runcastle 0.1.0

package/dist/chunk-AHRTPV2C.js

@@ -0,0 +1,1082 @@
+// ../schema/dist/index.js
+import { z } from "zod";
+import semver from "semver";
+import { z as z2 } from "zod";
+import semver2 from "semver";
+import {
+  Node,
+  SyntaxKind,
+  VariableDeclarationKind
+} from "ts-morph";
+import { Project } from "ts-morph";
+import { Node as Node2, SyntaxKind as SyntaxKind2 } from "ts-morph";
+import { Node as Node3, SyntaxKind as SyntaxKind3 } from "ts-morph";
+import { Node as Node4, SyntaxKind as SyntaxKind4 } from "ts-morph";
+import { z as z3 } from "zod";
+var PRODUCT_NAME = "runcastle";
+var DEFAULT_REGISTRY_URL = "https://runcastle.dev";
+var SCHEMA_VERSION = 1;
+var SCHEMA_ID = `${DEFAULT_REGISTRY_URL}/schema/v1.json`;
+var PAYLOAD_DIR = ".sandcastle";
+var DEFAULT_ENTRYPOINT = `${PAYLOAD_DIR}/main.ts`;
+var SANDCASTLE_PACKAGE_NAME = "@ai-hero/sandcastle";
+var MAX_PACKAGE_SIZE_BYTES = 2 * 1024 * 1024;
+var MAX_FILE_COUNT = 100;
+var MAX_FILE_SIZE_BYTES = 512 * 1024;
+var MAX_DESCRIPTION_LENGTH = 280;
+var MAX_TAGS = 8;
+var MIN_README_LENGTH = 300;
+var SLUG_REGEX = /^[a-z0-9-]{3,64}$/;
+var ENV_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ALLOWED_EXTENSIONS = [
+  ".ts",
+  ".mts",
+  ".md",
+  ".json",
+  ".yaml",
+  ".yml",
+  ".gitignore",
+  ".env.example",
+  ".sh"
+];
+var ALLOWED_FILENAMES = [
+  "Dockerfile",
+  "Containerfile",
+  ".gitignore",
+  ".env.example"
+];
+var WINDOWS_RESERVED_NAMES = /* @__PURE__ */ new Set([
+  "CON",
+  "PRN",
+  "AUX",
+  "NUL",
+  ...Array.from({ length: 9 }, (_, i) => `COM${i + 1}`),
+  ...Array.from({ length: 9 }, (_, i) => `LPT${i + 1}`)
+]);
+var SANDBOX_PROVIDERS = [
+  "docker",
+  "podman",
+  "vercel",
+  "custom"
+];
+var AGENT_PROVIDERS = [
+  "claude-code",
+  "codex",
+  "pi",
+  "opencode",
+  "cursor",
+  "copilot"
+];
+var AGENT_FACTORY_NAMES = [
+  "claudeCode",
+  "codex",
+  "pi",
+  "opencode"
+];
+var FACTORY_TO_PROVIDER = {
+  claudeCode: "claude-code",
+  codex: "codex",
+  pi: "pi",
+  opencode: "opencode"
+};
+var ALLOWED_IMPORT_ROOTS = [
+  SANDCASTLE_PACKAGE_NAME,
+  "zod"
+];
+var ErrorCode = {
+  E_SCHEMA_INVALID: "E_SCHEMA_INVALID",
+  E_MISSING_FILE: "E_MISSING_FILE",
+  E_UNLISTED_FILE: "E_UNLISTED_FILE",
+  E_UNSAFE_PATH: "E_UNSAFE_PATH",
+  E_ENV_FILE_PRESENT: "E_ENV_FILE_PRESENT",
+  E_SECRET_DETECTED: "E_SECRET_DETECTED",
+  E_ENV_MISMATCH: "E_ENV_MISMATCH",
+  E_HOOKS_MISMATCH: "E_HOOKS_MISMATCH",
+  E_HOOKS_NOT_STATIC: "E_HOOKS_NOT_STATIC",
+  E_FORBIDDEN_IMPORT: "E_FORBIDDEN_IMPORT",
+  E_UNDECLARED_SHELL_EXPANSION: "E_UNDECLARED_SHELL_EXPANSION",
+  E_PACKAGE_TOO_LARGE: "E_PACKAGE_TOO_LARGE",
+  E_TOO_MANY_FILES: "E_TOO_MANY_FILES",
+  E_FILE_TOO_LARGE: "E_FILE_TOO_LARGE",
+  E_BINARY_FILE: "E_BINARY_FILE",
+  E_FORBIDDEN_EXTENSION: "E_FORBIDDEN_EXTENSION"
+};
+var WarningCode = {
+  W_VERSION_RANGE_STALE: "W_VERSION_RANGE_STALE",
+  W_NO_TOPOLOGY: "W_NO_TOPOLOGY",
+  W_SHORT_README: "W_SHORT_README",
+  W_NAMESPACE_UNSAFE_PATHS: "W_NAMESPACE_UNSAFE_PATHS"
+};
+var semverString = z.string().refine((v) => semver.valid(v, { loose: false }) !== null, {
+  message: "must be a strict semver version (e.g. 1.2.3)"
+});
+var semverRange = z.string().refine((v) => semver.validRange(v, { loose: false }) !== null, {
+  message: "must be a valid semver range (e.g. >=0.12.0 <0.13.0)"
+});
+var AgentSchema = z.object({
+  role: z.string().min(1).describe("The agent's role name as used in the orchestration code (e.g. planner, implementer, reviewer)."),
+  provider: z.enum(AGENT_PROVIDERS).describe("Agent factory / provider used for this role."),
+  model: z.string().min(1).describe("Model identifier passed to the provider (e.g. claude-opus-4-8)."),
+  parallel: z.boolean().optional().describe("Whether this role fans out into parallel instances.")
