@ghaniy_fadhil/skill-manager 0.0.0-stage → 0.1.0

package/dist/server.js

@@ -0,0 +1,4490 @@
+import { randomBytes, timingSafeEqual, randomUUID, createHash } from 'crypto';
+import { existsSync } from 'fs';
+import { createServer as createServer$1 } from 'http';
+import path2, { dirname, join, extname } from 'path';
+import { fileURLToPath } from 'url';
+import { getRequestListener } from '@hono/node-server';
+import * as fsp from 'fs/promises';
+import { readFile } from 'fs/promises';
+import { homedir } from 'os';
+import { serveStatic } from '@hono/node-server/serve-static';
+import { Hono } from 'hono';
+import { setCookie, getCookie } from 'hono/cookie';
+import { execFile } from 'child_process';
+import { z } from 'zod';
+import { crc32, inflateRawSync } from 'zlib';
+
+// src/server/index.ts
+
+// package.json
+var package_default = {
+  version: "0.1.0"};
+
+// src/core/errors.ts
+var SkillManagerError = class extends Error {
+  code;
+  details;
+  constructor({ code, message, details }) {
+    super(message);
+    this.name = "SkillManagerError";
+    this.code = code;
+    if (details !== void 0) {
+      this.details = details;
+    }
+  }
+};
+var DATA_ROOT_ENV = "SKILL_MANAGER_DATA_ROOT";
+function platformPath(platform) {
+  return platform === "win32" ? path2.win32 : path2.posix;
+}
+function resolveDataRoot(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const nodePath = platformPath(platform);
+  const override = env[DATA_ROOT_ENV]?.trim();
+  if (override) {
+    return nodePath.resolve(override);
+  }
+  const home = options.homedir ?? homedir();
+  if (platform === "win32") {
+    const localAppData = env.LOCALAPPDATA?.trim() || nodePath.join(home, "AppData", "Local");
+    return nodePath.join(localAppData, "SkillManager");
+  }
+  const dataHome = env.XDG_DATA_HOME?.trim() || nodePath.join(home, ".local", "share");
+  return nodePath.join(dataHome, "skillmanager");
+}
+function libraryRoot(dataRoot, platform = process.platform) {
+  return platformPath(platform).join(dataRoot, "library");
+}
+function adaptersRoot(dataRoot, platform = process.platform) {
+  return platformPath(platform).join(dataRoot, "adapters");
+}
+function depsRoot(dataRoot, platform = process.platform) {
+  return platformPath(platform).join(dataRoot, "deps");
+}
+function statePath(dataRoot, platform = process.platform) {
+  return platformPath(platform).join(dataRoot, "state.json");
+}
+
+// src/fs/types.ts
+function fsOk(value) {
+  return { ok: true, value };
+}
+function fsError(code, path23, message, cause) {
+  if (cause === void 0) {
+    return { code, path: path23, message };
+  }
+  return { code, path: path23, message, cause };
+}
+function fsErr(code, path23, message, cause) {
+  return { ok: false, error: fsError(code, path23, message, cause) };
+}
+function isExecutable(stat2) {
+  return (stat2.mode & 73) !== 0;
+}
+
+// src/fs/guard.ts
+function isPathInside(parent, child) {
+  const relative = path2.relative(path2.resolve(parent), path2.resolve(child));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
+}
+function isSamePath(left, right) {
+  return path2.relative(path2.resolve(left), path2.resolve(right)) === "";
+}
+async function guardStorePath(fs, storeRoot, targetPath, options = {}) {
+  if (!path2.isAbsolute(storeRoot) || !path2.isAbsolute(targetPath)) {
+    return fsErr("invalid_path", targetPath, "Path Store dan target harus absolut.");
+  }
+  const storeLexical = path2.resolve(storeRoot);
+  const targetLexical = path2.resolve(targetPath);
+  if (!isPathInside(storeLexical, targetLexical)) {
+    return fsErr("unsafe_path", targetPath, "Target berada di luar Store yang diharapkan.");
+  }
+  const storeReal = await fs.realpath(storeLexical);
+  if (!storeReal.ok) {
+    return storeReal;
+  }
+  const targetLstat = await fs.lstat(targetLexical);
+  if (targetLstat.ok) {
+    const targetReal = await fs.realpath(targetLexical);
+    if (!targetReal.ok) {
+      if (targetReal.error.code === "not_found") {
+        return fsErr(
+          "unsafe_symlink",
+          targetPath,
+          "Target adalah tautan menggantung; operasi ditolak.",
+          targetReal.error
+        );
+      }
+      return targetReal;
+    }
+    if (!isPathInside(storeReal.value, targetReal.value)) {
+      return fsErr("unsafe_path", targetPath, "Target menunjuk keluar dari Store melalui tautan.");
+    }
+    return fsOk({
+      path: targetLexical,
+      realPath: targetReal.value,
+      symlink: targetLstat.value.kind === "symlink"
+    });
+  }
+  if (targetLstat.error.code !== "not_found") {
+    return targetLstat;
+  }
+  if (options.mustExist === true) {
+    return targetLstat;
+  }
+  const missing = [];
+  let ancestor = targetLexical;
+  while (true) {
+    const ancestorLstat = await fs.lstat(ancestor);
+    if (ancestorLstat.ok) {
+      break;
+    }
+    if (ancestorLstat.error.code !== "not_found") {
+      return ancestorLstat;
+    }
+    const parent = path2.dirname(ancestor);
+    if (parent === ancestor) {
+      return fsErr("not_found", targetPath, "Tidak ada leluhur yang bisa diverifikasi.");
+    }
+    missing.unshift(path2.basename(ancestor));
+    ancestor = parent;
+  }
+  const ancestorReal = await fs.realpath(ancestor);
+  if (!ancestorReal.ok) {
+    return fsErr(
+      "unsafe_symlink",
+      targetPath,
+      "Leluhur target adalah tautan menggantung; operasi ditolak.",
+      ancestorReal.error
+    );
+  }
+  if (!isPathInside(storeReal.value, ancestorReal.value)) {
+    return fsErr(
+      "unsafe_path",
+      targetPath,
+      "Leluhur target menunjuk keluar dari Store melalui tautan."
+    );
+  }
+  return fsOk({
+    path: targetLexical,
+    realPath: path2.join(ancestorReal.value, ...missing),
+    symlink: false
+  });
+}
+async function removeWithinStore(fs, storeRoot, targetPath) {
+  if (!path2.isAbsolute(storeRoot) || !path2.isAbsolute(targetPath)) {
+    return fsErr("invalid_path", targetPath, "Path Store dan target harus absolut.");
+  }
+  if (isSamePath(storeRoot, targetPath)) {
+    return fsErr("invalid_path", targetPath, "Store itu sendiri tidak boleh dihapus.");
+  }
+  const guarded = await guardStorePath(fs, storeRoot, targetPath, { mustExist: true });
+  if (!guarded.ok) {
+    return guarded;
+  }
+  return fs.remove(guarded.value.path, { recursive: true });
+}
+
+// src/fs/node.ts
+var ERROR_CODES = {
+  EACCES: "permission_denied",
+  EPERM: "permission_denied",
+  EEXIST: "already_exists",
+  EISDIR: "is_a_directory",
+  ELOOP: "symlink_loop",
+  ENAMETOOLONG: "invalid_path",
+  ENOENT: "not_found",
+  ENOTDIR: "not_a_directory",
+  ENOTEMPTY: "not_empty",
+  EINVAL: "invalid_path",
+  EXDEV: "io_error"
+};
+function nodeErrno(error) {
+  return error?.code;
+}
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function toFsError(error, targetPath, message) {
+  const code = ERROR_CODES[nodeErrno(error) ?? ""] ?? "io_error";
+  return {
+    code,
+    path: targetPath,
+    message: message ?? `Operasi filesystem gagal: ${describe(error)}`,
+    cause: error
+  };
+}
+function kindOf(stats) {
+  if (stats.isSymbolicLink()) {
+    return "symlink";
+  }
+  if (stats.isDirectory()) {
+    return "directory";
+  }
+  if (stats.isFile()) {
+    return "file";
+  }
+  return "other";
+}
+function statOf(stats) {
+  return {
+    kind: kindOf(stats),
+    size: stats.size,
+    mode: stats.mode,
+    mtimeMs: stats.mtimeMs
+  };
+}
+function entryKindOf(stats) {
+  const kind = kindOf(stats);
+  return kind === "file" || kind === "directory" ? kind : "other";
+}
+var NodeFileSystem = class {
+  async read(targetPath) {
+    try {
+      const data = await fsp.readFile(targetPath);
+      return fsOk(new Uint8Array(data));
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+  }
+  async readText(targetPath) {
+    const bytes = await this.read(targetPath);
+    if (!bytes.ok) {
+      return bytes;
+    }
+    try {
+      return fsOk(new TextDecoder("utf-8", { fatal: true }).decode(bytes.value));
+    } catch (error) {
+      return fsErr("invalid_utf8", targetPath, "Isi file bukan UTF-8 yang valid.", error);
+    }
+  }
+  async write(targetPath, data, options) {
+    try {
+      await fsp.writeFile(targetPath, data, { mode: options?.mode ?? 420 });
+      return fsOk(void 0);
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+  }
+  async copy(source, destination) {
+    const sourceAbsolute = path2.resolve(source);
+    const destinationAbsolute = path2.resolve(destination);
+    const sourceReal = await this.realpath(sourceAbsolute);
+    if (!sourceReal.ok) {
+      return sourceReal;
+    }
+    const destinationParent = await this.realpath(path2.dirname(destinationAbsolute));
+    if (!destinationParent.ok) {
+      return destinationParent;
+    }
+    const destinationKey = path2.join(destinationParent.value, path2.basename(destinationAbsolute));
+    if (isPathInside(sourceReal.value, destinationParent.value)) {
+      return fsErr("invalid_path", destination, "Tidak bisa menyalin direktori ke dalam dirinya.");
+    }
+    if (await this.exists(destinationKey)) {
+      return fsErr("already_exists", destination, "Tujuan copy sudah ada.");
+    }
+    return this.copyEntry(sourceReal.value, destinationKey, sourceReal.value, /* @__PURE__ */ new Set());
+  }
+  async remove(targetPath, options) {
+    return this.removeAt(path2.resolve(targetPath), options?.recursive === true);
+  }
+  async realpath(targetPath) {
+    try {
+      return fsOk(await fsp.realpath(targetPath));
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+  }
+  async stat(targetPath) {
+    try {
+      return fsOk(statOf(await fsp.stat(targetPath)));
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+  }
+  async lstat(targetPath) {
+    try {
+      return fsOk(statOf(await fsp.lstat(targetPath)));
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+  }
+  async readdir(targetPath) {
+    try {
+      const names = await fsp.readdir(targetPath);
+      const entries = [];
+      for (const name of names) {
+        const entryPath = path2.join(targetPath, name);
+        const entryStat = await fsp.lstat(entryPath);
+        const isSymlink = entryStat.isSymbolicLink();
+        if (!isSymlink) {
+          entries.push({ name, kind: entryKindOf(entryStat), isSymlink });
+          continue;
+        }
+        try {
+          const resolved = await fsp.stat(entryPath);
+          entries.push({ name, kind: entryKindOf(resolved), isSymlink });
+        } catch (error) {
+          const code = nodeErrno(error);
+          if (code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP") {
+            entries.push({ name, kind: "dangling", isSymlink });
+            continue;
+          }
+          throw error;
+        }
+      }
+      entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+      return fsOk(entries);
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+  }
+  async mkdir(targetPath, options) {
+    try {
+      await fsp.mkdir(targetPath, { recursive: options?.recursive ?? true });
+      return fsOk(void 0);
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+  }
+  async rename(from, to) {
+    try {
+      await fsp.rename(from, to);
+      return fsOk(void 0);
+    } catch (error) {
+      return { ok: false, error: toFsError(error, to) };
+    }
+  }
+  async exists(targetPath) {
+    try {
+      await fsp.lstat(targetPath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async readlink(targetPath) {
+    try {
+      return fsOk(await fsp.readlink(targetPath));
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+  }
+  async symlink(target, linkPath, options) {
+    try {
+      let type = options?.type;
+      if (type === void 0 && process.platform === "win32") {
+        try {
+          const stats = await fsp.stat(target);
+          type = stats.isDirectory() ? "junction" : "file";
+        } catch {
+          type = "file";
+        }
+      }
+      await fsp.symlink(target, linkPath, type);
+      return fsOk(void 0);
+    } catch (error) {
+      return { ok: false, error: toFsError(error, linkPath) };
+    }
+  }
+  async copyEntry(source, destination, sourceRoot, activeDirectories) {
+    let sourceStat;
+    try {
+      sourceStat = await fsp.lstat(source);
+    } catch (error) {
+      return { ok: false, error: toFsError(error, source) };
+    }
+    if (sourceStat.isSymbolicLink()) {
+      const resolved = await this.realpath(source);
+      if (!resolved.ok) {
+        return fsErr(
+          "unsafe_symlink",
+          source,
+          "Tautan di dalam sumber tidak bisa disalin karena targetnya tidak ada.",
+          resolved.error
+        );
+      }
+      if (!isPathInside(sourceRoot, resolved.value)) {
+        return fsErr(
+          "unsafe_symlink",
+          source,
+          "Tautan di dalam sumber menunjuk keluar dari folder sumber."
+        );
+      }
+      return this.copyEntry(resolved.value, destination, sourceRoot, activeDirectories);
+    }
+    if (sourceStat.isFile()) {
+      try {
+        await fsp.copyFile(source, destination);
+        await fsp.chmod(destination, sourceStat.mode & 511);
+        return fsOk(void 0);
+      } catch (error) {
+        return { ok: false, error: toFsError(error, destination) };
+      }
+    }
+    if (!sourceStat.isDirectory()) {
+      return fsErr("io_error", source, "Jenis entri tidak didukung untuk copy.");
+    }
+    const canonical = await this.realpath(source);
+    if (!canonical.ok) {
+      return canonical;
+    }
+    if (activeDirectories.has(canonical.value)) {
+      return fsErr("symlink_loop", source, "Siklus direktori saat copy.");
+    }
+    try {
+      await fsp.mkdir(destination);
+      activeDirectories.add(canonical.value);
+      const entries = await fsp.readdir(canonical.value);
+      for (const name of entries) {
+        const copied = await this.copyEntry(
+          path2.join(canonical.value, name),
+          path2.join(destination, name),
+          sourceRoot,
+          activeDirectories
+        );
+        if (!copied.ok) {
+          activeDirectories.delete(canonical.value);
+          return copied;
+        }
+      }
+      activeDirectories.delete(canonical.value);
+      return fsOk(void 0);
+    } catch (error) {
+      return { ok: false, error: toFsError(error, destination) };
+    }
+  }
+  async removeAt(targetPath, recursive) {
+    let stats;
+    try {
+      stats = await fsp.lstat(targetPath);
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+      try {
+        await fsp.unlink(targetPath);
+        return fsOk(void 0);
+      } catch (error) {
+        return { ok: false, error: toFsError(error, targetPath) };
+      }
+    }
+    if (!recursive) {
+      try {
+        await fsp.rmdir(targetPath);
+        return fsOk(void 0);
+      } catch (error) {
+        return { ok: false, error: toFsError(error, targetPath) };
+      }
+    }
+    try {
+      const entries = await fsp.readdir(targetPath);
+      for (const name of entries) {
+        const childPath = path2.join(targetPath, name);
+        const childStats = await fsp.lstat(childPath);
+        if (childStats.isSymbolicLink()) {
+          await fsp.unlink(childPath);
+          continue;
+        }
+        const removed = await this.removeAt(childPath, true);
+        if (!removed.ok) {
+          return removed;
+        }
+      }
+      await fsp.rmdir(targetPath);
+      return fsOk(void 0);
+    } catch (error) {
+      return { ok: false, error: toFsError(error, targetPath) };
+    }
+  }
+};
+
+// src/fs/process.ts
+var DEFAULT_PROCESS_TIMEOUT_MS = 5e3;
+var DEFAULT_MAX_BUFFER_BYTES = 1024 * 1024;
+
+// src/fs/process-node.ts
+var PROCESS_ERROR_CODES = {
+  ENOENT: "process_not_found",
+  EACCES: "permission_denied",
+  EPERM: "permission_denied",
+  // Windows menolak spawn berkas `.cmd`/`.bat` tanpa shell (CVE-2024-27980).
+  // Itu bukan kegagalan I/O, jadi dipetakan ke galat proses biasa, bukan crash.
+  EINVAL: "process_failed"
+};
+function errnoOf(error) {
+  return error?.code?.toString();
+}
+function describe2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function toProcessError(error, command) {
+  const errno = errnoOf(error);
+  const code = PROCESS_ERROR_CODES[errno ?? ""] ?? "process_failed";
+  const message = code === "process_not_found" ? `Perintah "${command}" tidak ditemukan di PATH.` : `Perintah "${command}" gagal dijalankan: ${describe2(error)}`;
+  return { code, path: command, message, cause: error };
+}
+var NodeProcessRunner = class {
+  async run(command, args, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_PROCESS_TIMEOUT_MS;
+    const maxBuffer = options.maxBufferBytes ?? DEFAULT_MAX_BUFFER_BYTES;
+    return await new Promise((resolve) => {
+      try {
+        execFile(
+          command,
+          [...args],
+          {
+            cwd: options.cwd,
+            env: options.env ? { ...process.env, ...options.env } : process.env,
+            timeout: timeoutMs,
+            killSignal: "SIGKILL",
+            maxBuffer,
+            windowsHide: true,
+            shell: false
+          },
+          (error, stdout, stderr) => {
+            if (error === null) {
+              resolve(fsOk({ code: 0, stdout, stderr, timedOut: false }));
+              return;
+            }
+            const failure = error;
+            const errno = errnoOf(failure);
+            if (errno === "ENOENT" || errno === "EACCES" || errno === "EPERM") {
+              resolve({ ok: false, error: toProcessError(failure, command) });
+              return;
+            }
+            const killed = failure.killed === true || failure.signal != null;
+            const exitCode = typeof failure.code === "number" ? failure.code : null;
+            resolve(
+              fsOk({
+                code: killed ? null : exitCode,
+                stdout,
+                stderr,
+                timedOut: killed
+              })
+            );
+          }
+        );
+      } catch (error) {
+        resolve({ ok: false, error: toProcessError(error, command) });
+      }
+    });
+  }
+};
+
+// src/adapters/antigravity.json
+var antigravity_default = {
+  id: "antigravity",
+  name: "Google Antigravity",
+  tier: "managed",
+  detect: {
+    paths: ["~/.gemini/config"],
+    binaries: ["agy"],
+    versionArgs: ["--version"]
+  },
+  stores: [
+    {
+      scope: "global",
+      path: "~/.gemini/config/skills",
+      exclusive: true
+    }
+  ],
+  readsShared: false,
+  connect: {
+    installUrl: "https://antigravity.google/download",
+    docsUrl: "https://antigravity.google/docs/skills"
+  },
+  verified: {
+    at: "2026-11-05",
+    source: "https://antigravity.google/docs/skills"
+  }
+};
+
+// src/adapters/claude-code.json
+var claude_code_default = {
+  id: "claude-code",
+  name: "[CC]",
+  tier: "managed",
+  detect: {
+    paths: ["~/.claude"],
+    binaries: ["claude"],
+    versionArgs: ["--version"]
+  },
+  stores: [
+    {
+      scope: "global",
+      path: "~/.claude/skills",
+      exclusive: true
+    }
+  ],
+  readsShared: false,
+  connect: {
+    installUrl: "https://code.claude.com/docs/en/skills",
+    docsUrl: "https://code.claude.com/docs/en/skills"
+  },
+  verified: {
+    at: "2026-11-05",
+    source: "https://code.claude.com/docs/en/skills"
+  }
+};
+
+// src/adapters/crush.json
+var crush_default = {
+  id: "crush",
+  name: "Crush",
+  tier: "detected-only",
+  detect: {
+    paths: ["~/.config/crush"],
+    binaries: ["crush"],
+    versionArgs: ["--version"]
+  },
+  stores: [],
+  readsShared: true,
+  connect: {
+    installUrl: "https://github.com/charmbracelet/crush",
+    docsUrl: "https://github.com/charmbracelet/crush"
+  },
+  verified: {
+    at: "2026-11-05",
+    source: "https://github.com/charmbracelet/crush"
+  },
+  notes: "Detected-only (roadmap v0.2). Store Crush nanti adalah %LOCALAPPDATA%\\crush\\skills; ~/.config/crush/skills hanya dipakai untuk deteksi."
