@ai-plugin-marketplace/core 0.1.0 → 0.3.0

package/dist/pipeline/discover.js

@@ -1,70 +1,91 @@
 /**
  * Plugin discovery: resolve a `targetPath` (plugin dir or repo root) to the list of plugin
- * directories to operate on plus the `dist/` output root. Shared by the build (§5.2) and
+ * directories to operate on plus the dist output root. Shared by the build (§5.2) and
  * validate (§5.3) orchestrators so they detect topology identically.
  *
  * Detection rules (§8.1 "Why one build signature"):
- * - **Repo root** — `targetPath` contains a `plugins/` directory. Every immediate subdirectory
- *   of `plugins/` that contains an `aipm.config.ts` is a plugin; `dist/` sits at `<root>/dist`.
+ * - **Repo root** — `targetPath` contains the configured plugins root (default `plugins/`), or an
+ *   `aipm.repo.ts`. Every immediate subdirectory of the plugins root that contains an
+ *   `aipm.config.ts` is a plugin; generated bundles sit at the configured dist root
+ *   (default `<root>/dist`).
  * - **Single plugin** — otherwise `targetPath` is treated as a single plugin directory. The repo
- *   root is the plugin's grandparent (`repoRoot = dirname(dirname(pluginDir))`) and `dist/` sits
- *   there. A missing `aipm.config.ts` is **not** a discovery error: it is deferred to the
- *   config loader so the validate orchestrator can report it as an `envelope-invalid` finding
- *   (§10.1 step 1) and the build orchestrator can throw a descriptive error.
+ *   root is the plugin's grandparent (`repoRoot = dirname(dirname(pluginDir))`) and the dist root
+ *   is resolved from that repo root's config. A missing `aipm.config.ts` is **not** a discovery
+ *   error: it is deferred to the config loader so the validate orchestrator can report it as an
+ *   `envelope-invalid` finding (§10.1 step 1) and the build orchestrator can throw a descriptive
+ *   error.
  *
  * Repo-root detection is tried first so a real repo root is never misread as a single plugin.
  *
+ * The plugins root and dist root are read from an optional `aipm.repo.ts` at the repo root
+ * (embedded-marketplace support). Absent that file, they default to `plugins/` and `dist/`, so a
+ * repo with no repo config behaves exactly as before.
+ *
  * @see docs/specs/architecture.md §8.1, §3.2 (repository topology), §10.1 (validation order)
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { AIPM_CONFIG_FILENAME } from './load-config.js';
+import { AIPM_CONFIG_FILENAME, hasRepoConfig, loadRepoConfig } from './load-config.js';
 /** True iff `dir` contains an `aipm.config.ts`. */
 function hasConfig(dir) {
     return fs.existsSync(path.join(dir, AIPM_CONFIG_FILENAME));
 }
+/** True iff `dir` exists and is a directory. */
+function isDirectory(dir) {
+    return fs.existsSync(dir) && fs.statSync(dir).isDirectory();
+}
 /**
- * Resolve `targetPath` to the plugins to build/validate and the `dist/` root.
+ * Resolve `targetPath` to the plugins to build/validate and the dist root.
  *
  * @param targetPath - Absolute path to a single plugin directory or a repo root.
  * @returns The resolved discovery.
- * @throws {Error} If `targetPath` is neither a plugin directory nor a repo root with a
- *   `plugins/` directory.
+ * @throws {Error} If `targetPath` does not exist.
+ * @throws {ConfigLoadError} If a present `aipm.repo.ts` cannot be imported or fails validation.
  */
-export function discoverPlugins(targetPath) {
+export async function discoverPlugins(targetPath) {
