.skill' || target.target === 'claude.skill')
+        && typeof target.skillKey === 'string'
+        && target.skillKey.trim() !== '')
+        .map((target) => target.skillKey.trim())
+        .sort();
+    const dynamicSkillNameSet = new Set(dynamicSkillNames);
+    const portableRoot = typeof manifest.distributions?.agentSkills?.skills === 'string'
+        ? path.join(pluginDir, manifest.distributions.agentSkills.skills)
+        : null;
+    const portableRootStats = portableRoot
+        ? fs.lstatSync(portableRoot, { throwIfNoEntry: false })
+        : null;
+    const portableSkillNameSet = new Set(portableRootStats?.isDirectory() && !portableRootStats.isSymbolicLink()
+        ? fs.readdirSync(portableRoot, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => entry.name)
+        : []);
+    return {
+        static: staticSkillNameSet,
+        dynamic: dynamicSkillNameSet,
+        portable: portableSkillNameSet,
+        all: new Set([...staticSkillNames, ...dynamicSkillNames]),
+    };
+}
+function isNodeRunnablePath(relativePath) {
+    return SCRIPT_NODE_EXTENSIONS.has(path.posix.extname(normalizeRelativePath(relativePath)));
+}
+function isAutoRunnablePath(relativePath) {
+    return SCRIPT_AUTO_EXTENSIONS.has(path.posix.extname(normalizeRelativePath(relativePath)).toLowerCase());
+}
+function normalizePluginScriptPath(pluginDir, value, fieldName) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        error(`${fieldName} must be a non-empty string`);
+        return null;
+    }
+    if (/\s|[;&|<>`]/.test(value) || value.includes('$(')) {
+        error(`${fieldName} must be a file path, not an inline command`);
+        return null;
+    }
+    if (!value.startsWith('./')) {
+        error(`${fieldName} must start with "./"`);
+        return null;
+    }
+    if (path.isAbsolute(value) || path.win32.isAbsolute(value)) {
+        error(`${fieldName} must be relative to the plugin root`);
+        return null;
+    }
+    const relativePath = normalizeRelativePath(value);
+    if (relativePath === '.' || relativePath === '..' || relativePath.startsWith('../')) {
+        error(`${fieldName} must stay inside the plugin root`);
+        return null;
+    }
+    const absolutePath = path.resolve(pluginDir, relativePath);
+    const relativeFromRoot = path.relative(pluginDir, absolutePath);
+    if (relativeFromRoot.startsWith('..') || path.isAbsolute(relativeFromRoot)) {
+        error(`${fieldName} must stay inside the plugin root`);
+        return null;
+    }
+    return relativePath;
+}
+function validateDeclaredScriptFile(pluginDir, relativePath, fieldName) {
+    if (!relativePath)
+        return;
+    const absolutePath = path.join(pluginDir, relativePath);
+    const stats = fs.statSync(absolutePath, { throwIfNoEntry: false });
+    if (!stats?.isFile()) {
+        error(`${fieldName} points to "${relativePath}" but the file does not exist`);
+    }
+}
+function validateScriptEntry(pluginDir, value, fieldName, options = {}) {
+    const entry = expectRecord(value, fieldName);
+    if (!entry)
+        return null;
+    if ('command' in entry) {
+        error(`${fieldName}.command is not supported; declare runner/path instead`);
+    }
+    validateAllowedKeys(entry, fieldName, ['runner', 'path', 'args']);
+    const runner = validateManifestString(entry.runner, `${fieldName}.runner`);
+    if (runner && !SCRIPT_RUNNERS.has(runner)) {
+        error(`${fieldName}.runner has unsupported runner "${runner}"`);
+    }
+    if (options.requireNodeRunner && runner !== 'node') {
+        error(`${fieldName}.runner must be "node"`);
+    }
+    const relativePath = normalizePluginScriptPath(pluginDir, entry.path, `${fieldName}.path`);
+    validateDeclaredScriptFile(pluginDir, relativePath, `${fieldName}.path`);
+    if (runner === 'auto' && relativePath && !isAutoRunnablePath(relativePath)) {
+        error(`${fieldName}.path uses runner "auto" but has no supported extension (${[...SCRIPT_AUTO_EXTENSIONS].join(', ')})`);
+    }
+    if (options.requireNodePath && relativePath && !isNodeRunnablePath(relativePath)) {
+        error(`${fieldName}.path must use a Node runnable extension (.js, .mjs, or .cjs)`);
+    }
+    if (entry.args !== undefined) {
+        if (!Array.isArray(entry.args)) {
+            error(`${fieldName}.args must be an array of strings`);
+        }
+        else {
+            entry.args.forEach((arg, index) => {
+                if (typeof arg !== 'string') {
+                    error(`${fieldName}.args[${index}] must be a string`);
+                }
+            });
+        }
+    }
+    return runner && relativePath ? { runner, path: relativePath } : null;
+}
+function validateLifecycleDefinition(pluginDir, value, fieldName, runtimeEntries) {
+    if (typeof value === 'string') {
+        const relativePath = normalizePluginScriptPath(pluginDir, value, fieldName);
+        validateDeclaredScriptFile(pluginDir, relativePath, fieldName);
+        if (relativePath && !isAutoRunnablePath(relativePath)) {
+            error(`${fieldName} uses runner "auto" but has no supported extension (${[...SCRIPT_AUTO_EXTENSIONS].join(', ')})`);
+        }
+        if (relativePath && isNodeRunnablePath(relativePath)) {
+            runtimeEntries.push({ path: relativePath, fieldName });
+        }
+        return { default: relativePath ? { runner: 'auto', path: relativePath } : null };
+    }
+    const selector = expectRecord(value, fieldName);
+    if (!selector)
+        return {};
+    if ('runner' in selector || 'path' in selector || 'command' in selector) {
+        error(`${fieldName} must declare lifecycle scripts under OS selectors`);
+    }
+    for (const selectorName of Object.keys(selector)) {
+        if (!SCRIPT_OS_SELECTORS.has(selectorName)) {
+            error(`${fieldName} has unknown OS selector "${selectorName}"`);
+        }
+    }
+    const normalized = {};
+    for (const [selectorName, entryValue] of Object.entries(selector)) {
+        const entry = validateScriptEntry(pluginDir, entryValue, `${fieldName}.${selectorName}`);
+        if (entry) {
+            normalized[selectorName] = entry;
+            if (entry.runner === 'node' || (entry.runner === 'auto' && isNodeRunnablePath(entry.path))) {
+                runtimeEntries.push({ path: entry.path, fieldName: `${fieldName}.${selectorName}.path` });
+            }
+        }
+    }
+    const orders = {
+        linux: ['linux', 'unix', 'default'],
+        darwin: ['darwin', 'unix', 'default'],
+        win32: ['win32', 'windows', 'default'],
+    };
+    for (const [osName, order] of Object.entries(orders)) {
+        if (!order.some((selectorName) => normalized[selectorName])) {
+            error(`${fieldName} must include an entry that resolves on ${osName}`);
+        }
+    }
+    return normalized;
+}
+function isNonRegistryDependencySpecifier(specifier) {
+    const trimmed = String(specifier).trim();
+    return (/^(?:workspace|file|link|portal):/i.test(trimmed) ||
+        /^(?:git\+|git:|ssh:)/i.test(trimmed) ||
+        /^https?:\/\//i.test(trimmed) ||
+        /(?:\.tgz|\.tar\.gz)(?:[#?].*)?$/i.test(trimmed) ||
+        trimmed.startsWith('./') ||
+        trimmed.startsWith('../') ||
+        trimmed.startsWith('/') ||
+        trimmed.startsWith('~') ||
+        /^[\w.-]+\/[\w.-]+(?:#.*)?$/.test(trimmed));
+}
+function readPackageDependencyNames(packageJson, fieldName, dependencyField) {
+    const rawDependencies = packageJson[dependencyField];
+    if (rawDependencies === undefined)
+        return [];
+    const dependencies = expectRecord(rawDependencies, `${fieldName}.${dependencyField}`);
+    if (!dependencies)
+        return [];
+    const names = [];
+    for (const [name, specifier] of Object.entries(dependencies)) {
+        if (typeof specifier !== 'string') {
+            error(`${fieldName}.${dependencyField}.${name} must be a string specifier`);
+            continue;
+        }
+        if (isNonRegistryDependencySpecifier(specifier)) {
+            error(`${fieldName}.${dependencyField}.${name} uses non registry-backed specifier "${specifier}"`);
+        }
+        names.push(name);
+    }
+    return names;
+}
+function validatePackageRoot(pluginDir, packageRootValue, fieldName) {
+    const packageRoot = normalizePluginScriptPath(pluginDir, packageRootValue, fieldName);
+    if (!packageRoot)
+        return null;
+    const absolutePackageRoot = path.join(pluginDir, packageRoot);
+    const stats = fs.statSync(absolutePackageRoot, { throwIfNoEntry: false });
+    if (!stats?.isDirectory()) {
+        error(`${fieldName} must point to a package directory`);
+        return { packageRoot, dependencies: [], devDependencies: [] };
+    }
+    for (const lockfile of ['package-lock.json', 'yarn.lock', 'bun.lock', 'bun.lockb']) {
+        if (fs.existsSync(path.join(absolutePackageRoot, lockfile))) {
+            error(`${fieldName} only supports pnpm-lock.yaml, found ${lockfile}`);
+        }
+    }
+    const packageJsonPath = path.join(absolutePackageRoot, 'package.json');
+    const lockfilePath = path.join(absolutePackageRoot, 'pnpm-lock.yaml');
+    if (!fs.existsSync(packageJsonPath)) {
+        error(`${fieldName} is missing package.json`);
+    }
+    if (!fs.existsSync(lockfilePath)) {
+        error(`${fieldName} is missing pnpm-lock.yaml`);
+    }
+    let packageJson = {};
+    if (fs.existsSync(packageJsonPath)) {
+        try {
+            packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+        }
+        catch (e) {
+            error(`${fieldName}/package.json is not valid JSON: ${e.message}`);
+            packageJson = {};
+        }
+    }
+    if (packageJson.optionalDependencies !== undefined) {
+        error(`${fieldName}/package.json optionalDependencies are not supported`);
+    }
+    if (packageJson.bundledDependencies !== undefined || packageJson.bundleDependencies !== undefined) {
+        error(`${fieldName}/package.json bundledDependencies are not supported`);
+    }
+    return {
+        packageRoot,
+        dependencies: readPackageDependencyNames(packageJson, fieldName, 'dependencies'),
+        devDependencies: readPackageDependencyNames(packageJson, fieldName, 'devDependencies'),
+    };
+}
+function isRelativeSpecifier(specifier) {
+    return specifier === '.' || specifier === '..' || specifier.startsWith('./') || specifier.startsWith('../');
+}
+function packageNameFromSpecifier(specifier) {
+    if (specifier.startsWith('@')) {
+        const [scope, name] = specifier.split('/');
+        return `${scope}/${name ?? ''}`;
+    }
+    return specifier.split('/')[0];
+}
+function resolveRelativeJavaScriptImport(importer, specifier, pluginDir) {
+    const importerDir = path.posix.dirname(importer);
+    const normalized = path.posix.normalize(path.posix.join(importerDir, specifier));
+    if (normalized === '..' || normalized.startsWith('../') || path.posix.isAbsolute(normalized)) {
+        return { escaped: true, path: normalized };
+    }
+    const candidates = [
+        normalized,
+        `${normalized}.js`,
+        `${normalized}.mjs`,
+        `${normalized}.cjs`,
+        path.posix.join(normalized, 'index.js'),
+        path.posix.join(normalized, 'index.mjs'),
+        path.posix.join(normalized, 'index.cjs'),
+    ];
+    const found = candidates.find((candidate) => fs.existsSync(path.join(pluginDir, candidate)));
+    return found ? { escaped: false, path: found } : { escaped: false, path: null };
+}
+function pathIsUnderPackageRoot(relativePath, packageRoot) {
+    if (!packageRoot)
+        return false;
+    return relativePath === packageRoot || relativePath.startsWith(`${packageRoot}/`);
+}
+function scanNodeImportContract(pluginDir, entryPaths, options) {
+    const queue = [...new Set(entryPaths.filter(Boolean).map(normalizeRelativePath))];
+    const visited = new Set();
+    const dependencies = new Set(options.packageMeta?.dependencies ?? []);
+    const devDependencies = new Set(options.packageMeta?.devDependencies ?? []);
+    const packageRoot = options.packageMeta?.packageRoot;
+    while (queue.length > 0) {
+        const relativePath = queue.shift();
+        if (!relativePath || visited.has(relativePath))
+            continue;
+        visited.add(relativePath);
+        const absolutePath = path.join(pluginDir, relativePath);
+        if (!fs.existsSync(absolutePath)) {
+            error(`${options.label}: missing Node import file "${relativePath}"`);
+            continue;
+        }
+        const source = fs.readFileSync(absolutePath, 'utf8');
+        for (const { specifier } of scanJavaScriptImportSpecifiers(source)) {
+            if (specifier.startsWith('node:'))
+                continue;
+            if (isRelativeSpecifier(specifier)) {
+                const resolved = resolveRelativeJavaScriptImport(relativePath, specifier, pluginDir);
+                if (resolved.escaped) {
+                    error(`${options.label}: relative import "${specifier}" from "${relativePath}" escapes the plugin root`);
+                    continue;
+                }
+                if (!resolved.path) {
+                    error(`${options.label}: unable to resolve relative import "${specifier}" from "${relativePath}"`);
+                    continue;
+                }
+                queue.push(resolved.path);
+                continue;
+            }
+            if (specifier.startsWith('/') || specifier.includes(':')) {
+                error(`${options.label}: unsupported import specifier "${specifier}" from "${relativePath}"`);
+                continue;
