@openhands/agent-canvas 1.15.0 → 1.17.0

package/dist/manifests/manifest-local-validation.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-local-validation.cjs","names":[],"sources":["../../src/manifests/manifest-local-validation.ts"],"sourcesContent":["/**\n * The form model, and the host's own check of what the user typed into it.\n *\n * Local validation is a convenience, not the authority: it is instant and needs\n * no round trip, so it catches empty required fields and obvious typos.\n * Deployment-specific questions (\"is a one-minute schedule allowed here?\")\n * belong to preflight, which is authoritative.\n *\n * Errors are returned as codes rather than sentences so the host can render\n * them through its own translations; only manifest-authored copy is literal.\n */\n\nimport type {\n  DeploymentCapabilities,\n  SetupActionKind,\n  SetupBlock,\n  SetupFieldOption,\n  SetupFormField,\n  SetupFormFields,\n  SetupFormValue,\n  SetupFormValues,\n} from \"./types\";\n\n/** Characters that would break out of an expression string literal. */\nconst UNSAFE_EXPRESSION_LITERAL_PATTERN = /[\"'\\\\]/;\n\nexport type SetupFieldError =\n  | { code: \"required\" }\n  | { code: \"minLength\"; length: number }\n  | { code: \"maxLength\"; length: number }\n  | { code: \"min\"; value: number }\n  | { code: \"max\"; value: number }\n  | { code: \"invalidOption\" }\n  | { code: \"unsafeExpressionLiteral\" };\n\nexport type SetupFieldErrors = Record<string, SetupFieldError>;\n\n/** Field constraints supplied by the deployment rather than by the manifest. */\nexport interface SetupFieldOverride {\n  options?: SetupFieldOption[];\n}\n\nexport function triggerKinds(setup: SetupBlock): string[] {\n  return Object.keys(setup.form.triggers ?? {});\n}\n\nexport function initialTriggerKind(setup: SetupBlock): string | null {\n  return triggerKinds(setup)[0] ?? null;\n}\n\nexport function actionKinds(setup: SetupBlock): SetupActionKind[] {\n  return Object.keys(setup.actions ?? {}) as SetupActionKind[];\n}\n\nexport function initialActionKind(setup: SetupBlock): SetupActionKind | null {\n  return actionKinds(setup)[0] ?? null;\n}\n\nexport type SetupFieldOverrides = Record<string, SetupFieldOverride>;\n\n/**\n * Every input the form declares, keyed by name, whichever half it is in.\n *\n * Trigger inputs come first so the user is asked when it runs before what it\n * runs on, and so every derived view of the form keeps that order. Admission\n * rejects a name declared in both halves, so the merge cannot lose a field.\n */\nexport function collectFields(\n  setup: SetupBlock,\n  selectedTrigger?: string | null,\n  selectedAction?: string | null,\n): SetupFormFields {\n  const triggers = setup.form.triggers ?? {};\n  const triggerEntries = Object.entries(triggers);\n  const activeTrigger =\n    selectedTrigger && selectedTrigger in triggers\n      ? triggers[selectedTrigger as keyof typeof triggers]\n      : triggerEntries.length === 1\n        ? triggerEntries[0][1]\n        : {};\n  const actions = setup.actions ?? {};\n  const actionEntries = Object.entries(actions);\n  const activeAction =\n    selectedAction && selectedAction in actions\n      ? actions[selectedAction as SetupActionKind]?.args\n      : actionEntries.length === 1\n        ? actionEntries[0][1]?.args\n        : {};\n  return Object.assign(\n    {},\n    activeTrigger,\n    setup.form.args,\n    activeAction,\n  ) as SetupFormFields;\n}\n\n/**\n * Feed deployment values into form field constraints, so the form offers only\n * what the deployment accepts.\n *\n * A `timezone` field is the case that needs it: a manifest declares no options\n * for one, because the accepted zones belong to the deployment. The cron\n * interval floor is deliberately left to preflight — the deployment owns that\n * limit and states it in its own words, and a local approximation would\n * pre-empt the authoritative message with a worse one.\n */\nexport function resolveFieldOverrides(\n  setup: SetupBlock,\n  capabilities: DeploymentCapabilities | null,\n  selectedTrigger?: string | null,\n  selectedAction?: string | null,\n): SetupFieldOverrides {\n  const overrides: SetupFieldOverrides = {};\n  const fields = collectFields(setup, selectedTrigger, selectedAction);\n  const timezones = capabilities?.triggers?.cron?.timezones;\n  if (timezones?.length) {\n    const options = timezones.map((zone) => ({ value: zone, label: zone }));\n    Object.entries(fields)\n      .filter(([, field]) => field.type === \"timezone\")\n      .forEach(([name]) => {\n        overrides[name] = { options };\n      });\n  }\n\n  if (capabilities?.eventSources?.length) {\n    const options = capabilities.eventSources.map((source) => ({\n      value: source,\n      label: source,\n    }));\n    Object.entries(fields)\n      .filter(([, field]) => field.type === \"event-source\")\n      .forEach(([name]) => {\n        overrides[name] = { options };\n      });\n  }\n\n  if (capabilities?.eventTypes?.length) {\n    const options = capabilities.eventTypes.map((type) => ({\n      value: type,\n      label: type,\n    }));\n    Object.entries(fields)\n      .filter(([, field]) => field.type === \"event-type\")\n      .forEach(([name]) => {\n        overrides[name] = { options };\n      });\n  }\n\n  return overrides;\n}\n\n/** The options a field offers, after deployment constraints are applied. */\nexport function getFieldOptions(\n  name: string,\n  field: SetupFormField,\n  overrides: SetupFieldOverrides = {},\n): SetupFieldOption[] {\n  return overrides[name]?.options ?? field.options ?? [];\n}\n\n/**\n * Every value a field holds, whether it collects one or many.\n *\n * Reading both shapes as a list is what keeps validation, interpolation and\n * the payload mapping from branching on `multiple` at every use.\n */\nfunction isFileValue(value: SetupFormValue | undefined): value is File {\n  return typeof File !== \"undefined\" && value instanceof File;\n}\n\nexport function fieldValues(value: SetupFormValue | undefined): string[] {\n  if (Array.isArray(value)) return value.filter((item) => item.trim() !== \"\");\n  if (isFileValue(value)) return value.name ? [value.name] : [];\n  if (typeof value === \"string\" && value.trim() === \"\") return [];\n  if (value === undefined || value === null) return [];\n  return [String(value)];\n}\n\n/** The single value a field holds, or \"\" for a field collecting several. */\nexport function fieldText(value: SetupFormValue | undefined): string {\n  if (Array.isArray(value) || value === undefined || value === null) return \"\";\n  if (isFileValue(value)) return value.name;\n  return String(value);\n}\n\n/** Initial form state: every declared field, seeded with its declared default. */\nexport function getInitialFormValues(\n  setup: SetupBlock,\n  selectedTrigger?: string | null,\n  selectedAction?: string | null,\n): SetupFormValues {\n  return Object.fromEntries(\n    Object.entries(collectFields(setup, selectedTrigger, selectedAction)).map(\n      ([name, field]) => [\n        name,\n        // A field collecting several values starts empty rather than holding one\n        // blank entry, so \"required\" means \"add one\" rather than \"fill this in\".\n        field.multiple ? [] : (field.default ?? \"\"),\n      ],\n    ),\n  );\n}\n\nfunction validateField(\n  name: string,\n  field: SetupFormField,\n  rawValue: SetupFormValue | undefined,\n  overrides: SetupFieldOverrides,\n): SetupFieldError | null {\n  const entered = fieldValues(rawValue);\n\n  if (entered.length === 0) {\n    return field.required ? { code: \"required\" } : null;\n  }\n\n  // Every entry of a multi-value field answers the same field, so each is held\n  // to the same rules and the first failure is the one reported.\n  const failures = entered\n    .map((item) => validateValue(name, field, item.trim(), overrides))\n    .filter((error): error is SetupFieldError => error !== null);\n  return failures[0] ?? null;\n}\n\nfunction validateValue(\n  name: string,\n  field: SetupFormField,\n  value: string,\n  overrides: SetupFieldOverrides,\n): SetupFieldError | null {\n  const { minLength, maxLength, min, max, format } = field.constraints ?? {};\n  if (minLength !== undefined && value.length < minLength) {\n    return { code: \"minLength\", length: minLength };\n  }\n  if (maxLength !== undefined && value.length > maxLength) {\n    return { code: \"maxLength\", length: maxLength };\n  }\n  if (field.type === \"number\") {\n    const numeric = Number(value);\n    if (Number.isNaN(numeric)) return { code: \"invalidOption\" };\n    if (min !== undefined && numeric < min) return { code: \"min\", value: min };\n    if (max !== undefined && numeric > max) return { code: \"max\", value: max };\n  }\n  if (\n    format === \"safeExpressionLiteral\" &&\n    UNSAFE_EXPRESSION_LITERAL_PATTERN.test(value)\n  ) {\n    return { code: \"unsafeExpressionLiteral\" };\n  }\n\n  // Any field offering a closed set of values, whether the manifest declared it\n  // or the deployment supplied it, must be answered from that set.\n  const options = getFieldOptions(name, field, overrides);\n  if (options.length > 0 && !options.some((option) => option.value === value)) {\n    return { code: \"invalidOption\" };\n  }\n\n  return null;\n}\n\n/** Check every declared field. Returns only the fields that failed. */\nexport function validateFormValues(\n  setup: SetupBlock,\n  values: SetupFormValues,\n  overrides: SetupFieldOverrides = {},\n  selectedTrigger?: string | null,\n  selectedAction?: string | null,\n): SetupFieldErrors {\n  return Object.entries(\n    collectFields(setup, selectedTrigger, selectedAction),\n  ).reduce<SetupFieldErrors>((errors, [name, field]) => {\n    const error = validateField(name, field, values[name], overrides);\n    return error ? { ...errors, [name]: error } : errors;\n  }, {});\n}\n"],"mappings":"6CAkDA,SAAgB,EAAY,EAAsC,CAChE,OAAO,OAAO,KAAK,EAAM,SAAW,CAAC,CAAC,CACxC"}

package/dist/manifests/manifest-local-validation.d.ts

@@ -9,7 +9,7 @@
  * Errors are returned as codes rather than sentences so the host can render
  * them through its own translations; only manifest-authored copy is literal.
  */
-import type { DeploymentCapabilities, SetupBlock, SetupFieldOption, SetupFormField, SetupFormFields, SetupFormValue, SetupFormValues } from "./types";
+import type { DeploymentCapabilities, SetupActionKind, SetupBlock, SetupFieldOption, SetupFormField, SetupFormFields, SetupFormValue, SetupFormValues } from "./types";
 export type SetupFieldError = {
     code: "required";
 } | {
@@ -18,6 +18,12 @@ export type SetupFieldError = {
 } | {
     code: "maxLength";
     length: number;
+} | {
+    code: "min";
+    value: number;
+} | {
+    code: "max";
+    value: number;
 } | {
     code: "invalidOption";
 } | {
@@ -28,6 +34,10 @@ export type SetupFieldErrors = Record<string, SetupFieldError>;
 export interface SetupFieldOverride {
     options?: SetupFieldOption[];
 }
+export declare function triggerKinds(setup: SetupBlock): string[];
+export declare function initialTriggerKind(setup: SetupBlock): string | null;
+export declare function actionKinds(setup: SetupBlock): SetupActionKind[];
+export declare function initialActionKind(setup: SetupBlock): SetupActionKind | null;
 export type SetupFieldOverrides = Record<string, SetupFieldOverride>;
 /**
  * Every input the form declares, keyed by name, whichever half it is in.
@@ -36,7 +46,7 @@ export type SetupFieldOverrides = Record<string, SetupFieldOverride>;
  * runs on, and so every derived view of the form keeps that order. Admission
  * rejects a name declared in both halves, so the merge cannot lose a field.
  */
-export declare function collectFields(setup: SetupBlock): SetupFormFields;
+export declare function collectFields(setup: SetupBlock, selectedTrigger?: string | null, selectedAction?: string | null): SetupFormFields;
 /**
  * Feed deployment values into form field constraints, so the form offers only
  * what the deployment accepts.
@@ -47,19 +57,13 @@ export declare function collectFields(setup: SetupBlock): SetupFormFields;
  * limit and states it in its own words, and a local approximation would
  * pre-empt the authoritative message with a worse one.
  */
-export declare function resolveFieldOverrides(setup: SetupBlock, capabilities: DeploymentCapabilities | null): SetupFieldOverrides;
+export declare function resolveFieldOverrides(setup: SetupBlock, capabilities: DeploymentCapabilities | null, selectedTrigger?: string | null, selectedAction?: string | null): SetupFieldOverrides;
 /** The options a field offers, after deployment constraints are applied. */
 export declare function getFieldOptions(name: string, field: SetupFormField, overrides?: SetupFieldOverrides): SetupFieldOption[];
-/**
- * Every value a field holds, whether it collects one or many.
- *
- * Reading both shapes as a list is what keeps validation, interpolation and
- * the payload mapping from branching on `multiple` at every use.
- */
 export declare function fieldValues(value: SetupFormValue | undefined): string[];
 /** The single value a field holds, or "" for a field collecting several. */
 export declare function fieldText(value: SetupFormValue | undefined): string;
 /** Initial form state: every declared field, seeded with its declared default. */
-export declare function getInitialFormValues(setup: SetupBlock): SetupFormValues;
+export declare function getInitialFormValues(setup: SetupBlock, selectedTrigger?: string | null, selectedAction?: string | null): SetupFormValues;
 /** Check every declared field. Returns only the fields that failed. */
-export declare function validateFormValues(setup: SetupBlock, values: SetupFormValues, overrides?: SetupFieldOverrides): SetupFieldErrors;
+export declare function validateFormValues(setup: SetupBlock, values: SetupFormValues, overrides?: SetupFieldOverrides, selectedTrigger?: string | null, selectedAction?: string | null): SetupFieldErrors;

package/dist/manifests/manifest-local-validation.js

@@ -0,0 +1,8 @@
+//#region src/manifests/manifest-local-validation.ts
+function e(e) {
+	return Object.keys(e.actions ?? {});
+}
+//#endregion
+export { e as actionKinds };
+
+//# sourceMappingURL=manifest-local-validation.js.map

