@vibe-agent-toolkit/cli 0.2.0-rc.11 → 0.2.0-rc.12

package/dist/commands/claude/marketplace/validate-schema.d.ts

@@ -0,0 +1,362 @@
+/**
+ * The document `vat claude marketplace validate` publishes, apart from the
+ * command.
+ *
+ * A sibling module because the published-shape registry imports it and the
+ * command imports the writer that imports the registry: a schema declared in
+ * the command module itself would be an import cycle, read before it is
+ * initialised.
+ *
+ * 🔑 **One base, one meaning of `summary`.** `data.root` is the marketplace
+ * directory, stated once; every finding's `location`, every plugin `path`, and
+ * every `undeclared` / `refused` entry is relative to it. `summary` — on the
+ * envelope and on a plugin row — always counts FINDINGS by severity. Every
+ * finding is on the envelope, flat; a plugin row is a tally of the findings
+ * its own validator published, never a second list.
+ */
+import { type Report } from '@vibe-agent-toolkit/schema';
+import { z } from 'zod';
+import type { ExaminedDeclaration } from '../../../utils/run-integrity.js';
+/** What `examined` counts for `vat claude marketplace validate`, and the remedy when it is zero. */
+export declare const MARKETPLACE_VALIDATE_EXAMINED: ExaminedDeclaration;
+declare const MarketplaceValidateDataSchema: z.ZodObject<{
+    /** The marketplace directory — the ONE base every `location` and path below is relative to. */
+    root: z.ZodString;
+    /** The manifest's facts; `null` when it is missing or does not validate. */
+    marketplace: z.ZodNullable<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+        /** Every entry the manifest's `plugins` list declares, remote and local. */
+        pluginEntries: z.ZodOptional<z.ZodNumber>;
+        /** The entries whose `source` is a relative path — plugins this marketplace ships itself. */
+        localPluginSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            source: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            source: string;
+            name: string;
+        }, {
+            source: string;
+            name: string;
+        }>, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        name?: string | undefined;
+        version?: string | undefined;
+        description?: string | undefined;
+        pluginEntries?: number | undefined;
+        localPluginSources?: {
+            source: string;
+            name: string;
+        }[] | undefined;
+    }, {
+        name?: string | undefined;
+        version?: string | undefined;
+        description?: string | undefined;
+        pluginEntries?: number | undefined;
+        localPluginSources?: {
+            source: string;
+            name: string;
+        }[] | undefined;
+    }>>;
+    /** One row per declared local plugin the run walked. */
+    plugins: z.ZodArray<z.ZodObject<{
+        /** The manifest entry's `name`. */
+        name: z.ZodString;
+        /** The manifest entry's `source`, as the manifest wrote it. */
+        source: z.ZodString;
+        /** The directory the source resolved to, relative to `data.root`. */
+        path: z.ZodString;
+        /**
+         * `false` when the plugin's `plugin.json` resolves outside the root and was
+         * never opened — its row then counts nothing, and the run carries the
+         * `RESOURCE_CHECK_BROKEN` finding naming it.
+         */
+        manifestRead: z.ZodBoolean;
+        status: z.ZodEnum<["ok", "findings"]>;
+        /** The findings the plugin's own validator published, by severity. */
+        summary: z.ZodObject<{
+            errors: z.ZodNumber;
+            warnings: z.ZodNumber;
+            info: z.ZodNumber;
+        }, "strict", z.ZodTypeAny, {
+            info: number;
+            errors: number;
+            warnings: number;
+        }, {
+            info: number;
+            errors: number;
+            warnings: number;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        source: string;
+        name: string;
+        path: string;
+        status: "ok" | "findings";
+        summary: {
+            info: number;
+            errors: number;
+            warnings: number;
+        };
+        manifestRead: boolean;
+    }, {
+        source: string;
+        name: string;
+        path: string;
+        status: "ok" | "findings";
+        summary: {
+            info: number;
+            errors: number;
+            warnings: number;
+        };
+        manifestRead: boolean;
+    }>, "many">;
+    /** Directories under `plugins/` no manifest entry names — listed, never graded. */
+    undeclared: z.ZodArray<z.ZodString, "many">;
+    /** Paths inside a walked plugin the run would not open: each resolves outside the root. */
+    refused: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    refused: string[];
+    root: string;
+    marketplace: {
+        name?: string | undefined;