+            }
+            const packageName = packageNameFromSpecifier(specifier);
+            if (!packageRoot) {
+                error(`${options.label}: bare import "${specifier}" from "${relativePath}" requires scripts.node.packageRoot`);
+                continue;
+            }
+            if (!pathIsUnderPackageRoot(relativePath, packageRoot)) {
+                error(`${options.label}: bare import "${specifier}" from "${relativePath}" is outside scripts.node.packageRoot`);
+                continue;
+            }
+            if (dependencies.has(packageName))
+                continue;
+            if (devDependencies.has(packageName)) {
+                if (!options.allowDevDependencies) {
+                    error(`${options.label}: runtime import "${specifier}" from "${relativePath}" uses dev dependency "${packageName}"`);
+                }
+                continue;
+            }
+            error(`${options.label}: import "${specifier}" from "${relativePath}" is not declared in dependencies`);
+        }
+    }
+}
+function listFilesRecursive(rootDir) {
+    const output = [];
+    if (!fs.existsSync(rootDir))
+        return output;
+    const walk = (dir) => {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const absolutePath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(absolutePath);
+            }
+            else if (entry.isFile()) {
+                output.push(normalizeRelativePath(path.relative(rootDir, absolutePath)));
+            }
+        }
+    };
+    walk(rootDir);
+    return output;
+}
+function validateConfigValueLightweight(field, value, fieldName) {
+    if (!isRecord(field) || !CONFIG_FIELD_TYPES.has(field.type))
+        return;
+    if (field.type === 'string' || field.type === 'file' || field.type === 'directory') {
+        validateManifestString(value, fieldName);
+        return;
+    }
+    if (field.type === 'boolean') {
+        if (typeof value !== 'boolean') {
+            error(`${fieldName} must be a boolean`);
+        }
+        return;
+    }
+    if (field.type === 'number') {
+        if (typeof value !== 'number' || !Number.isFinite(value)) {
+            error(`${fieldName} must be a finite number`);
+            return;
+        }
+        if (typeof field.min === 'number' && value < field.min) {
+            error(`${fieldName} must be greater than or equal to ${field.min}`);
+        }
+        if (typeof field.max === 'number' && value > field.max) {
+            error(`${fieldName} must be less than or equal to ${field.max}`);
+        }
+        return;
+    }
+    if (field.type === 'enum') {
+        if (typeof value !== 'string' || !Array.isArray(field.values) || !field.values.includes(value)) {
+            error(`${fieldName} must be one of config schema values`);
+        }
+    }
+}
+function validateConfigPresentationLightweight(presentation, schema) {
+    if (presentation === undefined)
+        return;
+    const root = expectRecord(presentation, 'config.presentation');
+    if (!root)
+        return;
+    validateAllowedKeys(root, 'config.presentation', ['groups', 'fields', 'presets']);
+    const schemaKeys = new Set(Object.keys(schema));
+    if (root.groups !== undefined) {
+        if (!Array.isArray(root.groups)) {
+            error('config.presentation.groups must be an array');
+        }
+        else {
+            const groupIds = new Set();
+            const groupedFields = new Set();
+            root.groups.forEach((rawGroup, index) => {
+                const fieldName = `config.presentation.groups[${index}]`;
+                const group = expectRecord(rawGroup, fieldName);
+                if (!group)
+                    return;
+                validateAllowedKeys(group, fieldName, ['id', 'title', 'description', 'fields', 'advanced']);
+                const validId = validateManifestString(group.id, `${fieldName}.id`);
+                const id = validId ? group.id : null;
+                if (id && groupIds.has(id)) {
+                    error(`${fieldName}.id has duplicate group id "${id}"`);
+                }
+                else if (id) {
+                    groupIds.add(id);
+                }
+                validateManifestString(group.title, `${fieldName}.title`);
+                if (group.description !== undefined) {
+                    validateManifestString(group.description, `${fieldName}.description`);
+                }
+                if (group.advanced !== undefined && typeof group.advanced !== 'boolean') {
+                    error(`${fieldName}.advanced must be a boolean`);
+                }
+                if (!Array.isArray(group.fields)) {
+                    error(`${fieldName}.fields must be an array`);
+                    return;
+                }
+                group.fields.forEach((key, fieldIndex) => {
+                    const keyFieldName = `${fieldName}.fields[${fieldIndex}]`;
+                    const validKey = validateManifestString(key, keyFieldName);
+                    if (!validKey)
+                        return;
+                    if (!schemaKeys.has(key)) {
+                        error(`${keyFieldName} references unknown config key "${key}"`);
+                    }
+                    if (groupedFields.has(key)) {
+                        error(`${keyFieldName} assigns config key "${key}" to more than one group`);
+                    }
+                    else {
+                        groupedFields.add(key);
+                    }
+                });
+            });
+        }
+    }
+    if (root.fields !== undefined) {
+        const fields = expectRecord(root.fields, 'config.presentation.fields');
+        if (fields) {
+            for (const [key, rawField] of Object.entries(fields)) {
+                const fieldName = `config.presentation.fields.${key}`;
+                const schemaField = schema[key];
+                if (!schemaKeys.has(key)) {
+                    error(`config.presentation.fields references unknown config key "${key}"`);
+                }
+                const field = expectRecord(rawField, fieldName);
+                if (!field)
+                    continue;
+                validateAllowedKeys(field, fieldName, [
+                    'valueLabels',
+                    'recommendedValue',
+                    'placeholder',
+                    'unit',
+                    'advanced',
+                ]);
+                if (field.placeholder !== undefined) {
+                    validateManifestString(field.placeholder, `${fieldName}.placeholder`);
+                }
+                if (field.unit !== undefined) {
+                    validateManifestString(field.unit, `${fieldName}.unit`);
+                }
+                if (field.advanced !== undefined && typeof field.advanced !== 'boolean') {
+                    error(`${fieldName}.advanced must be a boolean`);
+                }
+                if (field.valueLabels !== undefined) {
+                    const labels = expectRecord(field.valueLabels, `${fieldName}.valueLabels`);
+                    if (isRecord(schemaField) && schemaField.type !== 'enum') {
+                        error(`${fieldName}.valueLabels is only supported for enum config`);
+                    }
+                    if (labels) {
+                        for (const [token, label] of Object.entries(labels)) {
+                            if (!isRecord(schemaField) || !Array.isArray(schemaField.values) || !schemaField.values.includes(token)) {
+                                error(`${fieldName}.valueLabels references unknown enum token "${token}"`);
+                            }
+                            validateManifestString(label, `${fieldName}.valueLabels.${token}`);
+                        }
+                    }
+                }
+                if (field.recommendedValue !== undefined) {
+                    validateConfigValueLightweight(schemaField, field.recommendedValue, `${fieldName}.recommendedValue`);
+                }
+            }
+        }
+    }
+    if (root.presets !== undefined) {
+        if (!Array.isArray(root.presets)) {
+            error('config.presentation.presets must be an array');
+        }
+        else {
+            const presetIds = new Set();
+            root.presets.forEach((rawPreset, index) => {
+                const fieldName = `config.presentation.presets[${index}]`;
+                const preset = expectRecord(rawPreset, fieldName);
+                if (!preset)
+                    return;
+                validateAllowedKeys(preset, fieldName, ['id', 'title', 'description', 'values']);
+                const validId = validateManifestString(preset.id, `${fieldName}.id`);
+                const id = validId ? preset.id : null;
+                if (id && presetIds.has(id)) {
+                    error(`${fieldName}.id has duplicate preset id "${id}"`);
+                }
+                else if (id) {
+                    presetIds.add(id);
+                }
+                validateManifestString(preset.title, `${fieldName}.title`);
+                if (preset.description !== undefined) {
+                    validateManifestString(preset.description, `${fieldName}.description`);
+                }
+                const values = expectRecord(preset.values, `${fieldName}.values`);
+                if (!values)
+                    return;
+                for (const [key, value] of Object.entries(values)) {
+                    if (!schemaKeys.has(key)) {
+                        error(`${fieldName}.values references unknown config key "${key}"`);
+                        continue;
+                    }
+                    const schemaField = schema[key];
+                    if (isRecord(schemaField)
+                        && (schemaField.sensitive === true
+                            || schemaField.type === 'file'
+                            || schemaField.type === 'directory')) {
+                        error(`${fieldName}.values.${key} cannot contain sensitive, file, or directory config values`);
+                        continue;
+                    }
+                    validateConfigValueLightweight(schemaField, value, `${fieldName}.values.${key}`);
+                }
+            });
+        }
+    }
+}
+function validateConfigSchemaLightweight(config) {
+    if (config === undefined)
+        return;
+    const configRoot = expectRecord(config, 'config');
+    if (!configRoot)
+        return;
+    validateAllowedKeys(configRoot, 'config', ['schema', 'presentation']);
+    const schema = expectRecord(configRoot.schema, 'config.schema');
+    if (!schema)
+        return;
+    for (const [key, rawField] of Object.entries(schema)) {
+        if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(key)) {
+            error(`config.schema has invalid key "${key}"`);
+        }
+        const fieldName = `config.schema.${key}`;
+        const field = expectRecord(rawField, fieldName);
+        if (!field)
+            continue;
+        validateAllowedKeys(field, fieldName, [
+            'type',
+            'title',
+            'description',
+            'default',
+            'required',
+            'sensitive',
+            'values',
+            'min',
+            'max',
+        ]);
+        if (typeof field.type !== 'string' || !CONFIG_FIELD_TYPES.has(field.type)) {
+            error(`${fieldName}.type must be string, number, boolean, enum, file, or directory`);
+        }
+        if (field.required !== undefined && typeof field.required !== 'boolean') {
+            error(`${fieldName}.required must be a boolean`);
+        }
+        if (field.sensitive !== undefined && typeof field.sensitive !== 'boolean') {
+            error(`${fieldName}.sensitive must be a boolean`);
+        }
+        if (field.values !== undefined) {
+            if (field.type !== 'enum' || !Array.isArray(field.values) || field.values.length === 0) {
+                error(`${fieldName}.values is only supported for enum config and must be non-empty`);
+            }
+        }
+        else if (field.type === 'enum') {
+            error(`${fieldName}.values is required for enum config`);
+        }
+        if (field.type !== 'number' && (field.min !== undefined || field.max !== undefined)) {
+            error(`${fieldName}.min/max are only supported for number config`);
+        }
+        if (field.min !== undefined && typeof field.min !== 'number') {
+            error(`${fieldName}.min must be a number`);
+        }
+        if (field.max !== undefined && typeof field.max !== 'number') {
+            error(`${fieldName}.max must be a number`);
+        }
+        if (typeof field.min === 'number' && typeof field.max === 'number' && field.min > field.max) {
+            error(`${fieldName}.min must be less than or equal to max`);
+        }
+    }
+    validateConfigPresentationLightweight(configRoot.presentation, schema);
+}
+function configSchemaKeys(manifest) {
+    const schema = manifest.config?.schema;
+    return isRecord(schema) ? new Set(Object.keys(schema)) : new Set();
+}
+function configSchemaField(manifest, key) {
+    const field = manifest.config?.schema?.[key];
+    return isRecord(field) ? field : null;
+}
+function defaultConfigValues(manifest) {
+    const schema = manifest.config?.schema;
+    const values = {};
+    if (!isRecord(schema))
+        return values;
+    for (const [key, field] of Object.entries(schema)) {
+        if (isRecord(field) && Object.prototype.hasOwnProperty.call(field, 'default')) {
+            values[key] = field.default;
