@agentxm/extension-materialization 0.29.2 → 0.30.1

package/dist/src/mcps/authored-materialization.js

@@ -1,34 +0,0 @@
-/**
- * Materializing an authored MCP server package during create, fork, adopt, and
- * native import.
- *
- * The authored closure recipe accepts a type-specific materialization because
- * an MCP server's canonical content is realized by the install operation
- * rather than by its manager. Both live in this capability, so every authoring
- * route reaches the same realization without importing a peer feature.
- *
- * @experimental This API is unstable and may change without notice.
- */
-import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import { installMcpServer } from "./install-operation.js";
-/**
- * Realize the authored package's canonical content and native projections
- * without touching workspace state: the authored closure commits desired state
- * itself. Reports no acquisition facts — an authored package has no accepted
- * registry resolution for the entry writers to record.
- */
-export const materializeAuthoredMcpServer = (args) => installMcpServer({
-    name: "install-mcp-server",
-    args: {
-        ref: args.ref,
-        nonInteractive: args.nonInteractive,
-        force: false,
-        allowWorkspaceSourceTransition: true,
-        versionRange: Option.none(),
-        skipSettings: Option.none(),
-        skipStateWrites: true,
-        env: Option.none(),
-    },
-}).pipe(Effect.as(Option.none()));
-//# sourceMappingURL=authored-materialization.js.map

package/dist/src/mcps/install-operation.d.ts

@@ -1,92 +0,0 @@
-/**
- * The MCP server installation operation: acquire the package, reconcile the
- * connection's credentials, record the accepted resolution and the settings
- * entry, and project the connection into every configured agent.
- *
- * It lives in the materialization capability rather than in a feature because
- * four surfaces need it — `axm mcps install`, pack member installation,
- * reconciliation, and the authoring routes that install an MCP server they
- * have just scaffolded, forked, adopted, or imported — and a feature may not
- * import a peer feature. Requirements stay in `R` and failures stay typed in
- * `E`; the caller composes the layer and renders the failure.
- *
- * @experimental This API is unstable and may change without notice.
- */
-import * as FileSystem from "effect/FileSystem";
-import type * as HttpClient from "effect/unstable/http/HttpClient";
-import * as Path from "effect/Path";
-import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import { NativeWriteAuthority } from "@agentxm/agent-integration";
-import { CodingAgentRepository } from "@agentxm/workspace-projection";
-import type { JobStepResult, Operation } from "@agentxm/workspace-operations";
-import { WorkspaceMutations } from "@agentxm/workspace-state";
-import type { McpServerExtensionRef } from "@agentxm/extension-model/unstable/extensions/refs/mcp-server";
-import { type McpServerManifest } from "@agentxm/extension-model/unstable/mcps/manifest-schema";
-import type { ExtensionManagerFailure } from "../errors.js";
-import { McpSecretStore, type McpSecretIdentity } from "./secret-store.js";
-/**
- * Args for the install-mcp-server operation.
- */
-export type InstallMcpServerOperationArgs = {
-    readonly ref: McpServerExtensionRef;
-    /** Local connection identity and exact agent-native MCP key. */
-    readonly localName?: string;
-    readonly force: boolean;
-    /** Explicitly permit a workspace-authored relocation during reconciliation. */
-    readonly allowWorkspaceSourceTransition?: boolean;
-    readonly versionRange: Option.Option<string>;
-    /** When true, write to lockfile only (skip settings). Used for pack dependencies. */
-    readonly skipSettings: Option.Option<boolean>;
-    /** Materialize only; the enclosing authored-package transaction owns state writes. */
-    readonly skipStateWrites?: boolean;
-    /** When true, enforce strict policy for MCP sync outcomes. */
-    readonly strictAgentSync?: Option.Option<boolean>;
-    /** Resolved MCP input values from `--env KEY=VALUE` flags. */
-    readonly env?: Option.Option<Readonly<Record<string, string>>>;
-    /**
-     * Whether the invoking surface can prompt for missing required inputs.
