@skaile/workspaces 6.3.0 → 6.5.0

package/dist/{chunk-EQNIBBB6.js → chunk-TROEC2Z2.js}

@@ -1,17 +1,19 @@
-import { checkAgentInstances, unknownKeyWarnings, unknownHarnessErrors } from './chunk-KIPCBIFJ.js';
-import { registeredAssetKeys, unresolvedManifestDependencies, warnIgnoredDomainFiles, warnLegacyBundleFiles, removedDomainOption, rejectRemovedDomainOption, reportLibrarySymlinks, composeRefContext, assetEntryRef, manifestPublisherProblems, manifestRootProblems, manifestFilesProblems, manifestEntryNameProblems, manifestRequiresProblems, checkAssetFile, findEntryManifestFile, declaredVersion, manifestVersionMismatchMessage, MANIFEST_GLOBS, manifestParseErrorText, checkAsset, invalidPublisherMessage, invalidSemverText } from './chunk-ROVZCGTN.js';
-import { getKindRegistry } from './chunk-YW4ASEUP.js';
-import { logErr, logInfo, logWarn, logOk } from './chunk-7QG2WRSN.js';
-import { validateFlowVersions } from './chunk-URCJIV7T.js';
-import { loadFlow } from './chunk-RFQONXET.js';
+import { unknownKeyWarnings, unknownHarnessErrors } from './chunk-J6YPKMMY.js';
+import { checkAgentInstances } from './chunk-ETF6Q3R3.js';
+import { loadDeclaredPlugins } from './chunk-THX5EE3K.js';
+import { registeredAssetKeys, unresolvedManifestDependencies, warnIgnoredDomainFiles, warnLegacyBundleFiles, removedDomainOption, rejectRemovedDomainOption, reportLibrarySymlinks, composeRefContext, assetEntryRef, manifestPublisherProblems, manifestRootProblems, manifestFilesProblems, manifestEntryNameProblems, manifestRequiresProblems, checkAssetFile, findEntryManifestFile, declaredVersion, manifestVersionMismatchMessage, MANIFEST_GLOBS, manifestParseErrorText, checkAsset, invalidPublisherMessage, invalidSemverText, DEFAULT_VERSION } from './chunk-7EMS2GZO.js';
+import { getKindRegistry } from './chunk-WFLQMAR5.js';
+import { logErr, logInfo, logWarn, logOk } from './chunk-Z2X7UZEZ.js';
+import { validateFlowVersions } from './chunk-W5KCAWGN.js';
+import { loadFlow } from './chunk-X44XKBZX.js';
 import { flowSkillVersionPins } from './chunk-7RGTAEG6.js';
-import { missingRootAssets, assertManifestEditable, scanUnlistedAssets, UNLISTED_SCAN_SKIP_DIRS } from './chunk-Y3I4KGLX.js';
-import { parseManifestFile } from './chunk-XEVFSDIF.js';
-import { resolveRuntimeAssets } from './chunk-6WH2WE4B.js';
-import { decodeSkaileYaml, localConnectorMountDir, symlinkEscapeOfProject, isInsideProject } from './chunk-XBQTXGY4.js';
-import { SKAILE_MANIFEST_FILENAME, loadSkPublishManifest, isNonAssetPath } from './chunk-KPKGWXUJ.js';
-import { withYamlQuotingHint, readAssetBody } from './chunk-JMIKGAUA.js';
-import { parseAssetRef, isValidPublisher, isValidAssetName, ASSET_NAME_HINT } from './chunk-IZQOO6MN.js';
+import { missingRootAssets, assertManifestEditable, scanUnlistedAssets, UNLISTED_SCAN_SKIP_DIRS } from './chunk-TGUMN5G7.js';
+import { parseManifestFile } from './chunk-22ZX33H6.js';
+import { resolveRuntimeAssets } from './chunk-G4NCSYWR.js';
+import { decodeSkaileYaml, localConnectorMountDir, symlinkEscapeOfProject, isInsideProject } from './chunk-IWKKTCXY.js';
+import { SKAILE_MANIFEST_FILENAME, loadSkPublishManifest, isNonAssetPath } from './chunk-23SG4JRV.js';
+import { withYamlQuotingHint, readAssetBody } from './chunk-AVFRFGM2.js';
+import { parseAssetRef, isValidPublisher, isValidAssetName, ASSET_NAME_HINT } from './chunk-V5KG6CCV.js';
 import { execFileSync } from 'child_process';
 import fs from 'fs';
 import path from 'path';
@@ -329,13 +331,20 @@ async function validateWorkspaceManifests(rootPath) {
       logErr(`${relPath} [connectors] \u2014 ${d.code}: ${d.path ? `${d.path}: ` : ""}${d.message}`);
       errors++;
     }
+    for (const d of decoded.diagnostics) {
+      if (d.code !== "invalid_source_entry") continue;
+      logErr(`${relPath} \u2014 parse error: ${d.message}`);
+      errors++;
+    }
     for (const d of decoded.diagnostics) {
       if (d.code !== "legacy_key_rejected") continue;
       logErr(relPath === "skaile.yaml" ? d.message : `${relPath} \u2014 ${d.message}`);
       errors++;
     }
     for (const d of decoded.diagnostics) {
-      if (d.code !== "deprecated_harness_key" && d.code !== "harness_key_conflict") continue;
+      if (!["deprecated_harness_key", "retired_agent_key", "harness_key_conflict"].includes(d.code)) {
+        continue;
+      }
       const line = `${relPath} [agent-config] \u2014 ${d.code}: ${d.message}`;
       if (d.severity === "error") {
         logErr(line);
@@ -355,7 +364,11 @@ async function validateWorkspaceManifests(rootPath) {
       decoded.config?.connectors ?? []
     );
     if ((decoded.config?.connectors ?? []).length > 0) {
-      const assets = await resolveRuntimeAssets(path.dirname(file));
+      await loadDeclaredPlugins(path.dirname(file));
+      const { listConnectors } = await import('./connectors/index.js');
+      const assets = await resolveRuntimeAssets(path.dirname(file), {
+        isDriverRegistered: (driver) => listConnectors().includes(driver)
+      });
       if (!assets.warnings.some((w) => w.code === "repo_unavailable")) {
         for (const w of assets.warnings) {
           if (w.code !== "missing_driver" || !w.name) continue;
@@ -514,7 +527,7 @@ function readAssetVersion(c) {
     return {
       kind,
       name: typeof data.name === "string" ? data.name : kind === "prompt" ? stem : dirName,
-      version: declaredVersion(data) ?? "",
+      version: res.ok ? declaredVersion(data) ?? DEFAULT_VERSION : "",
       filePath: c.filePath
     };
   }
@@ -523,18 +536,19 @@ function readAssetVersion(c) {
     parsed = parse(content);
   } catch {
   }
+  const version = parsed ? String(parsed.version ?? DEFAULT_VERSION) : "";
   if (kind === "flow") {
     return {
       kind,
       name: String(parsed?.id ?? fileName.replace(".flow.yaml", "")),
-      version: String(parsed?.version ?? ""),
+      version,
       filePath: c.filePath
     };
   }
   return {
     kind,
     name: String(parsed?.name ?? dirName),
-    version: String(parsed?.version ?? ""),
+    version,
     filePath: c.filePath
   };
 }
@@ -892,5 +906,5 @@ function makeValidateCommand() {
 }
 
 export { makeValidateCommand, scanIdentities };
-//# sourceMappingURL=chunk-EQNIBBB6.js.map
-//# sourceMappingURL=chunk-EQNIBBB6.js.map
+//# sourceMappingURL=chunk-TROEC2Z2.js.map
+//# sourceMappingURL=chunk-TROEC2Z2.js.map

package/dist/chunk-TROEC2Z2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../cli/src/commands/validate.ts"],"names":["parseYaml","parsed","a","c"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqFA,IAAM,+BAAoC,IAAI,GAAA,CAAI,CAAC,SAAA,EAAW,QAAA,EAAU,MAAM,CAAC,CAAA;AAE/E,IAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EACxB,cAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,aAAA;AAAA,EACA,GAAG;AACL,CAAC,CAAA;AAQD,SAAS,uBAAuB,QAAA,EAAuC;AACrE,EAAA,MAAM,aAAkC,EAAC;AAEzC,EAAA,SAAS,KAAK,GAAA,EAAmB;AAC/B,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,GAAG,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA;AAC1C,MAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,QAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,MAAM,IAAI,CAAA,OAAQ,QAAQ,CAAA;AAAA,MAC/C,CAAA,MAAA,IAAW,KAAA,CAAM,MAAA,EAAO,EAAG;AACzB,QAAA,KAAA,MAAW,QAAQ,cAAA,EAAgB;AACjC,UAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC/B,YAAA,UAAA,CAAW,KAAK,EAAE,QAAA,EAAU,UAAU,IAAA,EAAM,IAAA,CAAK,MAAM,CAAA;AACvD,YAAA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAA,CAAK,QAAQ,CAAA;AACb,EAAA,OAAO,UAAA;AACT;AAQA,SAAS,sBAAA,CACP,GACA,OAAA,EACuE;AACvE,EAAA,MAAM,OAAA,GAAU,EAAA,CAAG,YAAA,CAAa,CAAA,CAAE,UAAU,OAAO,CAAA;AACnD,EAAA,MAAM,GAAA,GAAM,iBAAA,CAAkB,CAAA,CAAE,QAAA,EAAU,OAAO,CAAA;AACjD,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAA;AAAA,MACE,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS,EAAE,QAAQ,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,IAAI,CAAA,SAAA,EAAO,sBAAA,CAAuB,GAAA,CAAI,MAAM,CAAC,CAAA;AAAA,KAC3F;AACA,IAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AAAA,EACzB;AACA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,QAAQ,GAAA,CAAI,IAAA;AAAA,IACZ,IAAA,EAAM,aAAA,CAAc,CAAA,CAAE,QAAA,EAAU,OAAO;AAAA,GACzC;AACF;AAMA,SAAS,cAAc,OAAA,EAAyB;AAC9C,EAAA,KAAA,IAAS,MAAM,OAAA,IAAW,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,EAAG;AACjD,IAAA,IAAI,EAAA,CAAG,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,wBAAwB,CAAC,GAAG,OAAO,GAAA;AACpE,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,KAAK,OAAO,OAAA;AAAA,EACxC;AACF;AAMA,SAAS,0BACP,CAAA,EACA,MAAA,EACA,MACA,OAAA,EACA,QAAA,EACA,mBACA,WAAA,EACsC;AACtC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS,EAAE,QAAQ,CAAA;AACjD,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI,QAAA,GAAW,CAAA;AAKf,EAAA,MAAM,UAAU,IAAA,CAAK,QAAA,CAAS,KAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAC,CAAA;AACtD,EAAA,MAAM,OAAA,GAAU,UAAA;AAAA,IACd,CAAA,CAAE,IAAA;AAAA,IACD,UAAU,EAAC;AAAA,IACZ,IAAA;AAAA,IACA,OAAA;AAAA,IACA,QAAA;AAAA,IACA,EAAA,CAAG,YAAA,CAAa,CAAA,CAAE,QAAA,EAAU,OAAO,CAAA;AAAA,IACnC,IAAA,CAAK,QAAA,CAAS,CAAA,CAAE,QAAQ,CAAA;AAAA,IACxB,EAAE,GAAA,EAAK,IAAA,CAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,EAAG,WAAA,EAAa,aAAA,CAAc,OAAO,CAAA,EAAG,WAAA;AAAY,GACpF;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,MAAA,EAAQ;AAC9B,IAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,CAAA,CAAE,GAAG,CAAA,SAAA,EAAO,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAC1C,IAAA,MAAA,EAAA;AAAA,EACF;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,UAAA,EAAY;AAClC,IAAA,MAAM,IAAA,GAAO,GAAG,OAAO,CAAA,EAAA,EAAK,EAAE,GAAG,CAAA,SAAA,EAAO,EAAE,IAAI,CAAA,CAAA;AAE9C,IAAA,IAAK,CAAA,CAAE,WAAA,IAAe,iBAAA,IAAsB,CAAA,CAAE,YAAA,EAAc;AAC1D,MAAA,MAAA,CAAO,IAAI,CAAA;AACX,MAAA,MAAA,EAAA;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA,QAAA,EAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC5B;AAMO,SAAS,eAAe,IAAA,EAA2B;AACxD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,KAAA,MAAW,CAAA,IAAK,sBAAA,CAAuB,IAAI,CAAA,EAAG;AAC5C,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,kBAAkB,CAAA,CAAE,QAAA,EAAU,GAAG,YAAA,CAAa,CAAA,CAAE,QAAA,EAAU,OAAO,CAAC,CAAA;AAC9E,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACb,MAAA,MAAA,GAAS,GAAA,CAAI,IAAA;AAAA,IACf,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,EAAU;AACnD,IAAA,MAAM,WAAY,MAAA,CAAmC,CAAA,CAAE,IAAA,KAAS,MAAA,GAAS,OAAO,MAAM,CAAA;AACtF,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,CAAA;AACpD,MAAA,UAAA,CAAW,IAAI,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,kBACd,QAAA,EACA,iBAAA,EACA,gBAAA,mBAAwC,IAAI,KAAI,EACK;AACrD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,OAAO,CAAA,EAAG;AAC3B,IAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,OAAO,CAAA,CAAE,CAAA;AACxC,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAQ,CAAA,EAAG,UAAU,CAAA,EAAE;AAAA,EAC5C;AAEA,EAAA,MAAM,WAA+B,eAAA,EAAgB;AACrD,EAAA,MAAM,UAAA,GAAa,uBAAuB,OAAO,CAAA;AAMjD,EAAA,MAAM,YAAY,EAAA,CAAG,UAAA,CAAW,KAAK,IAAA,CAAK,OAAA,EAAS,wBAAwB,CAAC,CAAA;AAG5E,EAAA,IAAI,MAAA,GAAS,sBAAsB,OAAA,EAAS;AAAA,IAC1C,SAAA,EAAW,SAAA;AAAA,IACX,QAAA,EAAU,YAAY,MAAA,GAAY;AAAA,GACnC,CAAA;AACD,EAAA,IAAI,QAAA,GAAW,CAAA;AAIf,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAoB;AAI7C,EAAA,MAAM,WAAA,GAAc,cAAc,OAAO,CAAA;AACzC,EAAA,MAAM,WAAA,GAAc,iBAAA;AAAA,IAClB,eAAe,WAAW,CAAA;AAAA,IAC1B,gBAAA;AAAA,IACA,qBAAA,CAAsB,WAAW,CAAA,EAAG;AAAA,GACtC;AACA,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,MAAM,WAAA,GAAc,sBAAA,CAAuB,CAAA,EAAG,OAAO,CAAA;AACrD,IAAA,IAAI,WAAA,CAAY,SAAS,OAAA,EAAS;AAChC,MAAA,MAAA,EAAA;AACA,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,KAAA,GAAQ,yBAAA;AAAA,MACZ,CAAA;AAAA,MACA,WAAA,CAAY,MAAA;AAAA,MACZ,WAAA,CAAY,IAAA;AAAA,MACZ,OAAA;AAAA,MACA,QAAA;AAAA,MACA,iBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAA,IAAU,KAAA,CAAM,MAAA;AAChB,IAAA,QAAA,IAAY,KAAA,CAAM,QAAA;AAClB,IAAA,MAAM,MAAM,WAAA,CAAY,MAAA;AACxB,IAAA,MAAM,QAAA,GAAW,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,CAAI,CAAA,CAAE,IAAA,KAAS,MAAA,GAAS,IAAA,GAAO,MAAM,CAAA,GAAI,IAAA;AAC3F,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,CAAS,SAAS,CAAA,EAAG;AACvD,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA;AACnC,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,CAAA,CAAE,IAAI,IAAI,QAAQ,CAAA,CAAA;AACjC,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AAClC,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,YAAA,CAAa,GAAA,CAAI,KAAK,GAAG,CAAA;AAAA,MAC3B,CAAA,MAAA,IAAW,UAAU,GAAA,EAAK;AACxB,QAAA,MAAA;AAAA,UACE,GAAG,IAAA,CAAK,QAAA,CAAS,SAAS,CAAA,CAAE,QAAQ,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,IAAI,CAAA,SAAA,EAAO,GAAG,CAAA,oBAAA,EAAuB,IAAA,CAAK,SAAS,OAAA,EAAS,KAAK,KAAK,GAAG,CAAA,+FAAA;AAAA,SAEvH;AACA,QAAA,MAAA,EAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,UAAA,CAAW,MAAA,EAAQ,QAAQ,QAAA,EAAS;AACtD;AAGA,SAAS,uBAAuB,QAAA,EAA4B;AAC1D,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,SAAS,KAAK,GAAA,EAAmB;AAC/B,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,GAAG,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA;AACtC,MAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,QAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,MAAM,IAAI,CAAA,OAAQ,IAAI,CAAA;AAAA,MAC3C,CAAA,MAAA,IAAW,MAAM,MAAA,EAAO,IAAK,sBAAsB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG;AACnE,QAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAA,CAAK,QAAQ,CAAA;AACb,EAAA,OAAO,GAAA;AACT;AAcA,SAAS,0BAA0B,MAAA,EAA0D;AAC3F,EAAA,MAAM,YAAqC,EAAC;AAC5C,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAA,EAAG;AACtC,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,YAAA,EAAc;AACnC,MAAA,IAAI,OAAO,MAAM,QAAA,EAAU,SAAA,CAAU,KAAK,CAAC,cAAA,EAAgB,CAAC,CAAC,CAAA;AAAA,IAC/D;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AACnC,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,SAAA,EAAW;AAChC,MAAA,MAAM,MAAO,CAAA,EAA+B,GAAA;AAC5C,MAAA,IAAI,OAAO,QAAQ,QAAA,EAAU,SAAA,CAAU,KAAK,CAAC,eAAA,EAAiB,GAAG,CAAC,CAAA;AAAA,IACpE;AAAA,EACF;AACA,EAAA,OAAO,SAAA;AACT;AAGA,SAAS,qBAAA,CAAsB,WAAoC,OAAA,EAAyB;AAC1F,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAG,CAAA,IAAK,SAAA,EAAW;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,cAAc,GAAG,CAAA;AAGnC,MAAA,MAAM,SAAA,GAAY,SAAA,CAAU,SAAA,EAAW,OAAA,CAAQ,MAAM,EAAE,CAAA;AACvD,MAAA,IAAI,SAAA,KAAc,KAAA,CAAA,IAAa,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAC3D,QAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,KAAK,CAAA,SAAA,EAAO,GAAG,CAAA,EAAA,EAAK,uBAAA,CAAwB,SAAS,CAAC,CAAA,CAAE,CAAA;AAC9E,QAAA,MAAA,EAAA;AAAA,MACF;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,KAAK,CAAA,SAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAC9E,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,uBAAA,CAAwB,QAAiC,OAAA,EAAyB;AACzF,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,MAAM,GAAG,OAAO,CAAA;AAC1C,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,MAAM,eAAe,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,GAAW,OAAO,SAAA,GAAY,MAAA;AAC/E,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,MAAA,EAAQ;AAC7B,IAAA,MAAM,KAAA,GAAQ,CAAA;AACd,IAAA,MAAM,OAAO,KAAA,EAAO,IAAA;AACpB,IAAA,MAAM,OAAO,OAAO,KAAA,EAAO,IAAA,KAAS,QAAA,GAAW,MAAM,IAAA,GAAO,OAAA;AAC5D,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,WAAW,CAAA,EAAG;AACnD,IAAA,MAAM,YAAY,OAAO,KAAA,EAAO,SAAA,KAAc,QAAA,GAAW,MAAM,SAAA,GAAY,YAAA;AAC3E,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,aAAA,CAAc,GAAG,IAAI,CAAA,EAAA,EAAK,SAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAAA,MAC/C,SAAS,CAAA,EAAG;AACV,QAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,iBAAA,EAAe,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAC5E,QAAA,MAAA,EAAA;AAAA,MACF;AAAA,IACF,CAAA,MAAA,IAAW,CAAC,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAClC,MAAA,MAAA,CAAO,GAAG,OAAO,CAAA,qCAAA,EAAmC,IAAI,CAAA,SAAA,EAAO,eAAe,CAAA,CAAE,CAAA;AAChF,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGA,IAAM,qBAAA,GAA2C;AAAA,EAC/C,0BAAA;AAAA,EACA,sBAAA;AAAA,EACA,wBAAA;AAAA,EACA;AACF,CAAA;AAOA,SAAS,gCAAA,CACP,UAAA,EACA,OAAA,EACA,UAAA,EACQ;AACR,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI,CAAA,CAAE,MAAA,KAAW,OAAA,IAAW,CAAA,CAAE,KAAA,EAAO;AACrC,IAAA,MAAM,GAAA,GAAM,sBAAA,CAAuB,CAAA,EAAG,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,GAAA,EAAK;AACV,IAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,GAAA,EAAK,UAAU,CAAA;AACxD,IAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,GAAG,CAAA,EAAG;AACvB,MAAA,MAAA;AAAA,QACE,GAAG,OAAO,CAAA,8DAAA,EAA4D,CAAA,CAAE,EAAE,eAAe,GAAG,CAAA,qDAAA;AAAA,OAC9F;AACA,MAAA,MAAA,EAAA;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,IAAA,EAAM;AAC7B,MAAA,MAAA;AAAA,QACE,CAAA,EAAG,OAAO,CAAA,8DAAA,EAA4D,CAAA,CAAE,EAAE,eAAe,GAAG,CAAA,iBAAA,EAAoB,SAAS,CAAA,sBAAA,EAAyB,UAAU,CAAA,uCAAA;AAAA,OAC9J;AACA,MAAA,MAAA,EAAA;AAAA,IACF,CAAA,MAAA,IAAW,CAAC,eAAA,CAAgB,GAAA,EAAK,UAAU,CAAA,EAAG;AAC5C,MAAA,OAAA;AAAA,QACE,CAAA,EAAG,OAAO,CAAA,gCAAA,EAA8B,CAAA,CAAE,EAAE,CAAA,YAAA,EAAe,GAAG,CAAA,wBAAA,EAA2B,UAAU,CAAA,iBAAA,EAAoB,CAAA,CAAE,MAAA,KAAW,YAAA,GAAe,gBAAgB,EAAE,CAAA,MAAA;AAAA,OACvK;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,2BAA2B,QAAA,EAGvC;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,uBAAuB,OAAO,CAAA;AAC5C,EAAA,IAAI,MAAA,GAAS,CAAA;AAEb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS,IAAI,CAAA;AAC3C,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,EAAA,CAAG,YAAA,CAAa,IAAA,EAAM,OAAO,CAAA;AACpC,MAAA,MAAA,GAAUA,KAAA,CAAU,IAAI,CAAA,IAAK,EAAC;AAAA,IAChC,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,UAAU,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC,CAAA;AACzD,MAAA,MAAA,CAAO,GAAG,OAAO,CAAA,qBAAA,EAAmB,oBAAoB,OAAA,EAAS,IAAI,CAAC,CAAA,CAAE,CAAA;AACxE,MAAA,MAAA,EAAA;AACA,MAAA;AAAA,IACF;AAGA,IAAA,MAAM,UAAA,GAAa,gBAAA,CAAiB,IAAI,CAAA,CAAE,WAAA,CAAY,IAAA;AAAA,MACpD,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,iBAAA,IAAqB,EAAE,IAAA,KAAS;AAAA,KACpD;AACA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,qBAAA,EAAmB,UAAA,CAAW,OAAO,CAAA,CAAE,CAAA;AACxD,MAAA,MAAA,EAAA;AACA,MAAA;AAAA,IACF;AAEA,IAAA,MAAA,IAAU,qBAAA,CAAsB,yBAAA,CAA0B,MAAM,CAAA,EAAG,OAAO,CAAA;AAC1E,IAAA,MAAA,IAAU,uBAAA,CAAwB,QAAQ,OAAO,CAAA;AACjD,IAAA,KAAA,MAAW,KAAK,mBAAA,CAAoB,IAAA,CAAK,QAAQ,IAAI,CAAA,EAAG,MAAM,CAAA,EAAG;AAC/D,MAAA,MAAM,OAAO,CAAA,EAAG,OAAO,CAAA,iBAAA,EAAe,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,IAAA,GAAO,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,CAAA,GAAO,EAAE,CAAA,EAAG,EAAE,OAAO,CAAA,CAAA;AACxF,MAAA,IAAI,CAAA,CAAE,aAAa,OAAA,EAAS;AAC1B,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA,MAAA,EAAA;AAAA,MACF,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,MACd;AAAA,IACF;AAGA,IAAA,MAAM,UAAU,gBAAA,CAAiB,EAAA,CAAG,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AAC/D,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,WAAA,EAAa;AACnC,MAAA,IAAI,CAAC,qBAAA,CAAsB,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA,EAAG;AAC7C,MAAA,MAAA,CAAO,GAAG,OAAO,CAAA,qBAAA,EAAmB,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA,GAAO,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,CAAA,GAAO,EAAE,CAAA,EAAG,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACxF,MAAA,MAAA,EAAA;AAAA,IACF;AAGA,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,WAAA,EAAa;AACnC,MAAA,IAAI,CAAA,CAAE,SAAS,sBAAA,EAAwB;AACvC,MAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,qBAAA,EAAmB,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAC/C,MAAA,MAAA,EAAA;AAAA,IACF;AAGA,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,WAAA,EAAa;AACnC,MAAA,IAAI,CAAA,CAAE,SAAS,qBAAA,EAAuB;AACtC,MAAA,MAAA,CAAO,OAAA,KAAY,gBAAgB,CAAA,CAAE,OAAA,GAAU,GAAG,OAAO,CAAA,QAAA,EAAM,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAC1E,MAAA,MAAA,EAAA;AAAA,IACF;AAGA,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,WAAA,EAAa;AACnC,MAAA,IACE,CAAC,CAAC,wBAAA,EAA0B,mBAAA,EAAqB,sBAAsB,CAAA,CAAE,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA,EACxF;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,IAAA,GAAO,GAAG,OAAO,CAAA,uBAAA,EAAqB,EAAE,IAAI,CAAA,EAAA,EAAK,EAAE,OAAO,CAAA,CAAA;AAChE,MAAA,IAAI,CAAA,CAAE,aAAa,OAAA,EAAS;AAC1B,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA,MAAA,EAAA;AAAA,MACF,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,MACd;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,QAAQ,kBAAA,CAAmB,OAAA,CAAQ,aAAa,OAAO,CAAA,UAAW,IAAI,CAAA;AACjF,IAAA,KAAA,MAAW,IAAA,IAAQ,MAAM,oBAAA,CAAqB,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA,EAAG,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA,EAAG;AAC1F,MAAA,MAAA,CAAO,IAAI,CAAA;AACX,MAAA,MAAA,EAAA;AAAA,IACF;AACA,IAAA,MAAA,IAAU,gCAAA;AAAA,MACR,IAAA,CAAK,QAAQ,IAAI,CAAA;AAAA,MACjB,OAAA;AAAA,MACA,OAAA,CAAQ,MAAA,EAAQ,UAAA,IAAc;AAAC,KACjC;AAIA,IAAA,IAAA,CAAK,QAAQ,MAAA,EAAQ,UAAA,IAAc,EAAC,EAAG,SAAS,CAAA,EAAG;AAEjD,MAAA,MAAM,mBAAA,CAAoB,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AAC5C,MAAA,MAAM,EAAE,cAAA,EAAe,GAAI,MAAM,OAAO,uBAA+B,CAAA;AACvE,MAAA,MAAM,SAAS,MAAM,oBAAA,CAAqB,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA,EAAG;AAAA,QAC5D,oBAAoB,CAAC,MAAA,KAAW,cAAA,EAAe,CAAE,SAAS,MAAM;AAAA,OACjE,CAAA;AACD,MAAA,IAAI,CAAC,OAAO,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,kBAAkB,CAAA,EAAG;AAC/D,QAAA,KAAA,MAAW,CAAA,IAAK,OAAO,QAAA,EAAU;AAC/B,UAAA,IAAI,CAAA,CAAE,IAAA,KAAS,gBAAA,IAAoB,CAAC,EAAE,IAAA,EAAM;AAC5C,UAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,qBAAA,EAAmB,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAC1D,UAAA,MAAA,EAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,CAAM,MAAA,EAAQ,MAAA,EAAO;AACvC;AAQA,SAAS,6BAA6B,QAAA,EAA0B;AAC9D,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,sBAAsB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,UAAU,OAAO,CAAA;AACtB,EAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,OAAA,EAAS,QAAQ,CAAA;AACnD,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,MAAA;AAAA,MACE,CAAA,EAAG,wBAAwB,CAAA,iBAAA,EAAe,aAAA,CAAc,GAAG,QAAQ,CAAC,CAAA,QAAA,EAAW,CAAA,CAAE,IAAI,CAAA,qGAAA;AAAA,KAEvF;AAAA,EACF;AACA,EAAA,OAAO,OAAA,CAAQ,MAAA;AACjB;AAWA,eAAe,gCAAgC,QAAA,EAAmC;AAChF,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,sBAAsB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,UAAU,OAAO,CAAA;AACtB,EAAA,MAAM,WAAW,eAAA,EAAgB;AACjC,EAAA,MAAM,WAAA,GAAc,cAAc,OAAO,CAAA;AACzC,EAAA,MAAM,WAAA,GAAc,iBAAA;AAAA,IAClB,eAAe,WAAW,CAAA;AAAA,IAC1B,MAAM,oBAAoB,WAAW,CAAA;AAAA,IACrC,QAAA,CAAS;AAAA,GACX;AACA,EAAA,MAAM,YACJ,MAAM,kBAAA;AAAA,IACJ,OAAA;AAAA,IACA,QAAA,CAAS,SAAA,IAAa,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAAA,IAC3C,QAAA;AAAA,IACA;AAAA,GACF,EACA,MAAA;AAAA,IACA,CAAC,CAAA,KACC,CAAC,CAAA,CAAE,YAAA,IACH,CAAC,CAAA,CAAE,YAAA;AAAA,IACH,cAAA,CAAe,CAAA,CAAE,KAAA,CAAM,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,WAAW,CAAA,CAAE,MAAA,KAAW;AAAA,GAC5F;AACA,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,MAAA;AAAA,MACE,CAAA,EAAG,KAAK,QAAA,CAAS,OAAA,EAAS,EAAE,KAAA,CAAM,MAAM,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,MAAM,IAAI,CAAA,SAAA,EAAO,EAAE,KAAA,CAAM,IAAI,IAAI,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,uBAAA,EAA0B,wBAAwB,CAAA,qGAAA;AAAA,KAEjJ;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,MAAA;AAClB;AAOA,SAAS,gCAAgC,QAAA,EAA0B;AACjE,EAAA,MAAM,QAAA,GAAW,wBAAA,CAAyB,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAChE,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,MAAA;AAAA,MACE,GAAG,wBAAwB,CAAA,iBAAA,EAAe,EAAE,KAAK,CAAA,EAAA,EAAK,EAAE,OAAO,CAAA,oDAAA;AAAA,KAEjE;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,MAAA;AAClB;AAOA,SAAS,sCAAsC,QAAA,EAA0B;AACvE,EAAA,MAAM,QAAA,GAAW,yBAAA,CAA0B,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA;AACjE,EAAA,KAAA,MAAW,OAAA,IAAW,QAAA,EAAU,MAAA,CAAO,OAAO,CAAA;AAC9C,EAAA,OAAO,QAAA,CAAS,MAAA;AAClB;AAQA,SAAS,iCAAiC,QAAA,EAA0B;AAClE,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,GAAG,oBAAA,CAAqB,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,IAC9C,GAAG,qBAAA,CAAsB,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,IAC/C,GAAG,yBAAA,CAA0B,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC;AAAA,GACrD;AACA,EAAA,KAAA,MAAW,OAAA,IAAW,QAAA,EAAU,MAAA,CAAO,OAAO,CAAA;AAC9C,EAAA,OAAO,QAAA,CAAS,MAAA;AAClB;AAOA,SAAS,8BAA8B,QAAA,EAA0B;AAC/D,EAAA,IAAI;AACF,IAAA,sBAAA,CAAuB,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAC7C,IAAA,OAAO,CAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,eAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AACvD,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAQA,SAAS,gCAAgC,QAAA,EAA0B;AACjE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,sBAAsB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACzC,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AACrC,IAAA,IAAI,CAAA,CAAE,MAAA,IAAU,CAAC,CAAA,CAAE,OAAA,EAAS;AAC5B,IAAA,MAAM,IAAA,GAAO,qBAAA,CAAsB,OAAA,EAAS,CAAC,CAAA;AAC7C,IAAA,IAAI,CAAC,IAAA,EAAM;AACX,IAAA,MAAM,MAAM,iBAAA,CAAkB,IAAA,EAAM,GAAG,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AAClE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACb,IAAA,MAAM,WAAA,GAAc,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA;AAC5C,IAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,CAAA,CAAE,OAAA,EAAS;AAC5D,IAAA,OAAA;AAAA,MACE,8BAAA;AAAA,QACE,aAAA,CAAc,GAAG,QAAQ,CAAA;AAAA,QACzB,CAAA,CAAE,OAAA;AAAA,QACF,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS,IAAI,CAAC,CAAA;AAAA,QACpC;AAAA;AACF,KACF;AACA,IAAA,QAAA,EAAA;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AASA,SAAS,kCAAkC,QAAA,EAA0B;AACnE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,sBAAsB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAAc,CAAA,CAAE,MAAK,CAAE,OAAA,CAAQ,MAAM,EAAE,CAAA;AACrD,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AACrC,IAAA,MAAM,QAAA,GAAW,CAAA,CAAE,SAAA,IAAa,QAAA,CAAS,SAAA;AACzC,IAAA,IAAI,CAAA,CAAE,MAAA,IAAU,CAAC,QAAA,EAAU;AAC3B,IAAA,MAAM,IAAA,GAAO,qBAAA,CAAsB,OAAA,EAAS,CAAC,CAAA;AAC7C,IAAA,IAAI,CAAC,IAAA,EAAM;AACX,IAAA,MAAM,MAAM,iBAAA,CAAkB,IAAA,EAAM,GAAG,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AAClE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACb,IAAA,MAAM,IAAA,GAAQ,IAAI,IAAA,CAAiC,QAAA;AACnD,IAAA,MAAM,WACJ,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,GAC5B,KAAiC,SAAA,GAClC,IAAA;AACN,IAAA,IAAI,OAAO,aAAa,QAAA,IAAY,IAAA,CAAK,QAAQ,