@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/workforce-bundle-inventory.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildWorkforceBundleInventory = buildWorkforceBundleInventory;
+const shared_1 = require("@nexusclaw/shared");
+const manifest_inventory_1 = require("./manifest-inventory");
+const archive_safety_1 = require("./archive-safety");
+/**
+ * Sole pure portable-inventory owner shared by CLI packing and server upload
+ * verification. Runtime bindings travel in the archive but never contribute
+ * to the portable digest; generated `.nexusclaw/` state is forbidden.
+ */
+async function buildWorkforceBundleInventory(entries, parseStructured) {
+    const files = new Map(entries.map((entry) => [entry.path, entry]));
+    if (files.size !== entries.length) {
+        throw new Error('PACKAGE_ARCHIVE_COLLISION');
+    }
+    (0, archive_safety_1.assertNoPathCollisions)(entries.map((entry) => entry.path));
+    for (const entry of entries)
+        (0, archive_safety_1.assertSafeArchivePath)(entry.path);
+    if (entries.some((entry) => entry.path.startsWith('.nexusclaw/'))) {
+        throw new Error('WORKFORCE_GENERATED_STATE_FORBIDDEN');
+    }
+    const bundleEntry = requireFile(files, 'workforce.bundle.json');
+    const bundle = parseStructured(bundleEntry.path, bundleEntry.bytes);
+    if (bundle?.schemaVersion !== shared_1.BUNDLE_SCHEMA_VERSION) {
+        throw new Error('BUNDLE_SCHEMA_VERSION_UNSUPPORTED');
+    }
+    const portable = new Map();
+    portable.set(bundleEntry.path, (0, shared_1.canonicalJsonDigest)(bundle));
+    const employee = requireFile(files, bundle.employeePackage.path);
+    portable.set(employee.path, (0, shared_1.canonicalJsonDigest)(parseStructured(employee.path, employee.bytes)));
+    const employeeEvalCases = requireFile(files, bundle.employeePackage.evalCasesPath);
+    portable.set(employeeEvalCases.path, (0, shared_1.canonicalJsonDigest)(parseStructured(employeeEvalCases.path, employeeEvalCases.bytes)));
+    for (const packageRef of [
+        ...bundle.codePackages,
+        ...bundle.flowPackages,
+    ]) {
+        const manifestPath = normalizeManifestPath(packageRef.path);
+        const manifestEntry = requireFile(files, manifestPath);
+        const manifest = parseStructured(manifestPath, manifestEntry.bytes);
+        const root = manifestPath.slice(0, manifestPath.lastIndexOf('/') + 1);
+        const descriptor = await derivePackageInventoryManifest(manifestPath, root, manifest, files, parseStructured);
+        const inventory = await (0, manifest_inventory_1.buildManifestInventory)(descriptor, async (path) => inventoryFile(path, files, parseStructured));
+        for (const item of inventory.entries) {
+            portable.set(item.path, item.semanticEntryDigest);
+        }
+    }
+    const bindingEntries = entries.filter((entry) => /^bindings\/[^/]+\.runtime-bindings\.json$/.test(entry.path));
+    if (bindingEntries.length !== 1) {
+        throw new Error('WORKFORCE_RUNTIME_BINDINGS_NOT_EXACT');
+    }
+    const runtimeBindings = parseStructured(bindingEntries[0].path, bindingEntries[0].bytes);
+    const permitted = new Set([
+        ...portable.keys(),
+        bindingEntries[0].path,
+    ]);
+    const unknown = entries
+        .map((entry) => entry.path)
+        .filter((path) => !permitted.has(path));
+    if (unknown.length > 0) {
+        throw new Error(`PACKAGE_UNREFERENCED_ENTRY:${unknown.sort().join(',')}`);
+    }
+    const portableEntries = [...portable]
+        .map(([path, semanticEntryDigest]) => ({ path, semanticEntryDigest }))
+        .sort(bytePathSort);
+    return {
+        portableEntries,
+        archiveEntries: [...entries].sort((a, b) => bytePathSort(a, b)),
+        portableBundleDigest: (0, shared_1.portableBundleDigest)(portableEntries),
+        runtimeBindingsDigest: (0, shared_1.canonicalJsonDigest)(runtimeBindings),
+        runtimeBindingsPath: bindingEntries[0].path,
+    };
+}
+async function derivePackageInventoryManifest(manifestPath, root, manifest, files, parseStructured) {
+    const artifacts = Array.isArray(manifest.executableArtifacts)
+        ? manifest.executableArtifacts
+        : [];
+    const prefix = (value) => `${root}${value}`;
+    const catalogRelative = typeof manifest.agentToolCatalogPath === 'string'
+        ? manifest.agentToolCatalogPath
+        : null;
+    const schemaRefs = [];
+    const testPaths = [];
+    if (catalogRelative) {
+        const catalogPath = prefix(catalogRelative);
+        const catalogEntry = requireFile(files, catalogPath);
+        const catalog = parseStructured(catalogPath, catalogEntry.bytes);
+        for (const item of catalog.exports ?? []) {
+            for (const key of ['inputSchemaRef', 'outputSchemaRef']) {
+                if (typeof item[key] === 'string')
+                    schemaRefs.push(prefix(item[key]));
+            }
+            if (Array.isArray(item.tests)) {
+                for (const test of item.tests) {
+                    if (typeof test.path === 'string')
+                        testPaths.push(prefix(test.path));
+                }
+            }
+        }
+    }
+    return {
+        manifestPath,
+        manifestValue: manifest,
+        sourcePaths: artifacts
+            .map((item) => item.sourcePath)