-     * The transport boundary resolves flag, CI, and TTY state.
-     */
-    readonly nonInteractive: boolean;
-};
-/**
- * Add an MCP server to the workspace.
- *
- * @experimental This API is unstable and may change without notice.
- */
-export type InstallMcpServerOperation = Operation<"install-mcp-server", InstallMcpServerOperationArgs>;
-export type McpSecretDeletionOutcome = {
-    readonly _tag: "deleted";
-    readonly inputName: string;
-} | {
-    readonly _tag: "absent";
-    readonly inputName: string;
-} | {
-    readonly _tag: "failed";
-    readonly inputName: string;
-};
-export declare const collectSecretInputNames: (manifest: McpServerManifest) => ReadonlySet<string>;
-export declare const readMcpServerManifest: (canonicalPath: string) => Effect.Effect<Option.Option<McpServerManifest>, never, FileSystem.FileSystem | Path.Path>;
-/**
- * Erase every credential one connection holds. Erasure is reported per input:
- * a credential store that is unavailable leaves the secret behind and says so,
- * rather than failing the removal that has already settled.
- */
-export declare const deleteMcpSecrets: (identity: McpSecretIdentity, secretNames: ReadonlySet<string>) => Effect.Effect<ReadonlyArray<McpSecretDeletionOutcome>, never, McpSecretStore>;
-/**
- * Everything the MCP install operation needs from its composition root.
- */
-export type McpServerInstallRequirements = FileSystem.FileSystem | HttpClient.HttpClient | Path.Path | WorkspaceMutations | CodingAgentRepository | NativeWriteAuthority | McpSecretStore;
-/**
- * Install one MCP server: acquire the package (registry archive or the
- * workspace-authored directory), merge the connection's inputs with what the
- * credential store already holds, record the settings entry and the accepted
- * resolution, and project the connection into every configured agent.
- *
- * Failures stay typed: a refused request, an unrepresentable connection, and a
- * credential store that will not persist a secret are three different facts,
- * and the caller decides how each is reported.
- */
-export declare const installMcpServer: (op: InstallMcpServerOperation) => Effect.Effect<JobStepResult, ExtensionManagerFailure, McpServerInstallRequirements>;
-//# sourceMappingURL=install-operation.d.ts.map

package/dist/src/mcps/install-operation.js

@@ -1,557 +0,0 @@
-/**
- * The MCP server installation operation: acquire the package, reconcile the
- * connection's credentials, record the accepted resolution and the settings
- * entry, and project the connection into every configured agent.
- *
- * It lives in the materialization capability rather than in a feature because
- * four surfaces need it — `axm mcps install`, pack member installation,
- * reconciliation, and the authoring routes that install an MCP server they
- * have just scaffolded, forked, adopted, or imported — and a feature may not
- * import a peer feature. Requirements stay in `R` and failures stay typed in
- * `E`; the caller composes the layer and renders the failure.
- *
- * @experimental This API is unstable and may change without notice.