+        }
+    }
+    return values;
+}
+function validateArtifactId(value, fieldName) {
+    const id = validateManifestString(value, fieldName);
+    if (!id)
+        return null;
+    if (!/^[A-Za-z][A-Za-z0-9_.-]*$/.test(id)) {
+        error(`${fieldName}: expected a stable id using letters, numbers, ".", "_" or "-"`);
+    }
+    return id;
+}
+function validateCodexRoleKey(value, fieldName) {
+    const roleKey = validateManifestString(value, fieldName);
+    if (!roleKey)
+        return null;
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(roleKey)) {
+        error(`${fieldName}: expected a valid Codex role key`);
+    }
+    return roleKey;
+}
+function validateCodexSkillKey(value, fieldName) {
+    const skillKey = validateManifestString(value, fieldName);
+    if (!skillKey)
+        return null;
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(skillKey)) {
+        error(`${fieldName}: expected a valid Codex skill key`);
+    }
+    return skillKey;
+}
+function validatePortableSkillKey(value, fieldName) {
+    const skillKey = validateManifestString(value, fieldName);
+    if (!skillKey)
+        return null;
+    if (skillKey.length > MAX_SKILL_NAME_LEN || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(skillKey)) {
+        error(`${fieldName}: expected at most 64 ASCII lowercase hyphen-case characters`);
+    }
+    return skillKey;
+}
+function validateStringArray(value, fieldName, options = {}) {
+    if (!Array.isArray(value)) {
+        error(`${fieldName} must be an array`);
+        return [];
+    }
+    const output = [];
+    for (const [index, entry] of value.entries()) {
+        const itemFieldName = `${fieldName}[${index}]`;
+        if (typeof entry !== 'string' || entry.trim() === '') {
+            error(`${itemFieldName} must be a non-empty string`);
+            continue;
+        }
+        if (options.allowed && !options.allowed.has(entry)) {
+            error(`${itemFieldName}: unsupported ${options.label ?? 'value'} "${entry}"`);
+            continue;
+        }
+        if (!output.includes(entry))
+            output.push(entry);
+    }
+    if (options.requireNonEmpty && output.length === 0) {
+        error(`${fieldName} must contain at least one value`);
+    }
+    return output;
+}
+function validateArtifactTargetEntry(entry, index, manifest, seen, pluginDir) {
+    const fieldName = `artifacts.targets[${index}]`;
+    const target = expectRecord(entry, fieldName);
+    if (!target)
+        return null;
+    validateAllowedKeys(target, fieldName, [
+        'id',
+        'platform',
+        'distribution',
+        'scopes',
+        'target',
+        'kind',
+        'projectManagedKind',
+        'states',
+        'refreshKeys',
+        'requiresCodexProjectConfig',
+        'roleKey',
+        'skillKey',
+        'sourceDirs',
+        'runtimeImports',
+    ]);
+    const id = validateArtifactId(target.id, `${fieldName}.id`);
+    const artifactTarget = validateManifestString(target.target, `${fieldName}.target`);
+    if (artifactTarget && !ARTIFACT_TARGETS.has(artifactTarget)) {
+        error(`${fieldName}.target: unsupported artifact target "${artifactTarget}"`);
+    }
+    const portable = artifactTarget === 'agent-skills.skill';
+    const platform = portable || target.platform === undefined
+        ? undefined
+        : validateManifestString(target.platform, `${fieldName}.platform`);
+    const distribution = portable || target.distribution !== undefined
+        ? validateManifestString(target.distribution, `${fieldName}.distribution`)
+        : undefined;
+    if (portable) {
+        if (distribution !== 'agent-skills') {
+            error(`${fieldName}.distribution: expected "agent-skills"`);
+        }
+        if (target.platform !== undefined) {
+            error(`${fieldName}.platform: distribution targets do not support platform`);
+        }
+    }
+    else {
+        const expectedPlatform = artifactTarget === 'claude.skill' ? 'claude' : 'codex';
+        if (platform && artifactTarget && platform !== expectedPlatform) {
+            error(`${fieldName}.platform: target "${artifactTarget}" must use "${expectedPlatform}"`);
+        }
+        if (target.distribution !== undefined) {
+            error(`${fieldName}.distribution: platform targets do not support distribution`);
+        }
+    }
+    const key = id && artifactTarget ? `${id}:${artifactTarget}` : null;
+    if (key) {
+        if (seen.has(key)) {
+            error(`${fieldName}: duplicate artifact id + target "${key}"`);
+        }
+        seen.add(key);
+    }
+    const expectedKind = ARTIFACT_KIND_BY_TARGET[artifactTarget];
+    const kind = target.kind === undefined
+        ? expectedKind
+        : validateManifestString(target.kind, `${fieldName}.kind`);
+    if (kind && !ARTIFACT_KINDS.has(kind)) {
+        error(`${fieldName}.kind: unsupported artifact kind "${kind}"`);
+    }
+    if (expectedKind && kind && kind !== expectedKind) {
+        error(`${fieldName}.kind: target "${artifactTarget}" requires kind "${expectedKind}"`);
+    }
+    const expectedProjectManagedKind = ARTIFACT_PROJECT_MANAGED_KIND_BY_TARGET[artifactTarget];
+    const projectManagedKind = target.projectManagedKind === undefined
+        ? expectedProjectManagedKind
+        : validateManifestString(target.projectManagedKind, `${fieldName}.projectManagedKind`);
+    if (projectManagedKind && !ARTIFACT_PROJECT_MANAGED_KINDS.has(projectManagedKind)) {
+        error(`${fieldName}.projectManagedKind: unsupported Codex project managed kind "${projectManagedKind}"`);
+    }
+    if (expectedProjectManagedKind &&
+        projectManagedKind &&
+        projectManagedKind !== expectedProjectManagedKind) {
+        error(`${fieldName}.projectManagedKind: target "${artifactTarget}" must map to "${expectedProjectManagedKind}"`);
+    }
+    if (!expectedProjectManagedKind && projectManagedKind) {
+        error(`${fieldName}.projectManagedKind: target "${artifactTarget}" does not support projectManagedKind`);
+    }
+    const scopes = validateStringArray(target.scopes, `${fieldName}.scopes`, {
+        allowed: ARTIFACT_SCOPES,
+        label: 'artifact scope',
+        requireNonEmpty: true,
+    });
+    const states = validateStringArray(target.states, `${fieldName}.states`, {
+        allowed: ARTIFACT_STATES,
+        label: 'artifact state',
+        requireNonEmpty: true,
+    });
+    const refreshKeys = validateStringArray(target.refreshKeys, `${fieldName}.refreshKeys`);
+    const schemaKeys = configSchemaKeys(manifest);
+    for (const [refreshIndex, refreshKey] of refreshKeys.entries()) {
+        if (!schemaKeys.has(refreshKey)) {
+            error(`${fieldName}.refreshKeys[${refreshIndex}]: unknown config key "${refreshKey}"`);
+            continue;
+        }
+        const field = configSchemaField(manifest, refreshKey);
+        if (scopes.includes('project') &&
+            (field?.type === 'file' || field?.type === 'directory')) {
+            error(`${fieldName}.refreshKeys[${refreshIndex}]: project-scope repo-visible artifacts cannot depend on "${field.type}" config key "${refreshKey}"; use a portable string key or keep the path in user/project local config for lifecycle/helper code.`);
+        }
+    }
+    if (target.requiresCodexProjectConfig !== undefined &&
+        typeof target.requiresCodexProjectConfig !== 'boolean') {
+        error(`${fieldName}.requiresCodexProjectConfig must be a boolean`);
+    }
+    if (artifactTarget === 'codex.skill' && target.requiresCodexProjectConfig === true) {
+        error(`${fieldName}.requiresCodexProjectConfig: codex.skill writes the skill runtime and must not require Codex project config preflight`);
+    }
+    if ((platform === 'claude' || portable) && target.requiresCodexProjectConfig !== undefined) {
+        error(`${fieldName}.requiresCodexProjectConfig: this target does not support the field`);
+    }
+    let roleKey;
+    let skillKey;
+    if (artifactTarget === 'codex.agentRole') {
+        roleKey = validateCodexRoleKey(target.roleKey, `${fieldName}.roleKey`);
+        if (!roleKey) {
+            error(`${fieldName}.roleKey: codex.agentRole targets must declare a static roleKey`);
+        }
+    }
+    else if (target.roleKey !== undefined) {
+        error(`${fieldName}.roleKey: roleKey is only supported for codex.agentRole targets`);
+    }
+    if (artifactTarget === 'codex.skill' || artifactTarget === 'claude.skill' || portable) {
+        skillKey = portable
+            ? validatePortableSkillKey(target.skillKey, `${fieldName}.skillKey`)
+            : validateCodexSkillKey(target.skillKey, `${fieldName}.skillKey`);
+        if (!skillKey) {
+            error(`${fieldName}.skillKey: ${artifactTarget} targets must declare a static skillKey`);
+        }
+    }
+    else if (target.skillKey !== undefined) {
+        error(`${fieldName}.skillKey: skillKey is only supported for skill targets`);
+    }
+    const normalizedSourceDirs = Array.isArray(target.sourceDirs)
+        ? target.sourceDirs
+            .filter((sourceDir) => typeof sourceDir === 'string' && sourceDir.trim() !== '')
+            .map((sourceDir) => path.posix.normalize(sourceDir))
+        : [];
+    if (new Set(normalizedSourceDirs).size !== normalizedSourceDirs.length) {
+        error(`${fieldName}.sourceDirs must not contain duplicate directories`);
+    }
+    const sourceDirs = target.sourceDirs === undefined
+        ? []
+        : validateStringArray(target.sourceDirs, `${fieldName}.sourceDirs`);
+    if (sourceDirs.length > 0 && artifactTarget !== 'codex.skill' && artifactTarget !== 'claude.skill' && !portable) {
+        error(`${fieldName}.sourceDirs: sourceDirs are only supported for skill targets`);
+    }
+    for (const [sourceIndex, sourceDir] of sourceDirs.entries()) {
+        const sourceField = `${fieldName}.sourceDirs[${sourceIndex}]`;
+        if (!sourceDir.startsWith('./') || path.posix.isAbsolute(sourceDir)) {
+            error(`${sourceField} must start with "./" and stay inside the plugin root`);
+            continue;
+        }
+        const normalized = path.posix.normalize(sourceDir);
+        if (normalized === '.' || normalized === '..' || normalized.startsWith('../')) {
+            error(`${sourceField} must stay inside the plugin root`);
+            continue;
+        }
+        const stats = fs.lstatSync(path.join(pluginDir, normalized), { throwIfNoEntry: false });
+        if (!stats?.isDirectory() || stats.isSymbolicLink()) {
+            error(`${sourceField} must point to an existing directory`);
+        }
+        if (skillKey && !portable &&
+            normalized !== `skills/${skillKey}` &&
+            !normalized.startsWith(`skills/${skillKey}/`)) {
+            error(`${sourceField} must stay inside "./skills/${skillKey}"`);
+        }
+        if (skillKey && !portable &&
+            isSkillAuthorOnlyPath(path.posix.relative(`skills/${skillKey}`, normalized))) {
+            error(`${sourceField} must not point inside an author-only Skill directory`);
+        }
+    }
+    if (skillKey && !portable &&
+        sourceDirs.length > 0 &&
+        !normalizedSourceDirs.includes(`skills/${skillKey}`)) {
+        error(`${fieldName}.sourceDirs must include "./skills/${skillKey}" so README.md is published`);
+    }
+    return {
+        id,
+        platform,
+        distribution,
+        scopes,
+        target: artifactTarget,
+        kind,
+        projectManagedKind,
+        states,
+        refreshKeys,
+        roleKey,
+        skillKey,
+        sourceDirs,
+        runtimeImports: Array.isArray(target.runtimeImports) ? target.runtimeImports : [],
+    };
+}
+function validateArtifactsConfigLightweight(pluginDir, manifest) {
+    if (manifest.artifacts === undefined)
+        return [];
+    const artifacts = expectRecord(manifest.artifacts, 'artifacts');
+    if (!artifacts)
+        return [];
+    validateAllowedKeys(artifacts, 'artifacts', ['targets']);
+    if (artifacts.targets === undefined)
+        return [];
+    if (!Array.isArray(artifacts.targets)) {
+        error('artifacts.targets must be an array');
+        return [];
+    }
+    const seen = new Set();
+    const declarations = artifacts.targets
+        .map((entry, index) => validateArtifactTargetEntry(entry, index, manifest, seen, pluginDir))
+        .filter(Boolean);
+    const owners = new Map();
+    for (const declaration of declarations) {
+        if ((declaration.target !== 'codex.skill' && declaration.target !== 'claude.skill' && declaration.target !== 'agent-skills.skill') ||
+            !declaration.skillKey) {
+            continue;
+        }
+        for (const scope of declaration.scopes) {
+            const ownerKey = `${declaration.platform ?? declaration.distribution}:${scope}:${declaration.skillKey}`;
+            const existing = owners.get(ownerKey);
+            if (existing) {
+                error(`artifacts.targets has duplicate skill ownership "${ownerKey}" in artifacts "${existing}" and "${declaration.id}"`);
+            }
+            else {
+                owners.set(ownerKey, declaration.id);
+            }
+        }
+    }
+    return declarations;
+}
+function validateArtifactPlanRefreshKeys(refreshKeys, declaration, fieldName) {
+    const keys = validateStringArray(refreshKeys, `${fieldName}.refreshKeys`);
+    for (const [index, key] of keys.entries()) {
+        if (!declaration.refreshKeys.includes(key)) {
+            error(`${fieldName}.refreshKeys[${index}]: "${key}" is not declared for artifact "${declaration.id}"`);
+        }