+});
+var SandcastleCompatSchema = z.object({
+  packageName: z.string().min(1).default(SANDCASTLE_PACKAGE_NAME).describe("The orchestration package. Defaults to @ai-hero/sandcastle."),
+  versionRange: semverRange.describe(
+    "Semver range of Sandcastle versions the workflow is tested against (e.g. >=0.12.0 <0.13.0)."
+  ),
+  entrypoint: z.string().min(1).default(DEFAULT_ENTRYPOINT).describe("Path to the orchestration entrypoint that calls run(). Defaults to .sandcastle/main.ts.")
+});
+var EnvVarSchema = z.object({
+  name: z.string().regex(ENV_NAME_REGEX, "invalid environment variable name").describe("Environment variable name (shell-safe identifier)."),
+  required: z.boolean().describe("Whether the workflow fails without this variable set."),
+  description: z.string().optional().describe("What the variable is for \u2014 shown to installers.")
+});
+var DisclosuresSchema = z.object({
+  hostHooks: z.array(z.string()).default([]).describe("Every host.* hook command run on the consumer's machine, verbatim as string literals."),
+  sandboxHooks: z.array(z.string()).default([]).describe("Every sandbox.* hook command run inside the sandbox, verbatim as string literals."),
+  networkAccess: z.string().optional().describe("Free-text note describing what the workflow accesses over the network."),
+  usesShellExpansion: z.boolean().default(false).describe("Whether any prompt file contains !`command` shell-expansion blocks.")
+});
+var TopologyNodeSchema = z.object({
+  id: z.string().min(1).describe("Unique node identifier, referenced by edges."),
+  role: z.string().min(1).nullable().describe("The agent role this node represents, or null for non-agent nodes (e.g. a git step)."),
+  label: z.string().min(1).describe("Display label rendered in the diagram."),
+  kind: z.string().min(1).optional().describe('Optional node flavor (e.g. "git") \u2014 non-agent nodes get a muted rendering.'),
+  fanOut: z.boolean().optional().describe("Marks a node that fans out into parallel instances \u2014 rendered as a stacked card.")
+});
+var TopologyEdgeSchema = z.object({
+  from: z.string().min(1).describe("Source node id."),
+  to: z.string().min(1).describe("Target node id."),
+  label: z.string().optional().describe("Optional edge label (e.g. a condition)."),
+  loop: z.boolean().optional().describe("Marks a feedback edge (e.g. reviewer sending work back) \u2014 rendered dashed.")
+});
+var TopologySchema = z.object({
+  nodes: z.array(TopologyNodeSchema).describe("Graph nodes \u2014 one per agent role or auxiliary step."),
+  edges: z.array(TopologyEdgeSchema).describe("Directed edges between node ids.")
+});
+var ManifestSchema = z.object({
+  $schema: z.string().optional().describe("Optional JSON Schema URL so editors provide autocomplete and inline validation."),
+  schemaVersion: z.literal(SCHEMA_VERSION).describe("Manifest format version. Always 1 for now."),
+  // Identity
+  name: z.string().min(1).max(120).describe("Human-readable display name shown on cards and the detail page."),
+  slug: z.string().regex(SLUG_REGEX, "slug must match [a-z0-9-]{3,64}").describe("URL-safe identifier [a-z0-9-]{3,64}, unique per author; forms the install handle author/slug."),
+  version: semverString.describe(
+    "Strict semver (e.g. 1.2.0). Versions are immutable \u2014 republishing a version is rejected with 409."
+  ),
+  description: z.string().min(1).max(MAX_DESCRIPTION_LENGTH).describe(`One-paragraph summary (max ${MAX_DESCRIPTION_LENGTH} chars) shown on cards and in search.`),
+  license: z.string().min(1).describe("SPDX license identifier for the package contents (e.g. MIT)."),
+  tags: z.array(z.string().min(1)).max(MAX_TAGS).default([]).describe(`Up to ${MAX_TAGS} tags from an open vocabulary, used for browse filters and search.`),
+  // Compatibility
+  sandcastle: SandcastleCompatSchema.describe(
+    "Compatibility block describing the Sandcastle runtime the workflow targets."
+  ),
+  // Declared runtime metadata
+  agents: z.array(AgentSchema).default([]).describe("The agents the workflow orchestrates \u2014 declared metadata cross-checked against the entrypoint."),
+  sandboxProviders: z.array(z.enum(SANDBOX_PROVIDERS)).default([]).describe("Sandbox environments the workflow supports (subset of docker | podman | vercel | custom)."),
+  // Environment
+  env: z.array(EnvVarSchema).default([]).describe("Environment variables the user must provide; cross-checked against .env.example."),
+  // Disclosures
+  disclosures: DisclosuresSchema.describe(
+    "The declared side-effect surface (hooks, network, shell expansion). Mismatches with detected behavior block publish."
+  ),
+  // Topology (optional — absence produces a warning)
+  topology: TopologySchema.optional().describe(
+    "The node/edge graph describing the orchestration shape. Optional \u2014 drives the site diagram, cards, and OG images."
+  ),
+  // Files to install
+  files: z.array(z.string().min(1)).min(1).max(MAX_FILE_COUNT).describe("Exhaustive list of files the package installs, relative to the package root (all under .sandcastle/)."),
+  // Optional metadata
+  repositoryDirectory: z.string().optional().describe("Directory within the repository containing the package, when it isn't at the repo root."),
+  // http(s) only — package content is hostile input (§8.6); a javascript: URL
+  // here would become a live link on the workflow page.