- */
-import * as FileSystem from "effect/FileSystem";
-import * as Path from "effect/Path";
-import * as Array from "effect/Array";
-import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import * as Schema from "effect/Schema";
-import { NativeWriteAuthority } from "@agentxm/agent-integration";
-import { CodingAgentRepository, applyProjectionPlansWithResults, planSingletonProjection, } from "@agentxm/workspace-projection";
-import { mcpRegistryResolutionKey } from "@agentxm/workspace-state";
-import { isPathSafe } from "@agentxm/extension-model/unstable/path-types";
-import { acceptedRegistryVersionForRef, validateExactResolvedVersion, } from "@agentxm/workspace-state";
-import { appendWarningsToMessage } from "@agentxm/workspace-operations";
-import { WorkspaceMutations } from "@agentxm/workspace-state";
-import { canReuseInstalledPackage } from "../extensions/canonical-directory.js";
-import { materializeRegistryPackage } from "../registry-materialization.js";
-import { computeExtensionPathsForLayout } from "@agentxm/workspace-state";
-import { printSourceParams } from "@agentxm/extension-model/unstable/sources/printer";
-import { computeMaterializedTreeIntegrity } from "@agentxm/workspace-state";
-import { decodeVersionSync } from "@agentxm/extension-model/unstable/version-constraints";
-import { MCP_SERVER_MANIFEST_FILENAME, McpServerManifestSchema, } from "@agentxm/extension-model/unstable/mcps/manifest-schema";
-import { agentConfigTargets, mcpServerArtifact, mcpSettingsTarget, mcpSourceTarget, } from "./artifact.js";
-import { McpAgentSyncRefused, McpCanonicalPathUnsafe, McpLocalNameConflict, McpRegistryOnlyInstall, McpRequiredInputsMissing, McpWorkspacePackageInvalid, } from "./errors.js";
-import { McpSecretStore, mcpSecretAccount } from "./secret-store.js";
-// -----------------------------------------------------------------------------
-// Lock entry builder
-// -----------------------------------------------------------------------------
-const buildLockEntry = (ref, treeIntegrity) => ({
-    type: "registry",
-    sourceType: "registry",
-    packageFormat: "agentxm",
-    endpoint: ref.source.location,
-    extensionType: "mcp-server",
-    workspaceName: ref.server.name,
-    owner: ref.owner,
-    name: ref.name,
-    resolvedVersion: decodeVersionSync(ref.version),
-    integrity: Option.getOrElse(ref.integrity, () => ""),
-    sourceName: ref.source.name,
-    publisherBindingId: ref.publisherBindingId,
-    treeIntegrity,
-});
-const maybeSecretInputName = (input) => {
-    if (input.isSecret !== true)
-        return undefined;
-    if ("name" in input)
-        return input.name;
-    if ("valueHint" in input)
-        return input.valueHint;
-    return undefined;
-};
-/**
- * Named environment inputs the manifest marks required. Only key/value inputs
- * are collected: an unnamed input has nothing a caller could pass through
- * `--env KEY=VALUE`, so it cannot be reported as a missing name.
- */
-const collectRequiredInputNames = (manifest) => {
-    const names = new Set();
-    const add = (input) => {
-        if (input.isRequired === true && input.value === undefined && input.default === undefined) {
-            names.add(input.name);
-        }
-    };
-    for (const pkg of manifest.server.packages ?? []) {
-        for (const input of pkg.environmentVariables ?? [])
-            add(input);
-    }
-    for (const remote of manifest.server.remotes ?? []) {
-        for (const input of remote.headers ?? [])
-            add(input);
-    }
-    return names;
-};
-export const collectSecretInputNames = (manifest) => {
-    const names = new Set();
-    const add = (input) => {
-        const name = maybeSecretInputName(input);
-        if (name !== undefined)
-            names.add(name);
-    };
-    for (const pkg of manifest.server.packages ?? []) {
-        for (const input of pkg.environmentVariables ?? [])
-            add(input);
-        for (const input of pkg.runtimeArguments ?? [])
-            add(input);
-        for (const input of pkg.packageArguments ?? [])
-            add(input);
-    }
-    for (const remote of manifest.server.remotes ?? []) {
-        for (const input of remote.headers ?? [])