+};
+
+// src/adapters/devin.json
+var devin_default = {
+  id: "devin",
+  name: "Devin",
+  tier: "detected-only",
+  detect: {
+    paths: ["~/.config/devin"],
+    binaries: ["devin"],
+    versionArgs: ["--version"]
+  },
+  stores: [],
+  readsShared: true,
+  connect: {
+    installUrl: "https://docs.devin.ai/desktop/cascade/skills",
+    docsUrl: "https://docs.devin.ai/desktop/cascade/skills"
+  },
+  verified: {
+    at: "2026-11-05",
+    source: "https://docs.devin.ai/desktop/cascade/skills"
+  },
+  notes: "BERTENTANGAN: docs Desktop menyebut ~/.config/devin/skills, docs CLI menyebut %APPDATA%\\devin\\skills. Deteksi memakai bentuk POSIX dari docs Desktop; belum ada Store managed sampai pertentangan ini teruji di mesin dengan Devin terpasang."
+};
+
+// src/adapters/goose.json
+var goose_default = {
+  id: "goose",
+  name: "Goose",
+  tier: "detected-only",
+  detect: {
+    paths: ["~/.config/goose"],
+    binaries: ["goose"],
+    versionArgs: ["--version"]
+  },
+  stores: [],
+  readsShared: true,
+  connect: {
+    installUrl: "https://github.com/aaif-goose/goose",
+    docsUrl: "https://github.com/aaif-goose/goose/blob/main/documentation/docs/guides/context-engineering/using-skills.md"
+  },
+  verified: {
+    at: "2026-11-05",
+    source: "https://github.com/aaif-goose/goose/blob/main/documentation/docs/guides/context-engineering/using-skills.md"
+  },
+  notes: "Detected-only (roadmap v0.2). Root kanonik Goose adalah ~/.agents/skills (Store shared); ~/.config/goose/skills bukan path kanonik di Windows, hanya dipakai untuk deteksi."
+};
+
+// src/adapters/hermes.json
+var hermes_default = {
+  id: "hermes",
+  name: "Hermes",
+  tier: "detected-only",
+  detect: {
+    paths: ["~/.hermes"],
+    binaries: ["hermes"],
+    versionArgs: ["--version"]
+  },
+  stores: [],
+  readsShared: false,
+  connect: {
+    installUrl: "https://github.com/NousResearch/hermes-agent",
+    docsUrl: "https://github.com/NousResearch/hermes-agent"
+  },
+  verified: {
+    at: "2026-11-05",
+    source: "https://github.com/NousResearch/hermes-agent/blob/ca705db/hermes_constants.py#L51-L58"
+  },
+  notes: "Detected-only (roadmap v0.2). Home aktif Hermes di Windows adalah %LOCALAPPDATA%\\hermes\\skills; ~/.hermes/skills hanya dipakai untuk deteksi, bukan Store."
+};
+var httpUrl = z.string().regex(/^https?:\/\/\S+$/, "harus URL http(s)");
+var storeSchema = z.object({
+  scope: z.enum(["global", "project"]),
+  path: z.string().min(1),
+  exclusive: z.boolean(),
+  members: z.array(z.string().min(1)).optional()
+});
+var detectSchema = z.object({
+  paths: z.array(z.string().min(1)),
+  binaries: z.array(z.string().min(1)),
+  versionArgs: z.array(z.string())
+});
+var adapterSchema = z.object({
+  id: z.string().regex(/^[a-z0-9][a-z0-9-]*$/, "id hanya huruf kecil, angka, dan tanda hubung"),
+  name: z.string().min(1),
+  tier: z.enum(["managed", "detected-only"]),
+  detect: detectSchema,
+  stores: z.array(storeSchema),
+  readsShared: z.boolean(),
+  connect: z.object({ installUrl: httpUrl, docsUrl: httpUrl.optional() }).optional(),
+  verified: z.object({
+    at: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "format tanggal harus YYYY-MM-DD"),
+    source: httpUrl
+  }).optional(),
+  notes: z.string().min(1).optional()
+});
+function adapterCapability(adapter) {
+  return adapter.tier === "managed" && adapter.verified !== void 0 ? "managed" : "detected";
+}
+
+// src/adapters/opencode.json
+var opencode_default = {
+  id: "opencode",
+  name: "opencode",
+  tier: "managed",
+  detect: {
+    paths: ["~/.config/opencode"],
+    binaries: ["opencode"],
+    versionArgs: ["--version"]
+  },
+  stores: [
+    {
+      scope: "global",
+      path: "~/.config/opencode/skills",
+      exclusive: true
+    }
+  ],
+  readsShared: true,
+  connect: {
+    installUrl: "https://opencode.ai/docs",
+    docsUrl: "https://opencode.ai/docs/skills/"
+  },
+  verified: {
+    at: "2026-11-05",
+    source: "https://opencode.ai/docs/skills/"
+  }
+};
+
+// src/adapters/shared.json
+var shared_default = {
+  id: "shared",
+  name: "Shared (.agents)",
+  tier: "managed",
+  detect: {
+    paths: ["~/.agents"],
+    binaries: [],
+    versionArgs: []
+  },
+  stores: [
+    {
+      scope: "global",
+      path: "~/.agents/skills",
+      exclusive: false,
+      members: [
+        "codex",
+        "gemini",
+        "cursor",
+        "copilot",
+        "amp",
+        "zed",
+        "roo",
+        "kilo",
+        "factory",
+        "dsh"
+      ]
+    }
+  ],
+  readsShared: true,
+  connect: {
+    installUrl: "https://agentskills.io",
+    docsUrl: "https://agentskills.io/specification"
+  },
+  verified: {
+    at: "2026-11-05",
+    source: "https://learn.chatgpt.com/docs/build-skills"
+  }
+};
+
+// src/adapters/bundled.ts
+var BUNDLED_ADAPTERS = [
+  claude_code_default,
+  opencode_default,
+  antigravity_default,
+  shared_default,
+  hermes_default,
+  goose_default,
+  crush_default,
+  devin_default
+].map((raw) => adapterSchema.parse(raw));
+
+// src/adapters/home.ts
+function expandHome(raw, home, platform) {
+  const nodePath = platformPath(platform);
+  if (raw === "~") {
+    return nodePath.resolve(home);
+  }
+  if (raw.startsWith("~/") || raw.startsWith("~\\")) {
+    return nodePath.resolve(home, raw.slice(2));
+  }
+  return raw;
+}
+function platformPath2(platform) {
+  return platform === "win32" ? path2.win32 : path2.posix;
+}
+function formatIssues(error) {
+  return error.issues.map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "(root)"}: ${issue.message}`).join("; ");
+}
+function describe3(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function loadAdapters(options) {
+  const platform = options.platform ?? process.platform;
+  const nodePath = platformPath2(platform);
+  const dir = adaptersRoot(options.dataRoot, platform);
+  const problems = [];
+  const adapters = [...BUNDLED_ADAPTERS];
+  const listing = await options.fs.readdir(dir);
+  if (!listing.ok) {
+    if (listing.error.code !== "not_found") {
+      problems.push({ file: dir, message: listing.error.message });
+    }
+    return { adapters, problems };
+  }
+  const files = listing.value.filter((entry) => entry.kind === "file" && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
+  const overridden = /* @__PURE__ */ new Set();
+  for (const name of files) {
+    const file = nodePath.join(dir, name);
+    const text = await options.fs.readText(file);
+    if (!text.ok) {
+      problems.push({ file, message: text.error.message });
+      continue;
+    }
+    let raw;
+    try {
+      raw = JSON.parse(text.value);
+    } catch (error) {
+      problems.push({ file, message: `JSON tidak valid: ${describe3(error)}` });
+      continue;
+    }
+    const parsed = adapterSchema.safeParse(raw);
+    if (!parsed.success) {
+      problems.push({ file, message: formatIssues(parsed.error) });
+      continue;
+    }
+    const adapter = parsed.data;
+    if (overridden.has(adapter.id)) {
+      problems.push({ file, message: `id "${adapter.id}" duplikat; manifest terakhir menang` });
+    }
+    overridden.add(adapter.id);
+    const index = adapters.findIndex((existing) => existing.id === adapter.id);
+    if (index >= 0) {
+      adapters[index] = adapter;
+    } else {
+      adapters.push(adapter);
+    }
+  }
+  return { adapters, problems };
+}
+
+// src/adapters/detect.ts
+var POSIX_CANDIDATES = ["/usr/local/bin", "/usr/bin", "/bin"];
+function splitList(value, separator) {
+  return value.split(separator).map((entry) => entry.trim().replace(/^"|"$/g, "")).filter((entry) => entry.length > 0);
+}
+function candidateDirs(context) {
+  const { env, home, nodePath, platform } = context;
+  if (platform === "win32") {
+    const appData = env.APPDATA?.trim() || nodePath.join(home, "AppData", "Roaming");
+    const localAppData = env.LOCALAPPDATA?.trim() || nodePath.join(home, "AppData", "Local");
+    return [
+      nodePath.join(appData, "npm"),
+      nodePath.join(localAppData, "Programs"),
+      nodePath.join(home, ".local", "bin")
+    ];
+  }
+  return [...POSIX_CANDIDATES, nodePath.join(home, ".local", "bin"), nodePath.join(home, "bin")];
+}
+function createContext(options) {
+  const platform = options.platform ?? process.platform;
+  const base = {
+    fs: options.fs,
+    runner: options.runner,
+    home: options.home ?? homedir(),
+    env: options.env ?? process.env,
+    platform,
+    nodePath: platformPath(platform),
+    timeoutMs: options.timeoutMs ?? DEFAULT_PROCESS_TIMEOUT_MS
+  };
+  const rawPath = base.env.PATH ?? base.env.Path ?? base.env.path ?? "";
+  const fromPath = splitList(rawPath, platform === "win32" ? ";" : ":");
+  const seen = /* @__PURE__ */ new Set();
+  const searchDirs = [];
+  for (const dir of [...fromPath, ...candidateDirs(base)]) {
+    const resolved = base.nodePath.resolve(dir);
+    if (seen.has(resolved)) {
+      continue;
+    }
+    seen.add(resolved);
+    searchDirs.push(resolved);
+  }
+  return { ...base, searchDirs };
+}
+async function isFile(fs, target) {
+  const stat2 = await fs.stat(target);
+  return stat2.ok && stat2.value.kind === "file";
+}
+function binaryNames(binary, platform) {
+  if (platform !== "win32") {
+    return [binary];
+  }
+  return [`${binary}.exe`, `${binary}.cmd`, `${binary}.bat`, binary, `${binary}.ps1`];
+}
+async function findBinary(context, binary) {
+  for (const dir of context.searchDirs) {
+    for (const name of binaryNames(binary, context.platform)) {
+      const candidate = context.nodePath.join(dir, name);
+      if (await isFile(context.fs, candidate)) {
+        return candidate;
+      }
+    }
+  }
+  return void 0;
+}
+async function verifyBinary(context, binary, command, versionArgs) {
+  if (versionArgs.length === 0) {
+    return `${binary} ditemukan`;
+  }
+  if (context.platform === "win32" && /\.(cmd|bat|ps1)$/i.test(command)) {
+    return `${binary} ditemukan (skrip ${path2.win32.extname(command).slice(1)}, versi tidak diverifikasi)`;
+  }
+  const label = `${binary} ${versionArgs.join(" ")}`;
+  const result = await context.runner.run(command, versionArgs, { timeoutMs: context.timeoutMs });
+  if (!result.ok) {
+    return `${label} gagal dijalankan (${result.error.code})`;
+  }
+  if (result.value.timedOut) {
+    return `${label} tidak menjawab dalam ${context.timeoutMs} ms`;
+  }
+  if (result.value.code === 0) {
+    return `${label} menjawab`;
+  }
+  return `${label} keluar dengan kode ${result.value.code ?? "?"}`;
+}
+async function detectOne(adapter, context) {
+  const reasons = [];
+  let detected = false;
+  for (const raw of adapter.detect.paths) {
+    const resolved = expandHome(raw, context.home, context.platform);
+    const stat2 = await context.fs.stat(resolved);
+    if (stat2.ok) {
+      detected = true;
+      reasons.push(`ditemukan ${raw}`);
+      continue;
+    }
+    reasons.push(`${raw} tidak ada`);
+  }
+  for (const binary of adapter.detect.binaries) {
+    const command = await findBinary(context, binary);
+    if (command === void 0) {
+      reasons.push(`${binary} tidak ditemukan di PATH`);
+      continue;
+    }
+    detected = true;
+    reasons.push(await verifyBinary(context, binary, command, adapter.detect.versionArgs));
+  }
+  const capability = adapterCapability(adapter);
+  if (adapter.tier === "detected-only") {
+    reasons.push(
+      "adapter berstatus detected-only: terlihat di UI, tidak bisa dipilih sebagai Target"
+    );
+  } else if (adapter.verified === void 0) {
+    reasons.push("manifest tidak punya verified.at: status diturunkan ke detected");
+  }
+  if (adapter.notes !== void 0) {
+    reasons.push(adapter.notes);
+  }
+  return {
+    id: adapter.id,
+    name: adapter.name,
+    capability,
+    detected,
+    detectionReasons: reasons,
+    storeIds: capability === "managed" ? adapter.stores.map((store) => store.path) : [],
+    connect: adapter.connect === void 0 ? void 0 : { installUrl: adapter.connect.installUrl }
+  };
+}
+async function detectHarnesses(adapters, options) {
+  const context = createContext(options);
+  const harnesses = [];
+  for (const adapter of adapters) {
+    harnesses.push(await detectOne(adapter, context));
+  }
+  return harnesses;
+}
+async function recheck(options) {
+  const catalog = await loadAdapters(options);
+  const harnesses = await detectHarnesses(catalog.adapters, options);
+  return { adapters: catalog.adapters, harnesses, problems: catalog.problems };
+}
+function parseTargetId(targetId) {
+  const [harnessId, scope, ...rest] = targetId.split("/");
+  if (harnessId === void 0 || harnessId.length === 0 || rest.length > 0 || scope !== "global" && scope !== "project") {
+    throw new SkillManagerError({
+      code: "invalid_target",
+      message: `Target "${targetId}" tidak valid; format yang benar mis. "opencode/global".`
+    });
+  }
+  return { harnessId, scope };
+}
+function sharedStore(adapters, scope) {
+  for (const adapter of adapters) {
+    if (adapterCapability(adapter) !== "managed") {
+      continue;
+    }
+    const store = adapter.stores.find((entry) => entry.scope === scope && !entry.exclusive);
+    if (store !== void 0) {
+      return store;
+    }
+  }
+  return void 0;
+}
+function resolveTarget(adapters, target, options = {}) {
+  const { harnessId, scope } = typeof target === "string" ? parseTargetId(target) : target;
+  const adapter = adapters.find((entry) => entry.id === harnessId);
+  if (adapter === void 0) {
+    throw new SkillManagerError({
+      code: "unknown_target",
+      message: `Harness "${harnessId}" tidak dikenal.`
+    });
+  }
+  if (adapterCapability(adapter) !== "managed") {
+    throw new SkillManagerError({
+      code: "target_not_managed",
+      message: `Harness "${harnessId}" berstatus detected-only sehingga tidak bisa dipilih sebagai Target.`
+    });
+  }
+  if (options.shared === true) {
+    const shared = sharedStore(adapters, scope);
+    if (!adapter.readsShared || shared === void 0) {
+      throw new SkillManagerError({
+        code: "shared_not_supported",
+        message: `Harness "${harnessId}" tidak membaca Store shared.`
+      });
+    }
+    return { harnessId, scope, storeId: shared.path };
+  }
+  const store = adapter.stores.find((entry) => entry.scope === scope);
+  if (store === void 0) {
+    throw new SkillManagerError({
+      code: "target_not_available",
+      message: `Target "${harnessId}/${scope}" belum tersedia di v0.1.`
+    });
+  }
+  return { harnessId, scope, storeId: store.path };
+}
+function listStores(adapters, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const home = options.home ?? homedir();
+  const stores = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const adapter of adapters) {
+    if (adapterCapability(adapter) !== "managed") {
+      continue;
+    }
+    for (const store of adapter.stores) {
+      if (seen.has(store.path)) {
+        continue;
+      }
+      seen.add(store.path);
+      stores.push({
+        id: store.path,
+        path: expandHome(store.path, home, platform),
+        members: store.members === void 0 ? [adapter.id] : [...store.members],
+        exclusive: store.exclusive
+      });
+    }
+  }
+  return stores;
+}
+
+// src/server/routes/connect.ts
+function registerConnectRoutes(app, deps) {
+  app.get("/api/connect/:harnessId", async (c) => {
+    const harnessId = c.req.param("harnessId");
+    const { adapters } = await loadAdapters({ fs: deps.fs, dataRoot: deps.dataRoot });
+    const adapter = adapters.find((entry) => entry.id === harnessId);
+    if (adapter?.connect === void 0) {
+      throw new SkillManagerError({
+        code: "harness_not_found",
+        message: `Harness "${harnessId}" tidak dikenal atau tidak punya URL installer.`
+      });
+    }
+    return c.json({ url: adapter.connect.installUrl });
+  });
+}
+
+// src/library/frontmatter.ts
+var OFFICIAL_FRONTMATTER_FIELDS = [
+  "name",
+  "description",
+  "license",
+  "compatibility",
+  "metadata",
+  "allowed-tools"
+];
+var FRONTMATTER_INVALID_CODE = "frontmatter_invalid";
+var KEY_PATTERN = /^([A-Za-z0-9_-]+)[ \t]*:[ \t]*(.*)$/;
+var INDENTED_PATTERN = /^[ \t]+\S/;
+function invalid(message) {
+  return new SkillManagerError({ code: FRONTMATTER_INVALID_CODE, message });
+}
+function parseScalar(raw, lineNumber) {
+  const value = raw.trim();
+  if (value.startsWith('"') || value.startsWith("'")) {
+    const quote = value.charAt(0);
+    if (value.length < 2 || !value.endsWith(quote)) {
+      throw invalid(`baris ${lineNumber}: string berkutip tidak ditutup.`);
+    }
+    return value.slice(1, -1).replaceAll(`\\${quote}`, quote);
+  }
+  return value;
+}
+function parseFrontmatter(text) {
+  const lines = text.split("\n").map((line) => line.replace(/\r$/, ""));
+  const start = lines.findIndex((line) => line.trim() !== "");
+  if (start === -1 || lines[start]?.trim() !== "---") {
+    throw invalid("SKILL.md tidak memiliki blok frontmatter (---) di awal file.");
+  }
+  const end = lines.findIndex((line, index) => index > start && line.trim() === "---");
+  if (end === -1) {
+    throw invalid("Blok frontmatter tidak ditutup dengan ---.");
+  }
+  const data = {};
+  let nested;
+  for (let index = start + 1; index < end; index += 1) {
+    const line = lines[index] ?? "";
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) {
+      continue;
+    }
+    const indented = INDENTED_PATTERN.test(line);
+    const match = KEY_PATTERN.exec(indented ? trimmed : line);
+    if (!match) {
+      throw invalid(`baris ${index + 1}: bukan pasangan key: value.`);
+    }
+    const key = match[1] ?? "";
+    const rawValue = match[2] ?? "";
+    if (indented) {
+      if (!nested) {
+        throw invalid(`baris ${index + 1}: baris menjorok tanpa induk key.`);
+      }
+      nested.map[key] = parseScalar(rawValue, index + 1);
+      continue;
+    }
+    if (rawValue.trim() === "") {
+      nested = { key, map: {} };
+      data[key] = nested.map;
+      continue;
+    }
+    nested = void 0;
+    data[key] = parseScalar(rawValue, index + 1);
+  }
+  return { data, body: lines.slice(end + 1).join("\n") };
+}
+
+// src/deps/detect.ts
+var PACKAGE_JSON = "package.json";
