@vibe-agent-toolkit/agent-skills 0.2.0-rc.5 → 0.2.0-rc.7

package/dist/validators/packaged-size-limit.js

@@ -0,0 +1,494 @@
+/**
+ * PACKAGED_SIZE_EXCEEDS_API_LIMIT — the packaged skill is too large to upload to
+ * the Anthropic Skills API.
+ *
+ * ## Why this needs its own detector rather than a threshold on an existing one
+ *
+ * VAT ships two checks whose names suggest they already answer this, and neither
+ * can:
+ *
+ * - `SKILL_TOTAL_SIZE_LARGE` counts **lines** across bundled markdown (≤2000).
+ * - `SKILL_TOO_MANY_FILES` counts **files** (≤6).
+ *
+ * The shape that actually blocks a publish is one large binary, which has no
+ * lines and is one file. The measured instance is a 35.7 MB `.wasm` runtime
+ * bundled by three skills in a single adopter marketplace: over the ceiling on
+ * its own, before a byte of markdown counts, and invisible to both checks above.
+ * Before this module there was no byte measurement anywhere in the validators.
+ *
+ * ## Why the message names the largest files
+ *
+ * A total alone ("34.9 MB, limit 30 MB") tells an author they have a problem and
+ * not where it is; a bundle at that size has hundreds of files and the true cause
+ * is nearly always one or two of them. The adopter who reported this built the
+ * same thing locally and said naming the largest files "is the thing that made
+ * the cause obvious in one line". So the finding leads with the offenders.
+ *
+ * ## Built phase only
+ *
+ * The bytes that matter are the bytes that ship, and a `files:` config entry
+ * materializes files at build time — a source tree can lack the very artifact
+ * that blows the ceiling. Measuring the source directory would answer a
+ * different question and get it wrong in both directions.
+ *
+ * ## This module is the ONLY thing that stats the packaged bytes
+ *
+ * That is why an entry it cannot weigh gets a receipt rather than a zero — see
+ * {@link walkBundle}. No other validator revisits these files, so a silent zero
+ * here is a silent zero everywhere.
+ */
+import { readdirSync, statSync } from 'node:fs';
+import { CODE_REGISTRY } from '@vibe-agent-toolkit/schema';
+import { safePath } from '@vibe-agent-toolkit/utils';
+/**
+ * The Skills API's refusal ceiling, in bytes. The vendor documents it as "Total
+ * upload size must be under 30 MB (uncompressed)" and the 413 says "requests up
+ * to 30MBs", neither of which says whether MB means 10^6 or 2^20 — a 1.4 MB gap.
+ *
+ * **This is measured, not read.** VAT first assumed decimal (30,000,000) as the
+ * conservative reading. Uploading against the live API disproved it:
+ *
+ * | Bundle content bytes | Result |
+ * |---|---|
+ * | 30,700,000 | **accepted** — above decimal 30 MB, so decimal is wrong |
+ * | 31,500,000 | 413 refused |
+ * | 35,900,338 | 413 refused |
+ *
+ * That brackets the ceiling to (30,700,000, 31,500,000], and 2^20 × 30 =
+ * 31,457,280 is the only round number in the window. So the limit is mebibytes,
+ * and the old decimal constant warned ~1.46 MB early — a false-positive band on
+ * every bundle between 30.0 and 31.4 MB, which is exactly where a big bundle
+ * lands.
+ *
+ * ## What this counts versus what the API counts
+ *
+ * The API measures the REQUEST. This check measures the bundle's file bytes,
+ * because at build time there is no request to weigh — see
+ * {@link checkPackagedSizeLimit} for why that is left as it is rather than
+ * modelled.
+ *
+ * The gap between the two is not small. `buildMultipartFormData` frames every
+ * file part with a 51-byte boundary line, a `Content-Disposition` header of
+ * 61 bytes plus the filename, a 42-byte content-type-and-blank-line, and a
+ * 2-byte trailing CRLF — **156 bytes plus the filename's length, per file** —
+ * and closes the body with a 53-byte terminator. Measured: one part with a
+ * 14-character filename costs 170 bytes of framing, and a 1,000-file bundle
+ * with `resources/`-shaped names costs ~185,000. So a bundle whose FILES sit
+ * just under the ceiling can be a REQUEST comfortably over it. An earlier
+ * version of this comment put the residue at "a few hundred bytes… roughly a
+ * kilobyte", which understates it by two orders of magnitude on a many-file
+ * bundle.
+ *
+ * The uploader therefore weighs the body it built rather than the sum of its
+ * file bytes, and says so in its own message ({@link OversizeMeasure}). Neither
+ * lane pads its threshold with a fudge factor: an invented margin is a number
+ * nobody can re-derive.