-            add(input);
-        for (const [name, input] of Object.entries(remote.variables ?? {})) {
-            if (input.isSecret === true)
-                names.add(name);
-        }
-    }
-    return names;
-};
-// -----------------------------------------------------------------------------
-// Registry install
-// -----------------------------------------------------------------------------
-const installFromRegistry = (ref, reuse) => Effect.gen(function* () {
-    const path = yield* Path.Path;
-    const ws = yield* WorkspaceMutations;
-    const canonicalPath = computeExtensionPathsForLayout(path.join, ws.layout, ref, "mcps", ref.name).canonicalPath;
-    if (!isPathSafe(path, ws.baseDir, canonicalPath)) {
-        return yield* new McpCanonicalPathUnsafe({ serverName: ref.name, canonicalPath });
-    }
-    const useExisting = yield* canReuseInstalledPackage({
-        installedPath: canonicalPath,
-        force: reuse.force,
-        refVersion: ref.version,
-        hasIntegrity: Option.isSome(ref.integrity),
-        ...(reuse.lockedVersion === undefined ? {} : { lockedVersion: reuse.lockedVersion }),
-        existsFailureDetail: (target) => `Failed to check if canonical path exists: ${target}`,
-    });
-    if (!useExisting) {
-        yield* materializeRegistryPackage({
-            baseDir: ws.baseDir,
-            destinationPath: canonicalPath,
-            sourceLocation: ref.source.location,
-            owner: ref.owner,
-            type: "mcp-server",
-            name: ref.name,
-            version: ref.version,
-            integrity: ref.integrity,
-            messages: {
-                integrityMismatchDetail: `Integrity mismatch for ${ref.name}@${ref.version}`,
-            },
-        });
-    }
-    return canonicalPath;
-});
-export const readMcpServerManifest = (canonicalPath) => Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    const manifestPath = path.join(canonicalPath, MCP_SERVER_MANIFEST_FILENAME);
-    const exists = yield* fs.exists(manifestPath).pipe(Effect.catch(() => Effect.succeed(false)));
-    if (!exists) {
-        return Option.none();
-    }
-    const manifest = yield* fs.readFileString(manifestPath).pipe(Effect.flatMap((raw) => Effect.try({
-        try: () => {
-            const parsed = JSON.parse(raw);
-            return Schema.decodeUnknownSync(McpServerManifestSchema)(parsed);
-        },
-        catch: () => undefined,
-    })), Effect.catch(() => Effect.void));
-    if (manifest === undefined) {
-        return Option.none();
-    }
-    return Option.some(manifest);
-});
-const isNothingRunnableManifest = (manifest) => Option.match(manifest, {
-    onNone: () => false,
-    onSome: (value) => (value.server.packages === undefined || value.server.packages.length === 0) &&
-        (value.server.remotes === undefined || value.server.remotes.length === 0),
-});
-const loadStoredMcpSecrets = (identity, secretNames) => Effect.gen(function* () {
-    const secrets = yield* McpSecretStore;
-    const entries = yield* Effect.forEach(secretNames, (name) => secrets
-        .read(mcpSecretAccount({ ...identity, inputName: name }))
-        .pipe(Effect.map((value) => ({ name, value }))), { concurrency: "unbounded" });
-    const loaded = {};
-    for (const { name, value } of entries) {
-        if (Option.isSome(value))
-            loaded[name] = value.value;
-    }
-    return loaded;
-});
-const persistMcpSecrets = (identity, secretNames, values) => Effect.gen(function* () {
-    const secrets = yield* McpSecretStore;
-    return yield* Effect.forEach(secretNames, (inputName) => {
-        const value = values[inputName];
-        return value === undefined
-            ? Effect.succeed({ _tag: "skipped", inputName })
-            : secrets
-                .write(mcpSecretAccount({ ...identity, inputName }), value)
-                .pipe(Effect.map((outcome) => ({ _tag: outcome, inputName })));
-    }, { concurrency: "unbounded" });
-});
-/**
- * Erase every credential one connection holds. Erasure is reported per input:
- * a credential store that is unavailable leaves the secret behind and says so,
- * rather than failing the removal that has already settled.
