@growthub/cli 0.6.0 → 0.6.2

package/dist/starter/source-import/materialize.js

@@ -0,0 +1,260 @@
+/**
+ * Source Import Agent — materializer.
+ *
+ * Executes a `SourceImportPlan`. Composes already-shipping primitives:
+ *
+ *   - `copyBundledKitSource`      (kits/service)
+ *   - `registerKitFork`           (kits/fork-registry)
+ *   - `writeKitForkPolicy`        (kits/fork-policy)
+ *   - `appendKitForkTraceEvent`   (kits/fork-trace)
+ *
+ * Plus two source-specific fetch surfaces:
+ *
+ *   - `cloneGithubRepo` + `narrowToSubdirectory` (github-source)
+ *   - `fetchSkillPayload`                        (skills-source)
+ *
+ * The materializer never runs a skill script, never executes an imported
+ * shell command, and never opens a network port. Its job is to place the
+ * fetched payload into the starter shell and write the canonical manifest,
+ * policy, and trace entries.
+ *
+ * Confirmation gating:
+ *   - If the plan has pending confirmations that the caller has not
+ *     acknowledged, the materializer throws and the agent parks the job.
+ *   - If the security report is `blocked`, the materializer refuses even
+ *     when the caller passes confirmations.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { copyBundledKitSource } from "../../kits/service.js";
+import { registerKitFork } from "../../kits/fork-registry.js";
+import { makeDefaultKitForkPolicy, writeKitForkPolicy, } from "../../kits/fork-policy.js";
+import { appendKitForkTraceEvent } from "../../kits/fork-trace.js";
+import { cloneGithubRepo, narrowToSubdirectory, resolveGithubCloneToken, } from "./github-source.js";
+import { fetchSkillPayload } from "./skills-source.js";
+import { detectSourceShape } from "./detect.js";
+import { inspectSourcePayload } from "./security.js";
+import { writeImportSummary } from "./summarize.js";
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+const MANIFEST_RELATIVE_PATH = ".growthub-fork/source-import.json";
+const SUMMARY_RELATIVE_PATH = "IMPORT_SUMMARY.md";
+function resolveSourceKind(probe) {
+    return probe.kind === "github-repo" ? "github-repo" : "skills-skill";
+}
+function stagingDirFor(forkPath) {
+    return path.join(os.tmpdir(), `growthub-source-import-${path.basename(forkPath)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`);
+}
+async function fetchPayload(probe, stagingDir, opts) {
+    if (probe.kind === "github-repo") {
+        const ghProbe = probe;
+        const token = await resolveGithubCloneToken(ghProbe);
+        opts.onProgress?.(`[source-import] cloning ${ghProbe.repo.owner}/${ghProbe.repo.repo}` +
+            `@${opts.branch ?? ghProbe.defaultBranch} via ${ghProbe.mode}`);
+        const cloneRes = cloneGithubRepo({
+            probe: ghProbe,
+            branch: opts.branch,
+            destination: stagingDir,
+            token: token?.token,
+        });
+        if (opts.subdirectory) {
+            opts.onProgress?.(`[source-import] narrowing clone to subdirectory '${opts.subdirectory}'`);
+            narrowToSubdirectory(stagingDir, opts.subdirectory);
+        }
+        return { payloadRoot: stagingDir, gitSha: cloneRes.sha };
+    }
+    const skillProbe = probe;
+    opts.onProgress?.(`[source-import] fetching skill ${skillProbe.skillId}@${skillProbe.version}`);
+    await fetchSkillPayload({ probe: skillProbe, destination: stagingDir });
+    return { payloadRoot: stagingDir };
+}
+function movePayloadIntoFork(payloadRoot, forkPath, payloadRelativePath) {
+    const target = path.resolve(forkPath, payloadRelativePath);
+    if (fs.existsSync(target)) {
+        fs.rmSync(target, { recursive: true, force: true });
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.renameSync(payloadRoot, target);
+    return target;
+}
+function writeManifest(forkPath, manifest) {
+    const p = path.resolve(forkPath, MANIFEST_RELATIVE_PATH);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+    return p;
+}
+function assertConfirmationsSatisfied(plan, confirmations) {
+    const confirmed = new Set(confirmations);
+    const pending = plan.actions
+        .filter((a) => {
+        if (!a.needsConfirmation)
+            return false;
+        const token = a.confirmationLabel ?? a.targetPath;
+        return !confirmed.has(token);
+    })
+        .map((a) => a.confirmationLabel ?? a.targetPath);
+    if (pending.length > 0) {
+        throw new PendingConfirmationError(pending);
+    }
+}
+export class PendingConfirmationError extends Error {
+    pending;
+    constructor(pending) {
+        super(`Import plan has ${pending.length} action(s) awaiting confirmation: ${pending.join(", ")}`);
+        this.name = "PendingConfirmationError";
+        this.pending = pending;
+    }
+}
+// ---------------------------------------------------------------------------
+// Main executor
+// ---------------------------------------------------------------------------
+/**
+ * Execute a `SourceImportPlan` end-to-end. Returns the final
+ * `SourceImportResult`. Throws `PendingConfirmationError` when the plan
+ * has unsatisfied confirmations.
