synorch 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-09-20
+
+### Added
+
+- Provider-neutral orchestration structure generation for Codex and Claude Code.
+- Safe `inspect`, `init`, `sync`, and `doctor` CLI commands exposed through `syn` and `synorch`.
+- Evidence-driven repository and workspace discovery for JavaScript, TypeScript, Java, Python, Rust, and Go projects.
+- Automatic technology skill selection for React, Java, Spring Boot, JPA, Node.js, Vue, Nuxt, and Tailwind CSS.
+- A bundled, provenance-tracked Ingenium skill catalog with on-demand loading rules.
+- Model profiles, orchestration protocols, minimal context packets, verification contracts, and provider adapters.
+
+[Unreleased]: https://github.com/TunahanTuna/synorch/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/TunahanTuna/synorch/releases/tag/v0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tunahan Tuna
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,56 @@
+# Synorch
+
+`synorch`, Codex ve Claude Code için provider-bağımsız, orchestrator merkezli agent/skill/protokol yapısı kuran Node.js tabanlı bir CLI'dır. Paket adı `synorch`, kurulumdan sonraki kısa terminal komutu `syn`'dir.
+
+## Kullanım
+
+Kurulum yapmadan çalıştırma:
+
+```bash
+npx synorch init
+pnpm dlx synorch init
+yarn dlx synorch init
+```
+
+Global kurulumdan sonra kısa komut:
+
+```bash
+npm install --global synorch
+syn init
+```
+
+## Geliştirme
+
+```bash
+pnpm install
+pnpm check
+pnpm dev -- inspect
+```
+
+## Komutlar
+
+```bash
+syn inspect [--target <path>] [--scope workspace|repository]
+syn init [--target <path>] [--scope workspace|repository] [--force]
+syn sync [--target <path>] [--force] [--json]
+syn doctor [--target <path>] [--json]
+```
+
+## Skill havuzu
+
+`sync`, proje sahibinin 33 skill'lik Ingenium havuzunu destek dosyalarıyla birlikte `.ai/skills/library/ingenium/` altına materialize eder ve kaynak/lisans/provenance bilgisini `.ai/skills/catalog.yaml` içinde tutar. React, Java, Node, Vue, JPA ve Tailwind skill'leri yalnız verified stack kanıtıyla otomatik aktive edilir; diğer skill'ler açıklamaları eşleştiğinde on-demand yüklenir. Bütün havuzun aynı anda context'e alınması yasaktır.
+
+Anthropic Agent Skills, Superpowers ve Microsoft Agent Skills kaynakları sabit commit kimlikleriyle kataloglanır ancak güvenlik ve lisans incelemesi yapılmadan içerikleri otomatik import veya execute edilmez.
+
+`init`, kaynak koda dokunmadan canonical orchestration çekirdeğini kurar. Ardından `sync`, repository veya workspace modüllerini kanıta dayalı olarak keşfeder, proje/skill registry'lerini ve seçilen teknoloji skill'lerini üretir; kullanıcı tarafından değiştirilmiş generated teknoloji skill'lerini yalnızca açık `--force` ile yeniler. Son olarak `doctor`, referans zincirini, canonical base skill kümesini ve path/symlink sınırlarını doğrular.
+
+Mimari kararlar için [mimari planı](./docs/AI-ORCHESTRATION-ARCHITECTURE.md) inceleyin.
+
+## Gereksinimler ve proje bilgileri
+
+- Node.js 24 veya daha yeni bir sürüm gerekir.
+- Sürüm geçmişi için [CHANGELOG.md](./CHANGELOG.md) dosyasını inceleyin.
+- Güvenlik açıklarını herkese açık issue yerine [güvenlik politikasındaki](./SECURITY.md) özel bildirim akışıyla paylaşın.
+- Synorch, [MIT lisansı](./LICENSE) altında yayımlanır.
+
+İlk sürüm notları [Synorch v0.1.0](./docs/releases/v0.1.0.md) belgesinde yer alır.