     const resolved = path.resolve(targetPath);
     if (!fs.existsSync(resolved)) {
         throw new Error(`Path '${targetPath}' does not exist.`);
     }
     // ── Repo-root input (tried first) ─────────────────────────────────────────
-    // A path is a repo root when it does NOT itself carry a config but does contain a `plugins/`
-    // directory. (A plugin directory that happens to contain a `plugins/` subfolder is vanishingly
-    // unlikely and would be a layout error; carrying its own config disambiguates it as a plugin.)
-    const pluginsDir = path.join(resolved, 'plugins');
-    if (!hasConfig(resolved) && fs.existsSync(pluginsDir) && fs.statSync(pluginsDir).isDirectory()) {
-        const pluginDirs = [];
-        for (const entry of fs.readdirSync(pluginsDir, { withFileTypes: true })) {
-            if (!entry.isDirectory())
-                continue;
-            const candidate = path.join(pluginsDir, entry.name);
-            if (hasConfig(candidate)) {
-                pluginDirs.push(candidate);
+    // A path is a repo root when it does NOT itself carry a plugin config but either declares an
+    // `aipm.repo.ts` or contains the configured plugins root. (A plugin directory that happens to
+    // contain a `plugins/` subfolder is vanishingly unlikely and would be a layout error; carrying
+    // its own `aipm.config.ts` disambiguates it as a plugin.)
+    if (!hasConfig(resolved)) {
+        const repoConfig = await loadRepoConfig(resolved);
+        const pluginsDir = path.join(resolved, repoConfig.pluginsRoot);
+        // An explicit `aipm.repo.ts` marks a repo root even before its plugins dir exists, so a
+        // freshly-initialised embedded repo still resolves as a repo root rather than a single plugin.
+        if (hasRepoConfig(resolved) || isDirectory(pluginsDir)) {
+            const pluginDirs = [];
+            if (isDirectory(pluginsDir)) {
+                for (const entry of fs.readdirSync(pluginsDir, { withFileTypes: true })) {
+                    if (!entry.isDirectory())
+                        continue;
+                    const candidate = path.join(pluginsDir, entry.name);
+                    if (hasConfig(candidate)) {
+                        pluginDirs.push(candidate);
+                    }
+                }
+                pluginDirs.sort();
             }
+            return {
+                repoRoot: resolved,
+                distDir: path.join(resolved, repoConfig.distDir),
+                pluginDirs,
+            };
         }
-        pluginDirs.sort();
-        return {
-            repoRoot: resolved,
-            distDir: path.join(resolved, 'dist'),
-            pluginDirs,
-        };
     }
     // ── Single-plugin input ───────────────────────────────────────────────────
     // Whether or not it carries a config: a missing config is deferred to the loader so validate
-    // can emit `envelope-invalid` and build can throw a descriptive error (§10.1 step 1).
+    // can emit `envelope-invalid` and build can throw a descriptive error (§10.1 step 1). The dist
+    // root is resolved from the repo root's config so a relocated dist root is still honored.
     const grandparent = path.dirname(path.dirname(resolved));
+    const repoConfig = await loadRepoConfig(grandparent);
     return {
         repoRoot: grandparent,
-        distDir: path.join(grandparent, 'dist'),
+        distDir: path.join(grandparent, repoConfig.distDir),
         pluginDirs: [resolved],
     };
 }