+var REQUIREMENTS_TXT = "requirements.txt";
+var PYPROJECT_TOML = "pyproject.toml";
+var SKILL_MD = "SKILL.md";
+var IGNORE_SCRIPTS_FLAG = "--ignore-scripts";
+var UV_REQUIREMENTS_ARGS = ["pip", "install", "-r", REQUIREMENTS_TXT];
+var UV_PYPROJECT_ARGS = ["pip", "install", "-r", PYPROJECT_TOML];
+function validateSkillId(skillId) {
+  if (skillId.length === 0) {
+    return "skillId kosong.";
+  }
+  if (skillId === "." || skillId === ".." || /[\\/]/.test(skillId)) {
+    return "skillId tidak boleh berisi pemisah path atau menunjuk ke direktori induk.";
+  }
+  return void 0;
+}
+async function readManifest(fs, directory, name) {
+  const filePath = path2.join(directory, name);
+  const stat2 = await fs.stat(filePath);
+  if (!stat2.ok || stat2.value.kind !== "file") {
+    return fsOk(void 0);
+  }
+  const text = await fs.readText(filePath);
+  return text.ok ? fsOk({ text: text.value, filePath }) : text;
+}
+function splitList2(value) {
+  return value.replace(/^\[|\]$/g, "").split(/[,\s]+/).map((token) => token.trim().replace(/^["']|["']$/g, "")).filter((token) => token.length > 0);
+}
+function metadataRequires(text) {
+  let parsed;
+  try {
+    parsed = parseFrontmatter(text);
+  } catch {
+    return [];
+  }
+  const metadata = parsed.data.metadata;
+  if (metadata === void 0 || typeof metadata === "string") {
+    return [];
+  }
+  const requires = metadata.requires;
+  return requires === void 0 ? [] : splitList2(requires);
+}
+function hintKinds(tokens) {
+  const kinds = /* @__PURE__ */ new Set();
+  for (const token of tokens) {
+    const hint = token.toLowerCase();
+    if (hint === "npm" || hint === "node" || hint.startsWith("npm:")) {
+      kinds.add("npm");
+    }
+    if (hint === "uv" || hint === "pip" || hint === "python" || hint.startsWith("pip:")) {
+      kinds.add("uv");
+    }
+  }
+  return kinds;
+}
+function withHint(reason, kind, hints) {
+  return hints.has(kind) ? `${reason}; metadata.requires menyebut ${kind}` : reason;
+}
+function dependencyNames(value) {
+  return typeof value === "object" && value !== null ? Object.keys(value) : [];
+}
+function parsePackageJson(manifest) {
+  let parsed;
+  try {
+    parsed = JSON.parse(manifest.text);
+  } catch {
+    return fsErr("io_error", manifest.filePath, "package.json bukan JSON yang valid.");
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return fsErr("io_error", manifest.filePath, "package.json harus berupa objek JSON.");
+  }
+  const record = parsed;
+  return fsOk({
+    dependencies: [
+      ...dependencyNames(record.dependencies),
+      ...dependencyNames(record.devDependencies)
+    ]
+  });
+}
+function requirementNames(text) {
+  return text.split(/\r?\n/).map((line) => line.replace(/#.*$/, "").trim()).filter((line) => line.length > 0 && !line.startsWith("-")).map((line) => line.split(/\s+/)[0] ?? "").filter((name) => name.length > 0);
+}
+async function detectDependencies(fs, skillDir, options) {
+  const invalid3 = validateSkillId(options.skillId);
+  if (invalid3) {
+    return fsErr("invalid_path", options.skillId, invalid3);
+  }
+  const cwd = path2.join(depsRoot(options.dataRoot, options.platform), options.skillId);
+  const hints = /* @__PURE__ */ new Set();
+  const skillFile = await readManifest(fs, skillDir, SKILL_MD);
+  if (skillFile.ok && skillFile.value) {
+    for (const kind of hintKinds(metadataRequires(skillFile.value.text))) {
+      hints.add(kind);
+    }
+  }
+  const commands = [];
+  const packageFile = await readManifest(fs, skillDir, PACKAGE_JSON);
+  if (!packageFile.ok) {
+    return packageFile;
+  }
+  if (packageFile.value) {
+    const manifest = parsePackageJson(packageFile.value);
+    if (!manifest.ok) {
+      return manifest;
+    }
+    commands.push({
+      kind: "npm",
+      command: "npm",
+      args: ["install", IGNORE_SCRIPTS_FLAG],
+      cwd,
+      reason: withHint(
+        `package.json: ${manifest.value.dependencies.length} dependensi`,
+        "npm",
+        hints
+      ),
+      dependencies: manifest.value.dependencies
+    });
+  }
+  const requirements = await readManifest(fs, skillDir, REQUIREMENTS_TXT);
+  if (!requirements.ok) {
+    return requirements;
+  }
+  if (requirements.value) {
+    const dependencies = requirementNames(requirements.value.text);
+    commands.push({
+      kind: "uv",
+      command: "uv",
+      args: [...UV_REQUIREMENTS_ARGS],
+      cwd,
+      reason: withHint(`requirements.txt: ${dependencies.length} dependensi`, "uv", hints),
+      dependencies
+    });
+    return fsOk(commands);
+  }
+  const pyproject = await readManifest(fs, skillDir, PYPROJECT_TOML);
+  if (!pyproject.ok) {
+    return pyproject;
+  }
+  if (pyproject.value && /^\s*\[(project|tool\.poetry)\]/m.test(pyproject.value.text)) {
+    commands.push({
+      kind: "uv",
+      command: "uv",
+      args: [...UV_PYPROJECT_ARGS],
+      cwd,
+      reason: withHint("pyproject.toml: proyek Python terdeteksi", "uv", hints),
+      dependencies: []
+    });
+  }
+  return fsOk(commands);
+}
+
+// src/deps/plan.ts
+async function planDependencies(fs, skillDir, options) {
+  const detected = await detectDependencies(fs, skillDir, options);
+  if (!detected.ok || options.allowScripts !== true) {
+    return detected;
+  }
+  return fsOk(
+    detected.value.map((command) => {
+      if (command.kind !== "npm") {
+        return command;
+      }
+      return {
+        ...command,
+        args: command.args.filter((arg) => arg !== IGNORE_SCRIPTS_FLAG),
+        reason: `${command.reason}; script lifecycle diizinkan`
+      };
+    })
+  );
+}
+
+// src/deps/availability.ts
+async function checkDependencyTool(runner, kind, options = {}) {
+  const result = await runner.run(kind, ["--version"], {
+    timeoutMs: options.timeoutMs ?? DEFAULT_PROCESS_TIMEOUT_MS
+  });
+  if (!result.ok) {
+    return { kind, available: false, message: result.error.message };
+  }
+  if (result.value.timedOut) {
+    return { kind, available: false, message: `"${kind} --version" melewati batas waktu.` };
+  }
+  if (result.value.code !== 0) {
+    return {
+      kind,
+      available: false,
+      message: `"${kind} --version" keluar dengan kode ${result.value.code ?? "null"}.`
+    };
+  }
+  const version = (result.value.stdout || result.value.stderr).trim();
+  return version.length > 0 ? { kind, available: true, version } : { kind, available: true };
+}
+async function assertDependencyTools(runner, kinds, options = {}) {
+  const unique = [...new Set(kinds)];
+  const statuses = await Promise.all(
+    unique.map((kind) => checkDependencyTool(runner, kind, options))
+  );
+  const missing = statuses.filter((status) => !status.available);
+  if (missing.length > 0) {
+    const names = missing.map((status) => status.kind).join(" dan ");
+    throw new SkillManagerError({
+      code: "dependency_tool_missing",
+      message: `${names} tidak tersedia. Pasang sendiri lebih dulu; Skill Manager tidak pernah memasang package manager.`,
+      details: { missing: missing.map(({ kind, message }) => ({ kind, message })) }
+    });
+  }
+  return statuses;
+}
+
+// src/deps/run.ts
+var DEFAULT_INSTALL_TIMEOUT_MS = 5 * 6e4;
+var MANIFESTS = {
+  npm: ["package.json"],
+  uv: ["requirements.txt", "pyproject.toml"]
+};
+async function stageManifests(fs, skillDir, cwd, kind) {
+  const created = await fs.mkdir(cwd, { recursive: true });
+  if (!created.ok) {
+    return created;
+  }
+  for (const name of MANIFESTS[kind]) {
+    const source = path2.join(skillDir, name);
+    const stat2 = await fs.stat(source);
+    if (!stat2.ok || stat2.value.kind !== "file") {
+      continue;
+    }
+    const text = await fs.readText(source);
+    if (!text.ok) {
+      return text;
+    }
+    const written = await fs.write(path2.join(cwd, name), text.value);
+    if (!written.ok) {
+      return written;
+    }
+  }
+  return fsOk(void 0);
+}
+function wrap(error, details) {
+  return new SkillManagerError({ code: error.code, message: error.message, details });
+}
+async function runDependencies(options) {
+  const planned = await planDependencies(options.fs, options.skillDir, options);
+  if (!planned.ok) {
+    throw wrap(planned.error, planned.error);
+  }
+  const commands = planned.value;
+  if (commands.length === 0) {
+    return { ok: true, results: [] };
+  }
+  await assertDependencyTools(
+    options.runner,
+    commands.map((command) => command.kind)
+  );
+  const timeoutMs = options.timeoutMs ?? DEFAULT_INSTALL_TIMEOUT_MS;
+  const results = [];
+  for (const command of commands) {
+    const staged = await stageManifests(options.fs, options.skillDir, command.cwd, command.kind);
+    if (!staged.ok) {
+      throw wrap(staged.error, staged.error);
+    }
+    const execution = await options.runner.run(command.command, command.args, {
+      cwd: command.cwd,
+      timeoutMs
+    });
+    if (!execution.ok) {
+      throw new SkillManagerError({
+        code: "dependency_run_failed",
+        message: execution.error.message,
+        details: execution.error
+      });
+    }
+    results.push({
+      kind: command.kind,
+      command: command.command,
+      args: command.args,
+      cwd: command.cwd,
+      code: execution.value.code,
+      stdout: execution.value.stdout,
+      stderr: execution.value.stderr,
+      timedOut: execution.value.timedOut
+    });
+  }
+  return { ok: results.every((result) => result.code === 0 && !result.timedOut), results };
+}
+
+// src/server/routes/context.ts
+function describeIssues(error) {
+  return error.issues.map((issue) => ({
+    path: issue.path.map(String).join("."),
+    message: issue.message
+  }));
+}
+async function readJson(c, schema) {
+  let payload;
+  try {
+    payload = await c.req.json();
+  } catch {
+    throw new SkillManagerError({
+      code: "bad_request",
+      message: "Body request harus JSON yang valid."
+    });
+  }
+  const parsed = schema.safeParse(payload);
+  if (!parsed.success) {
+    throw new SkillManagerError({
+      code: "bad_request",
+      message: "Body request tidak sesuai bentuk yang diharapkan.",
+      details: { issues: describeIssues(parsed.error) }
+    });
+  }
+  return parsed.data;
+}
+function fsFailure(error) {
+  return new SkillManagerError({
+    code: error.code,
+    message: error.message,
+    details: { path: error.path }
+  });
+}
+function unwrap(result) {
+  if (!result.ok) {
+    throw fsFailure(result.error);
+  }
+  return result.value;
+}
+var DOMAIN_CODE_PATTERN = /^[a-z][a-z0-9]*(_[a-z0-9]+)*$/;
+function asDomainError(error) {
+  if (error instanceof SkillManagerError) {
+    return error;
+  }
+  if (typeof error === "object" && error !== null) {
+    const candidate = error;
+    if (typeof candidate.code === "string" && DOMAIN_CODE_PATTERN.test(candidate.code) && typeof candidate.message === "string") {
+      return new SkillManagerError({
+        code: candidate.code,
+        message: candidate.message,
+        ...typeof candidate.path === "string" ? { details: { path: candidate.path } } : {}
+      });
+    }
+  }
+  return error;
+}
+
+// src/core/types.ts
+var STATE_SCHEMA_VERSION = 1;
+
+// src/core/state.ts
+var STATE_FILE_NAME = "state.json";
+var contentHashSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "harus berformat sha256:<64 hex lowercase>");
+var sourceInfoSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("folder"), path: z.string().min(1) }),
+  z.object({
+    type: z.literal("git"),
+    url: z.string().min(1),
+    ref: z.string().min(1),
+    commit: z.string().min(1)
+  }),
+  z.object({ type: z.literal("zip"), path: z.string().min(1) })
+]);
+var skillSchema = z.object({
+  id: z.string().min(1),
+  name: z.string().min(1),
+  dirName: z.string().min(1),
+  contentHash: contentHashSchema,
+  source: sourceInfoSchema,
+  license: z.string().optional(),
+  importedAt: z.string().min(1)
+});
+var installationSchema = z.object({
+  skillId: z.string().min(1),
+  storeId: z.string().min(1),
+  mode: z.enum(["copy", "symlink"]),
+  installedHash: contentHashSchema,
+  installedAt: z.string().min(1)
+});
+var projectSchema = z.object({
+  path: z.string().min(1)
+});
+var stateFileSchema = z.object({
+  schemaVersion: z.literal(STATE_SCHEMA_VERSION),
+  library: z.array(skillSchema),
+  installations: z.array(installationSchema),
+  projects: z.array(projectSchema),
+  settings: z.object({
+    sharedGroupMembers: z.array(z.string().min(1))
+  })
+});
+function emptyState() {
+  return {
+    schemaVersion: STATE_SCHEMA_VERSION,
+    library: [],
+    installations: [],
+    projects: [],
+    settings: { sharedGroupMembers: [] }
+  };
+}
+function recovered(reason) {
+  return { state: emptyState(), status: "recovered", reason };
+}
+function formatIssues2(error) {
+  return error.issues.map((issue) => {
+    const location = issue.path.length > 0 ? issue.path.join(".") : "(akar)";
+    return `${location}: ${issue.message}`;
+  }).join("; ");
+}
+async function loadState(fs, dataRoot) {
+  const filePath = statePath(dataRoot);
+  const text = await fs.readText(filePath);
+  if (!text.ok) {
+    if (text.error.code === "not_found") {
+      return { state: emptyState(), status: "missing" };
+    }
+    return recovered(
+      `${STATE_FILE_NAME} tidak bisa dibaca (${text.error.code}): ${text.error.message}`
+    );
+  }
+  let parsedJson;
+  try {
+    parsedJson = JSON.parse(text.value);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return recovered(`${STATE_FILE_NAME} bukan JSON valid: ${message}`);
+  }
+  const version = parsedJson?.schemaVersion;
+  if (typeof version === "number" && version > STATE_SCHEMA_VERSION) {
+    return {
+      state: emptyState(),
+      status: "unsupported_version",
+      reason: `${STATE_FILE_NAME} memakai schemaVersion ${version}, sedangkan aplikasi ini hanya mendukung ${STATE_SCHEMA_VERSION}.`
+    };
+  }
+  const parsed = stateFileSchema.safeParse(parsedJson);
+  if (!parsed.success) {
+    return recovered(`${STATE_FILE_NAME} tidak sesuai schema: ${formatIssues2(parsed.error)}`);
+  }
+  return { state: parsed.data, status: "loaded" };
+}
+async function quarantineCorruptState(fs, targetPath) {
+  const existing = await fs.readText(targetPath);
+  if (!existing.ok) {
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(existing.value);
+  } catch {
+    parsed = void 0;
+  }
+  if (parsed !== void 0 && stateFileSchema.safeParse(parsed).success) {
+    return;
+  }
+  const corruptPath = `${targetPath}.corrupt`;
+  await fs.remove(corruptPath);
+  await fs.rename(targetPath, corruptPath);
+}
+async function saveState(fs, dataRoot, state) {
+  const targetPath = statePath(dataRoot);
+  const tempPath = `${targetPath}.tmp`;
+  const directory = await fs.mkdir(dataRoot, { recursive: true });
+  if (!directory.ok) {
+    return directory;
+  }
+  const serialized = `${JSON.stringify(state, null, 2)}
+`;
+  const written = await fs.write(tempPath, serialized);
+  if (!written.ok) {
+    await fs.remove(tempPath);
+    return written;
+  }
+  await quarantineCorruptState(fs, targetPath);
+  const renamed = await fs.rename(tempPath, targetPath);
+  if (!renamed.ok) {
+    await fs.remove(tempPath);
+    return renamed;
+  }
+  return fsOk(void 0);
+}
+
+// src/core/skill-lookup.ts
+async function findLibrarySkill(fs, dataRoot, name) {
+  const { state } = await loadState(fs, dataRoot);
+  const skill = state.library.find((entry) => entry.name === name || entry.id === name);
+  if (skill === void 0) {
+    throw new SkillManagerError({
+      code: "skill_not_found",
+      message: `Skill "${name}" tidak ada di Library.`
+    });
+  }
+  return { skill, state };
+}
+async function resolveLibrarySkill(fs, dataRoot, name) {
+  const { skill, state } = await findLibrarySkill(fs, dataRoot, name);
+  const source = path2.join(libraryRoot(dataRoot), skill.dirName);
+  const stat2 = await fs.stat(source);
+  if (!stat2.ok || stat2.value.kind !== "directory") {
+    throw new SkillManagerError({
+      code: "skill_not_found",
+      message: `Isi skill "${skill.name}" tidak ditemukan di Library (${source}).`,
+      details: { path: source }
+    });
+  }
+  return { skill, source, state };
+}
+function toPosix(relativePath) {
+  return relativePath.split(path2.sep).join("/");
+}
+async function walkTree(fs, root, options = {}) {
+  const rootStat = await fs.stat(root);
+  if (!rootStat.ok) {
+    return rootStat;
+  }
+  if (rootStat.value.kind !== "directory") {
+    return fsErr("not_a_directory", root, "walkTree membutuhkan direktori.");
+  }
+  const entries = [];
+  const state = { count: 0, bytes: 0 };
+  const walked = await visit(fs, root, root, "", options, entries, state);
+  if (!walked.ok) {
+    return walked;
+  }
+  return fsOk(entries);
+}
+async function visit(fs, rootPath, directory, relative, options, entries, state) {
+  const listing = await fs.readdir(directory);
+  if (!listing.ok) {
+    return listing;
+  }
+  for (const entry of listing.value) {
+    const entryPath = path2.join(directory, entry.name);
+    const relativePath = relative === "" ? entry.name : `${relative}/${entry.name}`;
+    const canonical = toPosix(relativePath);
+    state.count += 1;
+    if (options.maxEntries !== void 0 && state.count > options.maxEntries) {
+      return fsErr("io_error", rootPath, `Jumlah entri melebihi batas ${options.maxEntries}.`);
+    }
+    const isSymlink = entry.isSymlink;
+    const kind = entry.kind === "dangling" ? "symlink" : entry.kind;
+    let size = 0;
+    if (kind === "file") {
+      const stat2 = await fs.stat(entryPath);
+      if (!stat2.ok) {
+        return stat2;
+      }
+      size = stat2.value.size;
+      state.bytes += size;
+      if (options.maxBytes !== void 0 && state.bytes > options.maxBytes) {
+        return fsErr(
+          "io_error",
+          entryPath,
+          `Ukuran total melebihi batas ${options.maxBytes} byte.`
+        );
+      }
+    }
+    entries.push({ path: entryPath, relativePath: canonical, kind, size, isSymlink });
+    if (entry.kind === "directory" && !isSymlink) {
+      const nested = await visit(fs, rootPath, entryPath, relativePath, options, entries, state);
+      if (!nested.ok) {