+        version?: string | undefined;
+        description?: string | undefined;
+        pluginEntries?: number | undefined;
+        localPluginSources?: {
+            source: string;
+            name: string;
+        }[] | undefined;
+    } | null;
+    plugins: {
+        source: string;
+        name: string;
+        path: string;
+        status: "ok" | "findings";
+        summary: {
+            info: number;
+            errors: number;
+            warnings: number;
+        };
+        manifestRead: boolean;
+    }[];
+    undeclared: string[];
+}, {
+    refused: string[];
+    root: string;
+    marketplace: {
+        name?: string | undefined;
+        version?: string | undefined;
+        description?: string | undefined;
+        pluginEntries?: number | undefined;
+        localPluginSources?: {
+            source: string;
+            name: string;
+        }[] | undefined;
+    } | null;
+    plugins: {
+        source: string;
+        name: string;
+        path: string;
+        status: "ok" | "findings";
+        summary: {
+            info: number;
+            errors: number;
+            warnings: number;
+        };
+        manifestRead: boolean;
+    }[];
+    undeclared: string[];
+}>;
+export type MarketplaceValidateData = z.infer<typeof MarketplaceValidateDataSchema>;
+/** The document this command publishes. */
+export declare const MARKETPLACE_VALIDATE_REPORT_SCHEMA: import("@vibe-agent-toolkit/schema").ReportZodSchema<z.ZodObject<{
+    /** The marketplace directory — the ONE base every `location` and path below is relative to. */
+    root: z.ZodString;
+    /** The manifest's facts; `null` when it is missing or does not validate. */
+    marketplace: z.ZodNullable<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+        /** Every entry the manifest's `plugins` list declares, remote and local. */
+        pluginEntries: z.ZodOptional<z.ZodNumber>;
+        /** The entries whose `source` is a relative path — plugins this marketplace ships itself. */
+        localPluginSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            source: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            source: string;
+            name: string;
+        }, {
+            source: string;
+            name: string;
+        }>, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        name?: string | undefined;
+        version?: string | undefined;
+        description?: string | undefined;
+        pluginEntries?: number | undefined;
+        localPluginSources?: {
+            source: string;
+            name: string;
+        }[] | undefined;
+    }, {
+        name?: string | undefined;
+        version?: string | undefined;
+        description?: string | undefined;
+        pluginEntries?: number | undefined;
+        localPluginSources?: {
+            source: string;
+            name: string;
+        }[] | undefined;
+    }>>;
+    /** One row per declared local plugin the run walked. */
+    plugins: z.ZodArray<z.ZodObject<{
+        /** The manifest entry's `name`. */
+        name: z.ZodString;
+        /** The manifest entry's `source`, as the manifest wrote it. */
+        source: z.ZodString;
+        /** The directory the source resolved to, relative to `data.root`. */
+        path: z.ZodString;
+        /**
+         * `false` when the plugin's `plugin.json` resolves outside the root and was
+         * never opened — its row then counts nothing, and the run carries the
+         * `RESOURCE_CHECK_BROKEN` finding naming it.
+         */
+        manifestRead: z.ZodBoolean;
+        status: z.ZodEnum<["ok", "findings"]>;
+        /** The findings the plugin's own validator published, by severity. */
+        summary: z.ZodObject<{
+            errors: z.ZodNumber;
+            warnings: z.ZodNumber;
+            info: z.ZodNumber;
+        }, "strict", z.ZodTypeAny, {
+            info: number;
+            errors: number;
+            warnings: number;
+        }, {
+            info: number;
+            errors: number;
+            warnings: number;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        source: string;
+        name: string;
+        path: string;
+        status: "ok" | "findings";
+        summary: {
+            info: number;
+            errors: number;
+            warnings: number;
+        };
+        manifestRead: boolean;
+    }, {
+        source: string;
+        name: string;
+        path: string;
+        status: "ok" | "findings";
+        summary: {
+            info: number;
+            errors: number;
+            warnings: number;
+        };
+        manifestRead: boolean;
+    }>, "many">;
+    /** Directories under `plugins/` no manifest entry names — listed, never graded. */
+    undeclared: z.ZodArray<z.ZodString, "many">;
+    /** Paths inside a walked plugin the run would not open: each resolves outside the root. */