+ *
+ * ## The two lanes compare DIFFERENTLY, and that is the correct answer
+ *
+ * The ceiling is INCLUSIVE, measured: a request body of exactly 31,457,280 bytes
+ * (31,456,735 file bytes plus 545 of framing) returned `status: success`, and one
+ * byte more returned `413`. So:
+ *
+ * - **Request bytes: `>` refuses.** The uploader knows the exact body and must
+ *   not refuse one the API would take.
+ * - **File bytes: `>=` refuses** — this lane, {@link checkPackagedSizeLimit}.
+ *   Framing is never zero, so files totalling exactly the limit ALWAYS frame up
+ *   into a request larger than the limit and earn a real 413.
+ *
+ * An earlier version of this comment claimed "both fire AT the ceiling rather
+ * than only above it" and offered that as the conservative reading. It was
+ * reasoned, never measured, and the measurement above refutes it for the request
+ * lane. Do not harmonise the two operators: they are applied to different
+ * quantities and each is right about the one it can see.
+ *
+ * ## If the bracket ever moves, these surfaces do NOT follow automatically
+ *
+ * Nothing derives the prose from this constant, so a re-measurement is a
+ * multi-file edit and the list belongs here, next to the number, rather than in
+ * whichever file the next maintainer happens to open:
+ *
+ * 1. This constant.
+ * 2. `docs/validation-codes.md`, `PACKAGED_SIZE_EXCEEDS_API_LIMIT` — several
+ *    bullets restate both the MiB figure and the exact byte count.
+ * 3. The `PACKAGED_SIZE_EXCEEDS_API_LIMIT` entry in
+ *    `packages/schema/src/validation-codes.ts` (its `description`).
+ * 4. The `vat-skill-review` skill's checklist item for the same code.
+ *
+ * The two `vat claude org skills` help texts interpolate this constant and need
+ * no edit. `CHANGELOG.md` is history and is never restated.
+ *
+ * @vendor-claim reviewed=2026-09-06 verify=Re-measure rather than re-read — the docs do not state the unit. Upload two skill bundles via `vat claude org skills install`, one just under and one just over this constant, and confirm the first is accepted and the second returns 413. Adjust only if the bracket moves; if it does, update the four surfaces listed above.
+ */
+export const API_SKILL_MAX_UPLOAD_BYTES = 31_457_280;
+/**
+ * Directory names that never reach the Skills API, so their bytes never count
+ * toward its ceiling.
+ *
+ * 🔑 **This must stay identical to the uploader's exclusion set**, because the
+ * two halves apply the SAME constant and the SAME sentence and must therefore
+ * apply them to the same file set. They did not: the walk summed everything
+ * under the output directory while `vat claude org skills install` dropped these
+ * three directories from the multipart body, so a bundle of 31.0 MB of shipped
+ * content plus a 1.0 MB `evals/` fired at build and uploaded fine — a false
+ * positive on the only lane that shows the finding to the AUTHOR, which is the
+ * lane whose credibility the check depends on.
+ *
+ * The case is reachable and documented into existence: a root `evals/` holding
+ * no `evals.json` is ordinary content, so `vat build` packages it and the
+ * uploader drops it unconditionally.
+ *
+ * The exclusion is by DIRECTORY, so a regular FILE named `evals` is weighed here
+ * because it is sent there. The uploader spells its own test
+ * `directoryLike && NEVER_UPLOADED_DIR_NAMES.has(entry.name)`, where
+ * `directoryLike` is a real directory OR a symbolic link resolving to one — this
+ * walk cannot descend a linked directory at all (`Dirent.isDirectory()` is
+ * lstat-based), so it weighs one as zero and files a `SCAN_PATH_UNREADABLE`
+ * receipt for it. Both lanes therefore leave a linked `evals` out of the total;
+ * they differ only in whether they say so.
+ *
+ * ⚠️ ONE asymmetry remains, and it can only under-count: the uploader also
+ * withholds the skill's DECLARED eval-suite unit, which it resolves from the
+ * governing VAT config asynchronously. This walk is synchronous and knows only
+ * an output directory. In a built bundle that unit is normally absent anyway —
+ * the packager drops declared test input on the way in and reports what it
+ * dropped — so the residue is a bundle weighed slightly heavy, never light.
+ */
+export const NEVER_UPLOADED_DIR_NAMES = new Set(['evals', 'node_modules', '.git']);
+/** Naive English pluralisation; every noun this file counts is regular. */
+function plural(noun, count) {
+    return count === 1 ? noun : `${noun}s`;
+}
+/** How many offenders the message names before it stops listing. */
+const LARGEST_FILES_NAMED = 3;
+/**
+ * Binary units, because the only threshold any of these numbers is read against
+ * is binary: {@link API_SKILL_MAX_UPLOAD_BYTES} is exactly 30 × 2^20, measured.
+ * Rendered in decimal, a total and the ceiling it is compared to could not be
+ * compared as written — "51.7 MB … over the 30 MiB ceiling" makes the reader do
+ * the conversion before they know how far over they are. The base and the labels
+ * move together: a function dividing by 1024 must not print "MB".