+        return nested;
+      }
+    }
+  }
+  return fsOk(void 0);
+}
+
+// src/core/hash.ts
+var CONTENT_HASH_PREFIX = "sha256:";
+function sha256(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+async function contentHash(fs, root) {
+  const walked = await walkTree(fs, root);
+  if (!walked.ok) {
+    return walked;
+  }
+  const entries = [];
+  for (const entry of walked.value) {
+    if (entry.isSymlink) {
+      const target = await fs.readlink(entry.path);
+      if (!target.ok) {
+        return fsErr(
+          "unsafe_symlink",
+          entry.path,
+          "Tautan di dalam skill tidak bisa dibaca.",
+          target.error
+        );
+      }
+      entries.push({ type: "symlink", path: entry.relativePath, target: target.value });
+      continue;
+    }
+    if (entry.kind === "directory") {
+      entries.push({ type: "directory", path: entry.relativePath });
+      continue;
+    }
+    if (entry.kind !== "file") {
+      return fsErr("io_error", entry.path, "Jenis entri tidak didukung contentHash.");
+    }
+    const stat2 = await fs.stat(entry.path);
+    if (!stat2.ok) {
+      return stat2;
+    }
+    const data = await fs.read(entry.path);
+    if (!data.ok) {
+      return data;
+    }
+    entries.push({
+      type: "file",
+      path: entry.relativePath,
+      executable: isExecutable(stat2.value),
+      digest: sha256(data.value)
+    });
+  }
+  entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const document = JSON.stringify({ version: 1, entries });
+  return fsOk(`${CONTENT_HASH_PREFIX}${sha256(document)}`);
+}
+var TEMP_PREFIX = ".skill-manager-tmp-";
+async function cleanup(fs, targetPath) {
+  await fs.remove(targetPath, { recursive: true });
+}
+async function writeDirectoryAtomic(fs, targetPath, populate, options = {}) {
+  const absoluteTarget = path2.resolve(targetPath);
+  const parent = path2.dirname(absoluteTarget);
+  const parentStat = await fs.stat(parent);
+  if (!parentStat.ok) {
+    return parentStat;
+  }
+  if (parentStat.value.kind !== "directory") {
+    return fsErr("not_a_directory", parent, "Induk target atomic bukan direktori.");
+  }
+  if (await fs.exists(absoluteTarget)) {
+    return fsErr("already_exists", absoluteTarget, "Target atomic sudah ada.");
+  }
+  const suffix = options.randomSuffix?.() ?? randomUUID();
+  const tempDir = path2.join(parent, `${options.tempPrefix ?? TEMP_PREFIX}${suffix}`);
+  const created = await fs.mkdir(tempDir);
+  if (!created.ok) {
+    return created;
+  }
+  let populated;
+  try {
+    populated = await populate(tempDir);
+  } catch (error) {
+    await cleanup(fs, tempDir);
+    return fsErr("io_error", tempDir, "Gagal mengisi direktori sementara.", error);
+  }
+  if (!populated.ok) {
+    await cleanup(fs, tempDir);
+    return populated;
+  }
+  const renamed = await fs.rename(tempDir, absoluteTarget);
+  if (!renamed.ok) {
+    await cleanup(fs, tempDir);
+    return renamed;
+  }
+  return fsOk(void 0);
+}
+
+// src/library/import-folder.ts
+var MAX_SOURCE_BYTES = 10 * 1024 * 1024;
+var MAX_SOURCE_ENTRIES = 1e3;
+var SKILL_FILE_NAME = "SKILL.md";
+var SKILL_ID_PREFIX = "sk_";
+var SAFE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var LICENSE_FILE_PATTERN = /^licen[cs]e(\.(md|txt))?$/i;
+var MAX_NAME_LENGTH = 100;
+function importError(code, message, details) {
+  return new SkillManagerError({
+    code,
+    message,
+    ...details === void 0 ? {} : { details }
+  });
+}
+function createSkillId(nowMs = Date.now()) {
+  const crockford = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+  let time = "";
+  let remaining = nowMs;
+  for (let index = 0; index < 10; index += 1) {
+    time = `${crockford.charAt(remaining % 32)}${time}`;
+    remaining = Math.floor(remaining / 32);
+  }
+  let randomness = "";
+  for (const byte of randomBytes(16)) {
+    randomness += crockford.charAt(byte % 32);
+  }
+  return `${SKILL_ID_PREFIX}${time}${randomness}`;
+}
+async function importFolderSkill(fs, dataRoot, options) {
+  return importFromDirectory(fs, dataRoot, {
+    sourceDir: options.sourceDir,
+    provenance: { type: "folder", path: path2.resolve(options.sourceDir) },
+    ...options.newSkillId === void 0 ? {} : { newSkillId: options.newSkillId },
+    ...options.now === void 0 ? {} : { now: options.now }
+  });
+}
+async function importFromDirectory(fs, dataRoot, options) {
+  const sourceDir = await resolveSourceDir(fs, options.sourceDir);
+  const entries = await scanSource(fs, sourceDir);
+  const frontmatter = await readFrontmatter(fs, sourceDir);
+  const expectedName = options.name ?? path2.basename(sourceDir);
+  const name = requireName(frontmatter, expectedName);
+  const warnings = collectWarnings(frontmatter);
+  const license = await detectLicense(fs, sourceDir, entries, frontmatter);
+  const state = await readState(fs, dataRoot);
+  assertNoConflict(state.library, name);
+  const libraryDir = libraryRoot(dataRoot);
+  const destination = path2.join(libraryDir, name);
+  const contentHashValue = await copyIntoLibrary(fs, libraryDir, sourceDir, destination);
+  const skill = {
+    id: options.newSkillId?.() ?? createSkillId(),
+    name,
+    dirName: name,
+    contentHash: contentHashValue,
+    source: options.provenance,
+    importedAt: options.now?.() ?? (/* @__PURE__ */ new Date()).toISOString(),
+    ...license === void 0 ? {} : { license }
+  };
+  const saved = await saveState(fs, dataRoot, {
+    ...state,
+    library: [...state.library, skill]
+  });
+  if (!saved.ok) {
+    await fs.remove(destination, { recursive: true });
+    throw importError(
+      "import_failed",
+      `Gagal menyimpan state setelah menyalin skill: ${saved.error.message}`,
+      saved.error
+    );
+  }
+  return { skill, warnings };
+}
+async function resolveSourceDir(fs, sourceDir) {
+  const real = await fs.realpath(sourceDir);
+  if (!real.ok) {
+    throw importError(
+      "source_not_found",
+      `Folder sumber tidak bisa dibaca: ${sourceDir} (${real.error.code}).`,
+      real.error
+    );
+  }
+  const stat2 = await fs.stat(real.value);
+  if (!stat2.ok) {
+    throw importError(
+      "source_not_found",
+      `Folder sumber tidak bisa dibaca: ${sourceDir}.`,
+      stat2.error
+    );
+  }
+  if (stat2.value.kind !== "directory") {
+    throw importError("source_not_directory", `Sumber impor bukan folder: ${sourceDir}.`);
+  }
+  return real.value;
+}
+async function scanSource(fs, sourceDir) {
+  const walked = await walkTree(fs, sourceDir, {
+    maxEntries: MAX_SOURCE_ENTRIES,
+    maxBytes: MAX_SOURCE_BYTES
+  });
+  if (walked.ok) {
+    return walked.value;
+  }
+  if (walked.error.code !== "io_error") {
+    throw importError(
+      "source_unreadable",
+      `Folder sumber tidak bisa ditelusuri: ${walked.error.message}`,
+      walked.error
+    );
+  }
+  const counted = await walkTree(fs, sourceDir, { maxEntries: MAX_SOURCE_ENTRIES });
+  if (!counted.ok) {
+    throw importError(
+      "source_too_many_files",
+      `Folder sumber melebihi batas ${MAX_SOURCE_ENTRIES} entri. Impor ditolak.`
+    );
+  }
+  throw importError(
+    "source_too_large",
+    `Ukuran folder sumber melebihi batas ${MAX_SOURCE_BYTES} byte (10 MiB). Impor ditolak.`
+  );
+}
+async function readFrontmatter(fs, sourceDir) {
+  const skillFilePath = path2.join(sourceDir, SKILL_FILE_NAME);
+  const text = await fs.readText(skillFilePath);
+  if (!text.ok) {
+    if (text.error.code === "not_found") {
+      throw importError(
+        "skill_md_missing",
+        `Folder sumber tidak berisi ${SKILL_FILE_NAME}: ${skillFilePath}.`
+      );
+    }
+    throw importError(
+      "source_unreadable",
+      `${SKILL_FILE_NAME} tidak bisa dibaca: ${text.error.message}`,
+      text.error
+    );
+  }
+  return parseFrontmatter(text.value);
+}
+function requireName(frontmatter, expectedName) {
+  const raw = frontmatter.data.name;
+  if (raw === void 0) {
+    throw importError(
+      "name_missing",
+      `Frontmatter ${SKILL_FILE_NAME} tidak memiliki field "name".`
+    );
+  }
+  if (typeof raw !== "string") {
+    throw importError(
+      "frontmatter_invalid",
+      `Field "name" pada ${SKILL_FILE_NAME} harus berupa teks, bukan blok bertingkat.`
+    );
+  }
+  const name = raw.trim();
+  if (name === "") {
+    throw importError("name_missing", `Field "name" pada ${SKILL_FILE_NAME} kosong.`);
+  }
+  if (name.length > MAX_NAME_LENGTH || !SAFE_NAME_PATTERN.test(name) || name === "." || name === "..") {
+    throw importError(
+      "invalid_name",
+      `Nama skill "${name}" tidak aman dipakai sebagai nama folder Library (hanya huruf, angka, ".", "_", "-").`
+    );
+  }
+  if (name !== expectedName) {
+    throw importError(
+      "name_mismatch",
+      `Nama skill di frontmatter ("${name}") tidak sama dengan nama folder sumber ("${expectedName}").`
+    );
+  }
+  return name;
+}
+function collectWarnings(frontmatter) {
+  const official = OFFICIAL_FRONTMATTER_FIELDS;
+  return Object.keys(frontmatter.data).filter((field) => !official.includes(field)).map(
+    (field) => `Field frontmatter "${field}" di luar 6 field resmi; diterima, tetapi tidak dipakai v0.1.`
+  );
+}
+async function detectLicense(fs, sourceDir, entries, frontmatter) {
+  const declared = frontmatter.data.license;
+  if (typeof declared === "string" && declared.trim() !== "") {
+    return declared.trim();
+  }
+  const licenseEntry = entries.find(
+    (entry) => entry.kind === "file" && !entry.isSymlink && !entry.relativePath.includes("/") && LICENSE_FILE_PATTERN.test(entry.relativePath)
+  );
+  if (licenseEntry === void 0) {
+    return void 0;
+  }
+  const text = await fs.readText(path2.join(sourceDir, licenseEntry.relativePath));
+  if (!text.ok) {
+    return void 0;
+  }
+  const firstLine = text.value.split(/\r?\n/).map((line) => line.trim()).find((line) => line !== "");
+  return firstLine === void 0 || firstLine === "" ? void 0 : firstLine.slice(0, 200);
+}
+async function readState(fs, dataRoot) {
+  const loaded = await loadState(fs, dataRoot);
+  if (loaded.status === "unsupported_version") {
+    throw importError(
+      "state_unsupported_version",
+      loaded.reason ?? "state.json dibuat versi aplikasi yang lebih baru."
+    );
+  }
+  return loaded.state;
+}
+function conflictError(name, existingId) {
+  return importError(
+    "name_conflict",
+    `Skill "${name}" sudah ada di Library. Impor ditolak; tidak ada penimpaan.`,
+    existingId === void 0 ? void 0 : { existing: name, existingId }
+  );
+}
+function assertNoConflict(library, name) {
+  const existing = library.find((skill) => skill.name === name || skill.dirName === name);
+  if (existing !== void 0) {
+    throw conflictError(name, existing.id);
+  }
+}
+async function copyIntoLibrary(fs, libraryDir, sourceDir, destination) {
+  const created = await fs.mkdir(libraryDir, { recursive: true });
+  if (!created.ok) {
+    throw importError(
+      "import_failed",
+      `Tidak bisa menyiapkan folder Library: ${created.error.message}`,
+      created.error
+    );
+  }
+  const guarded = await guardStorePath(fs, libraryDir, destination);
+  if (!guarded.ok) {
+    throw importError(
+      "import_failed",
+      `Tujuan impor tidak aman: ${guarded.error.message}`,
+      guarded.error
+    );
+  }
+  if (await fs.exists(destination)) {
+    throw conflictError(path2.basename(destination));
+  }
+  const tempDir = path2.join(libraryDir, `${TEMP_PREFIX}${randomUUID()}`);
+  const copied = await fs.copy(sourceDir, tempDir);
+  if (!copied.ok) {
+    await fs.remove(tempDir, { recursive: true });
+    throw copyError(copied.error);
+  }
+  const hashed = await contentHash(fs, tempDir);
+  if (!hashed.ok) {
+    await fs.remove(tempDir, { recursive: true });
+    throw importError(
+      "import_failed",
+      `Gagal menghitung hash skill: ${hashed.error.message}`,
+      hashed.error
+    );
+  }
+  const renamed = await fs.rename(tempDir, destination);
+  if (!renamed.ok) {
+    await fs.remove(tempDir, { recursive: true });
+    throw importError(
+      "import_failed",
+      `Gagal memindahkan skill ke Library: ${renamed.error.message}`,
+      renamed.error
+    );
+  }
+  return hashed.value;
+}
+function copyError(error) {
+  if (error.code === "unsafe_symlink") {
+    return importError(
+      "unsafe_symlink",
+      `Tautan di dalam folder sumber menunjuk keluar folder sumber: ${error.path}. Impor ditolak.`,
+      error
+    );
+  }
+  if (error.code === "already_exists") {
+    return importError("name_conflict", "Tujuan impor sudah ada di Library; impor ditolak.", error);
+  }
+  return importError("import_failed", `Gagal menyalin skill ke Library: ${error.message}`, error);
+}
+var LICENSE_FILE_PATTERN2 = /^licen[cs]e(\.(md|txt))?$/i;
+var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
+  "a",
+  "bin",
+  "class",
+  "dll",
+  "dylib",
+  "exe",
+  "gif",
+  "gz",
+  "ico",
+  "jar",
+  "jpeg",
+  "jpg",
+  "mov",
+  "mp3",
+  "mp4",
+  "node",
+  "o",
+  "otf",
+  "pdf",
+  "png",
+  "so",
+  "tar",
+  "ttf",
+  "wasm",
+  "webp",
+  "woff",
+  "woff2",
+  "zip",
+  "7z"
+]);
+function inspectError(code, message, details) {
+  return new SkillManagerError({ code, message, ...details === void 0 ? {} : { details } });
+}
+async function scanSource2(fs, sourceDir) {
+  const walked = await walkTree(fs, sourceDir, {
+    maxEntries: MAX_SOURCE_ENTRIES,
+    maxBytes: MAX_SOURCE_BYTES
+  });
+  if (walked.ok) {
+    return walked.value;
+  }
+  if (walked.error.code !== "io_error") {
+    throw inspectError(
+      "source_unreadable",
+      `Folder sumber tidak bisa ditelusuri: ${walked.error.message}`,
+      walked.error
+    );
+  }
+  const counted = await walkTree(fs, sourceDir, { maxEntries: MAX_SOURCE_ENTRIES });
+  if (!counted.ok) {
+    throw inspectError(
+      "source_too_many_files",
+      `Folder sumber melebihi batas ${MAX_SOURCE_ENTRIES} entri. Impor akan ditolak.`
+    );
+  }
+  throw inspectError(
+    "source_too_large",
+    `Ukuran folder sumber melebihi batas ${MAX_SOURCE_BYTES} byte (10 MiB). Impor akan ditolak.`
+  );
+}
+function buildTree(entries) {
+  const root = [];
+  const childrenByPath = /* @__PURE__ */ new Map([["", root]]);
+  for (const entry of entries) {
+    const separator = entry.relativePath.lastIndexOf("/");
+    const parentPath = separator === -1 ? "" : entry.relativePath.slice(0, separator);
+    const name = separator === -1 ? entry.relativePath : entry.relativePath.slice(separator + 1);
+    const children = entry.kind === "directory" ? [] : void 0;
+    const node = {
+      name,
+      path: entry.relativePath,
+      // readdir mengikuti tautan, jadi tautan ke file/direktori tetap dilaporkan
+      // sebagai symlink agar UI tidak menampilkan targetnya sebagai isi skill.
+      kind: entry.isSymlink ? "symlink" : entry.kind,
+      size: entry.size,
+      ...children === void 0 ? {} : { children }
+    };
+    const siblings = childrenByPath.get(parentPath) ?? root;
+    siblings.push(node);
+    if (children !== void 0) {
+      childrenByPath.set(entry.relativePath, children);
+    }
+  }
+  return root;
+}
+function isBinaryFile(entry) {
+  if (entry.kind !== "file") {
+    return false;
+  }
+  const extension = path2.posix.extname(entry.relativePath).slice(1).toLowerCase();
+  return BINARY_EXTENSIONS.has(extension);
+}
+async function escapesRoot(fs, rootLexical, rootReal, entry) {
+  const link = await fs.readlink(entry.path);
+  if (!link.ok) {
+    return true;
+  }
+  const target = path2.resolve(path2.dirname(entry.path), link.value);
+  if (!isPathInside(rootLexical, target)) {
+    return true;
+  }
+  const real = await fs.realpath(target);
+  if (real.ok) {
+    return !isPathInside(rootReal, real.value);
+  }
+  return false;
+}
+function licenseFromEntries(entries) {
+  return entries.find(
+    (entry) => entry.kind === "file" && !entry.isSymlink && !entry.relativePath.includes("/") && LICENSE_FILE_PATTERN2.test(entry.relativePath)
+  );
+}
+async function detectLicense2(fs, sourceDir, entries) {
+  const skillText = await fs.readText(path2.join(sourceDir, SKILL_FILE_NAME));
+  if (skillText.ok) {
+    try {
+      const declared = parseFrontmatter(skillText.value).data.license;
+      if (typeof declared === "string" && declared.trim() !== "") {
+        return declared.trim();
+      }
+    } catch {
+    }
+  }
+  const licenseEntry = licenseFromEntries(entries);
+  if (licenseEntry === void 0) {
+    return void 0;
+  }
+  const text = await fs.readText(licenseEntry.path);
+  if (!text.ok) {
+    return void 0;
+  }
+  const firstLine = text.value.split(/\r?\n/).map((line) => line.trim()).find((line) => line !== "");
+  return firstLine === void 0 || firstLine === "" ? void 0 : firstLine.slice(0, 200);
+}
+async function inspectSource(fs, sourceDir) {
+  const lexicalRoot = path2.resolve(sourceDir);
+  const stat2 = await fs.stat(lexicalRoot);
+  if (!stat2.ok) {
+    throw inspectError(
+      "source_not_found",
+      `Folder sumber tidak bisa dibaca: ${sourceDir} (${stat2.error.code}).`,
+      stat2.error
+    );
+  }
+  if (stat2.value.kind !== "directory") {
+    throw inspectError("source_not_directory", `Sumber impor bukan folder: ${sourceDir}.`);
+  }
+  const real = await fs.realpath(lexicalRoot);
+  const realRoot = real.ok ? real.value : lexicalRoot;
+  const entries = await scanSource2(fs, lexicalRoot);
+  const hasScriptsDir = entries.some(
+    (entry) => entry.kind === "directory" && !entry.isSymlink && path2.posix.basename(entry.relativePath).toLowerCase() === "scripts"
+  );
+  const hasBinary = entries.some(isBinaryFile);
+  const hasEscapingSymlink = (await Promise.all(
+    entries.filter((entry) => entry.isSymlink).map((entry) => escapesRoot(fs, lexicalRoot, realRoot, entry))
+  )).some(Boolean);
+  const fileEntries = entries.filter((entry) => entry.kind === "file" && !entry.isSymlink);
+  const totalBytes = fileEntries.reduce((total, entry) => total + entry.size, 0);
+  const license = await detectLicense2(fs, lexicalRoot, entries);
+  const risks = [];
+  if (hasScriptsDir) {
+    risks.push(
+      "Folder berisi direktori scripts/; isinya tidak dieksekusi saat impor, tetapi periksa sebelum dipakai."
