create-agdf 0.14.5 → 0.20.1

package/lib/public-plugin/builder.js

@@ -1,83 +0,0 @@
-import { createHash } from "node:crypto";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { renameSyncWithRetry } from "../fs-swap.js";
-import { assertPublicPluginContract, loadJson } from "./contract.js";
-import { renderCodexPluginManifest } from "./manifest.js";
-import { createReadinessReport, renderReadinessReport } from "./report.js";
-import { inventory, validateCandidate } from "./validator.js";
-
-function write(path, content) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, content, "utf8");
-}
-
-function json(value) {
-  return `${JSON.stringify(value, null, 2)}\n`;
-}
-
-export function buildPublicPluginCandidate({ repoRoot, outputRoot }) {
-  repoRoot = resolve(repoRoot);
-  outputRoot = resolve(outputRoot);
-  const expectedParent = resolve(repoRoot, "create-agdf", "generated", "submissions", "openai");
-  if (dirname(outputRoot) !== expectedParent) throw new Error(`Public candidate output must be a direct child of ${expectedParent}`);
-  mkdirSync(expectedParent, { recursive: true });
-  const temporaryRoot = mkdtempSync(join(expectedParent, ".agdf-build-"));
-  try {
-    const pluginRoot = join(repoRoot, "plugin");
-    const definition = loadJson(join(pluginRoot, "meta", "agdf-plugin.definition.json"));
-    const capabilityMatrix = loadJson(join(pluginRoot, "submission", "openai", "capability-matrix.json"));
-    const reviewerCases = loadJson(join(pluginRoot, "submission", "openai", "reviewer-cases.json"));
-    const releaseNotes = readFileSync(join(pluginRoot, "submission", "openai", "release-notes.md"), "utf8");
-    assertPublicPluginContract({ definition, capabilityMatrix, reviewerCases, releaseNotes });
-
-    write(join(temporaryRoot, ".codex-plugin", "plugin.json"), renderCodexPluginManifest(definition, { publicCandidate: true }));
-    for (const directory of ["skills", "meta", "assets"]) cpSync(join(pluginRoot, directory), join(temporaryRoot, directory), { recursive: true });
-    cpSync(join(pluginRoot, "submission", "openai"), join(temporaryRoot, "submission", "openai"), { recursive: true });
-    const listing = {
-      schemaVersion: 1,
-      releaseVersion: definition.version,
-      submissionType: definition.publicDistribution.submissionType,
-      identity: {
-        technicalId: definition.publicDistribution.technicalId,
-        publicDisplayName: definition.publicDistribution.publicDisplayName,
-        fullDisplayName: definition.publicDistribution.fullDisplayName,
-      },
-      interface: {
-        shortDescription: definition.publicDistribution.shortDescription,
-        longDescription: definition.longDescription,
-        developerName: definition.publicDistribution.developerName,
-        category: definition.publicDistribution.category,
-        defaultPrompt: definition.publicDistribution.defaultPrompt,
-      },
-      publisher: definition.publicDistribution.publisher,
-      urls: definition.publicDistribution.urls,
-      availability: definition.publicDistribution.availability,
-    };
-    write(join(temporaryRoot, "submission", "openai", "listing.json"), json(listing));
-    validateCandidate(temporaryRoot);
-    const entries = inventory(temporaryRoot, { exclude: ["submission/openai/inventory.json", "submission/openai/readiness.json"] });
-    const digest = createHash("sha256").update(json(entries)).digest("hex");
-    write(join(temporaryRoot, "submission", "openai", "inventory.json"), json({ schemaVersion: 1, releaseVersion: definition.version, digest, files: entries }));