+ */
+export async function materializeImportPlan(input) {
+    const { plan } = input;
+    const onProgress = input.onProgress;
+    const remoteSyncMode = input.remoteSyncMode ?? "off";
+    // 0. Hard block: security report with `blocked: true` cannot be confirmed away.
+    if (plan.security?.blocked) {
+        throw new Error(`Refusing to import: security inspection blocked the payload (${plan.security.summaryLines[0] ?? "blocking finding"})`);
+    }
+    assertConfirmationsSatisfied(plan, input.confirmations ?? []);
+    const forkPath = plan.destination.forkPath;
+    const kitId = plan.destination.starterKitId;
+    const sourceKind = resolveSourceKind(plan.source);
+    // 1. Fetch payload into a staging directory.
+    onProgress?.("[source-import] fetching payload into staging directory");
+    const stagingDir = stagingDirFor(forkPath);
+    const fetchResult = await fetchPayload(plan.source, stagingDir, {
+        subdirectory: input.subdirectory,
+        branch: input.branch,
+        onProgress,
+    });
+    // 2. Security inspection (mandatory — plan may already carry a report,
+    //    but we always re-run against the materialised payload to catch any
+    //    mismatch between manifest-advertised files and fetched files).
+    onProgress?.("[source-import] running security inspection over fetched payload");
+    const security = inspectSourcePayload({
+        payloadRoot: fetchResult.payloadRoot,
+        requireSkillAcknowledgement: sourceKind === "skills-skill",
+    });
+    if (security.blocked) {
+        fs.rmSync(fetchResult.payloadRoot, { recursive: true, force: true });
+        throw new Error(`Security inspection blocked the fetched payload: ${security.summaryLines[0] ?? "blocking finding"}`);
+    }
+    // 3. Shape detection.
+    onProgress?.("[source-import] detecting payload shape");
+    const detection = detectSourceShape(fetchResult.payloadRoot);
+    // 4. Materialize starter shell. `copyBundledKitSource` wipes+rewrites the
+    //    destination, so we run it BEFORE moving the payload into place.
+    onProgress?.(`[source-import] materializing starter kit ${kitId}`);
+    const kitInfo = copyBundledKitSource(kitId, forkPath);
+    // 5. Move staged payload into `<forkPath>/imported/`.
+    onProgress?.(`[source-import] placing payload at ${forkPath}/imported/`);
+    movePayloadIntoFork(fetchResult.payloadRoot, forkPath, "imported");
+    // 6. Register as a kit-fork.
+    const reg = registerKitFork({
+        forkPath,
+        kitId: kitInfo.id,
+        baseVersion: kitInfo.version,
+        label: input.label ??
+            (plan.source.kind === "github-repo"
+                ? `${plan.source.repo.owner}/${plan.source.repo.repo}`
+                : plan.source.title),
+    });
+    // 7. Seed policy.
+    const policy = {
+        ...makeDefaultKitForkPolicy(),
+        remoteSyncMode,
+    };
+    writeKitForkPolicy(forkPath, policy);
+    // 8. Build + write canonical in-fork manifest.
