@scrymore/scry-deployer 0.12.0-next.20261006020714 → 0.12.0

package/README.md

@@ -301,7 +301,7 @@ uploaded and hosted in every case below, so the preview link works; the red run
 | What happened | Log line | Exit code |
 |---|---|---|
 | Stories captured, metadata uploaded and queued | `⏳ Indexing has been queued, not finished.` | 0 |
-| Metadata upload rejected by the service | `❌ The metadata upload failed (<reason>), so NOTHING WILL BE INDEXED.` | 1 |
+| Metadata upload rejected by the service (a failed PUT or complete also marks the build failed) | `❌ The metadata upload failed (<reason>), so NOTHING WILL BE INDEXED.` | 1 |
 | Metadata uploaded but not queued | `❌ Metadata was uploaded but not queued for processing, so NOTHING WILL BE INDEXED.` | 1 |
 | Analysis captured 0 stories (the empty archive is not uploaded, no build is queued) | `❌ Analysis captured 0 of N stories, so NOTHING WILL BE INDEXED.` plus the first capture error | 1 |
 | Analysis produced no archive (for example, no Playwright browser) | `❌ Analysis produced no metadata, so NOTHING WILL BE INDEXED.` | 1 |
@@ -320,6 +320,16 @@ which does not know the flag, it is not passed and the log says dropped stories
 Before 0.7.0 the metadata-upload failure, the "not queued" case, an empty archive, a non-zero
 scry-sbcov exit and a workflow that simply forgot `--with-analysis` all ended green (ISSUES.md #50).
 
+### Large metadata ZIPs (0.12.0)
+
+The metadata ZIP is sent straight to storage on a presigned URL (presign, PUT, complete), not
+through the upload service, so it can be larger than 100 MiB (limit 2 GiB). It used to be POSTed
+through the service with a 100 MiB cap, and a library whose ZIP passed that (the dashboard's was
+101.5 MiB) indexed nothing and left its build "pending" (ISSUES.md #74). If the PUT or complete step
+fails, the build is marked failed with a reason, the log says `marked failed`, and the run exits 1.
+Against an upload service that has no presign route yet, the old route is used for a ZIP of up to
+100 MiB (the log says so); a larger ZIP stops with `upload service too old for a ZIP this size`.
+
 ### CI time (0.9.0)
 
 Every deploy measures how much CI time Scry took and records it with the build (ISSUES.md #54:

package/bin/cli.js

@@ -520,12 +520,21 @@ function reportMetadataUploadFailed(metadataUpload, uploadResult, logger) {
     const zip = uploadResult?.zipUpload || {};
     const buildNumberSuffix = zip.buildNumber !== undefined ? ` (#${zip.buildNumber})` : '';
     const build = zip.buildId ? `Build ${zip.buildId}${buildNumberSuffix}` : 'The build';
+    let outcome;
+    if (metadataUpload.markedFailed) {
+        outcome = `   ${build} is marked failed on the upload service. Re-run this job to index it.`;
+    } else if (metadataUpload.markFailedUnsupported) {
+        outcome = `   ${build} is left pending: the upload service has no way to mark it failed,\n` +
+            '   so it will not show as failed. Re-run this job to index it.';
+    } else {
+        outcome = `   ${build} is left pending: it could not be marked failed (see the warning above),\n` +
+            '   so it will not show as failed. Re-run this job to index it.';
+    }
     logger.error(
         `\n❌ The metadata upload failed (${metadataUpload.error || 'no reason given'}), so NOTHING WILL BE INDEXED.\n` +
         (metadataUpload.requestId ? `Ref: ${metadataUpload.requestId}\n` : '') +
         HOSTED_NOT_SEARCHABLE + '\n' +
-        `   ${build} is left pending: the upload service has no way to mark it failed,\n` +
-        '   so it will not show as failed. Re-run this job to index it.'
+        outcome
     );
 }
 