+    refused: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    refused: string[];
+    root: string;
+    marketplace: {
+        name?: string | undefined;
+        version?: string | undefined;
+        description?: string | undefined;
+        pluginEntries?: number | undefined;
+        localPluginSources?: {
+            source: string;
+            name: string;
+        }[] | undefined;
+    } | null;
+    plugins: {
+        source: string;
+        name: string;
+        path: string;
+        status: "ok" | "findings";
+        summary: {
+            info: number;
+            errors: number;
+            warnings: number;
+        };
+        manifestRead: boolean;
+    }[];
+    undeclared: string[];
+}, {
+    refused: string[];
+    root: string;
+    marketplace: {
+        name?: string | undefined;
+        version?: string | undefined;
+        description?: string | undefined;
+        pluginEntries?: number | undefined;
+        localPluginSources?: {
+            source: string;
+            name: string;
+        }[] | undefined;
+    } | null;
+    plugins: {
+        source: string;
+        name: string;
+        path: string;
+        status: "ok" | "findings";
+        summary: {
+            info: number;
+            errors: number;
+            warnings: number;
+        };
+        manifestRead: boolean;
+    }[];
+    undeclared: string[];
+}>, z.ZodObject<Omit<{
+    code: z.ZodString;
+    severity: z.ZodEnum<["error", "warning", "info", "ignore"]>;
+    message: z.ZodString;
+    location: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
+    line: z.ZodOptional<z.ZodNumber>;
+    field: z.ZodOptional<z.ZodString>;
+    link: z.ZodOptional<z.ZodString>;
+    fix: z.ZodOptional<z.ZodString>;
+    reference: z.ZodOptional<z.ZodString>;
+    suggestion: z.ZodOptional<z.ZodString>;
+}, "severity"> & {
+    severity: z.ZodEnum<["error", "warning", "info"]>;
+    column: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+    message: string;
+    severity: "error" | "warning" | "info";
+    fix?: string | undefined;
+    reference?: string | undefined;
+    location?: string | undefined;
+    line?: number | undefined;
+    field?: string | undefined;
+    link?: string | undefined;
+    suggestion?: string | undefined;
+    column?: number | undefined;
+}, {
+    code: string;
+    message: string;
+    severity: "error" | "warning" | "info";
+    fix?: string | undefined;
+    reference?: string | undefined;
+    location?: string | undefined;
+    line?: number | undefined;
+    field?: string | undefined;
+    link?: string | undefined;
+    suggestion?: string | undefined;
+    column?: number | undefined;
+}>>;
+export type MarketplaceValidateReport = Report<MarketplaceValidateData>;
+export {};
+//# sourceMappingURL=validate-schema.d.ts.map

package/dist/commands/claude/marketplace/validate-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-schema.d.ts","sourceRoot":"","sources":["../../../../src/commands/claude/marketplace/validate-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAqD,KAAK,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,oGAAoG;AACpG,eAAO,MAAM,6BAA6B,EAAE,mBAI3C,CAAC;AAgCF,QAAA,MAAM,6BAA6B;IACjC,+FAA+F;;IAE/F,4EAA4E;;;;;QA5B5E,4EAA4E;;QAE5E,6FAA6F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4B7F,wDAAwD;;QAtBxD,mCAAmC;;QAEnC,+DAA+D;;QAE/D,qEAAqE;;QAErE;;;;WAIG;;;QAGH,sEAAsE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAWtE,mFAAmF;;IAEnF,2FAA2F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAElF,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,2CAA2C;AAC3C,eAAO,MAAM,kCAAkC;IAf7C,+FAA+F;;IAE/F,4EAA4E;;;;;QA5B5E,4EAA4E;;QAE5E,6FAA6F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4B7F,wDAAwD;;QAtBxD,mCAAmC;;QAEnC,+DAA+D;;QAE/D,qEAAqE;;QAErE;;;;WAIG;;;QAGH,sEAAsE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAWtE,mFAAmF;;IAEnF,2FAA2F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAOe,CAAC;AAE7G,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC"}

package/dist/commands/claude/marketplace/validate-schema.js

@@ -0,0 +1,67 @@
+/**
+ * The document `vat claude marketplace validate` publishes, apart from the
+ * command.
+ *
+ * A sibling module because the published-shape registry imports it and the
+ * command imports the writer that imports the registry: a schema declared in
+ * the command module itself would be an import cycle, read before it is
+ * initialised.
+ *
+ * 🔑 **One base, one meaning of `summary`.** `data.root` is the marketplace
+ * directory, stated once; every finding's `location`, every plugin `path`, and
+ * every `undeclared` / `refused` entry is relative to it. `summary` — on the
+ * envelope and on a plugin row — always counts FINDINGS by severity. Every
+ * finding is on the envelope, flat; a plugin row is a tally of the findings
+ * its own validator published, never a second list.