+ */
+const BYTE_UNITS = ['KiB', 'MiB', 'GiB', 'TiB'];
+/** Human-readable bytes, in the binary units the API's ceiling is expressed in. */
+export function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    let value = bytes / 1024;
+    let unit = 0;
+    while (value >= 1024 && unit < BYTE_UNITS.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    // `?? ''` is unreachable — `unit` is bounded by the loop condition — but
+    // noUncheckedIndexedAccess types the read as possibly-undefined and a
+    // non-null assertion would hide a real bug if that bound ever moved.
+    return `${value.toFixed(1)} ${BYTE_UNITS[unit] ?? ''}`.trimEnd();
+}
+/**
+ * A size AND its exact byte count, for the two numbers a refusal compares.
+ *
+ * {@link formatBytes} rounds to one decimal, so a bundle one byte over the
+ * ceiling read `30.0 MiB … over the 30.0 MiB ceiling` — a sentence that refutes
+ * itself and leaves an author with no way to know how much to cut. Rounded for
+ * scanning, exact for acting on; the ceiling is quoted the same way so the two
+ * can actually be compared as written.
+ */
+function sizeWithExactBytes(bytes) {
+    return `${formatBytes(bytes)} (${bytes.toLocaleString('en-US')} bytes)`;
+}
+/** Whatever the platform gave us, as text a reader can act on. */
+function causeOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** A path as the finding spells it: bundle-relative POSIX, and `.` for the root. */
+function bundleRelative(root, target) {
+    return safePath.relative(root, target) || '.';
+}
+/**
+ * The half of `SCAN_PATH_UNREADABLE`'s registry `fix` that is FALSE for every
+ * entry this walk skips by policy, stated once so the two remedies below cannot
+ * drift from each other. See {@link UnweighedEntry.fix}.
+ */
+const NOT_A_PERMISSION_PROBLEM = "Nothing about this entry's permissions is wrong, and `--exclude` is an `audit` flag "
+    + 'that the `vat build` / `vat skills package` lane this check runs in does not accept.';
+/** Remedy for a symlink: skipped because the UPLOADER refuses it, not because it is unreadable. */
+const SYMLINK_SKIPPED_FIX = 'Replace the link with a real copy of the file if the skill needs it, or remove it from the '
+    + 'packaged output — the uploader refuses symbolic links outright, so this entry can never '
+    + `contribute bytes to a published skill. ${NOT_A_PERMISSION_PROBLEM}`;
+/** Remedy for a device, socket or FIFO: nothing to weigh and nothing that can be uploaded. */
+const NOT_A_REGULAR_FILE_FIX = 'Remove it from the packaged output — a device, socket or FIFO has no bytes to weigh and '
+    + 'cannot be uploaded, and one reaching a build output almost always came from a source tree '
+    + `that should not have contained it. ${NOT_A_PERMISSION_PROBLEM}`;
+/**
+ * Every regular file under `root` with its size, plus every entry whose size
+ * could NOT be established.
+ *
+ * ## Why "could not weigh it" is a return value and not a zero
+ *
+ * Every unreadable entry used to be swallowed into `[]`/`undefined` and summed
+ * as ZERO. That under-counts in exactly the direction that produces a clean bill
+ * of health: `statSync` failing on the 35.7 MB `.wasm` (an ELOOP symlink cycle, a
+ * Windows file lock, a file removed between readdir and stat) took the total from
+ * ~36 MB to ~2 MB, the build reported no warnings, and the upload ate a 413
+ * eleven seconds later — precisely the outcome this module exists to prevent.
+ *
+ * Nothing else was going to say so. `RESOURCE_UNREADABLE` — which an earlier
+ * version of this comment claimed "already owns 'VAT could not read this'" — is
+ * emitted by `walk-link-graph.ts` over the SOURCE link graph and never stats the
+ * packaged output. This walk is the only thing that touches these bytes, so the
+ * receipt is its own to emit (`SCAN_PATH_UNREADABLE`, warning: a size check must
+ * not be the thing that fails a build, but it must never be silent about what it
+ * could not put on the scale).
+ *
+ * ## Symlinks, exactly
+ *
+ * **No symlink is weighed, whatever it resolves to** — each becomes an unweighed
+ * entry naming the link, and the receipt says the uploader refuses it outright.
+ *
+ * ⚠️ An earlier version of this comment defended measuring a linked FILE
+ * *through* the link — "a link resolving to a 30 MB file contributes 30 MB,
+ * which matches the uploader, whose `readFileSync` reads the target's bytes."
+ * The two lanes did agree, and both were wrong: reading through the link is how
+ * `notes.md -> /etc/passwd` got published into a shared workspace. The uploader
+ * now refuses any symlink, so there is no such upload to weigh, and pricing one
+ * here would put a number on bytes that can never be sent.