package/lib/apiClient.js

@@ -360,9 +360,12 @@ function validatePresignedUrl(presignedUrl) {
  * @param {string} presignedUrl
  * @param {Buffer|import('stream').Readable} data
  * @param {string} contentType
+ * @param {{timeout?: number}} [options] timeout in ms (axios: a stalled socket
+ *   is aborted after this long without traffic); omitted keeps the old
+ *   no-timeout behaviour for the Storybook archive.
  * @returns {Promise<{status:number}>}
  */
-async function putToPresignedUrl(presignedUrl, data, contentType) {
+async function putToPresignedUrl(presignedUrl, data, contentType, options = {}) {
   const size = Buffer.isBuffer(data) ? `${data.length} bytes` : 'stream';
   logger.debug(`Starting PUT upload to presigned URL. Size: ${size}, Content-Type: ${contentType}`);
   
@@ -372,6 +375,7 @@ async function putToPresignedUrl(presignedUrl, data, contentType) {
     },
     maxContentLength: Infinity,
     maxBodyLength: Infinity,
+    ...(options.timeout ? { timeout: options.timeout } : {}),
     // Use a separate timeout for the actual upload if needed, 
     // but here we rely on the global axios or the one passed in.
   });
@@ -498,9 +502,106 @@ async function uploadCoverageReportDirectly(apiClient, target, coverageReport) {
   }
 }
 