package/dist/manifests/manifest-local-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-local-validation.js","names":[],"sources":["../../src/manifests/manifest-local-validation.ts"],"sourcesContent":["/**\n * The form model, and the host's own check of what the user typed into it.\n *\n * Local validation is a convenience, not the authority: it is instant and needs\n * no round trip, so it catches empty required fields and obvious typos.\n * Deployment-specific questions (\"is a one-minute schedule allowed here?\")\n * belong to preflight, which is authoritative.\n *\n * Errors are returned as codes rather than sentences so the host can render\n * them through its own translations; only manifest-authored copy is literal.\n */\n\nimport type {\n  DeploymentCapabilities,\n  SetupActionKind,\n  SetupBlock,\n  SetupFieldOption,\n  SetupFormField,\n  SetupFormFields,\n  SetupFormValue,\n  SetupFormValues,\n} from \"./types\";\n\n/** Characters that would break out of an expression string literal. */\nconst UNSAFE_EXPRESSION_LITERAL_PATTERN = /[\"'\\\\]/;\n\nexport type SetupFieldError =\n  | { code: \"required\" }\n  | { code: \"minLength\"; length: number }\n  | { code: \"maxLength\"; length: number }\n  | { code: \"min\"; value: number }\n  | { code: \"max\"; value: number }\n  | { code: \"invalidOption\" }\n  | { code: \"unsafeExpressionLiteral\" };\n\nexport type SetupFieldErrors = Record<string, SetupFieldError>;\n\n/** Field constraints supplied by the deployment rather than by the manifest. */\nexport interface SetupFieldOverride {\n  options?: SetupFieldOption[];\n}\n\nexport function triggerKinds(setup: SetupBlock): string[] {\n  return Object.keys(setup.form.triggers ?? {});\n}\n\nexport function initialTriggerKind(setup: SetupBlock): string | null {\n  return triggerKinds(setup)[0] ?? null;\n}\n\nexport function actionKinds(setup: SetupBlock): SetupActionKind[] {\n  return Object.keys(setup.actions ?? {}) as SetupActionKind[];\n}\n\nexport function initialActionKind(setup: SetupBlock): SetupActionKind | null {\n  return actionKinds(setup)[0] ?? null;\n}\n\nexport type SetupFieldOverrides = Record<string, SetupFieldOverride>;\n\n/**\n * Every input the form declares, keyed by name, whichever half it is in.\n *\n * Trigger inputs come first so the user is asked when it runs before what it\n * runs on, and so every derived view of the form keeps that order. Admission\n * rejects a name declared in both halves, so the merge cannot lose a field.\n */\nexport function collectFields(\n  setup: SetupBlock,\n  selectedTrigger?: string | null,\n  selectedAction?: string | null,\n): SetupFormFields {\n  const triggers = setup.form.triggers ?? {};\n  const triggerEntries = Object.entries(triggers);\n  const activeTrigger =\n    selectedTrigger && selectedTrigger in triggers\n      ? triggers[selectedTrigger as keyof typeof triggers]\n      : triggerEntries.length === 1\n        ? triggerEntries[0][1]\n        : {};\n  const actions = setup.actions ?? {};\n  const actionEntries = Object.entries(actions);\n  const activeAction =\n    selectedAction && selectedAction in actions\n      ? actions[selectedAction as SetupActionKind]?.args\n      : actionEntries.length === 1\n        ? actionEntries[0][1]?.args\n        : {};\n  return Object.assign(\n    {},\n    activeTrigger,\n    setup.form.args,\n    activeAction,\n  ) as SetupFormFields;\n}\n\n/**\n * Feed deployment values into form field constraints, so the form offers only\n * what the deployment accepts.\n *\n * A `timezone` field is the case that needs it: a manifest declares no options\n * for one, because the accepted zones belong to the deployment. The cron\n * interval floor is deliberately left to preflight — the deployment owns that\n * limit and states it in its own words, and a local approximation would\n * pre-empt the authoritative message with a worse one.\n */\nexport function resolveFieldOverrides(\n  setup: SetupBlock,\n  capabilities: DeploymentCapabilities | null,\n  selectedTrigger?: string | null,\n  selectedAction?: string | null,\n): SetupFieldOverrides {\n  const overrides: SetupFieldOverrides = {};\n  const fields = collectFields(setup, selectedTrigger, selectedAction);\n  const timezones = capabilities?.triggers?.cron?.timezones;\n  if (timezones?.length) {\n    const options = timezones.map((zone) => ({ value: zone, label: zone }));\n    Object.entries(fields)\n      .filter(([, field]) => field.type === \"timezone\")\n      .forEach(([name]) => {\n        overrides[name] = { options };\n      });\n  }\n\n  if (capabilities?.eventSources?.length) {\n    const options = capabilities.eventSources.map((source) => ({\n      value: source,\n      label: source,\n    }));\n    Object.entries(fields)\n      .filter(([, field]) => field.type === \"event-source\")\n      .forEach(([name]) => {\n        overrides[name] = { options };\n      });\n  }\n\n  if (capabilities?.eventTypes?.length) {\n    const options = capabilities.eventTypes.map((type) => ({\n      value: type,\n      label: type,\n    }));\n    Object.entries(fields)\n      .filter(([, field]) => field.type === \"event-type\")\n      .forEach(([name]) => {\n        overrides[name] = { options };\n      });\n  }\n\n  return overrides;\n}\n\n/** The options a field offers, after deployment constraints are applied. */\nexport function getFieldOptions(\n  name: string,\n  field: SetupFormField,\n  overrides: SetupFieldOverrides = {},\n): SetupFieldOption[] {\n  return overrides[name]?.options ?? field.options ?? [];\n}\n\n/**\n * Every value a field holds, whether it collects one or many.\n *\n * Reading both shapes as a list is what keeps validation, interpolation and\n * the payload mapping from branching on `multiple` at every use.\n */\nfunction isFileValue(value: SetupFormValue | undefined): value is File {\n  return typeof File !== \"undefined\" && value instanceof File;\n}\n\nexport function fieldValues(value: SetupFormValue | undefined): string[] {\n  if (Array.isArray(value)) return value.filter((item) => item.trim() !== \"\");\n  if (isFileValue(value)) return value.name ? [value.name] : [];\n  if (typeof value === \"string\" && value.trim() === \"\") return [];\n  if (value === undefined || value === null) return [];\n  return [String(value)];\n}\n\n/** The single value a field holds, or \"\" for a field collecting several. */\nexport function fieldText(value: SetupFormValue | undefined): string {\n  if (Array.isArray(value) || value === undefined || value === null) return \"\";\n  if (isFileValue(value)) return value.name;\n  return String(value);\n}\n\n/** Initial form state: every declared field, seeded with its declared default. */\nexport function getInitialFormValues(\n  setup: SetupBlock,\n  selectedTrigger?: string | null,\n  selectedAction?: string | null,\n): SetupFormValues {\n  return Object.fromEntries(\n    Object.entries(collectFields(setup, selectedTrigger, selectedAction)).map(\n      ([name, field]) => [\n        name,\n        // A field collecting several values starts empty rather than holding one\n        // blank entry, so \"required\" means \"add one\" rather than \"fill this in\".\n        field.multiple ? [] : (field.default ?? \"\"),\n      ],\n    ),\n  );\n}\n\nfunction validateField(\n  name: string,\n  field: SetupFormField,\n  rawValue: SetupFormValue | undefined,\n  overrides: SetupFieldOverrides,\n): SetupFieldError | null {\n  const entered = fieldValues(rawValue);\n\n  if (entered.length === 0) {\n    return field.required ? { code: \"required\" } : null;\n  }\n\n  // Every entry of a multi-value field answers the same field, so each is held\n  // to the same rules and the first failure is the one reported.\n  const failures = entered\n    .map((item) => validateValue(name, field, item.trim(), overrides))\n    .filter((error): error is SetupFieldError => error !== null);\n  return failures[0] ?? null;\n}\n\nfunction validateValue(\n  name: string,\n  field: SetupFormField,\n  value: string,\n  overrides: SetupFieldOverrides,\n): SetupFieldError | null {\n  const { minLength, maxLength, min, max, format } = field.constraints ?? {};\n  if (minLength !== undefined && value.length < minLength) {\n    return { code: \"minLength\", length: minLength };\n  }\n  if (maxLength !== undefined && value.length > maxLength) {\n    return { code: \"maxLength\", length: maxLength };\n  }\n  if (field.type === \"number\") {\n    const numeric = Number(value);\n    if (Number.isNaN(numeric)) return { code: \"invalidOption\" };\n    if (min !== undefined && numeric < min) return { code: \"min\", value: min };\n    if (max !== undefined && numeric > max) return { code: \"max\", value: max };\n  }\n  if (\n    format === \"safeExpressionLiteral\" &&\n    UNSAFE_EXPRESSION_LITERAL_PATTERN.test(value)\n  ) {\n    return { code: \"unsafeExpressionLiteral\" };\n  }\n\n  // Any field offering a closed set of values, whether the manifest declared it\n  // or the deployment supplied it, must be answered from that set.\n  const options = getFieldOptions(name, field, overrides);\n  if (options.length > 0 && !options.some((option) => option.value === value)) {\n    return { code: \"invalidOption\" };\n  }\n\n  return null;\n}\n\n/** Check every declared field. Returns only the fields that failed. */\nexport function validateFormValues(\n  setup: SetupBlock,\n  values: SetupFormValues,\n  overrides: SetupFieldOverrides = {},\n  selectedTrigger?: string | null,\n  selectedAction?: string | null,\n): SetupFieldErrors {\n  return Object.entries(\n    collectFields(setup, selectedTrigger, selectedAction),\n  ).reduce<SetupFieldErrors>((errors, [name, field]) => {\n    const error = validateField(name, field, values[name], overrides);\n    return error ? { ...errors, [name]: error } : errors;\n  }, {});\n}\n"],"mappings":";AAkDA,SAAgB,EAAY,GAAsC;CAChE,OAAO,OAAO,KAAK,EAAM,WAAW,CAAC,CAAC;AACxC"}

package/dist/manifests/manifest-template.cjs

@@ -0,0 +1,2 @@
+require("../_virtual/_rolldown/runtime.cjs");var e=/\{\{([A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*)\}\}/g;function t(e){return typeof e==`string`?e:typeof e==`number`||typeof e==`boolean`?String(e):Array.isArray(e)?e.map(t).filter(Boolean).join(`, `):``}function n(n,r){return n.replace(e,(e,n)=>t(r[n]))}exports.interpolateValues=n;
+//# sourceMappingURL=manifest-template.cjs.map

package/dist/manifests/manifest-template.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-template.cjs","names":[],"sources":["../../src/manifests/manifest-template.ts"],"sourcesContent":["/**\n * Placeholder interpolation for setup copy and request-body strings.\n *\n * A setup block declares what the user sees and the two request strings the\n * host cannot derive as templates over a small set of namespaces. Interpolation\n * is plain substitution — there is no expression language, so a setup block\n * cannot express behavior here.\n */\n\nimport type { SetupEntry, SetupFormValues, SetupPayloadValue } from \"./types\";\n\nconst PLACEHOLDER_PATTERN = /\\{\\{([A-Za-z0-9_]+(?:\\.[A-Za-z0-9_]+)*)\\}\\}/g;\n\nexport interface SetupScope {\n  form?: SetupFormValues;\n  /** The catalog entry the setup block belongs to. */\n  automation?: SetupEntry;\n}\n\n/** Walk a dotted path through plain objects. */\nexport function getByPath(source: unknown, path: string): unknown {\n  return path.split(\".\").reduce<unknown>((current, segment) => {\n    if (typeof current !== \"object\" || current === null) return undefined;\n    return (current as Record<string, unknown>)[segment];\n  }, source);\n}\n\nfunction toText(value: unknown): string {\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\") {\n    return String(value);\n  }\n  // A multi-value field inside a sentence reads as a list of names.\n  if (Array.isArray(value)) return value.map(toText).filter(Boolean).join(\", \");\n  // Missing values render as blank; callers that care show their own fallback.\n  return \"\";\n}\n\n/** A template that is exactly one placeholder, or null if it is not. */\nfunction wholePlaceholderPath(template: string): string | null {\n  const match = /^\\{\\{([A-Za-z0-9_]+(?:\\.[A-Za-z0-9_]+)*)\\}\\}$/.exec(template);\n  return match ? match[1] : null;\n}\n\nfunction isPlainPayloadValue(value: unknown): value is SetupPayloadValue {\n  if (\n    value === null ||\n    typeof value === \"string\" ||\n    typeof value === \"number\" ||\n    typeof value === \"boolean\"\n  ) {\n    return true;\n  }\n  if (Array.isArray(value)) return value.every(isPlainPayloadValue);\n  if (typeof value !== \"object\") return false;\n  if (Object.getPrototypeOf(value) !== Object.prototype) return false;\n  return Object.values(value).every(isPlainPayloadValue);\n}\n\n/**\n * Substitute placeholders, keeping the resolved value's own type when the\n * template is nothing but that placeholder.\n *\n * This is what lets a request body state `\"repos\": \"{{form.repositories}}\"` and\n * get an array. Inside a sentence the same placeholder still reads as text,\n * because there is nowhere for a list to go in a string.\n *\n * Plain JSON form values are kept whole. A placeholder naming anything else -\n * for example `{{automation.setup}}`, or a browser `File` selected by the user -\n * reads as text like it does inside a sentence, so a manifest cannot state one\n * value and put its own object graph into the request body.\n */\nexport function interpolateValue(\n  template: string,\n  scope: SetupScope,\n): SetupPayloadValue {\n  const path = wholePlaceholderPath(template);\n  if (path === null) return interpolateText(template, scope);\n  const resolved = getByPath(scope, path);\n  return isPlainPayloadValue(resolved) ? resolved : toText(resolved);\n}\n\n/** Substitute placeholders inside a template string. */\nexport function interpolateText(template: string, scope: SetupScope): string {\n  return template.replace(PLACEHOLDER_PATTERN, (_match, path: string) =>\n    toText(getByPath(scope, path)),\n  );\n}\n\n/** Substitute placeholders from a flat name → value record. */\nexport function interpolateValues(\n  template: string,\n  values: Record<string, string | number>,\n): string {\n  return template.replace(PLACEHOLDER_PATTERN, (_match, name: string) =>\n    toText(values[name]),\n  );\n}\n"],"mappings":"6CAWA,IAAM,EAAsB,+CAgB5B,SAAS,EAAO,EAAwB,CAQtC,OAPI,OAAO,GAAU,SAAiB,EAClC,OAAO,GAAU,UAAY,OAAO,GAAU,UACzC,OAAO,CAAK,EAGjB,MAAM,QAAQ,CAAK,EAAU,EAAM,IAAI,CAAM,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,EAErE,EACT,CAsDA,SAAgB,EACd,EACA,EACQ,CACR,OAAO,EAAS,QAAQ,GAAsB,EAAQ,IACpD,EAAO,EAAO,EAAK,CACrB,CACF"}

package/dist/manifests/manifest-template.d.ts

@@ -6,7 +6,7 @@
  * is plain substitution — there is no expression language, so a setup block
  * cannot express behavior here.
  */
-import type { SetupEntry, SetupFormValues } from "./types";
+import type { SetupEntry, SetupFormValues, SetupPayloadValue } from "./types";
 export interface SetupScope {
     form?: SetupFormValues;
     /** The catalog entry the setup block belongs to. */
@@ -22,12 +22,12 @@ export declare function getByPath(source: unknown, path: string): unknown;
  * get an array. Inside a sentence the same placeholder still reads as text,
  * because there is nowhere for a list to go in a string.
  *
- * Only the shapes a form value has are kept whole. A placeholder naming
- * anything else - `{{automation.setup}}` resolves to the setup block itself -
+ * Plain JSON form values are kept whole. A placeholder naming anything else -
+ * for example `{{automation.setup}}`, or a browser `File` selected by the user -
  * reads as text like it does inside a sentence, so a manifest cannot state one
  * value and put its own object graph into the request body.
  */
-export declare function interpolateValue(template: string, scope: SetupScope): string | string[];
+export declare function interpolateValue(template: string, scope: SetupScope): SetupPayloadValue;
 /** Substitute placeholders inside a template string. */
 export declare function interpolateText(template: string, scope: SetupScope): string;
 /** Substitute placeholders from a flat name → value record. */

package/dist/manifests/manifest-template.js

@@ -0,0 +1,12 @@
+//#region src/manifests/manifest-template.ts
+var e = /\{\{([A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)*)\}\}/g;
+function t(e) {
+	return typeof e == "string" ? e : typeof e == "number" || typeof e == "boolean" ? String(e) : Array.isArray(e) ? e.map(t).filter(Boolean).join(", ") : "";
+}
+function n(n, r) {
+	return n.replace(e, (e, n) => t(r[n]));
+}
+//#endregion
+export { n as interpolateValues };
+
+//# sourceMappingURL=manifest-template.js.map

package/dist/manifests/manifest-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-template.js","names":[],"sources":["../../src/manifests/manifest-template.ts"],"sourcesContent":["/**\n * Placeholder interpolation for setup copy and request-body strings.\n *\n * A setup block declares what the user sees and the two request strings the\n * host cannot derive as templates over a small set of namespaces. Interpolation\n * is plain substitution — there is no expression language, so a setup block\n * cannot express behavior here.\n */\n\nimport type { SetupEntry, SetupFormValues, SetupPayloadValue } from \"./types\";\n\nconst PLACEHOLDER_PATTERN = /\\{\\{([A-Za-z0-9_]+(?:\\.[A-Za-z0-9_]+)*)\\}\\}/g;\n\nexport interface SetupScope {\n  form?: SetupFormValues;\n  /** The catalog entry the setup block belongs to. */\n  automation?: SetupEntry;\n}\n\n/** Walk a dotted path through plain objects. */\nexport function getByPath(source: unknown, path: string): unknown {\n  return path.split(\".\").reduce<unknown>((current, segment) => {\n    if (typeof current !== \"object\" || current === null) return undefined;\n    return (current as Record<string, unknown>)[segment];\n  }, source);\n}\n\nfunction toText(value: unknown): string {\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\") {\n    return String(value);\n  }\n  // A multi-value field inside a sentence reads as a list of names.\n  if (Array.isArray(value)) return value.map(toText).filter(Boolean).join(\", \");\n  // Missing values render as blank; callers that care show their own fallback.\n  return \"\";\n}\n\n/** A template that is exactly one placeholder, or null if it is not. */\nfunction wholePlaceholderPath(template: string): string | null {\n  const match = /^\\{\\{([A-Za-z0-9_]+(?:\\.[A-Za-z0-9_]+)*)\\}\\}$/.exec(template);\n  return match ? match[1] : null;\n}\n\nfunction isPlainPayloadValue(value: unknown): value is SetupPayloadValue {\n  if (\n    value === null ||\n    typeof value === \"string\" ||\n    typeof value === \"number\" ||\n    typeof value === \"boolean\"\n  ) {\n    return true;\n  }\n  if (Array.isArray(value)) return value.every(isPlainPayloadValue);\n  if (typeof value !== \"object\") return false;\n  if (Object.getPrototypeOf(value) !== Object.prototype) return false;\n  return Object.values(value).every(isPlainPayloadValue);\n}\n\n/**\n * Substitute placeholders, keeping the resolved value's own type when the\n * template is nothing but that placeholder.\n *\n * This is what lets a request body state `\"repos\": \"{{form.repositories}}\"` and\n * get an array. Inside a sentence the same placeholder still reads as text,\n * because there is nowhere for a list to go in a string.\n *\n * Plain JSON form values are kept whole. A placeholder naming anything else -\n * for example `{{automation.setup}}`, or a browser `File` selected by the user -\n * reads as text like it does inside a sentence, so a manifest cannot state one\n * value and put its own object graph into the request body.\n */\nexport function interpolateValue(\n  template: string,\n  scope: SetupScope,\n): SetupPayloadValue {\n  const path = wholePlaceholderPath(template);\n  if (path === null) return interpolateText(template, scope);\n  const resolved = getByPath(scope, path);\n  return isPlainPayloadValue(resolved) ? resolved : toText(resolved);\n}\n\n/** Substitute placeholders inside a template string. */\nexport function interpolateText(template: string, scope: SetupScope): string {\n  return template.replace(PLACEHOLDER_PATTERN, (_match, path: string) =>\n    toText(getByPath(scope, path)),\n  );\n}\n\n/** Substitute placeholders from a flat name → value record. */\nexport function interpolateValues(\n  template: string,\n  values: Record<string, string | number>,\n): string {\n  return template.replace(PLACEHOLDER_PATTERN, (_match, name: string) =>\n    toText(values[name]),\n  );\n}\n"],"mappings":";AAWA,IAAM,IAAsB;AAgB5B,SAAS,EAAO,GAAwB;CAQtC,OAPI,OAAO,KAAU,WAAiB,IAClC,OAAO,KAAU,YAAY,OAAO,KAAU,YACzC,OAAO,CAAK,IAGjB,MAAM,QAAQ,CAAK,IAAU,EAAM,IAAI,CAAM,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,IAErE;AACT;AAsDA,SAAgB,EACd,GACA,GACQ;CACR,OAAO,EAAS,QAAQ,IAAsB,GAAQ,MACpD,EAAO,EAAO,EAAK,CACrB;AACF"}