+    );
+  }
+  if (hasBinary) {
+    risks.push("Folder berisi berkas biner; hanya isi teks yang bisa diperiksa otomatis.");
+  }
+  if (hasEscapingSymlink) {
+    risks.push("Ada tautan yang menunjuk keluar folder skill; impor folder akan menolaknya.");
+  }
+  return {
+    files: buildTree(entries),
+    hasScriptsDir,
+    hasBinary,
+    hasEscapingSymlink,
+    totalBytes,
+    fileCount: fileEntries.length,
+    ...license === void 0 ? {} : { license },
+    risks
+  };
+}
+function sourceError(code, message, details) {
+  return new SkillManagerError({ code, message, ...details === void 0 ? {} : { details } });
+}
+async function hasSkillFile(fs, dir) {
+  const stat2 = await fs.stat(path2.join(dir, SKILL_FILE_NAME));
+  return stat2.ok && stat2.value.kind === "file";
+}
+async function findSkillDirectory(fs, root) {
+  if (await hasSkillFile(fs, root)) {
+    return root;
+  }
+  const listing = await fs.readdir(root);
+  if (!listing.ok) {
+    throw sourceError(
+      "source_unreadable",
+      `Folder hasil unduhan tidak bisa dibaca: ${root} (${listing.error.code}).`,
+      listing.error
+    );
+  }
+  const candidates = [];
+  for (const entry of listing.value) {
+    if (entry.kind !== "directory" || entry.isSymlink) {
+      continue;
+    }
+    const candidate = path2.join(root, entry.name);
+    if (await hasSkillFile(fs, candidate)) {
+      candidates.push(candidate);
+    }
+  }
+  if (candidates.length === 0) {
+    throw sourceError(
+      "skill_md_missing",
+      `Tidak ada ${SKILL_FILE_NAME} di root atau di satu subdirektori sumber impor.`
+    );
+  }
+  if (candidates.length > 1) {
+    const names = candidates.map((candidate) => path2.basename(candidate)).join(", ");
+    throw sourceError(
+      "skill_md_ambiguous",
+      `Ditemukan lebih dari satu kandidat skill (${names}); impor membutuhkan tepat satu ${SKILL_FILE_NAME}.`,
+      { candidates: names }
+    );
+  }
+  return candidates[0];
+}
+async function readSkillName(fs, skillDir) {
+  const text = await fs.readText(path2.join(skillDir, SKILL_FILE_NAME));
+  if (!text.ok) {
+    throw sourceError(
+      "source_unreadable",
+      `${SKILL_FILE_NAME} tidak bisa dibaca: ${text.error.message}`,
+      text.error
+    );
+  }
+  const frontmatter = parseFrontmatter(text.value);
+  const raw = frontmatter.data.name;
+  if (typeof raw !== "string" || raw.trim() === "") {
+    throw sourceError(
+      "name_missing",
+      `Frontmatter ${SKILL_FILE_NAME} tidak memiliki field "name" yang bisa dipakai.`
+    );
+  }
+  return raw.trim();
+}
+
+// src/library/import-git.ts
+var GIT_BINARY = "git";
+var GIT_CLONE_TIMEOUT_MS = 12e4;
+var GIT_COMMAND_TIMEOUT_MS = 6e4;
+var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["https:", "http:"]);
+var SHA_PATTERN = /^[0-9a-f]{7,64}$/i;
+var COMMIT_PATTERN = /^[0-9a-f]{7,64}$/;
+var STDERR_EXCERPT_LENGTH = 400;
+function gitError(code, message, details) {
+  return new SkillManagerError({ code, message, ...details === void 0 ? {} : { details } });
+}
+function validateGitUrl(raw) {
+  const candidate = raw.trim();
+  let parsed;
+  try {
+    parsed = new URL(candidate);
+  } catch {
+    throw gitError(
+      "invalid_git_url",
+      `URL git tidak valid: "${raw}". Gunakan URL https:// atau http://.`
+    );
+  }
+  if (!ALLOWED_PROTOCOLS.has(parsed.protocol) || parsed.hostname === "") {
+    throw gitError(
+      "invalid_git_url",
+      `Skema URL git "${parsed.protocol}" tidak didukung. v0.1 hanya menerima https:// dan http:// (tanpa SSH/file).`
+    );
+  }
+  return candidate;
+}
+function resolveRef(raw) {
+  const ref = raw?.trim();
+  if (ref === void 0 || ref === "") {
+    return "HEAD";
+  }
+  if (ref.startsWith("-") || /\s/.test(ref)) {
+    throw gitError("invalid_git_ref", `Ref git tidak valid: "${ref}".`);
+  }
+  return ref;
+}
+function stderrExcerpt(result) {
+  const text = result.stderr.trim() || result.stdout.trim();
+  return text === "" ? "(tanpa keluaran)" : text.slice(0, STDERR_EXCERPT_LENGTH);
+}
+async function runGit(runner, args, cwd, timeoutMs) {
+  const result = await runner.run(
+    GIT_BINARY,
+    args,
+    cwd === void 0 ? { timeoutMs } : { cwd, timeoutMs }
+  );
+  if (!result.ok) {
+    if (result.error.code === "process_not_found") {
+      throw gitError(
+        "git_not_available",
+        "Git tidak ditemukan di PATH. Pasang Git lalu ulangi impor.",
+        result.error
+      );
+    }
+    throw gitError(
+      "git_clone_failed",
+      `Gagal menjalankan git: ${result.error.message}`,
+      result.error
+    );
+  }
+  return result.value;
+}
+function cloneArgs(url, ref, destination) {
+  const base = ["clone", "--depth", "1"];
+  if (ref !== "HEAD" && !SHA_PATTERN.test(ref)) {
+    base.push("--branch", ref);
+  }
+  base.push(url, destination);
+  return base;
+}
+async function checkoutCommit(runner, tempDir, sha) {
+  const direct = await runGit(runner, ["checkout", sha], tempDir, GIT_COMMAND_TIMEOUT_MS);
+  if (direct.code === 0) {
+    return;
+  }
+  const fetched = await runGit(
+    runner,
+    ["fetch", "--depth", "1", "origin", sha],
+    tempDir,
+    GIT_COMMAND_TIMEOUT_MS
+  );
+  if (fetched.code !== 0) {
+    throw gitError(
+      "git_ref_not_found",
+      `Commit "${sha}" tidak ditemukan di repositori. Periksa ref lalu ulangi impor.`
+    );
+  }
+  const retried = await runGit(runner, ["checkout", "FETCH_HEAD"], tempDir, GIT_COMMAND_TIMEOUT_MS);
+  if (retried.code !== 0) {
+    throw gitError("git_ref_not_found", `Commit "${sha}" tidak bisa di-checkout.`);
+  }
+}
+async function cloneGitTo(runner, options, destination) {
+  const url = validateGitUrl(options.url);
+  const ref = resolveRef(options.ref);
+  const clone = await runGit(
+    runner,
+    cloneArgs(url, ref, destination),
+    void 0,
+    GIT_CLONE_TIMEOUT_MS
+  );
+  if (clone.timedOut) {
+    throw gitError(
+      "git_timeout",
+      `git clone melewati batas waktu ${GIT_CLONE_TIMEOUT_MS} ms. Periksa jaringan lalu ulangi.`
+    );
+  }
+  if (clone.code !== 0) {
+    throw gitError(
+      "git_clone_failed",
+      `git clone gagal (exit ${clone.code ?? "null"}): ${stderrExcerpt(clone)}.`
+    );
+  }
+  if (ref !== "HEAD" && SHA_PATTERN.test(ref)) {
+    await checkoutCommit(runner, destination, ref);
+  }
+  const resolved = await runGit(runner, ["rev-parse", "HEAD"], destination, GIT_COMMAND_TIMEOUT_MS);
+  const commit = resolved.stdout.trim();
+  if (resolved.code !== 0 || !COMMIT_PATTERN.test(commit)) {
+    throw gitError(
+      "git_clone_failed",
+      `Commit HEAD tidak bisa dibaca dari hasil clone: ${stderrExcerpt(resolved)}.`
+    );
+  }
+  return { url, ref, commit };
+}
+var EOCD_SIGNATURE = 101010256;
+var CENTRAL_SIGNATURE = 33639248;
+var LOCAL_SIGNATURE = 67324752;
+var EOCD_MIN_SIZE = 22;
+var CENTRAL_MIN_SIZE = 46;
+var LOCAL_MIN_SIZE = 30;
+var MAX_COMMENT_LENGTH = 65535;
+var ZIP64_SENTINEL = 4294967295;
+var ZIP64_ENTRY_COUNT = 65535;
+var FILE_TYPE_MASK = 61440;
+var REGULAR_FILE = 32768;
+var DIRECTORY = 16384;
+var SYMLINK = 40960;
+var DEFAULT_FILE_MODE = 420;
+function zipError(code, message, details) {
+  return new SkillManagerError({ code, message, ...details === void 0 ? {} : { details } });
+}
+function invalid2(message) {
+  return zipError("zip_invalid", message);
+}
+function readU16(bytes, offset) {
+  return bytes[offset] | bytes[offset + 1] << 8;
+}
+function readU32(bytes, offset) {
+  return (bytes[offset] | bytes[offset + 1] << 8 | bytes[offset + 2] << 16 | bytes[offset + 3] << 24) >>> 0;
+}
+function findEndOfCentralDirectory(bytes) {
+  if (bytes.length < EOCD_MIN_SIZE) {
+    throw invalid2("Berkas terlalu kecil untuk sebuah arsip zip.");
+  }
+  const earliest = Math.max(0, bytes.length - EOCD_MIN_SIZE - MAX_COMMENT_LENGTH);
+  for (let offset = bytes.length - EOCD_MIN_SIZE; offset >= earliest; offset -= 1) {
+    if (readU32(bytes, offset) !== EOCD_SIGNATURE) {
+      continue;
+    }
+    const commentLength = readU16(bytes, offset + 20);
+    if (offset + EOCD_MIN_SIZE + commentLength <= bytes.length) {
+      return offset;
+    }
+  }
+  throw invalid2("Tidak menemukan End of Central Directory; berkas bukan zip yang valid.");
+}
+function decodeEntryName(raw) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(raw);
+  } catch {
+    throw zipError(
+      "zip_unsupported",
+      "Nama entri zip bukan UTF-8; arsip dengan nama CP437 tidak didukung."
+    );
+  }
+}
+function normalizeEntryName(raw) {
+  if (raw === "") {
+    throw invalid2("Arsip berisi entri tanpa nama.");
+  }
+  if (raw.includes("\0")) {
+    throw invalid2("Nama entri zip mengandung byte NUL.");
+  }
+  if (raw.includes("\\")) {
+    throw zipError(
+      "unsafe_zip_entry",
+      `Entri zip memakai pemisah Windows: "${raw}". Hanya "/" yang diterima.`
+    );
+  }
+  if (raw.startsWith("/") || /^[A-Za-z]:/.test(raw)) {
+    throw zipError("unsafe_zip_entry", `Entri zip memakai path absolut: "${raw}". Impor ditolak.`);
+  }
+  const segments = raw.split("/");
+  if (segments.some((segment) => segment === "..")) {
+    throw zipError(
+      "unsafe_zip_entry",
+      `Entri zip menunjuk keluar folder tujuan: "${raw}". Impor ditolak.`
+    );
+  }
+  const normalized = path2.posix.normalize(raw);
+  if (normalized === "." || normalized === "") {
+    return "";
+  }
+  if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/")) {
+    throw zipError(
+      "unsafe_zip_entry",
+      `Entri zip menunjuk keluar folder tujuan: "${raw}". Impor ditolak.`
+    );
+  }
+  return normalized;
+}
+function assertSingleDisk(bytes, eocd) {
+  const diskNumber = readU16(bytes, eocd + 4);
+  const cdStartDisk = readU16(bytes, eocd + 6);
+  const entriesOnDisk = readU16(bytes, eocd + 8);
+  const entriesTotal = readU16(bytes, eocd + 10);
+  const cdSize = readU32(bytes, eocd + 12);
+  const cdOffset = readU32(bytes, eocd + 16);
+  if (diskNumber !== 0 || cdStartDisk !== 0 || entriesOnDisk !== entriesTotal) {
+    throw zipError("zip_unsupported", "Arsip zip multi-disk tidak didukung.");
+  }
+  if (entriesTotal === ZIP64_ENTRY_COUNT || cdSize === ZIP64_SENTINEL || cdOffset === ZIP64_SENTINEL) {
+    throw zipError("zip_unsupported", "Arsip zip64 tidak didukung v0.1.");
+  }
+  if (cdOffset + cdSize > bytes.length) {
+    throw invalid2("Central directory zip melewati akhir berkas.");
+  }
+  return { entriesTotal, cdSize, cdOffset };
+}
+function parseZipEntries(bytes) {
+  const eocd = findEndOfCentralDirectory(bytes);
+  const { entriesTotal, cdSize, cdOffset } = assertSingleDisk(bytes, eocd);
+  const entries = [];
+  const fileNames = /* @__PURE__ */ new Set();
+  let cursor = cdOffset;
+  for (let index = 0; index < entriesTotal; index += 1) {
+    if (cursor + CENTRAL_MIN_SIZE > bytes.length) {
+      throw invalid2("Entri central directory terpotong.");
+    }
+    if (readU32(bytes, cursor) !== CENTRAL_SIGNATURE) {
+      throw invalid2("Tanda tangan central directory tidak dikenal.");
+    }
+    const flags = readU16(bytes, cursor + 8);
+    const method = readU16(bytes, cursor + 10);
+    const crc = readU32(bytes, cursor + 16);
+    const compressedSize = readU32(bytes, cursor + 20);
+    const uncompressedSize = readU32(bytes, cursor + 24);
+    const nameLength = readU16(bytes, cursor + 28);
+    const extraLength = readU16(bytes, cursor + 30);
+    const commentLength = readU16(bytes, cursor + 32);
+    const externalAttributes = readU32(bytes, cursor + 38);
+    const localOffset = readU32(bytes, cursor + 42);
+    const next = cursor + CENTRAL_MIN_SIZE + nameLength + extraLength + commentLength;
+    if (next > cdOffset + cdSize || next > bytes.length) {
+      throw invalid2("Central directory zip melewati batas arsip.");
+    }
+    if ((flags & 1) !== 0) {
+      throw zipError("zip_unsupported", "Arsip zip terenkripsi tidak didukung.");
+    }
+    if (compressedSize === ZIP64_SENTINEL || uncompressedSize === ZIP64_SENTINEL || localOffset === ZIP64_SENTINEL || nameLength === ZIP64_ENTRY_COUNT) {
+      throw zipError("zip_unsupported", "Entri zip64 tidak didukung v0.1.");
+    }
+    const rawName = decodeEntryName(
+      bytes.subarray(cursor + CENTRAL_MIN_SIZE, cursor + CENTRAL_MIN_SIZE + nameLength)
+    );
+    const name = normalizeEntryName(rawName);
+    const unixMode = externalAttributes >>> 16 & 65535;
+    const fileType = unixMode & FILE_TYPE_MASK;
+    const isDirectory = rawName.endsWith("/") || (externalAttributes & 16) !== 0 || fileType === DIRECTORY;
+    if (fileType === SYMLINK) {
+      throw zipError("unsafe_symlink", `Entri zip adalah tautan ("${rawName}"). Impor ditolak.`);
+    }
+    if (fileType !== 0 && fileType !== REGULAR_FILE && fileType !== DIRECTORY) {
+      throw zipError("zip_unsupported", `Entri zip bertipe khusus ("${rawName}") tidak didukung.`);
+    }
+    if (name === "") {
+      cursor = next;
+      continue;
+    }
+    if (!isDirectory) {
+      if (fileNames.has(name)) {
+        throw invalid2(`Arsip berisi entri ganda: "${name}".`);
+      }
+      fileNames.add(name);
+    }
+    entries.push({
+      name,
+      method,
+      compressedSize,
+      uncompressedSize,
+      crc,
+      localOffset,
+      permissions: unixMode & 511,
+      isDirectory
+    });
+    cursor = next;
+  }
+  return entries;
+}
+function assertLimits(archiveSize, entries) {
+  if (archiveSize > MAX_SOURCE_BYTES) {
+    throw zipError(
+      "source_too_large",
+      `Berkas zip melebihi batas ${MAX_SOURCE_BYTES} byte (10 MiB). Impor ditolak.`
+    );
+  }
+  if (entries.length > MAX_SOURCE_ENTRIES) {
+    throw zipError(
+      "source_too_many_files",
+      `Arsip zip melebihi batas ${MAX_SOURCE_ENTRIES} entri. Impor ditolak.`
+    );
+  }
+  let total = 0;
+  for (const entry of entries) {
+    if (entry.isDirectory) {
+      continue;
+    }
+    total += entry.uncompressedSize;
+    if (total > MAX_SOURCE_BYTES) {
+      throw zipError(
+        "source_too_large",
+        `Isi zip melebihi batas ${MAX_SOURCE_BYTES} byte (10 MiB) setelah diekstrak. Impor ditolak.`
+      );
+    }
+  }
+}
+function entryData(bytes, entry) {
+  if (entry.localOffset + LOCAL_MIN_SIZE > bytes.length) {
+    throw invalid2(`Local header entri "${entry.name}" terpotong.`);
+  }
+  if (readU32(bytes, entry.localOffset) !== LOCAL_SIGNATURE) {
+    throw invalid2(`Local header entri "${entry.name}" tidak dikenal.`);
+  }
+  const nameLength = readU16(bytes, entry.localOffset + 26);
+  const extraLength = readU16(bytes, entry.localOffset + 28);
+  const start = entry.localOffset + LOCAL_MIN_SIZE + nameLength + extraLength;
+  const end = start + entry.compressedSize;
+  if (end > bytes.length) {
+    throw invalid2(`Data entri "${entry.name}" melewati akhir berkas.`);
+  }
+  const compressed = bytes.subarray(start, end);
+  if (entry.method === 0) {
+    if (compressed.length !== entry.uncompressedSize) {
+      throw invalid2(`Ukuran entri "${entry.name}" tidak cocok dengan central directory.`);
+    }
+    return compressed;
+  }
+  if (entry.method !== 8) {
+    throw zipError(
+      "zip_unsupported",
+      `Metode kompresi ${entry.method} pada entri "${entry.name}" tidak didukung (hanya stored/deflate).`
+    );
+  }
+  let data;
+  try {
+    data = inflateRawSync(compressed, {
+      maxOutputLength: Math.max(1, entry.uncompressedSize)
+    });
+  } catch {
+    throw invalid2(
+      `Entri "${entry.name}" tidak bisa didekompresi atau melebihi ukuran yang dideklarasikan.`
+    );
+  }
+  if (data.length !== entry.uncompressedSize) {
+    throw invalid2(`Ukuran entri "${entry.name}" tidak cocok dengan central directory.`);
+  }
+  return new Uint8Array(data);
+}
+async function writeEntry(fs, bytes, entry, destination) {
+  const target = path2.join(destination, ...entry.name.split("/"));
+  if (!isPathInside(destination, target)) {
+    throw zipError(
+      "unsafe_zip_entry",
+      `Entri zip menunjuk keluar folder tujuan: "${entry.name}". Impor ditolak.`
+    );
+  }
+  if (entry.isDirectory) {
+    const created = await fs.mkdir(target, { recursive: true });
+    if (!created.ok) {
+      throw extractError(created.error.message, created.error);
+    }
+    return;
+  }
+  const data = entryData(bytes, entry);
+  if (crc32(data) !== entry.crc) {
+    throw invalid2(`CRC entri "${entry.name}" tidak cocok; arsip rusak.`);
+  }
+  const parent = await fs.mkdir(path2.dirname(target), { recursive: true });
+  if (!parent.ok) {
+    throw extractError(parent.error.message, parent.error);
+  }
+  const written = await fs.write(target, data, {
+    mode: entry.permissions === 0 ? DEFAULT_FILE_MODE : entry.permissions
+  });
+  if (!written.ok) {
+    throw extractError(written.error.message, written.error);
+  }
+}
+function extractError(message, cause) {
+  return zipError(
+    "zip_extract_failed",
+    `Gagal mengekstrak arsip zip ke direktori sementara: ${message}`,
+    cause
+  );
+}
+async function extractZipTo(fs, zipPath, destination) {
+  const resolved = path2.resolve(zipPath);
+  const archive = await fs.read(resolved);
+  if (!archive.ok) {
+    throw zipError(
+      "source_unreadable",
+      `Arsip zip tidak bisa dibaca: ${resolved} (${archive.error.code}).`,
+      archive.error
+    );
+  }
+  const entries = parseZipEntries(archive.value);
+  assertLimits(archive.value.length, entries);
+  const created = await fs.mkdir(destination, { recursive: true });
+  if (!created.ok) {
+    throw extractError(created.error.message, created.error);
+  }
+  for (const entry of entries) {
+    await writeEntry(fs, archive.value, entry, destination);
+  }
+}
+
+// src/library/staging.ts
+var STAGING_DIR_NAME = "staging";
+var STAGING_PREFIX = "stg_";
+var META_FILE_NAME = "meta.json";
+function stagingError(code, message, details) {
+  return new SkillManagerError({ code, message, ...details === void 0 ? {} : { details } });
+}
+function stagingRoot(dataRoot) {
+  return path2.join(dataRoot, STAGING_DIR_NAME);
+}
+function assertStagingId(stagingId) {
+  if (!/^stg_[A-Za-z0-9-]+$/.test(stagingId)) {
+    throw stagingError("staging_invalid", `Id staging tidak valid: "${stagingId}".`);
+  }
+}
+function newId(options) {
+  const raw = (options.newStagingId ?? (() => randomUUID()))();
+  const stagingId = `${STAGING_PREFIX}${raw}`;
+  assertStagingId(stagingId);
+  return stagingId;
+}
+async function prepare(fs, dataRoot, options) {
