@aiwg/cli 2026.7.19 → 2026.7.21

package/dist/src/extensions/commands/definitions.js

@@ -907,6 +907,34 @@ export const sessionCommand = {
         },
     },
 };
+// Session Catalog Command (#1903)
+export const sessionsCommand = {
+    id: 'sessions',
+    type: 'skill',
+    name: 'Sessions',
+    description: 'Manage the normalized session catalog with versioned JSON, deterministic pagination, previews, and health checks',
+    version: '1.0.0',
+    capabilities: ['cli', 'session-catalog', 'session-import', 'session-lifecycle', 'doctor'],
+    keywords: ['sessions', 'catalog', 'import', 'source', 'tag', 'reindex', 'delete'],
+    category: 'project',
+    platforms: {
+        claude: 'full',
+        generic: 'full',
+    },
+    deployment: {
+        pathTemplate: '.{platform}/commands/{id}.md',
+        core: true,
+    },
+    metadata: {
+        type: 'skill',
+        triggerPhrases: ['list sessions', 'import sessions', 'session catalog', 'sessions doctor'],
+        commandHint: {
+            template: 'utility',
+            argumentHint: '<sources|import|list|show|tag|relocate|reindex|delete|doctor> [--json] [--dry-run]',
+            allowedTools: ['Bash'],
+        },
+    },
+};
 // Sandbox Management Commands (#917)
 export const sandboxCommand = {
     id: 'sandbox',
@@ -1272,7 +1300,7 @@ export const discoverCommand = {
         ],
         commandHint: {
             template: 'utility',
-            argumentHint: '"<phrase>" [--limit N] [--type skill,agent,...] [--json] [--resource-source local|web|auto] [--aiwg-version <exact-or-channel>] [--offline]',
+            argumentHint: '"<phrase>" [--limit N] [--type skill,agent,...] [--json] [--resource-source local|web|auto] [--aiwg-version <version|range|digest|channel>] [--offline]',
             allowedTools: ['Read'],
         },
     },
@@ -1309,11 +1337,44 @@ export const showCommand = {
         ],
         commandHint: {
             template: 'utility',
-            argumentHint: '<type> <name> [--json] [--first] [--resource-source local|web|auto] [--aiwg-version <exact-or-channel>] [--offline]   # type: skill | agent | command | rule',
+            argumentHint: '<type> <name> [--json] [--first] [--resource-source local|web|auto] [--aiwg-version <version|range|digest|channel>] [--offline]   # type: skill | agent | command | rule',
             allowedTools: ['Read'],
         },
     },
 };
+export const versionsCommand = {
+    id: 'versions',
+    type: 'skill',
+    name: 'Resource Versions',
+    description: 'Browse and resolve signed AIWG web resource releases',
+    version: '1.0.0',
+    capabilities: ['cli', 'resources', 'versions', 'release', 'integrity', 'cache'],
+    keywords: ['versions', 'resource versions', 'aiwg version', 'release manifest', 'web resources', 'stable channel'],
+    category: 'index',
+    platforms: {
+        claude: 'full',
+        generic: 'full',
+    },
+    deployment: {
+        pathTemplate: '.{platform}/commands/{id}.md',
+        core: true,
+    },
+    metadata: {
+        type: 'skill',
+        triggerPhrases: [
+            'aiwg versions',
+            'resource versions',
+            'resolve aiwg version',
+            'show release manifest',
+            'list AIWG resource channels',
+        ],
+        commandHint: {
+            template: 'utility',
+            argumentHint: 'list|resolve|show [version|range|digest|channel] [--json] [--pretty] [--offline] [--channels stable,latest]',
+            allowedTools: ['Read', 'Bash'],
+        },
+    },
+};
 // Features: list, inspect (and eventually install) AIWG's optional
 // runtime features — embeddings, sqlite, pty, webserver. (#1219)
 export const featuresCommand = {
@@ -3379,6 +3440,7 @@ export const commandDefinitions = [
     researchQueryCommand,
     discoverCommand,
     showCommand,
+    versionsCommand,
     // Optional Features (1)
     featuresCommand,
     // Reproducibility (4)
@@ -3424,6 +3486,7 @@ export const commandDefinitions = [
     feedbackCommand,
     // Session (#884)
     sessionCommand,
+    sessionsCommand,
 ];
 // ============================================
 // Helper Functions