- */
-export const deleteMcpSecrets = (identity, secretNames) => Effect.gen(function* () {
-    const secrets = yield* McpSecretStore;
-    return yield* Effect.forEach(secretNames, (inputName) => secrets
-        .erase(mcpSecretAccount({ ...identity, inputName }))
-        .pipe(Effect.map((outcome) => ({ _tag: outcome, inputName }))), { concurrency: "unbounded" });
-});
-const redactSettingsEnv = (values, secretNames) => {
-    const redacted = {};
-    for (const [name, value] of Object.entries(values)) {
-        if (!secretNames.has(name))
-            redacted[name] = value;
-    }
-    return redacted;
-};
-const preserveSecretReferences = (values, secretNames) => Object.fromEntries(Object.entries(values).map(([name, value]) => [
-    name,
-    secretNames.has(name) ? `\${${name}}` : value,
-]));
-const REQUIRED_AGENT_IDS = new Set([
-    "claude-code",
-    "opencode",
-    "github-copilot-cli",
-    "cursor",
-    "gemini-cli",
-    "codex",
-]);
-const formatAgentSyncWarning = (serverName, outcomes) => {
-    const warningMessage = outcomes
-        .map(({ agentId, outcome }) => outcome._tag === "success"
-        ? `${agentId}:success`
-        : outcome._tag === "fallback"
-            ? `${agentId}:fallback(${outcome.fallbackFrom}):${outcome.reason}`
-            : `${agentId}:${outcome.reason}`)
-        .join(", ");
-    return `MCP agent sync warnings for ${serverName}: ${warningMessage}`;
-};
-const summarizeAgentSync = (outcomes, warnings) => {
-    const degraded = outcomes.some(({ outcome }) => outcome._tag === "failed" || outcome._tag === "fallback");
-    const details = outcomes.map(({ agentId, outcome }) => outcome._tag === "success"
-        ? `${agentId}:success`
-        : outcome._tag === "fallback"
-            ? `${agentId}:fallback:${outcome.fallbackFrom}`
-            : `${agentId}:${outcome._tag}`);
-    return {
-        status: degraded ? "degraded" : "green",
-        details,
-        warnings,
-        outcomes,
-    };
-};
-const syncConfiguredAgentsOnInstall = (args) => Effect.gen(function* () {
-    const agentRepo = yield* CodingAgentRepository;
-    const warnings = [];
-    const unknownConfiguredAgentIds = yield* agentRepo.getUnknownConfiguredAgentIds();
-    if (args.strict && unknownConfiguredAgentIds.length > 0) {
-        return yield* new McpAgentSyncRefused({
-            serverName: args.serverName,
-            fault: "unknown-agents",
-            agentIds: unknownConfiguredAgentIds,
-        });
-    }
-    if (unknownConfiguredAgentIds.length > 0) {
-        warnings.push(`Skipping unknown configured agents: ${unknownConfiguredAgentIds.join(", ")}`);
-    }
-    const configuredAgents = yield* agentRepo.getConfiguredAgents();
-    let outcomes;
-    if (args.nothingRunnable) {
-        outcomes = configuredAgents.map((agent) => ({
-            agentId: agent.id,
-            outcome: {
-                _tag: "nothing-runnable",
-                reason: "manifest server has no packages or remotes",
-            },
-        }));
-    }
-    else {
-        outcomes = yield* applyProjectionPlansWithResults(configuredAgents.map((agent) => planSingletonProjection({
-            unitId: "mcp-server:native-config-entry",
-            targetFile: "mcp:configured-agents",
-            contributor: args,
-            adapter: {
-                observe: () => Effect.succeed({
-                    unitId: "mcp-server:native-config-entry",
-                    path: `${agent.id}:${args.serverName}`,
-                    present: false,
-                    current: false,
-                    expectedContributors: [args.serverName],
-                    observedContributors: [],
-                }),
-                apply: () => Effect.gen(function* () {
-                    const outcome = yield* agent.addMcpServer({
-                        workspaceRoot: args.wsBaseDir,
-                        scope: args.scope,
-                        serverName: args.serverName,
-                        canonicalPath: args.canonicalPath,
-                        owner: args.owner,
-                        resolvedVersion: args.resolvedVersion,