+  homepage: z.string().url().refine((u) => /^https?:\/\//i.test(u), {
+    message: "homepage must be an http(s) URL"
+  }).optional().describe("Optional project homepage URL (http(s) only)."),
+  postInstallNotes: z.string().optional().describe("Plain text printed by the CLI after a successful install (printed, never executed).")
+});
+function parseManifest(value) {
+  const result = ManifestSchema.safeParse(value);
+  if (result.success) return { ok: true, manifest: result.data };
+  return { ok: false, error: result.error };
+}
+function manifestJsonSchema() {
+  const schema = z2.toJSONSchema(ManifestSchema, {
+    io: "input",
+    target: "draft-2020-12",
+    unrepresentable: "any"
+  });
+  schema.$id = SCHEMA_ID;
+  schema.title = "Runcastle workflow.json";
+  schema.description = "Manifest for a Runcastle workflow package (Sandcastle orchestration).";
+  return schema;
+}
+var MANIFEST_JSON_SCHEMA = manifestJsonSchema();
+var SECRET_RULES = [
+  {
+    id: "anthropic-api-key",
+    description: "Anthropic API key (sk-ant-)",
+    pattern: /sk-ant-[A-Za-z0-9_-]{16,}/g
+  },
+  {
+    id: "openai-project-key",
+    description: "OpenAI project key (sk-proj-)",
+    pattern: /sk-proj-[A-Za-z0-9_-]{16,}/g
+  },
+  {
+    id: "openai-api-key",
+    description: "OpenAI API key (sk-)",
+    // Classic sk- keys: sk- followed by >=20 base62 chars, not preceded by a
+    // word char and not one of the more specific sk-ant-/sk-proj- prefixes.
+    pattern: /(?<![A-Za-z0-9_-])sk-(?!ant-|proj-)[A-Za-z0-9]{20,}/g
+  },
+  {
+    id: "github-pat-classic",
+    description: "GitHub personal access token (ghp_)",
+    pattern: /ghp_[A-Za-z0-9]{36,}/g
+  },
+  {
+    id: "github-pat-fine-grained",
+    description: "GitHub fine-grained PAT (github_pat_)",
+    pattern: /github_pat_[A-Za-z0-9_]{22,}/g
+  },
+  {
+    id: "github-oauth-token",
+    description: "GitHub OAuth token (gho_)",
+    pattern: /gho_[A-Za-z0-9]{36,}/g
+  },
+  {
+    id: "aws-access-key-id",
+    description: "AWS access key id (AKIA/ASIA)",
+    pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g
+  },
+  {
+    id: "aws-secret-access-key",
+    description: "AWS secret access key (contextual)",
+    // Require an aws-secret context word near a 40-char base64 secret to keep
+    // false positives on arbitrary hashes/blobs low.
+    pattern: /aws.{0,20}?(?:secret|sak).{0,20}?['"]?([A-Za-z0-9/+=]{40})['"]?/gis
+  },
+  {
+    id: "private-key-block",
+    description: "PEM PRIVATE KEY block",
+    pattern: /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/g
+  }
+];
+function scanForSecrets(content) {
+  const findings = [];
+  for (const rule of SECRET_RULES) {
+    rule.pattern.lastIndex = 0;
+    let m;
+    while ((m = rule.pattern.exec(content)) !== null) {
+      findings.push({
+        ruleId: rule.id,
+        description: rule.description,
+        match: m[0],
+        index: m.index
+      });
+      if (m.index === rule.pattern.lastIndex) rule.pattern.lastIndex++;
+    }
+  }
+  return findings;
+}
+function createSourceFile(content) {
+  const project = new Project({
+    useInMemoryFileSystem: true,
+    skipAddingFilesFromTsConfig: true,
+    skipFileDependencyResolution: true,
+    skipLoadingLibFiles: true,
+    compilerOptions: {
+      allowJs: true
+    }
+  });
+  return project.createSourceFile("entrypoint.mts", content, {
+    overwrite: true
+  });
+}
+function readStringLiteral(node) {
+  if (!node) return void 0;
+  if (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node)) {
+    return node.getLiteralText();
+  }
+  return void 0;
+}
+function extractCommand(entry, out, reasons) {
+  if (!Node.isObjectLiteralExpression(entry)) {
+    reasons.push("hook entry is not an object literal");
+    return;
+  }
+  const commandProp = entry.getProperty("command");
+  if (!commandProp || !Node.isPropertyAssignment(commandProp)) {
+    reasons.push("hook entry has no static `command` property");
+    return;
+  }
+  const value = readStringLiteral(commandProp.getInitializer());
+  if (value === void 0) {
+    reasons.push("hook `command` is not a string literal");
+    return;
+  }
+  out.push(value);
+}
+function extractGroup(groupValue, out, reasons) {
+  if (!groupValue) return;
+  if (!Node.isObjectLiteralExpression(groupValue)) {
+    reasons.push("hook group is not an object literal");
+    return;
+  }
+  for (const prop of groupValue.getProperties()) {
+    if (!Node.isPropertyAssignment(prop)) {
+      reasons.push("hook event is not a static property");
+      continue;
+    }
+    const arr = prop.getInitializer();
+    if (!arr || !Node.isArrayLiteralExpression(arr)) {
+      reasons.push("hook event value is not an array literal");
+      continue;
+    }
+    for (const el of arr.getElements()) {
+      if (Node.isSpreadElement(el)) {
+        reasons.push("hook array uses a spread element");
+        continue;
+      }
+      extractCommand(el, out, reasons);
+    }
+  }
+}