package/dist/src/extensions/manifest.js

@@ -39,6 +39,7 @@ export const ProjectLocalTypeSchema = z.enum([
  * underscore + hyphen, optional trailing slash.
  */
 const safeRelativePath = z.string().regex(/^[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)*\/?$/, 'must be a relative path (alphanumeric + _-, no leading slash, no ..)');
+const safeModuleFile = z.string().regex(/^[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)*\.mjs$/, 'must be a relative .mjs path (alphanumeric + _-, no leading slash, no ..)');
 // Single-char ids are allowed; multi-char ids must end with alphanumeric
 // (no trailing hyphen). This pattern: `[a-z0-9]([a-z0-9-]*[a-z0-9])?`
 const bundleNamePattern = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -129,6 +130,31 @@ export const ProviderConfigSchema = z.object({
     aliases: z.array(z.string().min(1).max(64)).max(20).optional(),
     capabilities: ProviderCapabilityOverridesSchema.optional(),
 }).strict();
+export const CliCommandsSchema = z.object({
+    namespace: z.string()
+        .min(1)
+        .max(64)
+        .regex(bundleNamePattern, 'kebab-case alphanumeric, no leading/trailing hyphen'),
+    description: z.string().min(1).max(512),
+    entry: safeRelativePath.optional(),
+    subcommands: z.record(z.string()
+        .min(1)
+        .max(64)
+        .regex(bundleNamePattern, 'kebab-case alphanumeric, no leading/trailing hyphen'), z.object({
+        file: safeModuleFile,
+        description: z.string().min(1).max(512),
+        hook_event: z.enum([
+            'Stop',
+            'SessionStart',
+            'SessionEnd',
+            'PreToolUse',
+            'PostToolUse',
+            'FeatureComplete',
+        ]).optional(),
+    }).strict()).refine((commands) => Object.keys(commands).length > 0, {
+        message: 'at least one CLI subcommand is required',
+    }),
+}).strict();
 // ============================================
 // Top-level BundleManifestSchema
 // ============================================
@@ -162,6 +188,9 @@ export const BundleManifestSchema = z.object({
     // Optional patterns shared with existing extension validation
     deprecation: DeprecationSchema.optional(),
     memory: MemoryFootprintSchema.optional(),
+    // Expandable CLI namespace contributed by an addon-shaped bundle.
+    // The same block is accepted by bundled addon manifests.
+    cli_commands: CliCommandsSchema.optional(),
 })
     .strict()
     .refine((m) => {