package/dist/pipeline/discover.js.map

@@ -1 +1 @@
-{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../src/pipeline/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAYxD,mDAAmD;AACnD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,SAAS,UAAU,mBAAmB,CAAC,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/F,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,UAAU,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;YACpC,UAAU;SACX,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,6FAA6F;IAC7F,sFAAsF;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;QACvC,UAAU,EAAE,CAAC,QAAQ,CAAC;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../src/pipeline/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAYvF,mDAAmD;AACnD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,gDAAgD;AAChD,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,SAAS,UAAU,mBAAmB,CAAC,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,6FAA6F;IAC7F,8FAA8F;IAC9F,+FAA+F;IAC/F,0DAA0D;IAC1D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAC/D,wFAAwF;QACxF,+FAA+F;QAC/F,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;oBACxE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;wBAAE,SAAS;oBACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBACpD,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;wBACzB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;gBACD,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;gBAChD,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6FAA6F;IAC7F,+FAA+F;IAC/F,0FAA0F;IAC1F,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,CAAC;KACvB,CAAC;AACJ,CAAC"}

package/dist/pipeline/init-template.d.ts

@@ -21,13 +21,24 @@ export interface InitFile {
     /** Full file contents, including a trailing newline. */
     content: string;
 }
+/**
+ * Toolkit-owned **scaffold** files that `aipm init --refresh` keeps in sync with the installed
+ * tooling: the CI workflow and `.gitignore`. These are pure tooling recipes — their content is
+ * independent of the repo name and the pinned toolkit version, so refresh can re-render them with
+ * no inputs and compare byte-for-byte. (Files with repo identity or user content — `package.json`,
+ * `aipm.workspace.ts`, `README.md`, plugins, `aipm build` output — are deliberately NOT here.)
+ *
+ * Output is deterministic and stably ordered.
+ */
+export declare function buildManagedScaffoldFiles(): InitFile[];
 /**
  * Build the complete, deterministic seed file set for a consumer repo named `name`, pinning the
- * `@ai-plugin-marketplace/cli` dev dependency to `^${toolkitVersion}`.
+ * `cli`/`core` dev dependencies to carets of `cliVersion`/`coreVersion` respectively.
  *
- * The set mirrors §3.2: `package.json`, `.gitignore`, `README.md`, both repo-root marketplace
- * registries, an empty `plugins/` (seeded with `.gitkeep` so the directory is tracked), and the
- * CI workflow. Output is a pure function of the two inputs — stable ordering, no timestamps.
+ * The set mirrors §3.2: `package.json`, the {@link buildManagedScaffoldFiles managed scaffold
+ * files} (`.gitignore`, CI workflow), `README.md`, both repo-root marketplace registries, and an
+ * empty `plugins/` (seeded with `.gitkeep` so the directory is tracked). Output is a pure function
+ * of the inputs — stable ordering, no timestamps.
  */
-export declare function buildInitFiles(name: string, toolkitVersion: string): InitFile[];