+function extractHooksObject(hooksObject, hostOut, sandboxOut, reasons) {
+  const host = hooksObject.getProperty("host");
+  if (host) {
+    if (Node.isPropertyAssignment(host)) {
+      extractGroup(host.getInitializer(), hostOut, reasons);
+    } else {
+      reasons.push("`host` hooks are not a static property");
+    }
+  }
+  const sandbox = hooksObject.getProperty("sandbox");
+  if (sandbox) {
+    if (Node.isPropertyAssignment(sandbox)) {
+      extractGroup(sandbox.getInitializer(), sandboxOut, reasons);
+    } else {
+      reasons.push("`sandbox` hooks are not a static property");
+    }
+  }
+}
+function resolveObjectLiteral(node, source) {
+  let current = node;
+  while (current && (Node.isAsExpression(current) || Node.isSatisfiesExpression(current) || Node.isParenthesizedExpression(current))) {
+    current = current.getExpression();
+  }
+  if (!current) return void 0;
+  if (Node.isObjectLiteralExpression(current)) return current;
+  if (Node.isIdentifier(current)) {
+    const name = current.getText();
+    for (const stmt of source.getVariableStatements()) {
+      if (stmt.getDeclarationKind() !== VariableDeclarationKind.Const) continue;
+      for (const decl of stmt.getDeclarations()) {
+        if (decl.getName() !== name) continue;
+        const init = decl.getInitializer();
+        if (!init) return void 0;
+        let unwrapped = init;
+        while (Node.isAsExpression(unwrapped) || Node.isSatisfiesExpression(unwrapped) || Node.isParenthesizedExpression(unwrapped)) {
+          unwrapped = unwrapped.getExpression();
+        }
+        return Node.isObjectLiteralExpression(unwrapped) ? unwrapped : void 0;
+      }
+    }
+  }
+  return void 0;
+}
+function extractHooks(entrypointContent) {
+  const source = createSourceFile(entrypointContent);
+  const hostCommands = [];
+  const sandboxCommands = [];
+  const dynamicReasons = [];
+  const objects = source.getDescendantsOfKind(
+    SyntaxKind.ObjectLiteralExpression
+  );
+  for (const obj of objects) {
+    const hooksProp = obj.getProperty("hooks");
+    if (!hooksProp) continue;
+    let value;
+    if (Node.isPropertyAssignment(hooksProp)) {
+      value = hooksProp.getInitializer();
+    } else if (Node.isShorthandPropertyAssignment(hooksProp)) {
+      value = hooksProp.getNameNode();
+    } else {
+      dynamicReasons.push("`hooks` is not a static property assignment");
+      continue;
+    }
+    const literal2 = value ? resolveObjectLiteral(value, source) : void 0;
+    if (!literal2) {
+      dynamicReasons.push(
+        "`hooks` value is not an object literal (or a same-file `const` object literal)"
+      );
+      continue;
+    }
+    extractHooksObject(literal2, hostCommands, sandboxCommands, dynamicReasons);
+  }
+  return {
+    static: dynamicReasons.length === 0,
+    hostCommands,
+    sandboxCommands,
+    dynamicReasons
+  };
+}
+function isAllowedImport(specifier) {
+  if (specifier.startsWith("node:")) return true;
+  for (const root of ALLOWED_IMPORT_ROOTS) {
+    if (specifier === root || specifier.startsWith(`${root}/`)) return true;
+  }
+  return false;
+}
+function analyzeImports(entrypointContent) {
+  const source = createSourceFile(entrypointContent);
+  const specifiers = [];
+  for (const decl of source.getImportDeclarations()) {
+    specifiers.push(decl.getModuleSpecifierValue());
+  }
+  for (const decl of source.getExportDeclarations()) {
+    const value = decl.getModuleSpecifierValue();
+    if (value) specifiers.push(value);
+  }
+  for (const call of source.getDescendantsOfKind(SyntaxKind2.CallExpression)) {
+    const expr = call.getExpression();
+    const isRequire = Node2.isIdentifier(expr) && expr.getText() === "require";
+    const isDynamicImport = expr.getKind() === SyntaxKind2.ImportKeyword;
+    if (!isRequire && !isDynamicImport) continue;
+    const arg = call.getArguments()[0];
+    if (arg && (Node2.isStringLiteral(arg) || Node2.isNoSubstitutionTemplateLiteral(arg))) {
+      specifiers.push(arg.getLiteralText());
+    }
+  }
+  return specifiers.map((specifier) => ({
+    specifier,
+    allowed: isAllowedImport(specifier)
+  }));
+}
+function forbiddenImports(entrypointContent) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const ref of analyzeImports(entrypointContent)) {
+    if (!ref.allowed && !seen.has(ref.specifier)) {
+      seen.add(ref.specifier);
+      out.push(ref.specifier);
+    }
+  }
+  return out;
+}
+var SHELL_EXPANSION_RE = /!`([^`]+)`/g;
+function detectShellExpansions(content) {
+  const out = [];
+  SHELL_EXPANSION_RE.lastIndex = 0;
+  let m;
+  while ((m = SHELL_EXPANSION_RE.exec(content)) !== null) {
+    out.push({ command: m[1] ?? "", index: m.index });
+  }
+  return out;
+}
+function literal(node) {
+  if (!node) return void 0;
+  if (Node3.isStringLiteral(node) || Node3.isNoSubstitutionTemplateLiteral(node)) {
+    return node.getLiteralText();
+  }
+  return void 0;
+}
+function findNamespaceUnsafePaths(entrypointContent) {