+    }
+    for (const declaredKey of declaration.refreshKeys) {
+        if (!keys.includes(declaredKey)) {
+            error(`${fieldName}: artifact "${declaration.id}" must preserve declared refresh key "${declaredKey}"`);
+        }
+    }
+}
+function isValidArtifactFilePath(relativePath) {
+    return (relativePath.trim() !== '' &&
+        !relativePath.includes('\\') &&
+        !relativePath.startsWith('/') &&
+        path.posix.normalize(relativePath) === relativePath &&
+        !relativePath.split('/').some((segment) => segment === '' || segment === '.' || segment === '..'));
+}
+function isSkillAuthorOnlyPath(relativePath) {
+    const [topLevel] = relativePath.split('/').filter(Boolean);
+    return topLevel === 'evals' || topLevel === 'reports';
+}
+function collectArtifactSourceFiles(rootDir, fieldName, files) {
+    const rootStats = fs.lstatSync(rootDir, { throwIfNoEntry: false });
+    if (!rootStats?.isDirectory() || rootStats.isSymbolicLink())
+        return;
+    const visit = (currentDir, parentPath) => {
+        const entries = fs.readdirSync(currentDir, { withFileTypes: true })
+            .sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of entries) {
+            const relativePath = parentPath ? `${parentPath}/${entry.name}` : entry.name;
+            if (isSkillAuthorOnlyPath(relativePath))
+                continue;
+            const absolutePath = path.join(currentDir, entry.name);
+            if (entry.isSymbolicLink()) {
+                error(`${fieldName} contains unsupported symbolic link "${relativePath}"`);
+                continue;
+            }
+            if (entry.isDirectory()) {
+                visit(absolutePath, relativePath);
+                continue;
+            }
+            if (!entry.isFile()) {
+                error(`${fieldName} contains unsupported non-regular file "${relativePath}"`);
+                continue;
+            }
+            files.set(relativePath, fs.readFileSync(absolutePath));
+        }
+    };
+    visit(rootDir, '');
+}
+function findArtifactFilePrefixConflict(files) {
+    const paths = [...files.keys()].sort();
+    for (const [index, relativePath] of paths.entries()) {
+        const prefix = paths.slice(0, index).find((candidate) => relativePath.startsWith(`${candidate}/`));
+        if (prefix)
+            return [prefix, relativePath];
+    }
+    return null;
+}
+function authorRuntimeImportKey(artifactId, importIndex) {
+    return `${artifactId}\0${importIndex}`;
+}
+async function resolveAuthorRuntimeImports(options) {
+    const artifactImports = (options.manifest.artifacts?.targets ?? []).flatMap((target) => (target.runtimeImports ?? []).map((reference, importIndex) => ({
+        key: authorRuntimeImportKey(target.id, importIndex),
+        label: `artifacts target ${JSON.stringify(target.id)} runtime import ${JSON.stringify(reference.name)}`,
+        purpose: 'artifact-runtime',
+        reference,
+    })));
+    const skillRuntimeImports = (options.manifest.buildConfig?.skillRuntimeFiles ?? []).flatMap((entry, importIndex) => {
+        if (!isRecord(entry.import))
+            return [];
+        const platforms = [
+            ...(entry.platforms !== undefined || entry.distributions === undefined
+                ? (entry.platforms ?? [...resolveSupportedPlatforms(options.manifest)])
+                : []),
+            ...(entry.distributions?.includes('agent-skills') ? [undefined] : []),
+        ];
+        return platforms.length > 0 ? [{
+                key: importIndex,
+                label: `buildConfig.skillRuntimeFiles[${importIndex}].import`,
+                purpose: 'skill-runtime-file',
+                reference: entry.import,
+                platforms,
+            }] : [];
+    });
+    const requested = [...artifactImports, ...skillRuntimeImports];
+    if (requested.length === 0) {
+        return { artifactImports: new Map(), skillRuntimeImports: new Map() };
+    }
+    if (!options.repoRoot
+        || typeof options.cliManifestTools?.readPluginManifest !== 'function'
+        || typeof options.cliManifestTools?.discoverPlugins !== 'function'
+        || typeof options.cliManifestTools?.createRuntimeResolver !== 'function') {
+        error('Portable runtime imports require a complete built CLI and canonical same-source Git workspace.');
+        return null;
+    }
+    let consumer;
+    let resolver;
+    try {
+        const sourceSet = await options.cliManifestTools.discoverPlugins(options.repoRoot);
+        consumer = await options.cliManifestTools.readPluginManifest(options.pluginDir);
+        if (!sourceSet.some((candidate) => candidate.manifest.name === consumer.manifest.name)) {
+            sourceSet.push(consumer);
+        }
+        resolver = options.cliManifestTools.createRuntimeResolver(sourceSet);
+    }
+    catch {
+        error('Portable runtime imports could not load the canonical same-source plugin set.');
+        return null;
+    }
+    const resolvedArtifacts = new Map();
+    const resolvedSkillRuntimeFiles = new Map();
+    for (const request of requested) {
+        let value;
+        try {
+            for (const platform of request.platforms ?? [undefined]) {
+                const resolution = await resolver.resolve({
+                    consumer,
+                    reference: request.reference,
+                    purpose: request.purpose,
+                    platform,
+                });
+                const bytes = fs.readFileSync(resolution.sourcePath);
+                const digest = `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+                if (digest !== resolution.sourceDigest)
+                    throw new Error('runtime export changed during resolution');
+                const current = {
+                    bytes,
+                    digest: resolution.sourceDigest,
+                    providerPluginId: resolution.provider,
+                    providerVersion: resolution.providerVersion,
+                    exportName: resolution.name,
+                    source: resolution.source,
+                };
+                if (value && (value.digest !== current.digest
+                    || value.providerPluginId !== current.providerPluginId
+                    || value.providerVersion !== current.providerVersion
+                    || value.exportName !== current.exportName
+                    || value.source !== current.source)) {
+                    throw new Error('runtime export changed between projection surfaces');
+                }
+                value = current;
+            }
+        }
+        catch {
+            const provider = typeof request.reference.plugin === 'string'
+                ? JSON.stringify(request.reference.plugin)
+                : '<invalid-provider>';
+            const exportName = typeof request.reference.export === 'string'
+                ? JSON.stringify(request.reference.export)
+                : '<invalid-export>';
+            error(`Cannot resolve ${request.label} from provider ${provider} export ${exportName}.`);
+            continue;
+        }
+        if (request.purpose === 'artifact-runtime')
+            resolvedArtifacts.set(request.key, value);
+        else
+            resolvedSkillRuntimeFiles.set(request.key, value);
+    }
+    return {
+        artifactImports: resolvedArtifacts,
+        skillRuntimeImports: resolvedSkillRuntimeFiles,
+    };
+}
+function overlayPortableRuntimeFiles(files, manifest, pluginDir, skillKey, runtimeImports) {
+    for (const [runtimeIndex, runtimeFile] of (manifest.buildConfig?.skillRuntimeFiles ?? []).entries()) {
+        if (runtimeFile.skill !== skillKey
+            || !runtimeFile.distributions?.includes('agent-skills'))
+            continue;
+        if (typeof runtimeFile.source === 'string') {
+            const sourcePath = path.join(pluginDir, normalizeRelativePath(runtimeFile.source));
+            const stats = fs.lstatSync(sourcePath, { throwIfNoEntry: false });
+            if (!stats?.isFile() || stats.isSymbolicLink()) {
+                error(`buildConfig.skillRuntimeFiles[${runtimeIndex}].source must point to a regular file`);
+                continue;
+            }
+            files.set(runtimeFile.target, fs.readFileSync(sourcePath));
+            continue;
+        }
+        if (isRecord(runtimeFile.import)) {
+            const resolved = runtimeImports?.skillRuntimeImports.get(runtimeIndex);
+            if (!resolved) {
+                error(`buildConfig.skillRuntimeFiles[${runtimeIndex}].import could not be resolved`);
+                continue;
+            }
+            files.set(runtimeFile.target, resolved.bytes);
+        }
+    }
+}
+function validateRenderedSkillTree(options) {
+    const { entry, declaration, fieldName, pluginDir, manifest, materializedRoot, skillValidationTools, } = options;
+    if (entry.state !== 'present' || !isRecord(entry.content) || !isRecord(entry.content.files)) {
+        return;
+    }
+    const files = new Map();
+    declaration.sourceDirs.forEach((sourceDir, index) => {
+        collectArtifactSourceFiles(path.join(pluginDir, normalizeRelativePath(sourceDir)), `artifacts.targets sourceDirs[${index}] for artifact "${declaration.id}"`, files);
+    });
+    if (declaration.target === 'agent-skills.skill') {
+        overlayPortableRuntimeFiles(files, manifest, pluginDir, declaration.skillKey, options.runtimeImports);
+    }
+    for (const [relativePath, content] of Object.entries(entry.content.files)) {
+        if (isSkillAuthorOnlyPath(relativePath)) {
+            error(`${fieldName}.content.files path "${relativePath}" uses an author-only Skill directory`);
+            continue;
+        }
+        if (isValidArtifactFilePath(relativePath) && typeof content === 'string') {
+            files.set(relativePath, Buffer.from(content, 'utf8'));
+        }
+    }
+    const conflict = findArtifactFilePrefixConflict(files);
+    if (conflict) {
+        error(`${fieldName} final file tree path "${conflict[0]}" conflicts with "${conflict[1]}"`);
+        return;
+    }
+    const skillFile = files.get('SKILL.md');
+    if (!skillFile || skillFile.toString('utf8').trim() === '') {
+        error(`${fieldName} final file tree must contain a non-empty SKILL.md`);
+    }
+    else if (!skillValidationTools) {
+        error(`${fieldName} final SKILL.md cannot be validated because the shared CLI Skill validator is unavailable`);
+    }
+    else {
+        const sourcePath = `${fieldName} final SKILL.md`;
+        const parsed = skillValidationTools.parseSkillFrontmatter(skillFile.toString('utf8'), sourcePath);
+        for (const diagnostic of parsed.errors) {
+            error(`${diagnostic.path} [${diagnostic.code}] ${diagnostic.message}`);
+        }
+        if (parsed.frontmatter) {
+            const diagnostics = skillValidationTools.validateSkillFrontmatter(parsed.frontmatter, {
+                profile: declaration.platform === 'claude' ? 'claude-2.1.88' : 'portable-agent-skills',
+                expectedName: declaration.skillKey,
+                sourcePath,
+            });
+            for (const diagnostic of diagnostics) {
+                error(`${diagnostic.path} [${diagnostic.code}] ${diagnostic.message}`);
+            }
+        }
+    }
+    const readme = files.get('README.md');
+    if (!readme || readme.toString('utf8').trim() === '') {
+        error(`${fieldName} final file tree must contain a non-empty README.md`);
+    }
+    const sensitiveValues = Object.entries(manifest.config?.schema ?? {})
+        .filter(([, field]) => isRecord(field) && field.sensitive === true)
+        .map(([key, field]) => Object.prototype.hasOwnProperty.call(field, 'default')
+        ? String(field.default)
+        : String(defaultConfigValues(manifest)[key] ?? ''))
+        .filter(Boolean);
+    for (const [relativePath, content] of files) {
+        const text = content.toString('utf8');
+        if (/\{\{[^{}]+\}\}/u.test(text)) {
+            error(`${fieldName} final file tree contains an unresolved template in "${relativePath}"`);
+        }
+        if (sensitiveValues.some((value) => text.includes(value))) {
+            error(`${fieldName} final file tree exposes sensitive config in "${relativePath}"`);
+        }
+    }
+    if (declaration.target === 'codex.skill') {
+        const openAiYaml = files.get('agents/openai.yaml');
+        if (!openAiYaml || openAiYaml.toString('utf8').trim() === '') {
+            error(`${fieldName} final file tree must contain a non-empty agents/openai.yaml`);
+        }
+    }
+    fs.rmSync(materializedRoot, { recursive: true, force: true });
+    for (const [relativePath, content] of files) {
+        const targetPath = path.join(materializedRoot, ...relativePath.split('/'));
+        fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+        fs.writeFileSync(targetPath, content);
+    }
+    if (declaration.target === 'codex.skill' && files.has('agents/openai.yaml')) {
+        validateOpenAiYaml(path.join(materializedRoot, 'agents', 'openai.yaml'), declaration.skillKey, true, manifest, materializedRoot, skillValidationTools);
+    }
+}
+function validateStaticPortableFinalTrees(pluginDir, manifest, runtimeImports, skillValidationTools) {
+    const portableRoot = manifest.distributions?.agentSkills?.skills;
+    if (typeof portableRoot !== 'string')
+        return;
+    const rootDir = path.join(pluginDir, normalizeRelativePath(portableRoot));
+    const rootStats = fs.lstatSync(rootDir, { throwIfNoEntry: false });
+    if (!rootStats?.isDirectory() || rootStats.isSymbolicLink())
