@ai-plugin-marketplace/core 0.2.0 → 0.3.0

package/dist/core.d.ts

@@ -287,6 +287,13 @@ export declare interface InitOptions {
      * directory.
      */
     name?: string;
+    /**
+     * Version of `@ai-plugin-marketplace/cli` to pin the generated `package.json`'s `cli`
+     * dev dependency to (as `^<cliVersion>`). The cli entrypoint supplies its own version here; cli
+     * and core ship independently and may differ (e.g. `cli 0.1.1` ships with `core 0.2.0`). When
+     * omitted, falls back to core's own version (the historical lockstep assumption).
+     */
+    cliVersion?: string;
 }
 
 /**
@@ -332,6 +339,50 @@ export declare interface MigrateResult {
     filesChanged: string[];
 }
 
+/**
+ * Options for {@link refreshScaffold}.
+ *
+ * @public
+ */
+export declare interface RefreshOptions {
+    /**
+     * Overwrite toolkit-owned scaffold files even when their on-disk content has diverged from what
+     * the toolkit last wrote (i.e. the user edited them). Without this, diverged files are reported
+     * as conflicts and left untouched.
+     */
+    force?: boolean;
+}
+
+/**
+ * Per-file outcome of a {@link refreshScaffold} run. Returned (one per managed scaffold file) so
+ * the CLI can report what changed without re-deriving it.
+ *
+ * @public
+ */
+export declare interface RefreshOutcome {
+    /** Repo-relative POSIX path of the managed scaffold file. */
+    path: string;
+    /**
+     * - `updated` — content changed and was rewritten (file was pristine or `--force`).
+     * - `unchanged` — already matched the current render; nothing written.
+     * - `recreated` — file was missing and was written from the render.
+     * - `conflict` — on-disk content diverged from the recorded hash; left untouched (no `--force`).
+     * - `overwritten` — diverged but rewritten because `--force` was set.
+     */
+    status: 'updated' | 'unchanged' | 'recreated' | 'conflict' | 'overwritten';
+}
+
+/**
+ * Refresh the toolkit-owned scaffold files (CI workflow, `.gitignore`) of an existing marketplace
+ * repo at `targetDir` to match the installed tooling — the upgrade path after
+ * `pnpm up @ai-plugin-marketplace/*`. Guarded by the `.aipm/scaffold.json` content-hash sidecar:
+ * user-modified files are reported as conflicts and left untouched unless `opts.force` is set.
+ * Returns one outcome per managed file; never rejects on conflict.
+ *
+ * @public
+ */
+export declare function refreshScaffold(targetDir: string, opts?: RefreshOptions): Promise<RefreshOutcome[]>;
+
 /**
  * Scaffold a new plugin under the cwd's configured plugins root (`<cwd>/plugins/<name>` by
  * default, or the relocated `pluginsRoot` from an `aipm.repo.ts`). The plugins directory is

package/dist/index.d.ts

@@ -10,6 +10,6 @@
  */
 export { defineConfig, defineRepoConfig, defineWorkspace } from './config.js';
 export type { AipmConfig, AipmConfigInput, AipmRepoConfig, AipmRepoConfigInput, AipmWorkspace, AipmWorkspaceInput, } from './config.js';
-export { build, validate, scaffold, init, migrate, checkSupport, addTarget, listTargets, } from './pipeline/operations.js';
-export type { TargetId, BuildOptions, BuildResult, GeneratedFile, ValidateOptions, ValidationResult, Finding, FindingCode, ScaffoldOptions, InitOptions, MigrateOptions, MigrateResult, SupportReport, } from './pipeline/types.js';
+export { build, validate, scaffold, init, refreshScaffold, migrate, checkSupport, addTarget, listTargets, } from './pipeline/operations.js';
+export type { TargetId, BuildOptions, BuildResult, GeneratedFile, ValidateOptions, ValidationResult, Finding, FindingCode, ScaffoldOptions, InitOptions, RefreshOptions, RefreshOutcome, MigrateOptions, MigrateResult, SupportReport, } from './pipeline/types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9E,YAAY,EACV,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,OAAO,EACP,YAAY,EACZ,SAAS,EACT,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,WAAW,EACX,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,aAAa,GACd,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9E,YAAY,EACV,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,eAAe,EACf,OAAO,EACP,YAAY,EACZ,SAAS,EACT,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,WAAW,EACX,eAAe,EACf,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,GACd,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -9,5 +9,5 @@
  * @packageDocumentation
  */
 export { defineConfig, defineRepoConfig, defineWorkspace } from './config.js';
-export { build, validate, scaffold, init, migrate, checkSupport, addTarget, listTargets, } from './pipeline/operations.js';
+export { build, validate, scaffold, init, refreshScaffold, migrate, checkSupport, addTarget, listTargets, } from './pipeline/operations.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAU9E,OAAO,EACL,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,OAAO,EACP,YAAY,EACZ,SAAS,EACT,WAAW,GACZ,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAU9E,OAAO,EACL,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,eAAe,EACf,OAAO,EACP,YAAY,EACZ,SAAS,EACT,WAAW,GACZ,MAAM,0BAA0B,CAAC"}

