@detergent-software/atk 8.8.1 → 8.9.0-dev.10

package/build/lib/schemas/lockfile.d.ts

@@ -1,31 +1,157 @@
 import { z } from 'zod';
-export declare const InstalledFile: z.ZodObject<{
-    checksum: z.ZodString;
-    installedPath: z.ZodOptional<z.ZodString>;
-    sourcePath: z.ZodString;
-}, z.core.$strip>;
-export type InstalledFile = z.infer<typeof InstalledFile>;
+/** The schemas built with `z.object`, for the exported types: a misspelt key in an `InstalledAsset` literal fails to compile. */
+type Known = ReturnType<typeof lockfileSchemas<z.core.$strip>>;
+/** `z.object` (drops keys it doesn't know) or `z.looseObject` (keeps them), for {@link lockfileSchemas}. */
+type ObjectOf<Config extends z.core.$ZodObjectConfig> = <Shape extends z.core.$ZodLooseShape>(shape: Shape) => z.ZodObject<Shape, Config>;
+declare function lockfileSchemas<Config extends z.core.$ZodObjectConfig>(object: ObjectOf<Config>): {
+    ConfigEntry: z.ZodObject<{
+        checksum: z.ZodString;
+        checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
+        command: z.ZodOptional<z.ZodString>;
+        file: z.ZodString;
+        key: z.ZodString;
+        tool: z.ZodOptional<z.ZodString>;
+    }, Config>;
+    InstalledAsset: z.ZodObject<{
+        bundleOrigin: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            org: z.ZodOptional<z.ZodString>;
+            version: z.ZodString;
+        }, Config>>;
+        configEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            checksum: z.ZodString;
+            checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
+            command: z.ZodOptional<z.ZodString>;
+            file: z.ZodString;
+            key: z.ZodString;
+            tool: z.ZodOptional<z.ZodString>;
+        }, Config>>>;
+        dependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            org: z.ZodOptional<z.ZodString>;
+            type: z.ZodEnum<{
+                skill: "skill";
+                agent: "agent";
+                rule: "rule";
+                hook: "hook";
+                "memory-template": "memory-template";
+                "mcp-config": "mcp-config";
+            }>;
+            version: z.ZodOptional<z.ZodString>;
+        }, Config>>>;
+        description: z.ZodOptional<z.ZodString>;
+        entrypoint: z.ZodOptional<z.ZodString>;
+        excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        files: z.ZodArray<z.ZodObject<{
+            checksum: z.ZodString;
+            installedPath: z.ZodOptional<z.ZodString>;
+            sourcePath: z.ZodString;
+        }, Config>>;
+        installReason: z.ZodOptional<z.ZodEnum<{
+            direct: "direct";
+            dependency: "dependency";
+        }>>;
+        name: z.ZodString;
+        org: z.ZodOptional<z.ZodString>;
+        pinnedVersion: z.ZodOptional<z.ZodString>;
+        type: z.ZodEnum<{
+            skill: "skill";
+            agent: "agent";
+            rule: "rule";
+            hook: "hook";
+            "memory-template": "memory-template";
+            "mcp-config": "mcp-config";
+        }>;
+        undeclaredTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        userConfigDirs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        version: z.ZodString;
+    }, Config>;
+    InstalledFile: z.ZodObject<{
+        checksum: z.ZodString;
+        installedPath: z.ZodOptional<z.ZodString>;
+        sourcePath: z.ZodString;
+    }, Config>;
+    LockfileSchema: z.ZodObject<{
+        assets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            bundleOrigin: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                org: z.ZodOptional<z.ZodString>;
+                version: z.ZodString;
+            }, Config>>;
+            configEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                checksum: z.ZodString;
+                checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
+                command: z.ZodOptional<z.ZodString>;
+                file: z.ZodString;
+                key: z.ZodString;
+                tool: z.ZodOptional<z.ZodString>;
+            }, Config>>>;
+            dependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                org: z.ZodOptional<z.ZodString>;
+                type: z.ZodEnum<{
+                    skill: "skill";
+                    agent: "agent";
+                    rule: "rule";
+                    hook: "hook";
+                    "memory-template": "memory-template";
+                    "mcp-config": "mcp-config";