+export declare function buildInitFiles(name: string, cliVersion: string, coreVersion: string): InitFile[];
 //# sourceMappingURL=init-template.d.ts.map

package/dist/pipeline/init-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-template.d.ts","sourceRoot":"","sources":["../../src/pipeline/init-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,gGAAgG;AAChG,MAAM,WAAW,QAAQ;IACvB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB;AA8GD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,QAAQ,EAAE,CAU/E"}
+{"version":3,"file":"init-template.d.ts","sourceRoot":"","sources":["../../src/pipeline/init-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAaH,gGAAgG;AAChG,MAAM,WAAW,QAAQ;IACvB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB;AAqID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,QAAQ,EAAE,CAKtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,QAAQ,EAAE,CAShG"}

package/dist/pipeline/init-template.js

@@ -17,33 +17,40 @@
 const json = String.raw;
 const md = String.raw;
 const yaml = String.raw;
+/**
+ * pnpm version pinned in the generated `package.json#packageManager`. The CI workflow reads the
+ * pnpm version from this field (it runs `pnpm/action-setup` without a hard-coded version), so the
+ * two stay in sync. Bumped deliberately when the recommended pnpm baseline moves.
+ */
+const PACKAGE_MANAGER = 'pnpm@10.30.3';
 /**
  * The `package.json` for a generated consumer repo.
  *
  * - `private: true` — a plugin repo is never published to npm; only its plugins ship to registries.
  * - `type: 'module'` — the toolkit is ESM-only (§8.1), and `aipm.config.ts` files are ESM.
+ * - `packageManager` pins pnpm; the CI workflow reads the pnpm version from here.
  * - `scripts` call `aipm` directly (it is on PATH via the dev dependency's bin).
- * - The `@ai-plugin-marketplace/cli` dev dependency is pinned to `^<toolkitVersion>` so authors
- *   upgrade the whole toolkit in lockstep via `pnpm up` (§9.1 lockstep release, §11 contract).
+ * - `cli` provides the `aipm` binary; `core` provides `defineConfig`/`defineWorkspace` for each
+ *   plugin's `aipm.config.ts` (§6.1). They ship independently and may differ (`cli 0.1.1` ships
+ *   with `core 0.2.0`), so each is pinned to a caret of its own version; authors upgrade both via
+ *   `pnpm up` (§11 contract).
  *
  * Emitted as 2-space JSON with a trailing newline to match the repo's formatting conventions.
  */
-function renderPackageJson(name, toolkitVersion) {
+function renderPackageJson(name, cliVersion, coreVersion) {
     const pkg = {
         name,
         private: true,
         type: 'module',
+        packageManager: PACKAGE_MANAGER,
         scripts: {
             build: 'aipm build',
             check: 'aipm validate',
             scaffold: 'aipm scaffold',
         },
         devDependencies: {
-            // cli provides the `aipm` binary; core provides `defineConfig` for each
-            // plugin's `aipm.config.ts` import (§6.1). Both pinned to the same toolkit
-            // version and upgraded together via `pnpm up`.
-            '@ai-plugin-marketplace/cli': `^${toolkitVersion}`,
-            '@ai-plugin-marketplace/core': `^${toolkitVersion}`,
+            '@ai-plugin-marketplace/cli': `^${cliVersion}`,
+            '@ai-plugin-marketplace/core': `^${coreVersion}`,
         },
     };
     return `${JSON.stringify(pkg, null, 2)}\n`;
@@ -95,21 +102,43 @@ function renderCiWorkflow() {
 