package/dist/src/extensions/project-local-discovery.js

@@ -9,8 +9,8 @@
  * @architecture .aiwg/architecture/adr-aiwg-directory-layout.md (#1039)
  * @architecture .aiwg/architecture/design-manifest-schema.md (#1044)
  */
-import { readFile, readdir, lstat, stat, access } from 'fs/promises';
-import { join } from 'path';
+import { readFile, readdir, lstat, stat, access, realpath } from 'fs/promises';
+import { join, relative, resolve, sep } from 'path';
 import { BundleManifestSchema, zodErrorToValidationErrors, MANIFEST_MAX_BYTES, MAX_BUNDLES_PER_PROJECT, } from './manifest.js';
 import { ensureTrailingSlash, projectLocalDisplayPath, PROJECT_LOCAL_DIR_TO_TYPE, PROJECT_LOCAL_SCAN_DIRS, resolveProjectLocalSearchRoots, } from './project-local-paths.js';
 /**
@@ -246,12 +246,96 @@ export async function loadAndValidateManifest(manifestPath, expectedType, projec
     }
     const bundlePath = manifestPath.slice(0, -'/manifest.json'.length);
     const localPath = ensureTrailingSlash(projectLocalDisplayPath(projectDir, bundlePath, searchRoot));
+    let artifactPath = bundlePath;
+    if (manifest.type === 'plugin') {
+        // BundleManifestSchema's discriminator refinement guarantees this for a
+        // plugin, but Zod refinements do not narrow the inferred TypeScript type.
+        const pluginConfig = manifest.pluginConfig;
+        const configuredPayload = resolve(bundlePath, pluginConfig.payloadPath);
+        const lexicalRelative = relative(bundlePath, configuredPayload);
+        if (lexicalRelative === ''
+            || lexicalRelative === '..'
+            || lexicalRelative.startsWith(`..${sep}`)) {
+            return {
+                errors: [{
+                        path: manifestPath,
+                        field: 'pluginConfig.payloadPath',
+                        expected: 'a child directory inside the plugin wrapper',
+                        actual: pluginConfig.payloadPath,
+                        hint: 'Plugin payloads must not resolve to the wrapper root or escape it',
+                        severity: 'error',
+                    }],
+            };
+        }
+        let wrapperReal;
+        let payloadReal;
+        try {
+            const payloadStat = await lstat(configuredPayload);
+            if (payloadStat.isSymbolicLink() || !payloadStat.isDirectory()) {
+                return {
+                    errors: [{
+                            path: configuredPayload,
+                            field: 'pluginConfig.payloadPath',
+                            expected: 'a regular payload directory',
+                            actual: payloadStat.isSymbolicLink() ? 'symlink' : 'non-directory',
+                            hint: 'Use a real directory below the plugin wrapper',
+                            severity: 'error',
+                        }],
+                };
+            }
+            [wrapperReal, payloadReal] = await Promise.all([
+                realpath(bundlePath),
+                realpath(configuredPayload),
+            ]);
+        }
+        catch (err) {
+            return {
+                errors: [{
+                        path: configuredPayload,
+                        field: 'pluginConfig.payloadPath',
+                        expected: 'an existing readable payload directory',
+                        actual: err.message,
+                        hint: 'Create the configured payload directory and its manifest.json',
+                        severity: 'error',
+                    }],
+            };
+        }
+        const realRelative = relative(wrapperReal, payloadReal);
+        if (realRelative === ''
+            || realRelative === '..'
+            || realRelative.startsWith(`..${sep}`)) {
+            return {
+                errors: [{
+                        path: configuredPayload,
+                        field: 'pluginConfig.payloadPath',
+                        expected: 'a non-symlinked child directory inside the plugin wrapper',
+                        actual: payloadReal,
+                        hint: 'Move the payload below the wrapper and remove symlink indirection',
+                        severity: 'error',
+                    }],
+            };
+        }
+        const payloadManifestPath = join(configuredPayload, 'manifest.json');
+        const payloadResult = await loadAndValidateManifest(payloadManifestPath, pluginConfig.payloadType, projectDir, searchRoot);
+        if (!payloadResult.bundle) {
+            return {
+                errors: payloadResult.errors.map(error => ({
+                    ...error,
+                    hint: error.field === 'type'
+                        ? `Payload manifest type must match pluginConfig.payloadType: "${pluginConfig.payloadType}"`
+                        : error.hint,
+                })),
+            };
+        }
+        artifactPath = payloadResult.bundle.bundlePath;
+    }
     return {
         bundle: {
             id: manifest.id,
             type: manifest.type,
             manifest,
             bundlePath,
+            artifactPath,
             localPath,
             manifestPath: projectLocalDisplayPath(projectDir, manifestPath, searchRoot),
         },