+            .filter((value) => typeof value === 'string')
+            .map(prefix),
+        ...(catalogRelative
+            ? { agentToolCatalogPath: prefix(catalogRelative) }
+            : {}),
+        schemaRefs: await collectSchemaClosure(schemaRefs, files, parseStructured),
+        testPaths,
+        flowPayloadRefs: stringArray(manifest.flowPayloadRefs).map(prefix),
+        releaseEvidenceRefs: stringArray(manifest.releaseEvidenceRefs).map(prefix),
+    };
+}
+async function collectSchemaClosure(initial, files, parseStructured) {
+    const result = new Set();
+    const visit = (schemaPath) => {
+        if (result.has(schemaPath))
+            return;
+        result.add(schemaPath);
+        const value = parseStructured(schemaPath, requireFile(files, schemaPath).bytes);
+        walk(value, (ref) => {
+            if (ref.startsWith('#'))
+                return;
+            const target = ref.split('#', 1)[0];
+            if (!target)
+                return;
+            const base = schemaPath.slice(0, schemaPath.lastIndexOf('/') + 1);
+            visit(normalizeRelativePath(`${base}${target}`));
+        });
+    };
+    initial.forEach(visit);
+    return [...result].sort();
+}
+function walk(value, onRef) {
+    if (Array.isArray(value))
+        return value.forEach((item) => walk(item, onRef));
+    if (!value || typeof value !== 'object')
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        if (key === '$ref' && typeof child === 'string')
+            onRef(child);
+        else
+            walk(child, onRef);
+    }
+}
+function inventoryFile(path, files, parseStructured) {
+    const entry = requireFile(files, path);
+    return {
+        path,
+        bytes: entry.bytes,
+        ...(path.endsWith('.json')
+            ? { parsedJson: parseStructured(path, entry.bytes) }
+            : {}),
+    };
+}
+function normalizeManifestPath(value) {
+    const normalized = normalizeRelativePath(value);
+    return /(?:^|\/)(?:package\.ya?ml|package\.json|manifest\.json)$/.test(normalized)
+        ? normalized
+        : `${normalized.replace(/\/$/, '')}/package.yaml`;
+}
+function normalizeRelativePath(value) {
+    const parts = [];
+    for (const part of value.split('/')) {
+        if (!part || part === '.')
+            continue;
+        if (part === '..') {
+            if (parts.length === 0)
+                throw new Error('PACKAGE_PATH_ESCAPE');
+            parts.pop();
+        }
+        else
+            parts.push(part);
+    }
+    const normalized = parts.join('/');
+    (0, archive_safety_1.assertSafeArchivePath)(normalized);
+    return normalized;
+}
+function requireFile(files, path) {
+    const entry = files.get(path);
+    if (!entry)
+        throw new Error(`PACKAGE_INVENTORY_MISSING:${path}`);
+    return entry;
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : [];
+}
+function bytePathSort(a, b) {
+    return Buffer.from(a.path).compare(Buffer.from(b.path));
+}
+//# sourceMappingURL=workforce-bundle-inventory.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/package/workforce-bundle-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workforce-bundle-inventory.js","sourceRoot":"","sources":["../../src/package/workforce-bundle-inventory.ts"],"names":[],"mappings":";;AAsCA,sEAwGC;AA9ID,8CAK2B;AAC3B,6DAI8B;AAC9B,qDAG0B;AAmB1B;;;;GAIG;AACI,KAAK,UAAU,6BAA6B,CACjD,OAA8C,EAC9C,eAAiC;IAEjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAA,uCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,IAAA,sCAAqB,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,eAAe,CAC5B,WAAW,CAAC,IAAI,EAChB,WAAW,CAAC,KAAK,CACe,CAAC;IACnC,IAAI,MAAM,EAAE,aAAa,KAAK,8BAAqB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IACvD,QAAQ,CAAC,GAAG,CACV,WAAW,CAAC,IAAI,EAChB,IAAA,4BAAmB,EAAC,MAAe,CAAC,CACrC,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CACV,QAAQ,CAAC,IAAI,EACb,IAAA,4BAAmB,EACjB,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAU,CACxD,CACF,CAAC;IACF,MAAM,iBAAiB,GAAG,WAAW,CACnC,KAAK,EACL,MAAM,CAAC,eAAe,CAAC,aAAa,CACrC,CAAC;IACF,QAAQ,CAAC,GAAG,CACV,iBAAiB,CAAC,IAAI,EACtB,IAAA,4BAAmB,EACjB,eAAe,CACb,iBAAiB,CAAC,IAAI,EACtB,iBAAiB,CAAC,KAAK,CACf,CACX,CACF,CAAC;IAEF,KAAK,MAAM,UAAU,IAAI;QACvB,GAAG,MAAM,CAAC,YAAY;QACtB,GAAG,MAAM,CAAC,YAAY;KACvB,EAAE,CAAC;QACF,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,eAAe,CAC9B,YAAY,EACZ,aAAa,CAAC,KAAK,CACO,CAAC;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,MAAM,8BAA8B,CACrD,YAAY,EACZ,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,eAAe,CAChB,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAA,2CAAsB,EAC5C,UAAU,EACV,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,CAC5D,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACrC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9C,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7D,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,eAAe,GAAG,eAAe,CACrC,cAAc,CAAC,CAAC,CAAE,CAAC,IAAI,EACvB,cAAc,CAAC,CAAC,CAAE,CAAC,KAAK,CACzB,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;QACxB,GAAG,QAAQ,CAAC,IAAI,EAAE;QAClB,cAAc,CAAC,CAAC,CAAE,CAAC,IAAI;KACxB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO;SACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;SACrE,IAAI,CAAC,YAAY,CAAC,CAAC;IACtB,OAAO;QACL,eAAe;QACf,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