+        return;
+    const dynamicKeys = new Set((manifest.artifacts?.targets ?? [])
+        .filter((target) => target.target === 'agent-skills.skill' && typeof target.skillKey === 'string')
+        .map((target) => target.skillKey));
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'aw-static-portable-final-'));
+    try {
+        for (const entry of fs.readdirSync(rootDir, { withFileTypes: true })) {
+            if (!entry.isDirectory() || dynamicKeys.has(entry.name))
+                continue;
+            validateRenderedSkillTree({
+                entry: { state: 'present', content: { files: {} } },
+                declaration: {
+                    id: `static:${entry.name}`,
+                    distribution: 'agent-skills',
+                    target: 'agent-skills.skill',
+                    skillKey: entry.name,
+                    sourceDirs: [`${portableRoot}/${entry.name}`],
+                },
+                fieldName: `static portable Skill "${entry.name}"`,
+                pluginDir,
+                manifest,
+                runtimeImports,
+                materializedRoot: path.join(tempRoot, entry.name),
+                skillValidationTools,
+            });
+        }
+    }
+    finally {
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+}
+function validateRenderedArtifactPlan(plan, declarations, scopeLabel, options) {
+    const planField = `scripts.artifacts.render fixture (${scopeLabel})`;
+    const root = expectRecord(plan, planField);
+    if (!root)
+        return;
+    validateAllowedKeys(root, planField, ['version', 'artifacts']);
+    if (root.version !== 2) {
+        error(`${planField}.version must be 2`);
+    }
+    if (!Array.isArray(root.artifacts)) {
+        error(`${planField}.artifacts must be an array`);
+        return;
+    }
+    const byKey = new Map(declarations.map((target) => [`${target.id}:${target.target}`, target]));
+    const returned = new Set();
+    root.artifacts.forEach((artifact, index) => {
+        const fieldName = `${planField}.artifacts[${index}]`;
+        const entry = expectRecord(artifact, fieldName);
+        if (!entry)
+            return;
+        validateAllowedKeys(entry, fieldName, [
+            'id',
+            'platform',
+            'distribution',
+            'target',
+            'kind',
+            'state',
+            'refreshKeys',
+            'disabledReason',
+            'roleKey',
+            'skillKey',
+            'content',
+        ]);
+        const id = validateArtifactId(entry.id, `${fieldName}.id`);
+        const target = validateManifestString(entry.target, `${fieldName}.target`);
+        const key = id && target ? `${id}:${target}` : null;
+        const declaration = key ? byKey.get(key) : null;
+        if (!declaration) {
+            error(`${fieldName}: artifact "${key ?? '<unknown>'}" is not declared for ${scopeLabel}`);
+            return;
+        }
+        if (returned.has(key)) {
+            error(`${fieldName}: duplicate artifact id + target "${key}"`);
+        }
+        returned.add(key);
+        if (declaration.distribution) {
+            if (entry.distribution !== declaration.distribution) {
+                error(`${fieldName}.distribution: expected "${declaration.distribution}"`);
+            }
+            if (entry.platform !== undefined) {
+                error(`${fieldName}.platform: distribution artifacts do not support platform`);
+            }
+        }
+        else if (entry.platform !== declaration.platform) {
+            error(`${fieldName}.platform: expected "${declaration.platform}"`);
+        }
+        if (entry.kind !== declaration.kind) {
+            error(`${fieldName}.kind: expected "${declaration.kind}"`);
+        }
+        if (!declaration.states.includes(entry.state)) {
+            error(`${fieldName}.state: "${entry.state}" is not declared for artifact "${declaration.id}"`);
+        }
+        validateArtifactPlanRefreshKeys(entry.refreshKeys, declaration, fieldName);
+        if (entry.state === 'present' && entry.content === undefined) {
+            error(`${fieldName}.content is required when state is "present"`);
+        }
+        if (entry.disabledReason !== undefined &&
+            (typeof entry.disabledReason !== 'string' || entry.disabledReason.trim() === '')) {
+            error(`${fieldName}.disabledReason must be a non-empty string`);
+        }
+        if (declaration.target === 'codex.agentRole') {
+            if (entry.roleKey !== declaration.roleKey) {
+                error(`${fieldName}.roleKey: expected "${declaration.roleKey}" from static metadata`);
+            }
+            if (isRecord(entry.content)) {
+                const registration = entry.content.registration;
+                if (isRecord(registration) && registration.config_file !== undefined) {
+                    error(`${fieldName}.content.registration.config_file must be generated by AW, not renderer`);
+                }
+                const roleFile = entry.content.roleFile;
+                if (isRecord(roleFile) && roleFile.name !== declaration.roleKey) {
+                    error(`${fieldName}.content.roleFile.name: expected "${declaration.roleKey}"`);
+                }
+            }
+        }
+        else if (entry.roleKey !== undefined) {
+            error(`${fieldName}.roleKey is only supported for codex.agentRole artifacts`);
+        }
+        if (declaration.target === 'codex.skill' || declaration.target === 'claude.skill' || declaration.target === 'agent-skills.skill') {
+            if (entry.skillKey !== declaration.skillKey) {
+                error(`${fieldName}.skillKey: expected "${declaration.skillKey}" from static metadata`);
+            }
+            if (entry.state === 'present') {
+                if (!isRecord(entry.content)) {
+                    error(`${fieldName}.content must be an object for dynamic skill artifacts`);
+                }
+                else {
+                    validateAllowedKeys(entry.content, `${fieldName}.content`, ['files']);
+                    const files = expectRecord(entry.content.files, `${fieldName}.content.files`);
+                    if (files) {
+                        const filePaths = Object.keys(files).sort();
+                        for (const [relativePath, content] of Object.entries(files)) {
+                            if (!isValidArtifactFilePath(relativePath)) {
+                                error(`${fieldName}.content.files path "${relativePath}" must be a normalized POSIX relative path`);
+                            }
+                            if (typeof content !== 'string') {
+                                error(`${fieldName}.content.files.${relativePath} must be a string`);
+                            }
+                        }
+                        for (const [pathIndex, relativePath] of filePaths.entries()) {
+                            const conflict = filePaths.slice(0, pathIndex).find((candidate) => relativePath.startsWith(`${candidate}/`));
+                            if (conflict) {
+                                error(`${fieldName}.content.files path "${conflict}" conflicts with "${relativePath}"`);
+                            }
+                        }
+                    }
+                }
+                validateRenderedSkillTree({
+                    entry,
+                    declaration,
+                    fieldName,
+                    pluginDir: options.pluginDir,
+                    manifest: options.manifest,
+                    runtimeImports: options.runtimeImports,
+                    materializedRoot: path.join(options.tempRoot, `${declaration.platform ?? declaration.distribution}-${scopeLabel.split('/')[1]}-${index}`),
+                    skillValidationTools: options.skillValidationTools,
+                });
+            }
+        }
+        else if (entry.skillKey !== undefined) {
+            error(`${fieldName}.skillKey is only supported for dynamic skill artifacts`);
+        }
+    });
+    for (const declaration of declarations) {
+        const key = `${declaration.id}:${declaration.target}`;
+        if (!returned.has(key)) {
+            error(`${planField}: renderer must return artifact "${declaration.id}" target "${declaration.target}"`);
+        }
+    }
+}
+function runArtifactRendererFixture(pluginDir, manifest, renderEntry, declarations, resolvedRuntimeImports, skillValidationTools) {
+    if (!renderEntry || declarations.length === 0)
+        return;
+    const surfaceScopes = [...new Set(declarations.flatMap((target) => target.scopes.map((scope) => `${target.platform ?? target.distribution}:${scope}`)))];
+    const values = defaultConfigValues(manifest);
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'aw-artifact-render-'));
+    try {
+        for (const surfaceScope of surfaceScopes) {
+            const [surface, scope] = surfaceScope.split(':');
+            const distribution = surface === 'agent-skills' ? surface : undefined;
+            const platform = distribution ? undefined : surface;
+            const event = distribution ? 'materialize' : 'install';
+            const scopedDeclarations = declarations.filter((target) => (distribution ? target.distribution === distribution : target.platform === platform)
+                && target.scopes.includes(scope));
+            const contextPath = path.join(tempRoot, `context-${surface}-${scope}.json`);
+            const runtimeImports = scopedDeclarations.flatMap((target) => target.runtimeImports.map((runtimeImport, importIndex) => {
+                const resolved = resolvedRuntimeImports?.artifactImports.get(authorRuntimeImportKey(target.id, importIndex));
+                if (!resolved)
+                    return null;
+                const importPath = path.join(tempRoot, `runtime-${target.id}-${importIndex}`);
+                fs.writeFileSync(importPath, resolved.bytes);
+                return {
+                    artifactId: target.id,
+                    name: runtimeImport.name,
+                    providerPluginId: resolved.providerPluginId,
+                    exportName: resolved.exportName,
+                    path: importPath,
+                    digest: resolved.digest,
+                };
+            }).filter(Boolean));
+            fs.writeFileSync(contextPath, JSON.stringify({
+                event,
+                surface: distribution
+                    ? { kind: 'distribution', name: distribution }
+                    : { kind: 'platform', name: platform },
+                ...(platform ? { platform } : {}),
+                ...(distribution ? { distribution } : {}),
+                scope,
+                plugin: {
+                    name: manifest.name,
+                    version: manifest.version,
+                    rootDir: pluginDir,
+                },
+                config: {
+                    mode: 'artifact-render',
+                    targetScope: scope,
+                    schema: manifest.config?.schema ?? {},
+                    values,
+                    sources: Object.fromEntries(Object.keys(values).map((key) => [key, 'default'])),
+                    issues: [],
+                },
+                changedConfigKeys: [],
+                previousArtifacts: [],
+                artifactSources: scopedDeclarations.map((target) => ({
+                    id: target.id,
+                    target: target.target,
+                    sourceDirs: target.sourceDirs.map((sourceDir) => path.join(pluginDir, normalizeRelativePath(sourceDir))),
+                })),
+                runtimeImports,
+                paths: {
+                    awHome: path.join(tempRoot, 'aw-home'),
+                    codexHome: path.join(tempRoot, 'codex-home'),
+                    claudeHome: path.join(tempRoot, 'claude-home'),
+                    manifestPath: path.join(pluginDir, '.agents-plugin', 'plugin.json'),
+                    configStores: {
+                        user: path.join(tempRoot, 'config-user.json'),
+                        project: path.join(tempRoot, 'config-project.json'),
+                    },
+                },
+                renderer: {
+                    runner: renderEntry.runner,
+                    path: renderEntry.path,
+                    args: renderEntry.args ?? [],
+                    manifestDigest: 'author-validator-fixture',
+                    rendererDigest: 'author-validator-fixture',
+                },
+            }), 'utf8');
+            const rendererHome = path.join(tempRoot, 'home');
+            const rendererTemp = path.join(tempRoot, 'tmp');
+            fs.mkdirSync(rendererHome, { recursive: true });
+            fs.mkdirSync(rendererTemp, { recursive: true });
+            const rendererEnv = {
+                AW_HOME: path.join(tempRoot, 'aw-home'),
+                AW_CODEX_HOME: path.join(tempRoot, 'codex-home'),
+                AW_CLAUDE_HOME: path.join(tempRoot, 'claude-home'),
+                PATH: process.env.PATH ?? process.env.Path ?? '',
+                AW_PLUGIN_CONTEXT: contextPath,
+                AW_PLUGIN_ROOT: pluginDir,
+                AW_PLUGIN_NAME: typeof manifest.name === 'string' ? manifest.name : '',
+                AW_PLUGIN_VERSION: typeof manifest.version === 'string' ? manifest.version : '',
+                AW_PLUGIN_EVENT: event,
+                ...(platform ? { AW_PLUGIN_PLATFORM: platform } : {}),
+                ...(distribution ? { AW_PLUGIN_DISTRIBUTION: distribution } : {}),