package/dist/src/extensions/project-local-remove.js

@@ -12,11 +12,11 @@
  * @design @.aiwg/architecture/design-aiwg-remove-revert.md
  * @implements #1037
  */
-import { lstat, readdir, stat, unlink } from 'fs/promises';
-import { resolve, join, relative } from 'path';
-import { homedir } from 'os';
+import { lstat, readdir, stat, unlink, rmdir } from 'fs/promises';
+import { resolve, join, relative, dirname, isAbsolute } from 'path';
 import { appendProjectLocalActivity } from './project-local-activity.js';
 import { sha256OfFileNormalized } from './managed-marker.js';
+import { getProviderArtifactPathStrings } from '../providers/provider-definitions.js';
 /**
  * Hash an artifact file with the managed-marker line stripped.
  *
@@ -93,54 +93,32 @@ export async function hashBundleArtifacts(bundleAbsPath) {
     }
     return out;
 }
-/**
- * Provider-specific deploy-path conventions for the artifact directories
- * we currently emit. Keyed by provider, value is the prefix relative to
- * the project (or HOME for HOME-deploying providers — those are out of
- * scope for revert in this iteration; they are silently skipped with a
- * message).
- */
-// Per PUW-026 (#1127): home-deploying providers get absolute prefixes so
-// `resolve(projectDir, prefix)` correctly produces the home-rooted path.
-// Previously these were `null`, which silently skipped lifecycle ops
-// against home-deployed project-local bundles (OpenClaw, Hermes).
-const PROVIDER_PREFIX = {
-    claude: '.claude',
-    cursor: '.cursor',
-    factory: '.factory',
-    opencode: '.opencode',
-    windsurf: '.windsurf',
-    warp: '.warp',
-    codex: '.codex',
-    copilot: '.github', // copilot uses .github/agents, .github/instructions, .github/skills
-    openclaw: resolve(homedir(), '.openclaw'),
-    hermes: resolve(homedir(), '.hermes'),
-};
-/**
- * Translate a source-relative artifact path to the provider's deploy path,
- * relative to the project (or HOME) root. Returns null when the provider
- * is HOME-deploying (revert from HOME is out of scope for this iteration).
- *
- * For most providers this is a 1:1 mapping (rules/x.md → .{p}/rules/x.md).
- */
-function deployedPathFor(provider, sourceRel) {
-    const prefix = PROVIDER_PREFIX[provider];
-    if (!prefix)
-        return null;
-    // Some providers rename rules to .mdc (cursor); revert checks both.
-    return `${prefix}/${sourceRel}`;
-}
-/** Try multiple plausible deployed paths (e.g., .md vs .mdc for rules). */
-function candidateDeployedPaths(provider, sourceRel) {
-    const paths = [];
-    const main = deployedPathFor(provider, sourceRel);
-    if (main)
-        paths.push(main);
-    // Cursor rule rename
-    if (provider === 'cursor' && sourceRel.startsWith('rules/') && sourceRel.endsWith('.md')) {
-        paths.push(`.cursor/${sourceRel.slice(0, -3)}.mdc`);
+/** Resolve a recorded source-relative artifact through the canonical provider
+ * definition rather than assuming every artifact lives directly under the
+ * provider prefix (#1869). Returned paths are absolute for both project- and
+ * home-deploying providers. */
+export function candidateDeployedPaths(projectDir, provider, sourceRel) {
+    const separator = sourceRel.indexOf('/');
+    if (separator < 1)
+        return [];
+    const artifactType = sourceRel.slice(0, separator);
+    if (!['agents', 'commands', 'skills', 'rules'].includes(artifactType))
+        return [];
+    const paths = getProviderArtifactPathStrings(provider);
+    const root = paths?.[artifactType];
+    if (!root)
+        return [];
+    const tail = sourceRel.slice(separator + 1);
+    const absoluteRoot = isAbsolute(root) ? root : resolve(projectDir, root);
+    const candidates = [join(absoluteRoot, tail)];
+    // Provider adapters may translate source extensions.
+    if (provider === 'cursor' && artifactType === 'rules' && tail.endsWith('.md')) {
+        candidates.push(join(absoluteRoot, `${tail.slice(0, -3)}.mdc`));
+    }