CAAA,KAAM,IAAA,CAAK,QAAQ,CAAA,EAAG;AACvE,IAAA,OAAA;AAAA,MACE,CAAA,EAAG,QAAQ,IAAA,CAAK,QAAA,CAAS,SAAS,IAAI,CAAC,CAAC,CAAA,wCAAA,EAAsC,IAAA,CAAK,QAAQ,CAAC,CAAA,uCAAA,EAC/D,IAAA,CAAK,QAAQ,CAAC,CAAA,MAAA,EAAS,cAAc,CAAA,EAAG,QAAQ,CAAC,CAAA,wHAAA,EAEzE,wBAAwB,CAAA,CAAA;AAAA,KAC/B;AACA,IAAA,QAAA,EAAA;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAGA,IAAM,cAAA,GAAiB,CAAC,kBAAA,EAAoB,WAAA,EAAa,OAAO,CAAA;AAGhE,SAAS,QAAQ,CAAA,EAAmB;AAClC,EAAA,OAAO,EAAE,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,KAAK,GAAG,CAAA;AACnC;AAGA,SAAS,eAAe,OAAA,EAA0B;AAChD,EAAA,MAAM,GAAA,GAAM,QAAQ,OAAO,CAAA;AAC3B,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,WAAW,GAAA,CAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAC/D;AAUA,IAAM,eAAA,GAAwC;AAAA,EAC5C,KAAA,EAAO,IAAA;AAAA,EACP,KAAA,EAAO,IAAA;AAAA,EACP,IAAA,EAAM,IAAA;AAAA,EACN,MAAA,EAAQ,IAAA;AAAA,EACR,MAAA,EAAQ,IAAA;AAAA,EACR,QAAA,EAAU;AACZ,CAAA;AAOA,SAAS,iBAAiB,CAAA,EAAoC;AAC5D,EAAA,MAAM,OAAO,CAAA,CAAE,IAAA;AACf,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,CAAA,CAAE,QAAQ,CAAA;AACzC,EAAA,MAAM,UAAU,IAAA,CAAK,QAAA,CAAS,KAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAC,CAAA;AACtD,EAAA,MAAM,OAAA,GAAU,EAAA,CAAG,YAAA,CAAa,CAAA,CAAE,UAAU,OAAO,CAAA;AACnD,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,QAAA,CAAS,KAAK,CAAA,EAAG;AAE9B,IAAA,MAAM,GAAA,GAAM,iBAAA,CAAkB,CAAA,CAAE,QAAA,EAAU,OAAO,CAAA;AACjD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,EAAA,GAAM,GAAA,CAAI,OAAmC,EAAC;AAC/D,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,CAAQ,eAAA,EAAiB,EAAE,CAAA;AACjD,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,KAAS,WAAW,IAAA,CAAK,IAAA,GAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,OAAA;AAAA,MAC7E,SAAS,GAAA,CAAI,EAAA,GAAM,eAAA,CAAgB,IAAI,KAAK,eAAA,GAAmB,EAAA;AAAA,MAC/D,UAAU,CAAA,CAAE;AAAA,KACd;AAAA,EACF;AACA,EAAA,IAAI,MAAA,GAAyC,IAAA;AAC7C,EAAA,IAAI;AACF,IAAA,MAAA,GAASA,MAAU,OAAO,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,MAAM,UAAU,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,OAAA,IAAW,eAAe,CAAA,GAAI,EAAA;AACrE,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,IAAA,EAAM,OAAO,MAAA,EAAQ,EAAA,IAAM,SAAS,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAC,CAAA;AAAA,MAC7D,OAAA;AAAA,MACA,UAAU,CAAA,CAAE;AAAA,KACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,IAAA,EAAM,MAAA,CAAO,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,IACpC,OAAA;AAAA,IACA,UAAU,CAAA,CAAE;AAAA,GACd;AACF;AAOA,SAAS,qBAAqB,IAAA,EAA8B;AAC1D,EAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAClC,EAAA,MAAM,SAAyB,EAAC;AAChC,EAAA,KAAA,MAAW,CAAA,IAAK,sBAAA,CAAuB,IAAI,CAAA,EAAG;AAC5C,IAAA,IAAI,CAAC,eAAA,CAAgB,CAAA,CAAE,IAAI,CAAA,EAAG;AAE9B,IAAA,IAAI,CAAA,CAAE,QAAA,CAAS,QAAA,CAAS,YAAY,CAAA,EAAG;AACvC,IAAA,IAAI,eAAe,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,CAAE,QAAQ,CAAC,CAAA,EAAG;AACrD,IAAA,MAAA,CAAO,IAAA,CAAK,gBAAA,CAAiB,CAAC,CAAC,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,aAAA,CAAc,GAAiB,IAAA,EAAsB;AAC5D,EAAA,OAAO,QAAQ,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,QAAQ,CAAC,CAAA;AAChD;AAQA,SAAS,iBAAA,CAAkB,cAAsB,IAAA,EAA6B;AAC5E,EAAA,IAAI,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,YAAY,CAAC,CAAA;AAClD,EAAA,WAAS;AACP,IAAA,MAAM,SAAA,GAAY,GAAA,KAAQ,GAAA,GAAM,cAAA,GAAiB,GAAG,GAAG,CAAA,aAAA,CAAA;AACvD,IAAA,IAAI,EAAA,CAAG,WAAW,IAAA,CAAK,IAAA,CAAK,MAAM,SAAS,CAAC,GAAG,OAAO,SAAA;AACtD,IAAA,IAAI,GAAA,KAAQ,KAAK,OAAO,IAAA;AACxB,IAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAAA,EAC9B;AACF;AAoBO,SAAS,mBAAA,CAAoB,eAAyB,IAAA,EAA8B;AACzF,EAAA,MAAM,WAAW,IAAI,GAAA,CAAI,aAAA,CAAc,GAAA,CAAI,OAAO,CAAC,CAAA;AACnD,EAAA,MAAM,YAAA,GAAe,oDAAA;AACrB,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAI,CAAC,YAAA,CAAa,IAAA,CAAK,CAAC,CAAA,IAAK,cAAA,CAAe,CAAC,CAAA,EAAG;AAChD,IAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,CAAA,EAAG,IAAI,CAAA;AACtC,IAAA,IAAI,IAAA,EAAM,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAAA,SACnB,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EACrB;AACA,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,KAAK,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,QAAA,CAAS,GAAA,CAAI,CAAC,CAAC,CAAA;AACxD,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,KAAK,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,QAAA,CAAS,GAAA,CAAI,CAAC,CAAC,CAAA;AACvD,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAQ;AACnC;AAGA,SAAS,yBAAA,CAA0B,UAAkB,OAAA,EAAgC;AACnF,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAMC,OAAAA,GAASD,MAAU,OAAO,CAAA;AAChC,IAAA,OAAOC,SAAQ,OAAA,IAAW,IAAA;AAAA,EAC5B;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,uBAAuB,CAAA;AACrD,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,MAAM,MAAA,GAASD,KAAA,CAAU,OAAA,CAAQ,CAAC,CAAC,CAAA;AACnC,EAAA,OAAO,MAAA,EAAQ,QAAA,EAAU,OAAA,IAAW,MAAA,EAAQ,OAAA,IAAW,IAAA;AACzD;AAGA,SAAS,kBAAA,CACP,QACA,IAAA,EACsC;AACtC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,MAAM,QAAA,GAAW,CAAA;AACjB,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,MAAM,QAAA,GAAW,aAAA,CAAc,CAAA,EAAG,IAAI,CAAA;AACtC,IAAA,IAAI,CAAC,EAAE,OAAA,EAAS;AACd,MAAA,MAAA,CAAO,CAAA,EAAG,EAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,wBAAA,CAAqB,CAAA;AAC5D,MAAA,MAAA,EAAA;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,CAAA,CAAE,OAAO,CAAA;AAC3C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAA,CAAO,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,SAAA,EAAO,OAAO,CAAA,CAAE,CAAA;AACvD,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC5B;AAGA,SAAS,iBAAA,CAAkB,QAAwB,IAAA,EAAsB;AACvE,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,IAAI,CAAC,EAAE,OAAA,EAAS;AAEhB,IAAA,MAAM,UAAU,OAAA,CAAQ,IAAA,CAAK,SAAS,IAAA,EAAM,CAAA,CAAE,QAAQ,CAAC,CAAA;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,aAAa,KAAA,EAAO,CAAC,QAAQ,CAAA,OAAA,EAAU,OAAO,EAAE,CAAA,EAAG;AAAA,QACrE,GAAA,EAAK,IAAA;AAAA,QACL,QAAA,EAAU,OAAA;AAAA,QACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,OACjC,CAAA;AACD,MAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,CAAA,CAAE,QAAA,EAAU,WAAW,CAAA;AACrE,MAAA,IAAI,WAAA,IAAe,WAAA,KAAgB,CAAA,CAAE,OAAA,EAAS;AAC5C,QAAA,OAAA;AAAA,UACE,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,aAAA,CAAc,CAAA,EAAG,IAAI,CAAC,CAAA,8CAAA,EAA4C,EAAE,OAAO,CAAA,CAAA;AAAA,SACrG;AACA,QAAA,QAAA,EAAA;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AASA,SAAS,oBAAA,CACP,QACA,IAAA,EACsC;AACtC,EAAA,MAAM,QAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,MAAM,CAAA;AACpD,EAAA,MAAM,eAAA,uBAAsB,GAAA,EAAoB;AAChD,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,MAAA,CAAO,CAACE,OAAMA,EAAAA,CAAE,IAAA,KAAS,OAAO,CAAA,EAAG;AACxD,IAAA,eAAA,CAAgB,GAAA,CAAI,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAA;AAAA,EACvC;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,oBAAA,CAAqB,QAAA,CAAS,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA,IAClD,SAAS,GAAA,EAAK;AAIZ,MAAA,OAAA;AAAA,QACE,CAAA,KAAA,EAAQ,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,KAAK,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,QAAQ,CAAC,CAAA,4BAAA,EAC7C,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA;AAAA,OAC/C;AACA,MAAA,QAAA,EAAA;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,IAAA,EAAM,eAAe,CAAA;AACzD,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,MAAA,CAAO,CAACC,OAAM,CAACA,EAAAA,CAAE,SAAS,CAAA,EAAG;AAClD,MAAA,MAAA;AAAA,QACE,CAAA,KAAA,EAAQ,CAAA,CAAE,IAAI,CAAA,MAAA,EAAS,CAAA,CAAE,MAAM,CAAA,cAAA,EAAY,CAAA,CAAE,SAAS,CAAA,QAAA,EAAW,CAAA,CAAE,MAAA,IAAU,QAAQ,CAAA;AAAA,OACvF;AACA,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC5B;AASA,SAAS,iBAAiB,OAAA,EAA4C;AACpE,EAAA,IAAI,IAAA,GAAO,QAAQ,GAAA,EAAI;AACvB,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,IAAA,GAAO,IAAA,CAAK,QAAQ,OAAO,CAAA;AAC3B,IAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,IAAI,CAAA,EAAG;AACxB,MAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,IAAI,CAAA,CAAE,CAAA;AACrC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,IAAS,MAAM,IAAA,IAAQ,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC9C,MAAA,IAAI,GAAG,UAAA,CAAW,IAAA,CAAK,KAAK,GAAA,EAAK,wBAAwB,CAAC,CAAA,EAAG;AAC3D,QAAA,IAAA,GAAO,GAAA;AACP,QAAA;AAAA,MACF;AACA,MAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,GAAA,EAAK;AAAA,IACjC;AAAA,EACF;AACA,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAI,CAAA,EAAG;AAC1B,IAAA,MAAA;AAAA,MACE,CAAA,oBAAA,EAAuB,IAAI,CAAA,KAAA,EAAQ,wBAAwB,CAAA,kIAAA;AAAA,KAC7D;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,gBAAgB,IAAA,EAAuB;AAC9C,EAAA,OACE,EAAA,CAAG,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,wBAAwB,CAAC,CAAA,IACvD,oBAAA,CAAqB,IAAI,CAAA,CAAE,MAAA,GAAS,CAAA;AAExC;AAGA,SAAS,gBAAgB,IAAA,EAAuB;AAC9C,EAAA,IAAI;AACF,IAAA,OACE,YAAA,CAAa,KAAA,EAAO,CAAC,WAAA,EAAa,uBAAuB,CAAA,EAAG;AAAA,MAC1D,GAAA,EAAK,IAAA;AAAA,MACL,QAAA,EAAU,OAAA;AAAA,MACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,QAAQ;AAAA,KACnC,CAAA,CAAE,IAAA,EAAK,KAAM,MAAA;AAAA,EAElB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAGA,SAAS,UAAU,IAAA,EAAuB;AACxC,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAO,CAAC,WAAA,EAAa,UAAA,EAAY,SAAA,EAAW,MAAM,CAAA,EAAG;AAAA,MAChE,GAAA,EAAK,IAAA;AAAA,MACL,KAAA,EAAO,CAAC,QAAA,EAAU,QAAA,EAAU,QAAQ;AAAA,KACrC,CAAA;AACD,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAWA,SAAS,aACP,IAAA,EACA,GAAA,EACA,IAAA,EACA,IAAA,GAAgC,EAAC,EAChB;AACjB,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAI,CAAA,EAAG;AAC1B,IAAA,MAAA,CAAO,CAAA,EAAG,IAAI,CAAA,yBAAA,EAA4B,IAAI,CAAA,+BAAA,CAAiC,CAAA;AAC/E,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAU,CAAC,SAAA,CAAU,IAAI,CAAA,EAAG;AACtC,IAAA,MAAA;AAAA,MACE,CAAA,EAAG,IAAI,CAAA,oCAAA,EAAuC,IAAI,CAAA,mGAAA;AAAA,KACpD;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,YAAA;AAAA,MACV,KAAA;AAAA,MACA,CAAC,MAAA,EAAQ,aAAA,EAAe,YAAA,EAAc,oBAAoB,GAAG,CAAA;AAAA,MAC7D;AAAA,QACE,GAAA,EAAK,IAAA;AAAA,QACL,QAAA,EAAU,OAAA;AAAA,QACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA;AAClC,KACF;AACA,IAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK,CAAE,MAAM,IAAI,CAAA,CAAE,OAAO,OAAO,CAAA;AACrD,IAAA,IAAI,KAAK,SAAA,EAAW;AAElB,MAAA,MAAM,QAAQ,YAAA,CAAa,KAAA,EAAO,CAAC,UAAA,EAAY,UAAA,EAAY,oBAAoB,CAAA,EAAG;AAAA,QAChF,GAAA,EAAK,IAAA;AAAA,QACL,QAAA,EAAU,OAAA;AAAA,QACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,OACjC,CAAA;AACD,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,KAAA,CAAM,IAAA,EAAK,CAAE,MAAM,IAAI,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAA,GAAS,GAAA,YAAe,KAAA,IAAS,QAAA,IAAY,GAAA,GAAM,OAAO,GAAA,CAAI,MAAM,CAAA,CAAE,IAAA,EAAK,GAAI,EAAA;AACrF,IAAA,MAAM,MAAA,GAAA,CAAU,MAAA,KAAW,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,CAAE,CAAC,CAAA;AAC3F,IAAA,MAAA,CAAO,CAAA,mBAAA,EAAsB,IAAI,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,CAAA;AAC9C,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOA,SAAS,YAAY,CAAA,EAAgC;AACnD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,EAAS,UAAU,EAAE,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA,IAAK,KAAK,QAAA,CAAS,GAAG,CAAA,KAAM,CAAA,CAAE,MAAM,OAAO,GAAA;AAC7F,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,YAAA,CAAa,GAAiB,UAAA,EAA0C;AAC/E,EAAA,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAE,QAAQ,GAAG,OAAO,IAAA;AACvC,EAAA,MAAM,GAAA,GAAM,YAAY,CAAC,CAAA;AACzB,EAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,KAAA;AACzB,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,CAAC,CAAA;AAChC,IAAA,IAAI,IAAI,UAAA,CAAW,IAAI,KAAK,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AAClD,IAAA,IAAI,CAAC,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAC,GAAG,OAAO,IAAA;AAAA,EAC5C;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,gBAAA,CACP,SACA,IAAA,EACM;AACN,EAAA,MAAM,IAAA,GAAO,iBAAiB,OAAO,CAAA;AACrC,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,IAAA;AAAA,EACF;AACA,EAAA,IAAI,MAAA,GAAS,qBAAqB,IAAI,CAAA;AAGtC,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,MAAA;AAAA,MACE,uBAAuB,IAAI,CAAA,wGAAA;AAAA,KAC7B;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,MAAM,OAAA,GAAU,aAAa,IAAA,EAAM,MAAA,EAAQ,kBAAkB,EAAE,SAAA,EAAW,MAAM,CAAA;AAChF,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AACpE,IAAA,MAAA,GAAS,OAAO,MAAA,CAAO,CAAC,MAAM,YAAA,CAAa,CAAA,EAAG,UAAU,CAAC,CAAA;AAAA,EAC3D;AAEA,EAAA,OAAA,CAAQ,CAAA,qBAAA,EAAwB,IAAI,CAAA,CAAE,CAAA;AACtC,EAAA,MAAM,YAAA,GAAe,kBAAA,CAAmB,MAAA,EAAQ,IAAI,CAAA;AACpD,EAAA,IAAI,SAAS,YAAA,CAAa,MAAA;AAC1B,EAAA,IAAI,WAAW,YAAA,CAAa,QAAA;AAG5B,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,QAAA,IAAY,iBAAA,CAAkB,QAAQ,IAAI,CAAA;AAAA,EAC5C;AAEA,EAAA,MAAM,QAAA,GAAW,oBAAA,CAAqB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,MAAA,IAAU,QAAA,CAAS,MAAA;AACnB,EAAA,QAAA,IAAY,QAAA,CAAS,QAAA;AAGrB,EAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,EAAA,OAAA,CAAQ,CAAA,QAAA,EAAW,MAAA,CAAO,MAAM,CAAA,OAAA,CAAS,CAAA;AACzC,EAAA,IAAI,MAAA,KAAW,CAAA,IAAK,QAAA,KAAa,CAAA,EAAG;AAClC,IAAA,KAAA,CAAM,oBAAoB,CAAA;AAAA,EAC5B,CAAA,MAAO;AACL,IAAA,IAAI,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,CAAA,EAAG,MAAM,CAAA,SAAA,CAAW,CAAA;AAC3C,IAAA,IAAI,QAAA,GAAW,CAAA,EAAG,OAAA,CAAQ,CAAA,EAAG,QAAQ,CAAA,WAAA,CAAa,CAAA;AAAA,EACpD;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA,IAAM,IAAA,CAAK,MAAA,IAAU,WAAW,CAAA,EAAI;AAC/C,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAaO,SAAS,mBAAA,GAA+B;AAC7C,EAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,UAAU,CAAA,CAAE,WAAA;AAAA,IAClC;AAAA,GACF;AAGA,EAAA,GAAA,CACG,QAAA,CAAS,QAAA,EAAU,6CAAA,EAA+C,GAAG,CAAA,CACrE,MAAA;AAAA,IACC,sBAAA;AAAA,IACA;AAAA,GACF,CACC,MAAA,CAAO,OAAO,UAAA,EAAoB,IAAA,KAA0C;AAC3E,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,UAAU,CAAA;AACvC,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,OAAO,CAAA,IAAK,CAAC,GAAG,QAAA,CAAS,OAAO,CAAA,CAAE,WAAA,EAAY,EAAG;AACjE,MAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,qEAAA,CAAuE,CAAA;AACxF,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,CAAA,wBAAA,EAA2B,OAAO,CAAA,CAAE,CAAA;AAC5C,IAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAS,GAAI,iBAAA;AAAA,MAClC,OAAA;AAAA,MACA,KAAK,iBAAA,IAAqB,KAAA;AAAA,MAC1B,MAAM,mBAAA,CAAoB,aAAA,CAAc,OAAO,CAAC;AAAA,KAClD;AACA,IAAA,MAAM,EAAA,GAAK,MAAM,0BAAA,CAA2B,OAAO,CAAA;AACnD,IAAA,MAAM,UAAA,GAAa,6BAA6B,OAAO,CAAA;AACvD,IAAA,MAAM,UAAA,GAAa,sCAAsC,OAAO,CAAA;AAChE,IAAA,MAAM,cAAA,GAAiB,iCAAiC,OAAO,CAAA;AAC/D,IAAA,MAAM,WAAA,GAAc,8BAA8B,OAAO,CAAA;AACzD,IAAA,MAAM,cAAA,GAAiB,gCAAgC,OAAO,CAAA;AAC9D,IAAA,MAAM,cAAA,GAAiB,MAAM,+BAAA,CAAgC,OAAO,CAAA;AACpE,IAAA,MAAM,eAAA,GAAkB,gCAAgC,OAAO,CAAA;AAC/D,IAAA,MAAM,iBAAA,GAAoB,kCAAkC,OAAO,CAAA;AAGnE,IAAA,MAAM,kBAAA,GAAqB,MAAM,8BAAA,CAA+B,OAAO,CAAA;AACvE,IAAA,KAAA,MAAW,CAAA,IAAK,kBAAA,EAAoB,OAAA,CAAQ,CAAC,CAAA;AAC7C,IAAA,MAAM,qBAAqB,kBAAA,CAAmB,MAAA;AAC9C,IAAA,MAAM,WAAA,GACJ,SACA,EAAA,CAAG,MAAA,GACH,aACA,UAAA,GACA,cAAA,GACA,cACA,cAAA,GACA,cAAA;AACF,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,sBAAA,CAAuB,OAAO,CAAA;AAC9B,IAAA,qBAAA,CAAsB,OAAO,CAAA;AAC7B,IAAA,OAAA,CAAQ,CAAA,QAAA,EAAW,KAAK,CAAA,uBAAA,EAA0B,EAAA,CAAG,KAAK,CAAA,oBAAA,CAAsB,CAAA;AAGhF,IAAA,IACE,KAAA,KAAU,CAAA,IACV,EAAA,CAAG,KAAA,KAAU,KACb,WAAA,KAAgB,CAAA,IAChB,CAAC,EAAA,CAAG,WAAW,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,wBAAwB,CAAC,CAAA,EAC3D;AACA,MAAA,MAAA;AAAA,QACE,CAAA,uBAAA,EAA0B,OAAO,CAAA,oCAAA,EAAuC,wBAAwB,CAAA,OAAA;AAAA,OAClG;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,MAAM,aAAA,GAAgB,QAAA,GAAW,eAAA,GAAkB,iBAAA,GAAoB,kBAAA;AACvE,IAAA,IAAI,aAAA,GAAgB,CAAA,EAAG,OAAA,CAAQ,CAAA,EAAG,aAAa,CAAA,WAAA,CAAa,CAAA;AAC5D,IAAA,IAAI,gBAAgB,CAAA,EAAG;AACrB,MAAA,KAAA,CAAM,qBAAqB,CAAA;AAAA,IAC7B,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,CAAA,EAAG,WAAW,CAAA,oBAAA,CAAsB,CAAA;AAC3C,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,EACF,CAAC,CAAA;AAEH,EAAA,GAAA,CACG,OAAA,CAAQ,UAAU,CAAA,CAClB,WAAA,CAAY,4CAA4C,CAAA,CACxD,QAAA,CAAS,UAAU,2DAA2D,CAAA,CAC9E,OAAO,gBAAA,EAAkB,8CAA8C,EACvE,MAAA,CAAO,UAAA,EAAY,6BAA6B,CAAA,CAChD,SAAA,CAAU,mBAAA,EAAqB,CAAA,CAC/B,MAAA;AAAA,IACC,CACE,SACA,IAAA,KACG;AACH,MAAA,yBAAA,CAA0B,IAAI,CAAA;AAC9B,MAAA,gBAAA,CAAiB,SAAS,IAAI,CAAA;AAAA,IAChC;AAAA,GACF;AAEF,EAAA,GAAA,CACG,QAAQ,WAAW,CAAA,CACnB,YAAY,iEAAiE,CAAA,CAC7E,SAAS,QAAA,EAAU,2DAA2D,CAAA,CAC9E,MAAA,CAAO,gBAAgB,uBAAA,EAAyB,MAAM,EACtD,MAAA,CAAO,CAAC,SAA6B,IAAA,KAA2B;AAC/D,IAAA,MAAM,IAAA,GAAO,iBAAiB,OAAO,CAAA;AACrC,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,MAAM,aAAA,GAAgB,YAAA,CAAa,IAAA,EAAM,IAAA,CAAK,MAAM,WAAW,CAAA;AAC/D,IAAA,IAAI,kBAAkB,IAAA,EAAM;AAC1B,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAO,SAAQ,GAAI,mBAAA,CAAoB,eAAe,IAAI,CAAA;AAE3E,IAAA,IAAI,QAAQ,MAAA,GAAS,KAAA,CAAM,MAAA,GAAS,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxD,MAAA,KAAA,CAAM,0BAA0B,CAAA;AAChC,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,IAAA,IAAQ,OAAA,EAAS,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,QAAA,CAAU,CAAA;AACnD,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,CAAO,CAAA,EAAG,IAAI,CAAA,mCAAA,CAAqC,CAAA;AAC7E,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAA,CAAO,CAAA,EAAG,KAAK,CAAA,sEAAA,CAAmE,CAAA;AAAA,IACpF;AAEA,IAAA,IAAI,MAAM,MAAA,GAAS,OAAA,CAAQ,SAAS,CAAA,EAAG,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EACvD,CAAC,CAAA;AAEH,EAAA,OAAO,GAAA;AACT","file":"chunk-TROEC2Z2.js","sourcesContent":["/**\n * Validate asset versions, changelogs, and manifest schemas across asset repos.\n */\n\nimport { execFileSync } from \"node:child_process\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  ASSET_NAME_HINT,\n  type ConnectorDeclaration,\n  decodeSkaileYaml,\n  isInsideProject,\n  symlinkEscapeOfProject,\n  isValidAssetName,\n  isValidPublisher,\n  loadSkPublishManifest,\n  localConnectorMountDir,\n  parseAssetRef,\n  resolveRuntimeAssets,\n  SKAILE_MANIFEST_FILENAME,\n  readAssetBody,\n} from \"@skaile/workspaces/core\";\nimport {\n  flowSkillVersionPins,\n  loadFlow,\n} from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { parseManifestFile } from \"@skaile/workspaces/discovery\";\nimport { withYamlQuotingHint } from \"@skaile/workspaces/core/manifest\";\nimport { isNonAssetPath } from \"@skaile/workspaces/core/publish-manifest\";\nimport {\n  assertManifestEditable,\n  missingRootAssets,\n  scanUnlistedAssets,\n  UNLISTED_SCAN_SKIP_DIRS,\n} from \"@skaile/workspaces/library\";\nimport type { IAssetKindRegistry } from \"@skaile/workspaces/plugins\";\nimport type { FlowVersionNode } from \"@skaile/workspaces/resolver\";\nimport { validateFlowVersions } from \"@skaile/workspaces/resolver\";\nimport { Command } from \"commander\";\nimport { parse as parseYaml } from \"yaml\";\nimport { type ComposeRefContext, composeRefContext } from \"../agent-checks.ts\";\nimport { unknownHarnessErrors, unknownKeyWarnings } from \"../config-checks.ts\";\nimport { logErr, logInfo, logOk, logWarn } from \"../helpers.ts\";\nimport { getKindRegistry } from \"../open-registry.ts\";\nimport { loadDeclaredPlugins } from \"../plugin-store/index.ts\";\nimport {\n  checkAsset,\n  checkAssetFile,\n  DEFAULT_VERSION,\n  declaredVersion,\n  findEntryManifestFile,\n  invalidSemverText,\n  MANIFEST_GLOBS,\n  manifestParseErrorText,\n} from \"../skill-checks.ts\";\nimport {\n  manifestEntryNameProblems,\n  invalidPublisherMessage,\n  manifestFilesProblems,\n  manifestPublisherProblems,\n  manifestRootProblems,\n  manifestRequiresProblems,\n  registeredAssetKeys,\n  rejectRemovedDomainOption,\n  removedDomainOption,\n  reportLibrarySymlinks,\n  unresolvedManifestDependencies,\n  warnIgnoredDomainFiles,\n  warnLegacyBundleFiles,\n} from \"./library-index.ts\";\nimport { assetEntryRef, manifestVersionMismatchMessage } from \"./publish-core.ts\";\nimport { checkAgentInstances } from \"./validate-instances.ts\";\n\n// ---------------------------------------------------------------------------\n// Manifest schema validation (skaile validate [path])\n// ---------------------------------------------------------------------------\n\n// The manifest file patterns live in skill-checks.ts (`MANIFEST_GLOBS`): `library index` names\n// the kind of a file it cannot parse with the same table.\n\n/**\n * `.claude`, `.codex` and `.omp` hold the copies `skaile add` deploys for the harnesses (and\n * the harness's own state): a project `validate .` checks what the author owns, not the\n * deployed bytes of an asset published elsewhere (p853).\n */\nconst HARNESS_DIRS: ReadonlySet<string> = new Set([\".claude\", \".codex\", \".omp\"]);\n/** Directories to skip during tree walk. */\nconst SKIP_DIRS = new Set([\n  \"node_modules\",\n  \"dist\",\n  \".git\",\n  \".skaile\",\n  \"__pycache__\",\n  ...HARNESS_DIRS,\n]);\n\ninterface ManifestCandidate {\n  filePath: string;\n  kind: string;\n}\n\n/** Recursively walk a directory tree and find manifest candidates. */\nfunction findManifestCandidates(rootPath: string): ManifestCandidate[] {\n  const candidates: ManifestCandidate[] = [];\n\n  function walk(dir: string): void {\n    let entries: fs.Dirent[];\n    try {\n      entries = fs.readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const entry of entries) {\n      const fullPath = path.join(dir, entry.name);\n      if (entry.isDirectory()) {\n        if (!SKIP_DIRS.has(entry.name)) walk(fullPath);\n      } else if (entry.isFile()) {\n        for (const glob of MANIFEST_GLOBS) {\n          if (glob.pattern.test(fullPath)) {\n            candidates.push({ filePath: fullPath, kind: glob.kind });\n            break;\n          }\n        }\n      }\n    }\n  }\n\n  walk(rootPath);\n  return candidates;\n}\n\n/**\n * Parse a single manifest candidate's bytes with the indexer's own parser\n * (`parseManifestFile`), so a manifest `library index` cannot parse — an empty\n * `SKILL.md`, no frontmatter, invalid YAML — is an error here too. On failure\n * the error is already logged; count it.\n */\nfunction parseManifestCandidate(\n  c: ManifestCandidate,\n  absRoot: string,\n): { kind: \"value\"; parsed: unknown; body?: string } | { kind: \"error\" } {\n  const content = fs.readFileSync(c.filePath, \"utf-8\");\n  const res = parseManifestFile(c.filePath, content);\n  if (!res.ok) {\n    logErr(\n      `${path.relative(absRoot, c.filePath)} [${c.kind}] — ${manifestParseErrorText(res.reason)}`,\n    );\n    return { kind: \"error\" };\n  }\n  return {\n    kind: \"value\",\n    parsed: res.data,\n    body: readAssetBody(c.filePath, content),\n  };\n}\n\n/**\n * The library root a validated path belongs to: the nearest directory at or above `absRoot`\n * that holds a `skaile.yaml`, else `absRoot` itself.\n */\nfunction libraryRootOf(absRoot: string): string {\n  for (let dir = absRoot; ; dir = path.dirname(dir)) {\n    if (fs.existsSync(path.join(dir, SKAILE_MANIFEST_FILENAME))) return dir;\n    if (path.dirname(dir) === dir) return absRoot;\n  }\n}\n\n/**\n * Validate a single parsed manifest candidate against identity rules + the kind\n * registry. Returns the error/warning deltas this candidate contributes.\n */\nfunction validateManifestCandidate(\n  c: ManifestCandidate,\n  parsed: unknown,\n  body: string | undefined,\n  absRoot: string,\n  registry: IAssetKindRegistry,\n  strictConformance: boolean,\n  composeRefs: ComposeRefContext,\n): { errors: number; warnings: number } {\n  const relPath = path.relative(absRoot, c.filePath);\n  let errors = 0;\n  let warnings = 0;\n\n  // The shared per-asset checks (also run by `library index` and the publish plan):\n  // errors fail validate; advisories are warnings (exit code unchanged) unless\n  // --strict-conformance escalates the agentskills.io conformance ones to errors.\n  const dirName = path.basename(path.dirname(c.filePath)); // the manifest's folder\n  const checked = checkAsset(\n    c.kind,\n    (parsed ?? {}) as Record<string, unknown>,\n    body,\n    dirName,\n    registry,\n    fs.readFileSync(c.filePath, \"utf-8\"),\n    path.basename(c.filePath),\n    { dir: path.dirname(c.filePath), libraryRoot: libraryRootOf(absRoot), composeRefs },\n  );\n  for (const f of checked.errors) {\n    logErr(`${relPath} [${f.tag}] — ${f.text}`);\n    errors++;\n  }\n  for (const f of checked.advisories) {\n    const line = `${relPath} [${f.tag}] — ${f.text}`;\n    // An untouched scaffold body is an error: a passing `validate` means the asset can be published.\n    if ((f.conformance && strictConformance) || f.scaffoldBody) {\n      logErr(line);\n      errors++;\n    } else {\n      logWarn(line);\n      warnings++;\n    }\n  }\n\n  return { errors, warnings };\n}\n\n/**\n * The `kind:name` identity of every asset manifest under `root`, read quietly: a manifest\n * that does not parse holds no identity (its own validation reports the error).\n */\nexport function scanIdentities(root: string): Set<string> {\n  const identities = new Set<string>();\n  for (const c of findManifestCandidates(root)) {\n    let parsed: unknown;\n    try {\n      const res = parseManifestFile(c.filePath, fs.readFileSync(c.filePath, \"utf-8\"));\n      if (!res.ok) continue;\n      parsed = res.data;\n    } catch {\n      continue;\n    }\n    if (parsed === null || typeof parsed !== \"object\") continue;\n    const identity = (parsed as Record<string, unknown>)[c.kind === \"flow\" ? \"id\" : \"name\"];\n    if (typeof identity === \"string\" && identity.length > 0)\n      identities.add(`${c.kind}:${identity}`);\n  }\n  return identities;\n}\n\n/** Validate all manifest files in a directory tree using the kind registry. */\nexport function validateManifests(\n  rootPath: string,\n  strictConformance: boolean,\n  registeredAssets: ReadonlySet<string> = new Set(),\n): { total: number; errors: number; warnings: number } {\n  const absRoot = path.resolve(rootPath);\n  if (!fs.existsSync(absRoot)) {\n    logErr(`Path does not exist: ${absRoot}`);\n    return { total: 0, errors: 1, warnings: 0 };\n  }\n\n  const registry: IAssetKindRegistry = getKindRegistry();\n  const candidates = findManifestCandidates(absRoot);\n  // Symlinks are refused with the text `library index` and the publish plan print (p520). In a\n  // library (a `skaile.manifest.yaml` at the root) any symlink is refused, as `git add -A`\n  // would publish it; elsewhere (a project) only those inside an asset folder or aliasing one.