+ */
+import { FindingSchema, reportSchema, SeverityCountsSchema } from '@vibe-agent-toolkit/schema';
+import { z } from 'zod';
+/** What `examined` counts for `vat claude marketplace validate`, and the remedy when it is zero. */
+export const MARKETPLACE_VALIDATE_EXAMINED = {
+    unit: 'plugin entries',
+    whenZero: 'The marketplace manifest declares no plugin, or it could not be validated — point the command at'
+        + ' a marketplace directory holding a valid .claude-plugin/marketplace.json with at least one entry in plugins[].',
+};
+/** The manifest's own facts, once it validated against the marketplace schema. */
+const MarketplaceSchema = z.object({
+    name: z.string().optional(),
+    description: z.string().optional(),
+    version: z.string().optional(),
+    /** Every entry the manifest's `plugins` list declares, remote and local. */
+    pluginEntries: z.number().int().nonnegative().optional(),
+    /** The entries whose `source` is a relative path — plugins this marketplace ships itself. */
+    localPluginSources: z.array(z.object({ name: z.string(), source: z.string() }).strict()).optional(),
+}).strict();
+/** One declared local plugin the run walked, keyed by the manifest entry it satisfies. */
+const PluginRowSchema = z.object({
+    /** The manifest entry's `name`. */
+    name: z.string(),
+    /** The manifest entry's `source`, as the manifest wrote it. */
+    source: z.string(),
+    /** The directory the source resolved to, relative to `data.root`. */
+    path: z.string(),
+    /**
+     * `false` when the plugin's `plugin.json` resolves outside the root and was
+     * never opened — its row then counts nothing, and the run carries the
+     * `RESOURCE_CHECK_BROKEN` finding naming it.
+     */
+    manifestRead: z.boolean(),
+    status: z.enum(['ok', 'findings']),
+    /** The findings the plugin's own validator published, by severity. */
+    summary: SeverityCountsSchema,
+}).strict();
+const MarketplaceValidateDataSchema = z.object({
+    /** The marketplace directory — the ONE base every `location` and path below is relative to. */
+    root: z.string(),
+    /** The manifest's facts; `null` when it is missing or does not validate. */
+    marketplace: MarketplaceSchema.nullable(),
+    /** One row per declared local plugin the run walked. */
+    plugins: z.array(PluginRowSchema),
+    /** Directories under `plugins/` no manifest entry names — listed, never graded. */
+    undeclared: z.array(z.string()),
+    /** Paths inside a walked plugin the run would not open: each resolves outside the root. */
+    refused: z.array(z.string()),
+}).strict();
+/** The document this command publishes. */
+export const MARKETPLACE_VALIDATE_REPORT_SCHEMA = reportSchema(MarketplaceValidateDataSchema, FindingSchema);
+//# sourceMappingURL=validate-schema.js.map

package/dist/commands/claude/marketplace/validate-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-schema.js","sourceRoot":"","sources":["../../../../src/commands/claude/marketplace/validate-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAe,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,oGAAoG;AACpG,MAAM,CAAC,MAAM,6BAA6B,GAAwB;IAChE,IAAI,EAAE,gBAAgB;IACtB,QAAQ,EAAE,kGAAkG;UACxG,gHAAgH;CACrH,CAAC;AAEF,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,4EAA4E;IAC5E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACxD,6FAA6F;IAC7F,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpG,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,0FAA0F;AAC1F,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,mCAAmC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,+DAA+D;IAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,qEAAqE;IACrE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAClC,sEAAsE;IACtE,OAAO,EAAE,oBAAoB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,+FAA+F;IAC/F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,4EAA4E;IAC5E,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,wDAAwD;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACjC,mFAAmF;IACnF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,2FAA2F;IAC3F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,YAAY,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAC"}

package/dist/commands/claude/marketplace/validate.d.ts

@@ -7,16 +7,20 @@
  * - LICENSE file must exist (error)
  * - README.md should exist (warning)
  * - CHANGELOG.md should exist (warning)
+ *
+ * Publishes the `Report<T>` envelope (`validate-schema.ts`): every finding flat
+ * with its `location` relative to `data.root`, one `data.plugins` row per
+ * declared local plugin walked.