+  const stagingId = newId(options);
+  const root = path2.join(stagingRoot(dataRoot), stagingId);
+  const created = await fs.mkdir(root, { recursive: true });
+  if (!created.ok) {
+    throw stagingError(
+      "staging_invalid",
+      `Direktori staging tidak bisa dibuat: ${created.error.message}`,
+      created.error
+    );
+  }
+  return { stagingId, root };
+}
+async function finalize(fs, root, skillDir, stagingId, provenance, options) {
+  const suggestedName = await readSkillName(fs, skillDir);
+  const inspect = await inspectSource(fs, skillDir);
+  const meta = {
+    provenance,
+    suggestedName,
+    createdAt: (options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()))()
+  };
+  const written = await fs.write(`${root}/${META_FILE_NAME}`, `${JSON.stringify(meta)}
+`);
+  if (!written.ok) {
+    throw stagingError("staging_invalid", "Metadata staging tidak bisa ditulis.", written.error);
+  }
+  return { stagingId, inspect, provenance, suggestedName };
+}
+async function stageFromFolder(fs, dataRoot, sourceDir, options = {}) {
+  const { stagingId, root } = await prepare(fs, dataRoot, options);
+  const target = path2.join(root, "source");
+  try {
+    const copied = await fs.copy(path2.resolve(sourceDir), target);
+    if (!copied.ok) {
+      throw copied.error;
+    }
+    const provenance = { type: "folder", path: path2.resolve(sourceDir) };
+    return await finalize(fs, root, target, stagingId, provenance, options);
+  } catch (error) {
+    await fs.remove(root, { recursive: true });
+    throw error;
+  }
+}
+async function stageFromGit(fs, dataRoot, runner, input, options = {}) {
+  const { stagingId, root } = await prepare(fs, dataRoot, options);
+  try {
+    const cloned = await cloneGitTo(runner, input, root);
+    const skillDir = await findSkillDirectory(fs, root);
+    const provenance = {
+      type: "git",
+      url: cloned.url,
+      ref: cloned.ref,
+      commit: cloned.commit
+    };
+    return await finalize(fs, root, skillDir, stagingId, provenance, options);
+  } catch (error) {
+    await fs.remove(root, { recursive: true });
+    throw error;
+  }
+}
+async function stageFromZip(fs, dataRoot, zipPath, options = {}) {
+  const { stagingId, root } = await prepare(fs, dataRoot, options);
+  try {
+    await extractZipTo(fs, zipPath, root);
+    const skillDir = await findSkillDirectory(fs, root);
+    const provenance = { type: "zip", path: path2.resolve(zipPath) };
+    return await finalize(fs, root, skillDir, stagingId, provenance, options);
+  } catch (error) {
+    await fs.remove(root, { recursive: true });
+    throw error;
+  }
+}
+async function readStaged(fs, dataRoot, stagingId) {
+  assertStagingId(stagingId);
+  const root = path2.join(stagingRoot(dataRoot), stagingId);
+  const raw = await fs.readText(path2.join(root, META_FILE_NAME));
+  if (!raw.ok) {
+    throw stagingError(
+      "staging_not_found",
+      `Staging "${stagingId}" tidak ditemukan atau sudah kedaluwarsa. Ulangi pratinjau.`
+    );
+  }
+  let meta;
+  try {
+    meta = JSON.parse(raw.value);
+  } catch {
+    throw stagingError("staging_invalid", `Metadata staging "${stagingId}" rusak.`);
+  }
+  const skillDir = await findSkillDirectory(fs, root);
+  const inspect = await inspectSource(fs, skillDir);
+  return { stagingId, root, skillDir, meta, inspect };
+}
+async function importStaged(fs, dataRoot, stagingId, options = {}) {
+  const staged = await readStaged(fs, dataRoot, stagingId);
+  try {
+    const skillDir = await findSkillDirectory(fs, staged.root);
+    return await importFromDirectory(fs, dataRoot, {
+      sourceDir: skillDir,
+      provenance: staged.meta.provenance,
+      name: staged.meta.suggestedName,
+      ...options.newSkillId === void 0 ? {} : { newSkillId: options.newSkillId },
+      ...options.now === void 0 ? {} : { now: options.now }
+    });
+  } finally {
+    await fs.remove(staged.root, { recursive: true });
+  }
+}
+async function cleanStaleStaging(fs, dataRoot, maxAgeMs = 24 * 60 * 60 * 1e3, now = () => Date.now()) {
+  const root = stagingRoot(dataRoot);
+  const listing = await fs.readdir(root);
+  if (!listing.ok) {
+    return [];
+  }
+  const removed = [];
+  for (const entry of listing.value) {
+    if (entry.kind !== "directory" || !entry.name.startsWith(STAGING_PREFIX)) {
+      continue;
+    }
+    const target = path2.join(root, entry.name);
+    const raw = await fs.readText(path2.join(target, META_FILE_NAME));
+    let createdAt = Number.NaN;
+    if (raw.ok) {
+      try {
+        createdAt = Date.parse(JSON.parse(raw.value).createdAt);
+      } catch {
+        createdAt = Number.NaN;
+      }
+    }
+    if (Number.isNaN(createdAt) || now() - createdAt > maxAgeMs) {
+      await fs.remove(target, { recursive: true });
+      removed.push(target);
+    }
+  }
+  return removed;
+}
+
+// src/server/routes/skills.ts
+var nameSchema = z.string().min(1, "nama skill wajib diisi").max(200).refine((value) => value !== "." && value !== ".." && !/[\\/]/.test(value), {
+  message: "nama skill tidak boleh berupa path"
+});
+function summarizeSkill(skill) {
+  return {
+    id: skill.id,
+    name: skill.name,
+    dirName: skill.dirName,
+    contentHash: skill.contentHash,
+    source: skill.source,
+    importedAt: skill.importedAt,
+    ...skill.license === void 0 ? {} : { license: skill.license }
+  };
+}
+function flatten(nodes, result = []) {
+  for (const node of nodes) {
+    if (node.kind === "directory") {
+      flatten(node.children ?? [], result);
+      continue;
+    }
+    result.push({
+      path: node.path,
+      bytes: node.size,
+      ...node.kind === "symlink" ? { risk: "symlink" } : {}
+    });
+  }
+  return result;
+}
+function riskyOf(inspect) {
+  return {
+    scripts: inspect.hasScriptsDir,
+    binary: inspect.hasBinary,
+    escapingSymlink: inspect.hasEscapingSymlink,
+    messages: inspect.risks
+  };
+}
+async function findSkill(deps, name) {
+  const { skill } = await findLibrarySkill(deps.fs, deps.dataRoot, name);
+  return skill;
+}
+function skillDirectory(deps, skill) {
+  const root = libraryRoot(deps.dataRoot);
+  const directory = path2.join(root, skill.dirName);
+  if (!isPathInside(root, directory)) {
+    throw new SkillManagerError({
+      code: "invalid_path",
+      message: `Nama folder skill "${skill.dirName}" menunjuk keluar Library.`,
+      details: { path: directory }
+    });
+  }
+  return directory;
+}
+var inspectSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("folder"), path: z.string().min(1) }),
+  z.object({
+    type: z.literal("git"),
+    url: z.string().min(1),
+    ref: z.string().min(1).optional()
+  }),
+  z.object({ type: z.literal("zip"), path: z.string().min(1) })
+]);
+var importSchema = z.union([
+  z.object({ stagingId: z.string().min(1) }),
+  z.object({ type: z.literal("folder"), path: z.string().min(1) })
+]);
+function registerSkillRoutes(app, deps) {
+  let stagingCleaned = false;
+  const cleanStagingOnce = async () => {
+    if (stagingCleaned) {
+      return;
+    }
+    stagingCleaned = true;
+    await cleanStaleStaging(deps.fs, deps.dataRoot);
+  };
+  app.get("/api/skills", async (c) => {
+    const { state } = await loadState(deps.fs, deps.dataRoot);
+    return c.json({ skills: state.library.map((skill) => summarizeSkill(skill)) });
+  });
+  app.get("/api/skills/:name", async (c) => {
+    const parsed = nameSchema.safeParse(c.req.param("name"));
+    if (!parsed.success) {
+      throw new SkillManagerError({
+        code: "bad_request",
+        message: "Nama skill pada URL tidak valid.",
+        details: { issues: parsed.error.issues.map((issue) => issue.message) }
+      });
+    }
+    const skill = await findSkill(deps, parsed.data);
+    const directory = skillDirectory(deps, skill);
+    const inspected = await inspectSource(deps.fs, directory);
+    const planned = await planDependencies(deps.fs, directory, {
+      dataRoot: deps.dataRoot,
+      skillId: skill.dirName
+    });
+    return c.json({
+      skill: {
+        ...summarizeSkill(skill),
+        ...skill.license === void 0 && inspected.license === void 0 ? {} : { license: skill.license ?? inspected.license },
+        // Provenance sudah utuh di `source` (dari summarizeSkill); field
+        // terpisah di sini hanya akan menduplikasi objek yang sama.
+        files: flatten(inspected.files),
+        ...planned.ok ? { dependencies: planned.value } : {}
+      }
+    });
+  });
+  app.post("/api/skills/inspect", async (c) => {
+    const body = await readJson(c, inspectSchema);
+    await cleanStagingOnce();
+    let staged;
+    try {
+      if (body.type === "folder") {
+        staged = await stageFromFolder(deps.fs, deps.dataRoot, body.path);
+      } else if (body.type === "git") {
+        staged = await stageFromGit(
+          deps.fs,
+          deps.dataRoot,
+          deps.runner,
+          body.ref === void 0 ? { url: body.url } : { url: body.url, ref: body.ref }
+        );
+      } else {
+        staged = await stageFromZip(deps.fs, deps.dataRoot, body.path);
+      }
+    } catch (error) {
+      throw asDomainError(error);
+    }
+    return c.json({
+      stagingId: staged.stagingId,
+      files: staged.inspect.files,
+      risky: riskyOf(staged.inspect),
+      totalBytes: staged.inspect.totalBytes,
+      ...staged.inspect.license === void 0 ? {} : { license: staged.inspect.license },
+      suggestedName: staged.suggestedName,
+      provenance: staged.provenance
+    });
+  });
+  app.post("/api/skills/import", async (c) => {
+    const body = await readJson(c, importSchema);
+    const imported = "stagingId" in body ? await importStaged(deps.fs, deps.dataRoot, body.stagingId) : await importFolderSkill(deps.fs, deps.dataRoot, { sourceDir: body.path });
+    return c.json({ skill: summarizeSkill(imported.skill) }, 201);
+  });
+}
+
+// src/server/routes/deps.ts
+var planSchema = z.object({ skill: z.string().min(1) });
+var runSchema = planSchema.extend({ allowScripts: z.boolean().optional() });
+function registerDepsRoutes(app, deps) {
+  app.post("/api/deps/plan", async (c) => {
+    const body = await readJson(c, planSchema);
+    const skill = await findSkill(deps, body.skill);
+    const commands = unwrap(
+      await planDependencies(deps.fs, skillDirectory(deps, skill), {
+        dataRoot: deps.dataRoot,
+        skillId: skill.dirName
+      })
+    );
+    return c.json({ commands });
+  });
+  app.post("/api/deps/run", async (c) => {
+    const body = await readJson(c, runSchema);
+    const skill = await findSkill(deps, body.skill);
+    const report = await runDependencies({
+      fs: deps.fs,
+      runner: deps.runner,
+      dataRoot: deps.dataRoot,
+      skillId: skill.dirName,
+      skillDir: skillDirectory(deps, skill),
+      ...body.allowScripts === void 0 ? {} : { allowScripts: body.allowScripts }
+    });
+    return c.json({ ok: report.ok, output: report.results });
+  });
+}
+function toEntryError(error) {
+  return { code: error.code, message: error.message };
+}
+function isWantedSkill(skill, filter) {
+  return filter === void 0 || skill.name === filter || skill.id === filter;
+}
+async function computeDrift(fs, dataRoot, options) {
+  const { state } = await loadState(fs, dataRoot);
+  const stores = listStores(options.adapters, {
+    home: options.home,
+    platform: options.platform
+  });
+  const storesById = new Map(stores.map((store) => [store.id, store]));
+  const skills = new Map(state.library.map((skill) => [skill.id, skill]));
+  const filter = options.skill;
+  const entries = [];
+  let staleCount = 0;
+  for (const installation of state.installations) {
+    const skill = skills.get(installation.skillId);
+    if (filter !== void 0 && (skill === void 0 || !isWantedSkill(skill, filter))) {
+      continue;
+    }
+    const store = storesById.get(installation.storeId);
+    const skillName = skill?.name;
+    if (skill === void 0 || store === void 0) {
+      entries.push({
+        status: "missing",
+        storeId: installation.storeId,
+        path: "",
+        skillId: installation.skillId,
+        skillName,
+        installedHash: installation.installedHash,
+        error: skill === void 0 ? { code: "skill_not_found", message: "Entri Library untuk Installation ini hilang." } : { code: "unknown_store", message: "Store Installation ini tidak dikenal adapter." }
+      });
+      continue;
+    }
+    const destination = path2.join(store.path, skill.dirName);
+    const stat2 = await fs.stat(destination);
+    if (!stat2.ok) {
+      const notFound = stat2.error.code === "not_found";
+      entries.push({
+        status: notFound ? "missing" : "modified",
+        storeId: store.id,
+        path: destination,
+        skillId: skill.id,
+        skillName,
+        installedHash: installation.installedHash,
+        ...notFound ? {} : { error: toEntryError(stat2.error) }
+      });
+      continue;
+    }
+    if (stat2.value.kind !== "directory") {
+      entries.push({
+        status: "modified",
+        storeId: store.id,
+        path: destination,
+        skillId: skill.id,
+        skillName,
+        installedHash: installation.installedHash,
+        error: { code: "not_a_directory", message: "Path skill di Store bukan direktori." }
+      });
+      continue;
+    }
+    const hash = await contentHash(fs, destination);
+    if (!hash.ok) {
+      entries.push({
+        status: "modified",
+        storeId: store.id,
+        path: destination,
+        skillId: skill.id,
+        skillName,
+        installedHash: installation.installedHash,
+        error: toEntryError(hash.error)
+      });
+      continue;
+    }
+    const behindLibrary = hash.value !== skill.contentHash;
+    if (behindLibrary) {
+      staleCount += 1;
+    }
+    entries.push({
+      status: hash.value === installation.installedHash ? "clean" : "modified",
+      storeId: store.id,
+      path: destination,
+      skillId: skill.id,
+      skillName,
+      installedHash: installation.installedHash,
+      storeHash: hash.value,
+      behindLibrary
+    });
+  }
+  if (filter === void 0) {
+    entries.push(...await unmanagedEntries(fs, state.installations, skills, stores));
+  }
+  return { entries, staleCount };
+}
+async function unmanagedEntries(fs, installations, skills, stores) {
+  const recorded = /* @__PURE__ */ new Map();
+  for (const installation of installations) {
+    const skill = skills.get(installation.skillId);
+    if (skill === void 0) {
+      continue;
+    }
+    const names = recorded.get(installation.storeId) ?? /* @__PURE__ */ new Set();
+    names.add(skill.dirName);
+    recorded.set(installation.storeId, names);
+  }
+  const entries = [];
+  for (const store of stores) {
+    const listing = await fs.readdir(store.path);
+    if (!listing.ok) {
+      continue;
+    }
+    const known = recorded.get(store.id) ?? /* @__PURE__ */ new Set();
+    for (const entry of listing.value) {
+      if (entry.kind !== "directory" || known.has(entry.name)) {
+        continue;
+      }
+      if (entry.name.startsWith(TEMP_PREFIX)) {
+        continue;
+      }
+      entries.push({
+        status: "unmanaged",
+        storeId: store.id,
+        path: path2.join(store.path, entry.name),
+        skillName: entry.name
+      });
+    }
+  }
+  return entries;
+}
+
+// src/maintenance/doctor.ts
+async function tempDirectories(fs, options) {
+  const stores = listStores(options.adapters, {
+    home: options.home,
+    platform: options.platform
+  });
+  const found = [];
+  for (const store of stores) {
+    const listing = await fs.readdir(store.path);
+    if (!listing.ok) {
+      continue;
+    }
+    for (const entry of listing.value) {
+      if (entry.kind === "directory" && entry.name.startsWith(TEMP_PREFIX)) {
+        found.push({ storePath: store.path, dir: path2.join(store.path, entry.name) });
+      }
+    }
+  }
+  return found;
+}
+async function missingLibraryEntries(fs, dataRoot) {
+  const { state } = await loadState(fs, dataRoot);
+  const root = libraryRoot(dataRoot);
+  const found = [];
+  for (const skill of state.library) {
+    const dir = path2.join(root, skill.dirName);
+    const stat2 = await fs.stat(dir);
+    if (!stat2.ok || stat2.value.kind !== "directory") {
+      found.push({ skillId: skill.id, name: skill.name, path: dir });
+    }
+  }
+  return found;
+}
+async function runDoctor(fs, dataRoot, options) {
+  const drift = await computeDrift(fs, dataRoot, options);
+  const tempDirs = (await tempDirectories(fs, options)).map((entry) => entry.dir);
+  return {
+    missing: drift.entries.filter((entry) => entry.status === "missing"),
+    unmanaged: drift.entries.filter((entry) => entry.status === "unmanaged"),
+    stale: drift.entries.filter((entry) => entry.behindLibrary === true),
+    tempDirs,
+    libraryMissing: await missingLibraryEntries(fs, dataRoot)
+  };
+}
+async function cleanTempDirs(fs, _dataRoot, options) {
+  const removed = [];
+  const stores = listStores(options.adapters, {
+    home: options.home,
+    platform: options.platform
+  });
+  for (const store of stores) {
+    const listing = await fs.readdir(store.path);
+    if (!listing.ok) {
+      continue;
+    }
+    for (const entry of listing.value) {
+      if (entry.kind !== "directory" || !entry.name.startsWith(TEMP_PREFIX)) {
+        continue;
+      }
+      const dir = path2.join(store.path, entry.name);
+      const result = await removeWithinStore(fs, store.path, dir);
+      if (result.ok) {
+        removed.push(dir);
+      }
+    }
+  }
+  return removed;
+}
+
+// src/server/routes/doctor.ts
+function registerDoctorRoutes(app, deps) {
+  const options = async () => ({
+    adapters: (await loadAdapters({ fs: deps.fs, dataRoot: deps.dataRoot })).adapters,
+    home: deps.home
+  });
+  app.get("/api/doctor", async (c) => {
+    const report = await runDoctor(deps.fs, deps.dataRoot, await options());
+    return c.json(report);
+  });
+  app.post("/api/doctor/clean-temp", async (c) => {
+    const removed = await cleanTempDirs(deps.fs, deps.dataRoot, await options());
+    return c.json({ removed });
+  });
+}
+
+// src/server/routes/harnesses.ts
+function targetsFor(adapters, harness) {
+  const adapter = adapters.find((entry) => entry.id === harness.id);
+  if (adapter === void 0 || adapterCapability(adapter) !== "managed") {
+    return [];
+  }