package/dist/pipeline/init-template.d.ts

@@ -21,13 +21,24 @@ export interface InitFile {
     /** Full file contents, including a trailing newline. */
     content: string;
 }
+/**
+ * Toolkit-owned **scaffold** files that `aipm init --refresh` keeps in sync with the installed
+ * tooling: the CI workflow and `.gitignore`. These are pure tooling recipes — their content is
+ * independent of the repo name and the pinned toolkit version, so refresh can re-render them with
+ * no inputs and compare byte-for-byte. (Files with repo identity or user content — `package.json`,
+ * `aipm.workspace.ts`, `README.md`, plugins, `aipm build` output — are deliberately NOT here.)
+ *
+ * Output is deterministic and stably ordered.
+ */
+export declare function buildManagedScaffoldFiles(): InitFile[];
 /**
  * Build the complete, deterministic seed file set for a consumer repo named `name`, pinning the
- * `@ai-plugin-marketplace/cli` dev dependency to `^${toolkitVersion}`.
+ * `cli`/`core` dev dependencies to carets of `cliVersion`/`coreVersion` respectively.
  *
- * The set mirrors §3.2: `package.json`, `.gitignore`, `README.md`, both repo-root marketplace
- * registries, an empty `plugins/` (seeded with `.gitkeep` so the directory is tracked), and the
- * CI workflow. Output is a pure function of the two inputs — stable ordering, no timestamps.
+ * The set mirrors §3.2: `package.json`, the {@link buildManagedScaffoldFiles managed scaffold
+ * files} (`.gitignore`, CI workflow), `README.md`, both repo-root marketplace registries, and an
+ * empty `plugins/` (seeded with `.gitkeep` so the directory is tracked). Output is a pure function
+ * of the inputs — stable ordering, no timestamps.
  */
-export declare function buildInitFiles(name: string, toolkitVersion: string): InitFile[];
+export declare function buildInitFiles(name: string, cliVersion: string, coreVersion: string): InitFile[];
 //# sourceMappingURL=init-template.d.ts.map

package/dist/pipeline/init-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-template.d.ts","sourceRoot":"","sources":["../../src/pipeline/init-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,gGAAgG;AAChG,MAAM,WAAW,QAAQ;IACvB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB;AA8GD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,QAAQ,EAAE,CAU/E"}
+{"version":3,"file":"init-template.d.ts","sourceRoot":"","sources":["../../src/pipeline/init-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAaH,gGAAgG;AAChG,MAAM,WAAW,QAAQ;IACvB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB;AAqID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,QAAQ,EAAE,CAKtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,QAAQ,EAAE,CAShG"}

package/dist/pipeline/init-template.js

@@ -17,33 +17,40 @@
 const json = String.raw;
 const md = String.raw;
 const yaml = String.raw;
+/**
+ * pnpm version pinned in the generated `package.json#packageManager`. The CI workflow reads the
+ * pnpm version from this field (it runs `pnpm/action-setup` without a hard-coded version), so the
+ * two stay in sync. Bumped deliberately when the recommended pnpm baseline moves.
+ */
+const PACKAGE_MANAGER = 'pnpm@10.30.3';
 /**
  * The `package.json` for a generated consumer repo.
  *
  * - `private: true` — a plugin repo is never published to npm; only its plugins ship to registries.
  * - `type: 'module'` — the toolkit is ESM-only (§8.1), and `aipm.config.ts` files are ESM.
+ * - `packageManager` pins pnpm; the CI workflow reads the pnpm version from here.
  * - `scripts` call `aipm` directly (it is on PATH via the dev dependency's bin).
- * - The `@ai-plugin-marketplace/cli` dev dependency is pinned to `^<toolkitVersion>` so authors
- *   upgrade the whole toolkit in lockstep via `pnpm up` (§9.1 lockstep release, §11 contract).
+ * - `cli` provides the `aipm` binary; `core` provides `defineConfig`/`defineWorkspace` for each
+ *   plugin's `aipm.config.ts` (§6.1). They ship independently and may differ (`cli 0.1.1` ships
+ *   with `core 0.2.0`), so each is pinned to a caret of its own version; authors upgrade both via
+ *   `pnpm up` (§11 contract).
  *
  * Emitted as 2-space JSON with a trailing newline to match the repo's formatting conventions.
  */
-function renderPackageJson(name, toolkitVersion) {
+function renderPackageJson(name, cliVersion, coreVersion) {
     const pkg = {
         name,
         private: true,
         type: 'module',
+        packageManager: PACKAGE_MANAGER,
         scripts: {
             build: 'aipm build',
             check: 'aipm validate',
             scaffold: 'aipm scaffold',
         },
         devDependencies: {
-            // cli provides the `aipm` binary; core provides `defineConfig` for each
-            // plugin's `aipm.config.ts` import (§6.1). Both pinned to the same toolkit
-            // version and upgraded together via `pnpm up`.
-            '@ai-plugin-marketplace/cli': `^${toolkitVersion}`,
-            '@ai-plugin-marketplace/core': `^${toolkitVersion}`,
+            '@ai-plugin-marketplace/cli': `^${cliVersion}`,
+            '@ai-plugin-marketplace/core': `^${coreVersion}`,
         },
     };
     return `${JSON.stringify(pkg, null, 2)}\n`;
@@ -95,21 +102,43 @@ function renderCiWorkflow() {
 
 on:
   push:
+    branches: [main]
   pull_request:
+    branches: [main]
 