\n  // A link elsewhere in a project is not refused: the connector real-path check judges a\n  // `mountPath` link (p1332).\n  const isLibrary = fs.existsSync(path.join(absRoot, SKAILE_MANIFEST_FILENAME));\n  // A project's deployed harness folders (`add --link` makes `.claude/skills/x` a link to the\n  // project's own `skills/x`) are not sources: they are skipped here as in the manifest walk.\n  let errors = reportLibrarySymlinks(absRoot, {\n    wholeTree: isLibrary,\n    skipDirs: isLibrary ? undefined : HARNESS_DIRS,\n  });\n  let warnings = 0;\n\n  // kind:name → directory of the first manifest seen; a second directory with the same\n  // identity cannot be told apart by `add`/`publish` (and `library index` skips it).\n  const seenIdentity = new Map<string, string>();\n  // `composes:` refs resolve against the assets of the whole library (the scanned tree plus,\n  // when `validate` got a sub-directory, its siblings under the enclosing library root) and the\n  // registered libraries of its publisher: a ref no library holds fails `skaile add` (p415).\n  const libraryRoot = libraryRootOf(absRoot);\n  const composeRefs = composeRefContext(\n    scanIdentities(libraryRoot),\n    registeredAssets,\n    loadSkPublishManifest(libraryRoot)?.publisher,\n  );\n  for (const c of candidates) {\n    const parseResult = parseManifestCandidate(c, absRoot);\n    if (parseResult.kind === \"error\") {\n      errors++;\n      continue;\n    }\n\n    const delta = validateManifestCandidate(\n      c,\n      parseResult.parsed,\n      parseResult.body,\n      absRoot,\n      registry,\n      strictConformance,\n      composeRefs,\n    );\n    errors += delta.errors;\n    warnings += delta.warnings;\n    const obj = parseResult.parsed as Record<string, unknown> | null;\n    const identity = obj && typeof obj === \"object\" ? obj[c.kind === \"flow\" ? \"id\" : \"name\"] : null;\n    if (typeof identity === \"string\" && identity.length > 0) {\n      const dir = path.dirname(c.filePath);\n      const key = `${c.kind}:${identity}`;\n      const first = seenIdentity.get(key);\n      if (first === undefined) {\n        seenIdentity.set(key, dir);\n      } else if (first !== dir) {\n        logErr(\n          `${path.relative(absRoot, c.filePath)} [${c.kind}] — ${key} is also defined in ${path.relative(absRoot, first) || \".\"}; ` +\n            \"two directories cannot share a kind and name (`skaile library index` keeps only the first).\",\n        );\n        errors++;\n      }\n    }\n  }\n\n  return { total: candidates.length, errors, warnings };\n}\n\n/** Recursively find every `skaile.yaml` / `*.skaile.yaml` workspace manifest. */\nfunction findWorkspaceManifests(rootPath: string): string[] {\n  const out: string[] = [];\n  function walk(dir: string): void {\n    let entries: fs.Dirent[];\n    try {\n      entries = fs.readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const entry of entries) {\n      const full = path.join(dir, entry.name);\n      if (entry.isDirectory()) {\n        if (!SKIP_DIRS.has(entry.name)) walk(full);\n      } else if (entry.isFile() && /(^|\\.)skaile\\.yaml$/.test(entry.name)) {\n        out.push(full);\n      }\n    }\n  }\n  walk(rootPath);\n  return out;\n}\n\n/**\n * Validate the dependency refs and asset identities declared in every\n * `skaile.yaml` under a tree. This is the manifest-level mirror of the\n * per-file identity check: it parses each `dependencies[]` /\n * `overrides[].ref` through `parseAssetRef` (the exact code path that produced\n * the original \"publisher required …\" / \"invalid asset name …\" hard error) and\n * checks each `assets[].name` against the canonical name grammar.\n */\n/**\n * Collect every `[field, ref]` pair to validate from a workspace manifest:\n * each string in `dependencies[]` and each `overrides[].ref`.\n */\nfunction collectWorkspaceRefFields(parsed: Record<string, unknown>): Array<[string, string]> {\n  const refFields: Array<[string, string]> = [];\n  if (Array.isArray(parsed.dependencies)) {\n    for (const d of parsed.dependencies) {\n      if (typeof d === \"string\") refFields.push([\"dependencies\", d]);\n    }\n  }\n  if (Array.isArray(parsed.overrides)) {\n    for (const o of parsed.overrides) {\n      const ref = (o as Record<string, unknown>)?.ref;\n      if (typeof ref === \"string\") refFields.push([\"overrides.ref\", ref]);\n    }\n  }\n  return refFields;\n}\n\n/** Parse each declared ref through `parseAssetRef`; returns the error count. */\nfunction validateWorkspaceRefs(refFields: Array<[string, string]>, relPath: string): number {\n  let errors = 0;\n  for (const [field, ref] of refFields) {\n    try {\n      const parsedRef = parseAssetRef(ref);\n      // The library-side slug rule (`library index`, the publish plan) holds for a project's\n      // `dependencies:` too: `add` cannot resolve such a ref, so `check` fails on it (p1080).\n      const publisher = parsedRef.publisher?.replace(/^@/, \"\");\n      if (publisher !== undefined && !isValidPublisher(publisher)) {\n        logErr(`${relPath} [${field}] — ${ref}: ${invalidPublisherMessage(publisher)}`);\n        errors++;\n      }\n    } catch (e) {\n      logErr(`${relPath} [${field}] — ${e instanceof Error ? e.message : String(e)}`);\n      errors++;\n    }\n  }\n  return errors;\n}\n\n/** Validate `assets[].name` against the canonical name/ref grammar. */\nfunction validateWorkspaceAssets(parsed: Record<string, unknown>, relPath: string): number {\n  if (!Array.isArray(parsed.assets)) return 0;\n  let errors = 0;\n  const topPublisher = typeof parsed.publisher === \"string\" ? parsed.publisher : undefined;\n  for (const a of parsed.assets) {\n    const asset = a as Record<string, unknown>;\n    const name = asset?.name;\n    const kind = typeof asset?.kind === \"string\" ? asset.kind : \"skill\";\n    if (typeof name !== \"string\" || name.length === 0) continue;\n    const publisher = typeof asset?.publisher === \"string\" ? asset.publisher : topPublisher;\n    if (publisher !== undefined) {\n      try {\n        parseAssetRef(`${kind}:@${publisher}/${name}`);\n      } catch (e) {\n        logErr(`${relPath} [assets] — ${e instanceof Error ? e.message : String(e)}`);\n        errors++;\n      }\n    } else if (!isValidAssetName(name)) {\n      logErr(`${relPath} [assets] — invalid asset name \"${name}\" — ${ASSET_NAME_HINT}`);\n      errors++;\n    }\n  }\n  return errors;\n}\n\n/** `skaile.yaml` connector diagnostics that fail `validate` (the runner cannot mount it right). */\nconst CONNECTOR_ERROR_CODES: readonly string[] = [\n  \"connector_missing_driver\",\n  \"connector_missing_id\",\n  \"connector_duplicate_id\",\n  \"connector_invalid_access\",\n];\n\n/**\n * A `local` connector's `mountPath` is mounted read-write as given: one that does not exist\n * fails (`serve` refuses it too), one outside the project is a warning, one that reaches outside\n * through a symlink fails (p833).\n */\nfunction validateLocalConnectorMountPaths(\n  projectDir: string,\n  relPath: string,\n  connectors: ReadonlyArray<ConnectorDeclaration>,\n): number {\n  let errors = 0;\n  for (const c of connectors) {\n    if (c.driver !== \"local\" || c.mount) continue;\n    const dir = localConnectorMountDir(c, projectDir);\n    if (!dir) continue;\n    const escapesTo = symlinkEscapeOfProject(dir, projectDir);\n    if (!fs.existsSync(dir)) {\n      logErr(\n        `${relPath} [connectors] — connector_mount_path_missing: connectors.${c.id}.mountPath: ${dir} does not exist; create the directory or fix the path`,\n      );\n      errors++;\n    } else if (escapesTo !== null) {\n      logErr(\n        `${relPath} [connectors] — connector_mount_path_symlink: connectors.${c.id}.mountPath: ${dir} is a symlink to ${escapesTo}, outside the project ${projectDir}; point mountPath at the real directory`,\n      );\n      errors++;\n    } else if (!isInsideProject(dir, projectDir)) {\n      logWarn(\n        `${relPath} [connectors] — connectors.${c.id}.mountPath: ${dir} is outside the project ${projectDir}; the agent reads${c.access === \"read-write\" ? \" and writes\" : \"\"} there`,\n      );\n    }\n  }\n  return errors;\n}\n\nasync function validateWorkspaceManifests(rootPath: string): Promise<{\n  total: number;\n  errors: number;\n}> {\n  const absRoot = path.resolve(rootPath);\n  const files = findWorkspaceManifests(absRoot);\n  let errors = 0;\n\n  for (const file of files) {\n    const relPath = path.relative(absRoot, file);\n    let parsed: Record<string, unknown>;\n    let text = \"\";\n    try {\n      text = fs.readFileSync(file, \"utf-8\");\n      parsed = (parseYaml(text) ?? {}) as Record<string, unknown>;\n    } catch (e) {\n      const message = e instanceof Error ? e.message : String(e);\n      logErr(`${relPath} — parse error: ${withYamlQuotingHint(message, text)}`);\n      errors++;\n      continue;\n    }\n    // A root that is no mapping, or a `dependencies:`/`sources:` of the wrong shape, is one\n    // parse-error line, as `check` prints it (p1421, p1620).\n    const unreadable = decodeSkaileYaml(text).diagnostics.find(\n      (d) => d.code === \"non_object_root\" || d.code === \"invalid_value_shape\",\n    );\n    if (unreadable) {\n      logErr(`${relPath} — parse error: ${unreadable.message}`);\n      errors++;\n      continue;\n    }\n\n    errors += validateWorkspaceRefs(collectWorkspaceRefFields(parsed), relPath);\n    errors += validateWorkspaceAssets(parsed, relPath);\n    for (const d of checkAgentInstances(path.dirname(file), parsed)) {\n      const line = `${relPath} [agents] — ${d.code}: ${d.path ? `${d.path}: ` : \"\"}${d.message}`;\n      if (d.severity === \"error\") {\n        logErr(line);\n        errors++;\n      } else {\n        logWarn(line);\n      }\n    }\n    // A connector the runner cannot mount or mounts wrongly: no `driver` (or the old `adapter`\n    // spelling), no `id`, a duplicate `id`, an `access` that is neither read-only nor read-write.\n    const decoded = decodeSkaileYaml(fs.readFileSync(file, \"utf-8\"));\n    for (const d of decoded.diagnostics) {\n      if (!CONNECTOR_ERROR_CODES.includes(d.code)) continue;\n      logErr(`${relPath} [connectors] — ${d.code}: ${d.path ? `${d.path}: ` : \"\"}${d.message}`);\n      errors++;\n    }\n    // A `sources:` item with no url or a non-string publisher: `check`, `doctor` and `add` stop\n    // on it, so `validate` must not call the file valid (p1620).\n    for (const d of decoded.diagnostics) {\n      if (d.code !== \"invalid_source_entry\") continue;\n      logErr(`${relPath} — parse error: ${d.message}`);\n      errors++;\n    }\n    // A key skaile.yaml no longer accepts (a legacy `provider:`): every command that reads the\n    // file stops on it, so `validate` must not call the file valid (p1352).\n    for (const d of decoded.diagnostics) {\n      if (d.code !== \"legacy_key_rejected\") continue;\n      logErr(relPath === \"skaile.yaml\" ? d.message : `${relPath} — ${d.message}`);\n      errors++;\n    }\n    // The 5.x `driver` key of an agent-config profile: still read as `harness` until 7.0\n    // (warning); setting both keys is an error. The retired `agent` key is ignored (warning).\n    for (const d of decoded.diagnostics) {\n      if (\n        ![\"deprecated_harness_key\", \"retired_agent_key\", \"harness_key_conflict\"].includes(d.code)\n      ) {\n        continue;\n      }\n      const line = `${relPath} [agent-config] — ${d.code}: ${d.message}`;\n      if (d.severity === \"error\") {\n        logErr(line);\n        errors++;\n      } else {\n        logWarn(line);\n      }\n    }\n    // A mistyped key warns (p1474); a `harness:` no harness registers, plugins included, fails (p1022).\n    for (const line of unknownKeyWarnings(decoded.diagnostics, relPath)) logWarn(line);\n    for (const line of await unknownHarnessErrors(path.dirname(file), decoded.config, relPath)) {\n      logErr(line);\n      errors++;\n    }\n    errors += validateLocalConnectorMountPaths(\n      path.dirname(file),\n      relPath,\n      decoded.config?.connectors ?? [],\n    );\n    // A `driver` no catalog entry provides: `serve` cannot mount it either. The text is the one\n    // `serve` logs as `validation_warning`. An unreachable source (not cloned yet) may hold the\n    // driver, so nothing is reported while one is missing.\n    if ((decoded.config?.connectors ?? []).length > 0) {\n      // A plugin's connector driver is known once the plugins are loaded, as `serve` loads them.\n      await loadDeclaredPlugins(path.dirname(file));\n      const { listConnectors } = await import(\"@skaile/workspaces/connectors\");\n      const assets = await resolveRuntimeAssets(path.dirname(file), {\n        isDriverRegistered: (driver) => listConnectors().includes(driver),\n      });\n      if (!assets.warnings.some((w) => w.code === \"repo_unavailable\")) {\n        for (const w of assets.warnings) {\n          if (w.code !