+                }>;
+                version: z.ZodOptional<z.ZodString>;
+            }, Config>>>;
+            description: z.ZodOptional<z.ZodString>;
+            entrypoint: z.ZodOptional<z.ZodString>;
+            excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            files: z.ZodArray<z.ZodObject<{
+                checksum: z.ZodString;
+                installedPath: z.ZodOptional<z.ZodString>;
+                sourcePath: z.ZodString;
+            }, Config>>;
+            installReason: z.ZodOptional<z.ZodEnum<{
+                direct: "direct";
+                dependency: "dependency";
+            }>>;
+            name: z.ZodString;
+            org: z.ZodOptional<z.ZodString>;
+            pinnedVersion: z.ZodOptional<z.ZodString>;
+            type: z.ZodEnum<{
+                skill: "skill";
+                agent: "agent";
+                rule: "rule";
+                hook: "hook";
+                "memory-template": "memory-template";
+                "mcp-config": "mcp-config";
+            }>;
+            undeclaredTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            userConfigDirs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            version: z.ZodString;
+        }, Config>>>;
+        lockVersion: z.ZodLiteral<1>;
+        org: z.ZodOptional<z.ZodString>;
+        orgReviewers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, Config>;
+};
 export declare const ConfigEntry: z.ZodObject<{
     checksum: z.ZodString;
+    checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
     command: z.ZodOptional<z.ZodString>;
     file: z.ZodString;
     key: z.ZodString;
     tool: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type ConfigEntry = z.infer<typeof ConfigEntry>;
-export declare const InstalledAsset: z.ZodObject<{
+}, z.core.$loose>, InstalledAsset: z.ZodObject<{
     bundleOrigin: z.ZodOptional<z.ZodObject<{
         name: z.ZodString;
         org: z.ZodOptional<z.ZodString>;
         version: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
     configEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
         checksum: z.ZodString;
+        checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
         command: z.ZodOptional<z.ZodString>;
         file: z.ZodString;
         key: z.ZodString;
         tool: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
+    }, z.core.$loose>>>;
     dependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         org: z.ZodOptional<z.ZodString>;
@@ -38,7 +164,7 @@ export declare const InstalledAsset: z.ZodObject<{
             "mcp-config": "mcp-config";
         }>;
         version: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
+    }, z.core.$loose>>>;
     description: z.ZodOptional<z.ZodString>;
     entrypoint: z.ZodOptional<z.ZodString>;
     excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -46,7 +172,7 @@ export declare const InstalledAsset: z.ZodObject<{
         checksum: z.ZodString;
         installedPath: z.ZodOptional<z.ZodString>;
         sourcePath: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
     installReason: z.ZodOptional<z.ZodEnum<{
         direct: "direct";
         dependency: "dependency";
@@ -65,22 +191,25 @@ export declare const InstalledAsset: z.ZodObject<{
     undeclaredTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     userConfigDirs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     version: z.ZodString;
-}, z.core.$strip>;
-export type InstalledAsset = z.infer<typeof InstalledAsset>;
-export declare const LockfileSchema: z.ZodObject<{
+}, z.core.$loose>, InstalledFile: z.ZodObject<{
+    checksum: z.ZodString;
+    installedPath: z.ZodOptional<z.ZodString>;
+    sourcePath: z.ZodString;
+}, z.core.$loose>, LockfileSchema: z.ZodObject<{
     assets: z.ZodOptional<z.ZodArray<z.ZodObject<{
         bundleOrigin: z.ZodOptional<z.ZodObject<{
             name: z.ZodString;
             org: z.ZodOptional<z.ZodString>;
             version: z.ZodString;
-        }, z.core.$strip>>;
+        }, z.core.$loose>>;
         configEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
             checksum: z.ZodString;
+            checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
             command: z.ZodOptional<z.ZodString>;
             file: z.ZodString;
             key: z.ZodString;
             tool: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>>;
+        }, z.core.$loose>>>;
         dependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