package/dist/manifests/manifest-validation.cjs

@@ -1,2 +1,2 @@
-require("../_virtual/_rolldown/runtime.cjs");const e=require("./types.cjs");var t=/^[a-z0-9]+(-[a-z0-9]+)*$/,n=/^[a-z][A-Za-z0-9]*$/,r=/<[A-Za-z/!]/,i=/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/,a=/^[A-Za-z0-9 ._/-]+$/,o=/^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/,s=/^(skills|automations)\/[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/,c=RegExp(`\\{\\{(?!(?:${e.SETUP_PLACEHOLDER_NAMESPACES.join(`|`)})\\.[A-Za-z0-9_.]+\\}\\})`),l=[`direct`,`assisted`],u=[`text`,`textarea`,`select`,`cron`,`timezone`,`repo-picker`],d=[`github`,`gitlab`,`bitbucket`],f=[`cron`,`event`],p=[`safeExpressionLiteral`],m=2e3;function h(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function g(e,t){return typeof e==`string`&&t.includes(e)}function _(e,t){return typeof e==`number`&&Number.isInteger(e)&&e>=t}var v=class{errors=[];fail(e,t){return this.errors.push(`${e}: ${t}`),!1}copy(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):r.test(e)?this.fail(t,`must not contain markup`):!0}placeholders(e,t){return c.test(e)?this.fail(t,`uses an unknown placeholder namespace`):!0}templateCopy(e,t){return this.copy(e,t)&&this.placeholders(e,t)}templateValue(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):this.placeholders(e,t)}absent(e,t,n,r){return t in e?this.fail(`${n}.${t}`,r):!0}};function y(e,t){return typeof e==`string`&&t.test(e)&&!e.split(`/`).some(e=>e===`.`||e===`..`)}function b(e){if(typeof e!=`string`||!a.test(e))return!1;let t=e.split(` `).filter(e=>e.length>0);return t.length>0&&t.every(e=>!e.startsWith(`/`)&&!e.split(`/`).some(e=>e===`..`))}function x(e,t){if(!h(t)){e.fail(`requires`,`must be an object`);return}let{integrations:n,features:r}=t;h(n)?Object.entries(n).forEach(([t,n])=>{let r=`requires.integrations.${t}`;if(!h(n)){e.fail(r,`must be an object`);return}e.copy(n.message,`${r}.message`),`required`in n&&n.required!==!1&&e.fail(`${r}.required`,`may only be false`);let i=[`message`,`required`];Object.keys(n).filter(e=>!i.includes(e)).forEach(t=>e.fail(`${r}.${t}`,`is not allowed`))}):e.fail(`requires.integrations`,`must be an object`),r!==void 0&&(!Array.isArray(r)||r.length===0?e.fail(`requires.features`,`must be a non-empty array`):r.forEach((t,n)=>{(typeof t!=`string`||t.length===0)&&e.fail(`requires.features[${n}]`,`must be a non-empty string`)}))}function S(e,t,n){if(!h(t)||Object.keys(t).length===0){e.fail(n,`must be a non-empty object`);return}let{minLength:r,maxLength:i,format:a}=t;r!==void 0&&!_(r,0)&&e.fail(`${n}.minLength`,`must be a non-negative integer`),i!==void 0&&!_(i,1)&&e.fail(`${n}.maxLength`,`must be a positive integer`),a!==void 0&&!g(a,p)&&e.fail(`${n}.format`,`is not a supported format`)}function C(e,t,n){if(!h(t)){e.fail(n,`must be an object`);return}let{type:r,label:i,help:a,placeholder:o,required:s,provider:c,options:l}=t;g(r,u)||e.fail(`${n}.type`,`is not a supported field type`),e.copy(i,`${n}.label`),e.copy(a,`${n}.help`),o!==void 0&&e.copy(o,`${n}.placeholder`),t.default!==void 0&&typeof t.default!=`string`&&e.fail(`${n}.default`,`must be a string`),typeof s!=`boolean`&&e.fail(`${n}.required`,`must be a boolean`),c!==void 0&&!g(c,d)&&e.fail(`${n}.provider`,`is not a supported provider`),r===`repo-picker`&&c===void 0&&e.fail(`${n}.provider`,`is required for a repository field`),t.multiple!==void 0&&(t.multiple!==!0||r!==`repo-picker`)&&e.fail(`${n}.multiple`,`may only be true, and only on a repository field`),l!==void 0&&(r===`select`?!Array.isArray(l)||l.length===0?e.fail(`${n}.options`,`must be a non-empty array`):l.forEach((t,r)=>{let i=`${n}.options[${r}]`;if(!h(t)){e.fail(i,`must be an object`);return}(typeof t.value!=`string`||t.value.length===0)&&e.fail(`${i}.value`,`must be a non-empty string`),e.copy(t.label,`${i}.label`)}):e.fail(`${n}.options`,`is only allowed on a select field`)),t.constraints!==void 0&&S(e,t.constraints,`${n}.constraints`)}function w(e,t,r){return!h(t)||Object.keys(t).length===0?(e.fail(r,`must be a non-empty object`),[]):Object.entries(t).map(([t,i])=>(n.test(t)||e.fail(`${r}.${t}`,`is not a valid field name`),C(e,i,`${r}.${t}`),t))}function T(e,t){if(!h(t))return e.fail(`setup.form`,`must be an object`),[];t.note!==void 0&&e.copy(t.note,`setup.form.note`);let n=w(e,t.args,`setup.form.args`),r=[];t.triggers!==void 0&&(!h(t.triggers)||Object.keys(t.triggers).length===0?e.fail(`setup.form.triggers`,`must be a non-empty object`):Object.entries(t.triggers).forEach(([t,i])=>{if(!g(t,f)){e.fail(`setup.form.triggers.${t}`,`is not a trigger kind`);return}r.push(t),n.push(...w(e,i,`setup.form.triggers.${t}`))}));let i=n.filter((e,t)=>n.indexOf(e)!==t);return Array.from(new Set(i)).forEach(t=>e.fail(`setup.form.${t}`,`is declared more than once`)),r}function E(e){return h(e)?[e.args,...Object.values(h(e.triggers)?e.triggers:{})].some(e=>h(e)&&Object.values(e).some(e=>h(e)&&e.type===`repo-picker`)):!1}function D(e,t){e.templateCopy(t,`setup.message`)&&t.length>m&&e.fail(`setup.message`,`must be at most ${m} characters`)}function O(e,t){if(!h(t)){e.fail(`setup.bundle`,`must be an object`);return}(typeof t.version!=`string`||!i.test(t.version))&&e.fail(`setup.bundle.version`,`must be a semantic version`),b(t.entrypoint)||e.fail(`setup.bundle.entrypoint`,`must be a plain command that stays inside the archive`),t.setupScript!==void 0&&!y(t.setupScript,o)&&e.fail(`setup.bundle.setupScript`,`must be a relative path`),t.timeout!==void 0&&!_(t.timeout,1)&&e.fail(`setup.bundle.timeout`,`must be a positive integer`),!h(t.files)||Object.keys(t.files).length===0?e.fail(`setup.bundle.files`,`must be a non-empty object`):(Object.entries(t.files).forEach(([t,n])=>{y(t,o)||e.fail(`setup.bundle.files.${t}`,`is not a packed path`),t===`config.json`&&e.fail(`setup.bundle.files.${t}`,`is the name the rendered config is packed under`),y(n,s)||e.fail(`setup.bundle.files.${t}`,`must name a file under skills/ or automations/`)}),typeof t.setupScript==`string`&&!(t.setupScript in t.files)&&e.fail(`setup.bundle.setupScript`,`must name a packed file`)),!h(t.config)||Object.keys(t.config).length===0?e.fail(`setup.bundle.config`,`must be a non-empty object`):k(e,t.config,`setup.bundle.config`)}function k(e,t,n){if(typeof t==`string`){e.templateValue(t,n);return}if(Array.isArray(t)){t.forEach((t,r)=>k(e,t,`${n}[${r}]`));return}if(h(t)){Object.entries(t).forEach(([t,r])=>k(e,r,`${n}.${t}`));return}t!==null&&typeof t!=`number`&&typeof t!=`boolean`&&e.fail(n,`must be a string, number, boolean, null, array or object`)}function A(e,t,n){if(!g(t.mode,l)){e.fail(`setup.mode`,`is not a supported mode`);return}if(t.mode===`direct`){let r=t.prompt!==void 0,i=t.bundle!==void 0;r===i?e.fail(`setup`,`must declare exactly one of prompt or bundle for direct setup`):i?O(e,t.bundle):e.templateValue(t.prompt,`setup.prompt`),t.message!==void 0&&D(e,t.message),n.length!==1&&e.fail(`setup.form.triggers`,`must declare exactly one trigger kind`),n.includes(`event`)&&!E(t.form)&&e.fail(`setup.form`,`must declare a repository field for an event trigger`),t.filter!==void 0&&(n.includes(`event`)?e.templateValue(t.filter,`setup.filter`):e.fail(`setup.filter`,`is only allowed for an event trigger`));return}D(e,t.message),e.absent(t,`prompt`,`setup`,`is only allowed for direct setup`),e.absent(t,`bundle`,`setup`,`is only allowed for direct setup`),e.absent(t,`filter`,`setup`,`is only allowed for direct setup`)}function j(e){return h(e)&&e.setup!==void 0}function M(e){let n=new v;if(!h(e))return{valid:!1,errors:[`manifest: must be an object`]};let{setup:r}=e;return h(r)?r.version===`1.0`?((typeof e.id!=`string`||!t.test(e.id))&&n.fail(`id`,`must be a lowercase slug`),n.copy(e.name,`name`),n.copy(e.description,`description`),e.version!==void 0&&(typeof e.version!=`string`||!i.test(e.version))&&n.fail(`version`,`must be a semantic version`),e.skill!==void 0&&(typeof e.skill!=`string`||!t.test(e.skill))&&n.fail(`skill`,`must be a lowercase slug`),x(n,e.requires),A(n,r,T(n,r.form)),{valid:n.errors.length===0,errors:n.errors}):{valid:!1,errors:[`setup.version: must be "1.0"`]}:{valid:!1,errors:[`setup: must be an object`]}}exports.hasSetupBlock=j,exports.validateSetupEntry=M;
+require("../_virtual/_rolldown/runtime.cjs");const e=require("./types.cjs");var t=/^[a-z0-9]+(-[a-z0-9]+)*$/,n=/^[a-z][A-Za-z0-9]*$/,r=/<[A-Za-z/!]/,i=/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/,a=/^[A-Za-z0-9 ._/-]+$/,o=/^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/,s=/^(skills|automations)\/[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/,c=RegExp(`\\{\\{(?!(?:${e.SETUP_PLACEHOLDER_NAMESPACES.join(`|`)})\\.[A-Za-z0-9_.]+\\}\\})`),l=[`direct`,`assisted`],u=[`text`,`textarea`,`select`,`number`,`cron`,`timezone`,`repo-picker`,`llm-profile`,`event-source`,`event-type`,`plugin-sources`,`tarball-upload`],d=[`github`,`gitlab`,`bitbucket`],f=[`cron`,`event`],p=[`safeExpressionLiteral`],m=2e3;function h(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function g(e,t){return typeof e==`string`&&t.includes(e)}function _(e,t){return typeof e==`number`&&Number.isInteger(e)&&e>=t}var v=class{errors=[];fail(e,t){return this.errors.push(`${e}: ${t}`),!1}copy(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):r.test(e)?this.fail(t,`must not contain markup`):!0}placeholders(e,t){return c.test(e)?this.fail(t,`uses an unknown placeholder namespace`):!0}templateCopy(e,t){return this.copy(e,t)&&this.placeholders(e,t)}templateValue(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):this.placeholders(e,t)}absent(e,t,n,r){return t in e?this.fail(`${n}.${t}`,r):!0}};function y(e,t){return typeof e==`string`&&t.test(e)&&!e.split(`/`).some(e=>e===`.`||e===`..`)}function b(e){if(typeof e!=`string`||!a.test(e))return!1;let t=e.split(` `).filter(e=>e.length>0);return t.length>0&&t.every(e=>!e.startsWith(`/`)&&!e.split(`/`).some(e=>e===`..`))}function x(e,t){if(!h(t)){e.fail(`requires`,`must be an object`);return}let{integrations:n,features:r}=t;h(n)?Object.entries(n).forEach(([t,n])=>{let r=`requires.integrations.${t}`;if(!h(n)){e.fail(r,`must be an object`);return}e.copy(n.message,`${r}.message`),`required`in n&&n.required!==!1&&e.fail(`${r}.required`,`may only be false`);let i=[`message`,`required`];Object.keys(n).filter(e=>!i.includes(e)).forEach(t=>e.fail(`${r}.${t}`,`is not allowed`))}):e.fail(`requires.integrations`,`must be an object`),r!==void 0&&(!Array.isArray(r)||r.length===0?e.fail(`requires.features`,`must be a non-empty array`):r.forEach((t,n)=>{(typeof t!=`string`||t.length===0)&&e.fail(`requires.features[${n}]`,`must be a non-empty string`)}))}function S(e,t,n){if(!h(t)||Object.keys(t).length===0){e.fail(n,`must be a non-empty object`);return}let{minLength:r,maxLength:i,min:a,max:o,format:s}=t;r!==void 0&&!_(r,0)&&e.fail(`${n}.minLength`,`must be a non-negative integer`),i!==void 0&&!_(i,1)&&e.fail(`${n}.maxLength`,`must be a positive integer`),a!==void 0&&!_(a,0)&&e.fail(`${n}.min`,`must be a non-negative integer`),o!==void 0&&!_(o,1)&&e.fail(`${n}.max`,`must be a positive integer`),s!==void 0&&!g(s,p)&&e.fail(`${n}.format`,`is not a supported format`)}function C(e,t,n){if(!h(t)){e.fail(n,`must be an object`);return}let{type:r,label:i,help:a,placeholder:o,required:s,provider:c,options:l}=t;g(r,u)||e.fail(`${n}.type`,`is not a supported field type`),e.copy(i,`${n}.label`),e.copy(a,`${n}.help`),o!==void 0&&e.copy(o,`${n}.placeholder`),t.default!==void 0&&typeof t.default!=`string`&&typeof t.default!=`number`&&typeof t.default!=`boolean`&&t.default!==null&&e.fail(`${n}.default`,`must be a string, number, boolean or null`),typeof s!=`boolean`&&e.fail(`${n}.required`,`must be a boolean`),c!==void 0&&!g(c,d)&&e.fail(`${n}.provider`,`is not a supported provider`),r===`repo-picker`&&c===void 0&&e.fail(`${n}.provider`,`is required for a repository field`),t.multiple!==void 0&&(t.multiple!==!0||r!==`repo-picker`)&&e.fail(`${n}.multiple`,`may only be true, and only on a repository field`),l!==void 0&&(r===`select`?!Array.isArray(l)||l.length===0?e.fail(`${n}.options`,`must be a non-empty array`):l.forEach((t,r)=>{let i=`${n}.options[${r}]`;if(!h(t)){e.fail(i,`must be an object`);return}(typeof t.value!=`string`||t.value.length===0)&&e.fail(`${i}.value`,`must be a non-empty string`),e.copy(t.label,`${i}.label`)}):e.fail(`${n}.options`,`is only allowed on a select field`)),t.constraints!==void 0&&S(e,t.constraints,`${n}.constraints`)}function w(e,t,r){return!h(t)||Object.keys(t).length===0?(e.fail(r,`must be a non-empty object`),[]):Object.entries(t).map(([t,i])=>(n.test(t)||e.fail(`${r}.${t}`,`is not a valid field name`),C(e,i,`${r}.${t}`),t))}function T(e,t){if(!h(t))return e.fail(`setup.form`,`must be an object`),{kinds:[],fieldNames:[]};t.note!==void 0&&e.copy(t.note,`setup.form.note`);let n=w(e,t.args,`setup.form.args`),r=[];t.triggers!==void 0&&(!h(t.triggers)||Object.keys(t.triggers).length===0?e.fail(`setup.form.triggers`,`must be a non-empty object`):Object.entries(t.triggers).forEach(([t,i])=>{if(!g(t,f)){e.fail(`setup.form.triggers.${t}`,`is not a trigger kind`);return}r.push(t),n.push(...w(e,i,`setup.form.triggers.${t}`))}));let i=n.filter((e,t)=>n.indexOf(e)!==t);return Array.from(new Set(i)).forEach(t=>e.fail(`setup.form.${t}`,`is declared more than once`)),{kinds:r,fieldNames:n}}function E(e,t,n){if(!Array.isArray(t)||t.length===0){e.fail(n,`must be a non-empty array`);return}t.forEach((t,r)=>{(typeof t!=`string`||t.length===0)&&e.fail(`${n}[${r}]`,`must be a non-empty string`)})}function D(e,t,n,r){let i=`setup.actions.${t}`;if(!h(n)){e.fail(i,`must be an object`);return}e.copy(n.label,`${i}.label`),e.copy(n.help,`${i}.help`),E(e,n.features,`${i}.features`),w(e,n.args,`${i}.args`).filter(e=>r.includes(e)).forEach(t=>e.fail(`${i}.args.${t}`,`is already declared by the form`)),t===`prompt`?e.templateValue(n.prompt,`${i}.prompt`):t===`plugin`?(e.templateValue(n.prompt,`${i}.prompt`),e.templateValue(n.plugins,`${i}.plugins`)):t===`upload`?(e.templateValue(n.tarballPath,`${i}.tarballPath`),e.templateValue(n.entrypoint,`${i}.entrypoint`),n.setupScript!==void 0&&e.templateValue(n.setupScript,`${i}.setupScript`)):e.fail(i,`is not a supported action kind`);let a={prompt:[`label`,`help`,`features`,`args`,`prompt`],plugin:[`label`,`help`,`features`,`args`,`prompt`,`plugins`],upload:[`label`,`help`,`features`,`args`,`tarballPath`,`entrypoint`,`setupScript`]}[t]??[];Object.keys(n).filter(e=>!a.includes(e)).forEach(t=>e.fail(`${i}.${t}`,`is not allowed`))}function O(e,t,n){if(!h(t)||Object.keys(t).length===0){e.fail(`setup.actions`,`must be a non-empty object`);return}Object.entries(t).forEach(([t,r])=>D(e,t,r,n))}function k(e,t){return h(e)?Object.values(e).some(e=>h(e)&&e.type===t):!1}function A(e){return h(e)&&k(e.args,`repo-picker`)}function j(e){let t=h(e.form)?e.form:{},n=h(t.triggers)?t.triggers:{},r=n.event;return k(r,`event-source`)||`event`in n&&Object.keys(n).length===1&&k(r,`repo-picker`)||k(t.args,`repo-picker`)?!0:!h(e.actions)||Object.keys(e.actions).length===0?!1:Object.values(e.actions).every(A)}function M(e,t){e.templateCopy(t,`setup.message`)&&t.length>m&&e.fail(`setup.message`,`must be at most ${m} characters`)}function N(e,t){if(!h(t)){e.fail(`setup.bundle`,`must be an object`);return}(typeof t.version!=`string`||!i.test(t.version))&&e.fail(`setup.bundle.version`,`must be a semantic version`),b(t.entrypoint)||e.fail(`setup.bundle.entrypoint`,`must be a plain command that stays inside the archive`),t.setupScript!==void 0&&!y(t.setupScript,o)&&e.fail(`setup.bundle.setupScript`,`must be a relative path`),t.timeout!==void 0&&!_(t.timeout,1)&&e.fail(`setup.bundle.timeout`,`must be a positive integer`),!h(t.files)||Object.keys(t.files).length===0?e.fail(`setup.bundle.files`,`must be a non-empty object`):(Object.entries(t.files).forEach(([t,n])=>{y(t,o)||e.fail(`setup.bundle.files.${t}`,`is not a packed path`),t===`config.json`&&e.fail(`setup.bundle.files.${t}`,`is the name the rendered config is packed under`),y(n,s)||e.fail(`setup.bundle.files.${t}`,`must name a file under skills/ or automations/`)}),typeof t.setupScript==`string`&&!(t.setupScript in t.files)&&e.fail(`setup.bundle.setupScript`,`must name a packed file`)),!h(t.config)||Object.keys(t.config).length===0?e.fail(`setup.bundle.config`,`must be a non-empty object`):P(e,t.config,`setup.bundle.config`)}function P(e,t,n){if(typeof t==`string`){e.templateValue(t,n);return}if(Array.isArray(t)){t.forEach((t,r)=>P(e,t,`${n}[${r}]`));return}if(h(t)){Object.entries(t).forEach(([t,r])=>P(e,r,`${n}.${t}`));return}t!==null&&typeof t!=`number`&&typeof t!=`boolean`&&e.fail(n,`must be a string, number, boolean, null, array or object`)}function F(e,t,n,r){if(!g(t.mode,l)){e.fail(`setup.mode`,`is not a supported mode`);return}if(t.mode===`direct`){let i=t.prompt!==void 0,a=t.bundle!==void 0,o=t.actions!==void 0;[i,a,o].filter(Boolean).length===1?a?N(e,t.bundle):o?O(e,t.actions,r):e.templateValue(t.prompt,`setup.prompt`):e.fail(`setup`,`must declare exactly one of prompt, bundle or actions for direct setup`),t.message!==void 0&&M(e,t.message),n.length===0&&e.fail(`setup.form.triggers`,`must declare at least one trigger kind`),n.includes(`event`)&&!j(t)&&e.fail(`setup.form.triggers.event`,`must declare an event source field or repository picker`),t.filter!==void 0&&(n.includes(`event`)?e.templateValue(t.filter,`setup.filter`):e.fail(`setup.filter`,`is only allowed for an event trigger`));return}M(e,t.message),e.absent(t,`prompt`,`setup`,`is only allowed for direct setup`),e.absent(t,`bundle`,`setup`,`is only allowed for direct setup`),e.absent(t,`actions`,`setup`,`is only allowed for direct setup`),e.absent(t,`filter`,`setup`,`is only allowed for direct setup`)}function I(e){return h(e)&&e.setup!==void 0}function L(e){let n=new v;if(!h(e))return{valid:!1,errors:[`manifest: must be an object`]};let{setup:r}=e;if(!h(r))return{valid:!1,errors:[`setup: must be an object`]};if(r.version!==`1.0`)return{valid:!1,errors:[`setup.version: must be "1.0"`]};(typeof e.id!=`string`||!t.test(e.id))&&n.fail(`id`,`must be a lowercase slug`),n.copy(e.name,`name`),n.copy(e.description,`description`),e.version!==void 0&&(typeof e.version!=`string`||!i.test(e.version))&&n.fail(`version`,`must be a semantic version`),e.skill!==void 0&&(typeof e.skill!=`string`||!t.test(e.skill))&&n.fail(`skill`,`must be a lowercase slug`),x(n,e.requires);let{kinds:a,fieldNames:o}=T(n,r.form);return F(n,r,a,o),{valid:n.errors.length===0,errors:n.errors}}exports.hasSetupBlock=I,exports.validateSetupEntry=L;
 //# sourceMappingURL=manifest-validation.cjs.map

