@vibe-agent-toolkit/cli 0.2.0-rc.6 → 0.2.0-rc.8

package/dist/commands/claude/marketplace/validate.js

@@ -1,4 +1,3 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- Paths are user-provided CLI arguments */
 /**
  * `vat claude marketplace validate [path]` — strict marketplace validation.
  *
@@ -9,11 +8,11 @@
  * - README.md should exist (warning)
  * - CHANGELOG.md should exist (warning)
  */
-import { existsSync, readdirSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { validateMarketplace, validateSkill, } from '@vibe-agent-toolkit/agent-skills';
 import { validatePlugin } from '@vibe-agent-toolkit/claude-marketplace';
 import { calculateValidationStatus, countBySeverity, } from '@vibe-agent-toolkit/schema';
-import { findProjectRoot, issueLocation, safePath } from '@vibe-agent-toolkit/utils';
+import { direntKindFollowingSync, findProjectRoot, isPathAbsentError, issueLocation, isVatError, normalizePath, PathEscapesRootError, relativeEscapesRoot, safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
 import { Command } from 'commander';
 import { formatDuration, reportCommandError } from '../../../utils/command-error.js';
 import { loadConfig } from '../../../utils/config-loader.js';
@@ -22,6 +21,7 @@ import { resolveIssueSeverity } from '../../../utils/issue-severity.js';
 import { createLogger } from '../../../utils/logger.js';
 import { writeYamlOutput } from '../../../utils/output.js';
 import { relativizePathEntries } from '../../../utils/relativize-paths.js';
+import { runIntegrityFinding } from '../../../utils/run-integrity.js';
 import { finishCommand } from '../../phase-utils.js';
 /**
  * Check for required/recommended files in the marketplace root.
@@ -46,29 +46,171 @@ function checkMarketplaceFiles(marketplacePath) {
     }
     return issues;
 }
+/**
+ * The boundary of what this command may read, applied to every path the walk
+ * opens below a contained plugin — not only to the declared `source`.
+ *
+ * 🚨 **Containment used to stop at the `source`.** Inside a contained plugin,
+ * `skills/` was `readdir`ed through a directory link, a `SKILL.md` parsed
+ * through a file link, and `.claude-plugin/plugin.json` read through one — each
+ * pointing OUT of the root — and the outside file's findings were published at
+ * a root-relative location whose real file is not under the root. A
+ * marketplace checkout is the untrusted input (git carries symlinks), so the
+ * class the source lane closed was open one level down, while the help text
+ * and the refusal message promised the absolute.
+ *
+ * Same predicate as {@link containedPluginDir}: real path against the root's
+ * own real path, so a link INSIDE the root is followed (the link is not the
+ * offence, leaving the root is) and one that leaves it is recorded by its
+ * root-relative spelling in `refused` and never opened. The record is what the
+ * document publishes and what the builder turns into the run-integrity
+ * refusal: a path the run would not read is a plugin the run did not finish
+ * validating, and silence there is the reassuring failure.
+ */
+class WalkBoundary {
+    marketplacePath;
+    realRoot;
+    refused = [];
+    constructor(marketplacePath, realRoot) {
+        this.marketplacePath = marketplacePath;
+        this.realRoot = realRoot;
+    }
+    /**
+     * May the walk open `abs`? `true` when its real path sits under the root.
+     * `false` records the refusal by name and is final for that path: nothing
+     * beneath it is visited either, because nothing beneath it was read.
+     */
+    contains(abs) {
+        const real = toForwardSlash(normalizePath(abs));
+        if (!relativeEscapesRoot(safePath.relative(this.realRoot, real)))
+            return true;
+        this.refused.push(issueLocation(abs, this.marketplacePath));
+        return false;
+    }
+}
 /**
  * Validate all SKILL.md files within a plugin's skills/ directory.
+ *
+ * Every path opened here — `skills/`, each skill directory, each `SKILL.md` —
+ * is checked against `boundary` first, so a link out of the root at any of
+ * the three depths is refused by name rather than read. A skill directory is
+ * recognised by what it RESOLVES to (a link to an in-root directory is a
+ * skill directory; `Dirent.isDirectory()` said no to every link and skipped
+ * the skill silently), which is the same by-real-path rule the source gets.
  */
-async function validatePluginSkills(pluginDir, marketplacePath) {
+async function validatePluginSkills(pluginDir, marketplacePath, boundary, validation) {
     const skillsDir = safePath.join(pluginDir, 'skills');
-    if (!existsSync(skillsDir))
+    if (!existsSync(skillsDir) || !boundary.contains(skillsDir))
         return [];
     const issues = [];
     const skillEntries = readdirSync(skillsDir, { withFileTypes: true });
     for (const skillEntry of skillEntries) {
-        if (!skillEntry.isDirectory())
-            continue;
         const skillDir = safePath.join(skillsDir, skillEntry.name);
+        if (!isDirectory(skillDir) || !boundary.contains(skillDir))
+            continue;
         const skillMdPath = safePath.join(skillDir, 'SKILL.md');
-        if (!existsSync(skillMdPath))
+        if (!existsSync(skillMdPath) || !boundary.contains(skillMdPath))
             continue;
-        const skillResult = await validateSkill({ skillPath: skillMdPath, rootDir: skillDir, locationRoot: marketplacePath });
+        // Severity only (no `allow`), resolved here so a default-`ignore` code can still be raised.