== \"missing_driver\" || !w.name) continue;\n          logErr(`${relPath} [connectors] — ${w.code}: ${w.message}`);\n          errors++;\n        }\n      }\n    }\n  }\n\n  return { total: files.length, errors };\n}\n\n/**\n * Check the library's publication manifest (`skaile.manifest.yaml` at the\n * validated root): every first-party `root:` must still exist. An entry whose\n * directory was deleted would otherwise stay publishable; the fix is\n * `skaile library index <lib>`, which drops it.\n */\nfunction validatePublishManifestRoots(rootPath: string): number {\n  const absRoot = path.resolve(rootPath);\n  const manifest = loadSkPublishManifest(absRoot);\n  if (!manifest) return 0;\n  const missing = missingRootAssets(absRoot, manifest);\n  for (const a of missing) {\n    logErr(\n      `${SKAILE_MANIFEST_FILENAME} [assets] — ${assetEntryRef(a, manifest)}: root \"${a.root}\" does not exist. ` +\n        \"Run `skaile library index <library>` to drop the entry, or restore the directory.\",\n    );\n  }\n  return missing.length;\n}\n\n/**\n * An asset directory the library's manifest does not list is an error: `add` refuses it (`not\n * listed in its skaile.manifest.yaml`), the publish plan does not ship it, yet `git add -A`\n * commits its files. The fix is `skaile library index <lib>`, which lists it (p1193). A directory\n * that holds a kind + name the manifest already names elsewhere is the duplicate check's finding.\n * An asset that already fails its own check is not listed here: `library index` refuses it, so\n * \"run `library index`\" would send the author round in a circle; the check line names the real\n * fix (p871).\n */\nasync function validatePublishManifestUnlisted(rootPath: string): Promise<number> {\n  const absRoot = path.resolve(rootPath);\n  const manifest = loadSkPublishManifest(absRoot);\n  if (!manifest) return 0;\n  const registry = getKindRegistry();\n  const libraryRoot = libraryRootOf(absRoot);\n  const composeRefs = composeRefContext(\n    scanIdentities(libraryRoot),\n    await registeredAssetKeys(libraryRoot),\n    manifest.publisher,\n  );\n  const unlisted = (\n    await scanUnlistedAssets(\n      absRoot,\n      manifest.publisher ?? path.basename(absRoot),\n      registry,\n      UNLISTED_SCAN_SKIP_DIRS,\n    )\n  ).filter(\n    (u) =>\n      !u.registeredAt &&\n      !u.parseFailure && // a file that does not parse has its own parse error\n      checkAssetFile(u.entry.source, u.entry.kind, registry, absRoot, composeRefs).length === 0,\n  );\n  for (const u of unlisted) {\n    logErr(\n      `${path.relative(absRoot, u.entry.source)} [${u.entry.kind}] — ${u.entry.kind}:${u.entry.name} is on disk but not in ${SKAILE_MANIFEST_FILENAME}, so it is not published. ` +\n        \"Run `skaile library index <library>` to list it, or delete the directory.\",\n    );\n  }\n  return unlisted.length;\n}\n\n/**\n * Check every `assets[].dependencies` entry of the publication manifest with the\n * same syntax rule (and message) `library index` applies, so a malformed ref\n * fails `validate` instead of being silently dropped by the manifest decoder.\n */\nfunction validatePublishManifestRequires(rootPath: string): number {\n  const problems = manifestRequiresProblems(path.resolve(rootPath));\n  for (const p of problems) {\n    logErr(\n      `${SKAILE_MANIFEST_FILENAME} [assets] — ${p.asset}: ${p.message}. ` +\n        \"Use the `kind:@<publisher>/name[#version]` form.\",\n    );\n  }\n  return problems.length;\n}\n\n/**\n * Check the publisher of the publication manifest (top-level and every\n * `assets[].publisher`) against the one publisher slug rule `library create`, `library\n * index` and the publish plan apply, with the same message.\n */\nfunction validatePublishManifestPublisherSlugs(rootPath: string): number {\n  const problems = manifestPublisherProblems(path.resolve(rootPath));\n  for (const message of problems) logErr(message);\n  return problems.length;\n}\n\n/**\n * Check every first-party `assets[].root` and `files:` entry of the publication manifest stays\n * inside the library and crosses no symlink ({@link manifestRootProblems},\n * {@link manifestFilesProblems}), the refusal `library index` and the publish plan print too: a\n * path outside the library is never found by `add` (p701, p1403), a missing file is no asset (p1404).\n */\nfunction validatePublishManifestRootPaths(rootPath: string): number {\n  const problems = [\n    ...manifestRootProblems(path.resolve(rootPath)),\n    ...manifestFilesProblems(path.resolve(rootPath)),\n    ...manifestEntryNameProblems(path.resolve(rootPath)),\n  ];\n  for (const message of problems) logErr(message);\n  return problems.length;\n}\n\n/**\n * Parse the publication manifest the way `library index` and `library publish` open it, so a\n * `skaile.manifest.yaml` that does not parse fails `validate` too, with the file and line.\n * Without the file there is nothing to check.\n */\nfunction validatePublishManifestParses(rootPath: string): number {\n  try {\n    assertManifestEditable(path.resolve(rootPath));\n    return 0;\n  } catch (err) {\n    logErr(err instanceof Error ? err.message : String(err));\n    return 1;\n  }\n}\n\n/**\n * Warn when a first-party `assets[].version` of the publication manifest differs\n * from the version in the asset's own manifest file. The file is the source of\n * truth — `skaile library index` rewrites the entry from it — so a hand-edited\n * manifest version is silently overwritten by the next index. Returns the warning count.\n */\nfunction validatePublishManifestVersions(rootPath: string): number {\n  const absRoot = path.resolve(rootPath);\n  const manifest = loadSkPublishManifest(absRoot);\n  if (!manifest || manifest.source) return 0;\n  let warnings = 0;\n  for (const a of manifest.assets ?? []) {\n    if (a.source || !a.version) continue;\n    const file = findEntryManifestFile(absRoot, a);\n    if (!file) continue;\n    const res = parseManifestFile(file, fs.readFileSync(file, \"utf-8\"));\n    if (!res.ok) continue; // reported by the per-file parse check\n    const fileVersion = declaredVersion(res.data);\n    if (fileVersion === undefined || fileVersion === a.version) continue;\n    logWarn(\n      manifestVersionMismatchMessage(\n        assetEntryRef(a, manifest),\n        a.version,\n        toPosix(path.relative(absRoot, file)),\n        fileVersion,\n      ),\n    );\n    warnings++;\n  }\n  return warnings;\n}\n\n/**\n * Warn when a first-party asset file still carries a `metadata.publisher` that\n * differs from the publisher the manifest resolves for it (`assets[].publisher`,\n * else the top-level `publisher`). The manifest is the only source of an\n * asset's publisher; the file value is ignored by every resolver, so a stale\n * one only misleads the reader. Returns the warning count.\n */\nfunction validatePublishManifestPublishers(rootPath: string): number {\n  const absRoot = path.resolve(rootPath);\n  const manifest = loadSkPublishManifest(absRoot);\n  if (!manifest || manifest.source) return 0;\n  const bare = (p: string) => p.trim().replace(/^@/, \"\");\n  let warnings = 0;\n  for (const a of manifest.assets ?? []) {\n    const resolved = a.publisher ?? manifest.publisher;\n    if (a.source || !resolved) continue;\n    const file = findEntryManifestFile(absRoot, a);\n    if (!file) continue;\n    const res = parseManifestFile(file, fs.readFileSync(file, \"utf-8\"));\n    if (!res.ok) continue; // reported by the per-file parse check\n    const meta = (res.data as Record<string, unknown>).metadata;\n    const declared =\n      meta !== null && typeof meta === \"object\"\n        ? (meta as Record<string, unknown>).publisher\n        : null;\n    if (typeof declared !== \"string\" || bare(declared) === bare(resolved)) continue;\n    logWarn(\n      `${toPosix(path.relative(absRoot, file))} [publisher] — metadata.publisher \"${bare(declared)}\" differs from ` +\n        `the manifest publisher \"${bare(resolved)}\" for ${assetEntryRef(a, manifest)}. The manifest wins and the ` +\n        \"file value is ignored: delete `metadata.publisher` from the file, or set the publisher in \" +\n        `${SKAILE_MANIFEST_FILENAME}.`,\n    );\n    warnings++;\n  }\n  return warnings;\n}\n\n/** Root-relative path prefixes excluded from version/changelog checks. */\nconst EXCLUDED_PATHS = [\"skaileup-shared/\", \"external/\", \"docs/\"];\n\n/** Normalise to forward slashes so prefix and set comparisons work on any OS. */\nfunction toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** True when a root-relative path sits under one of {@link EXCLUDED_PATHS}. */\nfunction isExcludedPath(relPath: string): boolean {\n  const rel = toPosix(relPath);\n  return EXCLUDED_PATHS.some((prefix) => rel.startsWith(prefix));\n}\n\ninterface AssetVersion {\n  kind: \"skill\" | \"agent\" | \"flow\" | \"prompt\" | \"preset\" | \"contract\";\n  name: string;\n  version: string;\n  filePath: string;\n}\n\n/** Manifest candidates whose kind carries a version `validate versions` checks. */\nconst VERSIONED_KINDS: Record<string, true> = {\n  skill: true,\n  agent: true,\n  flow: true,\n  prompt: true,\n  preset: true,\n  contract: true,\n};\n\n/**\n * Read one manifest candidate's identity and version. A manifest without a `version` reads as\n * {@link DEFAULT_VERSION}, as `validate`, `library index` and `add` read it (p1858); an unreadable\n * file has no version.\n */\nfunction readAssetVersion(c: ManifestCandidate): AssetVersion {\n  const kind = c.kind as AssetVersion[\"kind\"];\n  const fileName = path.basename(c.filePath);\n  const dirName = path.basename(path.dirname(c.filePath));\n  const content = fs.readFileSync(c.filePath, \"utf-8\");\n  if (c.filePath.endsWith(\".md\")) {\n    // The version `library index` records (top-level `version`, else `metadata.version`).\n    const res = parseManifestFile(c.filePath, content);\n    const data = res.ok ? (res.data as Record<string, unknown>) : {};\n    const stem = fileName.replace(/\\.prompt\\.md$/, \"\");\n    return {\n      kind,\n      name: typeof data.name === \"string\" ? data.name : kind === \"prompt\" ? stem : dirName,\n      version: res.ok ? (declaredVersion(data) ?? DEFAULT_VERSION) : \"\",\n      filePath: c.filePath,\n    };\n  }\n  let parsed: Record<string, unknown> | null = null;\n  try {\n    parsed = parseYaml(content);\n  } catch {\n    // Reported by the default `skaile validate`; here the asset just has no readable version.\n  }\n  const version = parsed ? String(parsed.version ?? DEFAULT_VERSION) : \"\";\n  if (kind === \"flow\") {\n    return {\n      kind,\n      name: String(parsed?.id ?? fileName.replace(\".flow.yaml\", \"\")),\n      version,\n      filePath: c.filePath,\n    };\n  }\n  return {\n    kind,\n    name: String(parsed?.name ?? dirName),\n    version,\n    filePath: c.filePath,\n  };\n}\n\n/**\n * Walk `root` at any depth and collect the version of every skill, agent, flow, prompt,\n * preset and contract — the same tree walk the default `validate` uses, so a library laid out\n * as `<root>/<asset>/SKILL.md` is covered as well as `skills/<asset>/SKILL.md`.\n */\nfunction collectAssetVersions(root: string): AssetVersion[] {\n  if (!fs.existsSync(root)) return [];\n  const assets: AssetVersion[] = [];\n  for (const c of findManifestCandidates(root)) {\n    if (!VERSIONED_KINDS[c.kind]) continue;\n    // Only the YAML flow form and `agent.yaml` / `AGENT.md` carry a readable version here.\n    if (c.filePath.endsWith(\".flow.json\")) continue;\n    if (isExcludedPath(path.relative(root, c.filePath))) continue;\n    assets.push(readAssetVersion(c));\n  }\n  return assets;\n}\n\n/** Root-relative posix location of an asset file, for messages. */\nfunction assetLocation(a: AssetVersion, root: string): string {\n  return toPosix(path.relative(root, a.filePath));\n}\n\n/**\n * Nearest ancestor directory of `assetRelPath` (root-relative, posix) that\n * holds a `CHANGELOG.md`, walking up from the asset's own directory to and\n * including `root`, never above it. Returns the changelog's root-relative\n * path, or `null` when no ancestor has one.\n */\nfunction findChangelogUnit(assetRelPath: string, root: string): string | null {\n  let dir = path.posix.dirname(toPosix(assetRelPath));\n  for (;;) {\n    const candidate = dir === \".\" ? \"CHANGELOG.md\" : `${dir}/CHANGELOG.md`;\n    if (fs.existsSync(path.join(root, candidate))) return candidate;\n    if (dir === \".\") return null;\n    dir = path.posix.dirname(dir);\n  }\n}\n\n/** Outcome of {@link checkChangelogUnits}. All paths are root-relative posix. */\nexport interface ChangelogCheck {\n  /** Changelog units whose `CHANGELOG.md` is among the modified files. */\n  updated: string[];\n  /** Changelog units covering a modified asset whose `CHANGELOG.md` is not modified. */\n  stale: string[];\n  /** Modified assets with no `CHANGELOG.md` in any ancestor up to the root. */\n  orphans: string[];\n}\n\n/**\n * Group the modified asset files by their nearest-ancestor `CHANGELOG.md` and\n * report which units were updated alongside them. Assets under\n * {@link EXCLUDED_PATHS} are ignored.