package/dist/manifests/manifest-validation.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-validation.cjs","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/**\n * Admission policy for extension-authored catalog manifests.\n *\n * A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is *permitted* to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n *\n * Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n *\n * A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n */\n\nimport {\n  BUNDLE_CONFIG_FILENAME,\n  SETUP_PLACEHOLDER_NAMESPACES,\n  SETUP_VERSION,\n} from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]*$/;\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/**\n * A template version, declared as `version` by a prompt entry and as\n * `setup.bundle.version` by a bundle one. Sent to the service as template\n * provenance, so it is checked at admission. Full semver, as the spec at\n * semver.org states it: a catalog entry published with a pre-release or build\n * suffix is still a version this host may forward, and refusing one would drop\n * the entry from the registry outright.\n */\nconst TEMPLATE_VERSION_PATTERN =\n  /^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\\+[0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*)?$/;\n// The characters a command of plain words and paths is made of. No shell\n// metacharacters, which the service rejects anyway and a bundle has no reason\n// to need; where those words may point is `isPlainCommand`'s to say.\nconst BUNDLE_COMMAND_PATTERN = /^[A-Za-z0-9 ._/-]+$/;\nconst BUNDLE_PATH_PATTERN = /^[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\nconst BUNDLE_SOURCE_PATTERN =\n  /^(skills|automations)\\/[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\n/** Every `{{` must open a known namespace and close immediately. */\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n  `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n  \"text\",\n  \"textarea\",\n  \"select\",\n  \"cron\",\n  \"timezone\",\n  \"repo-picker\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/** Setup context only, so this can never become a channel for runtime instructions. */\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n  value: unknown,\n  allowed: T,\n): value is T[number] {\n  return (\n    typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n  );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n  return (\n    typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n  );\n}\n\nclass SetupChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  placeholders(value: string, path: string): boolean {\n    if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n      return this.fail(path, \"uses an unknown placeholder namespace\");\n    }\n    return true;\n  }\n\n  /** Copy that may embed `{{namespace.key}}` placeholders. */\n  templateCopy(value: unknown, path: string): boolean {\n    return this.copy(value, path) && this.placeholders(value as string, path);\n  }\n\n  /**\n   * A request-body string that may embed placeholders. Never rendered, so\n   * expression syntax such as a JMESPath filter is allowed through.\n   */\n  templateValue(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    return this.placeholders(value, path);\n  }\n\n  absent(container: Rec, key: string, path: string, reason: string): boolean {\n    if (key in container) return this.fail(`${path}.${key}`, reason);\n    return true;\n  }\n}\n\n/**\n * A relative path that stays inside the archive it names.\n *\n * The character class alone is not enough: `.` and `..` are made of allowed\n * characters, so a segment check is what actually keeps a packed file from\n * climbing out of the directory it is extracted into.\n */\nfunction isRelativePath(value: unknown, pattern: RegExp): value is string {\n  return (\n    typeof value === \"string\" &&\n    pattern.test(value) &&\n    !value.split(\"/\").some((segment) => segment === \".\" || segment === \"..\")\n  );\n}\n\n/**\n * A command whose every word stays inside the archive it is run in.\n *\n * The character class is not what keeps it there: `/` and `.` are allowed\n * characters, so `/bin/sh setup.sh` and `python3 ../../etc/x.py` are made of\n * them and each names something outside the extracted directory. The segment\n * rule packed paths are held to is what refuses those, and requiring a word at\n * all is what refuses an entrypoint of nothing but spaces.\n */\nfunction isPlainCommand(value: unknown): value is string {\n  if (typeof value !== \"string\" || !BUNDLE_COMMAND_PATTERN.test(value)) {\n    return false;\n  }\n  const words = value.split(\" \").filter((word) => word.length > 0);\n  return (\n    words.length > 0 &&\n    words.every(\n      (word) =>\n        !word.startsWith(\"/\") &&\n        !word.split(\"/\").some((segment) => segment === \"..\"),\n    )\n  );\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n  if (!isRecord(requires)) {\n    check.fail(\"requires\", \"must be an object\");\n    return;\n  }\n\n  const { integrations, features } = requires;\n  // Empty is meaningful rather than malformed: an automation that needs no\n  // credential connects to nothing, and the key stays required so that saying\n  // so is a deliberate statement instead of an omission.\n  if (!isRecord(integrations)) {\n    check.fail(\"requires.integrations\", \"must be an object\");\n  } else {\n    Object.entries(integrations).forEach(([id, requirement]) => {\n      const path = `requires.integrations.${id}`;\n      if (!isRecord(requirement)) {\n        check.fail(path, \"must be an object\");\n        return;\n      }\n      check.copy(requirement.message, `${path}.message`);\n      if (\"required\" in requirement && requirement.required !== false) {\n        check.fail(`${path}.required`, \"may only be false\");\n      }\n      const allowed = [\"message\", \"required\"];\n      Object.keys(requirement)\n        .filter((key) => !allowed.includes(key))\n        .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n    });\n  }\n\n  if (features !== undefined) {\n    if (!Array.isArray(features) || features.length === 0) {\n      check.fail(\"requires.features\", \"must be a non-empty array\");\n    } else {\n      features.forEach((feature, index) => {\n        if (typeof feature !== \"string\" || feature.length === 0) {\n          check.fail(\n            `requires.features[${index}]`,\n            \"must be a non-empty string\",\n          );\n        }\n      });\n    }\n  }\n}\n\nfunction checkConstraints(\n  check: SetupChecker,\n  constraints: unknown,\n  path: string,\n): void {\n  if (!isRecord(constraints) || Object.keys(constraints).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return;\n  }\n\n  const { minLength, maxLength, format } = constraints;\n  if (minLength !== undefined && !isInteger(minLength, 0)) {\n    check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n  }\n  if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n    check.fail(`${path}.maxLength`, \"must be a positive integer\");\n  }\n  if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n    check.fail(`${path}.format`, \"is not a supported format\");\n  }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n  if (!isRecord(field)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  const { type, label, help, placeholder, required, provider, options } = field;\n\n  if (!isOneOf(type, FIELD_TYPES)) {\n    check.fail(`${path}.type`, \"is not a supported field type\");\n  }\n  check.copy(label, `${path}.label`);\n  check.copy(help, `${path}.help`);\n  if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n  if (field.default !== undefined && typeof field.default !== \"string\") {\n    check.fail(`${path}.default`, \"must be a string\");\n  }\n  if (typeof required !== \"boolean\") {\n    check.fail(`${path}.required`, \"must be a boolean\");\n  }\n  if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n    check.fail(`${path}.provider`, \"is not a supported provider\");\n  }\n  if (type === \"repo-picker\" && provider === undefined) {\n    check.fail(`${path}.provider`, \"is required for a repository field\");\n  }\n  // The host branches on this key to decide whether a field's value is a list,\n  // so a field declaring it anywhere else would be seeded with a list and\n  // rendered as a string.\n  if (\n    field.multiple !== undefined &&\n    (field.multiple !== true || type !== \"repo-picker\")\n  ) {\n    check.fail(\n      `${path}.multiple`,\n      \"may only be true, and only on a repository field\",\n    );\n  }\n\n  if (options !== undefined) {\n    if (type !== \"select\") {\n      check.fail(`${path}.options`, \"is only allowed on a select field\");\n    } else if (!Array.isArray(options) || options.length === 0) {\n      check.fail(`${path}.options`, \"must be a non-empty array\");\n    } else {\n      options.forEach((option, index) => {\n        const optionPath = `${path}.options[${index}]`;\n        if (!isRecord(option)) {\n          check.fail(optionPath, \"must be an object\");\n          return;\n        }\n        if (typeof option.value !== \"string\" || option.value.length === 0) {\n          check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n        }\n        check.copy(option.label, `${optionPath}.label`);\n      });\n    }\n  }\n\n  if (field.constraints !== undefined) {\n    checkConstraints(check, field.constraints, `${path}.constraints`);\n  }\n}\n\n/** Returns the declared field names, so the caller can check them for collisions. */\nfunction checkFields(\n  check: SetupChecker,\n  fields: unknown,\n  path: string,\n): string[] {\n  if (!isRecord(fields) || Object.keys(fields).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return [];\n  }\n\n  return Object.entries(fields).map(([name, field]) => {\n    if (!FIELD_NAME_PATTERN.test(name)) {\n      check.fail(`${path}.${name}`, \"is not a valid field name\");\n    }\n    checkField(check, field, `${path}.${name}`);\n    return name;\n  });\n}\n\n/** Returns the trigger kinds declared, in order. */\nfunction checkForm(check: SetupChecker, form: unknown): string[] {\n  if (!isRecord(form)) {\n    check.fail(\"setup.form\", \"must be an object\");\n    return [];\n  }\n\n  if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n  const names = checkFields(check, form.args, \"setup.form.args\");\n  const kinds: string[] = [];\n\n  if (form.triggers !== undefined) {\n    if (!isRecord(form.triggers) || Object.keys(form.triggers).length === 0) {\n      check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n    } else {\n      Object.entries(form.triggers).forEach(([kind, fields]) => {\n        if (!isOneOf(kind, TRIGGER_KINDS)) {\n          check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n          return;\n        }\n        kinds.push(kind);\n        names.push(\n          ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n        );\n      });\n    }\n  }\n\n  // The host merges both halves into one value map, so a repeated name would\n  // silently shadow a field and misaddress every error reported against it.\n  const duplicates = names.filter(\n    (name, index) => names.indexOf(name) !== index,\n  );\n  Array.from(new Set(duplicates)).forEach((name) =>\n    check.fail(`setup.form.${name}`, \"is declared more than once\"),\n  );\n\n  return kinds;\n}\n\nfunction hasRepoPicker(form: unknown): boolean {\n  if (!isRecord(form)) return false;\n  const groups = [\n    form.args,\n    ...Object.values(isRecord(form.triggers) ? form.triggers : {}),\n  ];\n  return groups.some(\n    (group) =>\n      isRecord(group) &&\n      Object.values(group).some(\n        (field) => isRecord(field) && field.type === \"repo-picker\",\n      ),\n  );\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n  if (check.templateCopy(message, \"setup.message\")) {\n    if ((message as string).length > MAX_MESSAGE_LENGTH) {\n      check.fail(\n        \"setup.message\",\n        `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n      );\n    }\n  }\n}\n\n/**\n * The script tarball a direct entry may ship.\n *\n * The strings here are commands and paths this host acts on, so they are held\n * to a closed character set rather than the placeholder rules copy uses: an\n * entrypoint with a shell metacharacter, or a packed path that escapes the\n * archive, is refused here rather than by the service.\n */\nfunction checkBundle(check: SetupChecker, bundle: unknown): void {\n  if (!isRecord(bundle)) {\n    check.fail(\"setup.bundle\", \"must be an object\");\n    return;\n  }\n\n  if (\n    typeof bundle.version !