package/dist/application/doctor-service.d.ts

@@ -0,0 +1,24 @@
+import type { FileSystem } from "../infrastructure/file-system.ts";
+export type DiagnosticSeverity = "error" | "warning" | "info";
+export interface Diagnostic {
+    readonly severity: DiagnosticSeverity;
+    readonly code: string;
+    readonly message: string;
+    readonly path?: string;
+}
+export declare class DoctorService {
+    private readonly fileSystem;
+    constructor(fileSystem: FileSystem);
+    diagnose(targetDirectory: string): Promise<readonly Diagnostic[]>;
+    private validateWorkspaceChain;
+    private validateProjectRecordPaths;
+    private validateProjectArtifactPath;
+    private validateCommandPaths;
+    private validateSkillRegistry;
+    private validateRegisteredSkills;
+    private isExistingDirectory;
+    private isExistingRegularFile;
+    private isCanonicalPathWithin;
+    private validateYamlFile;
+}
+//# sourceMappingURL=doctor-service.d.ts.map

package/dist/application/doctor-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-service.d.ts","sourceRoot":"","sources":["../../src/application/doctor-service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAWD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;gBAErB,UAAU,EAAE,UAAU;IAI5B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;YAyFhE,sBAAsB;YAkItB,0BAA0B;YA+F1B,2BAA2B;YA+B3B,oBAAoB;YAqDpB,qBAAqB;YA4DrB,wBAAwB;YAiHxB,mBAAmB;YAOnB,qBAAqB;YAOrB,qBAAqB;YASrB,gBAAgB;CAgD/B"}

package/dist/application/doctor-service.js

@@ -0,0 +1,508 @@
+import path from "node:path";
+import { manifestSchema, modelProfileSchema, projectRecordSchema, skillRegistrySchema, workspaceSchema, } from "../domain/config.js";
+import { BASE_SKILLS } from "../domain/skill-packs.js";
+import { parseYaml } from "../infrastructure/serialization.js";
+const REQUIRED_PATHS = [
+    "AGENTS.md",
+    "CLAUDE.md",
+    ".ai/constitution.md",
+    ".ai/protocols/registry.yaml",
+    ".ai/schemas/context-packet.schema.json",
+    ".ai/schemas/completion-packet.schema.json",
+];
+export class DoctorService {
+    fileSystem;
+    constructor(fileSystem) {
+        this.fileSystem = fileSystem;
+    }
+    async diagnose(targetDirectory) {
+        const root = path.resolve(targetDirectory);
+        const diagnostics = [];
+        for (const requiredPath of REQUIRED_PATHS) {
+            if (!(await this.fileSystem.exists(path.join(root, requiredPath)))) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "missing-required-file",
+                    message: `Required structure file is missing: ${requiredPath}`,
+                    path: requiredPath,
+                });
+            }
+        }
+        const manifest = await this.validateYamlFile(root, ".ai/manifest.yaml", manifestSchema, diagnostics);
+        const workspace = await this.validateYamlFile(root, ".ai/workspace.yaml", workspaceSchema, diagnostics);
+        const openAi = await this.validateYamlFile(root, ".ai/model-profiles/openai.yaml", modelProfileSchema, diagnostics);
+        const claude = await this.validateYamlFile(root, ".ai/model-profiles/claude.yaml", modelProfileSchema, diagnostics);
+        if (manifest?.routing.require_session_confirmation !== true) {
+            diagnostics.push({
+                severity: "error",
+                code: "session-confirmation-disabled",
+                message: "Session model-profile confirmation must remain enabled.",
+                path: ".ai/manifest.yaml",
+            });
+        }
+        if (manifest?.routing.silent_fallback !== false) {
+            diagnostics.push({
+                severity: "error",
+                code: "silent-fallback-enabled",
+                message: "Silent model fallback is forbidden.",
+                path: ".ai/manifest.yaml",
+            });
+        }
+        if (openAi && openAi.provider !== "openai") {
+            diagnostics.push({
+                severity: "error",
+                code: "provider-profile-mismatch",
+                message: "OpenAI profile declares a different provider.",
+                path: ".ai/model-profiles/openai.yaml",
+            });
+        }
+        if (claude && claude.provider !== "claude") {
+            diagnostics.push({
+                severity: "error",
+                code: "provider-profile-mismatch",
+                message: "Claude profile declares a different provider.",
+                path: ".ai/model-profiles/claude.yaml",
+            });
+        }
+        if (workspace !== undefined) {
+            await this.validateWorkspaceChain(root, workspace, diagnostics);
+        }
+        if (diagnostics.length === 0) {
+            diagnostics.push({
+                severity: "info",
+                code: "healthy",