+    if (provider === 'codex' && artifactType === 'agents' && tail.endsWith('.md')) {
+        candidates.push(join(absoluteRoot, `${tail.slice(0, -3)}.toml`));
     }
-    return paths;
+    return [...new Set(candidates)];
 }
 async function tryUnlink(absPath) {
     try {
@@ -156,6 +134,18 @@ async function tryUnlink(absPath) {
         throw err;
     }
 }
+async function cleanupManagedSkillDirectory(absPath) {
+    if (!absPath.endsWith('/SKILL.md'))
+        return;
+    const skillDir = dirname(absPath);
+    await tryUnlink(join(skillDir, '.aiwg-managed'));
+    try {
+        await rmdir(skillDir);
+    }
+    catch {
+        // Preserve directories containing any operator or provider-created files.
+    }
+}
 async function classify(expectedHash, absPath) {
     if (!expectedHash)
         return 'unhashed';
@@ -258,28 +248,30 @@ export async function removeProjectLocalBundle(config, projectDir, bundleId, opt
                 }
                 continue;
             }
-            const candidates = candidateDeployedPaths(provider, sourceRel);
+            const candidates = candidateDeployedPaths(projectDir, provider, sourceRel);
             let resolvedAbs = null;
             let detectedCase = 'missing';
             for (const c of candidates) {
-                const abs = resolve(projectDir, c);
-                const k = await classify(artifactHashes[sourceRel], abs);
+                const k = await classify(artifactHashes[sourceRel], c);
                 if (k !== 'missing') {
-                    resolvedAbs = abs;
+                    resolvedAbs = c;
                     detectedCase = k;
                     break;
                 }
             }
             if (!resolvedAbs) {
                 // Pick the first candidate just so the outcome carries a path
-                const fallback = candidates[0] ? resolve(projectDir, candidates[0]) : '(unknown)';
+                const fallback = candidates[0] ?? '(unknown)';
+                providerHadSkip = true;
                 outcomes.push({
                     provider,
                     artifactPath: sourceRel,
                     deployedAbsPath: fallback,
                     case: 'missing',
                     reverted: false,
-                    message: 'already absent',
+                    message: candidates.length === 0
+                        ? 'provider artifact path unavailable — registry preserved'
+                        : 'recorded artifact not found at canonical provider path — registry preserved for retry',
                 });
                 continue;
             }
@@ -295,6 +287,8 @@ export async function removeProjectLocalBundle(config, projectDir, bundleId, opt
                         outcomes.push({ provider, artifactPath: sourceRel, deployedAbsPath: resolvedAbs, case: 'permission', reverted: false, message: 'permission denied' });
                     }
                     else {
+                        if (r.deleted)
+                            await cleanupManagedSkillDirectory(resolvedAbs);
                         outcomes.push({ provider, artifactPath: sourceRel, deployedAbsPath: resolvedAbs, case: 'pristine', reverted: r.deleted, message: r.deleted ? 'reverted' : 'already absent' });
                     }
                 }
@@ -325,6 +319,8 @@ export async function removeProjectLocalBundle(config, projectDir, bundleId, opt
                     outcomes.push({ provider, artifactPath: sourceRel, deployedAbsPath: resolvedAbs, case: 'permission', reverted: false, message: 'permission denied' });
                 }
                 else {
+                    if (r.deleted)
+                        await cleanupManagedSkillDirectory(resolvedAbs);
                     outcomes.push({ provider, artifactPath: sourceRel, deployedAbsPath: resolvedAbs, case: detectedCase, reverted: r.deleted, message: r.deleted ? 'reverted (mutation overridden)' : 'already absent' });
                 }
             }