+  const source = createSourceFile(entrypointContent);
+  const out = [];
+  const prefix = `${PAYLOAD_DIR}/`;
+  for (const prop of source.getDescendantsOfKind(
+    SyntaxKind3.PropertyAssignment
+  )) {
+    if (prop.getName() !== "promptFile") continue;
+    const value = literal(prop.getInitializer());
+    if (value === void 0) continue;
+    const normalized = value.replace(/^\.\//, "");
+    if (normalized.startsWith(prefix)) {
+      out.push({ path: value });
+    }
+  }
+  return out;
+}
+function normalizePath(p) {
+  return p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/{2,}/g, "/").replace(/^\/+/, "").replace(/\/+$/, "");
+}
+function basename(p) {
+  const norm = normalizePath(p);
+  const idx = norm.lastIndexOf("/");
+  return idx === -1 ? norm : norm.slice(idx + 1);
+}
+var PURE_EXTENSIONS = ALLOWED_EXTENSIONS.filter(
+  (e) => !ALLOWED_FILENAMES.includes(e)
+);
+function extensionAllowed(path) {
+  const base = basename(path);
+  if (ALLOWED_FILENAMES.includes(base)) return true;
+  return PURE_EXTENSIONS.some((ext) => base.endsWith(ext));
+}
+var PAYLOAD_PREFIX = `${PAYLOAD_DIR}/`;
+function inPayload(path) {
+  return path === PAYLOAD_DIR || path.startsWith(PAYLOAD_PREFIX);
+}
+function unsafePathReason(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return "path is empty";
+  for (let i = 0; i < raw.length; i++) {
+    const code = raw.charCodeAt(i);
+    if (code < 32 || code === 127) return "path contains control characters";
+  }
+  if (raw.includes("\\")) return "path contains a backslash";
+  if (raw.includes(":")) {
+    return "path contains a colon (drive letter or NTFS alternate data stream)";
+  }
+  if (raw.startsWith("/")) return "path is absolute";
+  const norm = normalizePath(raw);
+  if (norm === "") return "path is empty";
+  for (const seg of norm.split("/")) {
+    if (seg === "..") return "path contains a '..' traversal segment";
+    const stem = seg.split(".")[0].toUpperCase();
+    if (WINDOWS_RESERVED_NAMES.has(stem)) {
+      return `path uses the Windows reserved name "${seg}"`;
+    }
+  }
+  if (!inPayload(norm)) {
+    return `path must live under ${PAYLOAD_DIR}/`;
+  }
+  return null;
+}
+var utf8Decoder = new TextDecoder("utf-8", { fatal: false });
+function decodeFile(file) {
+  if (typeof file.content === "string") {
+    return {
+      text: file.content,
+      isBinary: file.content.includes("\0")
+    };
+  }
+  const bytes = file.content;
+  for (let i = 0; i < bytes.length; i++) {
+    if (bytes[i] === 0) return { text: null, isBinary: true };
+  }
+  const text = utf8Decoder.decode(bytes);
+  const isBinary = text.includes("\uFFFD");
+  return { text: isBinary ? null : text, isBinary };
+}
+function parseEnvExampleKeys(content) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const rawLine of content.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const m = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+    if (m?.[1]) keys.add(m[1]);
+  }
+  return keys;
+}
+var Report = class {
+  errors = [];
+  warnings = [];
+  error(code, message, file) {
+    this.errors.push({ code, message, ...file ? { file } : {} });
+  }
+  warn(code, message, file) {
+    this.warnings.push({ code, message, ...file ? { file } : {} });
+  }
+};
+function validatePackage(pkg, options = {}) {
+  const report = new Report();
+  const files = /* @__PURE__ */ new Map();
+  for (const [rawPath, file] of pkg.files) {
+    files.set(normalizePath(rawPath), file);
+  }
+  const decoded = /* @__PURE__ */ new Map();
+  const textOf = (path) => {
+    if (!decoded.has(path)) {
+      const f = files.get(path);
+      decoded.set(path, f ? decodeFile(f) : { text: null, isBinary: false });
+    }
+    return decoded.get(path).text;
+  };
+  runStructuralChecks(files, decoded, report);
+  const manifestFile = files.get("workflow.json");
+  if (!manifestFile) {
+    report.error(
+      ErrorCode.E_MISSING_FILE,
+      "workflow.json is required at the package root",
+      "workflow.json"
+    );
+    return finalize(report);
+  }
+  const manifestText = textOf("workflow.json");
+  let manifest;
+  if (manifestText === null) {
+    report.error(
+      ErrorCode.E_SCHEMA_INVALID,
+      "workflow.json is not readable UTF-8 text",
+      "workflow.json"
+    );
+  } else {
+    let json;
+    try {
+      json = JSON.parse(manifestText);
+    } catch (e) {
+      report.error(
+        ErrorCode.E_SCHEMA_INVALID,
+        `workflow.json is not valid JSON: ${e.message}`,
+        "workflow.json"
+      );
+    }
+    if (json !== void 0) {
+      const parsed = parseManifest(json);
+      if (parsed.ok) {
+        manifest = parsed.manifest;
+      } else {
+        for (const issue of parsed.error.issues) {
+          const path = issue.path.join(".");
+          report.error(
+            ErrorCode.E_SCHEMA_INVALID,
+            `${path ? `${path}: ` : ""}${issue.message}`,
+            "workflow.json"
+          );
+        }
+      }
+    }
+  }