+  const targets = [];
+  for (const store of adapter.stores) {
+    try {
+      const target = resolveTarget(adapters, { harnessId: adapter.id, scope: store.scope });
+      targets.push({
+        id: `${target.harnessId}/${target.scope}`,
+        harnessId: target.harnessId,
+        scope: target.scope,
+        storeId: target.storeId
+      });
+    } catch {
+    }
+  }
+  return targets;
+}
+function toView(adapters, harness) {
+  return {
+    id: harness.id,
+    name: harness.name,
+    capability: harness.capability,
+    detected: harness.detected,
+    detectionReasons: [...harness.detectionReasons],
+    storeIds: [...harness.storeIds],
+    targets: targetsFor(adapters, harness),
+    ...harness.connect === void 0 ? {} : { connect: { installUrl: harness.connect.installUrl } }
+  };
+}
+function registerHarnessRoutes(app, deps) {
+  const detect = async () => {
+    const result = await recheck({
+      fs: deps.fs,
+      runner: deps.runner,
+      dataRoot: deps.dataRoot,
+      home: deps.home
+    });
+    return { harnesses: result.harnesses.map((harness) => toView(result.adapters, harness)) };
+  };
+  app.get("/api/harnesses", async (c) => c.json(await detect()));
+  app.post("/api/harnesses/recheck", async (c) => c.json(await detect()));
+}
+function fromFs(error) {
+  return new SkillManagerError({
+    code: error.code,
+    message: error.message,
+    details: { path: error.path }
+  });
+}
+function toTargetError(error) {
+  if (error instanceof SkillManagerError) {
+    return { code: error.code, message: error.message, details: error.details };
+  }
+  return {
+    code: "io_error",
+    message: error instanceof Error ? error.message : String(error)
+  };
+}
+async function ensureStoreDirectory(fs, storePath) {
+  const stat2 = await fs.stat(storePath);
+  if (stat2.ok) {
+    if (stat2.value.kind !== "directory") {
+      throw new SkillManagerError({
+        code: "not_a_directory",
+        message: `Store ${storePath} bukan direktori.`,
+        details: { path: storePath }
+      });
+    }
+    return;
+  }
+  if (stat2.error.code !== "not_found") {
+    throw fromFs(stat2.error);
+  }
+  const made = await fs.mkdir(storePath, { recursive: true });
+  if (!made.ok) {
+    throw fromFs(made.error);
+  }
+}
+function populateFrom(fs, source) {
+  return async (tempDir) => {
+    const listing = await fs.readdir(source);
+    if (!listing.ok) {
+      return listing;
+    }
+    for (const entry of listing.value) {
+      const copied = await fs.copy(path2.join(source, entry.name), path2.join(tempDir, entry.name));
+      if (!copied.ok) {
+        return copied;
+      }
+    }
+    return fsOk(void 0);
+  };
+}
+function findOwner(state, storeId, dirName) {
+  for (const installation of state.installations) {
+    if (installation.storeId !== storeId) {
+      continue;
+    }
+    const owner = state.library.find(
+      (entry) => entry.id === installation.skillId && entry.dirName === dirName
+    );
+    if (owner !== void 0) {
+      return { skillId: owner.id, name: owner.name };
+    }
+  }
+  return void 0;
+}
+function conflictError2(destination, storeId, owner) {
+  const owned = owner === void 0 ? "tidak tercatat sebagai Installation" : `milik skill "${owner.name}"`;
+  return new SkillManagerError({
+    code: "install_conflict",
+    message: `${destination} sudah ada di Store ${storeId} (${owned}). Tidak ada yang ditimpa.`,
+    details: { path: destination, storeId, owner: owner ?? null }
+  });
+}
+async function installOne(context, store, installedAt) {
+  const destination = path2.join(store.path, context.skill.dirName);
+  await ensureStoreDirectory(context.fs, store.path);
+  const guarded = await guardStorePath(context.fs, store.path, destination);
+  if (!guarded.ok) {
+    throw fromFs(guarded.error);
+  }
+  if (await context.fs.exists(guarded.value.path)) {
+    throw conflictError2(
+      guarded.value.path,
+      store.id,
+      findOwner(context.state, store.id, context.skill.dirName)
+    );
+  }
+  const written = await writeDirectoryAtomic(
+    context.fs,
+    guarded.value.path,
+    populateFrom(context.fs, context.source)
+  );
+  if (!written.ok) {
+    if (written.error.code === "already_exists") {
+      throw conflictError2(
+        guarded.value.path,
+        store.id,
+        findOwner(context.state, store.id, context.skill.dirName)
+      );
+    }
+    throw fromFs(written.error);
+  }
+  const hash = await contentHash(context.fs, guarded.value.path);
+  if (!hash.ok) {
+    await removeWithinStore(context.fs, store.path, guarded.value.path);
+    throw fromFs(hash.error);
+  }
+  return {
+    skillId: context.skill.id,
+    storeId: store.id,
+    mode: "copy",
+    installedHash: hash.value,
+    installedAt
+  };
+}
+function resolvePlanEntry(options, targetId, stores) {
+  try {
+    const target = resolveTarget(options.adapters, targetId, {
+      shared: options.shared
+    });
+    const store = stores.get(target.storeId);
+    if (store === void 0) {
+      throw new SkillManagerError({
+        code: "unknown_store",
+        message: `Store "${target.storeId}" untuk Target "${targetId}" tidak dikenal.`
+      });
+    }
+    return { targetId, store };
+  } catch (error) {
+    return { targetId, error: toTargetError(error) };
+  }
+}
+function assertSharedAcknowledged(plan, acknowledgeShared) {
+  if (acknowledgeShared === true) {
+    return;
+  }
+  const shared = plan.filter((entry) => entry.store !== void 0 && !entry.store.exclusive);
+  if (shared.length === 0) {
+    return;
+  }
+  const storeList = /* @__PURE__ */ new Map();
+  for (const entry of shared) {
+    if (entry.store !== void 0) {
+      storeList.set(entry.store.id, entry.store);
+    }
+  }
+  const stores = [...storeList.values()];
+  const described = stores.map((store) => `${store.id} (member: ${store.members.join(", ")})`);
+  const targets = shared.map((entry) => entry.targetId);
+  throw new SkillManagerError({
+    code: "shared_confirmation_required",
+    message: `Memasang ke grup shared akan terlihat oleh semua member terdampak: ${described.join("; ")}. Setujui dulu dengan acknowledgeShared.`,
+    details: {
+      stores: stores.map((store) => ({ storeId: store.id, members: [...store.members] })),
+      targets
+    }
+  });
+}
+function installationKey(installation) {
+  return `${installation.skillId}::${installation.storeId}`;
+}
+async function persistInstallations(fs, dataRoot, state, installations) {
+  if (installations.length === 0) {
+    return;
+  }
+  const replaced = new Set(installations.map(installationKey));
+  const kept = state.installations.filter(
+    (installation) => !replaced.has(installationKey(installation))
+  );
+  const saved = await saveState(fs, dataRoot, {
+    ...state,
+    installations: [...kept, ...installations]
+  });
+  if (!saved.ok) {
+    throw new SkillManagerError({
+      code: "state_write_failed",
+      message: `Installation berhasil disalin tetapi state.json gagal ditulis: ${saved.error.message}`,
+      details: saved.error
+    });
+  }
+}
+async function installSkill(options) {
+  const { fs, dataRoot } = options;
+  const { skill, source, state } = await resolveLibrarySkill(fs, dataRoot, options.skill);
+  const stores = new Map(
+    listStores(options.adapters, { home: options.home, platform: options.platform }).map(
+      (store) => [store.id, store]
+    )
+  );
+  const plan = options.targets.map((targetId) => resolvePlanEntry(options, targetId, stores));
+  assertSharedAcknowledged(plan, options.acknowledgeShared);
+  const context = { fs, state, skill, source };
+  const results = [];
+  const installations = [];
+  for (const entry of plan) {
+    if (entry.error !== void 0) {
+      results.push({ targetId: entry.targetId, ok: false, error: entry.error });
+      continue;
+    }
+    try {
+      const installation = await installOne(context, entry.store, (/* @__PURE__ */ new Date()).toISOString());
+      installations.push(installation);
+      results.push({ targetId: entry.targetId, ok: true, installation });
+    } catch (error) {
+      results.push({ targetId: entry.targetId, ok: false, error: toTargetError(error) });
+    }
+  }
+  await persistInstallations(fs, dataRoot, state, installations);
+  return results;
+}
+function fromFs2(error) {
+  return new SkillManagerError({
+    code: error.code,
+    message: error.message,
+    details: { path: error.path }
+  });
+}
+function toTargetError2(error) {
+  if (error instanceof SkillManagerError) {
+    return { code: error.code, message: error.message, details: error.details };
+  }
+  return {
+    code: "io_error",
+    message: error instanceof Error ? error.message : String(error)
+  };
+}
+function resolvePlanEntry2(options, targetId, stores) {
+  try {
+    const target = resolveTarget(options.adapters, targetId);
+    const store = stores.get(target.storeId);
+    if (store === void 0) {
+      throw new SkillManagerError({
+        code: "unknown_store",
+        message: `Store "${target.storeId}" untuk Target "${targetId}" tidak dikenal.`
+      });
+    }
+    return { targetId, store };
+  } catch (error) {
+    return { targetId, error: toTargetError2(error) };
+  }
+}
+function assertSharedAcknowledged2(plan, acknowledgeShared) {
+  if (acknowledgeShared === true) {
+    return;
+  }
+  const shared = plan.filter((entry) => entry.store !== void 0 && !entry.store.exclusive);
+  if (shared.length === 0) {
+    return;
+  }
+  const storeList = /* @__PURE__ */ new Map();
+  for (const entry of shared) {
+    if (entry.store !== void 0) {
+      storeList.set(entry.store.id, entry.store);
+    }
+  }
+  const stores = [...storeList.values()];
+  const described = stores.map((store) => `${store.id} (member: ${store.members.join(", ")})`);
+  throw new SkillManagerError({
+    code: "shared_confirmation_required",
+    message: `Mencabut dari grup shared akan menghapus salinan untuk semua member terdampak: ${described.join("; ")}. Setujui dulu dengan acknowledgeShared.`,
+    details: {
+      stores: stores.map((store) => ({ storeId: store.id, members: [...store.members] })),
+      targets: shared.map((entry) => entry.targetId)
+    }
+  });
+}
+async function uninstallOne(fs, state, skill, store, force) {
+  const installation = state.installations.find(
+    (entry) => entry.skillId === skill.id && entry.storeId === store.id
+  );
+  if (installation === void 0) {
+    throw new SkillManagerError({
+      code: "installation_not_found",
+      message: `Skill "${skill.name}" tidak tercatat terpasang di Store ${store.id}.`,
+      details: { storeId: store.id, skillId: skill.id }
+    });
+  }
+  const destination = path2.join(store.path, skill.dirName);
+  const guarded = await guardStorePath(fs, store.path, destination, { mustExist: true });
+  if (!guarded.ok) {
+    if (guarded.error.code === "not_found") {
+      return installation;
+    }
+    throw fromFs2(guarded.error);
+  }
+  const hash = await contentHash(fs, guarded.value.path);
+  if (!hash.ok) {
+    throw fromFs2(hash.error);
+  }
+  if (hash.value !== installation.installedHash && !force) {
+    throw new SkillManagerError({
+      code: "drift_detected",
+      message: `Isi ${guarded.value.path} sudah berubah sejak dipasang (hash berbeda). Tidak ada yang dihapus; setujui force untuk menghapus tetap.`,
+      details: {
+        storeId: store.id,
+        path: guarded.value.path,
+        expectedHash: installation.installedHash,
+        actualHash: hash.value
+      }
+    });
+  }
+  const removed = await removeWithinStore(fs, store.path, guarded.value.path);
+  if (!removed.ok) {
+    throw fromFs2(removed.error);
+  }
+  return installation;
+}
+function installationKey2(installation) {
+  return `${installation.skillId}::${installation.storeId}`;
+}
+async function persistRemovals(fs, dataRoot, state, removed) {
+  if (removed.length === 0) {
+    return;
+  }
+  const keys = new Set(removed.map(installationKey2));
+  const saved = await saveState(fs, dataRoot, {
+    ...state,
+    installations: state.installations.filter(
+      (installation) => !keys.has(installationKey2(installation))
+    )
+  });
+  if (!saved.ok) {
+    throw new SkillManagerError({
+      code: "state_write_failed",
+      message: `Salinan berhasil dihapus tetapi state.json gagal ditulis: ${saved.error.message}`,
+      details: saved.error
+    });
+  }
+}
+async function uninstallSkill(options) {
+  const { fs, dataRoot } = options;
+  const { skill, state } = await findLibrarySkill(fs, dataRoot, options.skill);
+  const stores = new Map(
+    listStores(options.adapters, { home: options.home, platform: options.platform }).map(
+      (store) => [store.id, store]
+    )
+  );
+  const plan = options.targets.map((targetId) => resolvePlanEntry2(options, targetId, stores));
+  assertSharedAcknowledged2(plan, options.acknowledgeShared);
+  const results = [];
+  const removed = [];
+  for (const entry of plan) {
+    if (entry.error !== void 0) {
+      results.push({ targetId: entry.targetId, ok: false, error: entry.error });
+      continue;
+    }
+    try {
+      const installation = await uninstallOne(
+        fs,
+        state,
+        skill,
+        entry.store,
+        options.force === true
+      );
+      removed.push(installation);
+      results.push({ targetId: entry.targetId, ok: true, installation });
+    } catch (error) {
+      results.push({ targetId: entry.targetId, ok: false, error: toTargetError2(error) });
+    }
+  }
+  await persistRemovals(fs, dataRoot, state, removed);
+  return results;
+}
+
+// src/server/routes/installations.ts
+var targetSchema = z.string().min(1);
+var installSchema = z.object({
+  skill: z.string().min(1),
+  targets: z.array(targetSchema).min(1, "minimal satu Target"),
+  acknowledgeShared: z.boolean().optional()
+});
+var uninstallSchema = installSchema.extend({
+  force: z.boolean().optional()
+});
+function targetIdsByStore(adapters) {
+  const map = /* @__PURE__ */ new Map();
+  for (const adapter of adapters) {
+    if (adapterCapability(adapter) !== "managed") {
+      continue;
+    }
+    for (const store of adapter.stores) {
+      if (map.has(store.path)) {
+        continue;
+      }
+      try {
+        const target = resolveTarget(adapters, { harnessId: adapter.id, scope: store.scope });
+        map.set(target.storeId, `${target.harnessId}/${target.scope}`);
+      } catch {
+      }
+    }
+  }
+  return map;
+}
+async function assertNoDrift(deps, adapters, skill, targets) {
+  const report = await computeDrift(deps.fs, deps.dataRoot, {
+    adapters,
+    skill,
+    home: deps.home
+  });
+  const byStore = new Map(report.entries.map((entry) => [entry.storeId, entry]));
+  const requested = /* @__PURE__ */ new Set();
+  for (const targetId of targets) {
+    try {
+      requested.add(resolveTarget(adapters, targetId).storeId);
+    } catch {
+    }
+  }
+  for (const storeId of requested) {
+    const entry = byStore.get(storeId);
+    if (entry === void 0 || entry.status !== "modified") {
+      continue;
+    }
+    throw new SkillManagerError({
+      code: "drift_detected",
+      message: `Isi ${entry.path} sudah berubah sejak dipasang (hash berbeda). Tidak ada yang dihapus; setujui force untuk menghapus tetap.`,
+      details: {
+        storeId,
+        path: entry.path,
+        expectedHash: entry.installedHash,
+        actualHash: entry.storeHash
+      }
+    });
+  }
+}
+function registerInstallationRoutes(app, deps) {
+  const adaptersOf = async () => (await loadAdapters({ fs: deps.fs, dataRoot: deps.dataRoot })).adapters;
+  app.get("/api/installations", async (c) => {
+    const adapters = await adaptersOf();
+    const { state } = await loadState(deps.fs, deps.dataRoot);
+    const names = new Map(state.library.map((skill) => [skill.id, skill.name]));
+    const targetIds = targetIdsByStore(adapters);
+    const drift = await computeDrift(deps.fs, deps.dataRoot, { adapters, home: deps.home });
+    const driftByKey = new Map(
+      drift.entries.filter((entry) => entry.skillId !== void 0).map((entry) => [`${entry.skillId}::${entry.storeId}`, entry.status])
+    );
+    const installations = [];
+    for (const installation of state.installations) {
+      const skillName = names.get(installation.skillId);
+      if (skillName === void 0) {
+        continue;
+      }
+      const status = driftByKey.get(`${installation.skillId}::${installation.storeId}`);
+      installations.push({
+        skillId: installation.skillId,
+        skillName,
+        targetId: targetIds.get(installation.storeId) ?? installation.storeId,
+        storeId: installation.storeId,
+        mode: installation.mode,
+        installedHash: installation.installedHash,
+        installedAt: installation.installedAt,
+        ...status === void 0 ? {} : { drift: status }
+      });
+    }
+    return c.json({ installations });
+  });
+  app.post("/api/installations", async (c) => {
+    const body = await readJson(c, installSchema);
+    const adapters = await adaptersOf();
+    const results = await installSkill({
+      fs: deps.fs,
+      dataRoot: deps.dataRoot,
+      adapters,
+      home: deps.home,
+      skill: body.skill,
+      targets: body.targets,
+      ...body.acknowledgeShared === void 0 ? {} : { acknowledgeShared: body.acknowledgeShared }
+    });
+    return c.json({ results });
+  });
+  app.delete("/api/installations", async (c) => {
+    const body = await readJson(c, uninstallSchema);
+    const adapters = await adaptersOf();
+    if (body.force !== true) {
+      await assertNoDrift(deps, adapters, body.skill, body.targets);
+    }
+    const results = await uninstallSkill({
+      fs: deps.fs,
+      dataRoot: deps.dataRoot,
+      adapters,
+      home: deps.home,
+      skill: body.skill,
+      targets: body.targets,
+      ...body.force === void 0 ? {} : { force: body.force },
+      ...body.acknowledgeShared === void 0 ? {} : { acknowledgeShared: body.acknowledgeShared }
+    });
+    return c.json({ results });
+  });
+}
+function fromFs3(error) {
+  return new SkillManagerError({
+    code: error.code,
+    message: error.message,
+    details: { path: error.path }
+  });
+}
+function toTargetError3(error) {
+  if (error instanceof SkillManagerError) {
+    return { code: error.code, message: error.message, details: error.details };