             name: z.ZodString;
             org: z.ZodOptional<z.ZodString>;
@@ -93,7 +222,7 @@ export declare const LockfileSchema: z.ZodObject<{
                 "mcp-config": "mcp-config";
             }>;
             version: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>>;
+        }, z.core.$loose>>>;
         description: z.ZodOptional<z.ZodString>;
         entrypoint: z.ZodOptional<z.ZodString>;
         excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -101,7 +230,7 @@ export declare const LockfileSchema: z.ZodObject<{
             checksum: z.ZodString;
             installedPath: z.ZodOptional<z.ZodString>;
             sourcePath: z.ZodString;
-        }, z.core.$strip>>;
+        }, z.core.$loose>>;
         installReason: z.ZodOptional<z.ZodEnum<{
             direct: "direct";
             dependency: "dependency";
@@ -120,10 +249,14 @@ export declare const LockfileSchema: z.ZodObject<{
         undeclaredTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         userConfigDirs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         version: z.ZodString;
-    }, z.core.$strip>>>;
+    }, z.core.$loose>>>;
     lockVersion: z.ZodLiteral<1>;
     org: z.ZodOptional<z.ZodString>;
     orgReviewers: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-export type Lockfile = z.infer<typeof LockfileSchema>;
+}, z.core.$loose>;
+export type ConfigEntry = z.infer<Known['ConfigEntry']>;
+export type InstalledAsset = z.infer<Known['InstalledAsset']>;
+export type InstalledFile = z.infer<Known['InstalledFile']>;
+export type Lockfile = z.infer<Known['LockfileSchema']>;
+export {};
 //# sourceMappingURL=lockfile.d.ts.map

package/build/lib/schemas/lockfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../../src/lib/schemas/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,aAAa;;;;iBASxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,WAAW;;;;;;iBAoBtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwDzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../../src/lib/schemas/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,iIAAiI;AACjI,KAAK,KAAK,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAE/D,4GAA4G;AAC5G,KAAK,QAAQ,CAAC,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,EAC1F,KAAK,EAAE,KAAK,KACT,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAEhC,iBAAS,eAAe,CAAC,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyHxF;AAID,eAAO,MAAQ,WAAW;;;;;;;mBAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAAE,aAAa;;;;mBAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAExE,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAC5D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC"}

package/build/lib/schemas/lockfile.js

@@ -1,82 +1,103 @@
 import { z } from 'zod';
 import { AssetTypeSchema as AssetType } from '../atk-schemas/index.js';
-export const InstalledFile = z.object({
-    checksum: z.string().describe('SHA-256 checksum of the file contents'),
-    installedPath: z
-        .string()
-        .optional()
-        .describe('Project-relative POSIX path to where the file was installed (computed via adapter for legacy entries); absolute at the user scope when the tool’s config directory is on another drive than the user root'),
-    sourcePath: z.string().describe('Original path within the asset directory'),
-});
-export const ConfigEntry = z.object({
-    checksum: z.string().describe('SHA-256 hex digest of the config entry value'),
-    command: z
-        .string()
-        .optional()
-        .describe('For array-valued config sections (e.g. hooks.<Event>): identifies the array element this asset owns by its nested hooks[].command value'),
-    file: z
-        .string()
-        .describe('Project-relative POSIX path to the config file; absolute at the user scope when the tool’s config directory is on another drive than the user root'),
-    key: z.string().describe('Dot-path key within the config file (e.g. hooks.Stop)'),
-    tool: z
-        .string()
-        .optional()
-        .describe('Tool adapter id (e.g. claude-code) that registered this entry. Absent on entries written by older CLI versions; ownership is then inferred from the config file path'),
-});
-export const InstalledAsset = z.object({
-    bundleOrigin: z
-        .object({
-        name: z.string().describe('Bundle name that sourced this asset'),
-        org: z.string().optional().describe('Organization scope of the bundle (absent for global bundles)'),
-        version: z.string().describe('Bundle version at install time'),
-    })