+ *
+ * A symlinked DIRECTORY was never walked and contributed nothing, because
+ * `Dirent.isDirectory()` is lstat-based and answers `false` for it. Now it is
+ * reported for the same reason as the linked file, alongside any other
+ * non-regular entry (device, socket, FIFO) and any dangling link.
+ */
+function walkBundle(root) {
+    const acc = { files: [], unweighed: [] };
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        if (dir === undefined)
+            break;
+        for (const dirent of readDirOrRecord(dir, root, acc)) {
+            const full = safePath.join(dir, dirent.name);
+            if (dirent.isDirectory()) {
+                if (!NEVER_UPLOADED_DIR_NAMES.has(dirent.name))
+                    stack.push(full);
+                continue;
+            }
+            if (dirent.isSymbolicLink()) {
+                acc.unweighed.push({
+                    path: bundleRelative(root, full),
+                    reason: 'it is a symbolic link, which the uploader refuses rather than following — '
+                        + 'no byte of its target can be sent, so none is weighed here',
+                    fix: SYMLINK_SKIPPED_FIX,
+                });
+                continue;
+            }
+            weighEntry(full, bundleRelative(root, full), acc);
+        }
+    }
+    return acc;
+}
+/** Directory entries, recording a receipt when the directory cannot be read. */
+function readDirOrRecord(dir, root, acc) {
+    try {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- caller-supplied packaged output dir
+        return readdirSync(dir, { withFileTypes: true });
+    }
+    catch (error) {
+        acc.unweighed.push({
+            path: bundleRelative(root, dir),
+            reason: `VAT could not read the directory (${causeOf(error)})`,
+        });
+        return [];
+    }
+}
+/** Record one non-directory entry: its size, or why it has none VAT can use. */
+function weighEntry(full, rel, acc) {
+    let stats;
+    try {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- as above
+        stats = statSync(full);
+    }
+    catch (error) {
+        acc.unweighed.push({ path: rel, reason: `VAT could not stat it (${causeOf(error)})` });
+        return;
+    }
+    if (stats.isFile()) {
+        acc.files.push({ path: rel, bytes: stats.size });
+        return;
+    }
+    acc.unweighed.push({
+        path: rel,
+        // Symbolic links never reach here — they are caught by the walk, which does
+        // not follow one. What is left is a device, a socket or a FIFO.
+        reason: 'it is not a regular file (a device, a socket, or a FIFO)',
+        fix: NOT_A_REGULAR_FILE_FIX,
+    });
+}
+/**
+ * The bundle's files, heaviest first — the order both the message and the anchor
+ * want — with EQUAL sizes broken by path, in code-point order.
+ *
+ * 🔑 The tiebreak is not cosmetic: the heaviest file becomes the finding's `link`,
+ * and `link` is the key an adopter's `validation.allow` entry matches. Sorting on
+ * bytes alone left ties in the order `readdir` happened to return them, so two
+ * equal-sized files — a vendored runtime shipped twice, which is exactly the shape
+ * that motivated this check — could swap between a developer's macOS box and a
+ * Linux CI runner. The waiver then matched locally, missed in CI, and was reported
+ * `ALLOW_UNUSED` in the run that needed it.
+ *
+ * The comparator is explicit code points rather than `localeCompare`, for the same
+ * reason `walkableChildren` in the sibling module gives: the order only has to be
+ * the SAME everywhere, and `localeCompare` is locale- and ICU-dependent.
+ */
+function largestFirst(files) {
+    return [...files].sort((a, b) => b.bytes - a.bytes || (a.path < b.path ? -1 : Number(a.path > b.path)));
+}
+/**
+ * The one sentence describing an over-ceiling upload, shared by the build-time
+ * validator and by `vat claude org skills install`'s pre-flight refusal.
+ *
+ * Both refuse for the same external reason, so neither owns the wording: the
+ * uploader's copy would otherwise drift from the validator's, and an author who
+ * met the warning at build would meet a differently-worded version of it at
+ * upload. It takes already-measured files rather than a directory because the
+ * uploader knows something the walker cannot — which files it EXCLUDED (the
+ * declared eval suite) — and must describe the bundle it is actually sending.
+ * The exclusions it can state up front are shared as
+ * {@link NEVER_UPLOADED_DIR_NAMES}, so both sides weigh the same file set.
+ *
+ * The two lanes differ in exactly one place, {@link OversizeMeasure}: the request
+ * variant reports the body it weighed AND the file bytes inside it, so the
+ * framing is visible as the difference rather than as an unexplained discrepancy.