-                        enabled: args.enabled,
-                        configValues: args.configValues,
-                    });
-                    return { agentId: agent.id, outcome };
-                }),
-            },
-        })));
-    }
-    const misconfigured = Array.filter(outcomes, ({ outcome }) => outcome._tag === "misconfigured");
-    if (misconfigured.length > 0) {
-        return yield* new McpAgentSyncRefused({
-            serverName: args.serverName,
-            fault: "misconfigured",
-            agentIds: misconfigured.map(({ agentId }) => agentId),
-        });
-    }
-    const failed = Array.filter(outcomes, ({ outcome }) => outcome._tag === "failed");
-    if (args.strict && failed.length > 0) {
-        return yield* new McpAgentSyncRefused({
-            serverName: args.serverName,
-            fault: "failed",
-            agentIds: failed.map(({ agentId }) => agentId),
-        });
-    }
-    const strictDisabledFailures = Array.filter(outcomes, ({ agentId, outcome }) => (outcome._tag === "disabled" ||
-        (outcome._tag === "fallback" && outcome.fallbackFrom === "disabled")) &&
-        args.strict &&
-        REQUIRED_AGENT_IDS.has(agentId));
-    if (strictDisabledFailures.length > 0) {
-        return yield* new McpAgentSyncRefused({
-            serverName: args.serverName,
-            fault: "disabled",
-            agentIds: strictDisabledFailures.map(({ agentId }) => agentId),
-        });
-    }
-    const warningOutcomes = Array.filter(outcomes, ({ outcome }) => outcome._tag === "unsupported" ||
-        outcome._tag === "disabled" ||
-        outcome._tag === "nothing-runnable" ||
-        outcome._tag === "needs-input" ||
-        outcome._tag === "failed" ||
-        outcome._tag === "fallback");
-    if (warningOutcomes.length > 0) {
-        warnings.push(formatAgentSyncWarning(args.serverName, warningOutcomes));
-    }
-    return summarizeAgentSync(outcomes, warnings);
-});
-/**
- * Install one MCP server: acquire the package (registry archive or the
- * workspace-authored directory), merge the connection's inputs with what the
- * credential store already holds, record the settings entry and the accepted
- * resolution, and project the connection into every configured agent.
- *
- * Failures stay typed: a refused request, an unrepresentable connection, and a
- * credential store that will not persist a secret are three different facts,
- * and the caller decides how each is reported.
- */
-export const installMcpServer = (op) => Effect.gen(function* () {
-    const ws = yield* WorkspaceMutations;
-    const path = yield* Path.Path;
-    const { ref } = op.args;
-    const localName = op.args.localName ?? ref.server.name;
-    if (ref.refType !== "registry" && ref.refType !== "workspace") {
-        return yield* new McpRegistryOnlyInstall({
-            serverName: ref.server.name,
-            refType: ref.refType,
-        });
-    }
-    const strictAgentSync = Option.getOrElse(op.args.strictAgentSync ?? Option.none(), () => false);
-    const env = Option.getOrElse(op.args.env ?? Option.none(), () => ({}));
-    const resolutionKey = ref.refType === "registry"
-        ? mcpRegistryResolutionKey({
-            authority: ref.source.location,
-            owner: ref.owner,
-            name: ref.server.name,
-        })
-        : undefined;
-    const sourceIdentity = resolutionKey ?? `workspace:${ref.owner}/mcps/${ref.server.name}`;
-    const desiredGraph = yield* ws.getDesiredStateGraph();
-    const existingLocalNode = desiredGraph.nodes.find((node) => node.type === "mcp-server" && node.name === localName);
-    if (existingLocalNode !== undefined &&
-        (existingLocalNode.authority === "inline" || existingLocalNode.identity !== sourceIdentity)) {
-        return yield* new McpLocalNameConflict({
-            localName,
-            requestedIdentity: sourceIdentity,
-            owningIdentity: existingLocalNode.authority === "inline" ? "inline" : existingLocalNode.identity,
-        });
-    }
-    const existingClosure = desiredGraph.mcpSourceClosures.find((closure) => closure.identity === sourceIdentity);