+                AW_PLUGIN_SCOPE: scope,
+            };
+            if (process.platform === 'win32') {
+                rendererEnv.USERPROFILE = rendererHome;
+                rendererEnv.TEMP = rendererTemp;
+                rendererEnv.TMP = rendererTemp;
+                if (process.env.SystemRoot)
+                    rendererEnv.SystemRoot = process.env.SystemRoot;
+                if (process.env.ComSpec)
+                    rendererEnv.ComSpec = process.env.ComSpec;
+            }
+            else {
+                rendererEnv.HOME = rendererHome;
+                rendererEnv.TMPDIR = rendererTemp;
+            }
+            const result = spawnSync(process.execPath, [path.join(pluginDir, renderEntry.path), ...(renderEntry.args ?? [])], {
+                cwd: pluginDir,
+                env: rendererEnv,
+                encoding: 'utf8',
+                timeout: 5000,
+                maxBuffer: 1024 * 1024,
+            });
+            const fieldName = `scripts.artifacts.render fixture (${surface}/${scope})`;
+            if (result.error) {
+                error(`${fieldName} failed: ${result.error.message}`);
+                continue;
+            }
+            if (result.status !== 0) {
+                const stderr = String(result.stderr ?? '').trim().split('\n')[0] ?? '';
+                error(`${fieldName} exited with code ${result.status}${stderr ? `: ${stderr}` : ''}`);
+                continue;
+            }
+            let plan;
+            try {
+                plan = JSON.parse(result.stdout);
+            }
+            catch (e) {
+                error(`${fieldName} stdout must be JSON ArtifactPlan: ${e.message}`);
+                continue;
+            }
+            validateRenderedArtifactPlan(plan, scopedDeclarations, `${surface}/${scope}`, {
+                pluginDir,
+                manifest,
+                runtimeImports: resolvedRuntimeImports,
+                tempRoot,
+                skillValidationTools,
+            });
+        }
+    }
+    finally {
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+}
+function validateDynamicArtifactsLightweight(pluginDir, manifest, renderEntry, runtimeImports, skillValidationTools) {
+    const declarations = validateArtifactsConfigLightweight(pluginDir, manifest);
+    const hasTargets = declarations.length > 0;
+    const hasRenderer = Boolean(manifest.scripts?.artifacts?.render);
+    if (hasTargets && !hasRenderer) {
+        error('artifacts.targets requires scripts.artifacts.render');
+    }
+    if (hasRenderer && !hasTargets) {
+        error('scripts.artifacts.render requires artifacts.targets');
+    }
+    runArtifactRendererFixture(pluginDir, manifest, renderEntry, declarations, runtimeImports, skillValidationTools);
+}
+function validateScriptsLightweight(pluginDir, manifest) {
+    validateConfigSchemaLightweight(manifest.config);
+    if (manifest.scripts === undefined)
+        return null;
+    const scripts = expectRecord(manifest.scripts, 'scripts');
+    if (!scripts)
+        return null;
+    validateAllowedKeys(scripts, 'scripts', ['timeoutMs', 'lifecycle', 'helpers', 'node', 'artifacts', 'tests']);
+    if (scripts.timeoutMs !== undefined &&
+        (!Number.isInteger(scripts.timeoutMs) ||
+            scripts.timeoutMs < SCRIPT_TIMEOUT_MIN_MS ||
+            scripts.timeoutMs > SCRIPT_TIMEOUT_MAX_MS)) {
+        error(`scripts.timeoutMs must be an integer between ${SCRIPT_TIMEOUT_MIN_MS} and ${SCRIPT_TIMEOUT_MAX_MS}`);
+    }
+    const runtimeNodeEntries = [];
+    let artifactRenderEntry = null;
+    let packageMeta = null;
+    if (scripts.helpers !== undefined) {
+        const helpers = expectRecord(scripts.helpers, 'scripts.helpers');
+        if (helpers) {
+            validateAllowedKeys(helpers, 'scripts.helpers', ['config']);
+            const helperPath = normalizePluginScriptPath(pluginDir, helpers.config, 'scripts.helpers.config');
+            validateDeclaredScriptFile(pluginDir, helperPath, 'scripts.helpers.config');
+            if (helperPath && !isNodeRunnablePath(helperPath)) {
+                error('scripts.helpers.config must use a Node runnable extension (.js, .mjs, or .cjs)');
+            }
+            if (helperPath)
+                runtimeNodeEntries.push({ path: helperPath, fieldName: 'scripts.helpers.config' });
+        }
+    }
+    if (scripts.lifecycle !== undefined) {
+        const lifecycle = expectRecord(scripts.lifecycle, 'scripts.lifecycle');
+        if (lifecycle) {
+            validateAllowedKeys(lifecycle, 'scripts.lifecycle', [...SCRIPT_LIFECYCLE_EVENTS]);
+            for (const [eventName, definition] of Object.entries(lifecycle)) {
+                if (!SCRIPT_LIFECYCLE_EVENTS.has(eventName)) {
+                    error(`scripts.lifecycle has unsupported event "${eventName}"`);
+                    continue;
+                }
+                validateLifecycleDefinition(pluginDir, definition, `scripts.lifecycle.${eventName}`, runtimeNodeEntries);
+            }
+        }
+    }
+    if (scripts.node !== undefined) {
+        const node = expectRecord(scripts.node, 'scripts.node');
+        if (node) {
+            validateAllowedKeys(node, 'scripts.node', ['packageRoot', 'build']);
+            if (node.packageRoot !== undefined) {
+                packageMeta = validatePackageRoot(pluginDir, node.packageRoot, 'scripts.node.packageRoot');
+            }
+            if (node.build !== undefined) {
+                const buildEntry = validateScriptEntry(pluginDir, node.build, 'scripts.node.build', {
+                    requireNodeRunner: true,
+                    requireNodePath: true,
+                });
+                if (buildEntry) {
+                    scanNodeImportContract(pluginDir, [buildEntry.path], {
+                        label: 'scripts.node.build import contract',
+                        packageMeta,
+                        allowDevDependencies: true,
+                    });
+                }
+            }
+        }
+    }
+    if (scripts.artifacts !== undefined) {
+        const artifacts = expectRecord(scripts.artifacts, 'scripts.artifacts');
+        if (artifacts) {
+            validateAllowedKeys(artifacts, 'scripts.artifacts', ['render']);
+            if (artifacts.render !== undefined) {
+                artifactRenderEntry = validateScriptEntry(pluginDir, artifacts.render, 'scripts.artifacts.render', {
+                    requireNodeRunner: true,
+                    requireNodePath: true,
+                });
+                if (artifactRenderEntry) {
+                    runtimeNodeEntries.push({
+                        path: artifactRenderEntry.path,
+                        fieldName: 'scripts.artifacts.render.path',
+                    });
+                }
+            }
+        }
+    }
+    if (scripts.tests !== undefined) {
+        const tests = expectRecord(scripts.tests, 'scripts.tests');
+        if (tests) {
+            validateAllowedKeys(tests, 'scripts.tests', ['node']);
+            if (tests.node !== undefined) {
+                if (!Array.isArray(tests.node)) {
+                    error('scripts.tests.node must be an array of glob strings');
+                }
+                else {
+                    const allFiles = listFilesRecursive(pluginDir);
+                    const testEntries = [];
+                    tests.node.forEach((pattern, index) => {
+                        if (typeof pattern !== 'string' || pattern.trim() === '') {
+                            error(`scripts.tests.node[${index}] must be a non-empty string`);
+                            return;
+                        }
+                        for (const filePath of allFiles) {
+                            if (matchesGlob(filePath, pattern)) {
+                                testEntries.push(filePath);
+                            }
+                        }
+                    });
+                    scanNodeImportContract(pluginDir, testEntries, {
+                        label: 'scripts.tests.node import contract',
+                        packageMeta,
+                        allowDevDependencies: true,
+                    });
+                }
+            }
+        }
+    }
+    scanNodeImportContract(pluginDir, runtimeNodeEntries.map((entry) => entry.path), {
+        label: 'runtime Node import contract',
+        packageMeta,
+        allowDevDependencies: false,
+    });
+    return artifactRenderEntry;
+}
+function validateMcpContent(pluginDir, manifest) {
+    if (!manifest.mcpServers)
+        return;
+    if (isTemplateAsset(manifest, manifest.mcpServers))
+        return;
+    const mcpPath = path.join(pluginDir, manifest.mcpServers);
+    if (!fs.existsSync(mcpPath))
+        return;
+    try {
+        const content = JSON.parse(fs.readFileSync(mcpPath, 'utf8'));
+        if (!content.mcpServers || typeof content.mcpServers !== 'object') {
+            error(`${manifest.mcpServers} must have a "mcpServers" top-level key`);
+        }
+    }
+    catch (e) {
+        error(`${manifest.mcpServers} is not valid JSON: ${e.message}`);
+    }
+}
+function validateAppsContent(pluginDir, manifest) {
+    if (!manifest.apps)
+        return;
+    if (isTemplateAsset(manifest, manifest.apps))
+        return;
+    const appsPath = path.join(pluginDir, manifest.apps);
+    if (!fs.existsSync(appsPath))
+        return;
+    try {
+        const content = JSON.parse(fs.readFileSync(appsPath, 'utf8'));
+        if (!content.apps || typeof content.apps !== 'object') {
+            error(`${manifest.apps} must have an "apps" top-level key`);
+        }
+    }
+    catch (e) {
+        error(`${manifest.apps} is not valid JSON: ${e.message}`);
+    }
+}
+function hasCodexRepoManagedSurface(manifest) {
+    if (manifest.skills || manifest.slashCommands || manifest.mcpServers) {
+        return true;
+    }
+    if ((manifest.artifacts?.targets ?? []).some((target) => target?.platform === 'codex' &&
+        Array.isArray(target.scopes) &&
+        target.scopes.includes('project') &&
+        typeof target.projectManagedKind === 'string')) {
+        return true;
+    }
+    const extensions = manifest.extensions;
+    if (!extensions || typeof extensions !== 'object' || Array.isArray(extensions)) {
+        return false;
+    }
+    return ['instructions', 'permissions', 'hooks', 'agents'].some((key) => Array.isArray(extensions[key]) && extensions[key].length > 0) || (extensions.nativeHooks &&
+        typeof extensions.nativeHooks === 'object' &&
+        !Array.isArray(extensions.nativeHooks) &&
+        Array.isArray(extensions.nativeHooks.codex) &&
+        extensions.nativeHooks.codex.length > 0);
+}
+function warnCodexProjectScopeLimitations(manifest) {
+    if (!isCodexTargeted(manifest)) {
+        return;
+    }
+    if (manifest.apps) {
+        warn('Codex project scope does not support apps; users must install this app surface with `aw install <plugin> -p codex -s user` or split the plugin.');
+    }
+    if (!hasCodexRepoManagedSurface(manifest)) {
+        warn('This Codex-targeted plugin has no repo-managed project surface; Codex project scope will fail fast and only Codex user native install is applicable.');
+    }
+}
+function validateExtensionNameUniqueness(manifest) {
+    if (!manifest.extensions)
+        return;
+    for (const extType of ['instructions', 'permissions', 'hooks', 'agents']) {
+        const items = manifest.extensions[extType];
+        if (!Array.isArray(items))
+            continue;
+        const names = new Set();
+        for (const item of items) {
+            if (item.name) {
+                if (names.has(item.name)) {
+                    error(`extensions.${extType} has duplicate name: "${item.name}"`);
+                }
+                names.add(item.name);
+            }
+        }
+    }
+}
+function validateOpenAiYaml(openaiYamlPath, skillName, required, manifest, pluginDir, skillValidationTools) {
+    const fieldName = `skills/${skillName}/agents/openai.yaml`;
+    if (!fs.existsSync(openaiYamlPath)) {
+        if (required) {
+            error(`${fieldName} not found; Codex-targeted skills must declare Codex trigger policy`);
+        }
+        else {
+            warn(`${fieldName} not found; this is acceptable only for non-Codex skills`);
+        }
+        return;
+    }
+    if (!skillValidationTools) {
+        error(`${fieldName} cannot be validated because the shared CLI Skill validator is unavailable`);
+        return;
+    }
+    try {
+        const relativePath = path.relative(pluginDir, openaiYamlPath);
+        const rawContent = fs.readFileSync(openaiYamlPath, 'utf8');
+        const validation = skillValidationTools.validateCodexMetadata(renderTemplateForPlatform(manifest, relativePath, rawContent, 'codex'), skillName, fieldName);
+        for (const entry of validation.errors) {
+            error(`${entry.path} [${entry.code}] ${entry.message}`);
+        }
+        const skillRoot = path.dirname(path.dirname(openaiYamlPath));
+        for (const assetPath of validation.assetPaths) {
+            const absoluteAssetPath = path.join(skillRoot, ...assetPath.split('/'));
+            const stats = fs.lstatSync(absoluteAssetPath, { throwIfNoEntry: false });
+            if (!stats?.isFile() || stats.isSymbolicLink()) {
+                error(`${fieldName} references missing regular file "${assetPath}"`);
+            }
+        }
+    }
+    catch (e) {
+        error(`${fieldName} shared validation failed: ${e.message}`);
+    }
+}
+function validateSkills(pluginDir, manifest, options, skillValidationTools) {