== \"string\" ||\n    !TEMPLATE_VERSION_PATTERN.test(bundle.version)\n  ) {\n    check.fail(\"setup.bundle.version\", \"must be a semantic version\");\n  }\n  if (!isPlainCommand(bundle.entrypoint)) {\n    check.fail(\n      \"setup.bundle.entrypoint\",\n      \"must be a plain command that stays inside the archive\",\n    );\n  }\n  if (\n    bundle.setupScript !== undefined &&\n    !isRelativePath(bundle.setupScript, BUNDLE_PATH_PATTERN)\n  ) {\n    check.fail(\"setup.bundle.setupScript\", \"must be a relative path\");\n  }\n  if (bundle.timeout !== undefined && !isInteger(bundle.timeout, 1)) {\n    check.fail(\"setup.bundle.timeout\", \"must be a positive integer\");\n  }\n\n  if (!isRecord(bundle.files) || Object.keys(bundle.files).length === 0) {\n    check.fail(\"setup.bundle.files\", \"must be a non-empty object\");\n  } else {\n    Object.entries(bundle.files).forEach(([packedPath, source]) => {\n      if (!isRelativePath(packedPath, BUNDLE_PATH_PATTERN)) {\n        check.fail(`setup.bundle.files.${packedPath}`, \"is not a packed path\");\n      }\n      // The rendered config is packed under this name too, and a tar carrying\n      // the name twice leaves which one the script reads to whichever\n      // extractor unpacks it.\n      if (packedPath === BUNDLE_CONFIG_FILENAME) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"is the name the rendered config is packed under\",\n        );\n      }\n      if (!isRelativePath(source, BUNDLE_SOURCE_PATTERN)) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"must name a file under skills/ or automations/\",\n        );\n      }\n    });\n\n    // A setup script the archive does not carry is a create request the\n    // service accepts and the first run fails on, and it is also the only\n    // thing packed executable - naming an unpacked file makes that rule\n    // unreachable.\n    if (\n      typeof bundle.setupScript === \"string\" &&\n      !(bundle.setupScript in bundle.files)\n    ) {\n      check.fail(\"setup.bundle.setupScript\", \"must name a packed file\");\n    }\n  }\n\n  if (!isRecord(bundle.config) || Object.keys(bundle.config).length === 0) {\n    check.fail(\"setup.bundle.config\", \"must be a non-empty object\");\n  } else {\n    checkBundleConfig(check, bundle.config, \"setup.bundle.config\");\n  }\n}\n\n/** Every string leaf of the config is a payload value: placeholders, no markup rule. */\nfunction checkBundleConfig(\n  check: SetupChecker,\n  node: unknown,\n  path: string,\n): void {\n  if (typeof node === \"string\") {\n    check.templateValue(node, path);\n    return;\n  }\n  if (Array.isArray(node)) {\n    node.forEach((item, index) =>\n      checkBundleConfig(check, item, `${path}[${index}]`),\n    );\n    return;\n  }\n  if (isRecord(node)) {\n    Object.entries(node).forEach(([key, value]) =>\n      checkBundleConfig(check, value, `${path}.${key}`),\n    );\n    return;\n  }\n  if (node !== null && typeof node !== \"number\" && typeof node !== \"boolean\") {\n    check.fail(\n      path,\n      \"must be a string, number, boolean, null, array or object\",\n    );\n  }\n}\n\nfunction checkMode(check: SetupChecker, setup: Rec, kinds: string[]): void {\n  if (!isOneOf(setup.mode, SETUP_MODES)) {\n    check.fail(\"setup.mode\", \"is not a supported mode\");\n    return;\n  }\n\n  if (setup.mode === \"direct\") {\n    // A direct entry produces one of two things: a prompt, or a script bundle\n    // the host packs and uploads. Both would be ambiguous, neither is nothing\n    // to create.\n    const hasPrompt = setup.prompt !== undefined;\n    const hasBundle = setup.bundle !== undefined;\n    if (hasPrompt === hasBundle) {\n      check.fail(\n        \"setup\",\n        \"must declare exactly one of prompt or bundle for direct setup\",\n      );\n    } else if (hasBundle) {\n      checkBundle(check, setup.bundle);\n    } else {\n      check.templateValue(setup.prompt, \"setup.prompt\");\n    }\n    // A direct entry may carry a fallback-conversation seed for deployments\n    // that cannot run the direct path, held to the same rules as an assisted\n    // message.\n    if (setup.message !== undefined) checkMessage(check, setup.message);\n\n    // The derivation reads a single trigger kind, and an event trigger takes\n    // its source from the repository field's provider.\n    if (kinds.length !== 1) {\n      check.fail(\n        \"setup.form.triggers\",\n        \"must declare exactly one trigger kind\",\n      );\n    }\n    if (kinds.includes(\"event\") && !hasRepoPicker(setup.form)) {\n      check.fail(\n        \"setup.form\",\n        \"must declare a repository field for an event trigger\",\n      );\n    }\n    if (setup.filter !== undefined) {\n      if (!kinds.includes(\"event\")) {\n        check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n      } else {\n        check.templateValue(setup.filter, \"setup.filter\");\n      }\n    }\n    return;\n  }\n\n  checkMessage(check, setup.message);\n  check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"bundle\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/** Whether a catalog entry ships a setup experience at all. It is optional. */\nexport function hasSetupBlock(candidate: unknown): boolean {\n  return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/**\n * Decide whether this host will act on a catalog manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n  const check = new SetupChecker();\n\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"manifest: must be an object\"] };\n  }\n\n  const { setup } = candidate;\n  if (!isRecord(setup)) {\n    return { valid: false, errors: [\"setup: must be an object\"] };\n  }\n  if (setup.version !== SETUP_VERSION) {\n    return {\n      valid: false,\n      errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n    };\n  }\n\n  if (\n    typeof candidate.id !== \"string\" ||\n    !ENTRY_ID_PATTERN.test(candidate.id)\n  ) {\n    check.fail(\"id\", \"must be a lowercase slug\");\n  }\n  check.copy(candidate.name, \"name\");\n  check.copy(candidate.description, \"description\");\n  if (\n    candidate.version !== undefined &&\n    (typeof candidate.version !== \"string\" ||\n      !TEMPLATE_VERSION_PATTERN.test(candidate.version))\n  ) {\n    check.fail(\"version\", \"must be a semantic version\");\n  }\n  if (\n    candidate.skill !== undefined &&\n    (typeof candidate.skill !== \"string\" ||\n      !ENTRY_ID_PATTERN.test(candidate.skill))\n  ) {\n    check.fail(\"skill\", \"must be a lowercase slug\");\n  }\n\n  checkRequires(check, candidate.requires);\n  const kinds = checkForm(check, setup.form);\n  checkMode(check, setup, kinds);\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":"4EAwBA,IAAM,EAAmB,2BACnB,EAAqB,sBAErB,EAAiB,cASjB,EACJ,wLAII,EAAyB,sBACzB,EAAsB,wCACtB,EACJ,8DAEI,EAAkC,OACtC,eAAe,EAAA,6BAA6B,KAAK,GAAG,EAAE,0BACxD,EAEM,EAAc,CAAC,SAAU,UAAU,EACnC,EAAc,CAClB,OACA,WACA,SACA,OACA,WACA,aACF,EACM,EAAgB,CAAC,SAAU,SAAU,WAAW,EAChD,EAAgB,CAAC,OAAQ,OAAO,EAChC,EAAqB,CAAC,uBAAuB,EAG7C,EAAqB,IAS3B,SAAS,EAAS,EAA8B,CAC9C,OAAO,OAAO,GAAU,YAAY,GAAkB,CAAC,MAAM,QAAQ,CAAK,CAC5E,CAEA,SAAS,EACP,EACA,EACoB,CACpB,OACE,OAAO,GAAU,UAAa,EAA8B,SAAS,CAAK,CAE9E,CAEA,SAAS,EAAU,EAAgB,EAA0B,CAC3D,OACE,OAAO,GAAU,UAAY,OAAO,UAAU,CAAK,GAAK,GAAS,CAErE,CAEA,IAAM,EAAN,KAAmB,CACjB,OAA4B,CAAC,EAE7B,KAAK,EAAc,EAAuB,CAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,EAC9B,EACT,CAGA,KAAK,EAAgB,EAAuB,CAO1C,OANI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAEjD,EAAe,KAAK,CAAK,EACpB,KAAK,KAAK,EAAM,yBAAyB,EAE3C,EACT,CAEA,aAAa,EAAe,EAAuB,CAIjD,OAHI,EAA4B,KAAK,CAAK,EACjC,KAAK,KAAK,EAAM,uCAAuC,EAEzD,EACT,CAGA,aAAa,EAAgB,EAAuB,CAClD,OAAO,KAAK,KAAK,EAAO,CAAI,GAAK,KAAK,aAAa,EAAiB,CAAI,CAC1E,CAMA,cAAc,EAAgB,EAAuB,CAInD,OAHI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAE9C,KAAK,aAAa,EAAO,CAAI,CACtC,CAEA,OAAO,EAAgB,EAAa,EAAc,EAAyB,CAEzE,OADI,KAAO,EAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,IAAO,CAAM,EACxD,EACT,CACF,EASA,SAAS,EAAe,EAAgB,EAAkC,CACxE,OACE,OAAO,GAAU,UACjB,EAAQ,KAAK,CAAK,GAClB,CAAC,EAAM,MAAM,GAAG,EAAE,KAAM,GAAY,IAAY,KAAO,IAAY,IAAI,CAE3E,CAWA,SAAS,EAAe,EAAiC,CACvD,GAAI,OAAO,GAAU,UAAY,CAAC,EAAuB,KAAK,CAAK,EACjE,MAAO,GAET,IAAM,EAAQ,EAAM,MAAM,GAAG,EAAE,OAAQ,GAAS,EAAK,OAAS,CAAC,EAC/D,OACE,EAAM,OAAS,GACf,EAAM,MACH,GACC,CAAC,EAAK,WAAW,GAAG,GACpB,CAAC,EAAK,MAAM,GAAG,EAAE,KAAM,GAAY,IAAY,IAAI,CACvD,CAEJ,CAEA,SAAS,EAAc,EAAqB,EAAyB,CACnE,GAAI,CAAC,EAAS,CAAQ,EAAG,CACvB,EAAM,KAAK,WAAY,mBAAmB,EAC1C,MACF,CAEA,GAAM,CAAE,eAAc,YAAa,EAI9B,EAAS,CAAY,EAGxB,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,EAAI,KAAiB,CAC1D,IAAM,EAAO,yBAAyB,IACtC,GAAI,CAAC,EAAS,CAAW,EAAG,CAC1B,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CACA,EAAM,KAAK,EAAY,QAAS,GAAG,EAAK,SAAS,EAC7C,aAAc,GAAe,EAAY,WAAa,IACxD,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEpD,IAAM,EAAU,CAAC,UAAW,UAAU,EACtC,OAAO,KAAK,CAAW,EACpB,OAAQ,GAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,QAAS,GAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,IAAO,gBAAgB,CAAC,CACpE,CAAC,EAhBD,EAAM,KAAK,wBAAyB,mBAAmB,EAmBrD,IAAa,IAAA,KACX,CAAC,MAAM,QAAQ,CAAQ,GAAK,EAAS,SAAW,EAClD,EAAM,KAAK,oBAAqB,2BAA2B,EAE3D,EAAS,SAAS,EAAS,IAAU,EAC/B,OAAO,GAAY,UAAY,EAAQ,SAAW,IACpD,EAAM,KACJ,qBAAqB,EAAM,GAC3B,4BACF,CAEJ,CAAC,EAGP,CAEA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAS,CAAW,GAAK,OAAO,KAAK,CAAW,EAAE,SAAW,EAAG,CACnE,EAAM,KAAK,EAAM,4BAA4B,EAC7C,MACF,CAEA,GAAM,CAAE,YAAW,YAAW,UAAW,EACrC,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,gCAAgC,EAE9D,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,4BAA4B,EAE1D,IAAW,IAAA,IAAa,CAAC,EAAQ,EAAQ,CAAkB,GAC7D,EAAM,KAAK,GAAG,EAAK,SAAU,2BAA2B,CAE5D,CAEA,SAAS,EAAW,EAAqB,EAAgB,EAAoB,CAC3E,GAAI,CAAC,EAAS,CAAK,EAAG,CACpB,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CAEA,GAAM,CAAE,OAAM,QAAO,OAAM,cAAa,WAAU,WAAU,WAAY,EAEnE,EAAQ,EAAM,CAAW,GAC5B,EAAM,KAAK,GAAG,EAAK,OAAQ,+BAA+B,EAE5D,EAAM,KAAK,EAAO,GAAG,EAAK,OAAO,EACjC,EAAM,KAAK,EAAM,GAAG,EAAK,MAAM,EAC3B,IAAgB,IAAA,IAAW,EAAM,KAAK,EAAa,GAAG,EAAK,aAAa,EACxE,EAAM,UAAY,IAAA,IAAa,OAAO,EAAM,SAAY,UAC1D,EAAM,KAAK,GAAG,EAAK,UAAW,kBAAkB,EAE9C,OAAO,GAAa,WACtB,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEhD,IAAa,IAAA,IAAa,CAAC,EAAQ,EAAU,CAAa,GAC5D,EAAM,KAAK,GAAG,EAAK,WAAY,6BAA6B,EAE1D,IAAS,eAAiB,IAAa,IAAA,IACzC,EAAM,KAAK,GAAG,EAAK,WAAY,oCAAoC,EAMnE,EAAM,WAAa,IAAA,KAClB,EAAM,WAAa,IAAQ,IAAS,gBAErC,EAAM,KACJ,GAAG,EAAK,WACR,kDACF,EAGE,IAAY,IAAA,KACV,IAAS,SAEF,CAAC,MAAM,QAAQ,CAAO,GAAK,EAAQ,SAAW,EACvD,EAAM,KAAK,GAAG,EAAK,UAAW,2BAA2B,EAEzD,EAAQ,SAAS,EAAQ,IAAU,CACjC,IAAM,EAAa,GAAG,EAAK,WAAW,EAAM,GAC5C,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,EAAY,mBAAmB,EAC1C,MACF,EACI,OAAO,EAAO,OAAU,UAAY,EAAO,MAAM,SAAW,IAC9D,EAAM,KAAK,GAAG,EAAW,QAAS,4BAA4B,EAEhE,EAAM,KAAK,EAAO,MAAO,GAAG,EAAW,OAAO,CAChD,CAAC,EAdD,EAAM,KAAK,GAAG,EAAK,UAAW,mCAAmC,GAkBjE,EAAM,cAAgB,IAAA,IACxB,EAAiB,EAAO,EAAM,YAAa,GAAG,EAAK,aAAa,CAEpE,CAGA,SAAS,EACP,EACA,EACA,EACU,CAMV,MALI,CAAC,EAAS,CAAM,GAAK,OAAO,KAAK,CAAM,EAAE,SAAW,GACtD,EAAM,KAAK,EAAM,4BAA4B,EACtC,CAAC,GAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,EAAM,MACnC,EAAmB,KAAK,CAAI,GAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,IAAQ,2BAA2B,EAE3D,EAAW,EAAO,EAAO,GAAG,EAAK,GAAG,GAAM,EACnC,EACR,CACH,CAGA,SAAS,EAAU,EAAqB,EAAyB,CAC/D,GAAI,CAAC,EAAS,CAAI,EAEhB,OADA,EAAM,KAAK,aAAc,mBAAmB,EACrC,CAAC,EAGN,EAAK,OAAS,IAAA,IAAW,EAAM,KAAK,EAAK,KAAM,iBAAiB,EAEpE,IAAM,EAAQ,EAAY,EAAO,EAAK,KAAM,iBAAiB,EACvD,EAAkB,CAAC,EAErB,EAAK,WAAa,IAAA,KAChB,CAAC,EAAS,EAAK,QAAQ,GAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,SAAW,EACpE,EAAM,KAAK,sBAAuB,4BAA4B,EAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,EAAM,KAAY,CACxD,GAAI,CAAC,EAAQ,EAAM,CAAa,EAAG,CACjC,EAAM,KAAK,uBAAuB,IAAQ,uBAAuB,EACjE,MACF,CACA,EAAM,KAAK,CAAI,EACf,EAAM,KACJ,GAAG,EAAY,EAAO,EAAQ,uBAAuB,GAAM,CAC7D,CACF,CAAC,GAML,IAAM,EAAa,EAAM,QACtB,EAAM,IAAU,EAAM,QAAQ,CAAI,IAAM,CAC3C,EAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,QAAS,GACvC,EAAM,KAAK,cAAc,IAAQ,4BAA4B,CAC/D,EAEO,CACT,CAEA,SAAS,EAAc,EAAwB,CAM7C,OALK,EAAS,CAAI,EAKX,CAHL,EAAK,KACL,GAAG,OAAO,OAAO,EAAS,EAAK,QAAQ,EAAI,EAAK,SAAW,CAAC,CAAC,CAExD,EAAO,KACX,GACC,EAAS,CAAK,GACd,OAAO,OAAO,CAAK,EAAE,KAClB,GAAU,EAAS,CAAK,GAAK,EAAM,OAAS,aAC/C,CACJ,EAX4B,EAY9B,CAEA,SAAS,EAAa,EAAqB,EAAwB,CAC7D,EAAM,aAAa,EAAS,eAAe,GACxC,EAAmB,OAAS,GAC/B,EAAM,KACJ,gBACA,mBAAmB,EAAmB,YACxC,CAGN,CAUA,SAAS,EAAY,EAAqB,EAAuB,CAC/D,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,eAAgB,mBAAmB,EAC9C,MACF,EAGE,OAAO,EAAO,SAAY,UAC1B,CAAC,EAAyB,KAAK,EAAO,OAAO,IAE7C,EAAM,KAAK,uBAAwB,4BAA4B,EAE5D,EAAe,EAAO,UAAU,GACnC,EAAM,KACJ,0BACA,uDACF,EAGA,EAAO,cAAgB,IAAA,IACvB,CAAC,EAAe,EAAO,YAAa,CAAmB,GAEvD,EAAM,KAAK,2BAA4B,yBAAyB,EAE9D,EAAO,UAAY,IAAA,IAAa,CAAC,EAAU,EAAO,QAAS,CAAC,GAC9D,EAAM,KAAK,uBAAwB,4BAA4B,EAG7D,CAAC,EAAS,EAAO,KAAK,GAAK,OAAO,KAAK,EAAO,KAAK,EAAE,SAAW,EAClE,EAAM,KAAK,qBAAsB