+        const severity = validation?.severity === undefined ? {} : { severity: validation.severity };
+        const skillResult = await validateSkill({ skillPath: skillMdPath, rootDir: skillDir, locationRoot: marketplacePath, validation: severity });
         issues.push(...skillResult.issues);
     }
     return issues;
 }
 /**
- * Validate all plugins under the plugins/ directory.
+ * Whether `dir` is a directory. `false` for a file and for nothing — both are
+ * "no plugin directory here". A path the process cannot stat is NOT: a
+ * declared source the OS refuses used to be reported as one that does not
+ * resolve, sending the reader to create a directory that is there. The refusal
+ * propagates and the command refuses the run by errno, like every other verb.
+ */
+function isDirectory(dir) {
+    try {
+        return statSync(dir).isDirectory();
+    }
+    catch (error) {
+        if (isPathAbsentError(error))
+            return false;
+        throw error;
+    }
+}
+/**
+ * The directory a declared `source` names, as the two paths the run needs —
+ * or `undefined` when it names nothing this command may enter.
+ *
+ * 🚨 **This used to be `safePath.resolve(root, source)` + `isDirectory`, and
+ * that walked `/etc`.** `marketplace.json` is attacker-reachable content — it
+ * is the thing being audited — and every string `source` was resolved and
+ * ENTERED. The document then published `../../../../etc/…` locations, breaking
+ * the "every location is relative to root" contract the help text claims.
+ *
+ * Containment is decided by REAL path, in two steps:
+ *
+ * 1. `joinUnderRoot` refuses lexically: an absolute source (POSIX root, drive
+ *    letter) or a `..` that climbs above the root. The source is
+ *    forward-slashed FIRST, because on POSIX `plugins\..\..\x` is one segment
+ *    to `path.resolve` — it resolved to a name containing backslashes, and the
+ *    same string walks out of the root on Windows. That also fixes the LOW:
+ *    `.\plugins\x` resolved to `<root>/./plugins/x`, which `statSync` accepts
+ *    but which is not the string `undeclared` builds for the same directory,
+ *    so one plugin was published as both validated and undeclared.
+ * 2. `realpath` refuses what only the filesystem knows: a symlink inside the
+ *    root pointing out is outside. The check is against the root's OWN real
+ *    path, so a root reached through a symlink (macOS `/var` → `/private/var`)
+ *    does not read as escaping itself.
+ *
+ * The schema refuses step 1's cases at the manifest before this runs, so here
+ * step 1 is the belt to that suspender. The consumer keeps it because the
+ * schema is `.passthrough()` Postel's-Law tolerant by design and this is the
+ * one place a wrong answer opens a directory.
+ *
+ * @returns `lexical` — the path as declared, resolved, which is what the
+ *   validators are handed so findings read `plugins/s/…` as the manifest spells
+ *   it; `real` — the identity, for "have I seen this directory?"
+ */
+function containedPluginDir(marketplacePath, realRoot, source) {
+    let lexical;
+    try {
+        lexical = safePath.joinUnderRoot(marketplacePath, toForwardSlash(source));
+    }
+    catch (error) {
+        // `joinUnderRoot` refuses an escape by design. Anything else (a
+        // `TypeError` from a bad argument) is a bug.
+        if (!isVatError(error, PathEscapesRootError.code))
+            throw error;
+        return undefined;
+    }
+    if (!isDirectory(lexical))
+        return undefined;
+    const real = toForwardSlash(normalizePath(lexical));
+    return relativeEscapesRoot(safePath.relative(realRoot, real)) ? undefined : { lexical, real };
+}
+/**
+ * Validate the plugins the manifest DECLARES with a local source.
+ *
+ * 🚨 **This walked `plugins/*` and shipped both defects that has.** The
+ * denominator was a count of directories under `plugins/`, so a co-located
+ * marketplace (`source: "./"` — the shape `detectResourceFormat` recognises on
+ * purpose and `vat audit` recurses into) declared 1, walked 0, and was refused
+ * at exit 1 on a code no override can lower; and a manifest declaring
+ * `./plugins/a` over a `plugins/` holding only an undeclared `b` validated
+ * "1 of 1" and passed with `a` never looked at. Each declared `source` is now
+ * resolved against the marketplace root and THAT directory is validated — see
+ * {@link containedPluginDir} for the containment the resolution enforces;
+ * `extractClaudeMarketplaceInventory` (`vat inventory`/`vat audit`) applies
+ * the same predicate on its side. A source that does not resolve to a directory INSIDE the root is
+ * simply absent from the results; the builder derives the refusal from that
+ * absence, so it lands on the document whatever this function's caller does.
+ *
+ * Directories under `plugins/` that no entry names come back as `undeclared`,
+ * relative to the root: listed, not validated, not a failure. The manifest is
+ * the marketplace's contract with its installer — Claude Code installs only
+ * what `plugins[]` names — so an undeclared directory cannot ship and grading
+ * it would grade something no consumer can receive; failing on it would turn a
+ * publishing gate into a tree-hygiene gate. Naming it costs nothing and is what
+ * lets a reader tell "the plugin you meant is under another name" from "it is
+ * not there at all" when a declared source did not resolve.