+                message: "The AI orchestration structure is internally consistent.",
+            });
+        }
+        return diagnostics;
+    }
+    async validateWorkspaceChain(root, workspace, diagnostics) {
+        reportDuplicates(workspace.projects.map((project) => project.id), "project id", "duplicate-project-id", diagnostics);
+        reportDuplicates(workspace.projects.map((project) => normalizeForComparison(project.path)), "project path", "duplicate-project-path", diagnostics);
+        reportDuplicates(workspace.projects.map((project) => normalizeForComparison(project.record)), "project record", "duplicate-project-record", diagnostics);
+        for (const project of workspace.projects) {
+            const projectPath = resolveSafeRelativePath(root, project.path);
+            if (projectPath === undefined) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "unsafe-project-path",
+                    message: `Workspace project path must stay within the target root: ${project.path}`,
+                    path: ".ai/workspace.yaml",
+                });
+                continue;
+            }
+            if (!(await this.isExistingDirectory(projectPath.absolute))) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "missing-project-directory",
+                    message: `Workspace project path is not an existing directory: ${project.path}`,
+                    path: ".ai/workspace.yaml",
+                });
+                continue;
+            }
+            if (!(await this.isCanonicalPathWithin(root, projectPath.absolute))) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "unsafe-project-path",
+                    message: `Workspace project path escapes the target root: ${project.path}`,
+                    path: ".ai/workspace.yaml",
+                });
+                continue;
+            }
+            const recordPath = resolveSafeRelativePath(root, project.record);
+            if (recordPath === undefined) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "unsafe-project-record-path",
+                    message: `Workspace project record path must stay within the target root: ${project.record}`,
+                    path: ".ai/workspace.yaml",
+                });
+                continue;
+            }
+            const expectedRecordPath = `.ai/projects/${project.id}.yaml`;
+            if (project.record !== expectedRecordPath) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "noncanonical-project-record-path",
+                    message: `Workspace project record must be exactly '${expectedRecordPath}', received ` +
+                        `'${project.record}'.`,
+                    path: ".ai/workspace.yaml",
+                });
+                continue;
+            }
+            if (!(await this.isExistingRegularFile(recordPath.absolute)) ||
+                !(await this.isCanonicalPathWithin(root, recordPath.absolute))) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "missing-project-record",
+                    message: `Project record is missing, unsafe, or not a regular file: ${project.record}`,
+                    path: recordPath.relative,
+                });
+                continue;
+            }
+            const record = await this.validateYamlFile(root, recordPath.relative, projectRecordSchema, diagnostics, {
+                missing: "missing-project-record",
+                invalid: "invalid-project-record",
+                malformed: "malformed-project-record",
+            });
+            if (record === undefined)
+                continue;
+            if (record.id !== project.id) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "project-record-id-mismatch",
+                    message: `Project record id '${record.id}' does not match workspace id '${project.id}'.`,
+                    path: recordPath.relative,
+                });
+            }
+            if (normalizeForComparison(record.path) !== projectPath.comparison) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "project-record-path-mismatch",
+                    message: `Project record path '${record.path}' does not match workspace path '${project.path}'.`,
+                    path: recordPath.relative,
+                });
+            }
+            await this.validateProjectRecordPaths(root, projectPath.absolute, record, recordPath.relative, diagnostics);
+            await this.validateSkillRegistry(root, record, recordPath.relative, diagnostics);
+        }
+    }
+    async validateProjectRecordPaths(root, projectRoot, record, recordPath, diagnostics) {
+        const modulePaths = new Set();
+        for (const module of record.modules) {
+            const modulePath = resolveSafeRelativePath(root, module.path);