 jobs:
-  build-and-validate:
+  CI:
     runs-on: ubuntu-latest
+    env:
+      CI: "true"
     steps:
       - uses: actions/checkout@v4
+
       - uses: pnpm/action-setup@v4
+        # version is read from package.json#packageManager — do not duplicate here
+
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm exec aipm build
-      - run: pnpm exec aipm validate
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build plugins
+        run: pnpm exec aipm build
+
+      - name: Verify the tree is clean after build (freshness)
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "::error::Working tree is dirty after 'aipm build'. Run 'aipm build' locally and commit the regenerated artifacts."
+            git status --porcelain
+            git --no-pager diff
+            exit 1
+          fi
+
+      - name: Validate plugins
+        run: pnpm exec aipm validate
 `;
 }
 /** `.gitignore` for a consumer repo: dependencies, build intermediates, OS/local cruft. */
@@ -121,22 +150,37 @@ function renderGitignore() {
 `;
 }
 /**
- * Build the complete, deterministic seed file set for a consumer repo named `name`, pinning the
- * `@ai-plugin-marketplace/cli` dev dependency to `^${toolkitVersion}`.
+ * Toolkit-owned **scaffold** files that `aipm init --refresh` keeps in sync with the installed
+ * tooling: the CI workflow and `.gitignore`. These are pure tooling recipes — their content is
+ * independent of the repo name and the pinned toolkit version, so refresh can re-render them with
+ * no inputs and compare byte-for-byte. (Files with repo identity or user content — `package.json`,
+ * `aipm.workspace.ts`, `README.md`, plugins, `aipm build` output — are deliberately NOT here.)
  *
- * The set mirrors §3.2: `package.json`, `.gitignore`, `README.md`, both repo-root marketplace
- * registries, an empty `plugins/` (seeded with `.gitkeep` so the directory is tracked), and the
- * CI workflow. Output is a pure function of the two inputs — stable ordering, no timestamps.
+ * Output is deterministic and stably ordered.
  */
-export function buildInitFiles(name, toolkitVersion) {
+export function buildManagedScaffoldFiles() {
     return [
-        { path: 'package.json', content: renderPackageJson(name, toolkitVersion) },
         { path: '.gitignore', content: renderGitignore() },
+        { path: '.github/workflows/ci.yml', content: renderCiWorkflow() },
+    ];
+}
+/**
+ * Build the complete, deterministic seed file set for a consumer repo named `name`, pinning the
+ * `cli`/`core` dev dependencies to carets of `cliVersion`/`coreVersion` respectively.
+ *
+ * The set mirrors §3.2: `package.json`, the {@link buildManagedScaffoldFiles managed scaffold
+ * files} (`.gitignore`, CI workflow), `README.md`, both repo-root marketplace registries, and an
+ * empty `plugins/` (seeded with `.gitkeep` so the directory is tracked). Output is a pure function
+ * of the inputs — stable ordering, no timestamps.
+ */
+export function buildInitFiles(name, cliVersion, coreVersion) {
+    return [
+        { path: 'package.json', content: renderPackageJson(name, cliVersion, coreVersion) },
         { path: 'README.md', content: renderReadme(name) },
         { path: '.claude-plugin/marketplace.json', content: renderEmptyMarketplace() },
         { path: '.cursor-plugin/marketplace.json', content: renderEmptyMarketplace() },
         { path: 'plugins/.gitkeep', content: '' },
-        { path: '.github/workflows/ci.yml', content: renderCiWorkflow() },
+        ...buildManagedScaffoldFiles(),
     ];
 }
 //# sourceMappingURL=init-template.js.map

package/dist/pipeline/init-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-template.js","sourceRoot":"","sources":["../../src/pipeline/init-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;AACxB,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;AACtB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;AAUxB;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,cAAsB;IAC7D,MAAM,GAAG,GAAG;QACV,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,eAAe;SAC1B;QACD,eAAe,EAAE;YACf,wEAAwE;YACxE,2EAA2E;YAC3E,+CAA+C;YAC/C,4BAA4B,EAAE,IAAI,cAAc,EAAE;YAClD,6BAA6B,EAAE,IAAI,cAAc,EAAE;SACpD;KACF,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB;IAC7B,OAAO,IAAI,CAAA;;;CAGZ,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,CAAA,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBnB,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAA;;;;;;;;;;;;;;;;;;;CAmBZ,CAAC;AACF,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe;IACtB,OAAO;;;;CAIR,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,cAAsB;IACjE,OAAO;QACL,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE;QAC1E,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE;QAClD,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;QAClD,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE;KAClE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"init-template.js","sourceRoot":"","sources":["../../src/pipeline/init-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;AACxB,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;AACtB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;AAExB;;;;GAIG;AACH,MAAM,eAAe,GAAG,cAAc,CAAC;AAUvC;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,UAAkB,EAAE,WAAmB;IAC9E,MAAM,GAAG,GAAG;QACV,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;QACd,cAAc,EAAE,eAAe;QAC/B,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,eAAe;SAC1B;QACD,eAAe,EAAE;YACf,4BAA4B,EAAE,IAAI,UAAU,EAAE;YAC9C,6BAA6B,EAAE,IAAI,WAAW,EAAE;SACjD;KACF,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB;IAC7B,OAAO,IAAI,CAAA;;;CAGZ,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,CAAA,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBnB,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCZ,CAAC;AACF,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe;IACtB,OAAO;;;;CAIR,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE;QAClD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE;KAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAkB,EAAE,WAAmB;IAClF,OAAO;QACL,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;QACnF,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;QAClD,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,GAAG,yBAAyB,EAAE;KAC/B,CAAC;AACJ,CAAC"}