,oBAAoB,EAAE,IAAA,6BAAoB,EAAC,eAAe,CAAC;QAC3D,qBAAqB,EAAE,IAAA,4BAAmB,EAAC,eAAwB,CAAC;QACpE,mBAAmB,EAAE,cAAc,CAAC,CAAC,CAAE,CAAC,IAAI;KAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,YAAoB,EACpB,IAAY,EACZ,QAAiC,EACjC,KAA0C,EAC1C,eAAiC;IAEjC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAC3D,CAAC,CAAC,QAAQ,CAAC,mBAAqD;QAChE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;IACpD,MAAM,eAAe,GACnB,OAAO,QAAQ,CAAC,oBAAoB,KAAK,QAAQ;QAC/C,CAAC,CAAC,QAAQ,CAAC,oBAAoB;QAC/B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,eAAe,CAC7B,WAAW,EACX,YAAY,CAAC,KAAK,CAC6B,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAU,EAAE,CAAC;gBACjE,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAuC,EAAE,CAAC;oBAChE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;wBAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY;QACZ,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,SAAS;aACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;aAC9B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;aAC7D,GAAG,CAAC,MAAM,CAAC;QACd,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,MAAM,oBAAoB,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,CAAC;QAC1E,SAAS;QACT,eAAe,EAAE,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAClE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAA0B,EAC1B,KAA0C,EAC1C,eAAiC;IAEjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,UAAkB,EAAQ,EAAE;QACzC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO;QACnC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,eAAe,CAC3B,UAAU,EACV,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,KAAK,CACrC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YAChC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,KAAK,CAAC,qBAAqB,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAA4B;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,GAAG,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;;YACzD,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,KAA0C,EAC1C,eAAiC;IAEjC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxB,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,0DAA0D,CAAC,IAAI,CACpE,UAAU,CACX;QACC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QACpC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAC/D,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,CAAC;;YAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAA,sCAAqB,EAAC,UAAU,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAClB,KAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACnB,CAAmB,EACnB,CAAmB;IAEnB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/runtime/local-runner-lock.d.ts

@@ -0,0 +1,8 @@
+export interface LocalRunnerLockV1 {
+    readonly schemaVersion: 'nexusclaw.local-runner-lock/v1';
+    readonly imageRef: string;
+    readonly manifestDigest: `sha256:${string}`;
+    readonly sbomDigest: `sha256:${string}`;
+    readonly runnerContractVersion: 'nexusclaw.local-sandbox-result/v1';
+}
+export declare function parseLocalRunnerLockV1(value: unknown): LocalRunnerLockV1;

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/runtime/local-runner-lock.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseLocalRunnerLockV1 = parseLocalRunnerLockV1;
+const DIGEST = /^sha256:[0-9a-f]{64}$/;
+const REPOSITORY = /^[a-z0-9.-]+(?::[0-9]+)?(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)+$/;
+function parseLocalRunnerLockV1(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('CODE_RUNTIME_PROVIDER_UNAVAILABLE');
+    }
+    const row = value;
+    if (Object.keys(row).sort().join(',') !==
+        'imageRef,manifestDigest,runnerContractVersion,sbomDigest,schemaVersion'
+        || row.schemaVersion !== 'nexusclaw.local-runner-lock/v1'
+        || typeof row.imageRef !== 'string'
+        || !REPOSITORY.test(row.imageRef)
+        || typeof row.manifestDigest !== 'string'
+        || !DIGEST.test(row.manifestDigest)
+        || typeof row.sbomDigest !== 'string'
+        || !DIGEST.test(row.sbomDigest)
+        || row.runnerContractVersion !== 'nexusclaw.local-sandbox-result/v1') {
+        throw new Error('CODE_RUNTIME_PROVIDER_UNAVAILABLE');
+    }
+    return row;
+}
+//# sourceMappingURL=local-runner-lock.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/runtime/local-runner-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-runner-lock.js","sourceRoot":"","sources":["../../src/runtime/local-runner-lock.ts"],"names":[],"mappings":";;AAYA,wDAoBC;AAxBD,MAAM,MAAM,GAAG,uBAAuB,CAAC;AACvC,MAAM,UAAU,GACd,8DAA8D,CAAC;AAEjE,SAAgB,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IACE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,wEAAwE;WACvE,GAAG,CAAC,aAAa,KAAK,gCAAgC;WACtD,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;WAChC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;WAC9B,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;WACtC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;WAChC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;WAClC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;WAC5B,GAAG,CAAC,qBAAqB,KAAK,mCAAmC,EACpE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAmC,CAAC;AAC7C,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/schema/code-schema-loader.d.ts

@@ -0,0 +1,52 @@
+/**
+ * JSON Schema (Draft 2020-12) loader/validator (executable-asset design §9,
+ * task 3.9).