+  const readmeText = textOf("README.md");
+  if (readmeText === null && !files.has("README.md")) {
+    report.error(
+      ErrorCode.E_MISSING_FILE,
+      "README.md is required at the package root",
+      "README.md"
+    );
+  } else if (readmeText !== null && readmeText.trim().length < MIN_README_LENGTH) {
+    report.warn(
+      WarningCode.W_SHORT_README,
+      `README is shorter than ${MIN_README_LENGTH} characters`,
+      "README.md"
+    );
+  }
+  if (manifest) {
+    runManifestChecks(manifest, files, textOf, report, options);
+  }
+  return finalize(report);
+}
+function finalize(report) {
+  return {
+    ok: report.errors.length === 0,
+    errors: report.errors,
+    warnings: report.warnings
+  };
+}
+function isRealEnvFile(path) {
+  const base = basename(path);
+  return base === ".env" || base.startsWith(".env.") && base !== ".env.example";
+}
+function runStructuralChecks(files, decoded, report) {
+  if (files.size > MAX_FILE_COUNT) {
+    report.error(
+      ErrorCode.E_TOO_MANY_FILES,
+      `package has ${files.size} files (max ${MAX_FILE_COUNT})`
+    );
+  }
+  let totalBytes = 0;
+  for (const [path, file] of files) {
+    totalBytes += file.sizeBytes;
+    if (isRealEnvFile(path)) {
+      report.error(
+        ErrorCode.E_ENV_FILE_PRESENT,
+        "a real .env file must not be included in the package",
+        path
+      );
+      continue;
+    }
+    if (file.sizeBytes > MAX_FILE_SIZE_BYTES) {
+      report.error(
+        ErrorCode.E_FILE_TOO_LARGE,
+        `file is ${file.sizeBytes} bytes (max ${MAX_FILE_SIZE_BYTES})`,
+        path
+      );
+    }
+    if (!decoded.has(path)) decoded.set(path, decodeFile(file));
+    const dec = decoded.get(path);
+    if (dec.isBinary) {
+      report.error(
+        ErrorCode.E_BINARY_FILE,
+        "binary files are not allowed; text files only",
+        path
+      );
+    }
+    if (!extensionAllowed(path)) {
+      report.error(
+        ErrorCode.E_FORBIDDEN_EXTENSION,
+        `file extension is not on the allowlist (${basename(path)})`,
+        path
+      );
+    }
+    if (!dec.isBinary && dec.text !== null) {
+      const findings = scanForSecrets(dec.text);
+      if (findings.length > 0) {
+        const rules = [...new Set(findings.map((f) => f.description))].join(", ");
+        report.error(
+          ErrorCode.E_SECRET_DETECTED,
+          `possible secret detected (${rules})`,
+          path
+        );
+      }
+    }
+  }
+  if (totalBytes > MAX_PACKAGE_SIZE_BYTES) {
+    report.error(
+      ErrorCode.E_PACKAGE_TOO_LARGE,
+      `package is ${totalBytes} bytes (max ${MAX_PACKAGE_SIZE_BYTES})`
+    );
+  }
+}
+function runManifestChecks(manifest, files, textOf, report, options) {
+  checkSafePaths(manifest, report);
+  const listed = new Set(manifest.files.map(normalizePath));
+  for (const path of listed) {
+    if (!files.has(path)) {
+      report.error(
+        ErrorCode.E_MISSING_FILE,
+        "file listed in manifest.files is missing from the package",
+        path
+      );
+    }
+  }
+  for (const path of files.keys()) {
+    if (inPayload(path) && !listed.has(path) && !isRealEnvFile(path)) {
+      report.error(
+        ErrorCode.E_UNLISTED_FILE,
+        "package file under .sandcastle/ is not listed in manifest.files",
+        path
+      );
+    }
+  }
+  const entrypoint = normalizePath(
+    manifest.sandcastle.entrypoint || DEFAULT_ENTRYPOINT
+  );
+  const entrypointText = files.has(entrypoint) ? textOf(entrypoint) : null;
+  if (!files.has(entrypoint)) {
+    report.error(
+      ErrorCode.E_MISSING_FILE,
+      "the manifest entrypoint is missing from the package",
+      entrypoint
+    );
+  }
+  checkEnvConsistency(manifest, files, textOf, report);
+  if (entrypointText !== null) {
+    checkHooks(manifest, entrypoint, entrypointText, report);
+    checkImports(entrypoint, entrypointText, report);
+    checkNamespaceSafety(entrypoint, entrypointText, report);
+  }
+  checkShellExpansion(manifest, files, textOf, report);
+  if (!manifest.topology) {
+    report.warn(WarningCode.W_NO_TOPOLOGY, "workflow declares no topology");
+  }
+  if (options.latestSandcastleVersion) {
+    const latest = options.latestSandcastleVersion;
+    const range = manifest.sandcastle.versionRange;
+    if (semver2.validRange(range) && semver2.valid(latest)) {
+      if (!semver2.satisfies(latest, range)) {
+        report.warn(
+          WarningCode.W_VERSION_RANGE_STALE,
+          `sandcastle.versionRange "${range}" does not include the latest known Sandcastle release (${latest})`
+        );
+      }
+    }
+  }
+}
+function checkSafePaths(manifest, report) {
+  for (const raw of manifest.files) {
+    const reason = unsafePathReason(raw);
+    if (reason) {
+      report.error(
+        ErrorCode.E_UNSAFE_PATH,
+        `unsafe install path in manifest.files \u2014 ${reason}`,
+        typeof raw === "string" ? raw : void 0
+      );
+    }
+  }
+  const entrypoint = manifest.sandcastle.entrypoint || DEFAULT_ENTRYPOINT;