package/dist/pipeline/init.d.ts

@@ -4,35 +4,38 @@
  *
  * This is the filesystem-writing orchestrator behind the public `init` operation and the
  * `aipm init [dir]` CLI surface. The generated file *contents* live in `init-template.ts`; this
- * module is the I/O boundary: it resolves the toolkit version to pin, refuses to clobber a
- * non-empty target, and writes the seed tree.
+ * module is the I/O boundary: it resolves the versions to pin, refuses to clobber a non-empty
+ * target, writes the seed tree, and seeds the `.aipm/scaffold.json` refresh sidecar.
  *
- * **Version pinning (§9.1 lockstep release).** core and cli ship in lockstep, so the `cli` dev
- * dependency is pinned to a caret of core's *own* version — read at runtime from this package's
- * `package.json`, resolved relative to {@link import.meta.url} exactly as `load-config.ts` resolves
- * the package entrypoint. Today that yields `^0.1.0-alpha.0`; once 0.1.0 ships, an `init` run from
- * the published cli pins `^0.1.0`.
+ * **Version pinning.** `cli` and `core` ship independently and may differ (e.g. `cli 0.1.1` ships
+ * with `core 0.2.0`), so the generated `package.json` pins each to a caret of its *own* version.
+ * `core`'s version is read at runtime from this package's `package.json` (resolved relative to
+ * {@link import.meta.url}, exactly as `load-config.ts` resolves the package entrypoint); `cli`'s
+ * version is supplied by the cli entrypoint via {@link InitOptions.cliVersion} (it reads its own
+ * `package.json`). When `cliVersion` is omitted, it falls back to core's version.
  *
  * @see docs/specs/architecture.md §3.2 (template repo contents)
- * @see docs/specs/architecture.md §9.1 (lockstep release lines)
  * @see docs/specs/architecture.md §11 (template→toolkit dependency contract)
+ * @see docs/specs/scaffold-refresh-and-upgrade.md (`aipm init --refresh`)
  */
 import type { InitOptions } from './types.js';
 /**
  * Scaffold a thin consumer repo at `targetDir` (§3.2).
  *
- * Writes `package.json` (with the `@ai-plugin-marketplace/cli` dev dependency pinned to a caret of
- * the current toolkit version), `.gitignore`, `README.md`, both repo-root marketplace registries
- * (`{ "plugins": [] }`), an empty `plugins/` (tracked via `.gitkeep`), and a CI workflow that runs
- * `aipm build` then `aipm validate` (§10.5 freshness). The repo name defaults to
- * `basename(targetDir)`; override it with `opts.name`.
+ * Writes `package.json` (with `cli`/`core` dev dependencies pinned to carets of their respective
+ * versions), `.gitignore`, `README.md`, both repo-root marketplace registries (`{ "plugins": [] }`),
+ * an empty `plugins/` (tracked via `.gitkeep`), and a CI workflow that runs `aipm build` then
+ * `aipm validate` (§10.5 freshness). It also seeds `.aipm/scaffold.json` so a later
+ * `aipm init --refresh` can tell pristine toolkit-owned files from user edits. The repo name
+ * defaults to `basename(targetDir)`; override it with `opts.name`.
  *
  * **Refuses to clobber.** If `targetDir` exists and is a non-empty directory (or exists as a
  * non-directory), the function throws and writes nothing. Creating into a fresh or empty directory
  * is fine.
  *
  * @param targetDir - Absolute or relative path to the directory to scaffold into.
- * @param opts - Init options; `name` overrides the derived repo name.
+ * @param opts - Init options; `name` overrides the derived repo name, `cliVersion` the pinned cli
+ *   dependency version (defaults to core's version).
  * @throws {Error} When `targetDir` exists and is non-empty (or is not a directory).
  */
 export declare function runInit(targetDir: string, opts?: InitOptions): Promise<void>;

package/dist/pipeline/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/pipeline/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA6B9C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBtF"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/pipeline/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA6B9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BtF"}

package/dist/pipeline/init.js

@@ -4,23 +4,25 @@
  *
  * This is the filesystem-writing orchestrator behind the public `init` operation and the
  * `aipm init [dir]` CLI surface. The generated file *contents* live in `init-template.ts`; this
- * module is the I/O boundary: it resolves the toolkit version to pin, refuses to clobber a
- * non-empty target, and writes the seed tree.
+ * module is the I/O boundary: it resolves the versions to pin, refuses to clobber a non-empty
+ * target, writes the seed tree, and seeds the `.aipm/scaffold.json` refresh sidecar.
  *
- * **Version pinning (§9.1 lockstep release).** core and cli ship in lockstep, so the `cli` dev
- * dependency is pinned to a caret of core's *own* version — read at runtime from this package's
- * `package.json`, resolved relative to {@link import.meta.url} exactly as `load-config.ts` resolves
- * the package entrypoint. Today that yields `^0.1.0-alpha.0`; once 0.1.0 ships, an `init` run from
- * the published cli pins `^0.1.0`.
+ * **Version pinning.** `cli` and `core` ship independently and may differ (e.g. `cli 0.1.1` ships
+ * with `core 0.2.0`), so the generated `package.json` pins each to a caret of its *own* version.
+ * `core`'s version is read at runtime from this package's `package.json` (resolved relative to
+ * {@link import.meta.url}, exactly as `load-config.ts` resolves the package entrypoint); `cli`'s
+ * version is supplied by the cli entrypoint via {@link InitOptions.cliVersion} (it reads its own
+ * `package.json`). When `cliVersion` is omitted, it falls back to core's version.
  *
  * @see docs/specs/architecture.md §3.2 (template repo contents)
- * @see docs/specs/architecture.md §9.1 (lockstep release lines)
  * @see docs/specs/architecture.md §11 (template→toolkit dependency contract)
+ * @see docs/specs/scaffold-refresh-and-upgrade.md (`aipm init --refresh`)
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { buildInitFiles } from './init-template.js';
+import { writeScaffoldSidecar } from './scaffold-refresh.js';
 /**
  * Read this package's `package.json#version`, resolved relative to this module's location.
  *
@@ -51,18 +53,20 @@ function isFreshTarget(dir) {
 /**
  * Scaffold a thin consumer repo at `targetDir` (§3.2).
  *
- * Writes `package.json` (with the `@ai-plugin-marketplace/cli` dev dependency pinned to a caret of
- * the current toolkit version), `.gitignore`, `README.md`, both repo-root marketplace registries
- * (`{ "plugins": [] }`), an empty `plugins/` (tracked via `.gitkeep`), and a CI workflow that runs
- * `aipm build` then `aipm validate` (§10.5 freshness). The repo name defaults to
- * `basename(targetDir)`; override it with `opts.name`.
+ * Writes `package.json` (with `cli`/`core` dev dependencies pinned to carets of their respective
+ * versions), `.gitignore`, `README.md`, both repo-root marketplace registries (`{ "plugins": [] }`),
+ * an empty `plugins/` (tracked via `.gitkeep`), and a CI workflow that runs `aipm build` then
+ * `aipm validate` (§10.5 freshness). It also seeds `.aipm/scaffold.json` so a later
+ * `aipm init --refresh` can tell pristine toolkit-owned files from user edits. The repo name
+ * defaults to `basename(targetDir)`; override it with `opts.name`.
  *
  * **Refuses to clobber.** If `targetDir` exists and is a non-empty directory (or exists as a
  * non-directory), the function throws and writes nothing. Creating into a fresh or empty directory
  * is fine.
  *
  * @param targetDir - Absolute or relative path to the directory to scaffold into.
- * @param opts - Init options; `name` overrides the derived repo name.
+ * @param opts - Init options; `name` overrides the derived repo name, `cliVersion` the pinned cli
+ *   dependency version (defaults to core's version).
  * @throws {Error} When `targetDir` exists and is non-empty (or is not a directory).
  */
 export async function runInit(targetDir, opts = {}) {
@@ -72,13 +76,17 @@ export async function runInit(targetDir, opts = {}) {
             'Choose a new path or an empty directory.');
     }
     const name = opts.name ?? path.basename(resolved);
-    const files = buildInitFiles(name, coreVersion());
+    const core = coreVersion();
+    const cli = opts.cliVersion ?? core;
+    const files = buildInitFiles(name, cli, core);
     fs.mkdirSync(resolved, { recursive: true });
     for (const file of files) {
         const full = path.join(resolved, file.path);
         fs.mkdirSync(path.dirname(full), { recursive: true });
         fs.writeFileSync(full, file.content, 'utf-8');
     }
+    // Seed the refresh sidecar so `aipm init --refresh` has a baseline of toolkit-owned content.
+    writeScaffoldSidecar(resolved);
     return Promise.resolve();
 }
 //# sourceMappingURL=init.js.map