+ *
+ * The single schema-validation owner for code-action input/output. Uses AJV
+ * 8.18.0 with the frozen config (design §9 verbatim). Enforces the safety
+ * limits (schema size, depth, property count, enum count, pattern length) and
+ * rejects forbidden constructs (remote/recursive refs, patternProperties,
+ * unevaluatedProperties, missing `additionalProperties: false`).
+ */
+import Ajv2020, { type AnySchemaObject } from 'ajv/dist/2020';
+import type { AuthoringDiagnostic } from '../index';
+/** Frozen AJV 8.18.0 config (design §9, verbatim). */
+export declare const FROZEN_AJV_CONFIG: {
+    readonly strict: true;
+    readonly strictSchema: true;
+    readonly allErrors: true;
+    readonly allowUnionTypes: false;
+    readonly coerceTypes: false;
+    readonly useDefaults: false;
+    readonly removeAdditional: false;
+    readonly validateFormats: false;
+    readonly unicodeRegExp: true;
+    readonly messages: true;
+    readonly $data: false;
+};
+/** Frozen schema-shape limits (design §9). */
+export declare const SCHEMA_LIMITS: {
+    readonly schemaFileMaxBytes: number;
+    readonly resolvedDepthMax: 12;
+    readonly totalPropertiesMax: 256;
+    readonly enumValuesMax: 256;
+    readonly patternLengthMax: 512;
+};
+export interface SchemaValidationResult {
+    valid: boolean;
+    diagnostics: ReadonlyArray<AuthoringDiagnostic>;
+}
+/** Shape-check and compile a schema without inventing an instance. */
+export declare function validateSchemaDefinition(schema: AnySchemaObject): SchemaValidationResult;
+/**
+ * Compile + validate a Draft 2020-12 schema, then validate an instance against
+ * it. The schema is shape-checked (limits + forbidden constructs) before
+ * compilation. Returns diagnostics on failure (never throws to the caller for
+ * ordinary validation failures; only for shape/config errors).
+ */
+export declare function validateWithFrozenSchema(args: {
+    schema: AnySchemaObject;
+    instance: unknown;
+}): SchemaValidationResult;
+/** Build a fresh AJV instance with the frozen config (for schema-compile-only callers). */
+export declare function createFrozenAjv(): Ajv2020;

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/schema/code-schema-loader.js

@@ -0,0 +1,189 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCHEMA_LIMITS = exports.FROZEN_AJV_CONFIG = void 0;
+exports.validateSchemaDefinition = validateSchemaDefinition;
+exports.validateWithFrozenSchema = validateWithFrozenSchema;
+exports.createFrozenAjv = createFrozenAjv;
+/**
+ * JSON Schema (Draft 2020-12) loader/validator (executable-asset design §9,
+ * task 3.9).
+ *
+ * The single schema-validation owner for code-action input/output. Uses AJV
+ * 8.18.0 with the frozen config (design §9 verbatim). Enforces the safety
+ * limits (schema size, depth, property count, enum count, pattern length) and
+ * rejects forbidden constructs (remote/recursive refs, patternProperties,
+ * unevaluatedProperties, missing `additionalProperties: false`).
+ */
+const _2020_1 = __importDefault(require("ajv/dist/2020"));
+/** Frozen AJV 8.18.0 config (design §9, verbatim). */
+exports.FROZEN_AJV_CONFIG = {
+    strict: true,
+    strictSchema: true,
+    allErrors: true,
+    allowUnionTypes: false,
+    coerceTypes: false,
+    useDefaults: false,
+    removeAdditional: false,
+    validateFormats: false,
+    unicodeRegExp: true,
+    messages: true,
+    $data: false,
+};
+/** Frozen schema-shape limits (design §9). */
+exports.SCHEMA_LIMITS = {
+    schemaFileMaxBytes: 256 * 1024,
+    resolvedDepthMax: 12,
+    totalPropertiesMax: 256,
+    enumValuesMax: 256,
+    patternLengthMax: 512,
+};
+class SchemaValidationError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'SchemaValidationError';
+    }
+}
+/** Convert an AJV error to an AuthoringDiagnostic (RFC 6901 jsonPath). */
+function ajvErrorToDiagnostic(err) {
+    return {
+        code: 'CODE_SCHEMA_INVALID',
+        severity: 'error',
+        jsonPath: err.instancePath || '/',
+        ruleId: err.keyword,
+        message: err.message ?? 'schema validation failed',
+    };
+}
+/** Walk a schema object counting depth + properties + enums + patterns. */
+function assertSchemaShape(schema, depth = 0) {
+    if (depth > exports.SCHEMA_LIMITS.resolvedDepthMax) {
+        throw new SchemaValidationError('CODE_SCHEMA_INVALID', `schema depth exceeds ${exports.SCHEMA_LIMITS.resolvedDepthMax}`);
+    }
+    if (schema === null || typeof schema !== 'object')
+        return;
+    // additionalProperties: false required on every object (design §9).