  *
  * `validation` is the governing project's severity map (see
  * {@link resolveProjectValidationConfig}). It is applied to each plugin result
@@ -79,36 +221,98 @@ async function validatePluginSkills(pluginDir, marketplacePath) {
  * `plugins[]`, or a plugin `status: warning` above an issue list that no longer
  * contains a warning.
  */
-async function validatePlugins(marketplacePath, validation) {
-    const pluginsDir = safePath.join(marketplacePath, 'plugins');
-    if (!existsSync(pluginsDir))
-        return { pluginResults: [], issues: [] };
+async function validateDeclaredPlugins(marketplacePath, declared, validation) {
     const pluginResults = [];
     const issues = [];
-    const entries = readdirSync(pluginsDir, { withFileTypes: true });
-    for (const entry of entries) {
-        if (!entry.isDirectory())
+    // Keyed by REAL path: one directory is validated once however many entries
+    // name it, and the same key is what `undeclaredPluginDirs` compares against.
+    const validatedByDir = new Map();
+    const realRoot = toForwardSlash(normalizePath(marketplacePath));
+    const boundary = new WalkBoundary(marketplacePath, realRoot);
+    for (const entry of declared) {
+        // A source that names nothing inside the root — nothing at all, a file,
+        // an absolute path, a `..` climb, a symlink out — is simply absent from the
+        // results, and the builder refuses the run by name from that absence.
+        const dir = containedPluginDir(marketplacePath, realRoot, entry.source);
+        if (dir === undefined)
             continue;
-        const pluginDir = safePath.join(pluginsDir, entry.name);
-        // `locationRoot` is not optional here even though the parameter is: omitted,
-        // `validatePlugin` anchors at the plugin's own discovered project root, so
-        // its findings land in a different coordinate system than the marketplace
-        // and skill findings beside them — and every plugin's manifest collapses to
-        // the same `.claude-plugin/plugin.json`.
-        const rawResult = await validatePlugin(pluginDir, { strict: true, locationRoot: marketplacePath });
-        const pluginIssues = resolveIssueSeverity(rawResult.issues, validation);
-        const pluginResult = {
-            ...rawResult,
-            issues: pluginIssues,
-            status: calculateValidationStatus(pluginIssues),
-            issueCounts: countBySeverity(pluginIssues),
+        // Two entries, one directory: the directory's findings were collected
+        // twice and COUNTED twice (`PLUGIN_MISSING_AUTHOR: 2` for one file). Each
+        // entry still gets its row — the manifest declared two — but the file is
+        // inspected once and its findings enter `issues` once.
+        const seen = validatedByDir.get(dir.real);
+        if (seen !== undefined) {
+            pluginResults.push({ ...entry, result: seen });
+            continue;
+        }
+        const result = await validateContainedPlugin(dir.lexical, marketplacePath, boundary, validation);
+        validatedByDir.set(dir.real, result);
+        pluginResults.push({ ...entry, result });
+        issues.push(...result.issues);
+        issues.push(...await validatePluginSkills(dir.lexical, marketplacePath, boundary, validation));
+    }
+    return {
+        pluginResults,
+        undeclared: undeclaredPluginDirs(marketplacePath, new Set(validatedByDir.keys())),
+        refused: boundary.refused,
+        issues,
+    };
+}
+/**
+ * Validate one contained plugin directory — unless its manifest is a link out
+ * of the root, in which case the manifest is refused by name and the plugin's
+ * row says so instead of carrying findings about a file the run did not read.
+ *
+ * The row keeps `status: 'error'` with no issues: the error is the refusal
+ * the builder publishes once for the run, and a `success` row for a plugin
+ * whose manifest was never opened would be the reassuring lie this whole
+ * boundary exists to refuse.
+ */
+async function validateContainedPlugin(pluginDir, marketplacePath, boundary, validation) {
+    const manifestPath = safePath.join(pluginDir, '.claude-plugin', 'plugin.json');
+    if (existsSync(manifestPath) && !boundary.contains(manifestPath)) {
+        return {
+            path: pluginDir,
+            type: 'claude-plugin',
+            status: 'error',
+            summary: `Plugin manifest not read: ${issueLocation(manifestPath, marketplacePath)} resolves outside the marketplace root`,
+            issues: [],
+            issueCounts: countBySeverity([]),
         };
-        pluginResults.push(pluginResult);
-        issues.push(...pluginIssues);
-        const skillIssues = await validatePluginSkills(pluginDir, marketplacePath);
-        issues.push(...resolveIssueSeverity(skillIssues, validation));
     }
-    return { pluginResults, issues };
+    // `locationRoot` is not optional here even though the parameter is: omitted,
+    // `validatePlugin` anchors at the plugin's own discovered project root, so
+    // its findings land in a different coordinate system than the marketplace
+    // and skill findings beside them — and every plugin's manifest collapses to
+    // the same `.claude-plugin/plugin.json`.