  */
 import { type ValidationResult } from '@vibe-agent-toolkit/agent-skills';
-import { calculateValidationStatus, type ValidationIssue } from '@vibe-agent-toolkit/schema';
+import { type ValidationIssue } from '@vibe-agent-toolkit/schema';
 import { Command } from 'commander';
-import { type FindingCountSummary } from '../../../utils/issue-rendering.js';
 import { createLogger } from '../../../utils/logger.js';
-import { type PhaseOutcome } from '../../phase-utils.js';
+import type { PhaseOutcome } from '../../phase-utils.js';
+import type { MarketplaceValidateReport } from './validate-schema.js';
 interface MarketplaceValidateOptions {
     debug?: boolean;
-    /** Show all inspected assets, including those without issues (per-issue detail). */
+    /** Print every finding in full on stderr. The published document is the same either way. */
     verbose?: boolean;
 }
 /** One manifest entry with a relative-path `source`, as the manifest wrote it. */
@@ -27,6 +31,13 @@ export interface LocalPluginSource {
 /** One declared local plugin the run validated, keyed by the entry it satisfies. */
 export interface LocalPluginResult extends LocalPluginSource {
     result: ValidationResult;
+    /**
+     * `false` when the plugin's manifest was refused (it resolves outside the
+     * marketplace root) and never opened. REQUIRED: the library `status` of an
+     * unread plugin is `ok` over an empty issue list, so without this bit the
+     * row would read as a clean plugin — see {@link validateContainedPlugin}.
+     */
+    manifestRead: boolean;
 }
 /** Every finding the command reports, all anchored at one marketplace root. */
 export interface MarketplaceFindings {
@@ -42,6 +53,12 @@ export interface MarketplaceFindings {
      * Empty when the manifest failed: the run never reached a plugin.
      */
     refused: string[];
+    /**
+     * Paths inside a validated plugin's `skills/` the OS would not let the walk
+     * list or read (a `skills/` dir, a skill dir, a `SKILL.md`), relative to the
+     * root. Each also has its `SCAN_PATH_UNREADABLE` warning in `issues`.
+     */
+    unread: string[];
     /**
      * Manifest, required-file, plugin and skill issues, in report order, with
      * every severity already resolved against the governing project's
@@ -67,8 +84,8 @@ export interface MarketplaceFindings {
  *
  * Severity resolution is likewise INSIDE this function rather than a step the
  * command adds after it. Its absence is the whole defect this addressed, and a
- * command-body step is one a caller can forget: with it here, the flat `issues`
- * list and `plugins[].issues` derive from a single resolved set, and the
+ * command-body step is one a caller can forget: with it here, the envelope's
+ * `findings` and the `data.plugins[]` tallies derive from a single resolved set, and the
  * smallest testable entry point is the one that includes the filter. The run's
  * `status` — and with it the exit code — is derived one step later, in
  * {@link buildMarketplaceValidateReport}, from the issues the document actually
@@ -115,45 +132,15 @@ export interface MarketplaceValidateReportInput {
      * refusal.
      */
     refused: readonly string[];
-    issues: readonly ValidationIssue[];
-    /**
-     * The manifest's own summary, present iff the run bailed on the manifest. A
-     * bailed run reports WHY it stopped; a completed run reports what it found,
-     * and the builder writes that counts line itself.
-     */
-    bailSummary?: string;
-    duration: string;
     /**
-     * Publish the flat per-issue list instead of the per-location summary.
-     *
-     * Picks the UNIT of the `issues` listing, not the content: everything else in
-     * the document is a total about the run and is identical in both modes.
-     * Optional, and absent means the summary — a caller with no opinion gets the
-     * readable form rather than the corpus-scale one.
+     * Root-relative paths in a validated plugin's `skills/` the OS would not let
+     * the walk read. Required for the same reason as `refused`: the builder turns
+     * a non-empty list into the run-integrity refusal.
      */
-    verbose?: boolean;
+    unread: readonly string[];
+    issues: readonly ValidationIssue[];
+    durationMs: number;
 }
-/** One inspected asset's DEFAULT row: where, how many, of what code. */
-export type LocationIssueSummary = FindingCountSummary & {
-    /** The asset, relative to the report's `root`. Absent iff `unlocated`. */
-    location?: string;
-    /** Set instead of `location` when the findings named no file at all. */
-    unlocated?: true;
-};
-/**
- * Collapse a flat finding list onto one counts-only row per `location`.