+    if (schema.type === 'object' && schema.additionalProperties === undefined) {
+        throw new SchemaValidationError('CODE_SCHEMA_INVALID', 'every object schema must explicitly set additionalProperties:false');
+    }
+    // Forbidden constructs.
+    if ('$ref' in schema && typeof schema.$ref === 'string') {
+        if (schema.$ref.startsWith('http://') || schema.$ref.startsWith('https://')) {
+            throw new SchemaValidationError('CODE_SCHEMA_REF_FORBIDDEN', `remote $ref forbidden: ${schema.$ref}`);
+        }
+    }
+    if ('patternProperties' in schema) {
+        throw new SchemaValidationError('CODE_SCHEMA_INVALID', 'patternProperties is forbidden');
+    }
+    if ('unevaluatedProperties' in schema) {
+        throw new SchemaValidationError('CODE_SCHEMA_INVALID', 'unevaluatedProperties is forbidden');
+    }
+    if ('dynamicRef' in schema || 'dynamicAnchor' in schema) {
+        throw new SchemaValidationError('CODE_SCHEMA_REF_FORBIDDEN', 'dynamic recursive refs forbidden');
+    }
+    if (Array.isArray(schema.enum) && schema.enum.length > exports.SCHEMA_LIMITS.enumValuesMax) {
+        throw new SchemaValidationError('CODE_SCHEMA_INVALID', `enum has ${schema.enum.length} values, exceeds ${exports.SCHEMA_LIMITS.enumValuesMax}`);
+    }
+    if (typeof schema.pattern === 'string' && schema.pattern.length > exports.SCHEMA_LIMITS.patternLengthMax) {
+        throw new SchemaValidationError('CODE_SCHEMA_INVALID', `pattern length ${schema.pattern.length} exceeds ${exports.SCHEMA_LIMITS.patternLengthMax}`);
+    }
+    // Recurse into properties / items / defs.
+    if (schema.properties && typeof schema.properties === 'object') {
+        const propCount = Object.keys(schema.properties).length;
+        if (propCount > exports.SCHEMA_LIMITS.totalPropertiesMax) {
+            throw new SchemaValidationError('CODE_SCHEMA_INVALID', `object has ${propCount} properties, exceeds ${exports.SCHEMA_LIMITS.totalPropertiesMax}`);
+        }
+        for (const child of Object.values(schema.properties)) {
+            assertSchemaShape(child, depth + 1);
+        }
+    }
+    if (schema.items) {
+        if (Array.isArray(schema.items)) {
+            for (const child of schema.items)
+                assertSchemaShape(child, depth + 1);
+        }
+        else {
+            assertSchemaShape(schema.items, depth + 1);
+        }
+    }
+    if (schema.$defs && typeof schema.$defs === 'object') {
+        for (const child of Object.values(schema.$defs)) {
+            assertSchemaShape(child, depth + 1);
+        }
+    }
+}
+/** Shape-check and compile a schema without inventing an instance. */
+function validateSchemaDefinition(schema) {
+    try {
+        assertSchemaShape(schema);
+        new _2020_1.default(exports.FROZEN_AJV_CONFIG).compile(schema);
+        return { valid: true, diagnostics: [] };
+    }
+    catch (e) {
+        return {
+            valid: false,
+            diagnostics: [{
+                    code: e instanceof SchemaValidationError ? e.code : 'CODE_SCHEMA_INVALID',
+                    severity: 'error',
+                    message: e instanceof Error ? e.message : 'schema compile failed',
+                }],
+        };
+    }
+}
+/**
+ * Compile + validate a Draft 2020-12 schema, then validate an instance against
+ * it. The schema is shape-checked (limits + forbidden constructs) before
+ * compilation. Returns diagnostics on failure (never throws to the caller for
+ * ordinary validation failures; only for shape/config errors).
+ */
+function validateWithFrozenSchema(args) {
+    // 1. Shape check the schema (throws on forbidden constructs).
+    try {
+        assertSchemaShape(args.schema);
+    }
+    catch (e) {
+        return {
+            valid: false,
+            diagnostics: [
+                {
+                    code: e.code,
+                    severity: 'error',
+                    message: e.message,
+                },
+            ],
+        };
+    }
+    // 2. Compile + validate with the frozen AJV config.