+ */
+export function describeOversizeBundle(files, measure, limitBytes = API_SKILL_MAX_UPLOAD_BYTES) {
+    const largest = largestFirst(files).slice(0, LARGEST_FILES_NAMED);
+    const named = largest.map(file => `${file.path} (${formatBytes(file.bytes)})`).join(', ');
+    const remainder = files.length - largest.length;
+    const tail = remainder > 0 ? `, and ${remainder} more ${plural('file', remainder)}` : '';
+    const across = `${files.length} ${plural('file', files.length)}`;
+    const fileBytes = files.reduce((sum, file) => sum + file.bytes, 0);
+    const subject = measure.of === 'upload-request'
+        ? `Upload request body is ${sizeWithExactBytes(measure.bytes)} — ${formatBytes(fileBytes)} `
+            + `of file content across ${across}, plus per-part multipart framing —`
+        : `Packaged skill is ${sizeWithExactBytes(measure.bytes)} across ${across},`;
+    return (`${subject} over the ${sizeWithExactBytes(limitBytes)} Anthropic Skills API ` +
+        `upload ceiling. Largest: ${named}${tail}`);
+}
+/**
+ * One receipt per entry the walk could not put on the scale.
+ *
+ * The `fix` is PER INSTANCE, falling back to the registry's only for the entries
+ * the registry's text actually describes — a readdir or stat FAILURE. Everything
+ * else here is a deliberate skip, and the registry advice ("make the path
+ * readable… or pass `--exclude`") sends its author to fix permissions on a
+ * healthy file with a flag this command does not have. See
+ * {@link UnweighedEntry.fix}.
+ */
+function unweighedIssues(entries) {
+    const registryEntry = CODE_REGISTRY.SCAN_PATH_UNREADABLE;
+    return entries.map(entry => ({
+        severity: registryEntry.defaultSeverity,
+        code: 'SCAN_PATH_UNREADABLE',
+        message: `Not weighed against the ${formatBytes(API_SKILL_MAX_UPLOAD_BYTES)} Anthropic Skills API upload ceiling: `
+            + `${entry.reason}. The packaged size VAT measured is a LOWER BOUND.`,
+        location: entry.path,
+        fix: entry.fix ?? registryEntry.fix,
+        reference: registryEntry.reference,
+    }));
+}
+/**
+ * Emit `PACKAGED_SIZE_EXCEEDS_API_LIMIT` when the packaged bundle at `outputDir`
+ * is at or over the API upload ceiling, plus one `SCAN_PATH_UNREADABLE` for every
+ * entry whose bytes VAT could not establish.
+ *
+ * ## This weighs FILES, and deliberately not the request
+ *
+ * The API refuses on the size of the multipart REQUEST, and the uploader weighs
+ * exactly that — the body it is about to send. This lane cannot: there is no
+ * request at build time, and the framing is not a property of the bundle. Its
+ * per-part cost is `156 + len(filename)`, where the filename is not the packaged
+ * path but `<declared-name>/<packaged-path>` as the uploader keys it, and the
+ * body also carries whatever fields that endpoint takes — a `display_title` on
+ * create, none on a version add. Every one of those is decided at upload time.
+ *
+ * Adding an ESTIMATE of it here would mean re-deriving the multipart builder's
+ * arithmetic in a second place, where it would silently stop matching the first —
+ * which is the same defect as a fudge factor, only harder to spot. So this check
+ * measures what it can see, the message says "Packaged skill is …", and the
+ * uploader's says "Upload request body is …". They are different numbers on
+ * purpose, and a bundle that clears this one can still be refused there.
+ *
+ * One size issue for the bundle, not one per file: unlike a per-reference
+ * finding, the defect here IS the total — no single file is "the" problem unless
+ * it alone exceeds the ceiling, and emitting per file would hand an adopter a
+ * waiver granularity that cannot express the actual fix.
+ *
+ * ## The anchor, and why the largest file is `link`
+ *
+ * `location` is the bundle root (`.`) because the finding is about the bundle —
+ * but `.` is the SAME STRING for every skill in a multi-skill build, so an allow
+ * glob written against it waives all of them or none. That left one escape hatch,
+ * `severity.PACKAGED_SIZE_EXCEEDS_API_LIMIT: ignore`, which is project-wide: an
+ * adopter with 40 skills, one legitimately bundling a 32 MB runtime it never
+ * publishes to the API, had to blind themselves on the other 39.
+ *
+ * So the largest file rides as `link` — the same convention the rest of this lane
+ * uses (`referenced-path-missing`, `mcp-tool-qualification`), where `link` is the
+ * specific thing an instance is about and `location` stays the file you open.
+ * `applyAllowFilter` matches an allow glob against `location` OR `link`, so:
+ *
+ * ```yaml
+ * validation:
+ *   allow:
+ *     PACKAGED_SIZE_EXCEEDS_API_LIMIT:
+ *       - paths: ["scripts/duckdb-eh.wasm"]
+ *         reason: "Runtime this skill needs; never published to the Skills API."
+ * ```
+ *
+ * …waives exactly the bundles whose weight that file explains, and every other
+ * skill keeps the check.