+  const entryReason = unsafePathReason(entrypoint);
+  if (entryReason) {
+    report.error(
+      ErrorCode.E_UNSAFE_PATH,
+      `unsafe sandcastle.entrypoint \u2014 ${entryReason}`,
+      entrypoint
+    );
+  }
+}
+function checkEnvConsistency(manifest, files, textOf, report) {
+  const envExamplePath = `${PAYLOAD_DIR}/.env.example`;
+  const exampleText = files.has(envExamplePath) ? textOf(envExamplePath) : null;
+  const exampleKeys = exampleText ? parseEnvExampleKeys(exampleText) : /* @__PURE__ */ new Set();
+  const manifestKeys = new Set(manifest.env.map((e) => e.name));
+  if (exampleKeys.size === 0 && manifestKeys.size === 0) return;
+  const missingFromManifest = [...exampleKeys].filter((k) => !manifestKeys.has(k));
+  const missingFromExample = [...manifestKeys].filter((k) => !exampleKeys.has(k));
+  if (missingFromManifest.length > 0 || missingFromExample.length > 0) {
+    const parts = [];
+    if (missingFromManifest.length > 0) {
+      parts.push(
+        `in .env.example but not manifest.env: ${missingFromManifest.join(", ")}`
+      );
+    }
+    if (missingFromExample.length > 0) {
+      parts.push(
+        `in manifest.env but not .env.example: ${missingFromExample.join(", ")}`
+      );
+    }
+    report.error(
+      ErrorCode.E_ENV_MISMATCH,
+      `env vars inconsistent \u2014 ${parts.join("; ")}`,
+      envExamplePath
+    );
+  }
+}
+function checkHooks(manifest, entrypoint, entrypointText, report) {
+  const extraction = extractHooks(entrypointText);
+  if (!extraction.static) {
+    report.error(
+      ErrorCode.E_HOOKS_NOT_STATIC,
+      `hooks must be statically analyzable: ${[...new Set(extraction.dynamicReasons)].join("; ")}`,
+      entrypoint
+    );
+    return;
+  }
+  const detectedHost = new Set(extraction.hostCommands);
+  const detectedSandbox = new Set(extraction.sandboxCommands);
+  const declaredHost = new Set(manifest.disclosures.hostHooks);
+  const declaredSandbox = new Set(manifest.disclosures.sandboxHooks);
+  const hostMismatch = !setsEqual(detectedHost, declaredHost);
+  const sandboxMismatch = !setsEqual(detectedSandbox, declaredSandbox);
+  if (hostMismatch || sandboxMismatch) {
+    const details = [];
+    if (hostMismatch) {
+      details.push(
+        `host hooks \u2014 declared [${[...declaredHost].join(", ")}] vs detected [${[...detectedHost].join(", ")}]`
+      );
+    }
+    if (sandboxMismatch) {
+      details.push(
+        `sandbox hooks \u2014 declared [${[...declaredSandbox].join(", ")}] vs detected [${[...detectedSandbox].join(", ")}]`
+      );
+    }
+    report.error(
+      ErrorCode.E_HOOKS_MISMATCH,
+      `disclosures.*Hooks do not match the entrypoint: ${details.join("; ")}`,
+      entrypoint
+    );
+  }
+}
+function checkImports(entrypoint, entrypointText, report) {
+  for (const specifier of forbiddenImports(entrypointText)) {
+    report.error(
+      ErrorCode.E_FORBIDDEN_IMPORT,
+      `entrypoint imports "${specifier}" \u2014 only @ai-hero/sandcastle, zod, and node:* builtins are allowed`,
+      entrypoint
+    );
+  }
+}
+function checkNamespaceSafety(entrypoint, entrypointText, report) {
+  const unsafe = findNamespaceUnsafePaths(entrypointText);
+  if (unsafe.length > 0) {
+    const paths = unsafe.map((u) => u.path).join(", ");
+    report.warn(
+      WarningCode.W_NAMESPACE_UNSAFE_PATHS,
+      `promptFile paths anchored to ${PAYLOAD_DIR}/ may break under a namespaced install: ${paths}`,
+      entrypoint
+    );
+  }
+}
+function checkShellExpansion(manifest, files, textOf, report) {
+  if (manifest.disclosures.usesShellExpansion) return;
+  for (const path of files.keys()) {
+    if (!inPayload(path) || !path.endsWith(".md")) continue;
+    const text = textOf(path);
+    if (text === null) continue;
+    const blocks = detectShellExpansions(text);
+    if (blocks.length > 0) {
+      report.error(
+        ErrorCode.E_UNDECLARED_SHELL_EXPANSION,
+        "prompt file contains !`command` shell expansion but disclosures.usesShellExpansion is false",
+        path
+      );
+    }
+  }
+}
+function setsEqual(a, b) {
+  if (a.size !== b.size) return false;
+  for (const v of a) if (!b.has(v)) return false;
+  return true;
+}
+var FACTORY_SET = new Set(AGENT_FACTORY_NAMES);
+function readStatic(node) {
+  if (!node) return void 0;
+  if (Node4.isStringLiteral(node) || Node4.isNoSubstitutionTemplateLiteral(node)) {
+    return node.getLiteralText();
+  }
+  if (Node4.isNumericLiteral(node)) return Number(node.getLiteralText());
+  if (node.getKind() === SyntaxKind4.TrueKeyword) return true;
+  if (node.getKind() === SyntaxKind4.FalseKeyword) return false;
+  if (node.getKind() === SyntaxKind4.NullKeyword) return null;
+  return void 0;
+}
+function readOptions(node) {
+  const out = {};
+  if (!node || !Node4.isObjectLiteralExpression(node)) return out;
+  for (const prop of node.getProperties()) {
+    if (!Node4.isPropertyAssignment(prop)) continue;
+    const value = readStatic(prop.getInitializer());