 on:
   push:
+    branches: [main]
   pull_request:
+    branches: [main]
 
 jobs:
-  build-and-validate:
+  CI:
     runs-on: ubuntu-latest
+    env:
+      CI: "true"
     steps:
       - uses: actions/checkout@v4
+
       - uses: pnpm/action-setup@v4
+        # version is read from package.json#packageManager — do not duplicate here
+
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm exec aipm build
-      - run: pnpm exec aipm validate
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build plugins
+        run: pnpm exec aipm build
+
+      - name: Verify the tree is clean after build (freshness)
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "::error::Working tree is dirty after 'aipm build'. Run 'aipm build' locally and commit the regenerated artifacts."
+            git status --porcelain
+            git --no-pager diff
+            exit 1
+          fi
+
+      - name: Validate plugins
+        run: pnpm exec aipm validate
 `;
 }
 /** `.gitignore` for a consumer repo: dependencies, build intermediates, OS/local cruft. */
@@ -121,22 +150,37 @@ function renderGitignore() {
 `;
 }
 /**
- * Build the complete, deterministic seed file set for a consumer repo named `name`, pinning the
- * `@ai-plugin-marketplace/cli` dev dependency to `^${toolkitVersion}`.
+ * Toolkit-owned **scaffold** files that `aipm init --refresh` keeps in sync with the installed
+ * tooling: the CI workflow and `.gitignore`. These are pure tooling recipes — their content is
+ * independent of the repo name and the pinned toolkit version, so refresh can re-render them with
+ * no inputs and compare byte-for-byte. (Files with repo identity or user content — `package.json`,
+ * `aipm.workspace.ts`, `README.md`, plugins, `aipm build` output — are deliberately NOT here.)
  *
- * The set mirrors §3.2: `package.json`, `.gitignore`, `README.md`, both repo-root marketplace
- * registries, an empty `plugins/` (seeded with `.gitkeep` so the directory is tracked), and the
- * CI workflow. Output is a pure function of the two inputs — stable ordering, no timestamps.
+ * Output is deterministic and stably ordered.
  */
-export function buildInitFiles(name, toolkitVersion) {
+export function buildManagedScaffoldFiles() {
     return [
-        { path: 'package.json', content: renderPackageJson(name, toolkitVersion) },
         { path: '.gitignore', content: renderGitignore() },
+        { path: '.github/workflows/ci.yml', content: renderCiWorkflow() },
+    ];
+}
+/**
+ * Build the complete, deterministic seed file set for a consumer repo named `name`, pinning the
+ * `cli`/`core` dev dependencies to carets of `cliVersion`/`coreVersion` respectively.
+ *
+ * The set mirrors §3.2: `package.json`, the {@link buildManagedScaffoldFiles managed scaffold
+ * files} (`.gitignore`, CI workflow), `README.md`, both repo-root marketplace registries, and an
+ * empty `plugins/` (seeded with `.gitkeep` so the directory is tracked). Output is a pure function
+ * of the inputs — stable ordering, no timestamps.
+ */
+export function buildInitFiles(name, cliVersion, coreVersion) {
+    return [
+        { path: 'package.json', content: renderPackageJson(name, cliVersion, coreVersion) },
         { path: 'README.md', content: renderReadme(name) },
         { path: '.claude-plugin/marketplace.json', content: renderEmptyMarketplace() },
         { path: '.cursor-plugin/marketplace.json', content: renderEmptyMarketplace() },
         { path: 'plugins/.gitkeep', content: '' },
-        { path: '.github/workflows/ci.yml', content: renderCiWorkflow() },
+        ...buildManagedScaffoldFiles(),
     ];
 }
 //# sourceMappingURL=init-template.js.map