+    const summaryLines = [];
+    summaryLines.push(plan.source.kind === "github-repo"
+        ? `Imported GitHub repo ${plan.source.repo.owner}/${plan.source.repo.repo}`
+        : `Imported skills.sh skill ${plan.source.skillId}@${plan.source.version}`);
+    summaryLines.push(`Detection: framework=${detection.framework}, pm=${detection.packageManager}, confidence=${detection.confidence}`);
+    summaryLines.push(`Security: ${security.summaryLines[0] ?? "no findings"}`);
+    summaryLines.push(`Fork ID: ${reg.forkId}`);
+    summaryLines.push(`Policy: remoteSyncMode=${policy.remoteSyncMode}`);
+    const manifest = {
+        version: 1,
+        importId: plan.importId,
+        sourceKind,
+        source: plan.source,
+        importMode: plan.destination.importMode,
+        starterKitId: kitInfo.id,
+        starterKitVersion: kitInfo.version,
+        importedAt: new Date().toISOString(),
+        detection,
+        security,
+        payloadRelativePath: "imported",
+        payloadGitSha: fetchResult.gitSha,
+        summary: summaryLines,
+    };
+    const manifestPath = writeManifest(forkPath, manifest);
+    // 9. Append initial trace events (reuse existing event types — no new
+    //    event schema introduced).
+    appendKitForkTraceEvent(forkPath, {
+        forkId: reg.forkId,
+        kitId: reg.kitId,
+        type: "registered",
+        summary: `Source-imported workspace registered (importId=${plan.importId})`,
+        detail: {
+            sourceKind,
+            importMode: plan.destination.importMode,
+            accessMode: plan.source.mode,
+        },
+    });
+    appendKitForkTraceEvent(forkPath, {
+        forkId: reg.forkId,
+        kitId: reg.kitId,
+        type: "policy_updated",
+        summary: `Initial policy seeded (remoteSyncMode=${policy.remoteSyncMode})`,
+    });
+    appendKitForkTraceEvent(forkPath, {
+        forkId: reg.forkId,
+        kitId: reg.kitId,
+        type: "agent_checkpoint",
+        summary: `source-import/security riskClass=${security.riskClass}, findings=${security.findings.length}`,
+        detail: { riskClass: security.riskClass, findings: security.findings.length },
+    });
+    if (plan.source.kind === "github-repo" && fetchResult.gitSha) {
+        appendKitForkTraceEvent(forkPath, {
+            forkId: reg.forkId,
+            kitId: reg.kitId,
+            type: "agent_checkpoint",
+            summary: `source-import/payload gitSha=${fetchResult.gitSha}`,
+            detail: { gitSha: fetchResult.gitSha },
+        });
+    }
+    // 10. Write operator-facing summary.
+    const summaryPath = writeImportSummary({
+        forkPath,
+        summaryRelativePath: SUMMARY_RELATIVE_PATH,
+        manifest,
+    });
+    return {
+        importId: plan.importId,
+        forkId: reg.forkId,
+        kitId: kitInfo.id,
+        forkPath,
+        baseVersion: kitInfo.version,
+        sourceKind,
+        source: plan.source,
+        importMode: plan.destination.importMode,
+        payloadRelativePath: "imported",
+        detection,
+        security,
+        summaryPath,
+        manifestPath,
+        policyMode: policy.remoteSyncMode,
+        warnings: [...plan.warnings, ...detection.warnings],
+    };
+}
+//# sourceMappingURL=materialize.js.map

package/dist/starter/source-import/materialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialize.js","sourceRoot":"","sources":["../../../src/starter/source-import/materialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAuCpD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AACnE,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAwB;IACjD,OAAO,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,CAAC,MAAM,EAAE,EACX,0BAA0B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACzH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAwB,EACxB,UAAkB,EAClB,IAAqF;IAErF,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,KAA8B,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,EAAE,CACf,2BAA2B,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;YAClE,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,aAAa,QAAQ,OAAO,CAAC,IAAI,EAAE,CACjE,CAAC;QACF,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,KAAK,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,UAAU,EAAE,CACf,oDAAoD,IAAI,CAAC,YAAY,GAAG,CACzE,CAAC;YACF,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,KAA+B,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CACf,kCAAkC,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,CAC7E,CAAC;IACF,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAAmB,EACnB,QAAgB,EAChB,mBAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CACpB