-    const report = createReadinessReport({ definition, fileCount: entries.length, inventoryDigest: digest });
-    write(join(temporaryRoot, "submission", "openai", "readiness.json"), json(report));
-    write(join(temporaryRoot, "submission", "openai", "readiness.md"), renderReadinessReport(report));
-    validateCandidate(temporaryRoot);
-
-    const backupRoot = `${outputRoot}.previous`;
-    if (existsSync(backupRoot)) throw new Error(`Refusing candidate swap while recovery backup exists: ${backupRoot}`);
-    const hadPrevious = existsSync(outputRoot);
-    if (hadPrevious) renameSyncWithRetry(outputRoot, backupRoot);
-    try {
-      renameSyncWithRetry(temporaryRoot, outputRoot);
-    } catch (error) {
-      if (hadPrevious && existsSync(backupRoot) && !existsSync(outputRoot)) renameSyncWithRetry(backupRoot, outputRoot);
-      throw error;
-    }
-    if (hadPrevious) rmSync(backupRoot, { recursive: true, force: true });
-    return { outputRoot, digest, fileCount: entries.length, report };
-  } catch (error) {
-    rmSync(temporaryRoot, { recursive: true, force: true });
-    throw error;
-  }
-}

package/lib/public-plugin/contract.js

@@ -1,102 +0,0 @@
-import { readFileSync } from "node:fs";
-
-export const LISTING_LIMITS = Object.freeze({
-  displayName: 30,
-  shortDescription: 30,
-  developerName: 80,
-  promptCount: 3,
-  promptLength: 128,
-});
-
-export function unicodeLength(value) {
-  return [...String(value)].length;
-}
-
-function requiredString(value, label, errors) {
-  if (typeof value !== "string" || value.trim() === "") errors.push(`${label} is required`);
-}
-
-function within(value, limit, label, errors) {
-  requiredString(value, label, errors);
-  if (typeof value === "string" && unicodeLength(value) > limit) {
-    errors.push(`${label} exceeds ${limit} Unicode code points`);
-  }
-}
-
-export function loadJson(path) {
-  return JSON.parse(readFileSync(path, "utf8"));
-}
-
-export function validatePublicPluginContract({ definition, capabilityMatrix, reviewerCases, releaseNotes }) {
-  const errors = [];
-  const contract = definition?.publicDistribution;
-  if (contract?.schemaVersion !== 1) errors.push("publicDistribution.schemaVersion must be 1");
-  if (contract?.submissionType !== "skills") errors.push("submissionType must be skills");
-  if (contract?.technicalId !== definition?.id) errors.push("technicalId must match canonical plugin id");
-  if (contract?.developerName !== definition?.developerName) errors.push("developerName must match canonical developerName");
-  if (contract?.category !== definition?.category) errors.push("category must match canonical category");
-  within(contract?.publicDisplayName, LISTING_LIMITS.displayName, "publicDisplayName", errors);
-  within(contract?.shortDescription, LISTING_LIMITS.shortDescription, "shortDescription", errors);
-  within(contract?.developerName, LISTING_LIMITS.developerName, "developerName", errors);
-  requiredString(contract?.fullDisplayName, "fullDisplayName", errors);
-  requiredString(definition?.longDescription, "longDescription", errors);
-  if (Object.hasOwn(contract ?? {}, "longDescription")) {
-    errors.push("publicDistribution.longDescription must use canonical longDescription");
-  }
-  if (contract?.fullDisplayName !== `${definition?.displayName} (${contract?.publicDisplayName})`) {
-    errors.push("fullDisplayName must combine canonical displayName and publicDisplayName");
-  }
-
-  const prompts = contract?.defaultPrompt;
-  if (!Array.isArray(prompts) || prompts.length !== LISTING_LIMITS.promptCount) {
-    errors.push(`defaultPrompt must contain exactly ${LISTING_LIMITS.promptCount} prompts`);