-        .optional()
-        .describe('Bundle that triggered this asset installation'),
-    configEntries: z.array(ConfigEntry).optional().describe('Config file entries registered by this asset'),
-    dependencies: z
-        .array(z.object({
-        name: z.string().describe('Dependency asset name'),
-        org: z.string().optional().describe('Organization scope of the dependency'),
-        type: AssetType.describe('Dependency asset type'),
-        version: z.string().optional().describe('Dependency version constraint at install time'),
-    }))
-        .optional()
-        .describe('Assets this asset depends on'),
-    description: z.string().optional().describe('Short description of the asset'),
-    entrypoint: z
-        .string()
-        .optional()
-        .describe('Primary file for this asset (relative to the asset directory), from the manifest — used to resolve adapter placement paths'),
-    excludedTools: z
-        .array(z.string())
-        .optional()
-        .describe('Tool adapter ids (e.g. codex-cli) this asset was explicitly uninstalled for, or that a hook was skipped for because its manifest does not declare them (those are also in undeclaredTools). Sync, audit and update skip the asset for these tools; installing it for a tool removes that tool again. Absent means the asset is wanted for every tool'),
-    files: z.array(InstalledFile).describe('Files placed by this asset'),
-    installReason: z
-        .enum(['direct', 'dependency'])
-        .optional()
-        .describe('Whether the user explicitly installed this or it was pulled in as a dependency'),
-    name: z.string().describe('Asset name'),
-    org: z.string().optional().describe('Organization scope for this asset'),
-    pinnedVersion: z.string().optional().describe('Pinned version constraint, if the asset is version-pinned'),
-    type: AssetType.describe('Asset type'),
-    undeclaredTools: z
-        .array(z.string())
-        .optional()
-        .describe('The tools in excludedTools that a hook was skipped for because its manifest does not declare them, not uninstalled for. Sync and update place the hook for such a tool once its version declares it'),
-    userConfigDirs: z
-        .record(z.string(), z.string())
-        .optional()
-        .describe('User scope only: per tool adapter id, the directory its `userConfigDir.env` (e.g. CLAUDE_CONFIG_DIR) had moved the tool’s user config to when ATK placed this asset, relative to the user root (e.g. { "claude-code": "../cc" }), or absolute when it is on another drive (e.g. "D:/cc"). A tool missing here placed it in its default directory. Uninstall, sync and audit find the tool’s copy there'),
-    version: z.string().describe('Installed version'),
-});
-export const LockfileSchema = z.object({
-    assets: z.array(InstalledAsset).optional().describe('Currently installed assets'),
-    lockVersion: z.literal(1).describe('Lock file format version'),
-    org: z.string().optional().describe('Organization scope for this lockfile'),
-    orgReviewers: z
-        .array(z.string())
-        .optional()
-        .describe('GitHub usernames auto-requested as PR reviewers for org-scoped asset publishes'),
-});
+import { ASSET_FILE_PATH, PATH_SEGMENT } from '../root-path.js';
+function lockfileSchemas(object) {
+    const InstalledFile = object({
+        checksum: z.string().describe('SHA-256 checksum of the file contents'),
+        installedPath: z
+            .string()
+            .optional()
+            .describe('Project-relative POSIX path to where the file was installed (computed via adapter for legacy entries); absolute at the user scope when the tool’s config directory is on another drive than the user root'),
+        sourcePath: z
+            .string()
+            .regex(ASSET_FILE_PATH, 'must be a relative path inside the asset directory, with no ".." segment')
+            .describe('Original path within the asset directory'),
+    });
+    const ConfigEntry = object({
+        checksum: z.string().describe('SHA-256 hex digest of the config entry value'),
+        checksumVersion: z
+            .literal(2)
+            .optional()
+            .describe('How the checksum was computed: 2 hashes the value with keys sorted at every depth. Absent on entries written by older CLI versions, whose digest ignores nested keys; the next sync records them again as 2. Hook groups (entries with a command) always hash every depth and ignore it'),
+        command: z
+            .string()
+            .optional()