+    const rawResult = await validatePlugin(pluginDir, { strict: true, locationRoot: marketplacePath });
+    const pluginIssues = resolveIssueSeverity(rawResult.issues, validation);
+    return {
+        ...rawResult,
+        issues: pluginIssues,
+        status: calculateValidationStatus(pluginIssues),
+        issueCounts: countBySeverity(pluginIssues),
+    };
+}
+/**
+ * Directories under `<root>/plugins/` that no declared source resolved to,
+ * relative to the root. The conventional location is the only one walked: an
+ * undeclared plugin anywhere else is indistinguishable from any other directory.
+ *
+ * @param validatedDirs - REAL paths of the directories the run validated, so
+ *   the comparison cannot be defeated by two spellings of one directory.
+ */
+function undeclaredPluginDirs(marketplacePath, validatedDirs) {
+    const pluginsDir = safePath.join(marketplacePath, 'plugins');
+    if (!existsSync(pluginsDir))
+        return [];
+    return readdirSync(pluginsDir, { withFileTypes: true })
+        // Followed: a plugin directory that is a link is a plugin the marketplace
+        // ships, and `validatedDirs` is real paths for exactly that reason.
+        .filter((entry) => direntKindFollowingSync(pluginsDir, entry) === 'directory')
+        .map((entry) => safePath.join(pluginsDir, entry.name))
+        .filter((dir) => !validatedDirs.has(toForwardSlash(normalizePath(dir))))
+        .map((dir) => issueLocation(dir, marketplacePath));
 }
 /**
  * The `validation` config governing findings about `marketplacePath`.
@@ -174,10 +378,13 @@ function resolveProjectValidationConfig(marketplacePath, logger) {
  *
  * Severity resolution is likewise INSIDE this function rather than a step the
  * command adds after it. Its absence is the whole defect this addressed, and a
- * command-body step is one a caller can forget: with it here, `status`, the
- * exit code, the flat `issues` list and `plugins[].issues` all derive from a
- * single resolved set, and the smallest testable entry point is the one that
- * includes the filter.
+ * command-body step is one a caller can forget: with it here, the flat `issues`
+ * list and `plugins[].issues` derive from a single resolved set, and the
+ * smallest testable entry point is the one that includes the filter. The run's
+ * `status` — and with it the exit code — is derived one step later, in
+ * {@link buildMarketplaceValidateReport}, from the issues the document actually
+ * publishes: that is where the run-integrity refusal is added, and a status
+ * computed here would not see it.
  *
  * Exported so that contract is testable against a real marketplace without a
  * CLI spawn; the command adds only the exit code and the emission.
@@ -201,24 +408,20 @@ export async function collectMarketplaceFindings(marketplacePath, logger) {
         return {
             marketplaceResult,
             pluginResults: [],
+            undeclared: [],
+            refused: [],
             issues: [...marketplaceResult.issues],
-            status: 'error',
         };
     }
     const validation = resolveProjectValidationConfig(marketplacePath, logger);
     const fileIssues = checkMarketplaceFiles(marketplacePath);
-    const { pluginResults, issues: pluginIssues } = await validatePlugins(marketplacePath, validation);
+    const { pluginResults, undeclared, refused, issues: pluginIssues } = await validateDeclaredPlugins(marketplacePath, marketplaceResult.metadata?.localPluginSources ?? [], validation);
     const issues = [
         ...resolveIssueSeverity(marketplaceResult.issues, validation),
         ...resolveIssueSeverity(fileIssues, validation),
         ...pluginIssues,
     ];
-    return {
-        marketplaceResult,
-        pluginResults,
-        issues,
-        status: calculateValidationStatus(issues),
-    };
+    return { marketplaceResult, pluginResults, undeclared, refused, issues };
 }
 /**
  * Group key for findings that carry no `location` at all.
@@ -278,19 +481,40 @@ export function summarizeIssuesByLocation(issues) {
  * against a real marketplace in `payload-path-coordinates.test.ts`, not here.
  */
 export function buildMarketplaceValidateReport(input) {
-    const { status, root, marketplace, pluginResults, issues, issueCounts, summary, duration, verbose } = input;
-    const plugins = pluginResults.map(r => ({
-        path: r.path,
-        status: r.status,
-        metadata: r.metadata,
-        issues: r.issues,
+    const { root, marketplace, pluginResults, undeclared, refused, bailSummary, duration, verbose } = input;
+    const issues = [
+        ...unfinishedRunFinding(marketplace, pluginResults, refused),
+        ...input.issues,
+    ];
+    const issueCounts = countBySeverity(issues);
+    const plugins = pluginResults.map(({ name, source, result }) => ({
+        name,
+        source,
+        path: result.path,
+        status: result.status,
+        metadata: result.metadata,
+        issues: result.issues,
     }));
     return {
-        status,
+        // Derived from the issues THIS document publishes — the refusal above
+        // included — so the status, the counts and the listing cannot disagree, and
+        // the exit code the command takes from it cannot either.
+        status: calculateValidationStatus(issues),
         // Stated once, and the only absolute path in the document.
         root,
         ...(marketplace ? { marketplace } : {}),
+        // The numerator. Beside `marketplace.localPluginSources` it says whether
+        // every declared source resolved; without it "three local plugins, all
+        // clean" and "three local plugins, none looked at" are the same document.