+    if (value !== void 0) out[prop.getName()] = value;
+  }
+  return out;
+}
+function detectAgents(entrypointContent) {
+  const source = createSourceFile(entrypointContent);
+  const out = [];
+  for (const call of source.getDescendantsOfKind(SyntaxKind4.CallExpression)) {
+    const expr = call.getExpression();
+    if (!Node4.isIdentifier(expr)) continue;
+    const name = expr.getText();
+    if (!FACTORY_SET.has(name)) continue;
+    const factory = name;
+    const args = call.getArguments();
+    const model = readStatic(args[0]);
+    const options = readOptions(args[1]);
+    out.push({
+      factory,
+      provider: FACTORY_TO_PROVIDER[factory],
+      ...typeof model === "string" ? { model } : {},
+      options
+    });
+  }
+  return out;
+}
+var ErrorEnvelopeSchema = z3.object({
+  error: z3.object({
+    code: z3.string(),
+    message: z3.string()
+  })
+});
+var RepoRefSchema = z3.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "expected owner/name");
+var CommitShaSchema = z3.string().regex(/^[0-9a-f]{40}$|^[0-9a-f]{64}$/, "expected a git commit SHA");
+var DirectorySchema = z3.string().max(256, "directory must be at most 256 characters").regex(
+  /^[A-Za-z0-9._/-]+$/,
+  "directory may only contain A-Za-z0-9._/- (no backslash, colon, or whitespace)"
+).refine((d) => !d.startsWith("/"), { message: "directory must be relative" }).refine((d) => !d.split("/").includes(".."), {
+  message: "directory must not contain a '..' traversal segment"
+});
+var FileChecksumSchema = z3.object({
+  path: z3.string().min(1),
+  sha256: z3.string().regex(/^[0-9a-f]{64}$/, "expected a sha256 hex digest"),
+  sizeBytes: z3.number().int().nonnegative(),
+  /** URL to fetch the cached content (registry cache endpoint). */
+  downloadUrl: z3.string().optional()
+});
+var FileListingSchema = z3.array(FileChecksumSchema);
+var PublishRequestSchema = z3.object({
+  manifest: ManifestSchema,
+  repo: RepoRefSchema,
+  directory: DirectorySchema.optional(),
+  commitSha: CommitShaSchema
+});
+var VersionRecordSchema = z3.object({
+  version: z3.string(),
+  commitSha: CommitShaSchema,
+  manifest: ManifestSchema,
+  publishedAt: z3.string()
+});
+var WorkflowStatsSchema = z3.object({
+  downloads: z3.number().int().nonnegative(),
+  stars: z3.number().int().nonnegative()
+});
+var WorkflowRecordSchema = z3.object({
+  author: z3.string(),
+  slug: z3.string(),
+  repo: RepoRefSchema,
+  directory: z3.string().optional(),
+  version: z3.string(),
+  commitSha: CommitShaSchema,
+  manifest: ManifestSchema,
+  files: FileListingSchema,
+  stats: WorkflowStatsSchema,
+  unlisted: z3.boolean().default(false),
+  publishedAt: z3.string(),
+  versions: z3.array(z3.string()).default([])
+});
+var BrowseSortSchema = z3.enum(["downloads", "newest", "name"]);
+var BrowseQuerySchema = z3.object({
+  q: z3.string().optional(),
+  tags: z3.union([z3.string(), z3.array(z3.string())]).transform(
+    (v) => Array.isArray(v) ? v : v.split(",").map((s) => s.trim()).filter(Boolean)
+  ).optional(),
+  agentProvider: z3.enum(AGENT_PROVIDERS).optional(),
+  sandboxProvider: z3.enum(SANDBOX_PROVIDERS).optional(),
+  sort: BrowseSortSchema.default("downloads"),
+  page: z3.coerce.number().int().positive().default(1)
+});
+var AgentBadgeSchema = z3.object({
+  role: z3.string(),
+  provider: z3.enum(AGENT_PROVIDERS),
+  model: z3.string()
+});
+var WorkflowCardSchema = z3.object({
+  author: z3.string(),
+  slug: z3.string(),
+  name: z3.string(),
+  description: z3.string(),
+  tags: z3.array(z3.string()),
+  agents: z3.array(AgentBadgeSchema),
+  sandboxProviders: z3.array(z3.enum(SANDBOX_PROVIDERS)),
+  downloads: z3.number().int().nonnegative(),
+  stars: z3.number().int().nonnegative(),
+  hasTopology: z3.boolean(),
+  version: z3.string()
+});
+var BrowseResponseSchema = z3.object({
+  items: z3.array(WorkflowCardSchema),
+  page: z3.number().int().positive(),
+  pageSize: z3.number().int().positive(),
+  total: z3.number().int().nonnegative()
+});
+var DownloadPingSchema = z3.object({
+  /** Random anonymous install id (no PII). */
+  anonInstallId: z3.string().min(1)
+});
+var ReportReasonSchema = z3.enum([
+  "malware",
+  "secret-leak",
+  "spam",
+  "policy-violation",
+  "other"
+]);
+var ReportRequestSchema = z3.object({
+  reason: ReportReasonSchema,
+  details: z3.string().max(2e3).optional()
+});
+var SandcastleVersionsSchema = z3.object({
+  latest: z3.string(),
+  distTags: z3.record(z3.string(), z3.string()),
+  refreshedAt: z3.string()
+});
+
+export {
+  PRODUCT_NAME,
+  DEFAULT_REGISTRY_URL,
+  SCHEMA_VERSION,
+  SCHEMA_ID,
+  PAYLOAD_DIR,
+  DEFAULT_ENTRYPOINT,
+  SANDCASTLE_PACKAGE_NAME,
+  SANDBOX_PROVIDERS,
+  parseManifest,
+  extractHooks,
+  detectShellExpansions,
+  normalizePath,
+  validatePackage,
+  detectAgents,
+  ErrorEnvelopeSchema,
+  PublishRequestSchema,
+  VersionRecordSchema,
+  WorkflowRecordSchema,
+  BrowseResponseSchema
+};
+//# sourceMappingURL=chunk-AHRTPV2C.js.map