+// The upload Worker refuses a metadata body above this on the old
+// POST .../metadata route (and the deployer never sent more through it).
+const METADATA_OLD_ROUTE_MAX_BYTES = 100 * 1024 * 1024;
+
+function metadataUrl(target, suffix, query = '') {
+  const project = encodeURIComponent(target.project || 'main');
+  const version = encodeURIComponent(target.version || 'latest');
+  return `/upload/${project}/${version}/metadata${suffix}${query}`;
+}
+
+/** An upload service older than the presign route answers 404 (no such route). */
+function isPresignRouteMissing(error) {
+  return error?.response?.status === 404;
+}
+
+/**
+ * Old route: POST the whole ZIP through the upload Worker. Kept for an upload
+ * service that has no presign route, up to METADATA_OLD_ROUTE_MAX_BYTES.
+ */
+async function uploadMetadataZipViaWorker(apiClient, target, fileBuffer, query, customLogger) {
+  const response = await postThroughService(apiClient, metadataUrl(target, '', query), fileBuffer, {
+    label: 'Metadata ZIP',
+    bytes: fileBuffer.length,
+    headers: { 'Content-Type': 'application/zip' },
+    log: customLogger,
+  });
+  const data = response.data || {};
+  customLogger.success(
+    `Metadata ZIP uploaded (build #${data.buildNumber ?? 'n/a'}, queued: ${Boolean(data.queued)})`
+  );
+  return {
+    success: true,
+    status: response.status,
+    queued: Boolean(data.queued),
+    buildNumber: data.buildNumber,
+    zipKey: data.zipKey,
+  };
+}
+
 /**
- * Upload metadata+screenshots ZIP.
- * This triggers async build-processing through the upload service queue.
+ * Ask the upload service to mark the build failed, with a reason, so a metadata
+ * upload that did not finish does not leave the build "pending" for ever.
+ * Never throws: when this cannot be done the caller is told, and the warning is
+ * printed here, so the build being left pending is never silent.
+ *
+ * @returns {Promise<boolean>} true when the service recorded the failure
+ */
+async function markMetadataUploadFailed(apiClient, target, buildId, reason, customLogger) {
+  if (!buildId) {
+    customLogger.warn('The build could not be marked failed: no build id is known (the upload service did not return one).');
+    return false;
+  }
+  try {
+    await postThroughService(apiClient, metadataUrl(target, '/failed'), { buildId, reason }, {
+      label: 'Mark build failed',
+      bytes: 0,
+      headers: { 'Content-Type': 'application/json' },
+      log: customLogger,
+    });
+    customLogger.info(`Build ${buildId} marked failed on the upload service.`);
+    return true;
+  } catch (error) {
+    customLogger.warn(
+      `The build could not be marked failed (${sanitizeServerText(error.response?.data?.error || describeUploadError(error))}); ` +
+      `build ${buildId} stays pending.`
+    );
+    return false;
+  }
+}
+
+/**
+ * presign + PUT in one retried unit: the presigned URL is signed at request
+ * time, so every attempt asks for a fresh one. `stage` says which half failed.
+ */
+async function presignAndPutMetadataZip(apiClient, target, fileBuffer, stage) {
+  return withUploadRetry(async () => {
+    stage.name = 'presign';
+    const response = await apiClient.post(metadataUrl(target, '/presign'), {}, { headers: { 'Content-Type': 'application/json' } });
+    const { url, key, buildId } = response.data || {};
+    if (!url || typeof url !== 'string') throw new ApiError(`The metadata presign response had no url (HTTP ${response.status}).`);
+    if (!key || typeof key !== 'string') throw new ApiError(`The metadata presign response had no key (HTTP ${response.status}).`);
+    if (!buildId || typeof buildId !== 'string') throw new ApiError(`The metadata presign response had no buildId (HTTP ${response.status}).`);
+    stage.buildId = buildId;
+    validatePresignedUrl(url);
+    stage.name = 'put';
+    // A PUT that stalls must end (and be retried, then marked failed), never hang the deploy.
+    await putToPresignedUrl(url, fileBuffer, 'application/zip', { timeout: uploadTimeoutMs(fileBuffer.length) });
+    return { buildId, buildNumber: response.data?.buildNumber, zipKey: key };
+  }, 'Metadata ZIP upload to storage');
+}
+
+/**
+ * Upload the metadata+screenshots ZIP and queue it for processing.
+ *
+ * The ZIP goes straight to storage on a presigned URL (presign, PUT, complete),
+ * so it never passes through the upload Worker and has no 100 MiB cap. Against
+ * an upload service that has no presign route (HTTP 404) the old route is used
+ * for a ZIP of up to 100 MiB, with a warning; a larger ZIP stops with
+ * "upload service too old for a ZIP this size". A failed PUT or complete marks
+ * the build failed (metadata/failed) and returns {success:false}.
  *
  * @param {axios.AxiosInstance} apiClient
  * @param {{project: string, version: string}} target
@@ -510,48 +611,93 @@ async function uploadCoverageReportDirectly(apiClient, target, coverageReport) {
  *   build document. Sent as query parameters so the service can record which
  *   commit a build's indexed rows came from (P13a). Omitted members are simply
  *   not sent; the service treats their absence as unknown rather than guessing.
- * @returns {Promise<{success:boolean, status?:number, queued?:boolean, buildNumber?:number, zipKey?:string, error?:string}>}
+ * @param {{buildId?: string}} [known] The build the storybook ZIP created, used
+ *   to mark it failed when the presign step itself fails.
+ * @returns {Promise<{success:boolean, status?:number, queued?:boolean, buildNumber?:number, zipKey?:string, error?:string, requestId?:string, markedFailed?:boolean}>}
  */
-async function uploadMetadataZip(apiClient, target, metadataZipPath, customLogger = logger, gitContext = {}) {
-  const projectName = target.project || 'main';
-  const versionName = target.version || 'latest';
+async function uploadMetadataZip(apiClient, target, metadataZipPath, customLogger = logger, gitContext = {}, known = {}) {
   const query = new URLSearchParams();
   if (gitContext.commitSha) query.set('commitSha', gitContext.commitSha);
   if (gitContext.branch) query.set('branch', gitContext.branch);
-  const suffix = query.toString() ? `?${query.toString()}` : '';
-  const url = `/upload/${projectName}/${versionName}/metadata${suffix}`;
+  const queryString = query.toString() ? `?${query.toString()}` : '';
 
   customLogger.info('Uploading metadata ZIP...');
 