-  } else {
-    prompts.forEach((prompt, index) => within(prompt, LISTING_LIMITS.promptLength, `defaultPrompt[${index}]`, errors));
-  }
-  for (const [name, value] of Object.entries(contract?.urls ?? {})) {
-    try {
-      const url = new URL(value);
-      if (url.protocol !== "https:") errors.push(`${name} URL must use HTTPS`);
-    } catch {
-      errors.push(`${name} URL is invalid`);
-    }
-  }
-  for (const name of ["website", "privacy", "terms", "support"]) {
-    if (!contract?.urls?.[name]) errors.push(`${name} URL is required`);
-  }
-  if (contract?.publisher?.verificationState !== "unverified") {
-    errors.push("publisher verificationState must remain unverified without portal evidence");
-  }
-  if (!contract?.availability || !Array.isArray(contract.availability.countries) || !Array.isArray(contract.availability.regions) || !Array.isArray(contract.availability.workspaceContexts)) {
-    errors.push("availability decision record is incomplete");
-  }
-
-  const allowedStates = new Set(["common", "codex-specific", "chatgpt-specific", "advisory", "unavailable", "unverified"]);
-  if (capabilityMatrix?.releaseVersion !== definition?.version) errors.push("capability matrix version must match definition");
-  if (!Array.isArray(capabilityMatrix?.capabilities) || capabilityMatrix.capabilities.length === 0) errors.push("capability matrix is empty");
-  for (const capability of capabilityMatrix?.capabilities ?? []) {
-    if (!allowedStates.has(capability.state)) errors.push(`capability ${capability.id ?? "unknown"} has invalid state`);
-    requiredString(capability.evidenceClass, `capability ${capability.id} evidenceClass`, errors);
-    requiredString(capability.evidenceRef, `capability ${capability.id} evidenceRef`, errors);
-  }
-
-  if (reviewerCases?.releaseVersion !== definition?.version) errors.push("reviewer cases version must match definition");
-  const cases = reviewerCases?.cases ?? [];
-  if (cases.filter((entry) => entry.kind === "positive").length < 5) errors.push("at least five positive reviewer cases are required");
-  if (cases.filter((entry) => entry.kind === "negative").length < 3) errors.push("at least three negative reviewer cases are required");
-  for (const entry of cases) {
-    for (const field of ["id", "kind", "theme", "prompt", "expectedWorkflow", "expectedResult"]) requiredString(entry[field], `${entry.id ?? "case"}.${field}`, errors);
-    if (!Array.isArray(entry.prerequisites)) errors.push(`${entry.id}.prerequisites must be an array`);
-  }
-  for (const theme of ["missing-approval", "disproportionate-fit", "unavailable-repository-authority", "unsupported-host-capability", "unauthorized-external-action"]) {
-    if (!cases.some((entry) => entry.kind === "negative" && entry.theme === theme)) errors.push(`negative reviewer theme ${theme} is required`);
-  }
-  requiredString(releaseNotes, "releaseNotes", errors);
-  if (typeof releaseNotes === "string" && !releaseNotes.includes(definition?.version)) errors.push("release notes must contain exact version");
-  return errors;
-}
-
-export function assertPublicPluginContract(inputs) {
-  const errors = validatePublicPluginContract(inputs);
-  if (errors.length) throw new Error(`AGDF_PUBLIC_PLUGIN_CONTRACT_INVALID: ${errors.join("; ")}`);
-}

package/lib/public-plugin/copilot-profile.js

@@ -1,126 +0,0 @@
-import { createHash } from "node:crypto";
-import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { join, relative } from "node:path";
-
-export const COPILOT_PROFILE_ID = "copilot-runtime-plugin";
-export const COPILOT_INVENTORY_FILE = ".agdf-payload-inventory.json";