+            if (modulePath === undefined ||
+                !isPathWithin(projectRoot, modulePath.absolute) ||
+                !(await this.isCanonicalPathWithin(projectRoot, modulePath.absolute))) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "unsafe-module-path",
+                    message: `Module path must stay within its project root: ${module.path}`,
+                    path: recordPath,
+                });
+                continue;
+            }
+            modulePaths.add(modulePath.comparison);
+            if (!(await this.isExistingDirectory(modulePath.absolute))) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "missing-module-directory",
+                    message: `Module path is not an existing directory: ${module.path}`,
+                    path: recordPath,
+                });
+            }
+            for (const manifestPath of module.manifests) {
+                await this.validateProjectArtifactPath(root, projectRoot, manifestPath, recordPath, diagnostics);
+            }
+            for (const evidence of module.evidence) {
+                await this.validateProjectArtifactPath(root, projectRoot, evidence.source, recordPath, diagnostics);
+            }
+            for (const command of Object.values(module.commands)) {
+                await this.validateCommandPaths(root, projectRoot, command.cwd, command.source, modulePath.comparison, recordPath, diagnostics);
+            }
+        }
+        for (const manifestPath of record.manifests) {
+            await this.validateProjectArtifactPath(root, projectRoot, manifestPath, recordPath, diagnostics);
+        }
+        for (const evidence of record.evidence) {
+            await this.validateProjectArtifactPath(root, projectRoot, evidence.source, recordPath, diagnostics);
+        }
+        for (const command of Object.values(record.commands)) {
+            await this.validateCommandPaths(root, projectRoot, command.cwd, command.source, modulePaths, recordPath, diagnostics);
+        }
+    }
+    async validateProjectArtifactPath(root, projectRoot, candidate, recordPath, diagnostics) {
+        const artifactPath = resolveSafeRelativePath(root, candidate);
+        if (artifactPath === undefined ||
+            !isPathWithin(projectRoot, artifactPath.absolute) ||
+            !(await this.isCanonicalPathWithin(projectRoot, artifactPath.absolute))) {
+            diagnostics.push({
+                severity: "error",
+                code: "unsafe-project-artifact-path",
+                message: `Manifest or source path must stay within its project root: ${candidate}`,
+                path: recordPath,
+            });
+            return;
+        }
+        if (!(await this.isExistingRegularFile(artifactPath.absolute))) {
+            diagnostics.push({
+                severity: "error",
+                code: "missing-project-artifact",
+                message: `Manifest or source path is not an existing regular file: ${candidate}`,
+                path: recordPath,
+            });
+        }
+    }
+    async validateCommandPaths(root, projectRoot, cwd, source, expectedModulePath, recordPath, diagnostics) {
+        const cwdPath = resolveSafeRelativePath(root, cwd);
+        if (cwdPath === undefined ||
+            !isPathWithin(projectRoot, cwdPath.absolute) ||
+            !(await this.isCanonicalPathWithin(projectRoot, cwdPath.absolute))) {
+            diagnostics.push({
+                severity: "error",
+                code: "unsafe-command-cwd",
+                message: `Command cwd must stay within its project root: ${cwd}`,
+                path: recordPath,
+            });
+        }
+        else {
+            if (!(await this.isExistingDirectory(cwdPath.absolute))) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "missing-command-cwd",
+                    message: `Command cwd is not an existing directory: ${cwd}`,
+                    path: recordPath,
+                });
+            }
+            const matchesModule = typeof expectedModulePath === "string"
+                ? cwdPath.comparison === expectedModulePath
+                : expectedModulePath.has(cwdPath.comparison);
+            if (!matchesModule) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "command-cwd-module-mismatch",
+                    message: `Command cwd does not match a discovered module path: ${cwd}`,
+                    path: recordPath,
+                });
+            }
+        }
+        await this.validateProjectArtifactPath(root, projectRoot, source, recordPath, diagnostics);
+    }
+    async validateSkillRegistry(root, record, recordPath, diagnostics) {
+        const registryPath = resolveSafeRelativePath(root, record.skill_registry, ".ai/projects/");