package/dist/pipeline/init-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-template.js","sourceRoot":"","sources":["../../src/pipeline/init-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;AACxB,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;AACtB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;AAUxB;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,cAAsB;IAC7D,MAAM,GAAG,GAAG;QACV,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,eAAe;SAC1B;QACD,eAAe,EAAE;YACf,wEAAwE;YACxE,2EAA2E;YAC3E,+CAA+C;YAC/C,4BAA4B,EAAE,IAAI,cAAc,EAAE;YAClD,6BAA6B,EAAE,IAAI,cAAc,EAAE;SACpD;KACF,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB;IAC7B,OAAO,IAAI,CAAA;;;CAGZ,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,CAAA,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBnB,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAA;;;;;;;;;;;;;;;;;;;CAmBZ,CAAC;AACF,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe;IACtB,OAAO;;;;CAIR,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,cAAsB;IACjE,OAAO;QACL,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE;QAC1E,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE;QAClD,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;QAClD,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE;KAClE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"init-template.js","sourceRoot":"","sources":["../../src/pipeline/init-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;AACxB,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;AACtB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;AAExB;;;;GAIG;AACH,MAAM,eAAe,GAAG,cAAc,CAAC;AAUvC;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,UAAkB,EAAE,WAAmB;IAC9E,MAAM,GAAG,GAAG;QACV,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;QACd,cAAc,EAAE,eAAe;QAC/B,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,eAAe;SAC1B;QACD,eAAe,EAAE;YACf,4BAA4B,EAAE,IAAI,UAAU,EAAE;YAC9C,6BAA6B,EAAE,IAAI,WAAW,EAAE;SACjD;KACF,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB;IAC7B,OAAO,IAAI,CAAA;;;CAGZ,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,CAAA,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBnB,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCZ,CAAC;AACF,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe;IACtB,OAAO;;;;CAIR,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE;QAClD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE;KAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAkB,EAAE,WAAmB;IAClF,OAAO;QACL,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;QACnF,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;QAClD,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,GAAG,yBAAyB,EAAE;KAC/B,CAAC;AACJ,CAAC"}

package/dist/pipeline/init.d.ts

@@ -4,35 +4,38 @@
  *
  * This is the filesystem-writing orchestrator behind the public `init` operation and the
  * `aipm init [dir]` CLI surface. The generated file *contents* live in `init-template.ts`; this
- * module is the I/O boundary: it resolves the toolkit version to pin, refuses to clobber a
- * non-empty target, and writes the seed tree.
+ * module is the I/O boundary: it resolves the versions to pin, refuses to clobber a non-empty
+ * target, writes the seed tree, and seeds the `.aipm/scaffold.json` refresh sidecar.
  *
- * **Version pinning (§9.1 lockstep release).** core and cli ship in lockstep, so the `cli` dev
- * dependency is pinned to a caret of core's *own* version — read at runtime from this package's
- * `package.json`, resolved relative to {@link import.meta.url} exactly as `load-config.ts` resolves
- * the package entrypoint. Today that yields `^0.1.0-alpha.0`; once 0.1.0 ships, an `init` run from
- * the published cli pins `^0.1.0`.
+ * **Version pinning.** `cli` and `core` ship independently and may differ (e.g. `cli 0.1.1` ships
+ * with `core 0.2.0`), so the generated `package.json` pins each to a caret of its *own* version.
+ * `core`'s version is read at runtime from this package's `package.json` (resolved relative to
+ * {@link import.meta.url}, exactly as `load-config.ts` resolves the package entrypoint); `cli`'s
+ * version is supplied by the cli entrypoint via {@link InitOptions.cliVersion} (it reads its own
+ * `package.json`). When `cliVersion` is omitted, it falls back to core's version.
  *
  * @see docs/specs/architecture.md §3.2 (template repo contents)
- * @see docs/specs/architecture.md §9.1 (lockstep release lines)
  * @see docs/specs/architecture.md §11 (template→toolkit dependency contract)
+ * @see docs/specs/scaffold-refresh-and-upgrade.md (`aipm init --refresh`)
  */
 import type { InitOptions } from './types.js';
 /**
  * Scaffold a thin consumer repo at `targetDir` (§3.2).
  *
- * Writes `package.json` (with the `@ai-plugin-marketplace/cli` dev dependency pinned to a caret of
- * the current toolkit version), `.gitignore`, `README.md`, both repo-root marketplace registries
- * (`{ "plugins": [] }`), an empty `plugins/` (tracked via `.gitkeep`), and a CI workflow that runs
- * `aipm build` then `aipm validate` (§10.5 freshness). The repo name defaults to
- * `basename(targetDir)`; override it with `opts.name`.
+ * Writes `package.json` (with `cli`/`core` dev dependencies pinned to carets of their respective
+ * versions), `.gitignore`, `README.md`, both repo-root marketplace registries (`{ "plugins": [] }`),
+ * an empty `plugins/` (tracked via `.gitkeep`), and a CI workflow that runs `aipm build` then
+ * `aipm validate` (§10.5 freshness). It also seeds `.aipm/scaffold.json` so a later
+ * `aipm init --refresh` can tell pristine toolkit-owned files from user edits. The repo name
+ * defaults to `basename(targetDir)`; override it with `opts.name`.
  *
  * **Refuses to clobber.** If `targetDir` exists and is a non-empty directory (or exists as a
  * non-directory), the function throws and writes nothing. Creating into a fresh or empty directory
  * is fine.
  *
  * @param targetDir - Absolute or relative path to the directory to scaffold into.
- * @param opts - Init options; `name` overrides the derived repo name.
+ * @param opts - Init options; `name` overrides the derived repo name, `cliVersion` the pinned cli
+ *   dependency version (defaults to core's version).
  * @throws {Error} When `targetDir` exists and is non-empty (or is not a directory).
  */
 export declare function runInit(targetDir: string, opts?: InitOptions): Promise<void>;