+        pluginsValidated: pluginResults.length,
         plugins: relativizePathEntries(plugins, root),
+        // Named, not graded — see `validateDeclaredPlugins`. Always present, so an
+        // empty list is a statement that `plugins/` was looked at.
+        undeclared: [...undeclared],
+        // Paths the walk would not open (real path outside the root) — see
+        // `WalkBoundary`. Always present: an empty list says every path the run
+        // read was under `root`, which is the containment claim the help text makes.
+        refused: [...refused],
         // One row per inspected asset by default; the flat per-issue list under
         // `--verbose`. Either way every `location` stays relative to `root` above.
         issues: verbose === true ? issues : summarizeIssuesByLocation(issues),
@@ -298,10 +522,82 @@ export function buildMarketplaceValidateReport(input) {
         // severity, so an info-only run is `success` and the info would otherwise
         // be unreported.
         issueCounts,
-        summary,
+        summary: bailSummary
+            ?? `${issueCounts.errors} error(s), ${issueCounts.warnings} warning(s), ${issueCounts.info} info`,
         duration,
     };
 }
+/**
+ * The refusal for a run in which a declared local source did not resolve.
+ *
+ * 🚨 **Two shapes of this shipped.** First, the plugin walk returned nothing
+ * when `plugins/` was absent, and the document carried no count, so a
+ * marketplace declaring three relative-path plugins over a missing `plugins/`
+ * reported `status: success`, exit 0. Then the count that fixed it —
+ * `validated < declared` by NUMBER — was wrong in both directions: a co-located
+ * `source: "./"` marketplace walked 0 against declared 1 and was refused, and
+ * an undeclared `plugins/b` counted for a declared `a` that did not exist.
+ *
+ * 🔑 **The condition is by IDENTITY, not by count.** `marketplace.localPluginSources`
+ * is the manifest's own list of local entries; `pluginResults` names the entry
+ * each validated plugin satisfies. A declared entry with no result is a source
+ * that did not resolve to a directory, and that is what is refused — whatever
+ * else the tree holds. Both halves are in the document, so the refusal is
+ * derivable from the document alone. All-remote stays green (nothing local
+ * declared); no entries stays green; an undeclared directory is listed under
+ * `undeclared` and stays green here — it cannot ship, so it is not a plugin
+ * that went unvalidated; a bailed manifest carries no sources and stays a
+ * manifest error alone.
+ *
+ * The message names the unresolved sources: the reader's next move is to fix
+ * the `source` or build the tree, and either needs the name.
+ *
+ * The second half is the same claim one level down: a path INSIDE a validated
+ * plugin that the walk refused to open because it resolves outside the root
+ * (`refused`, from {@link WalkBoundary}). The plugin's row exists, but what
+ * sits behind that path was never read, so the document is not a verdict
+ * about it either. ONE finding carries both halves — the claim is about the
+ * run, and two reports about one run is the per-finding duplication
+ * `run-integrity.ts` forbids.
+ *
+ * Derived here in the builder, not in {@link collectMarketplaceFindings}, so
+ * the status the document publishes — and the exit code taken from it — cannot
+ * be computed over an issue set that lacks it. Shared mechanism:
+ * `run-integrity.ts`.
+ *
+ * @param marketplace - The manifest's metadata; `undefined` when the run bailed
+ * @param validated - The declared local plugins the run validated
+ * @param refused - Root-relative paths the walk would not open
+ * @returns The one finding, or nothing
+ */
+function unfinishedRunFinding(marketplace, validated, refused) {
+    const declared = marketplace?.localPluginSources ?? [];
+    const unresolved = declared.filter((entry) => !validated.some((v) => v.name === entry.name && v.source === entry.source));
+    if (unresolved.length === 0 && refused.length === 0)
+        return [];
+    const parts = [];
+    if (unresolved.length > 0) {
+        const named = unresolved.map((entry) => `\`${entry.name}\` (${entry.source})`).join(', ');
+        parts.push(`The manifest declares ${declared.length} plugin(s) with a local source and this run validated`
+            + ` ${validated.length} of them, so this document is not a verdict about the rest: it reads the`
+            + ' same as a run over a marketplace whose plugins are all clean.'
+            + ` Declared source(s) that did not resolve to a directory under the marketplace root: ${named}.`
+            + ' Usually the marketplace was not built, was built somewhere else, or the entry\'s `source`'
+            + ' names the wrong directory — `undeclared` above lists the `plugins/` directories the'
+            + ' manifest does not name. A source that resolves OUTSIDE the root (a symlink pointing out)'
+            + ' is refused the same way: this command never leaves the directory it was pointed at.'
+            + ' Fix the `source`, run `vat build` first, or point this command at the built marketplace.');
+    }
+    if (refused.length > 0) {
+        const named = refused.map((path) => `\`${path}\``).join(', ');
+        parts.push(`This run refused to open ${refused.length} path(s) inside a validated plugin because each resolves`
+            + ` OUTSIDE the marketplace root (a symbolic link pointing out): ${named}.`
+            + ' Nothing behind them was read, so this document is not a verdict about the skills or manifest'
+            + ' they hold — this command never leaves the directory it was pointed at. Replace each link'
+            + ' with the files it points at, or move its target under the marketplace root.');
+    }
+    return [runIntegrityFinding(parts.join(' '))];
+}
 /**
  * Validate a marketplace and hand back its document and exit code, printing
  * nothing on stdout.