+            .describe('For array-valued config sections (e.g. hooks.<Event>): identifies the array element this asset owns by its nested hooks[].command value'),
+        file: z
+            .string()
+            .describe('Project-relative POSIX path to the config file; absolute at the user scope when the tool’s config directory is on another drive than the user root'),
+        key: z.string().describe('Dot-path key within the config file (e.g. hooks.Stop)'),
+        tool: z
+            .string()
+            .optional()
+            .describe('Tool adapter id (e.g. claude-code) that registered this entry. Absent on entries written by older CLI versions; ownership is then inferred from the config file path'),
+    });
+    const InstalledAsset = object({
+        bundleOrigin: object({
+            name: z.string().describe('Bundle name that sourced this asset'),
+            org: z.string().optional().describe('Organization scope of the bundle (absent for global bundles)'),
+            version: z.string().describe('Bundle version at install time'),
+        })
+            .optional()
+            .describe('Bundle that triggered this asset installation'),
+        configEntries: z.array(ConfigEntry).optional().describe('Config file entries registered by this asset'),
+        dependencies: z
+            .array(object({
+            name: z.string().describe('Dependency asset name'),
+            org: z.string().optional().describe('Organization scope of the dependency'),
+            type: AssetType.describe('Dependency asset type'),
+            version: z.string().optional().describe('Dependency version constraint at install time'),
+        }))
+            .optional()
+            .describe('Assets this asset depends on'),
+        description: z.string().optional().describe('Short description of the asset'),
+        entrypoint: z
+            .string()
+            .optional()
+            .describe('Primary file for this asset (relative to the asset directory), from the manifest — used to resolve adapter placement paths'),
+        excludedTools: z
+            .array(z.string())
+            .optional()
+            .describe('Tool adapter ids (e.g. codex-cli) this asset was explicitly uninstalled for, or that a hook was skipped for because its manifest does not declare them (those are also in undeclaredTools). Sync, audit and update skip the asset for these tools; installing it for a tool removes that tool again. Absent means the asset is wanted for every tool'),
+        files: z.array(InstalledFile).describe('Files placed by this asset'),
+        installReason: z
+            .enum(['direct', 'dependency'])
+            .optional()
+            .describe('Whether the user explicitly installed this or it was pulled in as a dependency'),
+        name: z
+            .string()
+            .regex(PATH_SEGMENT, 'must be one path segment: no "/" or "\\", and not "." or ".."')
+            .describe('Asset name'),
+        org: z.string().optional().describe('Organization scope for this asset'),
+        pinnedVersion: z.string().optional().describe('Pinned version constraint, if the asset is version-pinned'),
+        type: AssetType.describe('Asset type'),
+        undeclaredTools: z
+            .array(z.string())
+            .optional()
+            .describe('The tools in excludedTools that a hook was skipped for because its manifest does not declare them, not uninstalled for. Sync and update place the hook for such a tool once its version declares it'),
+        userConfigDirs: z
+            .record(z.string(), z.string())
+            .optional()
+            .describe('User scope only: per tool adapter id, the directory its `userConfigDir.env` (e.g. CLAUDE_CONFIG_DIR) had moved the tool’s user config to when ATK placed this asset, relative to the user root (e.g. { "claude-code": "../cc" }), or absolute when it is on another drive (e.g. "D:/cc"). A tool missing here placed it in its default directory. Uninstall, sync and audit find the tool’s copy there'),
+        version: z.string().describe('Installed version'),
+    });
+    const LockfileSchema = object({
+        assets: z.array(InstalledAsset).optional().describe('Currently installed assets'),
+        // A new field doesn't bump this: since ATK-587 a CLI keeps the keys it doesn't know, so an older
+        // one writing the lockfile leaves a newer one's fields alone. Bump it only for a change an older
+        // CLI can't read safely: every released CLI refuses anything but 1 (readLockfile names the upgrade).