-
-function sha256(content) {
-  return createHash("sha256").update(content).digest("hex");
-}
-
-function filesUnder(root) {
-  const files = [];
-  function visit(directory) {
-    for (const name of readdirSync(directory).sort()) {
-      const path = join(directory, name);
-      const stats = statSync(path);
-      if (stats.isDirectory()) visit(path);
-      else if (stats.isFile()) files.push(path);
-    }
-  }
-  visit(root);
-  return files;
-}
-
-export function payloadInventoryDigest(inventory) {
-  return sha256(`${JSON.stringify(inventory, null, 2)}\n`);
-}
-
-export function buildCopilotPayloadInventory({ profileRoot, mappings, version, baseline }) {
-  const files = filesUnder(profileRoot)
-    .map((path) => ({ path, relativePath: relative(profileRoot, path).replaceAll("\\", "/") }))
-    .filter(({ relativePath }) => relativePath !== COPILOT_INVENTORY_FILE);
-  const byDestination = new Map(mappings.map((entry) => [entry.destination, entry]));
-  const unmapped = files.filter(({ relativePath }) => !byDestination.has(relativePath));
-  if (unmapped.length) throw new Error(`AGDF_COPILOT_PAYLOAD_UNMAPPED: ${unmapped.map(({ relativePath }) => relativePath).join(", ")}`);
-  const missing = mappings.filter(({ destination }) => !files.some(({ relativePath }) => relativePath === destination));
-  if (missing.length) throw new Error(`AGDF_COPILOT_PAYLOAD_MISSING: ${missing.map(({ destination }) => destination).join(", ")}`);
-  if (new Set(mappings.map(({ destination }) => destination)).size !== mappings.length) {
-    throw new Error("AGDF_COPILOT_PAYLOAD_DUPLICATE_DESTINATION");
-  }
-  const entries = files.map(({ path, relativePath }) => {
-    const mapping = byDestination.get(relativePath);
-    const content = readFileSync(path);
-    return {
-      destination: relativePath,
-      component: mapping.component,
-      owner: mapping.owner,
-      rule: mapping.rule,
-      requirement: mapping.requirement,
-      ...(mapping.source ? { source: mapping.source } : {}),
-      ...(mapping.sourceDigest ? { source_digest: mapping.sourceDigest } : {}),
-      digest: sha256(content),
-      bytes: content.byteLength,
-    };
-  });
-  const totalBytes = entries.reduce((sum, entry) => sum + entry.bytes, 0);
-  const inventory = {
-    schema_version: 1,
-    profile_id: COPILOT_PROFILE_ID,
-    version,
-    baseline,
-    stats: { files: entries.length, bytes: totalBytes },
-    entries,
-  };
-  writeFileSync(join(profileRoot, COPILOT_INVENTORY_FILE), `${JSON.stringify(inventory, null, 2)}\n`, "utf8");
-  return inventory;
-}
-
-export function validateCopilotPayload({ profileRoot, repoRoot, expectedVersion, expectedSkills, baseline }) {
-  const inventoryPath = join(profileRoot, COPILOT_INVENTORY_FILE);
-  if (!existsSync(inventoryPath)) throw new Error("AGDF_COPILOT_PAYLOAD_INVENTORY_MISSING");
-  let inventory;
-  try { inventory = JSON.parse(readFileSync(inventoryPath, "utf8")); } catch {
-    throw new Error("AGDF_COPILOT_PAYLOAD_INVENTORY_INVALID");
-  }
-  if (inventory.schema_version !== 1 || inventory.profile_id !== COPILOT_PROFILE_ID || inventory.version !== expectedVersion) {
-    throw new Error("AGDF_COPILOT_PAYLOAD_INVENTORY_INVALID");
-  }
-  const actualFiles = filesUnder(profileRoot)
-    .map((path) => relative(profileRoot, path).replaceAll("\\", "/"))
-    .filter((path) => path !== COPILOT_INVENTORY_FILE);
-  const entries = Array.isArray(inventory.entries) ? inventory.entries : [];
-  if (new Set(entries.map(({ destination }) => destination)).size !== entries.length) {
-    throw new Error("AGDF_COPILOT_PAYLOAD_DUPLICATE_DESTINATION");