,4BAA4B,GAE7D,OAAO,QAAQ,EAAO,KAAK,EAAE,SAAS,CAAC,EAAY,KAAY,CACxD,EAAe,EAAY,CAAmB,GACjD,EAAM,KAAK,sBAAsB,IAAc,sBAAsB,EAKnE,IAAA,eACF,EAAM,KACJ,sBAAsB,IACtB,iDACF,EAEG,EAAe,EAAQ,CAAqB,GAC/C,EAAM,KACJ,sBAAsB,IACtB,gDACF,CAEJ,CAAC,EAOC,OAAO,EAAO,aAAgB,UAC9B,EAAE,EAAO,eAAe,EAAO,QAE/B,EAAM,KAAK,2BAA4B,yBAAyB,GAIhE,CAAC,EAAS,EAAO,MAAM,GAAK,OAAO,KAAK,EAAO,MAAM,EAAE,SAAW,EACpE,EAAM,KAAK,sBAAuB,4BAA4B,EAE9D,EAAkB,EAAO,EAAO,OAAQ,qBAAqB,CAEjE,CAGA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,OAAO,GAAS,SAAU,CAC5B,EAAM,cAAc,EAAM,CAAI,EAC9B,MACF,CACA,GAAI,MAAM,QAAQ,CAAI,EAAG,CACvB,EAAK,SAAS,EAAM,IAClB,EAAkB,EAAO,EAAM,GAAG,EAAK,GAAG,EAAM,EAAE,CACpD,EACA,MACF,CACA,GAAI,EAAS,CAAI,EAAG,CAClB,OAAO,QAAQ,CAAI,EAAE,SAAS,CAAC,EAAK,KAClC,EAAkB,EAAO,EAAO,GAAG,EAAK,GAAG,GAAK,CAClD,EACA,MACF,CACI,IAAS,MAAQ,OAAO,GAAS,UAAY,OAAO,GAAS,WAC/D,EAAM,KACJ,EACA,0DACF,CAEJ,CAEA,SAAS,EAAU,EAAqB,EAAY,EAAuB,CACzE,GAAI,CAAC,EAAQ,EAAM,KAAM,CAAW,EAAG,CACrC,EAAM,KAAK,aAAc,yBAAyB,EAClD,MACF,CAEA,GAAI,EAAM,OAAS,SAAU,CAI3B,IAAM,EAAY,EAAM,SAAW,IAAA,GAC7B,EAAY,EAAM,SAAW,IAAA,GAC/B,IAAc,EAChB,EAAM,KACJ,QACA,+DACF,EACS,EACT,EAAY,EAAO,EAAM,MAAM,EAE/B,EAAM,cAAc,EAAM,OAAQ,cAAc,EAK9C,EAAM,UAAY,IAAA,IAAW,EAAa,EAAO,EAAM,OAAO,EAI9D,EAAM,SAAW,GACnB,EAAM,KACJ,sBACA,uCACF,EAEE,EAAM,SAAS,OAAO,GAAK,CAAC,EAAc,EAAM,IAAI,GACtD,EAAM,KACJ,aACA,sDACF,EAEE,EAAM,SAAW,IAAA,KACd,EAAM,SAAS,OAAO,EAGzB,EAAM,cAAc,EAAM,OAAQ,cAAc,EAFhD,EAAM,KAAK,eAAgB,sCAAsC,GAKrE,MACF,CAEA,EAAa,EAAO,EAAM,OAAO,EACjC,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,EACzE,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,EACzE,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,CAC3E,CAGA,SAAgB,EAAc,EAA6B,CACzD,OAAO,EAAS,CAAS,GAAK,EAAU,QAAU,IAAA,EACpD,CAQA,SAAgB,EAAmB,EAA2C,CAC5E,IAAM,EAAQ,IAAI,EAElB,GAAI,CAAC,EAAS,CAAS,EACrB,MAAO,CAAE,MAAO,GAAO,OAAQ,CAAC,6BAA6B,CAAE,EAGjE,GAAM,CAAE,SAAU,EAsClB,OArCK,EAAS,CAAK,EAGf,EAAM,UAAA,QAQR,OAAO,EAAU,IAAO,UACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,IAEnC,EAAM,KAAK,KAAM,0BAA0B,EAE7C,EAAM,KAAK,EAAU,KAAM,MAAM,EACjC,EAAM,KAAK,EAAU,YAAa,aAAa,EAE7C,EAAU,UAAY,IAAA,KACrB,OAAO,EAAU,SAAY,UAC5B,CAAC,EAAyB,KAAK,EAAU,OAAO,IAElD,EAAM,KAAK,UAAW,4BAA4B,EAGlD,EAAU,QAAU,IAAA,KACnB,OAAO,EAAU,OAAU,UAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,IAExC,EAAM,KAAK,QAAS,0BAA0B,EAGhD,EAAc,EAAO,EAAU,QAAQ,EAEvC,EAAU,EAAO,EADH,EAAU,EAAO,EAAM,IACb,CAAK,EAEtB,CAAE,MAAO,EAAM,OAAO,SAAW,EAAG,OAAQ,EAAM,MAAO,GAjCvD,CACL,MAAO,GACP,OAAQ,CAAC,8BAA2C,CACtD,EANO,CAAE,MAAO,GAAO,OAAQ,CAAC,0BAA0B,CAAE,CAqChE"}
+{"version":3,"file":"manifest-validation.cjs","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/**\n * Admission policy for extension-authored catalog manifests.\n *\n * A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is *permitted* to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n *\n * Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n *\n * A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n */\n\nimport {\n  BUNDLE_CONFIG_FILENAME,\n  SETUP_PLACEHOLDER_NAMESPACES,\n  SETUP_VERSION,\n} from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]*$/;\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/**\n * A template version, declared as `version` by a prompt entry and as\n * `setup.bundle.version` by a bundle one. Sent to the service as template\n * provenance, so it is checked at admission. Full semver, as the spec at\n * semver.org states it: a catalog entry published with a pre-release or build\n * suffix is still a version this host may forward, and refusing one would drop\n * the entry from the registry outright.\n */\nconst TEMPLATE_VERSION_PATTERN =\n  /^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\\+[0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*)?$/;\n// The characters a command of plain words and paths is made of. No shell\n// metacharacters, which the service rejects anyway and a bundle has no reason\n// to need; where those words may point is `isPlainCommand`'s to say.\nconst BUNDLE_COMMAND_PATTERN = /^[A-Za-z0-9 ._/-]+$/;\nconst BUNDLE_PATH_PATTERN = /^[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\nconst BUNDLE_SOURCE_PATTERN =\n  /^(skills|automations)\\/[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\n/** Every `{{` must open a known namespace and close immediately. */\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n  `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n  \"text\",\n  \"textarea\",\n  \"select\",\n  \"number\",\n  \"cron\",\n  \"timezone\",\n  \"repo-picker\",\n  \"llm-profile\",\n  \"event-source\",\n  \"event-type\",\n  \"plugin-sources\",\n  \"tarball-upload\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/** Setup context only, so this can never become a channel for runtime instructions. */\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n  value: unknown,\n  allowed: T,\n): value is T[number] {\n  return (\n    typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n  );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n  return (\n    typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n  );\n}\n\nclass SetupChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  placeholders(value: string, path: string): boolean {\n    if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n      return this.fail(path, \"uses an unknown placeholder namespace\");\n    }\n    return true;\n  }\n\n  /** Copy that may embed `{{namespace.key}}` placeholders. */\n  templateCopy(value: unknown, path: string): boolean {\n    return this.copy(value, path) && this.placeholders(value as string, path);\n  }\n\n  /**\n   * A request-body string that may embed placeholders. Never rendered, so\n   * expression syntax such as a JMESPath filter is allowed through.\n   */\n  templateValue(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    return this.placeholders(value, path);\n  }\n\n  absent(container: Rec, key: string, path: string, reason: string): boolean {\n    if (key in container) return this.fail(`${path}.${key}`, reason);\n    return true;\n  }\n}\n\n/**\n * A relative path that stays inside the archive it names.\n *\n * The character class alone is not enough: `.` and `..` are made of allowed\n * characters, so a segment check is what actually keeps a packed file from\n * climbing out of the directory it is extracted into.\n */\nfunction isRelativePath(value: unknown, pattern: RegExp): value is string {\n  return (\n    typeof value === \"string\" &&\n    pattern.test(value) &&\n    !value.split(\"/\").some((segment) => segment === \".\" || segment === \"..\")\n  );\n}\n\n/**\n * A command whose every word stays inside the archive it is run in.\n *\n * The character class is not what keeps it there: `/` and `.` are allowed\n * characters, so `/bin/sh setup.sh` and `python3 ../../etc/x.py` are made of\n * them and each names something outside the extracted directory. The segment\n * rule packed paths are held to is what refuses those, and requiring a word at\n * all is what refuses an entrypoint of nothing but spaces.\n */\nfunction isPlainCommand(value: unknown): value is string {\n  if (typeof value !== \"string\" || !BUNDLE_COMMAND_PATTERN.test(value)) {\n    return false;\n  }\n  const words = value.split(\" \").filter((word) => word.length > 0);\n  return (\n    words.length > 0 &&\n    words.every(\n      (word) =>\n        !word.startsWith(\"/\") &&\n        !word.split(\"/\").some((segment) => segment === \"..\"),\n    )\n  );\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n  if (!isRecord(requires)) {\n    check.fail(\"requires\", \"must be an object\");\n    return;\n  }\n\n  const { integrations, features } = requires;\n  // Empty is meaningful rather than malformed: an automation that needs no\n  // credential connects to nothing, and the key stays required so that saying\n  // so is a deliberate statement instead of an omission.\n  if (!isRecord(integrations)) {\n    check.fail(\"requires.integrations\", \"must be an object\");\n  } else {\n    Object.entries(integrations).forEach(([id, requirement]) => {\n      const path = `requires.integrations.${id}`;\n      if (!isRecord(requirement)) {\n        check.fail(path, \"must be an object\");\n        return;\n      }\n      check.copy(requirement.message, `${path}.message`);\n      if (\"required\" in requirement && requirement.required !== false) {\n        check.fail(`${path}.required`, \"may only be false\");\n      }\n      const allowed = [\"message\", \"required\"];\n      Object.keys(requirement)\n        .filter((key) => !allowed.includes(key))\n        .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n    });\n  }\n\n  if (features !== undefined) {\n    if (!Array.isArray(features) || features.length === 0) {\n      check.fail(\"requires.features\", \"must be a non-empty array\");\n    } else {\n      features.forEach((feature, index) => {\n        if (typeof feature !== \"string\" || feature.length === 0) {\n          check.fail(\n            `requires.features[${index}]`,\n            \"must be a non-empty string\",\n          );\n        }\n      });\n    }\n  }\n}\n\nfunction checkConstraints(\n  check: SetupChecker,\n  constraints: unknown,\n  path: string,\n): void {\n  if (!isRecord(constraints) || Object.keys(constraints).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return;\n  }\n\n  const { minLength, maxLength, min, max, format } = constraints;\n  if (minLength !== undefined && !isInteger(minLength, 0)) {\n    check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n  }\n  if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n    check.fail(`${path}.maxLength`, \"must be a positive integer\");\n  }\n  if (min !== undefined && !isInteger(min, 0)) {\n    check.fail(`${path}.min`, \"must be a non-negative integer\");\n  }\n  if (max !== undefined && !isInteger(max, 1)) {\n    check.fail(`${path}.max`, \"must be a positive integer\");\n  }\n  if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n    check.fail(`${path}.format`, \"is not a supported format\");\n  }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n  if (!isRecord(field)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  const { type, label, help, placeholder, required, provider, options } = field;\n\n  if (!isOneOf(type, FIELD_TYPES)) {\n    check.fail(`${path}.type`, \"is not a supported field type\");\n  }\n  check.copy(label, `${path}.label`);\n  check.copy(help, `${path}.help`);\n  if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n  if (\n    field.default !== undefined &&\n    typeof field.default !== \"string\" &&\n    typeof field.default !== \"number\" &&\n    typeof field.default !== \"boolean\" &&\n    field.default !== null\n  ) {\n    check.fail(`${path}.default`, \"must be a string, number, boolean or null\");\n  }\n  if (typeof required !== \"boolean\") {\n    check.fail(`${path}.required`, \"must be a boolean\");\n  }\n  if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n    check.fail(`${path}.provider`, \"is not a supported provider\");\n  }\n  if (type === \"repo-picker\" && provider === undefined) {\n    check.fail(`${path}.provider`, \"is required for a repository field\");\n  }\n  // The host branches on this key to decide whether a field's value is a list,\n  // so a field declaring it anywhere else would be seeded with a list and\n  // rendered as a string.\n  if (\n    field.multiple !== undefined &&\n    (field.multiple !== true || type !== \"repo-picker\")\n  ) {\n    check.fail(\n      `${path}.multiple`,\n      \"may only be true, and only on a repository field\",\n    );\n  }\n\n  if (options !== undefined) {\n    if (type !== \"select\") {\n      check.fail(`${path}.options`, \"is only allowed on a select field\");\n    } else if (!Array.isArray(options) || options.length === 0) {\n      check.fail(`${path}.options`, \"must be a non-empty array\");\n    } else {\n      options.forEach((option, index) => {\n        const optionPath = `${path}.options[${index}]`;\n        if (!isRecord(option)) {\n          check.fail(optionPath, \"must be an object\");\n          return;\n        }\n        if (typeof option.value !== \"string\" || option.value.length === 0) {\n          check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n        }\n        check.copy(option.label, `${optionPath}.label`);\n      });\n    }\n  }\n\n  if (field.constraints !== undefined) {\n    checkConstraints(check, field.constraints, `${path}.constraints`);\n  }\n}\n\n/** Returns the declared field names, so the caller can check them for collisions. */\nfunction checkFields(\n  check: SetupChecker,\n  fields: unknown,\n  path: string,\n): string[] {\n  if (!isRecord(fields) || Object.keys(fields).