-    const lockedVersion = ref.refType === "registry"
-        ? acceptedRegistryVersionForRef(yield* ws.getLockedMcpServer(resolutionKey ?? ""), ref)
-        : undefined;
-    const canonicalPath = ref.refType === "registry"
-        ? yield* installFromRegistry(ref, { force: op.args.force, lockedVersion })
-        : yield* Effect.gen(function* () {
-            const fs = yield* FileSystem.FileSystem;
-            const path = yield* Path.Path;
-            const expectedPath = path.join(ws.layout.scope === "project"
-                ? ws.layout.authoredRoot("mcp-server")
-                : path.join(ws.layout.acquiredRoot, ref.owner, "mcps"), ref.name);
-            if (ref.scope !== ws.scope ||
-                path.resolve(ref.location) !== path.resolve(expectedPath)) {
-                return yield* new McpWorkspacePackageInvalid({
-                    serverName: ref.server.name,
-                    location: ref.location,
-                    fault: "outside-workspace",
-                });
-            }
-            const exists = yield* fs.exists(ref.location).pipe(Effect.mapError((error) => new McpWorkspacePackageInvalid({
-                serverName: ref.server.name,
-                location: ref.location,
-                fault: "unreadable",
-                cause: error,
-            })));
-            if (!exists) {
-                return yield* new McpWorkspacePackageInvalid({
-                    serverName: ref.server.name,
-                    location: ref.location,
-                    fault: "missing",
-                });
-            }
-            return ref.location;
-        });
-    const manifest = yield* readMcpServerManifest(canonicalPath);
-    const nothingRunnable = isNothingRunnableManifest(manifest);
-    const secretNames = Option.match(manifest, {
-        onNone: () => new Set(),
-        onSome: collectSecretInputNames,
-    });
-    if (ref.refType === "registry") {
-        yield* validateExactResolvedVersion(`mcpServers.${ref.server.name}.resolvedVersion`, ref.version);
-    }
-    const lockEntry = ref.refType === "registry"
-        ? buildLockEntry(ref, yield* computeMaterializedTreeIntegrity(canonicalPath))
-        : undefined;
-    const currentMcpServers = yield* ws.getConfiguredMcpServerEntries();
-    const currentEntry = currentMcpServers[localName];
-    const secretIdentity = {
-        scopeRoot: path.resolve(ws.baseDir),
-        localName,
-        sourceIdentity,
-    };
-    const storedSecrets = yield* loadStoredMcpSecrets(secretIdentity, secretNames);
-    const mergedEnv = { ...storedSecrets, ...(currentEntry?.env ?? {}), ...env };
-    // Under --non-interactive there is nobody to prompt, so a required input
-    // that nothing supplied would otherwise install a server that cannot start.
-    // Fail with the exact recipe instead.
-    const requiredInputNames = Option.match(manifest, {
-        onNone: () => new Set(),
-        onSome: collectRequiredInputNames,
-    });
-    const missingInputs = [...requiredInputNames]
-        .filter((name) => mergedEnv[name] === undefined || mergedEnv[name] === "")
-        .sort((left, right) => left.localeCompare(right));
-    if (missingInputs.length > 0 && op.args.nonInteractive) {
-        return yield* new McpRequiredInputsMissing({ localName, inputNames: missingInputs });
-    }
-    const persistedEnv = redactSettingsEnv(mergedEnv, secretNames);
-    const enabled = currentEntry?.enabled ?? true;
-    const settingsEntry = {
-        kind: "sourced",
-        source: ref.refType === "workspace" ? "workspace" : printSourceParams(ref.source),
-        env: persistedEnv,
-        enabled,
-    };
-    const writeEffect = op.args.skipStateWrites === true
-        ? Effect.void
-        : Option.getOrElse(op.args.skipSettings, () => false)
-            ? lockEntry === undefined
-                ? Effect.void
-                : ws.setMcpServerLock({
-                    name: resolutionKey ?? ref.server.name,
-                    resolutionKey: resolutionKey ?? ref.server.name,
-                    lockEntry,