package/dist/src/extensions/shadow-resolver.js

@@ -115,7 +115,9 @@ export async function resolveShadows(bundles, upstream, options = {}) {
     // Enumerate every artifact in every bundle once.
     const enumerated = [];
     for (const bundle of bundles) {
-        const arts = await enumerateBundleArtifacts(bundle.bundlePath);
+        // Preserve compatibility for programmatic callers that constructed the
+        // pre-#1868 ProjectLocalBundle shape; discovery always supplies artifactPath.
+        const arts = await enumerateBundleArtifacts(bundle.artifactPath ?? bundle.bundlePath);
         enumerated.push({ bundle, arts });
         for (const art of arts) {
             const key = `${art.type}:${art.id}`;

package/dist/src/plugins/standalone-packager.js

@@ -0,0 +1,143 @@
+// @ts-nocheck
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const NAME = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+const PROVIDERS = new Set(['claude', 'codex']);
+function inside(parent, candidate) {
+    const rel = path.relative(path.resolve(parent), path.resolve(candidate));
+    return rel === '' || (rel.length > 0 && !rel.startsWith('..') && !path.isAbsolute(rel));
+}
+async function validateManifest(wrapperRoot, expectedName, projectRoot) {
+    const manifestPath = path.join(wrapperRoot, 'manifest.json');
+    const { loadAndValidateManifest } = await import('../extensions/project-local-discovery.js');
+    const validation = await loadAndValidateManifest(manifestPath, 'plugin', projectRoot);
+    if (!validation.bundle) {
+        const details = validation.errors.map(error => {
+            const hint = error.hint ? `; ${error.hint}` : '';
+            return `${error.field}: expected ${error.expected}, got ${String(error.actual)}${hint}`;
+        }).join('\n  - ');
+        throw new Error(`Standalone plugin manifest validation failed:\n  - ${details}`);
+    }
+    const manifest = validation.bundle.manifest;
+    if (manifest.id !== expectedName)
+        throw new Error(`Wrapper manifest id '${manifest.id ?? '<missing>'}' does not match requested plugin '${expectedName}'`);
+    return { manifest, payloadRoot: validation.bundle.artifactPath };
+}
+function copyTree(source, destination) {
+    fs.mkdirSync(destination, { recursive: true });
+    for (const entry of fs.readdirSync(source, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+        const from = path.join(source, entry.name);
+        const to = path.join(destination, entry.name);
+        if (entry.isSymbolicLink())
+            throw new Error(`Refusing symbolic link in plugin source: ${from}`);
+        if (entry.isDirectory())
+            copyTree(from, to);
+        else if (entry.isFile())
+            fs.copyFileSync(from, to);
+    }
+}
+function writeProviderMetadata(root, provider, manifest) {
+    const version = manifest.version ?? '0.0.0';
+    const description = manifest.description ?? manifest.name ?? manifest.id;
+    if (provider === 'claude') {
+        const dir = path.join(root, '.claude-plugin');
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, 'plugin.json'), `${JSON.stringify({
+            name: manifest.id,
+            version,
+            description,
+        }, null, 2)}\n`);
+    }
+    else {
+        const dir = path.join(root, '.codex-plugin');
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, 'plugin.json'), `${JSON.stringify({
+            name: manifest.id,
+            version,
+            description,
+        }, null, 2)}\n`);
+        fs.writeFileSync(path.join(root, 'marketplace.json'), `${JSON.stringify({
+            name: manifest.id,
+            plugins: [{ name: manifest.id, source: { source: 'local', path: '.' } }],
+        }, null, 2)}\n`);
+    }
+}
+function createDeterministicArchive(sourceDir, archivePath) {
+    const result = spawnSync('tar', [
+        '--sort=name',
+        '--mtime=@0',
+        '--owner=0',
+        '--group=0',
+        '--numeric-owner',
+        '-czf',
+        archivePath,
+        '-C',
+        path.dirname(sourceDir),
+        path.basename(sourceDir),
+    ], { encoding: 'utf8' });
+    if (result.status !== 0)
+        throw new Error(`Could not create deterministic archive: ${result.stderr || 'tar failed'}`);
+}
+export function resolveStandalonePluginSource({ cwd, name, source }) {
+    const projectRoot = path.resolve(cwd);
+    const candidate = path.resolve(projectRoot, source ?? path.join('.aiwg', 'plugins', name));
+    if (!inside(projectRoot, candidate))
+        throw new Error('Plugin --source must stay inside the current project');
+    if (!fs.existsSync(candidate) || !fs.statSync(candidate).isDirectory())
+        return null;
+    const real = fs.realpathSync(candidate);
+    if (!inside(fs.realpathSync(projectRoot), real))
+        throw new Error('Plugin --source resolves outside the current project through a symlink');
+    return real;
+}
+export async function packageStandalonePlugin(options) {
+    const { cwd, name, source, output, dryRun = false, clean = false } = options;
+    if (!NAME.test(name))
+        throw new Error(`Plugin name '${name}' must be kebab-case`);
+    const sourceRoot = resolveStandalonePluginSource({ cwd, name, source });
+    if (!sourceRoot)
+        return null;
+    const { manifest, payloadRoot } = await validateManifest(sourceRoot, name, path.resolve(cwd));
+    const providers = options.provider === 'all'
+        ? ['claude', 'codex']
+        : [options.provider ?? 'claude'];
+    for (const provider of providers) {
+        if (!PROVIDERS.has(provider)) {
+            throw new Error(`Standalone plugin provider '${provider}' is not supported; use claude, codex, or all`);
+        }
+        const support = manifest.platforms?.[provider];
+        if (support === undefined || support === false || support === 'none') {
+            throw new Error(`Wrapper manifest does not declare compatible '${provider}' platform support`);
+        }
+    }
+    const outputRoot = path.resolve(cwd, output ?? path.join('dist', 'plugins'));
+    const version = manifest.version ?? '0.0.0';
+    const plans = providers.map(provider => ({
+        provider,
+        archivePath: path.join(outputRoot, `${name}-${version}-${provider}.tar.gz`),
+    }));
+    if (dryRun)
+        return { sourceRoot, payloadRoot, plans, dryRun: true };
+    fs.mkdirSync(outputRoot, { recursive: true });
+    for (const plan of plans) {
+        if (fs.existsSync(plan.archivePath) && !clean) {
+            throw new Error(`Package output already exists: ${plan.archivePath}; use --clean or choose another --output`);
+        }
+        if (clean)
+            fs.rmSync(plan.archivePath, { force: true });
+        const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'aiwg-plugin-package-'));
+        try {
+            const staged = path.join(tempRoot, name);
+            copyTree(sourceRoot, staged);
+            writeProviderMetadata(staged, plan.provider, manifest);
+            createDeterministicArchive(staged, plan.archivePath);
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    }
+    return { sourceRoot, payloadRoot, plans, dryRun: false };
+}
+//# sourceMappingURL=standalone-packager.js.map