package/dist/pipeline/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/pipeline/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD;;;;;;;GAOG;AACH,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAwB,CAAC;IACjF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,OAAoB,EAAE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,oDAAoD;YACxF,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAElD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/pipeline/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D;;;;;;;GAOG;AACH,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAwB,CAAC;IACjF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,OAAoB,EAAE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,oDAAoD;YACxF,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAE9C,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,6FAA6F;IAC7F,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/pipeline/operations.d.ts

@@ -9,7 +9,7 @@
  *
  * @see docs/specs/architecture.md §8.1
  */
-import type { BuildOptions, BuildResult, InitOptions, MigrateOptions, MigrateResult, ScaffoldOptions, SupportReport, TargetId, ValidateOptions, ValidationResult } from './types.js';
+import type { BuildOptions, BuildResult, InitOptions, MigrateOptions, MigrateResult, RefreshOptions, RefreshOutcome, ScaffoldOptions, SupportReport, TargetId, ValidateOptions, ValidationResult } from './types.js';
 /**
  * Build a single plugin or every plugin under a repo root. `path` may be a plugin directory
  * (contains `aipm.config.ts`) or a repo root (contains `plugins/`); the orchestrator detects
@@ -34,6 +34,16 @@ export declare function validate(targetPath: string, opts?: ValidateOptions): Pr
  * @public
  */
 export declare function init(targetDir: string, opts?: InitOptions): Promise<void>;
+/**
+ * Refresh the toolkit-owned scaffold files (CI workflow, `.gitignore`) of an existing marketplace
+ * repo at `targetDir` to match the installed tooling — the upgrade path after
+ * `pnpm up @ai-plugin-marketplace/*`. Guarded by the `.aipm/scaffold.json` content-hash sidecar:
+ * user-modified files are reported as conflicts and left untouched unless `opts.force` is set.
+ * Returns one outcome per managed file; never rejects on conflict.
+ *
+ * @public
+ */
+export declare function refreshScaffold(targetDir: string, opts?: RefreshOptions): Promise<RefreshOutcome[]>;
 /**
  * Scaffold a new plugin under the cwd's configured plugins root (`<cwd>/plugins/<name>` by
  * default, or the relocated `pluginsRoot` from an `aipm.repo.ts`). The plugins directory is

package/dist/pipeline/operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/pipeline/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,QAAQ,EACR,eAAe,EACf,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAOpB;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAErF;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAMrF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,SAAS,QAAQ,EAAE,CAEjD"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/pipeline/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,QAAQ,EACR,eAAe,EACf,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAOpB;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAErF;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,EAAE,CAAC,CAK3B;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAMrF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,SAAS,QAAQ,EAAE,CAEjD"}

package/dist/pipeline/operations.js

@@ -13,6 +13,7 @@ import * as path from 'node:path';
 import { runBuild } from './build.js';
 import { runInit } from './init.js';
 import { loadRepoConfig } from './load-config.js';
+import { runRefreshScaffold } from './scaffold-refresh.js';
 import { runScaffold, runAddTarget, runCheckSupport } from './scaffold.js';
 import { TARGET_IDS } from './types.js';
 import { runValidate } from './validate.js';
@@ -50,6 +51,21 @@ export function validate(targetPath, opts) {
 export function init(targetDir, opts) {
     return runInit(targetDir, opts);
 }
+/**
+ * Refresh the toolkit-owned scaffold files (CI workflow, `.gitignore`) of an existing marketplace
+ * repo at `targetDir` to match the installed tooling — the upgrade path after
+ * `pnpm up @ai-plugin-marketplace/*`. Guarded by the `.aipm/scaffold.json` content-hash sidecar:
+ * user-modified files are reported as conflicts and left untouched unless `opts.force` is set.
+ * Returns one outcome per managed file; never rejects on conflict.
+ *
+ * @public
+ */
+export function refreshScaffold(targetDir, opts) {
+    // Defer into the microtask queue so a synchronous failure in the orchestrator (e.g. an I/O error)
+    // surfaces as a rejected promise — matching `refreshScaffold(...).catch(...)` expectations —
+    // rather than throwing from this call before the promise exists.
+    return Promise.resolve().then(() => runRefreshScaffold(targetDir, opts));
+}
 /**
  * Scaffold a new plugin under the cwd's configured plugins root (`<cwd>/plugins/<name>` by
  * default, or the relocated `pluginsRoot` from an `aipm.repo.ts`). The plugins directory is