+  const stage = { name: 'read', buildId: known.buildId };
+  let fileBuffer;
+  let presigned;
   try {
-    const fileBuffer = fs.readFileSync(metadataZipPath);
-    const response = await postThroughService(apiClient, url, fileBuffer, {
-      label: 'Metadata ZIP',
-      bytes: fileBuffer.length,
-      headers: { 'Content-Type': 'application/zip' },
-      log: customLogger,
-    });
+    fileBuffer = fs.readFileSync(metadataZipPath);
+    stage.name = 'presign';
+    presigned = await presignAndPutMetadataZip(apiClient, target, fileBuffer, stage);
+  } catch (error) {
+    if (stage.name === 'presign' && isPresignRouteMissing(error)) {
+      return uploadMetadataZipOldService(apiClient, target, fileBuffer, queryString, customLogger);
+    }
+    return failMetadataUpload(apiClient, target, stage, error, customLogger);
+  }
+  customLogger.info(`Metadata ZIP stored (${formatBytes(fileBuffer.length)}, build #${presigned.buildNumber ?? 'n/a'}).`);
 
+  stage.name = 'complete';
+  try {
+    const response = await postThroughService(
+      apiClient,
+      metadataUrl(target, '/complete', queryString),
+      { buildId: presigned.buildId, zipKey: presigned.zipKey },
+      { label: 'Metadata complete', bytes: 0, headers: { 'Content-Type': 'application/json' }, log: customLogger }
+    );
     const data = response.data || {};
     customLogger.success(
-      `Metadata ZIP uploaded (build #${data.buildNumber ?? 'n/a'}, queued: ${Boolean(data.queued)})`
+      `Metadata ZIP uploaded (build #${data.buildNumber ?? presigned.buildNumber ?? 'n/a'}, queued: ${Boolean(data.queued)})`
     );
-
     return {
       success: true,
       status: response.status,
       queued: Boolean(data.queued),
-      buildNumber: data.buildNumber,
-      zipKey: data.zipKey,
+      buildNumber: data.buildNumber ?? presigned.buildNumber,
+      zipKey: data.zipKey || presigned.zipKey,
     };
+  } catch (error) {
+    return failMetadataUpload(apiClient, target, stage, error, customLogger);
+  }
+}
+
+/** The upload service has no presign route: the old route, or a clear stop. */
+async function uploadMetadataZipOldService(apiClient, target, fileBuffer, queryString, customLogger) {
+  if (fileBuffer.length > METADATA_OLD_ROUTE_MAX_BYTES) {
+    const message =
+      `upload service too old for a ZIP this size (${formatBytes(fileBuffer.length)}; it has no presigned metadata upload ` +
+      `and its metadata route takes at most ${formatBytes(METADATA_OLD_ROUTE_MAX_BYTES)}). Update the upload service, then re-run.`;
+    customLogger.error(`Metadata ZIP upload failed: ${message}`);
+    return { success: false, error: message, markedFailed: false, markFailedUnsupported: true };
+  }
+  customLogger.warn(
+    'The upload service has no presigned metadata upload (HTTP 404); using the old route ' +
+    `(ZIP of ${formatBytes(fileBuffer.length)}, limit ${formatBytes(METADATA_OLD_ROUTE_MAX_BYTES)}).`
+  );
+  try {
+    return await uploadMetadataZipViaWorker(apiClient, target, fileBuffer, queryString, customLogger);
   } catch (error) {
     const message = sanitizeServerText(error.response?.data?.error || error.message || 'Unknown error');
-    const requestId = getRequestId(error);
     customLogger.error(`Metadata ZIP upload failed: ${message}`);
-    return { success: false, error: message, requestId };
+    return { success: false, error: message, requestId: getRequestId(error), markedFailed: false, markFailedUnsupported: true };
   }
 }
 