+        if (registryPath === undefined) {
+            diagnostics.push({
+                severity: "error",
+                code: "unsafe-skill-registry-path",
+                message: "Project skill_registry must be a safe relative path under .ai/projects/: " +
+                    record.skill_registry,
+                path: recordPath,
+            });
+            return;
+        }
+        if (!(await this.isExistingRegularFile(registryPath.absolute)) ||
+            !(await this.isCanonicalPathWithin(root, registryPath.absolute))) {
+            diagnostics.push({
+                severity: "error",
+                code: "missing-skill-registry",
+                message: "Project skill_registry is missing, unsafe, or not a regular file: " +
+                    record.skill_registry,
+                path: registryPath.relative,
+            });
+            return;
+        }
+        const registry = await this.validateYamlFile(root, registryPath.relative, skillRegistrySchema, diagnostics, {
+            missing: "missing-skill-registry",
+            invalid: "invalid-skill-registry",
+            malformed: "malformed-skill-registry",
+        });
+        if (registry === undefined)
+            return;
+        if (registry.project_id !== record.id) {
+            diagnostics.push({
+                severity: "error",
+                code: "skill-registry-project-mismatch",
+                message: `Skill registry project_id '${registry.project_id}' does not match record id ` +
+                    `'${record.id}'.`,
+                path: registryPath.relative,
+            });
+        }
+        await this.validateRegisteredSkills(root, registry, registryPath.relative, diagnostics);
+    }
+    async validateRegisteredSkills(root, registry, registryPath, diagnostics) {
+        const expectedBaseSkills = new Map(BASE_SKILLS.map((skill) => [skill.id, skill.relativePath]));
+        reportDuplicates(registry.base_skills.map((skill) => skill.id), "base skill id", "duplicate-base-skill-id", diagnostics, registryPath);
+        const registeredBaseSkillIds = new Set(registry.base_skills.map((skill) => skill.id));
+        for (const expectedSkill of BASE_SKILLS) {
+            if (!registeredBaseSkillIds.has(expectedSkill.id)) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "missing-base-skill-entry",
+                    message: `Skill registry is missing canonical base skill '${expectedSkill.id}'.`,
+                    path: registryPath,
+                });
+            }
+        }
+        for (const registeredSkill of registry.base_skills) {
+            if (!expectedBaseSkills.has(registeredSkill.id)) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "unexpected-base-skill-entry",
+                    message: `Skill registry contains unexpected base skill '${registeredSkill.id}'.`,
+                    path: registryPath,
+                });
+            }
+        }
+        reportDuplicates([
+            ...registry.base_skills.map((skill) => normalizeForComparison(skill.relative_path)),
+            ...registry.technology_skills.map((skill) => normalizeForComparison(skill.relative_path)),
+        ], "registry skill path", "duplicate-registry-skill-path", diagnostics, registryPath);
+        for (const skill of registry.base_skills) {
+            const expectedPath = expectedBaseSkills.get(skill.id);
+            if (expectedPath === undefined)
+                continue;
+            const skillPath = resolveSafeRelativePath(root, skill.relative_path, ".ai/skills/");
+            if (skill.relative_path !== expectedPath ||
+                skillPath === undefined ||
+                normalizeForComparison(skill.relative_path).startsWith(".ai/skills/technology/")) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "unsafe-base-skill-path",
+                    message: `Base skill '${skill.id}' must use canonical path '${expectedPath}', received ` +
+                        `'${skill.relative_path}'.`,
+                    path: registryPath,
+                });
+                continue;
+            }
+            if (!(await this.isExistingRegularFile(skillPath.absolute)) ||
+                !(await this.isCanonicalPathWithin(root, skillPath.absolute))) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "missing-base-skill",
+                    message: `Registered base skill is missing or not a regular file: ${skillPath.relative}`,
+                    path: skillPath.relative,
+                });
+            }
+        }
+        for (const skill of registry.technology_skills) {
+            const skillPath = resolveSafeRelativePath(root, skill.relative_path, ".ai/skills/technology/") ??