package/dist/pipeline/operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/pipeline/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAc5C,sGAAsG;AACtG,SAAS,IAAI;IACX,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,UAAkB,EAAE,IAAmB;IAC3D,OAAO,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,IAAsB;IACjE,OAAO,WAAW,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,SAAiB,EAAE,IAAkB;IACxD,OAAO,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAwB,EAAE;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1D,OAAO,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,KAAsB;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB,EAAE,CAAC;QACpB,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAgB;IAC3D,OAAO,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/pipeline/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAgB5C,sGAAsG;AACtG,SAAS,IAAI;IACX,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,UAAkB,EAAE,IAAmB;IAC3D,OAAO,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,IAAsB;IACjE,OAAO,WAAW,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,SAAiB,EAAE,IAAkB;IACxD,OAAO,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,IAAqB;IAErB,kGAAkG;IAClG,6FAA6F;IAC7F,iEAAiE;IACjE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAwB,EAAE;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1D,OAAO,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,KAAsB;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB,EAAE,CAAC;QACpB,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAgB;IAC3D,OAAO,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/pipeline/scaffold-refresh.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `aipm init --refresh` — keep a marketplace repo's **toolkit-owned scaffold files** (the CI
+ * workflow and `.gitignore`) in sync with the installed tooling, and serve as the upgrade path for
+ * any marketplace repo after `pnpm up @ai-plugin-marketplace/*`.
+ *
+ * Safety rests on a content-hash sidecar at `.aipm/scaffold.json` (mirroring the root-emission
+ * sidecar `.aipm/generated-root.json`): it records a hash of the exact content the toolkit last
+ * wrote each managed file. Refresh updates a file only when it is still pristine (matches the
+ * recorded hash) or missing; a file the user has edited surfaces as a reported conflict and is left
+ * untouched unless `--force` is given. A repo with no sidecar entry bootstraps: an already-in-sync
+ * file is adopted silently, a diverged one is a conflict to review.
+ *
+ * The managed set is deliberately narrow — only the pure tooling-recipe files (see
+ * {@link buildManagedScaffoldFiles}). `package.json` (deps are `pnpm up`'s job), `aipm.workspace.ts`
+ * (repo identity), `README.md` (authored), plugins, and `aipm build` output are never touched.
+ *
+ * @see docs/specs/scaffold-refresh-and-upgrade.md
+ */
+import type { RefreshOptions, RefreshOutcome } from './types.js';
+/** A recorded `{ path, hash }` pair: the hash of the content the toolkit last wrote at `path`. */
+interface SidecarEntry {
+    path: string;
+    hash: string;
+}
+/** Content hash recorded in the sidecar. `sha256-`-prefixed hex over the UTF-8 bytes. */
+export declare function hashScaffoldContent(content: string): string;
+/**
+ * Serialize a sidecar payload: `{ version, files }` with `files` sorted by path for determinism,
+ * 2-space JSON + trailing newline (matching the repo's other generated JSON).
+ */
+export declare function serializeScaffoldSidecar(entries: readonly SidecarEntry[]): string;
+/** Inputs to the pure per-file refresh decision. */
+export interface ManagedFileDecisionInput {
+    /** Canonical content the toolkit would render for this file. */
+    render: string;
+    /** Current on-disk content, or `null` when the file is missing. */
+    current: string | null;
+    /** Hash recorded in the sidecar for this file, or `null` when untracked. */
+    recordedHash: string | null;
+    /** Whether `--force` was given. */
+    force: boolean;
+}
+/** Result of the pure per-file refresh decision. */
+export interface ManagedFileDecision {
+    status: RefreshOutcome['status'];
+    /** Whether to write `render` to disk. */
+    write: boolean;
+    /** Hash to record in the new sidecar, or `null` to preserve the prior entry (or stay untracked). */
+    recordHash: string | null;
+}
+/**
+ * Decide what to do with one managed scaffold file. Pure — all filesystem state is passed in — so
+ * the decision table is unit-testable in isolation.
+ *
+ * | On-disk state                                   | Result        |
+ * |-------------------------------------------------|---------------|
+ * | missing                                         | `recreated`   |
+ * | matches the current render                      | `unchanged`   |
+ * | differs from render, matches recorded hash      | `updated`     |
+ * | differs from render & recorded (or untracked)   | `conflict` *  |
+ * | …same, with `force`                             | `overwritten` |
+ *
+ * \* `unchanged` also adopts an untracked-but-in-sync file by recording its hash.
+ */
+export declare function decideManagedFile(input: ManagedFileDecisionInput): ManagedFileDecision;
+/**
+ * Seed `.aipm/scaffold.json` for a freshly scaffolded repo, recording the hash of every managed
+ * scaffold file as just written by `aipm init`. Called by {@link runInit} after the seed tree is
+ * written so the first `--refresh` has a baseline.
+ */
+export declare function writeScaffoldSidecar(repoRoot: string): void;
+/**
+ * Refresh the toolkit-owned scaffold files of an existing repo at `repoRoot`, re-rendering each
+ * from the installed tooling and updating it in place when safe (see {@link decideManagedFile}).
+ * Writes the updated `.aipm/scaffold.json` sidecar and returns one {@link RefreshOutcome} per
+ * managed file. Never throws on conflict — conflicts are reported, not failures.
+ */
+export declare function runRefreshScaffold(repoRoot: string, opts?: RefreshOptions): RefreshOutcome[];
+export {};
+//# sourceMappingURL=scaffold-refresh.d.ts.map

package/dist/pipeline/scaffold-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold-refresh.d.ts","sourceRoot":"","sources":["../../src/pipeline/scaffold-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAOjE,kGAAkG;AAClG,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAOD,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAGjF;AA+BD,oDAAoD;AACpD,MAAM,WAAW,wBAAwB;IACvC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mCAAmC;IACnC,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,yCAAyC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,oGAAoG;IACpG,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,CAmBtF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ3D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,cAAc,EAAE,CAmChG"}