package/dist/pipeline/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/pipeline/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA6B9C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBtF"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/pipeline/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA6B9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BtF"}

package/dist/pipeline/init.js

@@ -4,23 +4,25 @@
  *
  * This is the filesystem-writing orchestrator behind the public `init` operation and the
  * `aipm init [dir]` CLI surface. The generated file *contents* live in `init-template.ts`; this
- * module is the I/O boundary: it resolves the toolkit version to pin, refuses to clobber a
- * non-empty target, and writes the seed tree.
+ * module is the I/O boundary: it resolves the versions to pin, refuses to clobber a non-empty
+ * target, writes the seed tree, and seeds the `.aipm/scaffold.json` refresh sidecar.
  *
- * **Version pinning (§9.1 lockstep release).** core and cli ship in lockstep, so the `cli` dev
- * dependency is pinned to a caret of core's *own* version — read at runtime from this package's
- * `package.json`, resolved relative to {@link import.meta.url} exactly as `load-config.ts` resolves
- * the package entrypoint. Today that yields `^0.1.0-alpha.0`; once 0.1.0 ships, an `init` run from
- * the published cli pins `^0.1.0`.
+ * **Version pinning.** `cli` and `core` ship independently and may differ (e.g. `cli 0.1.1` ships
+ * with `core 0.2.0`), so the generated `package.json` pins each to a caret of its *own* version.
+ * `core`'s version is read at runtime from this package's `package.json` (resolved relative to
+ * {@link import.meta.url}, exactly as `load-config.ts` resolves the package entrypoint); `cli`'s
+ * version is supplied by the cli entrypoint via {@link InitOptions.cliVersion} (it reads its own
+ * `package.json`). When `cliVersion` is omitted, it falls back to core's version.
  *
  * @see docs/specs/architecture.md §3.2 (template repo contents)
- * @see docs/specs/architecture.md §9.1 (lockstep release lines)
  * @see docs/specs/architecture.md §11 (template→toolkit dependency contract)
+ * @see docs/specs/scaffold-refresh-and-upgrade.md (`aipm init --refresh`)
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { buildInitFiles } from './init-template.js';
+import { writeScaffoldSidecar } from './scaffold-refresh.js';
 /**
  * Read this package's `package.json#version`, resolved relative to this module's location.
  *
@@ -51,18 +53,20 @@ function isFreshTarget(dir) {
 /**
  * Scaffold a thin consumer repo at `targetDir` (§3.2).
  *
- * Writes `package.json` (with the `@ai-plugin-marketplace/cli` dev dependency pinned to a caret of
- * the current toolkit version), `.gitignore`, `README.md`, both repo-root marketplace registries
- * (`{ "plugins": [] }`), an empty `plugins/` (tracked via `.gitkeep`), and a CI workflow that runs
- * `aipm build` then `aipm validate` (§10.5 freshness). The repo name defaults to
- * `basename(targetDir)`; override it with `opts.name`.
+ * Writes `package.json` (with `cli`/`core` dev dependencies pinned to carets of their respective
+ * versions), `.gitignore`, `README.md`, both repo-root marketplace registries (`{ "plugins": [] }`),
+ * an empty `plugins/` (tracked via `.gitkeep`), and a CI workflow that runs `aipm build` then
+ * `aipm validate` (§10.5 freshness). It also seeds `.aipm/scaffold.json` so a later
+ * `aipm init --refresh` can tell pristine toolkit-owned files from user edits. The repo name
+ * defaults to `basename(targetDir)`; override it with `opts.name`.
  *
  * **Refuses to clobber.** If `targetDir` exists and is a non-empty directory (or exists as a
  * non-directory), the function throws and writes nothing. Creating into a fresh or empty directory
  * is fine.
  *
  * @param targetDir - Absolute or relative path to the directory to scaffold into.
- * @param opts - Init options; `name` overrides the derived repo name.
+ * @param opts - Init options; `name` overrides the derived repo name, `cliVersion` the pinned cli
+ *   dependency version (defaults to core's version).
  * @throws {Error} When `targetDir` exists and is non-empty (or is not a directory).
  */
 export async function runInit(targetDir, opts = {}) {
@@ -72,13 +76,17 @@ export async function runInit(targetDir, opts = {}) {
             'Choose a new path or an empty directory.');
     }
     const name = opts.name ?? path.basename(resolved);
-    const files = buildInitFiles(name, coreVersion());
+    const core = coreVersion();
+    const cli = opts.cliVersion ?? core;
+    const files = buildInitFiles(name, cli, core);
     fs.mkdirSync(resolved, { recursive: true });
     for (const file of files) {
         const full = path.join(resolved, file.path);
         fs.mkdirSync(path.dirname(full), { recursive: true });
         fs.writeFileSync(full, file.content, 'utf-8');
     }
+    // Seed the refresh sidecar so `aipm init --refresh` has a baseline of toolkit-owned content.
+    writeScaffoldSidecar(resolved);
     return Promise.resolve();
 }
 //# sourceMappingURL=init.js.map