- *
- * `location` is this command's per-asset unit: `plugins/alpha/.claude-plugin/
- * plugin.json`, `plugins/beta/skills/x/SKILL.md`. Rows come out in first-seen
- * order, and a location with no findings has no row — there is nothing to
- * filter here, because a location only exists in this listing by having emitted
- * something.
- *
- * Every value is passed through un-rebased: `location` is already relative to
- * the report's stated `root`, and `relative()` is not idempotent (see
- * {@link MarketplaceValidateReportInput.root}).
- */
-export declare function summarizeIssuesByLocation(issues: readonly ValidationIssue[]): LocationIssueSummary[];
 /**
  * Build the report `vat claude marketplace validate` publishes on stdout.
  *
@@ -162,26 +149,26 @@ export declare function summarizeIssuesByLocation(issues: readonly ValidationIss
  * builder serves both exits (manifest-missing bail and full run) so the
  * document has a single shape either way.
  *
+ * `status` and `summary` are derived by `buildReport` from the findings — the
+ * run-integrity refusal below included — so the status, the counts and the
+ * exit code cannot disagree. A plugin row's `summary` is the tally of the
+ * findings its own validator published; every finding itself is on the
+ * envelope, once.
+ *
  * Being pure is also the limit of what it can guarantee: it re-bases `path`,
  * and passes `issues` through verbatim. The single-coordinate-system property
  * is therefore only as true as its inputs — see `root` above — and is enforced
  * against a real marketplace in `payload-path-coordinates.test.ts`, not here.
  */
 export declare function buildMarketplaceValidateReport(input: MarketplaceValidateReportInput): MarketplaceValidateReport;
-/** The document `vat claude marketplace validate` publishes. */
-export interface MarketplaceValidateReport extends Record<string, unknown> {
-    status: ReturnType<typeof calculateValidationStatus>;
-    pluginsValidated: number;
-}
 /**
- * Validate a marketplace and hand back its document and exit code, printing
- * nothing on stdout.
+ * Validate a marketplace and hand back its report, printing nothing on stdout.
  *
  * The phase entry point for `vat verify`, which runs this once per configured
- * marketplace IN ITS OWN PROCESS. Progress and findings still go to stderr as
- * they always did; only the decision of where the document lands moves to the
- * caller — stdout for a command-line run, `phases[].report` for an orchestrated
- * one.
+ * marketplace, and the command's own. The report is the one BEFORE the
+ * writer's run-integrity pass: inside an orchestrator, `runPhase` applies the same
+ * pass to this phase's report, by the declaration this verb gives its own writer. A refusal is the envelope's error
+ * branch, its message already on stderr.
  */
 export declare function runMarketplaceValidatePhase(targetPath: string | undefined, options: MarketplaceValidateOptions): Promise<PhaseOutcome>;
 export declare function createMarketplaceValidateCommand(): Command;

package/dist/commands/claude/marketplace/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../../src/commands/claude/marketplace/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,yBAAyB,EAIzB,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAEhG,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIxD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExE,UAAU,0BAA0B;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA6GD,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAyQD,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,6EAA6E;IAC7E,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,0BAA0B,CAC9C,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAqC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1C;;;;OAIG;IACH,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC5C,oFAAoF;IACpF,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IACnC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAgBD,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG;IACvD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,eAAe,EAAE,GACjC,oBAAoB,EAAE,CAiBxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,8BAA8B,GACpC,yBAAyB,CAiD3B;AAED,gEAAgE;AAChE,MAAM,WAAW,yBAA0B,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACxE,MAAM,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC;IACrD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAmFD;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,YAAY,CAAC,CAsCvB;AAWD,wBAAgB,gCAAgC,IAAI,OAAO,CAwD1D"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../../src/commands/claude/marketplace/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,OAAO,EAAE,YAAY,EAAe,MAAM,0BAA0B,CAAC;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,KAAK,EAA2B,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAK/F,UAAU,0BAA0B;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA0KD,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;;OAKG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAuTD,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,6EAA6E;IAC7E,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,0BAA0B,CAC9C,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAqC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1C;;;;OAIG;IACH,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC5C,oFAAoF;IACpF,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;CACpB;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,8BAA8B,GACpC,yBAAyB,CAoC3B;AAyHD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,YAAY,CAAC,CA0BvB;AAoCD,wBAAgB,gCAAgC,IAAI,OAAO,CAqE1D"}