+    if (!manifest.skills)
+        return;
+    const skillsDir = path.join(pluginDir, manifest.skills);
+    if (!fs.existsSync(skillsDir))
+        return;
+    const requiresCodexMetadata = isCodexTargeted(manifest);
+    const targetsClaude = isClaudeTargeted(manifest);
+    const skillDirs = fs
+        .readdirSync(skillsDir, { withFileTypes: true })
+        .filter((d) => d.isDirectory());
+    if (skillDirs.length === 0) {
+        error('skills directory exists but contains no skill subdirectories');
+    }
+    for (const dir of skillDirs) {
+        const skillPath = path.join(skillsDir, dir.name);
+        const skillMdPath = path.join(skillPath, 'SKILL.md');
+        const openaiYamlPath = path.join(skillPath, 'agents', 'openai.yaml');
+        const skillMdRelativePath = path.relative(pluginDir, skillMdPath);
+        if (!fs.existsSync(skillMdPath)) {
+            error(`skills/${dir.name}/SKILL.md not found`);
+            continue;
+        }
+        const content = fs.readFileSync(skillMdPath, 'utf8');
+        const lineCount = countLines(content);
+        if (lineCount >= MAX_SKILL_LINES) {
+            warn(`skills/${dir.name}/SKILL.md has ${lineCount} lines; Agent Skills recommends keeping SKILL.md under ${MAX_SKILL_LINES} lines`);
+        }
+        const variants = renderedContentVariants(manifest, skillMdRelativePath, content, targetedPlatforms(manifest));
+        for (const variant of variants) {
+            const sourceName = variant.platform
+                ? `skills/${dir.name}/SKILL.md (${variant.platform} render)`
+                : `skills/${dir.name}/SKILL.md`;
+            if (!skillValidationTools) {
+                error(`${sourceName} cannot be validated because the shared CLI Skill validator is unavailable`);
+            }
+            else {
+                const parsed = skillValidationTools.parseSkillFrontmatter(variant.content, sourceName);
+                for (const entry of parsed.errors) {
+                    error(`${entry.path} [${entry.code}] ${entry.message}`);
+                }
+                if (parsed.frontmatter) {
+                    const profile = options.strictAgentSkills || !targetsClaude
+                        ? 'portable-agent-skills'
+                        : options.claudeSkillProfile === 'current'
+                            ? 'claude-current'
+                            : 'claude-2.1.88';
+                    const diagnostics = skillValidationTools.validateSkillFrontmatter(parsed.frontmatter, {
+                        profile,
+                        expectedName: dir.name,
+                        sourcePath: sourceName,
+                    });
+                    for (const entry of diagnostics) {
+                        error(`${entry.path} [${entry.code}] ${entry.message}`);
+                    }
+                }
+            }
+        }
+        validateOpenAiYaml(openaiYamlPath, dir.name, requiresCodexMetadata, manifest, pluginDir, skillValidationTools);
+        if (/\[TODO[:\]]/i.test(content)) {
+            error(`skills/${dir.name}/SKILL.md still contains TODO placeholders`);
+        }
+    }
+}
+function detectCodexSlashCommandForbiddenSyntax(content) {
+    const checks = [
+        [/\$ARGUMENTS\b/, '$ARGUMENTS'],
+        [/\$\d+\b/, '$1'],
+        [/```!/, '```!'],
+        [/!`[^`\r\n]+`/, '!`command`'],
+    ];
+    for (const [pattern, label] of checks) {
+        if (pattern.test(content)) {
+            return label;
+        }
+    }
+    return null;
+}
+function validateSlashCommandAssetReference(commandRoot, commandRelativePath, value, fieldName) {
+    if (value === undefined)
+        return;
+    validateCodexIconPath({ [fieldName]: value }, fieldName, `${commandRelativePath}.codex.interface`);
+    if (typeof value !== 'string' || value.trim().length === 0)
+        return;
+    const normalized = normalizeRelativePath(stripDotSlash(value));
+    const absolutePath = path.join(commandRoot, normalized);
+    const stats = fs.statSync(absolutePath, { throwIfNoEntry: false });
+    if (!stats) {
+        error(`${commandRelativePath}.codex.interface.${fieldName} references missing asset "${value}"`);
+        return;
+    }
+    if (!stats.isFile()) {
+        error(`${commandRelativePath}.codex.interface.${fieldName} must reference a file, got "${value}"`);
+    }
+}
+function validateSlashCommandFrontmatter(commandRoot, commandRelativePath, frontmatter, platform) {
+    const fieldName = `${commandRelativePath} frontmatter`;
+    const fm = expectRecord(frontmatter, fieldName);
+    if (!fm)
+        return;
+    for (const key of Object.keys(fm)) {
+        if (CLAUDE_SLASH_COMMAND_ONLY_FIELDS.has(key)) {
+            error(`${fieldName}: "${key}" must be nested under "claude"`);
+        }
+    }
+    validateAllowedKeys(fm, fieldName, ['description', 'claude', 'codex']);
+    validateNonEmptyString(fm.description, `${fieldName}.description`, MAX_SKILL_DESCRIPTION_LEN);
+    if (platform === 'claude' && fm.claude !== undefined) {
+        const claudeBlock = expectRecord(fm.claude, `${fieldName}.claude`);
+        if (claudeBlock) {
+            validateAllowedKeys(claudeBlock, `${fieldName}.claude`, [
+                'description',
+                'allowed-tools',
+                'model',
+                'argument-hint',
+                'shell',
+            ]);
+            if (claudeBlock.description !== undefined) {
+                validateNonEmptyString(claudeBlock.description, `${fieldName}.claude.description`, MAX_SKILL_DESCRIPTION_LEN);
+            }
+            if (claudeBlock['allowed-tools'] !== undefined) {
+                validateAllowedTools(claudeBlock['allowed-tools'], `${fieldName}.claude.allowed-tools`, { allowArray: true });
+            }
+            if (claudeBlock.model !== undefined) {
+                validateNonEmptyString(claudeBlock.model, `${fieldName}.claude.model`);
+            }
+            if (claudeBlock['argument-hint'] !== undefined) {
+                validateNonEmptyString(claudeBlock['argument-hint'], `${fieldName}.claude.argument-hint`);
+            }
+            if (claudeBlock.shell !== undefined) {
+                if (typeof claudeBlock.shell !== 'string') {
+                    error(`${fieldName}.claude.shell must be a string`);
+                }
+                else if (!CLAUDE_FRONTMATTER_SHELLS.has(claudeBlock.shell.trim().toLowerCase())) {
+                    error(`${fieldName}.claude.shell must be "bash" or "powershell"`);
+                }
+            }
+        }
+    }
+    if (platform === 'codex' && fm.codex !== undefined) {
+        const codexBlock = expectRecord(fm.codex, `${fieldName}.codex`);
+        if (codexBlock) {
+            if (codexBlock.policy !== undefined) {
+                error(`${fieldName}.codex.policy is not supported; generated slashCommands skills are always manual-only`);
+            }
+            validateAllowedKeys(codexBlock, `${fieldName}.codex`, ['description', 'interface']);
+            if (codexBlock.description !== undefined) {
+                validateNonEmptyString(codexBlock.description, `${fieldName}.codex.description`, MAX_SKILL_DESCRIPTION_LEN);
+            }
+            if (codexBlock.interface !== undefined) {
+                const interfaceBlock = expectRecord(codexBlock.interface, `${fieldName}.codex.interface`);
+                if (interfaceBlock) {
+                    validateAllowedKeys(interfaceBlock, `${fieldName}.codex.interface`, [
+                        'display_name',
+                        'short_description',
+                        'icon_small',
+                        'icon_large',
+                        'brand_color',
+                        'default_prompt',
+                    ]);
+                    validateCodexMetadataString(interfaceBlock, 'display_name', `${fieldName}.codex.interface`, MAX_OPENAI_INTERFACE_NAME_LEN);
+                    validateCodexShortDescription(interfaceBlock, `${fieldName}.codex.interface`);
+                    validateCodexDefaultPrompt(interfaceBlock, 'default_prompt', `${fieldName}.codex.interface`, MAX_OPENAI_DEFAULT_PROMPT_LEN, path.basename(commandRelativePath, path.extname(commandRelativePath)));
+                    validateCodexBrandColor(interfaceBlock, 'brand_color', `${fieldName}.codex.interface`);
+                    validateSlashCommandAssetReference(commandRoot, commandRelativePath, interfaceBlock.icon_small, 'icon_small');
+                    validateSlashCommandAssetReference(commandRoot, commandRelativePath, interfaceBlock.icon_large, 'icon_large');
+                }
+            }
+        }
+    }
+}
+function validateSlashCommands(pluginDir, manifest) {
+    const defaultSlashCommandsDir = path.join(pluginDir, DEFAULT_SLASH_COMMANDS_DIR);
+    if (fs.existsSync(defaultSlashCommandsDir) && !manifest.slashCommands) {
+        error(`"${DEFAULT_SLASH_COMMANDS_DIR}" exists but manifest does not declare "slashCommands"`);
+    }
+    if (!manifest.slashCommands)
+        return;
+    const targetPlatforms = resolveSupportedPlatforms(manifest);
+    const slashCommandsRoot = path.join(pluginDir, manifest.slashCommands);
+    const stats = fs.statSync(slashCommandsRoot, { throwIfNoEntry: false });
+    if (!stats) {
+        error(`slashCommands points to "${manifest.slashCommands}" but path does not exist`);
+        return;
+    }
+    if (!stats.isDirectory()) {
+        error(`slashCommands must point to a directory, got "${manifest.slashCommands}"`);
+        return;
+    }
+    const skillNames = new Set();
+    if (manifest.skills) {
+        const skillsRoot = path.join(pluginDir, manifest.skills);
+        if (fs.existsSync(skillsRoot)) {
+            for (const entry of fs.readdirSync(skillsRoot, { withFileTypes: true })) {
+                if (entry.isDirectory()) {
+                    skillNames.add(entry.name);
+                }
+            }
+        }
+    }
+    const seenCommands = new Set();
+    const commandFiles = [];
+    for (const entry of fs.readdirSync(slashCommandsRoot, { withFileTypes: true })) {
+        const relativePath = normalizeRelativePath(path.join(stripDotSlash(manifest.slashCommands), entry.name));
+        if (entry.isDirectory()) {
+            if (entry.name !== 'assets') {
+                error(`slashCommands does not support nested directory "${relativePath}"; only root *.md files and assets/ are allowed`);
+            }
+            continue;
+        }
+        if (!entry.isFile()) {
+            error(`slashCommands has unsupported entry "${relativePath}"`);
+            continue;
+        }
+        if (path.posix.extname(entry.name) !== '.md') {
+            error(`slashCommands only accepts root *.md files; found "${relativePath}"`);
+            continue;
+        }
+        commandFiles.push(entry.name);
+    }
+    if (commandFiles.length === 0) {
+        error(`slashCommands "${manifest.slashCommands}" must contain at least one root *.md command file`);
+        return;
+    }
+    for (const fileName of commandFiles.sort()) {
+        const commandName = path.posix.basename(fileName, '.md');
+        const commandRelativePath = normalizeRelativePath(path.join(stripDotSlash(manifest.slashCommands), fileName));
+        if (commandName.length === 0 ||
+            commandName.length > 64 ||
+            !SLASH_COMMAND_NAME_PATTERN.test(commandName)) {
+            error(`${commandRelativePath} command name must use lowercase hyphen-case and be <= 64 characters`);
+            continue;
+        }
+        if (seenCommands.has(commandName)) {
+            error(`slashCommands has duplicate command name "${commandName}"`);
+            continue;
+        }
+        if (skillNames.has(commandName)) {
+            error(`slashCommands command "${commandName}" conflicts with source skill "${commandName}"`);
+            continue;
+        }
+        seenCommands.add(commandName);
+        const absolutePath = path.join(slashCommandsRoot, fileName);
+        const rawContent = fs.readFileSync(absolutePath, 'utf8');
+        for (const platform of ['claude', 'codex']) {
+            if (!targetPlatforms.has(platform))
+                continue;
+            const rendered = renderTemplateForPlatform(manifest, commandRelativePath, rawContent, platform);
+            if (platform === 'codex') {
+                const codexForbiddenSyntax = detectCodexSlashCommandForbiddenSyntax(rendered);
+                if (codexForbiddenSyntax) {
+                    error(`${commandRelativePath} Codex render still contains Claude-only syntax "${codexForbiddenSyntax}"`);
+                }
+            }
+            let frontmatter;
+            try {
+                frontmatter = parseFrontmatter(rendered, `${commandRelativePath} (${platform} render)`);
+            }
+            catch (parseError) {
+                error(`${commandRelativePath} (${platform} render) has invalid YAML frontmatter: ${parseError.message}`);
+                continue;
+            }
+            if (!frontmatter) {
+                error(`${commandRelativePath} (${platform} render) is missing YAML frontmatter`);
+                continue;
+            }
+            validateSlashCommandFrontmatter(slashCommandsRoot, commandRelativePath, frontmatter, platform);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+function printUsage() {
+    console.log(`Usage:
+  aw plugin validate <plugin-directory> [options]
+
+Options:
+  --catalog-min-version <semver>
+                               Validate compatibility.aw.minVersion against a target catalog.