package/dist/pipeline/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/pipeline/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD;;;;;;;GAOG;AACH,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAwB,CAAC;IACjF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,OAAoB,EAAE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,oDAAoD;YACxF,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAElD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/pipeline/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D;;;;;;;GAOG;AACH,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAwB,CAAC;IACjF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,OAAoB,EAAE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,oDAAoD;YACxF,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAE9C,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,6FAA6F;IAC7F,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/pipeline/load-config.d.ts

@@ -18,7 +18,7 @@
  * @see docs/specs/architecture.md §6.1 (envelope declaration), P6 (TypeScript end-to-end)
  * @see docs/specs/architecture.md §5.2, §5.3 (build/validate consume the loaded envelope)
  */
-import type { AipmConfig } from '../config.js';
+import type { AipmConfig, AipmWorkspace } from '../config.js';
 /** The canonical config filename every plugin must provide (§6.1). */
 export declare const AIPM_CONFIG_FILENAME = "aipm.config.ts";
 /**
@@ -31,6 +31,21 @@ export declare class ConfigLoadError extends Error {
         cause?: unknown;
     });
 }
+/**
+ * A per-invocation memo of loaded plugin configs, keyed by absolute plugin directory. Created
+ * fresh by an orchestrator (`runBuild`/`runValidate`) and threaded through the helpers it calls,
+ * so a single invocation transpiles each `aipm.config.ts` **once** instead of repeatedly (the
+ * build loop, registry collection, and post-build validate would otherwise each reload every
+ * config — an expensive jiti transpile with module/fs caching disabled).
+ *
+ * Intentionally **per-invocation, not a module-level cache**: configs are static within one CLI
+ * run but may change between runs (and tests overwrite-and-reload across invocations), so a
+ * longer-lived cache would risk serving stale parses. Each `createConfigCache()` lives only for
+ * the orchestrator call that created it.
+ */
+export type ConfigCache = Map<string, AipmConfig>;
+/** Create an empty {@link ConfigCache} for a single orchestrator invocation. */
+export declare function createConfigCache(): ConfigCache;
 /**
  * Load and validate a plugin's `aipm.config.ts`, returning the branded {@link AipmConfig}.
  *
@@ -39,9 +54,54 @@ export declare class ConfigLoadError extends Error {
  * `defineConfig` in their source (e.g. exported a plain object literal).
  *
  * @param pluginDir - Absolute path to the `plugins/<name>/` directory.
+ * @param cache - Optional per-invocation memo (see {@link ConfigCache}). When supplied, a config
+ *   already loaded in this invocation is returned without re-transpiling.
  * @returns The validated, branded config.
  * @throws {ConfigLoadError} If the file is absent, fails to import, has no default export, or
  *   the default export fails schema validation.
  */
-export declare function loadPluginConfig(pluginDir: string): Promise<AipmConfig>;
+export declare function loadPluginConfig(pluginDir: string, cache?: ConfigCache): Promise<AipmConfig>;
+/**
+ * Resolved repo-level configuration: the plugins/dist roots after defaults are applied. These are
+ * repo-root-relative directory names that {@link discoverPlugins} joins onto the repo root.
+ */
+export interface ResolvedRepoConfig {
+    /** Directory (relative to the repo root) holding plugin folders. Default: `'plugins'`. */
+    pluginsRoot: string;
+    /** Directory (relative to the repo root) for generated dist bundles. Default: `'dist'`. */
+    distDir: string;
+}
+/** The resolved config used when no `aipm.repo.ts` is present — i.e. the historical topology. */
+export declare const DEFAULT_REPO_CONFIG: ResolvedRepoConfig;
+/** True iff `repoRoot` contains an `aipm.repo.ts`. */
+export declare function hasRepoConfig(repoRoot: string): boolean;
+/**
+ * Load the optional `aipm.repo.ts` at `repoRoot`, returning the resolved plugins/dist roots.
+ *
+ * When the file is **absent**, returns {@link DEFAULT_REPO_CONFIG} — so a repo with no repo
+ * config is byte-identical to the historical behavior. When **present**, the module's `default`
+ * export is re-validated through `defineRepoConfig` (applying defaults, rejecting absolute/`..`
+ * paths and unknown keys).
+ *
+ * @param repoRoot - Absolute path to the repo root.
+ * @returns The resolved repo config.
+ * @throws {ConfigLoadError} If the file exists but cannot be imported or fails validation.
+ */
+export declare function loadRepoConfig(repoRoot: string): Promise<ResolvedRepoConfig>;
+/** True iff `repoRoot` contains an `aipm.workspace.ts` (i.e. registry generation is opted in). */
+export declare function hasWorkspaceConfig(repoRoot: string): boolean;
+/**
+ * Load the optional `aipm.workspace.ts` at `repoRoot`, returning the validated, branded
+ * {@link AipmWorkspace}.
+ *
+ * When the file is **absent**, returns `undefined` — the signal that this repo has NOT opted into
+ * registry generation (the toolkit then leaves the hand-authored registries alone). When
+ * **present**, the module's `default` export is re-validated through `defineWorkspace` so the
+ * result provably passed the canonical schema.
+ *
+ * @param repoRoot - Absolute path to the repo root.
+ * @returns The validated workspace config, or `undefined` when no `aipm.workspace.ts` exists.
+ * @throws {ConfigLoadError} If the file exists but cannot be imported or fails validation.
+ */
+export declare function loadWorkspaceConfig(repoRoot: string): Promise<AipmWorkspace | undefined>;
 //# sourceMappingURL=load-config.d.ts.map

package/dist/pipeline/load-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load-config.d.ts","sourceRoot":"","sources":["../../src/pipeline/load-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,OAAO,KAAK,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAEhE,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAKrD;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA4C7E"}
+{"version":3,"file":"load-config.d.ts","sourceRoot":"","sources":["../../src/pipeline/load-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,OAAO,KAAK,EACV,UAAU,EAGV,aAAa,EAEd,MAAM,cAAc,CAAC;AAEtB,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAoBrD;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAuED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAElD,gFAAgF;AAChF,wBAAgB,iBAAiB,IAAI,WAAW,CAE/C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,UAAU,CAAC,CAyBrB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,EAAE,kBAAgE,CAAC;AAEnG,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAelF;AAED,kGAAkG;AAClG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAgB9F"}