+        lockVersion: z
+            .literal(1)
+            .describe('Lock file format version. Added fields keep it at 1: a CLI keeps the keys it does not know when it writes the lockfile'),
+        org: z.string().optional().describe('Organization scope for this lockfile'),
+        orgReviewers: z
+            .array(z.string())
+            .optional()
+            .describe('GitHub usernames auto-requested as PR reviewers for org-scoped asset publishes'),
+    });
+    return { ConfigEntry, InstalledAsset, InstalledFile, LockfileSchema };
+}
+// The schemas keep keys this CLI doesn't know, so a teammate on an older CLI doesn't erase a newer
+// one's fields when they write the lockfile (ATK-587). The types come from `Known`, without them.
+export const { ConfigEntry, InstalledAsset, InstalledFile, LockfileSchema } = lockfileSchemas(z.looseObject);
 //# sourceMappingURL=lockfile.js.map

package/build/lib/schemas/lockfile.js.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../../src/lib/schemas/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,IAAI,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEvE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACtE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,2MAA2M,CAC5M;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;CAC5E,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IAC7E,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yIAAyI,CAC1I;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,CACP,oJAAoJ,CACrJ;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACjF,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,sKAAsK,CACvK;CACJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;QACnG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAC/D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CAAC,+CAA+C,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IACvG,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAClD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;QAC3E,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;KACzF,CAAC,CACH;SACA,QAAQ,EAAE;SACV,QAAQ,CAAC,8BAA8B,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC7E,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,4HAA4H,CAC7H;IACH,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,sVAAsV,CACvV;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CAAC,gFAAgF,CAAC;IAC7F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;IAC1G,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;IACtC,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,qMAAqM,CACtM;IACH,cAAc,EAAE,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CACP,wYAAwY,CACzY;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACjF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAC3E,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,gFAAgF,CAAC;CAC9F,CAAC,CAAC"}
+{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../../src/lib/schemas/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,IAAI,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAUhE,SAAS,eAAe,CAAyC,MAAwB;IACvF,MAAM,aAAa,GAAG,MAAM,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QACtE,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,2MAA2M,CAC5M;QACH,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,KAAK,CAAC,eAAe,EAAE,0EAA0E,CAAC;aAClG,QAAQ,CAAC,0CAA0C,CAAC;KACxD,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,MAAM,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QAC7E,eAAe,EAAE,CAAC;aACf,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,yRAAyR,CAC1R;QACH,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,yIAAyI,CAC1I;QACH,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,CACP,oJAAoJ,CACrJ;QACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QACjF,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,sKAAsK,CACvK;KACJ,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,YAAY,EAAE,MAAM,CAAC;YACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;YACnG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;SAC/D,CAAC;aACC,QAAQ,EAAE;aACV,QAAQ,CAAC,+CAA+C,CAAC;QAC5D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QACvG,YAAY,EAAE,CAAC;aACZ,KAAK,CACJ,MAAM,CAAC;YACL,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAClD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YAC3E,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;SACzF,CAAC,CACH;aACA,QAAQ,EAAE;aACV,QAAQ,CAAC,8BAA8B,CAAC;QAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QAC7E,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,4HAA4H,CAC7H;QACH,aAAa,EAAE,CAAC;aACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE;aACV,QAAQ,CACP,sVAAsV,CACvV;QACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QACpE,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;aAC9B,QAAQ,EAAE;aACV,QAAQ,CAAC,gFAAgF,CAAC;QAC7F,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,KAAK,CAAC,YAAY,EAAE,+DAA+D,CAAC;aACpF,QAAQ,CAAC,YAAY,CAAC;QACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;QAC1G,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,eAAe,EAAE,CAAC;aACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE;aACV,QAAQ,CACP,qMAAqM,CACtM;QACH,cAAc,EAAE,CAAC;aACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,EAAE;aACV,QAAQ,CACP,wYAAwY,CACzY;QACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;KAClD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QACjF,iGAAiG;QACjG,iGAAiG;QACjG,qGAAqG;QACrG,WAAW,EAAE,CAAC;aACX,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CACP,wHAAwH,CACzH;QACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;QAC3E,YAAY,EAAE,CAAC;aACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE;aACV,QAAQ,CAAC,gFAAgF,CAAC;KAC9F,CAAC,CAAC;IAEH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AACxE,CAAC;AAED,mGAAmG;AACnG,kGAAkG;AAClG,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,eAAe,CAC3F,CAAC,CAAC,WAAW,CACd,CAAC"}

package/build/lib/staging.d.ts

@@ -0,0 +1,15 @@
+import type { Adapter } from './schemas/adapter.js';
+import type { InstalledAsset } from './schemas/index.js';
+/** Copy each file into the staging directory `dir` at its relative path `to`, creating folders as needed. */
+export declare function copyIntoStaging(dir: string, files: readonly {
+    from: string;
+    to: string;
+}[]): Promise<void>;
+/** A new, empty `atk-publish-*` directory in the OS temp folder, for a publish to stage its files in. The caller removes it. */
+export declare function createStagingDir(): Promise<string>;
+/**
+ * Copy an installed asset's files from the project into a new staging directory, at
+ * their source paths. The directory is removed again if a copy fails.