+    const ajv = new _2020_1.default(exports.FROZEN_AJV_CONFIG);
+    let validate;
+    try {
+        validate = ajv.compile(args.schema);
+    }
+    catch (e) {
+        return {
+            valid: false,
+            diagnostics: [
+                {
+                    code: 'CODE_SCHEMA_INVALID',
+                    severity: 'error',
+                    message: `schema compile failed: ${e.message}`,
+                },
+            ],
+        };
+    }
+    const ok = validate(args.instance);
+    if (ok)
+        return { valid: true, diagnostics: [] };
+    const errs = validate.errors ?? [];
+    return {
+        valid: false,
+        diagnostics: errs.map(ajvErrorToDiagnostic),
+    };
+}
+/** Build a fresh AJV instance with the frozen config (for schema-compile-only callers). */
+function createFrozenAjv() {
+    return new _2020_1.default(exports.FROZEN_AJV_CONFIG);
+}
+//# sourceMappingURL=code-schema-loader.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/schema/code-schema-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-schema-loader.js","sourceRoot":"","sources":["../../src/schema/code-schema-loader.ts"],"names":[],"mappings":";;;;;;AAuIA,4DAeC;AAQD,4DA6CC;AAGD,0CAEC;AAhND;;;;;;;;;GASG;AACH,0DAAgF;AAGhF,sDAAsD;AACzC,QAAA,iBAAiB,GAAG;IAC/B,MAAM,EAAE,IAAI;IACZ,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,gBAAgB,EAAE,KAAK;IACvB,eAAe,EAAE,KAAK;IACtB,aAAa,EAAE,IAAI;IACnB,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,KAAK;CACJ,CAAC;AAEX,8CAA8C;AACjC,QAAA,aAAa,GAAG;IAC3B,kBAAkB,EAAE,GAAG,GAAG,IAAI;IAC9B,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,GAAG;IACvB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,GAAG;CACb,CAAC;AAEX,MAAM,qBAAsB,SAAQ,KAAK;IACvC,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,0EAA0E;AAC1E,SAAS,oBAAoB,CAAC,GAAgB;IAC5C,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,GAAG,CAAC,YAAY,IAAI,GAAG;QACjC,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,0BAA0B;KACnD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,MAAuB,EAAE,KAAK,GAAG,CAAC;IAC3D,IAAI,KAAK,GAAG,qBAAa,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,EACrB,wBAAwB,qBAAa,CAAC,gBAAgB,EAAE,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO;IAE1D,oEAAoE;IACpE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,EACrB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,EAAE,0BAA0B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,IAAI,mBAAmB,IAAI,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,uBAAuB,IAAI,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,YAAY,IAAI,MAAM,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;QACxD,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,EAAE,kCAAkC,CAAC,CAAC;IACnG,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,qBAAa,CAAC,aAAa,EAAE,CAAC;QACnF,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,EACrB,YAAY,MAAM,CAAC,IAAI,CAAC,MAAM,oBAAoB,qBAAa,CAAC,aAAa,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,qBAAa,CAAC,gBAAgB,EAAE,CAAC;QACjG,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,EACrB,kBAAkB,MAAM,CAAC,OAAO,CAAC,MAAM,YAAY,qBAAa,CAAC,gBAAgB,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACxD,IAAI,SAAS,GAAG,qBAAa,CAAC,kBAAkB,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,EACrB,cAAc,SAAS,wBAAwB,qBAAa,CAAC,kBAAkB,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,iBAAiB,CAAC,KAAwB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK;gBAAE,iBAAiB,CAAC,KAAwB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,MAAM,CAAC,KAAwB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,iBAAiB,CAAC,KAAwB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;AACH,CAAC;AAOD,sEAAsE;AACtE,SAAgB,wBAAwB,CAAC,MAAuB;IAC9D,IAAI,CAAC;QACH,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,eAAO,CAAC,yBAAiB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,CAAC;oBACZ,IAAI,EAAE,CAAC,YAAY,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB;oBACzE,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;iBAClE,CAAC;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,IAGxC;IACC,8DAA8D;IAC9D,IAAI,CAAC;QACH,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE;gBACX;oBACE,IAAI,EAAG,CAA2B,CAAC,IAAI;oBACvC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAG,CAAW,CAAC,OAAO;iBAC9B;aACF;SACF,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,MAAM,GAAG,GAAG,IAAI,eAAO,CAAC,yBAAiB,CAAC,CAAC;IAC3C,IAAI,QAAwE,CAAC;IAC7E,IAAI,CAAC;QACH,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAmE,CAAC;IACxG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE;gBACX;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,0BAA2B,CAAW,CAAC,OAAO,EAAE;iBAC1D;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAChD,MAAM,IAAI,GAAI,QAA8C,CAAC,MAAM,IAAI,EAAE,CAAC;IAC1E,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAgB,eAAe;IAC7B,OAAO,IAAI,eAAO,CAAC,yBAAiB,CAAC,CAAC;AACxC,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@nexusclaw/code-authoring",
+  "version": "0.1.0",
+  "main": "dist/index.js",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./canonical-zip": {
+      "types": "./dist/package/canonical-zip.d.ts",
+      "default": "./dist/package/canonical-zip.js"
+    },
+    "./local-runner-lock.json": "./src/runtime/local-runner.lock.json"
+  }
+}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/src/runtime/local-runner.lock.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": "nexusclaw.local-runner-lock/v1",
+  "imageRef": "localhost:5000/nexusclaw/local-test-runner",
+  "manifestDigest": "sha256:8ac884873c3f92eac3e52f35904b3c3cc0a8cabf99a6614e977ecf6fb83eb501",
+  "sbomDigest": "sha256:0393bb6862664636e9ea2a09883efe969e554015dd13d063aa48e758b00057cf",
+  "runnerContractVersion": "nexusclaw.local-sandbox-result/v1"
+}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-avatars/presets.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Canonical list of AI-employee avatar presets. The `key` matches an agent's
+ * `avatarPresetKey` column and a `/ai-employee-avatars/<key>.png` static asset
+ * shipped by every app that renders agent avatars (frontend, mobile-h5).