+/** A step of the presigned flow failed for good: say so, mark the build failed. */
+async function failMetadataUpload(apiClient, target, stage, error, customLogger) {
+  // Never print the presigned URL (it carries a signature): an error from the
+  // PUT is described by status or code only.
+  const detail = stage.name === 'put' || stage.name === 'read'
+    ? sanitizeServerText(describeUploadError(error))
+    : sanitizeServerText(error.response?.data?.error || error.message || 'Unknown error');
+  const step = { read: 'reading the ZIP', presign: 'requesting the upload URL', put: 'sending the ZIP to storage', complete: 'completing the upload' }[stage.name];
+  const message = sanitizeServerText(`${step} failed: ${detail}`);
+  customLogger.error(`Metadata ZIP upload failed: ${message}`);
+  const markedFailed = await markMetadataUploadFailed(apiClient, target, stage.buildId, `metadata upload failed while ${step}: ${detail}`, customLogger);
+  return { success: false, error: message, requestId: getRequestId(error), markedFailed, buildId: stage.buildId };
+}
+
 /**
  * Upload storybook zip plus optional coverage report.
  *
@@ -619,6 +765,7 @@ async function uploadBuild(apiClient, target, options) {
       options.metadataZipPath,
       logger,
       options.gitContext || {},
+      { buildId: zipUpload?.buildId },
     );
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrymore/scry-deployer",
-  "version": "0.12.0-next.20261006020714",
+  "version": "0.12.0",
   "description": "A CLI to automate the deployment of Storybook static builds.",
   "main": "index.js",
   "bin": {