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return [];\n  }\n\n  return Object.entries(fields).map(([name, field]) => {\n    if (!FIELD_NAME_PATTERN.test(name)) {\n      check.fail(`${path}.${name}`, \"is not a valid field name\");\n    }\n    checkField(check, field, `${path}.${name}`);\n    return name;\n  });\n}\n\n/** Returns the trigger kinds declared, in order. */\nfunction checkForm(\n  check: SetupChecker,\n  form: unknown,\n): { kinds: string[]; fieldNames: string[] } {\n  if (!isRecord(form)) {\n    check.fail(\"setup.form\", \"must be an object\");\n    return { kinds: [], fieldNames: [] };\n  }\n\n  if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n  const names = checkFields(check, form.args, \"setup.form.args\");\n  const kinds: string[] = [];\n\n  if (form.triggers !== undefined) {\n    if (!isRecord(form.triggers) || Object.keys(form.triggers).length === 0) {\n      check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n    } else {\n      Object.entries(form.triggers).forEach(([kind, fields]) => {\n        if (!isOneOf(kind, TRIGGER_KINDS)) {\n          check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n          return;\n        }\n        kinds.push(kind);\n        names.push(\n          ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n        );\n      });\n    }\n  }\n\n  // The host merges both halves into one value map, so a repeated name would\n  // silently shadow a field and misaddress every error reported against it.\n  const duplicates = names.filter(\n    (name, index) => names.indexOf(name) !== index,\n  );\n  Array.from(new Set(duplicates)).forEach((name) =>\n    check.fail(`setup.form.${name}`, \"is declared more than once\"),\n  );\n\n  return { kinds, fieldNames: names };\n}\n\nfunction checkActionFeatures(\n  check: SetupChecker,\n  features: unknown,\n  path: string,\n): void {\n  if (!Array.isArray(features) || features.length === 0) {\n    check.fail(path, \"must be a non-empty array\");\n    return;\n  }\n  features.forEach((feature, index) => {\n    if (typeof feature !== \"string\" || feature.length === 0) {\n      check.fail(`${path}[${index}]`, \"must be a non-empty string\");\n    }\n  });\n}\n\nfunction checkAction(\n  check: SetupChecker,\n  kind: string,\n  action: unknown,\n  commonFieldNames: string[],\n): void {\n  const path = `setup.actions.${kind}`;\n  if (!isRecord(action)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  check.copy(action.label, `${path}.label`);\n  check.copy(action.help, `${path}.help`);\n  checkActionFeatures(check, action.features, `${path}.features`);\n  const actionFieldNames = checkFields(check, action.args, `${path}.args`);\n  actionFieldNames\n    .filter((name) => commonFieldNames.includes(name))\n    .forEach((name) =>\n      check.fail(`${path}.args.${name}`, \"is already declared by the form\"),\n    );\n\n  if (kind === \"prompt\") {\n    check.templateValue(action.prompt, `${path}.prompt`);\n  } else if (kind === \"plugin\") {\n    check.templateValue(action.prompt, `${path}.prompt`);\n    check.templateValue(action.plugins, `${path}.plugins`);\n  } else if (kind === \"upload\") {\n    check.templateValue(action.tarballPath, `${path}.tarballPath`);\n    check.templateValue(action.entrypoint, `${path}.entrypoint`);\n    if (action.setupScript !== undefined) {\n      check.templateValue(action.setupScript, `${path}.setupScript`);\n    }\n  } else {\n    check.fail(path, \"is not a supported action kind\");\n  }\n\n  const allowedByKind: Record<string, string[]> = {\n    prompt: [\"label\", \"help\", \"features\", \"args\", \"prompt\"],\n    plugin: [\"label\", \"help\", \"features\", \"args\", \"prompt\", \"plugins\"],\n    upload: [\n      \"label\",\n      \"help\",\n      \"features\",\n      \"args\",\n      \"tarballPath\",\n      \"entrypoint\",\n      \"setupScript\",\n    ],\n  };\n  const allowed = allowedByKind[kind] ?? [];\n  Object.keys(action)\n    .filter((key) => !allowed.includes(key))\n    .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n}\n\nfunction checkActions(\n  check: SetupChecker,\n  actions: unknown,\n  commonFieldNames: string[],\n): void {\n  if (!isRecord(actions) || Object.keys(actions).length === 0) {\n    check.fail(\"setup.actions\", \"must be a non-empty object\");\n    return;\n  }\n  Object.entries(actions).forEach(([kind, action]) =>\n    checkAction(check, kind, action, commonFieldNames),\n  );\n}\n\nfunction fieldsContainType(fields: unknown, type: string): boolean {\n  if (!isRecord(fields)) return false;\n  return Object.values(fields).some(\n    (field) => isRecord(field) && field.type === type,\n  );\n}\n\nfunction actionHasRepoPicker(action: unknown): boolean {\n  return isRecord(action) && fieldsContainType(action.args, \"repo-picker\");\n}\n\n/**\n * Whether an event trigger's `source` is derivable for every selectable action.\n *\n * `buildTrigger` fills `source` from a field named `source` in the event\n * trigger, or failing that from the selected action's repo-picker provider. A\n * picker in another trigger group (such as `cron`) is never collected for the\n * event trigger, and a picker in only some actions is invisible when one of the\n * others is selected — so neither may satisfy this check, or the user can end\n * up with an empty `source` no form field can fix.\n */\nfunction setupSuppliesEventSource(setup: Rec): boolean {\n  const form = isRecord(setup.form) ? setup.form : {};\n  const triggers = isRecord(form.triggers) ? form.triggers : {};\n  const eventFields = triggers.event;\n\n  // An explicit event-source field fills `source` directly, regardless of which\n  // action is selected.\n  if (fieldsContainType(eventFields, \"event-source\")) return true;\n\n  // A repo-picker in the event trigger is only collected when `event` is the\n  // sole trigger kind; with a sibling trigger the derivation reads no trigger\n  // fields for the picker. `form.args` is shared across every selection, so a\n  // picker there is always available.\n  const singleEventTrigger =\n    \"event\" in triggers && Object.keys(triggers).length === 1;\n  if (\n    (singleEventTrigger && fieldsContainType(eventFields, \"repo-picker\")) ||\n    fieldsContainType(form.args, \"repo-picker\")\n  ) {\n    return true;\n  }\n\n  // Without a shared or event-trigger picker, every selectable action must\n  // carry its own repo-picker; otherwise selecting an action without one\n  // derives `source: \"\"`.\n  if (!isRecord(setup.actions) || Object.keys(setup.actions).length === 0) {\n    return false;\n  }\n  return Object.values(setup.actions).every(actionHasRepoPicker);\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n  if (check.templateCopy(message, \"setup.message\")) {\n    if ((message as string).length > MAX_MESSAGE_LENGTH) {\n      check.fail(\n        \"setup.message\",\n        `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n      );\n    }\n  }\n}\n\n/**\n * The script tarball a direct entry may ship.\n *\n * The strings here are commands and paths this host acts on, so they are held\n * to a closed character set rather than the placeholder rules copy uses: an\n * entrypoint with a shell metacharacter, or a packed path that escapes the\n * archive, is refused here rather than by the service.\n */\nfunction checkBundle(check: SetupChecker, bundle: unknown): void {\n  if (!isRecord(bundle)) {\n    check.fail(\"setup.bundle\", \"must be an object\");\n    return;\n  }\n\n  if (\n    typeof bundle.version !== \"string\" ||\n    !TEMPLATE_VERSION_PATTERN.test(bundle.version)\n  ) {\n    check.fail(\"setup.bundle.version\", \"must be a semantic version\");\n  }\n  if (!isPlainCommand(bundle.entrypoint)) {\n    check.fail(\n      \"setup.bundle.entrypoint\",\n      \"must be a plain command that stays inside the archive\",\n    );\n  }\n  if (\n    bundle.setupScript !== undefined &&\n    !isRelativePath(bundle.setupScript, BUNDLE_PATH_PATTERN)\n  ) {\n    check.fail(\"setup.bundle.setupScript\", \"must be a relative path\");\n  }\n  if (bundle.timeout !== undefined && !isInteger(bundle.timeout, 1)) {\n    check.fail(\"setup.bundle.timeout\", \"must be a positive integer\");\n  }\n\n  if (!isRecord(bundle.files) || Object.keys(bundle.files).length === 0) {\n    check.fail(\"setup.bundle.files\", \"must be a non-empty object\");\n  } else {\n    Object.entries(bundle.files).forEach(([packedPath, source]) => {\n      if (!isRelativePath(packedPath, BUNDLE_PATH_PATTERN)) {\n        check.fail(`setup.bundle.files.${packedPath}`, \"is not a packed path\");\n      }\n      // The rendered config is packed under this name too, and a tar carrying\n      // the name twice leaves which one the script reads to whichever\n      // extractor unpacks it.\n      if (packedPath === BUNDLE_CONFIG_FILENAME) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"is the name the rendered config is packed under\",\n        );\n      }\n      if (!isRelativePath(source, BUNDLE_SOURCE_PATTERN)) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"must name a file under skills/ or automations/\",\n        );\n      }\n    });\n\n    // A setup script the archive does not carry is a create request the\n    // service accepts and the first run fails on, and it is also the only\n    // thing packed executable - naming an unpacked file makes that rule\n    // unreachable.\n    if (\n      typeof bundle.setupScript === \"string\" &&\n      !(bundle.setupScript in bundle.files)\n    ) {\n      check.fail(\"setup.bundle.setupScript\", \"must name a packed file\");\n    }\n  }\n\n  if (!isRecord(bundle.config) || Object.keys(bundle.config).length === 0) {\n    check.fail(\"setup.bundle.config\", \"must be a non-empty object\");\n  } else {\n    checkBundleConfig(check, bundle.config, \"setup.bundle.config\");\n  }\n}\n\n/** Every string leaf of the config is a payload value: placeholders, no markup rule. */\nfunction checkBundleConfig(\n  check: SetupChecker,\n  node: unknown,\n  path: string,\n): void {\n  if (typeof node === \"string\") {\n    check.templateValue(node, path);\n    return;\n  }\n  if (Array.isArray(node)) {\n    node.forEach((item, index) =>\n      checkBundleConfig(check, item, `${path}[${index}]`),\n    );\n    return;\n  }\n  if (isRecord(node)) {\n    Object.entries(node).forEach(([key, value]) =>\n      checkBundleConfig(check, value, `${path}.${key}`),\n    );\n    return;\n  }\n  if (node !== null && typeof node !== \"number\" && typeof node !== \"boolean\") {\n    check.fail(\n      path,\n      \"must be a string, number, boolean, null, array or object\",\n    );\n  }\n}\n\nfunction checkMode(\n  check: SetupChecker,\n  setup: Rec,\n  kinds: string[],\n  commonFieldNames: string[],\n): void {\n  if (!isOneOf(setup.mode, SETUP_MODES)) {\n    check.fail(\"setup.mode\", \"is not a supported mode\");\n    return;\n  }\n\n  if (setup.mode === \"direct\") {\n    // A direct entry produces one of three things: a prompt, a script bundle\n    // the host packs and uploads, or a selectable set of action variants.\n    // More than one would be ambiguous, and none is nothing to create.\n    const hasPrompt = setup.prompt !== undefined;\n    const hasBundle = setup.bundle !== undefined;\n    const hasActions = setup.actions !== undefined;\n    const variants = [hasPrompt, hasBundle, hasActions].filter(Boolean);\n    if (variants.length !== 1) {\n      check.fail(\n        \"setup\",\n        \"must declare exactly one of prompt, bundle or actions for direct setup\",\n      );\n    } else if (hasBundle) {\n      checkBundle(check, setup.bundle);\n    } else if (hasActions) {\n      checkActions(check, setup.actions, commonFieldNames);\n    } else {\n      check.templateValue(setup.prompt, \"setup.prompt\");\n    }\n    // A direct entry may carry a fallback-conversation seed for deployments\n    // that cannot run the direct path, held to the same rules as an assisted\n    // message.\n    if (setup.message !== undefined) checkMessage(check, setup.message);\n\n    if (kinds.length === 0) {\n      check.fail(\n        \"setup.form.triggers\",\n        \"must declare at least one trigger kind\",\n      );\n    }\n    if (kinds.includes(\"event\") && !setupSuppliesEventSource(setup)) {\n      check.fail(\n        \"setup.form.triggers.event\",\n        \"must declare an event source field or repository picker\",\n      );\n    }\n    if (setup.filter !