-  }
-  const mapped = new Set(entries.map(({ destination }) => destination));
-  const unmapped = actualFiles.filter((path) => !mapped.has(path));
-  if (unmapped.length) throw new Error(`AGDF_COPILOT_PAYLOAD_UNMAPPED: ${unmapped.join(", ")}`);
-  const missing = entries.filter(({ destination }) => !actualFiles.includes(destination));
-  if (missing.length) throw new Error(`AGDF_COPILOT_PAYLOAD_MISSING: ${missing.map(({ destination }) => destination).join(", ")}`);
-  for (const entry of entries) {
-    const content = readFileSync(join(profileRoot, entry.destination));
-    if (sha256(content) !== entry.digest || content.byteLength !== entry.bytes) {
-      throw new Error(`AGDF_COPILOT_PAYLOAD_DIGEST_MISMATCH: ${entry.destination}`);
-    }
-    if (repoRoot && entry.source) {
-      const source = readFileSync(join(repoRoot, entry.source));
-      if (sha256(source) !== entry.source_digest) {
-        throw new Error(`AGDF_COPILOT_PAYLOAD_STALE_SOURCE: ${entry.destination}`);
-      }
-    }
-  }
-  const excluded = actualFiles.filter((path) => path === "skills" || path.startsWith("skills/")
-    || path.startsWith(".codex-plugin/") || path.startsWith(".claude-plugin/")
-    || path === "hooks/hooks.json" || path === "hooks/session-start.sh"
-    || path.startsWith("submission/"));
-  if (excluded.length) throw new Error(`AGDF_COPILOT_PAYLOAD_EXCLUDED_SURFACE: ${excluded.join(", ")}`);
-  const skillFiles = actualFiles.filter((path) => /^copilot-skills\/agdf-[^/]+\/SKILL\.md$/.test(path));
-  const expectedSkillFiles = expectedSkills.map((slug) => `copilot-skills/agdf-${slug}/SKILL.md`).sort();
-  if (JSON.stringify(skillFiles.sort()) !== JSON.stringify(expectedSkillFiles)) {
-    throw new Error("AGDF_COPILOT_PAYLOAD_SKILL_SET_MISMATCH");
-  }
-  const stats = {
-    files: entries.length,
-    bytes: entries.reduce((sum, entry) => sum + entry.bytes, 0),
-  };
-  if (stats.files > baseline.max_files || stats.bytes > baseline.max_bytes) {
-    throw new Error(`AGDF_COPILOT_PAYLOAD_GROWTH: observed ${stats.files} files/${stats.bytes} bytes; baseline ${baseline.max_files}/${baseline.max_bytes}`);
-  }
-  if (inventory.stats?.files !== stats.files || inventory.stats?.bytes !== stats.bytes
-      || inventory.baseline?.max_files !== baseline.max_files || inventory.baseline?.max_bytes !== baseline.max_bytes) {
-    throw new Error("AGDF_COPILOT_PAYLOAD_BASELINE_MISMATCH");
-  }
-  return { inventory, inventoryDigest: payloadInventoryDigest(inventory), stats };
-}

package/lib/public-plugin/manifest.js

@@ -1,104 +0,0 @@
-function publicValues(definition) {
-  const distribution = definition.publicDistribution;
-  if (!distribution || distribution.schemaVersion !== 1) {
-    throw new Error("AGDF_PUBLIC_PLUGIN_CONTRACT_INVALID: publicDistribution schemaVersion 1 is required");
-  }
-  return distribution;
-}
-
-export function createCodexPluginManifest(definition, { publicCandidate = false } = {}) {
-  const distribution = publicValues(definition);
-  const pluginInterface = publicCandidate ? {
-    displayName: distribution.publicDisplayName,
-    shortDescription: distribution.shortDescription,
-    longDescription: definition.longDescription,
-    defaultPrompt: distribution.defaultPrompt,
-  } : {
-    displayName: definition.displayName,
-    shortDescription: definition.description,
-    longDescription: definition.longDescription,
-    defaultPrompt: definition.codex.defaultPrompt,
-  };
-  const manifest = {
-    name: definition.id,
-    version: definition.version,
-    description: definition.description,