+  --strict-agent-skills        Allow only Agent Skills portable core frontmatter.
+  --claude-skill-profile <minimum|current>
+                               Validate Claude fields at AW minimum 2.1.88 (default) or current docs.
+  --version-base <git-ref>     Compare the production bundle against this Git base. Default: HEAD.
+  --workspace-root <path>      Workspace root. Default: current directory.
+  --json                       Emit one machine-readable JSON result to stdout.
+  -h, --help                   Show this help message.
+`);
+}
+function exitCliError(message, json) {
+    if (json) {
+        console.log(JSON.stringify({
+            ok: false,
+            profile: 'unknown',
+            warnings: [],
+            errors: [message],
+        }, null, 2));
+    }
+    else {
+        console.error(message);
+    }
+    process.exit(1);
+}
+async function validatePluginDir(pluginDir, options) {
+    const manifestPath = path.join(pluginDir, '.agents-plugin', 'plugin.json');
+    const cliManifestTools = await tryLoadCliManifestTools();
+    if (!cliManifestTools
+        || typeof cliManifestTools.assertPluginInputTree !== 'function'
+        || typeof cliManifestTools.validateSourcePluginManifest !== 'function') {
+        error(`Plugin manifest contract v${SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION} is unavailable; install a complete current aw CLI and retry.`);
+        return;
+    }
+    try {
+        await cliManifestTools.assertPluginInputTree(pluginDir);
+    }
+    catch (e) {
+        error(e.message);
+        return;
+    }
+    if (!fs.existsSync(manifestPath)) {
+        error('.agents-plugin/plugin.json not found');
+        return;
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    }
+    catch (e) {
+        error(`.agents-plugin/plugin.json is not valid JSON: ${e.message}`);
+        return;
+    }
+    if (options.enforceCanonicalRoot
+        && typeof manifest?.name === 'string'
+        && manifest.name !== '') {
+        try {
+            assertCanonicalAuthoringPluginRoot({
+                workspaceRoot: options.repoRoot,
+                pluginRoot: pluginDir,
+                pluginName: manifest.name,
+                requireManifest: true,
+            });
+        }
+        catch (cause) {
+            error(cause.message);
+            return;
+        }
+    }
+    const skillValidationTools = await tryLoadCliSkillValidationTools();
+    try {
+        await cliManifestTools.validateSourcePluginManifest(pluginDir, manifest);
+    }
+    catch (e) {
+        error(e.message);
+    }
+    validatePlatformFieldSupport(manifest);
+    validatePortableNativeArtifactCapabilityLightweight(manifest);
+    validateNameMatchesDirectory(pluginDir, manifest);
+    validateNoBuildOutputDirs(pluginDir);
+    validateDeclaredNativeAssets(pluginDir, manifest);
+    validateCanonicalSkillLayout(pluginDir, manifest);
+    validatePluginVersionContracts(manifest, options);
+    validatePluginEvalManifest(pluginDir, manifest);
+    const artifactRenderEntry = validateScriptsLightweight(pluginDir, manifest);
+    const runtimeImports = await resolveAuthorRuntimeImports({
+        pluginDir,
+        manifest,
+        repoRoot: options.repoRoot,
+        cliManifestTools,
+    });
+    validateStaticPortableFinalTrees(pluginDir, manifest, runtimeImports, skillValidationTools);
+    validateDynamicArtifactsLightweight(pluginDir, manifest, artifactRenderEntry, runtimeImports, skillValidationTools);
+    validateMcpContent(pluginDir, manifest);
+    validateAppsContent(pluginDir, manifest);
+    warnCodexProjectScopeLimitations(manifest);
+    validateExtensionNameUniqueness(manifest);
+    validateSkills(pluginDir, manifest, options, skillValidationTools);
+    validateSlashCommands(pluginDir, manifest);
+    if (errors.length === 0) {
+        const repoRoot = resolveCanonicalRepoRoot(pluginDir, manifest.name ?? '', options.gitRoot);
+        if (repoRoot) {
+            try {
+                pluginVersionCheckResult = await checkPluginVersions({
+                    repoRoot,
+                    cliPackageRoot: CLI_PACKAGE_ROOT,
+                    base: options.versionBase,
+                    pluginNames: [manifest.name],
+                });
+                const check = pluginVersionCheckResult.checks[0];
+                for (const message of check?.warnings ?? []) {
+                    warn(`plugin version check: ${message}`);
+                }
+                for (const message of check?.errors ?? []) {
+                    error(`plugin version check: ${message}`);
+                }
+            }
+            catch (versionError) {
+                if (versionError?.code === 'bundlerUnavailable'
+                    || versionError?.code === 'gitUnavailable') {
+                    warn(`plugin version check skipped: ${versionError.message}`);
+                }
+                else {
+                    error(`plugin version check failed: ${versionError.message}`);
+                }
+            }
+        }
+    }
+}
+function parseArgs(argv) {
+    const args = argv.slice(2);
+    const options = {
+        pluginDir: null,
+        catalogMinVersion: null,
+        strictAgentSkills: false,
+        claudeSkillProfile: 'minimum',
+        versionBase: 'HEAD',
+        workspaceRoot: null,
+        json: args.includes('--json'),
+    };
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '-h' || arg === '--help') {
+            printUsage();
+            process.exit(0);
+        }
+        if (arg === '--json') {
+            continue;
+        }
+        if (arg === '--strict-agent-skills') {
+            options.strictAgentSkills = true;
+            continue;
+        }
+        if (arg === '--claude-skill-profile') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('--')) {
+                exitCliError('--claude-skill-profile requires a value.', options.json);
+            }
+            index += 1;
+            if (value !== 'minimum' && value !== 'current') {
+                exitCliError(`Invalid --claude-skill-profile: expected "minimum" or "current". Received ${JSON.stringify(value)}.`, options.json);
+            }
+            options.claudeSkillProfile = value;
+            continue;
+        }
+        if (arg === '--version-base') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('--')) {
+                exitCliError('--version-base requires a value.', options.json);
+            }
+            index += 1;
+            options.versionBase = value;
+            continue;
+        }
+        if (arg === '--workspace-root') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('--')) {
+                exitCliError('--workspace-root requires a value.', options.json);
+            }
+            index += 1;
+            options.workspaceRoot = value;
+            continue;
+        }
+        if (!arg.startsWith('--')) {
+            if (!options.pluginDir) {
+                options.pluginDir = arg;
+                continue;
+            }
+            exitCliError(`Unknown argument: ${arg}`, options.json);
+        }
+        if (arg === '--catalog-min-version') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('--')) {
+                exitCliError('--catalog-min-version requires a value.', options.json);
+            }
+            index += 1;
+            if (!STRICT_SEMVER_PATTERN.test(value)) {
+                exitCliError(`Invalid --catalog-min-version: expected a strict SemVer 2.0.0 string. Received ${JSON.stringify(value)}.`, options.json);
+            }
+            options.catalogMinVersion = value;
+            continue;
+        }
+        exitCliError(`Unknown option: ${arg}`, options.json);
+    }
+    return options;
+}
+async function main() {
+    const args = parseArgs(process.argv);
+    if (!args.pluginDir) {
+        exitCliError('plugin-directory is required; run with --help for usage.', args.json);
+    }
+    const requestedWorkspaceRoot = args.workspaceRoot === null
+        ? null
+        : path.resolve(args.workspaceRoot);
+    const resolved = path.resolve(requestedWorkspaceRoot ?? '.', args.pluginDir);
+    if (!fs.existsSync(resolved)) {
+        exitCliError(`[ERROR] Directory not found: ${resolved}`, args.json);
+    }
+    const repoRootCandidate = requestedWorkspaceRoot ?? findRepoRootCandidate(resolved);
+    try {
+        assertAuthoringPluginPathFence({
+            repoRoot: repoRootCandidate ?? undefined,
+            pluginRoot: resolved,
+            requirePluginRoot: true,
+            requireManifest: true,
+        });
+    }
+    catch (pathError) {
+        exitCliError(`[ERROR] ${pathError.message}`, args.json);
+    }
+    const repoRoot = requestedWorkspaceRoot ?? discoverCanonicalRepoRoot(repoRootCandidate);
+    const gitRoot = discoverCanonicalRepoRoot(findRepoRootCandidate(resolved));
+    await validatePluginDir(resolved, {
+        catalogMinVersion: args.catalogMinVersion,
+        strictAgentSkills: args.strictAgentSkills,
+        claudeSkillProfile: args.claudeSkillProfile,
+        versionBase: args.versionBase,
+        repoRoot,
+        gitRoot,
+        enforceCanonicalRoot: requestedWorkspaceRoot !== null,
+    });
+    if (args.json) {
+        console.log(JSON.stringify({
+            ok: errors.length === 0,
+            profile: args.strictAgentSkills ? 'agent-skills-portable-core' : 'aw-source',
+            claudeSkillProfile: args.claudeSkillProfile,
+            pluginDirectory: resolved,
+            versionCheck: pluginVersionCheckResult,
+            warnings,
+            errors,
+        }, null, 2));
+        if (errors.length > 0) {
+            process.exit(1);
+        }
+        return;
+    }
+    if (warnings.length > 0) {
+        console.log(`\n[WARN] ${warnings.length} warning(s):`);
+        for (const w of warnings) {
+            console.log(`  - ${w}`);
+        }
+    }
+    if (errors.length > 0) {
+        console.log(`\n[FAIL] ${errors.length} error(s):`);
+        for (const e of errors) {
+            console.log(`  - ${e}`);
+        }
+        process.exit(1);
+    }
+    console.log('[PASS] All checks passed.');
+}
+main();
+//# sourceMappingURL=validate-plugin.mjs.map