,QAAgB,EAChB,QAA8B;IAE9B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACzD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,4BAA4B,CACnC,IAAsB,EACtB,aAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,CAAC,CAAC,CAAC,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,UAAU,CAAC;QAClD,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,OAAO,CAAW;IAC3B,YAAY,OAAiB;QAC3B,KAAK,CACH,mBAAmB,OAAO,CAAC,MAAM,qCAAqC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAuB;IAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC;IAErD,gFAAgF;IAChF,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,gEAAgE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,GAAG,CACvH,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAE9D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;IAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,yDAAyD,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU;KACX,CAAC,CAAC;IAEH,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,UAAU,EAAE,CAAC,kEAAkE,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,2BAA2B,EAAE,UAAU,KAAK,cAAc;KAC3D,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,oDAAoD,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,EAAE,CACrG,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,UAAU,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAE7D,0EAA0E;IAC1E,qEAAqE;IACrE,UAAU,EAAE,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEtD,sDAAsD;IACtD,UAAU,EAAE,CAAC,sCAAsC,QAAQ,YAAY,CAAC,CAAC;IACzE,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,6BAA6B;IAC7B,MAAM,GAAG,GAAG,eAAe,CAAC;QAC1B,QAAQ;QACR,KAAK,EAAE,OAAO,CAAC,EAAE;QACjB,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,KAAK,EACH,KAAK,CAAC,KAAK;YACX,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;gBACjC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;gBACtD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KACzB,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,MAAM,GAAG;QACb,GAAG,wBAAwB,EAAE;QAC7B,cAAc;KACf,CAAC;IACF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAErC,+CAA+C;IAC/C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,YAAY,CAAC,IAAI,CACf,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;QAChC,CAAC,CAAC,wBAAwB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;QAC3E,CAAC,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAC7E,CAAC;IACF,YAAY,CAAC,IAAI,CAAC,wBAAwB,SAAS,CAAC,SAAS,QAAQ,SAAS,CAAC,cAAc,gBAAgB,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IACrI,YAAY,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IAC5E,YAAY,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,YAAY,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAErE,MAAM,QAAQ,GAAyB;QACrC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU;QACV,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU;QACvC,YAAY,EAAE,OAAO,CAAC,EAAE;QACxB,iBAAiB,EAAE,OAAO,CAAC,OAAO;QAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS;QACT,QAAQ;QACR,mBAAmB,EAAE,UAAU;QAC/B,aAAa,EAAE,WAAW,CAAC,MAAM;QACjC,OAAO,EAAE,YAAY;KACtB,CAAC;IACF,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEvD,sEAAsE;IACtE,+BAA+B;IAC/B,uBAAuB,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,kDAAkD,IAAI,CAAC,QAAQ,GAAG;QAC3E,MAAM,EAAE;YACN,UAAU;YACV,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU;YACvC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;SAC7B;KACF,CAAC,CAAC;IACH,uBAAuB,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yCAAyC,MAAM,CAAC,cAAc,GAAG;KAC3E,CAAC,CAAC;IACH,uBAAuB,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,oCAAoC,QAAQ,CAAC,SAAS,cAAc,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE;QACvG,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE;KAC9E,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QAC7D,uBAAuB,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,gCAAgC,WAAW,CAAC,MAAM,EAAE;YAC7D,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,MAAM,WAAW,GAAG,kBAAkB,CAAC;QACrC,QAAQ;QACR,mBAAmB,EAAE,qBAAqB;QAC1C,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,OAAO,CAAC,EAAE;QACjB,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,UAAU;QACV,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU;QACvC,mBAAmB,EAAE,UAAU;QAC/B,SAAS;QACT,QAAQ;QACR,WAAW;QACX,YAAY;QACZ,UAAU,EAAE,MAAM,CAAC,cAAc;QACjC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/starter/source-import/plan.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Source Import Agent — deterministic plan builder.
+ *
+ * Pure function: takes a union source probe, an optional detection report,
+ * an optional security report, and operator options — emits a
+ * `SourceImportPlan` with an ordered list of actions the materializer
+ * will execute.