\n *\n * @param modifiedFiles - Changed paths relative to `root`.\n * @param root - The asset root (`ai-assets/`); the walk up never leaves it.\n */\nexport function checkChangelogUnits(modifiedFiles: string[], root: string): ChangelogCheck {\n  const modified = new Set(modifiedFiles.map(toPosix));\n  const assetPattern = /(SKILL\\.md|agent\\.yaml|\\.flow\\.yaml|\\.prompt\\.md)$/;\n  const units = new Set<string>();\n  const orphans: string[] = [];\n  for (const f of modified) {\n    if (!assetPattern.test(f) || isExcludedPath(f)) continue;\n    const unit = findChangelogUnit(f, root);\n    if (unit) units.add(unit);\n    else orphans.push(f);\n  }\n  const updated = [...units].filter((u) => modified.has(u));\n  const stale = [...units].filter((u) => !modified.has(u));\n  return { updated, stale, orphans };\n}\n\n/** Extract version from file content using proper YAML parsing */\nfunction extractVersionFromContent(filePath: string, content: string): string | null {\n  if (filePath.endsWith(\".yaml\")) {\n    const parsed = parseYaml(content);\n    return parsed?.version ?? null;\n  }\n  // SKILL.md / .prompt.md — YAML frontmatter\n  const fmMatch = content.match(/^---\\n([\\s\\S]*?)\\n---/);\n  if (!fmMatch) return null;\n  const parsed = parseYaml(fmMatch[1]);\n  return parsed?.metadata?.version ?? parsed?.version ?? null;\n}\n\n/** Check every asset has a present + semver-valid version. */\nfunction checkAssetVersions(\n  assets: AssetVersion[],\n  root: string,\n): { errors: number; warnings: number } {\n  let errors = 0;\n  const warnings = 0;\n  for (const a of assets) {\n    const location = assetLocation(a, root);\n    if (!a.version) {\n      logErr(`${a.kind}:${a.name} (${location}) — missing version`);\n      errors++;\n      continue;\n    }\n    const invalid = invalidSemverText(a.version);\n    if (invalid) {\n      logErr(`${a.kind}:${a.name} (${location}) — ${invalid}`);\n      errors++;\n    }\n  }\n  return { errors, warnings };\n}\n\n/** In --changed-only mode, warn when a changed asset's version was not bumped. */\nfunction checkVersionBumps(assets: AssetVersion[], root: string): number {\n  let warnings = 0;\n  for (const a of assets) {\n    if (!a.version) continue; // already flagged above\n    // `HEAD:./<path>` is relative to `root` (the cwd), not the repository top level.\n    const relPath = toPosix(path.relative(root, a.filePath));\n    try {\n      const headContent = execFileSync(\"git\", [\"show\", `HEAD:./${relPath}`], {\n        cwd: root,\n        encoding: \"utf-8\",\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      });\n      const headVersion = extractVersionFromContent(a.filePath, headContent);\n      if (headVersion && headVersion === a.version) {\n        logWarn(\n          `${a.kind}:${a.name} (${assetLocation(a, root)}) — file changed but version not bumped (${a.version})`,\n        );\n        warnings++;\n      }\n    } catch {\n      // New file (no HEAD version) — that's fine\n    }\n  }\n  return warnings;\n}\n\n/**\n * Validate flow node skill-version pins against the discovered skill versions.\n *\n * Flows are read through `loadFlow`, which normalizes legacy v1 documents into\n * the strict v2 shape — reading the authored YAML directly would miss every v2\n * pin, since those ride in `run.assets` rather than `node.data.version`.\n */\nfunction checkFlowVersionPins(\n  assets: AssetVersion[],\n  root: string,\n): { errors: number; warnings: number } {\n  const flows = assets.filter((a) => a.kind === \"flow\");\n  const skillVersionMap = new Map<string, string>();\n  for (const a of assets.filter((a) => a.kind === \"skill\")) {\n    skillVersionMap.set(a.name, a.version);\n  }\n\n  let errors = 0;\n  let warnings = 0;\n  for (const f of flows) {\n    let pins: FlowVersionNode[];\n    try {\n      pins = flowSkillVersionPins(loadFlow(f.filePath));\n    } catch (err) {\n      // An unreadable flow is a gap in the check, not an absence of findings.\n      // Report the path, not `f.name`: that id comes from a raw-YAML read that\n      // falls back to the filename stem exactly when the file is unusable.\n      logWarn(\n        `flow:${f.name} (${path.relative(root, f.filePath)}) — could not be read: ` +\n          `${err instanceof Error ? err.message : err}`,\n      );\n      warnings++;\n      continue;\n    }\n\n    if (pins.length === 0) continue;\n    const checks = validateFlowVersions(pins, skillVersionMap);\n    for (const c of checks.filter((c) => !c.satisfied)) {\n      logErr(\n        `flow:${f.name} node ${c.nodeId} — wants ${c.requested}, found ${c.actual || \"(none)\"}`,\n      );\n      errors++;\n    }\n  }\n  return { errors, warnings };\n}\n\n/**\n * Root of a `validate versions` / `validate changelog` run: the explicit `[path]`, else the\n * library the shell is in (the nearest directory at or above the cwd that holds\n * `skaile.manifest.yaml`), else the cwd itself, as plain `validate` reads it. The bundled\n * factory assets are never a default (p1194). Returns `null` after printing an error when\n * the path does not exist, or when the root holds no library (see {@link isCheckableRoot}).\n */\nfunction resolveCheckRoot(pathArg: string | undefined): string | null {\n  let root = process.cwd();\n  if (pathArg) {\n    root = path.resolve(pathArg);\n    if (!fs.existsSync(root)) {\n      logErr(`Path does not exist: ${root}`);\n      return null;\n    }\n  } else {\n    for (let dir = root; ; dir = path.dirname(dir)) {\n      if (fs.existsSync(path.join(dir, SKAILE_MANIFEST_FILENAME))) {\n        root = dir;\n        break;\n      }\n      if (path.dirname(dir) === dir) break;\n    }\n  }\n  if (!isCheckableRoot(root)) {\n    logErr(\n      `Nothing to check in ${root}: no ${SKAILE_MANIFEST_FILENAME} and no versioned asset (skill, agent, flow, prompt, contract or preset) found. Run it in a library or pass the library directory.`,\n    );\n    return null;\n  }\n  return root;\n}\n\n/** Whether `root` is a library: it holds a library manifest or at least one versioned asset. */\nfunction isCheckableRoot(root: string): boolean {\n  return (\n    fs.existsSync(path.join(root, SKAILE_MANIFEST_FILENAME)) ||\n    collectAssetVersions(root).length > 0\n  );\n}\n\n/** `true` when `root` lies inside a git work tree. */\nfunction isInGitWorkTree(root: string): boolean {\n  try {\n    return (\n      execFileSync(\"git\", [\"rev-parse\", \"--is-inside-work-tree\"], {\n        cwd: root,\n        encoding: \"utf-8\",\n        stdio: [\"ignore\", \"pipe\", \"ignore\"],\n      }).trim() === \"true\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/** `true` when the git work tree at `root` has at least one commit (`HEAD` resolves). */\nfunction hasCommit(root: string): boolean {\n  try {\n    execFileSync(\"git\", [\"rev-parse\", \"--verify\", \"--quiet\", \"HEAD\"], {\n      cwd: root,\n      stdio: [\"ignore\", \"ignore\", \"ignore\"],\n    });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Run `git diff --name-only --relative <ref>` in `root` and return the changed paths\n * (relative to `root`), plus — with `untracked` — the new files git does not track yet.\n * No git work tree prints `<what> needs a git repository`; any other git failure — a bad\n * ref, no `git` — prints one `git diff failed in <root>: <first stderr line>` line. Both\n * return `null`; git's own usage text never reaches the terminal.\n *\n * @param what The command that needs git, for the message (`--changed-only`, `changelog`).\n */\nfunction changedFiles(\n  root: string,\n  ref: string,\n  what: string,\n  opts: { untracked?: boolean } = {},\n): string[] | null {\n  if (!isInGitWorkTree(root)) {\n    logErr(`${what} needs a git repository: ${root} is not inside a git work tree.`);\n    return null;\n  }\n  if (ref === \"HEAD\" && !hasCommit(root)) {\n    logErr(\n      `${what} compares with the last commit, and ${root} has no commit yet. Commit the library first (\\`skaile library commit <name>\\`), then run it again.`,\n    );\n    return null;\n  }\n  try {\n    const out = execFileSync(\n      \"git\",\n      [\"diff\", \"--name-only\", \"--relative\", \"--end-of-options\", ref],\n      {\n        cwd: root,\n        encoding: \"utf-8\",\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      },\n    );\n    const changed = out.trim().split(\"\\n\").filter(Boolean);\n    if (opts.untracked) {\n      // New files git does not track yet (`--others` paths are relative to `root`).\n      const fresh = execFileSync(\"git\", [\"ls-files\", \"--others\", \"--exclude-standard\"], {\n        cwd: root,\n        encoding: \"utf-8\",\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      });\n      changed.push(...fresh.trim().split(\"\\n\").filter(Boolean));\n    }\n    return changed;\n  } catch (err) {\n    const stderr = err instanceof Error && \"stderr\" in err ? String(err.stderr).trim() : \"\";\n    const reason = (stderr || (err instanceof Error ? err.message : String(err))).split(\"\\n\")[0];\n    logErr(`git diff failed in ${root}: ${reason}`);\n    return null;\n  }\n}\n\n/**\n * The directory whose files belong to `a`: the asset's own folder for a skill, agent, contract,\n * or a prompt/flow/preset that sits in a folder named after it — the folder `library create`\n * scaffolds. A single prompt/flow/preset file next to others is its own asset (`null`).\n */\nfunction assetOwnDir(a: AssetVersion): string | null {\n  const dir = path.dirname(a.filePath);\n  if ([\"skill\", \"agent\", \"contract\"].includes(a.kind) || path.basename(dir) === a.name) return dir;\n  return null;\n}\n\n/**\n * `true` when `a` changed: its asset file, or any file under its folder that a deploy ships\n * (the lock hash covers them, minus the deploy ignore list), is among `changedAbs`.\n */\nfunction assetChanged(a: AssetVersion, changedAbs: ReadonlySet<string>): boolean {\n  if (changedAbs.has(a.filePath)) return true;\n  const dir = assetOwnDir(a);\n  if (dir === null) return false;\n  for (const f of changedAbs) {\n    const rel = path.relative(dir, f);\n    if (rel.startsWith(\"..\") || path.isAbsolute(rel)) continue;\n    if (!isNonAssetPath(toPosix(rel))) return true;\n  }\n  return false;\n}\n\n/** Body of `skaile validate versions` — semver + bump + flow-pin checks. */\nfunction runVersionsCheck(\n  pathArg: string | undefined,\n  opts: { changedOnly?: boolean; strict?: boolean },\n): void {\n  const root = resolveCheckRoot(pathArg);\n  if (root === null) {\n    process.exit(1);\n    return;\n  }\n  let assets = collectAssetVersions(root);\n  // A directory with no asset has nothing to check: `Checked 0 assets / All versions valid` would\n  // read as a pass, so it fails as `validate` does for a path with no manifests (p1194).\n  if (assets.length === 0) {\n    logErr(\n      `Nothing to check in ${root}: no versioned asset (skill, agent, flow, prompt, contract or preset) found. Pass the library directory.`,\n    );\n    process.exit(1);\n    return;\n  }\n\n  // Filter to changed files only if requested\n  if (opts.changedOnly) {\n    const changed = changedFiles(root, \"HEAD\", \"--changed-only\", { untracked: true });\n    if (changed === null) {\n      process.exit(1);\n      return;\n    }\n    const changedAbs = new Set(changed.map((f) => path.resolve(root, f)));\n    assets = assets.filter((a) => assetChanged(a, changedAbs));\n  }\n\n  logInfo(`Checking versions in ${root}`);\n  const versionCheck = checkAssetVersions(assets, root);\n  let errors = versionCheck.errors;\n  let warnings = versionCheck.warnings;\n\n  // In --changed-only mode, check if version was actually bumped\n  if (opts.changedOnly) {\n    warnings += checkVersionBumps(assets, root);\n  }\n\n  const pinCheck = checkFlowVersionPins(assets, root);\n  errors += pinCheck.errors;\n  warnings += pinCheck.warnings;\n\n  // Summary\n  console.log();\n  logInfo(`Checked ${assets.length} assets`);\n  if (errors === 0 && warnings === 0) {\n    logOk(\"All versions valid\");\n  } else {\n    if (errors > 0) logErr(`${errors} error(s)`);\n    if (warnings > 0) logWarn(`${warnings} warning(s)`);\n  }\n\n  if (errors > 0 || (opts.strict && warnings > 0)) {\n    process.exit(1);\n  }\n}\n\n/**\n * Creates the `skaile validate` command group.\n *\n * Validates asset manifests, version fields, and changelogs in an asset\n * repository tree. Subcommands: default `validate [path]` (schema check),\n * `versions` (semver + flow pin validation), `changelog` (modified assets\n * must have an updated nearest-ancestor CHANGELOG.md).\n *\n * @returns Configured {@link Command} ready for `program.addCommand()`.\n * @docLink cli/commands/validate#make-validate-command\n */\nexport function makeValidateCommand(): Command {\n  const cmd = new Command(\"validate\").description(\n    \"Validate asset manifests, versions, and changelogs\",\n  );\n\n  // Default action: skaile validate [path]\n  cmd\n    .argument(\"[path]\", \"Path to asset repo or directory to validate\", \".