+                resolveSafeRelativePath(root, skill.relative_path, ".ai/skills/library/");
+            if (skillPath === undefined) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "unsafe-technology-skill-path",
+                    message: "Technology skill path must stay under .ai/skills/technology/ or .ai/skills/library/: " +
+                        skill.relative_path,
+                    path: registryPath,
+                });
+                continue;
+            }
+            if (!(await this.fileSystem.exists(skillPath.absolute)) ||
+                (await this.fileSystem.isDirectory(skillPath.absolute)) ||
+                !(await this.isCanonicalPathWithin(root, skillPath.absolute))) {
+                diagnostics.push({
+                    severity: "error",
+                    code: "missing-technology-skill",
+                    message: `Registered technology skill is missing: ${skillPath.relative}`,
+                    path: skillPath.relative,
+                });
+            }
+        }
+    }
+    async isExistingDirectory(targetPath) {
+        return ((await this.fileSystem.exists(targetPath)) &&
+            (await this.fileSystem.isDirectory(targetPath)));
+    }
+    async isExistingRegularFile(targetPath) {
+        return ((await this.fileSystem.exists(targetPath)) &&
+            !(await this.fileSystem.isDirectory(targetPath)));
+    }
+    async isCanonicalPathWithin(root, targetPath) {
+        try {
+            await this.fileSystem.assertPathWithinRoot(root, targetPath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async validateYamlFile(root, relativePath, schema, diagnostics, codes = {
+        missing: "missing-config",
+        invalid: "invalid-config",
+        malformed: "invalid-yaml",
+    }) {
+        const absolutePath = path.join(root, relativePath);
+        if (!(await this.fileSystem.exists(absolutePath))) {
+            diagnostics.push({
+                severity: "error",
+                code: codes.missing,
+                message: `Configuration file is missing: ${relativePath}`,
+                path: relativePath,
+            });
+            return undefined;
+        }
+        try {
+            const result = schema.safeParse(parseYaml(await this.fileSystem.readText(absolutePath)));
+            if (result.success) {
+                return result.data;
+            }
+            diagnostics.push({
+                severity: "error",
+                code: codes.invalid,
+                message: result.error.message,
+                path: relativePath,
+            });
+            return undefined;
+        }
+        catch (error) {
+            diagnostics.push({
+                severity: "error",
+                code: codes.malformed,
+                message: error instanceof Error ? error.message : String(error),
+                path: relativePath,
+            });
+            return undefined;
+        }
+    }
+}
+function resolveSafeRelativePath(root, candidate, requiredPrefix) {
+    if (candidate.includes("\0") || path.win32.parse(candidate).root !== "")
+        return undefined;
+    const normalized = normalizeRelativePath(candidate);
+    if (path.posix.isAbsolute(normalized))
+        return undefined;
+    const segments = normalized.split("/");
+    if (segments.some((segment) => segment === ".."))
+        return undefined;
+    const absolute = path.resolve(root, ...segments);
+    const relativeToRoot = path.relative(root, absolute);
+    if (relativeToRoot === ".." ||
+        relativeToRoot.startsWith(".." + path.sep) ||
+        path.isAbsolute(relativeToRoot)) {
+        return undefined;
+    }
+    const comparison = normalizeForComparison(normalized);
+    if (requiredPrefix !== undefined &&
+        !isStrictDescendant(comparison, normalizeForComparison(requiredPrefix))) {
+        return undefined;
+    }
+    return { relative: normalized, absolute, comparison };
+}
+function isStrictDescendant(candidate, directory) {
+    return candidate.startsWith(directory + "/");
+}
+function isPathWithin(root, target) {
+    const relative = path.relative(root, target);
+    return (relative === "" ||
+        (relative !== ".." && !relative.startsWith(".." + path.sep) && !path.isAbsolute(relative)));
+}
+function normalizeRelativePath(value) {
+    const normalized = value
+        .trim()
+        .replaceAll("\\", "/")
+        .replace(/\/+/g, "/")
+        .replace(/^(?:\.\/)+/, "")
+        .replace(/\/$/, "");
+    return normalized || ".";
+}
+function normalizeForComparison(value) {
+    return normalizeRelativePath(value).toLowerCase();
+}
+function reportDuplicates(values, label, code, diagnostics, diagnosticPath = ".ai/workspace.yaml") {
+    const seen = new Set();
+    const reported = new Set();
+    for (const value of values) {
+        const key = value.toLowerCase();
+        if (seen.has(key) && !reported.has(key)) {
+            diagnostics.push({
+                severity: "error",
+                code,
+                message: `Duplicate ${label}: ${value}`,
+                path: diagnosticPath,
+            });
+            reported.add(key);
+        }
+        seen.add(key);
+    }
+}
+//# sourceMappingURL=doctor-service.js.map