package/dist/src/resources/cache-cleanup.js

@@ -0,0 +1,67 @@
+import fs from "node:fs";
+import path from "node:path";
+import { getResourceCacheRoot } from "./web-release.js";
+import { readResourceLockfile } from "./lockfile.js";
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+function lockedReleaseKeys(projectDir) {
+    const lockfile = readResourceLockfile(projectDir);
+    const locked = new Set();
+    for (const resource of Object.values(lockfile?.resources ?? {})) {
+        locked.add(`${resource.version}/${resource.manifestSha256}`);
+    }
+    return locked;
+}
+function releaseGenerations(cacheRoot) {
+    const releasesRoot = path.join(cacheRoot, "releases");
+    const skipped = [];
+    const entries = [];
+    if (!fs.existsSync(releasesRoot))
+        return { entries, skipped };
+    for (const versionEntry of fs.readdirSync(releasesRoot, { withFileTypes: true })) {
+        const versionPath = path.join(releasesRoot, versionEntry.name);
+        if (!versionEntry.isDirectory()) {
+            skipped.push({ path: versionPath, reason: "not a directory" });
+            continue;
+        }
+        for (const digestEntry of fs.readdirSync(versionPath, { withFileTypes: true })) {
+            const generationPath = path.join(versionPath, digestEntry.name);
+            if (!digestEntry.isDirectory()) {
+                skipped.push({ path: generationPath, reason: "not a directory" });
+                continue;
+            }
+            if (!SHA256_PATTERN.test(digestEntry.name)) {
+                skipped.push({ path: generationPath, reason: "not a release digest generation" });
+                continue;
+            }
+            entries.push({
+                version: versionEntry.name,
+                manifestSha256: digestEntry.name,
+                path: generationPath,
+            });
+        }
+    }
+    entries.sort((left, right) => left.version.localeCompare(right.version) || left.manifestSha256.localeCompare(right.manifestSha256));
+    return { entries, skipped };
+}
+export function cleanWebResourceCache(projectDir, options = {}) {
+    const cacheRoot = getResourceCacheRoot(options.cacheRoot);
+    const dryRun = options.dryRun === true;
+    const force = options.force === true;
+    const lockedKeys = lockedReleaseKeys(projectDir);
+    const { entries, skipped } = releaseGenerations(cacheRoot);
+    const locked = entries.filter((entry) => lockedKeys.has(`${entry.version}/${entry.manifestSha256}`));
+    const preserved = [];
+    const removed = [];
+    for (const entry of entries) {
+        const isLocked = lockedKeys.has(`${entry.version}/${entry.manifestSha256}`);
+        if (isLocked && !force) {
+            preserved.push(entry);
+            continue;
+        }
+        removed.push(entry);
+        if (!dryRun)
+            fs.rmSync(entry.path, { recursive: true, force: true });
+    }
+    return { cacheRoot, dryRun, force, locked, removed, preserved, skipped };
+}
+//# sourceMappingURL=cache-cleanup.js.map