-                    versionRange: Option.none(),
-                })
-            : lockEntry === undefined
-                ? ws.setMcpServerEntry(localName, {
-                    ...settingsEntry,
-                })
-                : ws.setMcpServer({
-                    name: localName,
-                    resolutionKey: resolutionKey ?? localName,
-                    lockEntry,
-                    versionRange: op.args.versionRange,
-                    env: persistedEnv,
-                    enabled,
-                });
-    yield* writeEffect;
-    const projectionNames = ref.refType === "registry" && lockedVersion !== undefined && lockedVersion !== ref.version
-        ? [...new Set([...(existingClosure?.localNames ?? []), localName])].sort()
-        : [localName];
-    const agentSyncResults = yield* Effect.forEach(projectionNames, (projectionName) => Effect.gen(function* () {
-        const projectionEntry = projectionName === localName ? settingsEntry : currentMcpServers[projectionName];
-        if (projectionEntry === undefined || projectionEntry.kind === "inline") {
-            return undefined;
-        }
-        const projectionSecretIdentity = {
-            scopeRoot: path.resolve(ws.baseDir),
-            localName: projectionName,
-            sourceIdentity,
-        };
-        const projectionStoredSecrets = yield* loadStoredMcpSecrets(projectionSecretIdentity, secretNames);
-        const projectionEnv = projectionName === localName
-            ? mergedEnv
-            : { ...projectionStoredSecrets, ...projectionEntry.env };
-        return yield* syncConfiguredAgentsOnInstall({
-            wsBaseDir: ws.baseDir,
-            scope: ws.scope,
-            strict: strictAgentSync,
-            serverName: projectionName,
-            canonicalPath,
-            owner: ref.owner,
-            resolvedVersion: ref.version,
-            nothingRunnable,
-            enabled: projectionEntry.enabled,
-            configValues: preserveSecretReferences(projectionEnv, secretNames),
-            entry: projectionEntry,
-        });
-    }), { concurrency: 1 });
-    const agentSyncSummaries = agentSyncResults.filter((summary) => summary !== undefined);
-    const agentSync = {
-        status: agentSyncSummaries.some((summary) => summary.status === "degraded")
-            ? "degraded"
-            : "green",
-        details: agentSyncSummaries.flatMap((summary) => summary.details),
-        warnings: agentSyncSummaries.flatMap((summary) => summary.warnings),
-        outcomes: agentSyncSummaries.flatMap((summary) => summary.outcomes),
-    };
-    const secretPersistence = yield* persistMcpSecrets(secretIdentity, secretNames, mergedEnv);
-    const secretWarnings = secretPersistence.flatMap((outcome) => outcome._tag === "failed"
-        ? [
-            `${outcome.inputName} could not be saved to the system keychain; AXM state was applied and credential action is required`,
-        ]
-        : []);
-    const warnings = [...secretWarnings, ...agentSync.warnings];
-    const change = currentEntry === undefined ? "created" : "updated";
-    const agentOutcomes = agentSync.outcomes.flatMap(({ agentId, outcome }) => outcome._tag === "success" || outcome._tag === "fallback"
-        ? [
-            {
-                agentId,
-                ...(outcome.targets === undefined ? {} : { targets: outcome.targets }),
-            },
-        ]
-        : []);
-    return {
-        result: "success",
-        message: appendWarningsToMessage(`Installed ${localName} from ${ref.owner}/mcps/${ref.server.name} (canonical=success, agent-sync=${agentSync.status})`, warnings),
-        artifact: mcpServerArtifact({
-            lockEntry,
-            scope: ws.scope,
-            change,
-            agents: agentOutcomes.map(({ agentId }) => agentId),
-            targets: [
-                ...(lockEntry === undefined ? [] : [mcpSourceTarget(ws.scope, lockEntry, change)]),
-                mcpSettingsTarget(ws.scope, change),
-                ...agentConfigTargets(agentOutcomes),
-            ],
-        }),
-    };
-});
-//# sourceMappingURL=install-operation.js.map