@@ -318,28 +614,26 @@ export async function runMarketplaceValidatePhase(targetPath, options) {
     try {
         const marketplacePath = safePath.resolve(targetPath ?? '.');
         logger.info(`Validating marketplace: ${marketplacePath}`);
-        const { marketplaceResult, pluginResults, issues, status } = await collectMarketplaceFindings(marketplacePath, logger);
+        const { marketplaceResult, pluginResults, undeclared, refused, issues } = await collectMarketplaceFindings(marketplacePath, logger);
+        // A bailed run reports WHY it stopped; a completed run reports what it
+        // found. Both emit through the one builder, so the document has a single
+        // shape either way.
         const bailed = marketplaceResult.status === 'error';
-        const issueCounts = countBySeverity(issues);
-        return {
-            document: buildMarketplaceValidateReport({
-                status,
-                root: marketplacePath,
-                marketplace: marketplaceResult.metadata,
-                pluginResults,
-                issues,
-                issueCounts,
-                // A bailed run reports WHY it stopped; a completed run reports what it
-                // found. Both emit through the one builder, so the document has a
-                // single shape either way.
-                summary: bailed
-                    ? marketplaceResult.summary
-                    : `${issueCounts.errors} error(s), ${issueCounts.warnings} warning(s), ${issueCounts.info} info`,
-                duration: formatDuration(Date.now() - startTime),
-                verbose: options.verbose === true,
-            }),
-            exitCode: status === 'error' ? 1 : 0,
-        };
+        const document = buildMarketplaceValidateReport({
+            root: marketplacePath,
+            marketplace: marketplaceResult.metadata,
+            pluginResults,
+            undeclared,
+            refused,
+            issues,
+            ...(bailed ? { bailSummary: marketplaceResult.summary } : {}),
+            duration: formatDuration(Date.now() - startTime),
+            verbose: options.verbose === true,
+        });
+        // From the DOCUMENT, so the exit code and the published status are one
+        // derivation — the run-integrity refusal lands in the builder, and an exit
+        // code computed upstream of it would answer 0 over `status: error`.
+        return { document, exitCode: document.status === 'error' ? 1 : 0 };
     }
     catch (error) {
         return {
@@ -350,7 +644,9 @@ export async function runMarketplaceValidatePhase(targetPath, options) {
     }
 }
 async function marketplaceValidateCommand(targetPath, options) {
-    finishCommand(await runMarketplaceValidatePhase(targetPath, options), writeYamlOutput);
+    // `undefined`: this command offers no `--format`, so its failure envelope is
+    // YAML like its report.
+    finishCommand(await runMarketplaceValidatePhase(targetPath, options), writeYamlOutput, undefined);
 }
 export function createMarketplaceValidateCommand() {
     const command = new Command('validate');
@@ -370,6 +666,25 @@ Description:
 Output (YAML on stdout):
   root: the marketplace directory — every location below is relative to it
   status, issueCounts, summary, duration, marketplace, plugins
+  pluginsValidated: how many of the manifest's relative-path sources
+          (marketplace.localPluginSources) resolved to a directory and were
+          validated — each plugins[] row names the entry it satisfies. A
+          declared source that does not resolve is reported as
+          RESOURCE_CHECK_BROKEN at error (exit 1), naming it, rather than as
+          a pass — a plugin the manifest ships and this run never saw is not
+          a verdict. A source is never followed outside the root: an absolute
+          path or a ".." segment fails the manifest schema, and a symlink that
+          points out is refused like an unresolved source. Co-located
+          marketplaces (source: "./") are validated at the root. An
+          all-remote marketplace has nothing local and stays green.
+  undeclared: directories under plugins/ that no manifest entry names.
+          Listed only — they cannot be installed, so they are neither
+          validated nor a failure.
+  refused: paths inside a validated plugin this run would not open because
+          they resolve outside the root (a skills/ dir, skill dir, SKILL.md
+          or plugin.json that is a symlink pointing out). Containment is by
+          real path at every depth, not only at the declared source; each is
+          named here and in the RESOURCE_CHECK_BROKEN finding (exit 1).