+ *
+ * ⚠️ Two skills bundling the SAME oversized artifact share one anchor, so one
+ * entry waives both. That is the right grain for the case that produced this
+ * check (one `.wasm`, three skills, one decision), but it is NOT per-skill
+ * precision. Per-skill would need an anchor naming the skill, which this call
+ * site cannot mint: `location` must be a project-relative path and the packager
+ * passes only an absolute output directory. A caller that wants it should pass
+ * the bundle root as `issueLocation(outputPath, projectRoot)` and have this
+ * function use it in place of `.`.
+ *
+ * @param outputDir Absolute path to the packaged skill output.
+ * @param limitBytes Ceiling to compare against. Defaults to the documented API
+ *   limit; parameterized so a test can drive it with a few kilobytes instead of
+ *   writing 30 MB of fixture to disk.
+ */
+export function checkPackagedSizeLimit(outputDir, limitBytes = API_SKILL_MAX_UPLOAD_BYTES) {
+    const { files, unweighed } = walkBundle(outputDir);
+    const issues = unweighedIssues(unweighed);
+    const total = files.reduce((sum, file) => sum + file.bytes, 0);
+    // `>=`, deliberately unlike the uploader's `>`. This weighs FILE bytes, and
+    // per-part framing is never zero, so a bundle whose files total exactly the
+    // limit is always a request LARGER than the limit — a real 413. See
+    // {@link API_SKILL_MAX_UPLOAD_BYTES} for the measured boundary and why the two
+    // operators must not be made to match.
+    if (total < limitBytes)
+        return issues;
+    const registryEntry = CODE_REGISTRY.PACKAGED_SIZE_EXCEEDS_API_LIMIT;
+    const heaviest = largestFirst(files)[0];
+    issues.push({
+        severity: registryEntry.defaultSeverity,
+        code: 'PACKAGED_SIZE_EXCEEDS_API_LIMIT',
+        message: describeOversizeBundle(files, { of: 'packaged-files', bytes: total }, limitBytes),
+        // The bundle root, because the finding is about the bundle. Naming the
+        // largest file here would claim that one file is the defect, which is only
+        // true when it alone exceeds the ceiling — it rides as `link` instead.
+        location: '.',
+        // Absent only for a bundle with no weighable file at all, which needs a
+        // zero or negative limit to reach this line.
+        ...(heaviest === undefined ? {} : { link: heaviest.path }),
+        fix: registryEntry.fix,
+        reference: registryEntry.reference,
+    });
+    return issues;
+}
+//# sourceMappingURL=packaged-size-limit.js.map

package/dist/validators/packaged-size-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packaged-size-limit.js","sourceRoot":"","sources":["../../src/validators/packaged-size-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAe,MAAM,SAAS,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAwB,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;AAExG,2EAA2E;AAC3E,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;AACzC,CAAC;AAED,oEAAoE;AACpE,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAyC9B;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAEzD,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,KAAK,IAAI,CAAC;IACtC,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,KAAK,IAAI,IAAI,IAAI,IAAI,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,KAAK,IAAI,IAAI,CAAC;QACd,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,qEAAqE;IACrE,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;AAC1E,CAAC;AAQD,kEAAkE;AAClE,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAC5B,sFAAsF;MACpF,sFAAsF,CAAC;AAE3F,mGAAmG;AACnG,MAAM,mBAAmB,GACvB,6FAA6F;MAC3F,0FAA0F;MAC1F,0CAA0C,wBAAwB,EAAE,CAAC;AAEzE,8FAA8F;AAC9F,MAAM,sBAAsB,GAC1B,0FAA0F;MACxF,4FAA4F;MAC5F,sCAAsC,wBAAwB,EAAE,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM;QAC7B,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjE,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;oBAChC,MAAM,EACJ,4EAA4E;0BAC1E,4DAA4D;oBAChE,GAAG,EAAE,mBAAmB;iBACzB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,GAAoB;IACtE,IAAI,CAAC;QACH,0GAA0G;QAC1G,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC;YAC/B,MAAM,EAAE,qCAAqC,OAAO,CAAC,KAAK,CAAC,GAAG;SAC/D,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,GAAoB;IACjE,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,+EAA+E;QAC/E,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,0BAA0B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;QACjB,IAAI,EAAE,GAAG;QACT,4EAA4E;QAC5E,gEAAgE;QAChE,MAAM,EAAE,0DAA0D;QAClE,GAAG,EAAE,sBAAsB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,YAAY,CAAC,KAA2B;IAC/C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9B,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA2B,EAC3B,OAAwB,EACxB,aAAqB,0BAA0B;IAE/C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,IAAI,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