\")\n    .option(\n      \"--strict-conformance\",\n      \"Treat Agent Skills (agentskills.io) standard findings as errors\",\n    )\n    .action(async (targetPath: string, opts: { strictConformance?: boolean }) => {\n      const absPath = path.resolve(targetPath);\n      if (fs.existsSync(absPath) && !fs.statSync(absPath).isDirectory()) {\n        logErr(`${absPath} is not a directory: nothing to validate. Pass the library directory.`);\n        process.exit(1);\n        return;\n      }\n      logInfo(`Validating manifests in ${absPath}`);\n      const { total, errors, warnings } = validateManifests(\n        absPath,\n        opts.strictConformance ?? false,\n        await registeredAssetKeys(libraryRootOf(absPath)),\n      );\n      const ws = await validateWorkspaceManifests(absPath);\n      const rootErrors = validatePublishManifestRoots(absPath);\n      const slugErrors = validatePublishManifestPublisherSlugs(absPath);\n      const rootPathErrors = validatePublishManifestRootPaths(absPath);\n      const parseErrors = validatePublishManifestParses(absPath);\n      const requiresErrors = validatePublishManifestRequires(absPath);\n      const unlistedErrors = await validatePublishManifestUnlisted(absPath);\n      const versionWarnings = validatePublishManifestVersions(absPath);\n      const publisherWarnings = validatePublishManifestPublishers(absPath);\n      // Advisory and offline: a dependency no registered library holds may live in a\n      // library that is not registered on this machine.\n      const dependencyProblems = await unresolvedManifestDependencies(absPath);\n      for (const w of dependencyProblems) logWarn(w);\n      const dependencyWarnings = dependencyProblems.length;\n      const totalErrors =\n        errors +\n        ws.errors +\n        rootErrors +\n        slugErrors +\n        rootPathErrors +\n        parseErrors +\n        requiresErrors +\n        unlistedErrors;\n      console.log();\n      warnIgnoredDomainFiles(absPath);\n      warnLegacyBundleFiles(absPath);\n      logInfo(`Scanned ${total} asset manifest(s) and ${ws.total} skaile.yaml file(s)`);\n      // Nothing scanned and no library manifest: a directory with nothing in it is not valid,\n      // it is not validated (p745).\n      if (\n        total === 0 &&\n        ws.total === 0 &&\n        totalErrors === 0 &&\n        !fs.existsSync(path.join(absPath, SKAILE_MANIFEST_FILENAME))\n      ) {\n        logErr(\n          `Nothing to validate in ${absPath}: no asset manifest, skaile.yaml or ${SKAILE_MANIFEST_FILENAME} found.`,\n        );\n        process.exit(1);\n        return;\n      }\n      const totalWarnings = warnings + versionWarnings + publisherWarnings + dependencyWarnings;\n      if (totalWarnings > 0) logWarn(`${totalWarnings} warning(s)`);\n      if (totalErrors === 0) {\n        logOk(\"All manifests valid\");\n      } else {\n        logErr(`${totalErrors} validation error(s)`);\n        process.exit(1);\n      }\n    });\n\n  cmd\n    .command(\"versions\")\n    .description(\"Check version fields and flow version pins\")\n    .argument(\"[path]\", \"Library or asset directory (default: the current library)\")\n    .option(\"--changed-only\", \"Only check assets modified since last commit\")\n    .option(\"--strict\", \"Exit 1 on warnings (for CI)\")\n    .addOption(removedDomainOption())\n    .action(\n      (\n        pathArg: string | undefined,\n        opts: { changedOnly?: boolean; strict?: boolean; domain?: string },\n      ) => {\n        rejectRemovedDomainOption(opts);\n        runVersionsCheck(pathArg, opts);\n      },\n    );\n\n  cmd\n    .command(\"changelog\")\n    .description(\"Check that modified assets have an updated nearest CHANGELOG.md\")\n    .argument(\"[path]\", \"Library or asset directory (default: the current library)\")\n    .option(\"--base <ref>\", \"Git base ref for diff\", \"HEAD\")\n    .action((pathArg: string | undefined, opts: { base: string }) => {\n      const root = resolveCheckRoot(pathArg);\n      if (root === null) {\n        process.exit(1);\n        return;\n      }\n      const modifiedFiles = changedFiles(root, opts.base, \"changelog\");\n      if (modifiedFiles === null) {\n        process.exit(1);\n        return;\n      }\n      const { updated, stale, orphans } = checkChangelogUnits(modifiedFiles, root);\n\n      if (updated.length + stale.length + orphans.length === 0) {\n        logOk(\"No modified assets found\");\n        return;\n      }\n\n      for (const unit of updated) logOk(`${unit} updated`);\n      for (const unit of stale) logErr(`${unit} not updated (assets were modified)`);\n      for (const asset of orphans) {\n        logErr(`${asset} — no CHANGELOG.md in any ancestor directory up to the asset root`);\n      }\n\n      if (stale.length + orphans.length > 0) process.exit(1);\n    });\n\n  return cmd;\n}\n"]}

package/dist/{chunk-E5NQRHEB.js → chunk-U6KRTCNA.js}

@@ -1,5 +1,5 @@
-import { compositeSha256 } from './chunk-KPKGWXUJ.js';
-import { parseAssetRef } from './chunk-IZQOO6MN.js';
+import { compositeSha256 } from './chunk-23SG4JRV.js';
+import { parseAssetRef } from './chunk-V5KG6CCV.js';
 import { createHash } from 'crypto';
 import { openSync, fstatSync, readSync, chmodSync, closeSync } from 'fs';
 import { rm, mkdir, writeFile, chmod } from 'fs/promises';
@@ -146,5 +146,5 @@ async function installFlat(manifest, targetDir, fetcher) {
 }
 
 export { assertSafeManifestPath, installFromManifest, isScriptBytes, longestCommonDirPrefix, restoreScriptModes };
-//# sourceMappingURL=chunk-E5NQRHEB.js.map
-//# sourceMappingURL=chunk-E5NQRHEB.js.map
+//# sourceMappingURL=chunk-U6KRTCNA.js.map
+//# sourceMappingURL=chunk-U6KRTCNA.js.map

package/dist/{chunk-E5NQRHEB.js.map → chunk-U6KRTCNA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;;;AAiDO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAOO,SAAS,cAAc,KAAA,EAA4B;AACxD,EAAA,OAAO,KAAA,CAAM,UAAU,CAAA,IAAK,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA,IAAQ,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA;AAChE;AAGA,IAAM,eAAA,GAAkB,GAAA;AAQjB,SAAS,kBAAA,CAAmB,MAAc,QAAA,EAAmC;AAClF,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,IAAI,EAAA;AACJ,IAAA,IAAI;AACF,MAAA,EAAA,GAAK,QAAA,CAAS,IAAA,CAAK,IAAA,EAAM,GAAG,GAAG,GAAG,CAAA;AAClC,MAAA,IAAA,CAAK,SAAA,CAAU,EAAE,CAAA,CAAE,IAAA,GAAO,QAAW,CAAA,EAAG;AACxC,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC3B,MAAA,IAAI,QAAA,CAAS,EAAA,EAAI,IAAA,EAAM,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,IAAK,aAAA,CAAc,IAAI,CAAA,EAAG;AAC5D,QAAA,SAAA,CAAU,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA,EAAG,eAAe,CAAA;AAAA,MAC5C;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER,CAAA,SAAE;AACA,MAAA,IAAI,EAAA,KAAO,MAAA,EAAW,SAAA,CAAU,EAAE,CAAA;AAAA,IACpC;AAAA,EACF;AACF;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,QAAA,CAAS,KAAK,CAAA;AACtD,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AACtC,MAAA,IAAI,aAAA,CAAc,MAAM,CAAA,CAAE,IAAI,CAAE,CAAA,EAAG,MAAM,KAAA,CAAM,MAAA,EAAQ,eAAe,CAAA;AAAA,IACxE;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AACzB,IAAA,IAAI,cAAc,GAAG,CAAA,EAAG,MAAM,KAAA,CAAM,MAAM,eAAe,CAAA;AAAA,EAC3D;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-E5NQRHEB.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { chmodSync, closeSync, fstatSync, openSync, readSync } from \"node:fs\";\nimport { chmod, mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\nimport { compositeSha256 } from \"../../../core/src/publish-manifest.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Whether `bytes` start a script (`#!`). A pointer manifest and GitHub's raw host carry no file\n * modes, while the library or clone the same asset comes from keeps its script executable, so a\n * shebang is what marks a file executable here (p1657).\n */\nexport function isScriptBytes(bytes: Uint8Array): boolean {\n  return bytes.length >= 2 && bytes[0] === 0x23 && bytes[1] === 0x21;\n}\n\n/** The mode of an executable file written from store bytes. */\nconst EXECUTABLE_MODE = 0o755;\n\n/**\n * Make every file of `relPaths` under `root` that starts with `#!` executable. For bytes an\n * earlier install already wrote (a project store cache from before exec bits were kept), so a\n * restore from them deploys the same modes as a fresh fetch. A missing or unreadable file is\n * skipped.\n */\nexport function restoreScriptModes(root: string, relPaths: readonly string[]): void {\n  for (const rel of relPaths) {\n    let fd: number | undefined;\n    try {\n      fd = openSync(join(root, rel), \"r\");\n      if ((fstatSync(fd).mode & 0o111) !== 0) continue;\n      const head = Buffer.alloc(2);\n      if (readSync(fd, head, 0, 2, 0) === 2 && isScriptBytes(head)) {\n        chmodSync(join(root, rel), EXECUTABLE_MODE);\n      }\n    } catch {\n      // Not readable or not a file: nothing to fix.\n    } finally {\n      if (fd !== undefined) closeSync(fd);\n    }\n  }\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const actualComposite = compositeSha256(manifest.files);\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n      if (isScriptBytes(bytes[f.path]!)) await chmod(target, EXECUTABLE_MODE);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n    if (isScriptBytes(buf)) await chmod(dest, EXECUTABLE_MODE);\n  }\n\n  return { installPath: target };\n}\n"]}
+{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;;;AAiDO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAOO,SAAS,cAAc,KAAA,EAA4B;AACxD,EAAA,OAAO,KAAA,CAAM,UAAU,CAAA,IAAK,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA,IAAQ,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA;AAChE;AAGA,IAAM,eAAA,GAAkB,GAAA;AAQjB,SAAS,kBAAA,CAAmB,MAAc,QAAA,EAAmC;AAClF,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,IAAI,EAAA;AACJ,IAAA,IAAI;AACF,MAAA,EAAA,GAAK,QAAA,CAAS,IAAA,CAAK,IAAA,EAAM,GAAG,GAAG,GAAG,CAAA;AAClC,MAAA,IAAA,CAAK,SAAA,CAAU,EAAE,CAAA,CAAE,IAAA,GAAO,QAAW,CAAA,EAAG;AACxC,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC3B,MAAA,IAAI,QAAA,CAAS,EAAA,EAAI,IAAA,EAAM,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,IAAK,aAAA,CAAc,IAAI,CAAA,EAAG;AAC5D,QAAA,SAAA,CAAU,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA,EAAG,eAAe,CAAA;AAAA,MAC5C;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER,CAAA,SAAE;AACA,MAAA,IAAI,EAAA,KAAO,MAAA,EAAW,SAAA,CAAU,EAAE,CAAA;AAAA,IACpC;AAAA,EACF;AACF;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,QAAA,CAAS,KAAK,CAAA;AACtD,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AACtC,MAAA,IAAI,aAAA,CAAc,MAAM,CAAA,CAAE,IAAI,CAAE,CAAA,EAAG,MAAM,KAAA,CAAM,MAAA,EAAQ,eAAe,CAAA;AAAA,IACxE;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AACzB,IAAA,IAAI,cAAc,GAAG,CAAA,EAAG,MAAM,KAAA,CAAM,MAAM,eAAe,CAAA;AAAA,EAC3D;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-U6KRTCNA.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { chmodSync, closeSync, fstatSync, openSync, readSync } from \"node:fs\";\nimport { chmod, mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\nimport { compositeSha256 } from \"../../../core/src/publish-manifest.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Whether `bytes` start a script (`#!`). A pointer manifest and GitHub's raw host carry no file\n * modes, while the library or clone the same asset comes from keeps its script executable, so a\n * shebang is what marks a file executable here (p1657).\n */\nexport function isScriptBytes(bytes: Uint8Array): boolean {\n  return bytes.length >= 2 && bytes[0] === 0x23 && bytes[1] === 0x21;\n}\n\n/** The mode of an executable file written from store bytes. */\nconst EXECUTABLE_MODE = 0o755;\n\n/**\n * Make every file of `relPaths` under `root` that starts with `#!` executable. For bytes an\n * earlier install already wrote (a project store cache from before exec bits were kept), so a\n * restore from them deploys the same modes as a fresh fetch. A missing or unreadable file is\n * skipped.\n */\nexport function restoreScriptModes(root: string, relPaths: readonly string[]): void {\n  for (const rel of relPaths) {\n    let fd: number | undefined;\n    try {\n      fd = openSync(join(root, rel), \"r\");\n      if ((fstatSync(fd).mode & 0o111) !== 0) continue;\n      const head = Buffer.alloc(2);\n      if (readSync(fd, head, 0, 2, 0) === 2 && isScriptBytes(head)) {\n        chmodSync(join(root, rel), EXECUTABLE_MODE);\n      }\n    } catch {\n      // Not readable or not a file: nothing to fix.\n    } finally {\n      if (fd !== undefined) closeSync(fd);\n    }\n  }\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const actualComposite = compositeSha256(manifest.files);\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n      if (isScriptBytes(bytes[f.path]!)) await chmod(target, EXECUTABLE_MODE);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n    if (isScriptBytes(buf)) await chmod(dest, EXECUTABLE_MODE);\n  }\n\n  return { installPath: target };\n}\n"]}