package/scripts/check-skill-install.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# AT-16: install skills/scry-native-capture-setup from this checkout with `npx skills add` into a
+# throwaway HOME and project, then check the skill landed and its SKILL.md frontmatter parses.
+# Usage: bash scripts/check-skill-install.sh [skill-name]   (default: scry-native-capture-setup)
+# Also fails if the skill names the old epinnock/scry-node repo. Needs network for `npx skills` (npm registry) the first time. Never touches the real HOME or repo.
+set -euo pipefail
+SKILL="${1:-scry-native-capture-setup}"
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+mkdir -p "$TMP/home" "$TMP/project"
+git -C "$TMP/project" init -q .
+
+# F14: the skill must name the canonical repo, never the old epinnock/ name.
+if grep -rn "epinnock/scry-node" "$REPO/skills/$SKILL" >/dev/null 2>&1; then
+  echo "FAIL: skills/$SKILL still mentions epinnock/scry-node (use scryorg/scry-node)" >&2; exit 1
+fi
+grep -q "npx skills add scryorg/scry-node --skill $SKILL" "$REPO/skills/$SKILL/SKILL.md" \
+  || { echo "FAIL: SKILL.md does not show 'npx skills add scryorg/scry-node --skill $SKILL'" >&2; exit 1; }
+echo "canonical install command: npx skills add scryorg/scry-node --skill $SKILL (this script installs from the local checkout)"
+
+echo "install: npx skills add $REPO --skill $SKILL  (HOME=$TMP/home)"
+(cd "$TMP/project" && HOME="$TMP/home" npx --yes skills add "$REPO" --skill "$SKILL" -y >"$TMP/install.log" 2>&1) \
+  || { tail -20 "$TMP/install.log" >&2; echo "FAIL: skills add exited non-zero" >&2; exit 1; }
+
+# The installer writes the canonical copy to .agents/skills/<name> and links Claude Code to it
+# (other agents such as Amp get a rewritten copy under agent/skills; not checked here).
+FOUND="$TMP/project/.agents/skills/$SKILL/SKILL.md"
+[ -f "$FOUND" ] || { tail -20 "$TMP/install.log" >&2; echo "FAIL: .agents/skills/$SKILL/SKILL.md not found after install" >&2; exit 1; }
+echo "landed:  ${FOUND#"$TMP"/}"
+[ -f "$TMP/project/.claude/skills/$SKILL/SKILL.md" ] || { echo "FAIL: Claude Code link .claude/skills/$SKILL missing" >&2; exit 1; }
+echo "landed:  project/.claude/skills/$SKILL/SKILL.md (Claude Code)"
+
+# Only the requested skill may have been installed (no scry-setup riding along).
+OTHERS="$(find "$TMP/project/.agents/skills" -mindepth 2 -maxdepth 2 -name SKILL.md ! -path "*/$SKILL/*" 2>/dev/null || true)"
+[ -z "$OTHERS" ] || { echo "FAIL: unexpected extra skills installed: $OTHERS" >&2; exit 1; }
+
+SKILL_MD="$FOUND" SKILL_NAME="$SKILL" node -e '
+const fs = require("fs"), path = require("path");
+const file = process.env.SKILL_MD, name = process.env.SKILL_NAME;
+const text = fs.readFileSync(file, "utf8");
+const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n/.exec(text);
+if (!m) { console.error("FAIL: no YAML frontmatter"); process.exit(1); }
+const fm = {};
+for (const line of m[1].split(/\r?\n/)) { const k = /^([A-Za-z_-]+):\s*(.*)$/.exec(line); if (k) fm[k[1]] = k[2].trim(); }
+if (fm.name !== name) { console.error(`FAIL: frontmatter name "${fm.name}" != "${name}"`); process.exit(1); }
+if (!fm.description || fm.description.length < 40 || fm.description.length > 1024) { console.error("FAIL: description missing or outside 40..1024 chars"); process.exit(1); }
+// every relative link in SKILL.md must resolve inside the installed skill
+const dir = path.dirname(file), bad = [];
+for (const l of text.matchAll(/\]\((?!https?:|#)([^)\s]+)\)/g)) if (!fs.existsSync(path.join(dir, l[1]))) bad.push(l[1]);
+if (bad.length) { console.error("FAIL: broken relative links: " + bad.join(", ")); process.exit(1); }
+const files = fs.readdirSync(dir, { recursive: true }).filter((f) => fs.statSync(path.join(dir, f)).isFile());
+console.log(`frontmatter ok: name=${fm.name}, description ${fm.description.length} chars, ${files.length} files installed`);
+'
+
+# scry-native-capture-setup covers Flutter (feature flutter-capture): the Flutter files must have landed, the
+# skill must not still refuse Flutter, and UIKit-only must still be refused with the pointer to bundle.md.
+if [ "$SKILL" = scry-native-capture-setup ]; then
+  D="$TMP/project/.agents/skills/$SKILL"
+  for f in references/flutter.md references/bundle.md assets/make-scf.mjs assets/flutter/capture.sh assets/flutter/screens.dart \
+           assets/flutter/screens.json assets/flutter/scry_capture_test.dart assets/flutter/headless_scry_capture_test.dart \
+           assets/flutter/test_driver_integration_test.dart assets/flutter/scry_fonts.dart assets/flutter/scry_registry_test.dart; do
+    [ -f "$D/$f" ] || { echo "FAIL: $f missing from the installed skill" >&2; exit 1; }
+  done
+  if grep -Eqi 'not for[^.]*flutter|UIKit-only, Flutter' "$D/SKILL.md"; then
+    echo "FAIL: SKILL.md still refuses Flutter" >&2; exit 1
+  fi
+  grep -qi 'UIKit-only' "$D/SKILL.md" && grep -q 'references/bundle.md' "$D/SKILL.md" \
+    || { echo "FAIL: SKILL.md no longer refuses UIKit-only with the pointer to references/bundle.md" >&2; exit 1; }
+  grep -q 'references/flutter.md' "$D/SKILL.md" || { echo "FAIL: SKILL.md does not link references/flutter.md" >&2; exit 1; }
+  echo "flutter: reference and assets installed, Flutter no longer refused, UIKit-only still refused"
+fi
+echo "PASS: $SKILL installs and parses"