 
   issues: one row per inspected location, carrying only that location's counts
           ({location, errors?, warnings?, info?, codes}). A zero bucket is

package/dist/commands/claude/marketplace/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../../src/commands/claude/marketplace/validate.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGlD,OAAO,EACL,mBAAmB,EACnB,aAAa,GAEd,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,eAAe,GAIhB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAA4B,MAAM,mCAAmC,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAC;AAQxE;;GAEG;AACH,SAAS,qBAAqB,CAAC,eAAuB;IACpD,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,UAAU,GAAuF;QACrG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,2BAA2B,EAAE;QAC9G,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE;QACrH,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,kCAAkC,EAAE;KAC/H,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAA+B;gBAC3C,OAAO,EAAE,4BAA4B,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE;gBACjE,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;gBACpF,GAAG,EAAE,SAAS,KAAK,CAAC,IAAI,oCAAoC;aAC7D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,eAAuB;IAC5E,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;YAAE,SAAS;QAExC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAEvC,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;QACtH,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAC5B,eAAuB,EACvB,UAAwC;IAExC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEtE,MAAM,aAAa,GAAuB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,SAAS;QAEnC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,yCAAyC;QACzC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;QACnG,MAAM,YAAY,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,YAAY,GAAqB;YACrC,GAAG,SAAS;YACZ,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,yBAAyB,CAAC,YAAY,CAAC;YAC/C,WAAW,EAAE,eAAe,CAAC,YAAY,CAAC;SAC3C,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAE7B,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAS,8BAA8B,CACrC,eAAuB,EACvB,MAAuC;IAEvC,MAAM,WAAW,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACrD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,2BAA2B,WAAW,8CAA8C;YAClF,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChG,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,eAAuB,EACvB,MAAuC;IAEvC,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC,eAAe,EAAE;QACnE,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;IAEH,4EAA4E;IAC5E,EAAE;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,6DAA6D;IAC7D,IAAI,iBAAiB,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO;YACL,iBAAiB;YACjB,aAAa,EAAE,EAAE;YACjB,MAAM,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC;YACrC,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,8BAA8B,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,eAAe,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAEnG,MAAM,MAAM,GAAG;QACb,GAAG,oBAAoB,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC;QAC7D,GAAG,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC;QAC/C,GAAG,YAAY;KAChB,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,aAAa;QACb,MAAM;QACN,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC;KAC1C,CAAC;AACJ,CAAC;AAmCD;;;;;;;;;;;GAWG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;AAUtC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAkC;IAElC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsC,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE;QAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC;QAC1F,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAqC;IAErC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAE5G,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,MAAM;QACN,2DAA2D;QAC3D,IAAI;QACJ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC;QAC7C,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,iBAAiB;QACjB,WAAW;QACX,OAAO;QACP,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,UAA8B,EAC9B,OAAmC;IAEnC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,2BAA2B,eAAe,EAAE,CAAC,CAAC;QAE1D,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,GACxD,MAAM,0BAA0B,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,KAAK,OAAO,CAAC;QACpD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAE5C,OAAO;YACL,QAAQ,EAAE,8BAA8B,CAAC;gBACvC,MAAM;gBACN,IAAI,EAAE,eAAe;gBACrB,WAAW,EAAE,iBAAiB,CAAC,QAAQ;gBACvC,aAAa;gBACb,MAAM;gBACN,WAAW;gBACX,uEAAuE;gBACvE,kEAAkE;gBAClE,2BAA2B;gBAC3B,OAAO,EAAE,MAAM;oBACb,CAAC,CAAC,iBAAiB,CAAC,OAAO;oBAC3B,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,cAAc,WAAW,CAAC,QAAQ,gBAAgB,WAAW,CAAC,IAAI,OAAO;gBAClG,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAChD,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;aAClC,CAAC;YACF,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACrC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,QAAQ,EAAE,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,CAAC;YAC7E,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,UAA8B,EAC9B,OAAmC;IAEnC,aAAa,CAAC,MAAM,2BAA2B,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAExC,OAAO;SACJ,WAAW,CAAC,iDAAiD,CAAC;SAC9D,QAAQ,CAAC,QAAQ,EAAE,4DAA4D,CAAC;SAChF,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC;SAC7C,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,0BAA0B,CAAC;SAClC,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;CAyBzB,CAAC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../../src/commands/claude/marketplace/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE5D,OAAO,EACL,mBAAmB,EACnB,aAAa,GAEd,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,eAAe,GAIhB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACvN,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAA4B,MAAM,mCAAmC,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAC;AAQxE;;GAEG;AACH,SAAS,qBAAqB,CAAC,eAAuB;IACpD,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,UAAU,GAA4E;QAC1F,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,2BAA2B,EAAE;QAC9G,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE;QACrH,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,kCAAkC,EAAE;KAC/H,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAA+B;gBAC3C,OAAO,EAAE,4BAA4B,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE;gBACjE,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;gBACpF,GAAG,EAAE,SAAS,KAAK,CAAC,IAAI,oCAAoC;aAC7D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,YAAY;IAIG;IACA;IAJV,OAAO,GAAa,EAAE,CAAC;IAEhC,YACmB,eAAuB,EACvB,QAAgB;QADhB,oBAAe,GAAf,eAAe,CAAQ;QACvB,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ;;;;OAIG;IACH,QAAQ,CAAC,GAAW;QAClB,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,eAAuB,EACvB,QAAsB,EACtB,UAAwC;IAExC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAErE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QAE1E,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC7F,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5I,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAS,kBAAkB,CACzB,eAAuB,EACvB,QAAgB,EAChB,MAAc;IAEd,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,6CAA6C;QAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,KAAK,UAAU,uBAAuB,CACpC,eAAuB,EACvB,QAAsC,EACtC,UAAwC;IAExC,MAAM,aAAa,GAAwB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAE7D,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,wEAAwE;QACxE,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,GAAG,GAAG,kBAAkB,CAAC,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAEhC,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAE9B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,OAAO;QACL,aAAa;QACb,UAAU,EAAE,oBAAoB,CAAC,eAAe,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,uBAAuB,CACpC,SAAiB,EACjB,eAAuB,EACvB,QAAsB,EACtB,UAAwC;IAExC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC/E,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,6BAA6B,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,wCAAwC;YAC1H,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;SACjC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,yCAAyC;IACzC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;IACnG,MAAM,YAAY,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,SAAS;QACZ,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,yBAAyB,CAAC,YAAY,CAAC;QAC/C,WAAW,EAAE,eAAe,CAAC,YAAY,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,eAAuB,EAAE,aAAkC;IACvF,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QACrD,0EAA0E;QAC1E,oEAAoE;SACnE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,WAAW,CAAC;SAC7E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SACrD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAS,8BAA8B,CACrC,eAAuB,EACvB,MAAuC;IAEvC,MAAM,WAAW,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACrD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,2BAA2B,WAAW,8CAA8C;YAClF,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChG,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,eAAuB,EACvB,MAAuC;IAEvC,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC,eAAe,EAAE;QACnE,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;IAEH,4EAA4E;IAC5E,EAAE;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,6DAA6D;IAC7D,IAAI,iBAAiB,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO;YACL,iBAAiB;YACjB,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,8BAA8B,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,uBAAuB,CAChG,eAAe,EACf,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,IAAI,EAAE,EACpD,UAAU,CACX,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,GAAG,oBAAoB,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC;QAC7D,GAAG,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC;QAC/C,GAAG,YAAY;KAChB,CAAC;IAEF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAqDD;;;;;;;;;;;GAWG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;AAUtC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAkC;IAElC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsC,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE;QAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC;QAC1F,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAqC;IAErC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAExG,MAAM,MAAM,GAAG;QACb,GAAG,oBAAoB,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC;QAC5D,GAAG,KAAK,CAAC,MAAM;KAChB,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI;QACJ,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,sEAAsE;QACtE,4EAA4E;QAC5E,yDAAyD;QACzD,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC;QACzC,2DAA2D;QAC3D,IAAI;QACJ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,gBAAgB,EAAE,aAAa,CAAC,MAAM;QACtC,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC;QAC7C,2EAA2E;QAC3E,2DAA2D;QAC3D,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;QAC3B,mEAAmE;QACnE,wEAAwE;QACxE,6EAA6E;QAC7E,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;QACrB,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,iBAAiB;QACjB,WAAW;QACX,OAAO,EAAE,WAAW;eACf,GAAG,WAAW,CAAC,MAAM,cAAc,WAAW,CAAC,QAAQ,gBAAgB,WAAW,CAAC,IAAI,OAAO;QACnG,QAAQ;KACT,CAAC;AACJ,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,SAAS,oBAAoB,CAC3B,WAAyC,EACzC,SAAuC,EACvC,OAA0B;IAE1B,MAAM,QAAQ,GAAG,WAAW,EAAE,kBAAkB,IAAI,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CACtF,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,KAAK,CAAC,IAAI,CACR,yBAAyB,QAAQ,CAAC,MAAM,uDAAuD;cAC7F,IAAI,SAAS,CAAC,MAAM,0EAA0E;cAC9F,gEAAgE;cAChE,uFAAuF,KAAK,GAAG;cAC/F,4FAA4F;cAC5F,sFAAsF;cACtF,2FAA2F;cAC3F,sFAAsF;cACtF,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,4BAA4B,OAAO,CAAC,MAAM,0DAA0D;cAClG,iEAAiE,KAAK,GAAG;cACzE,+FAA+F;cAC/F,2FAA2F;cAC3F,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,UAA8B,EAC9B,OAAmC;IAEnC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,2BAA2B,eAAe,EAAE,CAAC,CAAC;QAE1D,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GACrE,MAAM,0BAA0B,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAE5D,uEAAuE;QACvE,yEAAyE;QACzE,oBAAoB;QACpB,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,KAAK,OAAO,CAAC;QACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAC;YAC9C,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,iBAAiB,CAAC,QAAQ;YACvC,aAAa;YACb,UAAU;YACV,OAAO;YACP,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;SAClC,CAAC,CAAC;QAEH,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,QAAQ,EAAE,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,CAAC;YAC7E,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,UAA8B,EAC9B,OAAmC;IAEnC,6EAA6E;IAC7E,wBAAwB;IACxB,aAAa,CAAC,MAAM,2BAA2B,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAExC,OAAO;SACJ,WAAW,CAAC,iDAAiD,CAAC;SAC9D,QAAQ,CAAC,QAAQ,EAAE,4DAA4D,CAAC;SAChF,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC;SAC7C,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,0BAA0B,CAAC;SAClC,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CzB,CAAC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/commands/claude/org/api-keys.d.ts

@@ -1,6 +1,3 @@
-/**
- * `vat claude org api-keys` — manage organization API keys via Admin API.
- */
 import { Command } from 'commander';
 export declare function createOrgApiKeysCommand(): Command;
 //# sourceMappingURL=api-keys.d.ts.map