+  }
+  return {
+    code: "io_error",
+    message: error instanceof Error ? error.message : String(error)
+  };
+}
+function installationKey3(installation) {
+  return `${installation.skillId}::${installation.storeId}`;
+}
+function targetIdForStore(adapters, storeId) {
+  for (const adapter of adapters) {
+    if (adapterCapability(adapter) !== "managed") {
+      continue;
+    }
+    for (const store of adapter.stores) {
+      if (store.path === storeId) {
+        return `${adapter.id}/${store.scope}`;
+      }
+    }
+  }
+  return void 0;
+}
+function resolvePlan(options, state, skill, stores) {
+  const findInstallation = (storeId) => state.installations.find(
+    (installation) => installation.skillId === skill.id && installation.storeId === storeId
+  );
+  if (options.targets !== void 0) {
+    return options.targets.map((targetId) => {
+      try {
+        const target = resolveTarget(options.adapters, targetId);
+        const store = stores.get(target.storeId);
+        if (store === void 0) {
+          throw new SkillManagerError({
+            code: "unknown_store",
+            message: `Store "${target.storeId}" untuk Target "${targetId}" tidak dikenal.`
+          });
+        }
+        const installation = findInstallation(store.id);
+        if (installation === void 0) {
+          throw new SkillManagerError({
+            code: "installation_not_found",
+            message: `Skill "${skill.name}" tidak tercatat terpasang di Store ${store.id}.`,
+            details: { storeId: store.id, skillId: skill.id }
+          });
+        }
+        return { targetId, store, installation };
+      } catch (error) {
+        return { targetId, error: toTargetError3(error) };
+      }
+    });
+  }
+  return state.installations.filter((installation) => installation.skillId === skill.id).map((installation) => {
+    const store = stores.get(installation.storeId);
+    const targetId = targetIdForStore(options.adapters, installation.storeId) ?? installation.storeId;
+    if (store === void 0) {
+      return {
+        targetId,
+        error: {
+          code: "unknown_store",
+          message: `Store "${installation.storeId}" tidak dikenal adapter.`
+        }
+      };
+    }
+    return { targetId, store, installation };
+  });
+}
+async function ensureStoreDirectory2(fs, storePath) {
+  const stat2 = await fs.stat(storePath);
+  if (stat2.ok) {
+    if (stat2.value.kind !== "directory") {
+      throw new SkillManagerError({
+        code: "not_a_directory",
+        message: `Store ${storePath} bukan direktori.`,
+        details: { path: storePath }
+      });
+    }
+    return;
+  }
+  if (stat2.error.code !== "not_found") {
+    throw fromFs3(stat2.error);
+  }
+  const made = await fs.mkdir(storePath, { recursive: true });
+  if (!made.ok) {
+    throw fromFs3(made.error);
+  }
+}
+function populateFrom2(fs, source) {
+  return async (tempDir) => {
+    const listing = await fs.readdir(source);
+    if (!listing.ok) {
+      return listing;
+    }
+    for (const entry of listing.value) {
+      const copied = await fs.copy(path2.join(source, entry.name), path2.join(tempDir, entry.name));
+      if (!copied.ok) {
+        return copied;
+      }
+    }
+    return { ok: true, value: void 0 };
+  };
+}
+async function swapDirectory(fs, containerDir, destination, label, populate) {
+  const staging = path2.join(containerDir, `${TEMP_PREFIX}${label}-${randomUUID()}`);
+  const written = await writeDirectoryAtomic(fs, staging, populate);
+  if (!written.ok) {
+    throw fromFs3(written.error);
+  }
+  const backup = path2.join(containerDir, `${TEMP_PREFIX}backup-${randomUUID()}`);
+  const hadTarget = await fs.exists(destination);
+  if (hadTarget) {
+    const moved = await fs.rename(destination, backup);
+    if (!moved.ok) {
+      await fs.remove(staging, { recursive: true });
+      throw fromFs3(moved.error);
+    }
+  }
+  const swapped = await fs.rename(staging, destination);
+  if (!swapped.ok) {
+    if (hadTarget) {
+      await fs.rename(backup, destination);
+    }
+    await fs.remove(staging, { recursive: true });
+    throw fromFs3(swapped.error);
+  }
+  if (hadTarget) {
+    await fs.remove(backup, { recursive: true });
+  }
+}
+async function restoreOne(fs, skill, source, store, installation) {
+  await ensureStoreDirectory2(fs, store.path);
+  const destination = path2.join(store.path, skill.dirName);
+  const guarded = await guardStorePath(fs, store.path, destination);
+  if (!guarded.ok) {
+    throw fromFs3(guarded.error);
+  }
+  const target = guarded.value.path;
+  await swapDirectory(fs, store.path, target, "restore", populateFrom2(fs, source));
+  const hash = await contentHash(fs, target);
+  if (!hash.ok) {
+    throw fromFs3(hash.error);
+  }
+  return { ...installation, installedHash: hash.value };
+}
+async function adoptOne(fs, dataRoot, skill, store) {
+  const destination = path2.join(store.path, skill.dirName);
+  const stat2 = await fs.stat(destination);
+  if (!stat2.ok) {
+    throw new SkillManagerError({
+      code: "drift_missing",
+      message: `Isi ${destination} tidak ada; tidak ada yang bisa diadopsi.`,
+      details: { path: destination, storeId: store.id }
+    });
+  }
+  if (stat2.value.kind !== "directory") {
+    throw new SkillManagerError({
+      code: "not_a_directory",
+      message: `${destination} bukan direktori; tidak ada yang bisa diadopsi.`,
+      details: { path: destination, storeId: store.id }
+    });
+  }
+  const libraryDir = libraryRoot(dataRoot);
+  const made = await fs.mkdir(libraryDir, { recursive: true });
+  if (!made.ok) {
+    throw fromFs3(made.error);
+  }
+  await swapDirectory(
+    fs,
+    libraryDir,
+    path2.join(libraryDir, skill.dirName),
+    "adopt",
+    populateFrom2(fs, destination)
+  );
+  const hash = await contentHash(fs, path2.join(libraryDir, skill.dirName));
+  if (!hash.ok) {
+    throw fromFs3(hash.error);
+  }
+  return hash.value;
+}
+async function persist(fs, dataRoot, state, skillId, libraryHash, installations) {
+  if (installations.length === 0 && libraryHash === void 0) {
+    return;
+  }
+  const replaced = new Set(installations.map(installationKey3));
+  const kept = state.installations.filter(
+    (installation) => !replaced.has(installationKey3(installation))
+  );
+  const library = libraryHash === void 0 ? state.library : state.library.map(
+    (skill) => skill.id === skillId ? { ...skill, contentHash: libraryHash } : skill
+  );
+  const saved = await saveState(fs, dataRoot, {
+    ...state,
+    library,
+    installations: [...kept, ...installations]
+  });
+  if (!saved.ok) {
+    throw new SkillManagerError({
+      code: "state_write_failed",
+      message: `Sinkron selesai tetapi state.json gagal ditulis: ${saved.error.message}`,
+      details: saved.error
+    });
+  }
+}
+async function syncSkill(options) {
+  const { fs, dataRoot } = options;
+  if (options.confirm !== true) {
+    throw new SkillManagerError({
+      code: "confirmation_required",
+      message: options.action === "restore" ? "Restore menimpa perubahan user di Store. Setujui dulu dengan confirm: true." : "Adopt mengubah hash Library. Setujui dulu dengan confirm: true.",
+      details: { action: options.action }
+    });
+  }
+  const { state } = await loadState(fs, dataRoot);
+  const skill = state.library.find(
+    (entry) => entry.name === options.skill || entry.id === options.skill
+  );
+  if (skill === void 0) {
+    throw new SkillManagerError({
+      code: "skill_not_found",
+      message: `Skill "${options.skill}" tidak ada di Library.`
+    });
+  }
+  let source = "";
+  if (options.action === "restore") {
+    source = path2.join(libraryRoot(dataRoot), skill.dirName);
+    const stat2 = await fs.stat(source);
+    if (!stat2.ok || stat2.value.kind !== "directory") {
+      throw new SkillManagerError({
+        code: "skill_not_found",
+        message: `Isi skill "${skill.name}" tidak ditemukan di Library (${source}).`,
+        details: { path: source }
+      });
+    }
+  }
+  const stores = new Map(
+    listStores(options.adapters, { home: options.home, platform: options.platform }).map(
+      (store) => [store.id, store]
+    )
+  );
+  const plan = resolvePlan(options, state, skill, stores);
+  const results = [];
+  const updated = [];
+  let libraryHash;
+  for (const entry of plan) {
+    if (entry.error !== void 0) {
+      results.push({ targetId: entry.targetId, ok: false, error: entry.error });
+      continue;
+    }
+    try {
+      if (options.action === "restore") {
+        const installation2 = await restoreOne(fs, skill, source, entry.store, entry.installation);
+        updated.push(installation2);
+        results.push({ targetId: entry.targetId, ok: true, installation: installation2 });
+        continue;
+      }
+      const hash = await adoptOne(fs, dataRoot, skill, entry.store);
+      if (libraryHash !== void 0 && libraryHash !== hash) {
+        throw new SkillManagerError({
+          code: "adopt_conflict",
+          message: "Isi Target lain berbeda; satu Library tidak bisa mengadopsi dua isi berbeda. Adopsi Target ini secara terpisah setelah membereskan perbedaannya.",
+          details: { storeId: entry.store.id, targetId: entry.targetId }
+        });
+      }
+      libraryHash = hash;
+      const installation = { ...entry.installation, installedHash: hash };
+      updated.push(installation);
+      results.push({ targetId: entry.targetId, ok: true, installation });
+    } catch (error) {
+      results.push({ targetId: entry.targetId, ok: false, error: toTargetError3(error) });
+    }
+  }
+  await persist(fs, dataRoot, state, skill.id, libraryHash, updated);
+  return results;
+}
+
+// src/server/routes/sync.ts
+var syncSchema = z.object({
+  skill: z.string().min(1),
+  action: z.enum(["restore", "adopt"]),
+  /**
+   * Wajib `true`. Tanpa ini domain menolak dengan `confirmation_required`
+   * (AC-8: "tanpa konfirmasi tidak ada penimpaan"), sehingga gerbang
+   * konfirmasi tetap berlaku juga bagi pemanggil HTTP langsung — bukan hanya
+   * bagi UI yang kebetulan menampilkan dialog.
+   */
+  confirm: z.boolean().optional()
+});
+function registerSyncRoutes(app, deps) {
+  app.post("/api/sync", async (c) => {
+    const body = await readJson(c, syncSchema);
+    const { adapters } = await loadAdapters({ fs: deps.fs, dataRoot: deps.dataRoot });
+    await syncSkill({
+      fs: deps.fs,
+      dataRoot: deps.dataRoot,
+      adapters,
+      home: deps.home,
+      skill: body.skill,
+      action: body.action,
+      confirm: body.confirm === true
+    });
+    const { state } = await loadState(deps.fs, deps.dataRoot);
+    const skill = state.library.find(
+      (entry) => entry.name === body.skill || entry.id === body.skill
+    );
+    if (skill === void 0) {
+      throw new SkillManagerError({
+        code: "skill_not_found",
+        message: `Skill "${body.skill}" tidak ada di Library.`
+      });
+    }
+    return c.json({ skill: summarizeSkill(skill) });
+  });
+}
+
+// src/server/app.ts
+function defaultServerDeps() {
+  return {
+    fs: new NodeFileSystem(),
+    runner: new NodeProcessRunner(),
+    dataRoot: resolveDataRoot(),
+    home: homedir()
+  };
+}
+var SESSION_COOKIE = "sm_session";
+var APP_VERSION = package_default.version;
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
+var STATUS_BY_CODE = {
+  bad_request: 400,
+  unauthorized: 401,
+  forbidden: 403,
+  not_found: 404,
+  source_not_found: 404,
+  skill_not_found: 404,
+  installation_not_found: 404,
+  staging_not_found: 404,
+  harness_not_found: 404,
+  web_not_built: 404,
+  conflict: 409,
+  install_conflict: 409,
+  name_conflict: 409,
+  drift_detected: 409,
+  adopt_conflict: 409,
+  shared_confirmation_required: 409,
+  confirmation_required: 409,
+  already_exists: 409,
+  not_empty: 409,
+  unsupported_version: 500,
+  state_unsupported_version: 500,
+  state_write_failed: 500,
+  import_failed: 500,
+  io_error: 500,
+  permission_denied: 500,
+  process_failed: 500,
+  dependency_run_failed: 500
+};
+function statusForCode(code) {
+  return STATUS_BY_CODE[code] ?? 400;
+}
+function errorBody(code, message, details) {
+  if (details === void 0) {
+    return { error: { code, message } };
+  }
+  return { error: { code, message, details } };
+}
+function tokensMatch(given, expected) {
+  const givenBuffer = Buffer.from(given);
+  const expectedBuffer = Buffer.from(expected);
+  if (givenBuffer.length !== expectedBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(givenBuffer, expectedBuffer);
+}
+function validPort(value) {
+  if (!/^\d{1,5}$/.test(value)) {
+    return false;
+  }
+  const port = Number(value);
+  return port >= 0 && port <= 65535;
+}
+function parseHostHeader(value) {
+  if (value.startsWith("[")) {
+    const closingBracket = value.indexOf("]");
+    if (closingBracket === -1) {
+      return void 0;
+    }
+    const hostname2 = value.slice(1, closingBracket);
+    if (!hostname2) {
+      return void 0;
+    }
+    const remainder = value.slice(closingBracket + 1);
+    if (remainder !== "") {
+      if (!remainder.startsWith(":")) {
+        return void 0;
+      }
+      if (!validPort(remainder.slice(1))) {
+        return void 0;
+      }
+    }
+    return hostname2;
+  }
+  const parts = value.split(":");
+  if (parts.length > 2) {
+    return void 0;
+  }
+  const hostname = parts[0] ?? "";
+  if (!hostname) {
+    return void 0;
+  }
+  const port = parts[1];
+  if (port !== void 0 && !validPort(port)) {
+    return void 0;
+  }
+  return hostname;
+}
+function checkHost(hostHeader) {
+  if (hostHeader === void 0) {
+    return 400;
+  }
+  const value = hostHeader.trim().toLowerCase();
+  if (!value) {
+    return 400;
+  }
+  const hostname = parseHostHeader(value);
+  if (hostname === void 0) {
+    return 400;
+  }
+  return LOOPBACK_HOSTNAMES.has(hostname) ? "ok" : 403;
+}
+function isSpaNavigation(c) {
+  if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+    return false;
+  }
+  const accept = c.req.header("accept")?.toLowerCase() ?? "";
+  if (!accept.includes("text/html")) {
+    return false;
+  }
+  return extname(c.req.path) === "";
+}
+function handleAppError(error, c) {
+  if (error instanceof SkillManagerError) {
+    return c.json(errorBody(error.code, error.message, error.details), statusForCode(error.code));
+  }
+  return c.json(errorBody("internal_error", "Terjadi kesalahan internal."), 500);
+}
+function createApp(options) {
+  const app = new Hono();
+  const deps = options.deps ?? defaultServerDeps();
+  app.use("*", async (c, next) => {
+    const host = checkHost(c.req.header("host"));
+    if (host === 400) {
+      return c.json(errorBody("bad_request", "Header Host tidak valid."), 400);
+    }
+    if (host === 403) {
+      return c.json(
+        errorBody("forbidden", "Header Host harus menunjuk ke 127.0.0.1 atau localhost."),
+        403
+      );
+    }
+    await next();
+  });
+  app.get("/auth", (c) => {
+    const candidate = c.req.query("token");
+    if (!candidate || !tokensMatch(candidate, options.token)) {
+      return c.json(errorBody("unauthorized", "Token tidak valid."), 401);
+    }
+    setCookie(c, SESSION_COOKIE, options.token, {
+      httpOnly: true,
+      sameSite: "Strict",
+      path: "/"
+    });
+    c.header("Cache-Control", "no-store");
+    return c.redirect("/", 302);
+  });
+  app.use("*", async (c, next) => {
+    const session = getCookie(c, SESSION_COOKIE);
+    if (!session || !tokensMatch(session, options.token)) {
+      return c.json(
+        errorBody("unauthorized", "Sesi tidak valid. Buka URL ber-token yang dicetak server."),
+        401
+      );
+    }
+    await next();
+  });
+  app.get("/api/health", (c) => c.json({ ok: true, version: APP_VERSION }));
+  registerHarnessRoutes(app, deps);
+  registerSkillRoutes(app, deps);
+  registerInstallationRoutes(app, deps);
+  registerSyncRoutes(app, deps);
+  registerDoctorRoutes(app, deps);
+  registerDepsRoutes(app, deps);
+  registerConnectRoutes(app, deps);
+  app.use("*", serveStatic({ root: options.webRoot }));
+  app.all("*", async (c) => {
+    if (c.req.path === "/api" || c.req.path.startsWith("/api/") || !isSpaNavigation(c)) {
+      return c.notFound();
+    }
+    try {
+      const html = await readFile(join(options.webRoot, "index.html"), "utf8");
+      return c.html(html);
+    } catch {
+      return c.json(
+        errorBody("web_not_built", "UI belum dibangun. Jalankan `pnpm run build` lebih dulu."),
+        404
+      );
+    }
+  });
+  app.notFound(
+    (c) => c.json(errorBody("not_found", `Rute ${c.req.method} ${c.req.path} tidak ditemukan.`), 404)
+  );
+  app.onError(handleAppError);
+  return app;
+}
+
+// src/server/index.ts
+function resolveDefaultWebRoot() {
+  const moduleDir = dirname(fileURLToPath(import.meta.url));
+  const bundled = join(moduleDir, "web");
+  if (existsSync(join(bundled, "index.html"))) {
+    return bundled;
+  }
+  const fromSource = join(moduleDir, "..", "web");
+  if (existsSync(join(fromSource, "index.html"))) {
+    return fromSource;
+  }
+  return bundled;
+}
+var DEFAULT_WEB_ROOT = resolveDefaultWebRoot();
+async function createServer(options = {}) {
+  const host = "127.0.0.1";
+  const requestedPort = options.port ?? 0;
+  const token = options.token ?? randomBytes(32).toString("hex");
+  const webRoot = options.webRoot ?? DEFAULT_WEB_ROOT;
+  const app = createApp({ token, webRoot });
+  const server = createServer$1(getRequestListener(app.fetch));
+  await new Promise((resolve, reject) => {
+    const onError = (error) => {
+      server.off("listening", onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      resolve();
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(requestedPort, host);
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    server.close();
+    throw new Error("Server tidak mengembalikan alamat TCP.");
+  }
+  const port = address.port;
+  const origin = `http://${host}:${port}`;
+  return {
+    server,
+    host,
+    port,
+    token,
+    origin,
+    url: `${origin}/auth?token=${token}`,
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => {
+        if (error) {
+          reject(error);
+        } else {
+          resolve();
+        }
+      });
+      server.closeAllConnections();
+    })
+  };
+}
+
+export { createServer };