package/scripts/check-skill-sync.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Drift check: the skill's assets/ are copies of the Kettle sample apps (the sample apps are canonical).
+# Usage: bash scripts/check-skill-sync.sh <scry-sample-ios dir> <scry-sample-android dir> <scry-sample-flutter dir>
+# Exit 0 = every copy matches its sample and the CI templates keep the G5 guards; 1 = drift (diff shown).
+# The Flutter sample is the third argument; for the Flutter copies of make-scf.mjs (the sample's, iOS's and
+# Android's) the rule is byte-identical to the skill asset (feature flutter-capture, guarantee 6); see the end.
+set -euo pipefail
+[ $# -eq 3 ] || { echo "usage: $0 <ios-sample-dir> <android-sample-dir> <flutter-sample-dir>" >&2; exit 2; }
+IOS="$1"; AND="$2"; FLU="$3"
+ASSETS="$(cd "$(dirname "$0")/../skills/scry-native-capture-setup/assets" && pwd)"
+AK="$AND/app/src"; fail=0
+
+check() { # <asset> <sample file>
+  if [ ! -f "$2" ]; then echo "MISSING sample file: $2"; fail=1
+  elif diff -u "$2" "$ASSETS/$1" >"${TMPDIR:-/tmp}/skill-sync.diff"; then echo "ok     $1 == $2"
+  else echo "DRIFT  $1 differs from $2"; cat "${TMPDIR:-/tmp}/skill-sync.diff"; fail=1; fi
+}
+check ScryLaunch.swift        "$IOS/Kettle/ScryLaunch.swift"
+check ScryScreens.swift       "$IOS/Kettle/ScryScreens.swift"
+check capture-ios.sh          "$IOS/scripts/capture.sh"
+check make-scf.mjs            "$IOS/scripts/make-scf.mjs"
+check scry-capture-ios.yml    "$IOS/.github/workflows/scry-capture.yml"
+check ScryLaunch.kt           "$(ls "$AK"/debug/java/*/*/*/ScryLaunch.kt 2>/dev/null | head -1)"
+check ScryScreens.kt          "$(ls "$AK"/debug/java/*/*/*/ScryScreens.kt 2>/dev/null | head -1)"
+check ScryLaunch-release.kt   "$(ls "$AK"/release/java/*/*/*/ScryLaunch.kt 2>/dev/null | head -1)"
+check capture-android.sh      "$AND/scripts/capture.sh"
+check scry-capture-android.yml "$AND/.github/workflows/scry-capture.yml"
+
+# Flutter (the sample is canonical for logic; screens.dart and screens.json are templates the user fills in, so
+# they only have to exist in both places).
+F="$ASSETS/flutter"
+check flutter/scry_capture_test.dart          "$FLU/integration_test/scry_capture_test.dart"
+check flutter/test_driver_integration_test.dart "$FLU/test_driver/integration_test.dart"
+check flutter/headless_scry_capture_test.dart "$FLU/test/scry_capture_test.dart"
+check flutter/capture.sh                      "$FLU/scripts/capture.sh"
+check flutter/scry_fonts.dart                 "$FLU/test/scry_fonts.dart"
+check flutter/scry_registry_test.dart         "$FLU/test/scry_registry_test.dart"
+for t in screens.dart screens.json; do [ -f "$F/$t" ] && echo "ok     flutter/$t template present" || { echo "MISSING flutter/$t template"; fail=1; }; done
+[ -f "$FLU/integration_test/scry/screens.dart" ] && [ -f "$FLU/scripts/screens.json" ] \
+  && echo "ok     Flutter sample has its registry and screens.json" || { echo "MISSING Flutter sample registry or screens.json"; fail=1; }
+check make-scf.mjs                            "$FLU/scripts/make-scf.mjs"
+# make-scf.mjs is shared and must be byte-identical in the skill and all three samples (the iOS copy is checked above).
+check make-scf.mjs                            "$AND/scripts/make-scf.mjs"
+
+# G5 on the CI templates: default branch only, no pull_request(_target), no self-hosted, key only on upload.
+for y in scry-capture-ios.yml scry-capture-android.yml; do
+  f="$ASSETS/$y"
+  grep -Eq '^\s*(pull_request|pull_request_target)\s*:' "$f" && { echo "G5 FAIL $y: pull_request trigger"; fail=1; }
+  grep -qi 'self-hosted' "$f" && { echo "G5 FAIL $y: self-hosted"; fail=1; }
+  grep -q 'branches: \[main\]' "$f" || { echo "G5 FAIL $y: not limited to a branch"; fail=1; }
+  n="$(grep -c 'secrets\.' "$f")"; [ "$n" -eq 1 ] || { echo "G5 FAIL $y: secrets referenced $n times (want 1, the upload step)"; fail=1; }
+done
+[ "$fail" -eq 0 ] && echo "PASS: skill assets match the samples, CI guards intact" || { echo "FAIL: drift found" >&2; exit 1; }