,KAAK,gBAAgB;QAC7C,CAAC,CAAC,0BAA0B,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG;cACxF,0BAA0B,MAAM,qCAAqC;QACzE,CAAC,CAAC,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,MAAM,GAAG,CAAC;IAC/E,OAAO,CACL,GAAG,OAAO,aAAa,kBAAkB,CAAC,UAAU,CAAC,wBAAwB;QAC7E,4BAA4B,KAAK,GAAG,IAAI,EAAE,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAkC;IACzD,MAAM,aAAa,GAAG,aAAa,CAAC,oBAAoB,CAAC;IACzD,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3B,QAAQ,EAAE,aAAa,CAAC,eAAe;QACvC,IAAI,EAAE,sBAA+B;QACrC,OAAO,EACL,2BAA2B,WAAW,CAAC,0BAA0B,CAAC,wCAAwC;cACxG,GAAG,KAAK,CAAC,MAAM,oDAAoD;QACvE,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG;QACnC,SAAS,EAAE,aAAa,CAAC,SAAS;KACnC,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,aAAqB,0BAA0B;IAE/C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/D,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE,+EAA+E;IAC/E,uCAAuC;IACvC,IAAI,KAAK,GAAG,UAAU;QAAE,OAAO,MAAM,CAAC;IAEtC,MAAM,aAAa,GAAG,aAAa,CAAC,+BAA+B,CAAC;IACpE,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC;QACV,QAAQ,EAAE,aAAa,CAAC,eAAe;QACvC,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,sBAAsB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC;QAC1F,uEAAuE;QACvE,2EAA2E;QAC3E,uEAAuE;QACvE,QAAQ,EAAE,GAAG;QACb,wEAAwE;QACxE,6CAA6C;QAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1D,GAAG,EAAE,aAAa,CAAC,GAAG;QACtB,SAAS,EAAE,aAAa,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/validators/packaging-validator.d.ts

@@ -12,7 +12,7 @@
  * - vat skills build (block build on validation errors)
  * - vat skills audit --user (report issues, exit 0 always)
  */
-import { ResourceRegistry, type ResourcePopulationSource, type SkillExecutableEntry } from '@vibe-agent-toolkit/resources';
+import { type RegistryUnreadablePolicy, ResourceRegistry, type ResourcePopulationSource, type SkillExecutableEntry } from '@vibe-agent-toolkit/resources';
 import { type AllowUsageLedger, type AllowRecord, type ValidationConfig, type ValidationIssue } from '@vibe-agent-toolkit/schema';
 import { type GitTracker } from '@vibe-agent-toolkit/utils/git';
 import type { EvidenceRecord, Observation } from '../evidence/index.js';
@@ -143,6 +143,18 @@ export declare function activeWarningsOf(result: WithAllErrors): ValidationIssue
  * Options for {@link crawlAndResolveRegistry}.
  */
 export interface CrawlRegistryOptions {
+    /**
+     * What the crawl does with a directory it cannot list — the caller's ruling,
+     * required, no default: `'refuse'` for every verb that acts on the registry as
+     * a complete population, `{ degrade }` for `vat audit`. See
+     * {@link RegistryUnreadablePolicy} on the registry for the two rulings.
+     *
+     * NOT part of the memo key: the memo replays the refusals the ONE crawl met
+     * into every later caller's policy, so a `'refuse'` caller served a registry
+     * that was built under `{ degrade }` still gets its throw — see
+     * {@link MemoizedRegistry}.
+     */
+    unreadable: RegistryUnreadablePolicy;
     /**
      * Where the file list comes from — omit for the incumbent walk, supply one to
      * source it from a projection instead.
@@ -207,7 +219,7 @@ export interface CrawlRegistryOptions {
  * the projection lane no declarations, so the two lanes still AGREE — which is
  * the property this function exists to hold.
  */
-export declare function crawlAndResolveRegistry(projectRoot: string, options?: CrawlRegistryOptions): Promise<ResourceRegistry>;
+export declare function crawlAndResolveRegistry(projectRoot: string, options: CrawlRegistryOptions): Promise<ResourceRegistry>;
 /**
  * Drop every memoized registry.
  *
@@ -234,6 +246,23 @@ export declare function resetPackagingRegistryCache(): void;
  * legacy per-skill behavior so one-off callers keep working.
  */
 export interface SkillValidationSharedContext {
+    /**
+     * What the validator's OWN registry crawl does with a directory it cannot
+     * list, when it has to build one (no `registry` below, or one that does not
+     * cover this skill) — the caller's ruling, and the ONE required field here:
+     * `'refuse'` for `vat skills validate`/`build`, `vat skill review` and the
+     * packager's post-build check, `{ degrade }` for `vat audit`, whose directory
+     * lane supplies no registry and reaches {@link crawlAndResolveRegistry} through
+     * exactly this seam. See {@link RegistryUnreadablePolicy}.
+     *
+     * Ignored when `registry` below already covers the skill, for the same reason
+     * `populationSource` is: the caller that built it has already ruled.
+     *
+     * A caller that passes NO shared context at all is a single-skill lane whose
+     * result is acted on whole, and is ruled `'refuse'` by
+     * {@link validateSkillForPackaging} — said there, once, not defaulted here.