+ */
+export interface AgentAvatarPresetDefinition {
+    key: string;
+    /** Ant Design icon component name to fall back to when no preset image matches. */
+    fallbackIcon: string;
+}
+export declare const AGENT_AVATAR_PRESET_DEFINITIONS: AgentAvatarPresetDefinition[];
+export declare const getAgentAvatarPreset: (avatarPresetKey?: string | null) => AgentAvatarPresetDefinition | undefined;
+/** Stable default used when a concrete employee has not selected a preset yet. */
+export declare const getDefaultAgentAvatarPreset: (identityKey?: string | null) => AgentAvatarPresetDefinition | undefined;
+export declare const resolveAgentAvatarPreset: (avatarPresetKey?: string | null, identityKey?: string | null) => AgentAvatarPresetDefinition | undefined;
+/** Static asset path for an explicit or stable default avatar preset. */
+export declare const getAgentAvatarSrc: (avatarPresetKey?: string | null, identityKey?: string | null) => string | undefined;

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-avatars/presets.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAgentAvatarSrc = exports.resolveAgentAvatarPreset = exports.getDefaultAgentAvatarPreset = exports.getAgentAvatarPreset = exports.AGENT_AVATAR_PRESET_DEFINITIONS = void 0;
+exports.AGENT_AVATAR_PRESET_DEFINITIONS = [
+    { key: 'revenue-strategist', fallbackIcon: 'RobotOutlined' },
+    { key: 'customer-success', fallbackIcon: 'CustomerServiceOutlined' },
+    { key: 'finance-analyst', fallbackIcon: 'FundOutlined' },
+    { key: 'operations-planner', fallbackIcon: 'SolutionOutlined' },
+    { key: 'compliance-guardian', fallbackIcon: 'AuditOutlined' },
+    { key: 'supply-chain-coordinator', fallbackIcon: 'ShoppingOutlined' },
+    { key: 'marketing-growth', fallbackIcon: 'ThunderboltOutlined' },
+    { key: 'data-scientist', fallbackIcon: 'BarChartOutlined' },
+    { key: 'hr-talent-partner', fallbackIcon: 'TeamOutlined' },
+    { key: 'field-service-coordinator', fallbackIcon: 'PhoneOutlined' },
+    { key: 'product-manager', fallbackIcon: 'ExperimentOutlined' },
+    { key: 'project-coordinator', fallbackIcon: 'SolutionOutlined' },
+    { key: 'healthcare-account-advisor', fallbackIcon: 'MedicineBoxOutlined' },
+    { key: 'manufacturing-quality', fallbackIcon: 'AuditOutlined' },
+    { key: 'retail-operations', fallbackIcon: 'ShoppingOutlined' },
+    { key: 'partner-channel-manager', fallbackIcon: 'TeamOutlined' },
+    { key: 'procurement-negotiator', fallbackIcon: 'FundOutlined' },
+    { key: 'legal-contract-reviewer', fallbackIcon: 'AuditOutlined' },
+    { key: 'training-coach', fallbackIcon: 'HeartOutlined' },
+    { key: 'executive-assistant', fallbackIcon: 'UserOutlined' },
+];
+const PRESET_BY_KEY = new Map(exports.AGENT_AVATAR_PRESET_DEFINITIONS.map((preset) => [preset.key, preset]));
+const getAgentAvatarPreset = (avatarPresetKey) => avatarPresetKey ? PRESET_BY_KEY.get(avatarPresetKey) : undefined;
+exports.getAgentAvatarPreset = getAgentAvatarPreset;
+/** Stable default used when a concrete employee has not selected a preset yet. */
+const getDefaultAgentAvatarPreset = (identityKey) => {
+    if (!identityKey)
+        return undefined;
+    // FNV-1a keeps the mapping deterministic across browsers and Node runtimes.
+    let hash = 2166136261;
+    for (let index = 0; index < identityKey.length; index += 1) {
+        hash ^= identityKey.charCodeAt(index);
+        hash = Math.imul(hash, 16777619);
+    }
+    return exports.AGENT_AVATAR_PRESET_DEFINITIONS[(hash >>> 0) % exports.AGENT_AVATAR_PRESET_DEFINITIONS.length];
+};
+exports.getDefaultAgentAvatarPreset = getDefaultAgentAvatarPreset;
+const resolveAgentAvatarPreset = (avatarPresetKey, identityKey) => {
+    // An explicit but unknown key is invalid data and must retain the safe fallback.