package/dist/pipeline/scaffold-refresh.js

@@ -0,0 +1,152 @@
+/**
+ * `aipm init --refresh` — keep a marketplace repo's **toolkit-owned scaffold files** (the CI
+ * workflow and `.gitignore`) in sync with the installed tooling, and serve as the upgrade path for
+ * any marketplace repo after `pnpm up @ai-plugin-marketplace/*`.
+ *
+ * Safety rests on a content-hash sidecar at `.aipm/scaffold.json` (mirroring the root-emission
+ * sidecar `.aipm/generated-root.json`): it records a hash of the exact content the toolkit last
+ * wrote each managed file. Refresh updates a file only when it is still pristine (matches the
+ * recorded hash) or missing; a file the user has edited surfaces as a reported conflict and is left
+ * untouched unless `--force` is given. A repo with no sidecar entry bootstraps: an already-in-sync
+ * file is adopted silently, a diverged one is a conflict to review.
+ *
+ * The managed set is deliberately narrow — only the pure tooling-recipe files (see
+ * {@link buildManagedScaffoldFiles}). `package.json` (deps are `pnpm up`'s job), `aipm.workspace.ts`
+ * (repo identity), `README.md` (authored), plugins, and `aipm build` output are never touched.
+ *
+ * @see docs/specs/scaffold-refresh-and-upgrade.md
+ */
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { buildManagedScaffoldFiles } from './init-template.js';
+/** Sidecar location relative to the repo root. */
+const SIDECAR_REL = ['.aipm', 'scaffold.json'];
+/** Schema version of the sidecar payload. */
+const SIDECAR_VERSION = 1;
+/** Absolute path of the scaffold sidecar under `repoRoot`. */
+function sidecarPath(repoRoot) {
+    return path.join(repoRoot, ...SIDECAR_REL);
+}
+/** Content hash recorded in the sidecar. `sha256-`-prefixed hex over the UTF-8 bytes. */
+export function hashScaffoldContent(content) {
+    return `sha256-${createHash('sha256').update(content, 'utf-8').digest('hex')}`;
+}
+/**
+ * Serialize a sidecar payload: `{ version, files }` with `files` sorted by path for determinism,
+ * 2-space JSON + trailing newline (matching the repo's other generated JSON).
+ */
+export function serializeScaffoldSidecar(entries) {
+    const files = [...entries].sort((a, b) => a.path.localeCompare(b.path));
+    return `${JSON.stringify({ version: SIDECAR_VERSION, files }, null, 2)}\n`;
+}
+/** Read the prior sidecar into a `path → hash` map. Missing or malformed sidecar → empty map. */
+function readSidecar(repoRoot) {
+    const map = new Map();
+    const abs = sidecarPath(repoRoot);
+    if (!fs.existsSync(abs))
+        return map;
+    // Read errors (permissions, transient I/O) propagate — they are real operational problems, not a
+    // "malformed sidecar" we should silently swallow. Only a JSON parse failure is tolerated.
+    const raw = fs.readFileSync(abs, 'utf-8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // A malformed sidecar is treated as absent: every managed file becomes "untracked" and must
+        // either already match the current render (adopted) or be resolved via --force.
+        return map;
+    }
+    if (Array.isArray(parsed.files)) {
+        for (const rawEntry of parsed.files) {
+            const entry = rawEntry;
+            if (typeof entry.path === 'string' && typeof entry.hash === 'string') {
+                map.set(entry.path, entry.hash);
+            }
+        }
+    }
+    return map;
+}
+/**
+ * Decide what to do with one managed scaffold file. Pure — all filesystem state is passed in — so
+ * the decision table is unit-testable in isolation.
+ *
+ * | On-disk state                                   | Result        |
+ * |-------------------------------------------------|---------------|
+ * | missing                                         | `recreated`   |
+ * | matches the current render                      | `unchanged`   |
+ * | differs from render, matches recorded hash      | `updated`     |
+ * | differs from render & recorded (or untracked)   | `conflict` *  |
+ * | …same, with `force`                             | `overwritten` |
+ *
+ * \* `unchanged` also adopts an untracked-but-in-sync file by recording its hash.
+ */
+export function decideManagedFile(input) {
+    const { render, current, recordedHash, force } = input;
+    const renderHash = hashScaffoldContent(render);
+    if (current === null)
+        return { status: 'recreated', write: true, recordHash: renderHash };
+    const currentHash = hashScaffoldContent(current);
+    if (currentHash === renderHash)
+        return { status: 'unchanged', write: false, recordHash: renderHash };
+    // Content differs from the current render.
+    if (recordedHash !== null && currentHash === recordedHash) {
+        // Pristine: the file is exactly what the toolkit last wrote, so it is safe to upgrade.
+        return { status: 'updated', write: true, recordHash: renderHash };
+    }
+    // Diverged from the recorded hash (user-edited) or untracked and not in sync.
+    if (force)
+        return { status: 'overwritten', write: true, recordHash: renderHash };
+    return { status: 'conflict', write: false, recordHash: null };
+}
+/**
+ * Seed `.aipm/scaffold.json` for a freshly scaffolded repo, recording the hash of every managed
+ * scaffold file as just written by `aipm init`. Called by {@link runInit} after the seed tree is
+ * written so the first `--refresh` has a baseline.
+ */
+export function writeScaffoldSidecar(repoRoot) {
+    const entries = buildManagedScaffoldFiles().map((file) => ({
+        path: file.path,
+        hash: hashScaffoldContent(file.content),
+    }));
+    const abs = sidecarPath(repoRoot);
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, serializeScaffoldSidecar(entries), 'utf-8');
+}
+/**
+ * Refresh the toolkit-owned scaffold files of an existing repo at `repoRoot`, re-rendering each
+ * from the installed tooling and updating it in place when safe (see {@link decideManagedFile}).
+ * Writes the updated `.aipm/scaffold.json` sidecar and returns one {@link RefreshOutcome} per
+ * managed file. Never throws on conflict — conflicts are reported, not failures.
+ */
+export function runRefreshScaffold(repoRoot, opts = {}) {
+    const force = opts.force ?? false;
+    const resolved = path.resolve(repoRoot);
+    const recorded = readSidecar(resolved);
+    const outcomes = [];
+    const newEntries = [];
+    for (const file of buildManagedScaffoldFiles()) {
+        const abs = path.join(resolved, file.path);
+        const current = fs.existsSync(abs) ? fs.readFileSync(abs, 'utf-8') : null;
+        const recordedHash = recorded.get(file.path) ?? null;
+        const decision = decideManagedFile({ render: file.content, current, recordedHash, force });
+        if (decision.write) {
+            fs.mkdirSync(path.dirname(abs), { recursive: true });
+            fs.writeFileSync(abs, file.content, 'utf-8');
+        }
+        if (decision.recordHash !== null) {
+            newEntries.push({ path: file.path, hash: decision.recordHash });
+        }
+        else if (recordedHash !== null) {
+            // Conflict left untouched: preserve the prior recorded hash so it stays tracked.
+            newEntries.push({ path: file.path, hash: recordedHash });
+        }
+        outcomes.push({ path: file.path, status: decision.status });
+    }
+    const sidecarAbs = sidecarPath(resolved);
+    fs.mkdirSync(path.dirname(sidecarAbs), { recursive: true });
+    fs.writeFileSync(sidecarAbs, serializeScaffoldSidecar(newEntries), 'utf-8');
+    return outcomes;
+}
+//# sourceMappingURL=scaffold-refresh.js.map