-    author: definition.author,
-    homepage: definition.homepage,
-    repository: definition.repository,
-    license: definition.license,
-    keywords: definition.keywords,
-    skills: definition.codex.skills,
-    interface: {
-      displayName: pluginInterface.displayName,
-      shortDescription: pluginInterface.shortDescription,
-      longDescription: pluginInterface.longDescription,
-      developerName: distribution.developerName,
-      category: distribution.category,
-      capabilities: definition.codex.capabilities,
-      websiteURL: distribution.urls.website,
-      privacyPolicyURL: distribution.urls.privacy,
-      termsOfServiceURL: distribution.urls.terms,
-      composerIcon: definition.codex.composerIcon,
-      logo: definition.codex.logo,
-      defaultPrompt: pluginInterface.defaultPrompt,
-      brandColor: definition.brandColor,
-    },
-  };
-  return manifest;
-}
-
-export function renderCodexPluginManifest(definition, options) {
-  return `${JSON.stringify(createCodexPluginManifest(definition, options), null, 2)}\n`;
-}
-
-export function createClaudePluginManifest(definition) {
-  return {
-    name: definition.id,
-    version: definition.version,
-    description: definition.longDescription,
-    keywords: definition.keywords,
-    homepage: definition.homepage,
-    repository: definition.repository,
-    license: definition.license,
-    author: definition.author,
-  };
-}
-
-export function renderClaudePluginManifest(definition) {
-  return `${JSON.stringify(createClaudePluginManifest(definition), null, 2)}\n`;
-}
-
-function requireCopilotPath(value, field) {
-  if (typeof value !== "string" || !value || value.startsWith("/") || value.includes("..") || value.includes("\\")) {
-    throw new Error(`AGDF_COPILOT_PLUGIN_CONTRACT_INVALID: ${field} must be a relative POSIX path`);
-  }
-  return value;
-}
-
-export function createCopilotPluginManifest(definition) {
-  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(definition.id ?? "") || definition.id.length > 64) {
-    throw new Error("AGDF_COPILOT_PLUGIN_CONTRACT_INVALID: kebab-case name is required");
-  }
-  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(definition.version ?? "")) {
-    throw new Error("AGDF_COPILOT_PLUGIN_CONTRACT_INVALID: semantic version is required");
-  }
-  const copilot = definition.copilot ?? {};
-  return {
-    name: definition.id,
-    version: definition.version,
-    description: definition.description,
-    author: definition.author,
-    homepage: definition.homepage,
-    repository: definition.repository,
-    license: definition.license,
-    keywords: definition.keywords,
-    category: definition.category,
-    skills: requireCopilotPath(copilot.skills, "skills"),
-    hooks: requireCopilotPath(copilot.hooks, "hooks"),
-  };
-}
-
-export function renderCopilotPluginManifest(definition) {
-  return `${JSON.stringify(createCopilotPluginManifest(definition), null, 2)}\n`;
-}

package/lib/public-plugin/report.js

@@ -1,33 +0,0 @@
-export function createReadinessReport({ definition, fileCount, inventoryDigest }) {
-  const contract = definition.publicDistribution;
-  return {
-    schemaVersion: 1,
-    releaseVersion: definition.version,
-    candidateState: "repository_ready",
-    submissionReady: false,
-    submissionBlockers: [
-      "publisher identity and Apps Management authority are unverified",
-      "availability selection is pending",
-      "public deployment and exact-host evidence are unverified",
-      "portal draft has not been created or reconciled",
-    ],
-    evidence: {