+    if (avatarPresetKey)
+        return (0, exports.getAgentAvatarPreset)(avatarPresetKey);
+    return (0, exports.getDefaultAgentAvatarPreset)(identityKey);
+};
+exports.resolveAgentAvatarPreset = resolveAgentAvatarPreset;
+/** Static asset path for an explicit or stable default avatar preset. */
+const getAgentAvatarSrc = (avatarPresetKey, identityKey) => {
+    const preset = (0, exports.resolveAgentAvatarPreset)(avatarPresetKey, identityKey);
+    return preset ? `/ai-employee-avatars/${preset.key}.png` : undefined;
+};
+exports.getAgentAvatarSrc = getAgentAvatarSrc;
+//# sourceMappingURL=presets.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-avatars/presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../src/agent-avatars/presets.ts"],"names":[],"mappings":";;;AAWa,QAAA,+BAA+B,GAAkC;IAC5E,EAAE,GAAG,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE;IAC5D,EAAE,GAAG,EAAE,kBAAkB,EAAE,YAAY,EAAE,yBAAyB,EAAE;IACpE,EAAE,GAAG,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE;IACxD,EAAE,GAAG,EAAE,oBAAoB,EAAE,YAAY,EAAE,kBAAkB,EAAE;IAC/D,EAAE,GAAG,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE;IAC7D,EAAE,GAAG,EAAE,0BAA0B,EAAE,YAAY,EAAE,kBAAkB,EAAE;IACrE,EAAE,GAAG,EAAE,kBAAkB,EAAE,YAAY,EAAE,qBAAqB,EAAE;IAChE,EAAE,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE;IAC3D,EAAE,GAAG,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE;IAC1D,EAAE,GAAG,EAAE,2BAA2B,EAAE,YAAY,EAAE,eAAe,EAAE;IACnE,EAAE,GAAG,EAAE,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,EAAE;IAC9D,EAAE,GAAG,EAAE,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,EAAE;IAChE,EAAE,GAAG,EAAE,4BAA4B,EAAE,YAAY,EAAE,qBAAqB,EAAE;IAC1E,EAAE,GAAG,EAAE,uBAAuB,EAAE,YAAY,EAAE,eAAe,EAAE;IAC/D,EAAE,GAAG,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE;IAC9D,EAAE,GAAG,EAAE,yBAAyB,EAAE,YAAY,EAAE,cAAc,EAAE;IAChE,EAAE,GAAG,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,EAAE;IAC/D,EAAE,GAAG,EAAE,yBAAyB,EAAE,YAAY,EAAE,eAAe,EAAE;IACjE,EAAE,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE;IACxD,EAAE,GAAG,EAAE,qBAAqB,EAAE,YAAY,EAAE,cAAc,EAAE;CAC7D,CAAC;AAEF,MAAM,aAAa,GAA6C,IAAI,GAAG,CACrE,uCAA+B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CACtE,CAAC;AAEK,MAAM,oBAAoB,GAAG,CAClC,eAA+B,EACU,EAAE,CAC3C,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAHtD,QAAA,oBAAoB,wBAGkC;AAEnE,kFAAkF;AAC3E,MAAM,2BAA2B,GAAG,CACzC,WAA2B,EACc,EAAE;IAC3C,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAEnC,4EAA4E;IAC5E,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,uCAA+B,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,uCAA+B,CAAC,MAAM,CAAC,CAAC;AAChG,CAAC,CAAC;AAbW,QAAA,2BAA2B,+BAatC;AAEK,MAAM,wBAAwB,GAAG,CACtC,eAA+B,EAC/B,WAA2B,EACc,EAAE;IAC3C,iFAAiF;IACjF,IAAI,eAAe;QAAE,OAAO,IAAA,4BAAoB,EAAC,eAAe,CAAC,CAAC;IAClE,OAAO,IAAA,mCAA2B,EAAC,WAAW,CAAC,CAAC;AAClD,CAAC,CAAC;AAPW,QAAA,wBAAwB,4BAOnC;AAEF,yEAAyE;AAClE,MAAM,iBAAiB,GAAG,CAC/B,eAA+B,EAC/B,WAA2B,EACP,EAAE;IACtB,MAAM,MAAM,GAAG,IAAA,gCAAwB,EAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC,CAAC;AANW,QAAA,iBAAiB,qBAM5B"}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/ai-authoring-context-signing.d.ts

@@ -0,0 +1,35 @@
+import type { AiContextSignaturePayloadV1, AiContextSigningKeySetV1 } from './ai-authoring-context.types';
+export type AiContextSigningErrorCode = 'AI_CONTEXT_SIGNATURE_INVALID' | 'AI_CONTEXT_SIGNING_KEY_UNKNOWN';
+export declare class AiContextSigningError extends Error {
+    readonly code: AiContextSigningErrorCode;
+    constructor(code: AiContextSigningErrorCode);
+}
+export interface AiContextDetachedSigningInput {
+    readonly protectedHeader: string;
+    readonly signingInput: Uint8Array;
+}
+export interface VerifyAiContextDetachedJwsInput {
+    readonly detachedJws: string;
+    readonly expectedKeyId: string;
+    readonly payload: AiContextSignaturePayloadV1;
+    readonly keySet: AiContextSigningKeySetV1;
+    readonly expectedIssuer?: string;
+    readonly now?: Date;
+}
+/** Runtime validation for the authenticated public JWK-set response. */
+export declare function assertAiContextSigningKeySet(value: unknown): asserts value is AiContextSigningKeySetV1;
+/**
+ * Build the exact RFC 8785 payload signing input. The returned JWS protected
+ * segment is combined with a deliberately omitted compact payload by callers:
+ * `<protected>..<signature>`.
+ */
+export declare function buildAiContextDetachedSigningInput(payload: AiContextSignaturePayloadV1, keyId: string): AiContextDetachedSigningInput;
+/**
+ * Verify an Ed25519 detached compact JWS using only the authenticated public
+ * key set. Embedded/untrusted keys and non-canonical/extra header fields are
+ * never accepted.
+ */
+export declare function verifyAiContextDetachedJws(input: VerifyAiContextDetachedJwsInput): {
+    readonly issuer: string;
+    readonly keyId: string;
+};