package/dist/pipeline/scaffold-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold-refresh.js","sourceRoot":"","sources":["../../src/pipeline/scaffold-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAG/D,kDAAkD;AAClD,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,eAAe,CAAU,CAAC;AACxD,6CAA6C;AAC7C,MAAM,eAAe,GAAG,CAAC,CAAC;AAQ1B,8DAA8D;AAC9D,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgC;IACvE,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,iGAAiG;AACjG,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAEpC,iGAAiG;IACjG,0FAA0F;IAC1F,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,gFAAgF;QAChF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,QAAiC,CAAC;YAChD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAuBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA+B;IAC/D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACvD,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAE/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IAE1F,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,UAAU;QAC5B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IAEvE,2CAA2C;IAC3C,IAAI,YAAY,KAAK,IAAI,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAC1D,uFAAuF;QACvF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IACpE,CAAC;IAED,8EAA8E;IAC9E,IAAI,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IACjF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,OAAO,GAAmB,yBAAyB,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;KACxC,CAAC,CAAC,CAAC;IACJ,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,OAAuB,EAAE;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,UAAU,GAAmB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAErD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3F,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACjC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YACjC,iFAAiF;YACjF,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACzC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,wBAAwB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAE5E,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/pipeline/types.d.ts

@@ -139,6 +139,44 @@ export interface InitOptions {
      * directory.
      */
     name?: string;
+    /**
+     * Version of `@ai-plugin-marketplace/cli` to pin the generated `package.json`'s `cli`
+     * dev dependency to (as `^<cliVersion>`). The cli entrypoint supplies its own version here; cli
+     * and core ship independently and may differ (e.g. `cli 0.1.1` ships with `core 0.2.0`). When
+     * omitted, falls back to core's own version (the historical lockstep assumption).
+     */
+    cliVersion?: string;
+}
+/**
+ * Options for {@link refreshScaffold}.
+ *
+ * @public
+ */
+export interface RefreshOptions {
+    /**
+     * Overwrite toolkit-owned scaffold files even when their on-disk content has diverged from what
+     * the toolkit last wrote (i.e. the user edited them). Without this, diverged files are reported
+     * as conflicts and left untouched.
+     */
+    force?: boolean;
+}
+/**
+ * Per-file outcome of a {@link refreshScaffold} run. Returned (one per managed scaffold file) so
+ * the CLI can report what changed without re-deriving it.
+ *
+ * @public
+ */
+export interface RefreshOutcome {
+    /** Repo-relative POSIX path of the managed scaffold file. */
+    path: string;
+    /**
+     * - `updated` — content changed and was rewritten (file was pristine or `--force`).
+     * - `unchanged` — already matched the current render; nothing written.
+     * - `recreated` — file was missing and was written from the render.
+     * - `conflict` — on-disk content diverged from the recorded hash; left untouched (no `--force`).
+     * - `overwritten` — diverged but rewritten because `--force` was set.
+     */
+    status: 'updated' | 'unchanged' | 'recreated' | 'conflict' | 'overwritten';
 }
 /**
  * Options for {@link migrate}.

package/dist/pipeline/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/pipeline/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU,oEAOiB,CAAC;AAmBzC;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,EAAE,QAAQ,CAAC;CAClB;AAKD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,WAAW,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,0BAA0B,GAC1B,WAAW,GACX,sBAAsB,GACtB,yBAAyB,CAAC;AAE9B;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,OAAO,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC9B,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAKD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtD,mBAAmB;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAKD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,4DAA4D;IAC5D,gBAAgB,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC5D,wFAAwF;IACxF,WAAW,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;CAC1D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/pipeline/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU,oEAOiB,CAAC;AAmBzC;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,EAAE,QAAQ,CAAC;CAClB;AAKD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,WAAW,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,0BAA0B,GAC1B,WAAW,GACX,sBAAsB,GACtB,yBAAyB,CAAC;AAE9B;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,OAAO,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC9B,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAKD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;CAC5E;AAKD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtD,mBAAmB;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAKD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,4DAA4D;IAC5D,gBAAgB,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC5D,wFAAwF;IACxF,WAAW,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;CAC1D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-plugin-marketplace/core",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Core build pipeline, validation, and scaffolding for the AI plugin marketplace toolkit.",
   "type": "module",
   "author": "Mike North <michael.l.north@gmail.com>",