-      repository: { state: "pass", detail: "canonical contract and deterministic source checks" },
-      bundle: { state: "pass", detail: `${fileCount} inventoried files; inventory digest ${inventoryDigest}` },
-      installed_host: { state: "unverified", detail: "PPD-L02 and PPD-L03 not performed" },
-      portal: { state: "unverified", detail: contract.publisher.verificationState },
-      post_publication: { state: "unverified", detail: "not published" },
-    },
-    externalState: {
-      publisherIdentity: contract.publisher.verificationState,
-      availability: contract.availability.decisionState,
-      portal: "not_observed",
-      publication: "not_observed",
-    },
-  };
-}
-
-export function renderReadinessReport(report) {
-  const blockers = report.submissionBlockers.map((blocker) => `- ${blocker}`).join("\n");
-  return `# AGDF Public Plugin Readiness\n\n- release: \`${report.releaseVersion}\`\n- candidate_state: \`${report.candidateState}\`\n- submission_ready: \`${report.submissionReady}\`\n\n## Evidence classes\n\n| Class | State | Detail |\n|---|---|---|\n${Object.entries(report.evidence).map(([name, value]) => `| ${name} | ${value.state} | ${value.detail} |`).join("\n")}\n\n## Submission blockers\n\n${blockers}\n\nRepository and bundle evidence do not prove installation, authenticated host behavior, publisher identity, portal state, deployment or publication.\n`;
-}

package/lib/public-plugin/validator.js

@@ -1,101 +0,0 @@
-import { createHash } from "node:crypto";
-import { lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
-import { LISTING_LIMITS, unicodeLength } from "./contract.js";
-
-function inside(root, candidate) {
-  const rel = relative(root, candidate);
-  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
-}
-
-function hasExactCase(root, target) {
-  const rel = relative(root, target);
-  let current = root;
-  for (const segment of rel.split(sep)) {
-    if (!readdirSync(current).includes(segment)) return false;
-    current = join(current, segment);
-  }
-  return true;
-}
-
-export function listCandidateFiles(root) {
-  root = realpathSync(resolve(root));
-  const files = [];
-  function visit(directory) {
-    for (const name of readdirSync(directory).sort()) {
-      const path = join(directory, name);
-      const stats = lstatSync(path);
-      if (stats.isSymbolicLink()) throw new Error(`AGDF_PUBLIC_PLUGIN_BUNDLE_PATH_MISSING: symlink not allowed: ${relative(root, path)}`);
-      if (stats.isDirectory()) visit(path);
-      else if (stats.isFile()) files.push(relative(root, path).replaceAll("\\", "/"));
-    }
-  }
-  visit(root);
-  return files;
-}
-
-function declaredPath(root, value, label, { directory = false } = {}) {
-  if (typeof value !== "string" || !value.startsWith("./")) throw new Error(`AGDF_PUBLIC_PLUGIN_BUNDLE_PATH_MISSING: ${label} must start with ./`);
-  const target = resolve(root, value);
-  if (!inside(root, target)) throw new Error(`AGDF_PUBLIC_PLUGIN_BUNDLE_PATH_MISSING: ${label} escapes candidate root`);
-  if (!hasExactCase(root, target)) throw new Error(`AGDF_PUBLIC_PLUGIN_BUNDLE_PATH_MISSING: ${label} has case mismatch or is missing`);
-  const actual = realpathSync(target);
-  if (!inside(root, actual)) throw new Error(`AGDF_PUBLIC_PLUGIN_BUNDLE_PATH_MISSING: ${label} resolves outside candidate root`);
-  const stats = statSync(target);
-  if (directory ? !stats.isDirectory() : !stats.isFile()) throw new Error(`AGDF_PUBLIC_PLUGIN_BUNDLE_PATH_MISSING: ${label} has wrong type`);
-}
-
-function assertReferencedSkillResources(root) {
-  const skillsRoot = join(root, "skills");
-  for (const skillName of readdirSync(skillsRoot).sort()) {