+     */
+    unreadable: RegistryUnreadablePolicy;
     /** Pre-built registry that covers the skill's project root. */
     registry?: ResourceRegistry;
     /**
@@ -356,6 +385,16 @@ export declare function validateSkillForPackaging(skillPath: string, packagingCo
  * with values derived from the skill path.
  */
 export declare function detectNameMismatchIssue(frontmatterName: unknown, parentDir: string, skillLocation: string): ValidationIssue | null;
+/**
+ * Collect NON_PORTABLE_ASSET_REFERENCE issues — scan one skill document for any
+ * member of the non-portable asset-reference family.
+ */
+export declare function collectNonPortableAssetReferenceIssues(content: string, docLocation: string, issues: ValidationIssue[]): void;
+/**
+ * Collect NON_PORTABLE_COMMAND issues — scan one skill document for any member of
+ * the non-portable shell-command family.
+ */
+export declare function collectNonPortableCommandIssues(content: string, docLocation: string, issues: ValidationIssue[]): void;
 /**
  * Process links from parsed markdown and return resolved .md file paths.
  *

package/dist/validators/packaging-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packaging-validator.d.ts","sourceRoot":"","sources":["../../src/validators/packaging-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,EAAkD,gBAAgB,EAAE,KAAK,wBAAwB,EAAE,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC3K,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAEhB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAQpC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAmB1B;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2BAA2B,CAAC,EAAE;QAC5B,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACzD,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,uFAAuF;IACvF,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC1C;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,GAAG,eAAe,GAAG,aAAa,CAAC,CAAC;IACzE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CACnD;AAED,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,kBAAkB,GAAG,YAAY,GAAG,qBAAqB,CAAC;IAC5K,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;OAQG;IACH,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAE5B;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,eAAe,EAAE,CAAC;IAE7B,yCAAyC;IACzC,aAAa,EAAE,WAAW,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,YAAY,EAAE,WAAW,EAAE,CAAC;IAE5B;;;;OAIG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAC;IAE3B,+BAA+B;IAC/B,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,kBAAkB,EAAE,uBAAuB,EAAE,CAAC;KAC/C,CAAC;CACH;AAED,qFAAqF;AACrF,KAAK,aAAa,GAAG,IAAI,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,EAAE,CAEvE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,EAAE,CAEzE;AAwED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CA+B3B;AAuGD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAMlD;AAmBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,4BAA4B;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IAC5C,kEAAkE;IAClE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,oBAAoB,EACtC,OAAO,GAAE,QAAQ,GAAG,OAAkB,EACtC,MAAM,CAAC,EAAE,4BAA4B,GACpC,OAAO,CAAC,yBAAyB,CAAC,CA8OpC;AAyFD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,eAAe,GAAG,IAAI,CA4BxB;AAwTD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5C,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,CAkCV"}
+{"version":3,"file":"packaging-validator.d.ts","sourceRoot":"","sources":["../../src/validators/packaging-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,EAKL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAEhB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AASpC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAoB1B;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2BAA2B,CAAC,EAAE;QAC5B,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACzD,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,uFAAuF;IACvF,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC1C;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,GAAG,eAAe,GAAG,aAAa,CAAC,CAAC;IACzE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CACnD;AAED,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,kBAAkB,GAAG,YAAY,GAAG,qBAAqB,CAAC;IAC5K,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;OAQG;IACH,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAE5B;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,eAAe,EAAE,CAAC;IAE7B,yCAAyC;IACzC,aAAa,EAAE,WAAW,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,YAAY,EAAE,WAAW,EAAE,CAAC;IAE5B;;;;OAIG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAC;IAE3B,+BAA+B;IAC/B,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,kBAAkB,EAAE,uBAAuB,EAAE,CAAC;KAC/C,CAAC;CACH;AAED,qFAAqF;AACrF,KAAK,aAAa,GAAG,IAAI,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,EAAE,CAEvE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,EAAE,CAEzE;AAwED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;OAUG;IACH,UAAU,EAAE,wBAAwB,CAAC;IACrC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACzD;AA2CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAyC3B;AAuGD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAMlD;AA+CD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;;;;;;;;;OAeG;IACH,UAAU,EAAE,wBAAwB,CAAC;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IAC5C,kEAAkE;IAClE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AA+BD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,oBAAoB,EACtC,OAAO,GAAE,QAAQ,GAAG,OAAkB,EACtC,MAAM,CAAC,EAAE,4BAA4B,GACpC,OAAO,CAAC,yBAAyB,CAAC,CA+PpC;AAyFD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,eAAe,GAAG,IAAI,CA4BxB;AA8SD;;;GAGG;AACH,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,eAAe,EAAE,GACxB,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,eAAe,EAAE,GACxB,IAAI,CASN;AAqBD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5C,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,CAkCV"}