== undefined) {\n      if (!kinds.includes(\"event\")) {\n        check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n      } else {\n        check.templateValue(setup.filter, \"setup.filter\");\n      }\n    }\n    return;\n  }\n\n  checkMessage(check, setup.message);\n  check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"bundle\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"actions\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/** Whether a catalog entry ships a setup experience at all. It is optional. */\nexport function hasSetupBlock(candidate: unknown): boolean {\n  return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/**\n * Decide whether this host will act on a catalog manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n  const check = new SetupChecker();\n\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"manifest: must be an object\"] };\n  }\n\n  const { setup } = candidate;\n  if (!isRecord(setup)) {\n    return { valid: false, errors: [\"setup: must be an object\"] };\n  }\n  if (setup.version !== SETUP_VERSION) {\n    return {\n      valid: false,\n      errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n    };\n  }\n\n  if (\n    typeof candidate.id !== \"string\" ||\n    !ENTRY_ID_PATTERN.test(candidate.id)\n  ) {\n    check.fail(\"id\", \"must be a lowercase slug\");\n  }\n  check.copy(candidate.name, \"name\");\n  check.copy(candidate.description, \"description\");\n  if (\n    candidate.version !== undefined &&\n    (typeof candidate.version !== \"string\" ||\n      !TEMPLATE_VERSION_PATTERN.test(candidate.version))\n  ) {\n    check.fail(\"version\", \"must be a semantic version\");\n  }\n  if (\n    candidate.skill !== undefined &&\n    (typeof candidate.skill !== \"string\" ||\n      !ENTRY_ID_PATTERN.test(candidate.skill))\n  ) {\n    check.fail(\"skill\", \"must be a lowercase slug\");\n  }\n\n  checkRequires(check, candidate.requires);\n  const { kinds, fieldNames } = checkForm(check, setup.form);\n  checkMode(check, setup, kinds, fieldNames);\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":"4EAwBA,IAAM,EAAmB,2BACnB,EAAqB,sBAErB,EAAiB,cASjB,EACJ,wLAII,EAAyB,sBACzB,EAAsB,wCACtB,EACJ,8DAEI,EAAkC,OACtC,eAAe,EAAA,6BAA6B,KAAK,GAAG,EAAE,0BACxD,EAEM,EAAc,CAAC,SAAU,UAAU,EACnC,EAAc,CAClB,OACA,WACA,SACA,SACA,OACA,WACA,cACA,cACA,eACA,aACA,iBACA,gBACF,EACM,EAAgB,CAAC,SAAU,SAAU,WAAW,EAChD,EAAgB,CAAC,OAAQ,OAAO,EAChC,EAAqB,CAAC,uBAAuB,EAG7C,EAAqB,IAS3B,SAAS,EAAS,EAA8B,CAC9C,OAAO,OAAO,GAAU,YAAY,GAAkB,CAAC,MAAM,QAAQ,CAAK,CAC5E,CAEA,SAAS,EACP,EACA,EACoB,CACpB,OACE,OAAO,GAAU,UAAa,EAA8B,SAAS,CAAK,CAE9E,CAEA,SAAS,EAAU,EAAgB,EAA0B,CAC3D,OACE,OAAO,GAAU,UAAY,OAAO,UAAU,CAAK,GAAK,GAAS,CAErE,CAEA,IAAM,EAAN,KAAmB,CACjB,OAA4B,CAAC,EAE7B,KAAK,EAAc,EAAuB,CAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,EAC9B,EACT,CAGA,KAAK,EAAgB,EAAuB,CAO1C,OANI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAEjD,EAAe,KAAK,CAAK,EACpB,KAAK,KAAK,EAAM,yBAAyB,EAE3C,EACT,CAEA,aAAa,EAAe,EAAuB,CAIjD,OAHI,EAA4B,KAAK,CAAK,EACjC,KAAK,KAAK,EAAM,uCAAuC,EAEzD,EACT,CAGA,aAAa,EAAgB,EAAuB,CAClD,OAAO,KAAK,KAAK,EAAO,CAAI,GAAK,KAAK,aAAa,EAAiB,CAAI,CAC1E,CAMA,cAAc,EAAgB,EAAuB,CAInD,OAHI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAE9C,KAAK,aAAa,EAAO,CAAI,CACtC,CAEA,OAAO,EAAgB,EAAa,EAAc,EAAyB,CAEzE,OADI,KAAO,EAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,IAAO,CAAM,EACxD,EACT,CACF,EASA,SAAS,EAAe,EAAgB,EAAkC,CACxE,OACE,OAAO,GAAU,UACjB,EAAQ,KAAK,CAAK,GAClB,CAAC,EAAM,MAAM,GAAG,EAAE,KAAM,GAAY,IAAY,KAAO,IAAY,IAAI,CAE3E,CAWA,SAAS,EAAe,EAAiC,CACvD,GAAI,OAAO,GAAU,UAAY,CAAC,EAAuB,KAAK,CAAK,EACjE,MAAO,GAET,IAAM,EAAQ,EAAM,MAAM,GAAG,EAAE,OAAQ,GAAS,EAAK,OAAS,CAAC,EAC/D,OACE,EAAM,OAAS,GACf,EAAM,MACH,GACC,CAAC,EAAK,WAAW,GAAG,GACpB,CAAC,EAAK,MAAM,GAAG,EAAE,KAAM,GAAY,IAAY,IAAI,CACvD,CAEJ,CAEA,SAAS,EAAc,EAAqB,EAAyB,CACnE,GAAI,CAAC,EAAS,CAAQ,EAAG,CACvB,EAAM,KAAK,WAAY,mBAAmB,EAC1C,MACF,CAEA,GAAM,CAAE,eAAc,YAAa,EAI9B,EAAS,CAAY,EAGxB,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,EAAI,KAAiB,CAC1D,IAAM,EAAO,yBAAyB,IACtC,GAAI,CAAC,EAAS,CAAW,EAAG,CAC1B,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CACA,EAAM,KAAK,EAAY,QAAS,GAAG,EAAK,SAAS,EAC7C,aAAc,GAAe,EAAY,WAAa,IACxD,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEpD,IAAM,EAAU,CAAC,UAAW,UAAU,EACtC,OAAO,KAAK,CAAW,EACpB,OAAQ,GAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,QAAS,GAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,IAAO,gBAAgB,CAAC,CACpE,CAAC,EAhBD,EAAM,KAAK,wBAAyB,mBAAmB,EAmBrD,IAAa,IAAA,KACX,CAAC,MAAM,QAAQ,CAAQ,GAAK,EAAS,SAAW,EAClD,EAAM,KAAK,oBAAqB,2BAA2B,EAE3D,EAAS,SAAS,EAAS,IAAU,EAC/B,OAAO,GAAY,UAAY,EAAQ,SAAW,IACpD,EAAM,KACJ,qBAAqB,EAAM,GAC3B,4BACF,CAEJ,CAAC,EAGP,CAEA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAS,CAAW,GAAK,OAAO,KAAK,CAAW,EAAE,SAAW,EAAG,CACnE,EAAM,KAAK,EAAM,4BAA4B,EAC7C,MACF,CAEA,GAAM,CAAE,YAAW,YAAW,MAAK,MAAK,UAAW,EAC/C,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,gCAAgC,EAE9D,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,4BAA4B,EAE1D,IAAQ,IAAA,IAAa,CAAC,EAAU,EAAK,CAAC,GACxC,EAAM,KAAK,GAAG,EAAK,MAAO,gCAAgC,EAExD,IAAQ,IAAA,IAAa,CAAC,EAAU,EAAK,CAAC,GACxC,EAAM,KAAK,GAAG,EAAK,MAAO,4BAA4B,EAEpD,IAAW,IAAA,IAAa,CAAC,EAAQ,EAAQ,CAAkB,GAC7D,EAAM,KAAK,GAAG,EAAK,SAAU,2BAA2B,CAE5D,CAEA,SAAS,EAAW,EAAqB,EAAgB,EAAoB,CAC3E,GAAI,CAAC,EAAS,CAAK,EAAG,CACpB,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CAEA,GAAM,CAAE,OAAM,QAAO,OAAM,cAAa,WAAU,WAAU,WAAY,EAEnE,EAAQ,EAAM,CAAW,GAC5B,EAAM,KAAK,GAAG,EAAK,OAAQ,+BAA+B,EAE5D,EAAM,KAAK,EAAO,GAAG,EAAK,OAAO,EACjC,EAAM,KAAK,EAAM,GAAG,EAAK,MAAM,EAC3B,IAAgB,IAAA,IAAW,EAAM,KAAK,EAAa,GAAG,EAAK,aAAa,EAE1E,EAAM,UAAY,IAAA,IAClB,OAAO,EAAM,SAAY,UACzB,OAAO,EAAM,SAAY,UACzB,OAAO,EAAM,SAAY,WACzB,EAAM,UAAY,MAElB,EAAM,KAAK,GAAG,EAAK,UAAW,2CAA2C,EAEvE,OAAO,GAAa,WACtB,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEhD,IAAa,IAAA,IAAa,CAAC,EAAQ,EAAU,CAAa,GAC5D,EAAM,KAAK,GAAG,EAAK,WAAY,6BAA6B,EAE1D,IAAS,eAAiB,IAAa,IAAA,IACzC,EAAM,KAAK,GAAG,EAAK,WAAY,oCAAoC,EAMnE,EAAM,WAAa,IAAA,KAClB,EAAM,WAAa,IAAQ,IAAS,gBAErC,EAAM,KACJ,GAAG,EAAK,WACR,kDACF,EAGE,IAAY,IAAA,KACV,IAAS,SAEF,CAAC,MAAM,QAAQ,CAAO,GAAK,EAAQ,SAAW,EACvD,EAAM,KAAK,GAAG,EAAK,UAAW,2BAA2B,EAEzD,EAAQ,SAAS,EAAQ,IAAU,CACjC,IAAM,EAAa,GAAG,EAAK,WAAW,EAAM,GAC5C,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,EAAY,mBAAmB,EAC1C,MACF,EACI,OAAO,EAAO,OAAU,UAAY,EAAO,MAAM,SAAW,IAC9D,EAAM,KAAK,GAAG,EAAW,QAAS,4BAA4B,EAEhE,EAAM,KAAK,EAAO,MAAO,GAAG,EAAW,OAAO,CAChD,CAAC,EAdD,EAAM,KAAK,GAAG,EAAK,UAAW,mCAAmC,GAkBjE,EAAM,cAAgB,IAAA,IACxB,EAAiB,EAAO,EAAM,YAAa,GAAG,EAAK,aAAa,CAEpE,CAGA,SAAS,EACP,EACA,EACA,EACU,CAMV,MALI,CAAC,EAAS,CAAM,GAAK,OAAO,KAAK,CAAM,EAAE,SAAW,GACtD,EAAM,KAAK,EAAM,4BAA4B,EACtC,CAAC,GAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,EAAM,MACnC,EAAmB,KAAK,CAAI,GAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,IAAQ,2BAA2B,EAE3D,EAAW,EAAO,EAAO,GAAG,EAAK,GAAG,GAAM,EACnC,EACR,CACH,CAGA,SAAS,EACP,EACA,EAC2C,CAC3C,GAAI,CAAC,EAAS,CAAI,EAEhB,OADA,EAAM,KAAK,aAAc,mBAAmB,EACrC,CAAE,MAAO,CAAC,EAAG,WAAY,CAAC,CAAE,EAGjC,EAAK,OAAS,IAAA,IAAW,EAAM,KAAK,EAAK,KAAM,iBAAiB,EAEpE,IAAM,EAAQ,EAAY,EAAO,EAAK,KAAM,iBAAiB,EACvD,EAAkB,CAAC,EAErB,EAAK,WAAa,IAAA,KAChB,CAAC,EAAS,EAAK,QAAQ,GAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,SAAW,EACpE,EAAM,KAAK,sBAAuB,4BAA4B,EAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,EAAM,KAAY,CACxD,GAAI,CAAC,EAAQ,EAAM,CAAa,EAAG,CACjC,EAAM,KAAK,uBAAuB,IAAQ,uBAAuB,EACjE,MACF,CACA,EAAM,KAAK,CAAI,EACf,EAAM,KACJ,GAAG,EAAY,EAAO,EAAQ,uBAAuB,GAAM,CAC7D,CACF,CAAC,GAML,IAAM,EAAa,EAAM,QACtB,EAAM,IAAU,EAAM,QAAQ,CAAI,IAAM,CAC3C,EAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,QAAS,GACvC,EAAM,KAAK,cAAc,IAAQ,4BAA4B,CAC/D,EAEO,CAAE,QAAO,WAAY,CAAM,CACpC,CAEA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CAAC,MAAM,QAAQ,CAAQ,GAAK,EAAS,SAAW,EAAG,CACrD,EAAM,KAAK,EAAM,2BAA2B,EAC5C,MACF,CACA,EAAS,SAAS,EAAS,IAAU,EAC/B,OAAO,GAAY,UAAY,EAAQ,SAAW,IACpD,EAAM,KAAK,GAAG,EAAK,GAAG,EAAM,GAAI,4BAA4B,CAEhE,CAAC,CACH,CAEA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAO,iBAAiB,IAC9B,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CAEA,EAAM,KAAK,EAAO,MAAO,GAAG,EAAK,OAAO,EACxC,EAAM,KAAK,EAAO,KAAM,GAAG,EAAK,MAAM,EACtC,EAAoB,EAAO,EAAO,SAAU,GAAG,EAAK,UAAU,EAE9D,EADqC,EAAO,EAAO,KAAM,GAAG,EAAK,MACjE,EACG,OAAQ,GAAS,EAAiB,SAAS,CAAI,CAAC,EAChD,QAAS,GACR,EAAM,KAAK,GAAG,EAAK,QAAQ,IAAQ,iCAAiC,CACtE,EAEE,IAAS,SACX,EAAM,cAAc,EAAO,OAAQ,GAAG,EAAK,QAAQ,EAC1C,IAAS,UAClB,EAAM,cAAc,EAAO,OAAQ,GAAG,EAAK,QAAQ,EACnD,EAAM,cAAc,EAAO,QAAS,GAAG,EAAK,SAAS,GAC5C,IAAS,UAClB,EAAM,cAAc,EAAO,YAAa,GAAG,EAAK,aAAa,EAC7D,EAAM,cAAc,EAAO,WAAY,GAAG,EAAK,YAAY,EACvD,EAAO,cAAgB,IAAA,IACzB,EAAM,cAAc,EAAO,YAAa,GAAG,EAAK,aAAa,GAG/D,EAAM,KAAK,EAAM,gCAAgC,EAgBnD,IAAM,EAAU,CAZd,OAAQ,CAAC,QAAS,OAAQ,WAAY,OAAQ,QAAQ,EACtD,OAAQ,CAAC,QAAS,OAAQ,WAAY,OAAQ,SAAU,SAAS,EACjE,OAAQ,CACN,QACA,OACA,WACA,OACA,cACA,aACA,aACF,CAEc,EAAc,IAAS,CAAC,EACxC,OAAO,KAAK,CAAM,EACf,OAAQ,GAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,QAAS,GAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,IAAO,gBAAgB,CAAC,CACpE,CAEA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAS,CAAO,GAAK,OAAO,KAAK,CAAO,EAAE,SAAW,EAAG,CAC3D,EAAM,KAAK,gBAAiB,4BAA4B,EACxD,MACF,CACA,OAAO,QAAQ,CAAO,EAAE,SAAS,CAAC,EAAM,KACtC,EAAY,EAAO,EAAM,EAAQ,CAAgB,CACnD,CACF,CAEA,SAAS,EAAkB,EAAiB,EAAuB,CAEjE,OADK,EAAS,CAAM,EACb,OAAO,OAAO,CAAM,EAAE,KAC1B,GAAU,EAAS,CAAK,GAAK,EAAM,OAAS,CAC/C,EAH8B,EAIhC,CAEA,SAAS,EAAoB,EAA0B,CACrD,OAAO,EAAS,CAAM,GAAK,EAAkB,EAAO,KAAM,aAAa,CACzE,CAYA,SAAS,EAAyB,EAAqB,CACrD,IAAM,EAAO,EAAS,EAAM,IAAI,EAAI,EAAM,KAAO,CAAC,EAC5C,EAAW,EAAS,EAAK,QAAQ,EAAI,EAAK,SAAW,CAAC,EACtD,EAAc,EAAS,MAyB7B,OArBI,EAAkB,EAAa,cAAc,GAO/C,UAAW,GAAY,OAAO,KAAK,CAAQ,EAAE,SAAW,GAEjC,EAAkB,EAAa,aAAa,GACnE,EAAkB,EAAK,KAAM,aAAa,EAEnC,GAML,CAAC,EAAS,EAAM,OAAO,GAAK,OAAO,KAAK,EAAM,OAAO,EAAE,SAAW,EAC7D,GAEF,OAAO,OAAO,EAAM,OAAO,EAAE,MAAM,CAAmB,CAC/D,CAEA,SAAS,EAAa,EAAqB,EAAwB,CAC7D,EAAM,aAAa,EAAS,eAAe,GACxC,EAAmB,OAAS,GAC/B,EAAM,KACJ,gBACA,mBAAmB,EAAmB,YACxC,CAGN,CAUA,SAAS,EAAY,EAAqB,EAAuB,CAC/D,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,eAAgB,mBAAmB,EAC9C,MACF,EAGE,OAAO,EAAO,SAAY,UAC1B,CAAC,EAAyB,KAAK,EAAO,OAAO,IAE7C,EAAM,KAAK,uBAAwB,4BAA4B,EAE5D,EAAe,EAAO,UAAU,GACnC,EAAM,KACJ,0BACA,uDACF,EAGA,EAAO,cAAgB,IAAA,IACvB,CAAC,EAAe,EAAO,YAAa,CAAmB,GAEvD,EAAM,KAAK,2BAA4B,yBAAyB,EAE9D,EAAO,UAAY,IAAA,IAAa,CAAC,EAAU,EAAO,QAAS,CAAC,GAC9D,EAAM,KAAK,uBAAwB,4BAA4B,EAG7D,CAAC,EAAS,EAAO,KAAK,GAAK,OAAO,KAAK,EAAO,KAAK,EAAE,SAAW,EAClE,EAAM,KAAK,qBAAsB,4BAA4B,GAE7D,OAAO,QAAQ,EAAO,KAAK,EAAE,SAAS,CAAC,EAAY,KAAY,CACxD,EAAe,EAAY,CAAmB,GACjD,EAAM,KAAK,sBAAsB,IAAc,sBAAsB,EAKnE,IAAA,eACF,EAAM,KACJ,sBAAsB,IACtB,iDACF,EAEG,EAAe,EAAQ,CAAqB,GAC/C,EAAM,KACJ,sBAAsB,IACtB,gDACF,CAEJ,CAAC,EAOC,OAAO,EAAO,aAAgB,UAC9B,EAAE,EAAO,eAAe,EAAO,QAE/B,EAAM,KAAK,2BAA4B,yBAAyB,GAIhE,CAAC,EAAS,EAAO,MAAM,GAAK,OAAO,KAAK,EAAO,MAAM,EAAE,SAAW,EACpE,EAAM,KAAK,sBAAuB,4BAA4B,EAE9D,EAAkB,EAAO,EAAO,OAAQ,qBAAqB,CAEjE,CAGA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,OAAO,GAAS,SAAU,CAC5B,EAAM,cAAc,EAAM,CAAI,EAC9B,MACF,CACA,GAAI,MAAM,QAAQ,CAAI,EAAG,CACvB,EAAK,SAAS,EAAM,IAClB,EAAkB,EAAO,EAAM,GAAG,EAAK,GAAG,EAAM,EAAE,CACpD,EACA,MACF,CACA,GAAI,EAAS,CAAI,EAAG,CAClB,OAAO,QAAQ,CAAI,EAAE,SAAS,CAAC,EAAK,KAClC,EAAkB,EAAO,EAAO,GAAG,EAAK,GAAG,GAAK,CAClD,EACA,MACF,CACI,IAAS,MAAQ,OAAO,GAAS,UAAY,OAAO,GAAS,WAC/D,EAAM,KACJ,EACA,0DACF,CAEJ,CAEA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAQ,EAAM,KAAM,CAAW,EAAG,CACrC,EAAM,KAAK,aAAc,yBAAyB,EAClD,MACF,CAEA,GAAI,EAAM,OAAS,SAAU,CAI3B,IAAM,EAAY,EAAM,SAAW,IAAA,GAC7B,EAAY,EAAM,SAAW,IAAA,GAC7B,EAAa,EAAM,UAAY,IAAA,GACpB,CAAC,EAAW,EAAW,CAAU,EAAE,OAAO,OACvD,EAAS,SAAW,EAKb,EACT,EAAY,EAAO,EAAM,MAAM,EACtB,EACT,EAAa,EAAO,EAAM,QAAS,CAAgB,EAEnD,EAAM,cAAc,EAAM,OAAQ,cAAc,EAThD,EAAM,KACJ,QACA,wEACF,EAWE,EAAM,UAAY,IAAA,IAAW,EAAa,EAAO,EAAM,OAAO,EAE9D,EAAM,SAAW,GACnB,EAAM,KACJ,sBACA,wCACF,EAEE,EAAM,SAAS,OAAO,GAAK,CAAC,EAAyB,CAAK,GAC5D,EAAM,KACJ,4BACA,yDACF,EAEE,EAAM,SAAW,IAAA,KACd,EAAM,SAAS,OAAO,EAGzB,EAAM,cAAc,EAAM,OAAQ,cAAc,EAFhD,EAAM,KAAK,eAAgB,sCAAsC,GAKrE,MACF,CAEA,EAAa,EAAO,EAAM,OAAO,EACjC,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,EACzE,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,EACzE,EAAM,OAAO,EAAO,UAAW,QAAS,kCAAkC,EAC1E,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,CAC3E,CAGA,SAAgB,EAAc,EAA6B,CACzD,OAAO,EAAS,CAAS,GAAK,EAAU,QAAU,IAAA,EACpD,CAQA,SAAgB,EAAmB,EAA2C,CAC5E,IAAM,EAAQ,IAAI,EAElB,GAAI,CAAC,EAAS,CAAS,EACrB,MAAO,CAAE,MAAO,GAAO,OAAQ,CAAC,6BAA6B,CAAE,EAGjE,GAAM,CAAE,SAAU,EAClB,GAAI,CAAC,EAAS,CAAK,EACjB,MAAO,CAAE,MAAO,GAAO,OAAQ,CAAC,0BAA0B,CAAE,EAE9D,GAAI,EAAM,UAAA,MACR,MAAO,CACL,MAAO,GACP,OAAQ,CAAC,8BAA2C,CACtD,GAIA,OAAO,EAAU,IAAO,UACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,IAEnC,EAAM,KAAK,KAAM,0BAA0B,EAE7C,EAAM,KAAK,EAAU,KAAM,MAAM,EACjC,EAAM,KAAK,EAAU,YAAa,aAAa,EAE7C,EAAU,UAAY,IAAA,KACrB,OAAO,EAAU,SAAY,UAC5B,CAAC,EAAyB,KAAK,EAAU,OAAO,IAElD,EAAM,KAAK,UAAW,4BAA4B,EAGlD,EAAU,QAAU,IAAA,KACnB,OAAO,EAAU,OAAU,UAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,IAExC,EAAM,KAAK,QAAS,0BAA0B,EAGhD,EAAc,EAAO,EAAU,QAAQ,EACvC,GAAM,CAAE,QAAO,cAAe,EAAU,EAAO,EAAM,IAAI,EAGzD,OAFA,EAAU,EAAO,EAAO,EAAO,CAAU,EAElC,CAAE,MAAO,EAAM,OAAO,SAAW,EAAG,OAAQ,EAAM,MAAO,CAClE"}