-    const skillRoot = join(skillsRoot, skillName);
-    if (!statSync(skillRoot).isDirectory()) continue;
-    const skillPath = join(skillRoot, "SKILL.md");
-    if (!statSync(skillPath).isFile()) throw new Error(`AGDF_PUBLIC_PLUGIN_BUNDLE_PATH_MISSING: skills/${skillName}/SKILL.md`);
-    const content = readFileSync(skillPath, "utf8");
-    const references = [...content.matchAll(/\.\.\/\.\.\/meta\/([A-Za-z0-9._/-]+)/g)].map((match) => match[1].replace(/[`)\],.;:]+$/, ""));
-    for (const reference of references) {
-      const target = resolve(root, "meta", reference);
-      if (!inside(root, target) || !statSync(target).isFile()) throw new Error(`AGDF_PUBLIC_PLUGIN_BUNDLE_PATH_MISSING: skills/${skillName} references meta/${reference}`);
-    }
-  }
-}
-
-export function validateCandidate(root) {
-  root = realpathSync(resolve(root));
-  const manifestPath = join(root, ".codex-plugin", "plugin.json");
-  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-  if (manifest.hooks || manifest.mcp || manifest.app) throw new Error("AGDF_PUBLIC_PLUGIN_CONTRACT_INVALID: Skills-only candidate must not declare hooks, MCP or app configuration");
-  declaredPath(root, manifest.skills, "skills", { directory: true });
-  declaredPath(root, manifest.interface?.composerIcon, "composerIcon");
-  declaredPath(root, manifest.interface?.logo, "logo");
-  const definition = JSON.parse(readFileSync(join(root, "meta", "agdf-plugin.definition.json"), "utf8"));
-  if (definition.version !== manifest.version) throw new Error("AGDF_PUBLIC_PLUGIN_VERSION_DRIFT: manifest and definition differ");
-  for (const [label, source] of Object.entries(definition.publicDistribution?.submissionSources ?? {})) {
-    declaredPath(root, `./${source}`, `submissionSources.${label}`);
-  }
-  assertReferencedSkillResources(root);
-  if (unicodeLength(manifest.interface?.displayName) > LISTING_LIMITS.displayName) throw new Error("AGDF_PUBLIC_PLUGIN_LISTING_LIMIT_EXCEEDED: displayName");
-  if (unicodeLength(manifest.interface?.shortDescription) > LISTING_LIMITS.shortDescription) throw new Error("AGDF_PUBLIC_PLUGIN_LISTING_LIMIT_EXCEEDED: shortDescription");
-  if (unicodeLength(manifest.interface?.developerName) > LISTING_LIMITS.developerName) throw new Error("AGDF_PUBLIC_PLUGIN_LISTING_LIMIT_EXCEEDED: developerName");
-  const prompts = manifest.interface?.defaultPrompt ?? [];
-  if (prompts.length !== LISTING_LIMITS.promptCount || prompts.some((prompt) => unicodeLength(prompt) > LISTING_LIMITS.promptLength)) throw new Error("AGDF_PUBLIC_PLUGIN_LISTING_LIMIT_EXCEEDED: defaultPrompt");
-  for (const field of ["websiteURL", "privacyPolicyURL", "termsOfServiceURL"]) {
-    let url;
-    try { url = new URL(manifest.interface?.[field]); } catch { throw new Error(`AGDF_PUBLIC_PLUGIN_CONTRACT_INVALID: ${field}`); }
-    if (url.protocol !== "https:") throw new Error(`AGDF_PUBLIC_PLUGIN_CONTRACT_INVALID: ${field} must use HTTPS`);
-  }
-  const files = listCandidateFiles(root);
-  for (const forbidden of [".app.json", ".mcp.json", ".agdf/control/", "node_modules/", ".git/"]) {
-    if (files.some((file) => file === forbidden || file.startsWith(forbidden))) throw new Error(`AGDF_PUBLIC_PLUGIN_CONTRACT_INVALID: forbidden candidate content ${forbidden}`);
-  }
-  return { manifest, files };
-}
-
-export function inventory(root, { exclude = [] } = {}) {
-  const excluded = new Set(exclude);
-  return listCandidateFiles(root).filter((path) => !excluded.has(path)).map((path) => ({
-    path,
-    sha256: createHash("sha256").update(readFileSync(join(root, path))).digest("hex"),
-  }));
-}