+ */
+export declare function stageInstalledFiles(installed: InstalledAsset, adapter: Adapter, projectRoot: string): Promise<string>;
+//# sourceMappingURL=staging.d.ts.map

package/build/lib/staging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staging.d.ts","sourceRoot":"","sources":["../../src/lib/staging.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIzD,6GAA6G;AAC7G,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhH;AAED,gIAAgI;AAChI,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAExD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB"}

package/build/lib/staging.js

@@ -0,0 +1,33 @@
+import { cp, mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { resolveInstalledPaths } from './adapter.js';
+/** Copy each file into the staging directory `dir` at its relative path `to`, creating folders as needed. */
+export async function copyIntoStaging(dir, files) {
+    for (const file of files) {
+        const destPath = join(dir, file.to);
+        await mkdir(dirname(destPath), { recursive: true });
+        await cp(file.from, destPath);
+    }
+}
+/** A new, empty `atk-publish-*` directory in the OS temp folder, for a publish to stage its files in. The caller removes it. */
+export async function createStagingDir() {
+    return mkdtemp(join(tmpdir(), 'atk-publish-'));
+}
+/**
+ * Copy an installed asset's files from the project into a new staging directory, at
+ * their source paths. The directory is removed again if a copy fails.
+ */
+export async function stageInstalledFiles(installed, adapter, projectRoot) {
+    const dir = await createStagingDir();
+    try {
+        const resolved = resolveInstalledPaths(installed, adapter, projectRoot);
+        await copyIntoStaging(dir, resolved.files.map((file) => ({ from: join(projectRoot, file.installedPath), to: file.sourcePath })));
+    }
+    catch (err) {
+        await rm(dir, { force: true, recursive: true });
+        throw err;
+    }
+    return dir;
+}
+//# sourceMappingURL=staging.js.map

package/build/lib/staging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staging.js","sourceRoot":"","sources":["../../src/lib/staging.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAK1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,KAA8C;IAC/F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,gIAAgI;AAChI,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAyB,EACzB,OAAgB,EAChB,WAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACxE,MAAM,eAAe,CACnB,GAAG,EACH,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CACrG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/build/lib/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/lib/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAc5D,OAAO,EAGL,KAAK,aAAa,EAElB,WAAW,EAEZ,MAAM,aAAa,CAAC;AAiBrB,OAAO,EAAE,KAAK,KAAK,EAAiB,MAAM,YAAY,CAAC;AAOvD,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,aAAa,EAAE,IAAI,GAAG,aAAa,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB;;;;OAIG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,aAAa,EAAE,IAAI,GAAG,aAAa,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,iFAAiF;IACjF,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,aAAa,EAAE,IAAI,GAAG,aAAa,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,cAAc,CAAC;IACtB,kFAAkF;IAClF,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;IACpD,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GACnB;IACE,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,QAAQ,CAAC;IAClB,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,GACD;IACE,OAAO,EAAE,SAAS,CAAC;IACnB,0DAA0D;IAC1D,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;CACjC,CAAC;AAMN,oFAAoF;AACpF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,sGAAsG;IACtG,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,8GAA8G;IAC9G,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sGAAsG;IACtG,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,SAAU,SAAQ,WAAW;IAC/B,IAAI,SAAe;CAC7B;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAoIjH;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoExF;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA8MtF"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/lib/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAY,MAAM,uBAAuB,CAAC;AAetE,OAAO,EAGL,KAAK,aAAa,EAElB,WAAW,EAEZ,MAAM,aAAa,CAAC;AAiBrB,OAAO,EAAE,KAAK,KAAK,EAAiB,MAAM,YAAY,CAAC;AAOvD,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,aAAa,EAAE,IAAI,GAAG,aAAa,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB;;;;OAIG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,aAAa,EAAE,IAAI,GAAG,aAAa,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,iFAAiF;IACjF,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,aAAa,EAAE,IAAI,GAAG,aAAa,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,cAAc,CAAC;IACtB,kFAAkF;IAClF,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;IACpD,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GACnB;IACE,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,QAAQ,CAAC;IAClB,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,GACD;IACE,OAAO,EAAE,SAAS,CAAC;IACnB,0DAA0D;IAC1D,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;CACjC,CAAC;AAMN,oFAAoF;AACpF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,sGAAsG;IACtG,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,8GAA8G;IAC9G,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sGAAsG;IACtG,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,SAAU,SAAQ,WAAW;IAC/B,IAAI,SAAe;CAC7B;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAoIjH;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoExF;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAgNtF"}

package/build/lib/sync.js

@@ -1,6 +1,7 @@
 import { configDirMove, resolveInstalledPaths } from './adapter.js';
 import { declarationAllows, excludeToolFromAsset, isExcludedAtVersion, isExcludedForTool, supportsType, withToolExcluded, } from './asset-tools.js';
 import { getCredential } from './auth.js';
+import { upgradeConfigEntryChecksums } from './checksum.js';
 import { getConfigEntriesForTool, needsConfigRegistration, staleHookCommandEntries } from './config-entries.js';
 import { isFrozenInConfig } from './config.js';
 import { asSentence, errorGuidance, errorMessage, GuidedError, isRunWideFailure, } from './errors.js';
@@ -405,6 +406,7 @@ export async function syncAssets(options) {
             if (notAttempted)
                 break;
         }
+        lockfile = await upgradeLegacyConfigChecksums(lockfile, projectDir, onProgress);
         // Write the lockfile once at the end to persist any in-memory mutations
         // (e.g., restored entries from failed reinstalls)
         await writeLockfile(projectDir, lockfile);
@@ -434,4 +436,30 @@ function scopeSwitchError(registry, entry, scope) {
 function toSyncRemoval({ name, org, type }) {
     return { name, ...(org ? { org } : {}), type };
 }
+/**
+ * Record each config entry an older CLI checksummed without its nested keys again with a deep
+ * checksum (see {@link upgradeConfigEntryChecksums}), for every asset and tool, so audit and sync
+ * see later edits to an MCP server's `env` or `headers`. An entry whose value no longer matches
+ * its legacy digest is left as it is: it was edited, and audit still reports it.
+ */
+async function upgradeLegacyConfigChecksums(lockfile, projectDir, onProgress) {
+    if (!lockfile.assets)
+        return lockfile;
+    let upgraded = 0;
+    const assets = [];
+    for (const asset of lockfile.assets) {
+        const recorded = asset.configEntries;
+        if (!recorded) {
+            assets.push(asset);
+            continue;
+        }
+        const configEntries = await upgradeConfigEntryChecksums(recorded, projectDir);
+        upgraded += configEntries.filter((entry, index) => entry !== recorded[index]).length;
+        assets.push({ ...asset, configEntries });
+    }
+    if (upgraded === 0)
+        return lockfile;
+    onProgress?.(`Recorded deep checksums for ${upgraded} config ${upgraded === 1 ? 'entry' : 'entries'}`);
+    return { ...lockfile, assets };
+}
 //# sourceMappingURL=sync.js.map