+ *
+ * The plan shape mirrors the Fork Sync Agent's heal plan: fully structured,
+ * traceable, and explicit about which actions require operator
+ * confirmation. Two mandatory confirmation surfaces:
+ *
+ *   1. `inspect_security` for every skill import, and for any repo import
+ *      with a non-safe risk class.
+ *   2. `materialize_starter_shell` for non-empty destinations (agent
+ *      refuses silent overwrites).
+ */
+import type { SourceAccessProbe, SourceDetectionReport, SourceImportMode, SourceImportPlan, SourceSecurityReport } from "./types.js";
+export interface BuildSourceImportPlanInput {
+    probe: SourceAccessProbe;
+    destination: string;
+    starterKitId: string;
+    importMode: SourceImportMode;
+    /** Shape detection (optional — produced post-fetch by the agent). */
+    detection?: SourceDetectionReport;
+    /** Security inspection report (required for skill imports at execution time). */
+    security?: SourceSecurityReport;
+}
+/**
+ * Build a deterministic import plan. No side effects besides a `fs.statSync`
+ * on the destination directory.
+ */
+export declare function buildSourceImportPlan(input: BuildSourceImportPlanInput): SourceImportPlan;
+/**
+ * Return the list of target paths in a plan that require explicit operator
+ * confirmation before the agent will execute them.
+ */
+export declare function pendingConfirmations(plan: SourceImportPlan): string[];
+//# sourceMappingURL=plan.d.ts.map

package/dist/starter/source-import/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAEV,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,qEAAqE;IACrE,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,iFAAiF;IACjF,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC;AA0BD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,0BAA0B,GAChC,gBAAgB,CAyHlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAIrE"}

package/dist/starter/source-import/plan.js

@@ -0,0 +1,158 @@
+/**
+ * Source Import Agent — deterministic plan builder.
+ *
+ * Pure function: takes a union source probe, an optional detection report,
+ * an optional security report, and operator options — emits a
+ * `SourceImportPlan` with an ordered list of actions the materializer
+ * will execute.
+ *
+ * The plan shape mirrors the Fork Sync Agent's heal plan: fully structured,
+ * traceable, and explicit about which actions require operator
+ * confirmation. Two mandatory confirmation surfaces:
+ *
+ *   1. `inspect_security` for every skill import, and for any repo import
+ *      with a non-safe risk class.
+ *   2. `materialize_starter_shell` for non-empty destinations (agent
+ *      refuses silent overwrites).
+ */
+import fs from "node:fs";
+import path from "node:path";
+function generateImportId() {
+    return `si-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 7)}`;
+}
+function destinationState(absDest) {
+    if (!fs.existsSync(absDest))
+        return { exists: false, nonEmpty: false };
+    const stats = fs.statSync(absDest);
+    if (!stats.isDirectory()) {
+        throw new Error(`Destination is not a directory: ${absDest}`);
+    }
+    const entries = fs.readdirSync(absDest);
+    return { exists: true, nonEmpty: entries.length > 0 };
+}
+function describeSource(probe) {
+    if (probe.kind === "github-repo") {
+        return `${probe.repo.owner}/${probe.repo.repo} via ${probe.mode} auth`;
+    }
+    return `skill ${probe.skillId}@${probe.version} (skills.sh)`;
+}
+/**
+ * Build a deterministic import plan. No side effects besides a `fs.statSync`
+ * on the destination directory.
+ */
+export function buildSourceImportPlan(input) {
+    const absDest = path.resolve(input.destination);
+    const state = destinationState(absDest);
+    const payloadPath = "imported";
+    const warnings = [...input.probe.warnings];
+    if (input.detection)
+        warnings.push(...input.detection.warnings);
+    if (state.nonEmpty) {
+        warnings.push(`Destination ${absDest} is not empty — import requires operator confirmation.`);
+    }
+    const isSkill = input.probe.kind === "skills-skill";
+    const securityNeedsConfirmation = isSkill ||
+        (input.security !== undefined && input.security.riskClass !== "safe");
+    const actions = [];
+    actions.push({
+        actionType: "fetch_source",
+        targetPath: ".source-staging",
+        description: `Fetch ${describeSource(input.probe)}`,
+        detail: input.probe.kind === "github-repo"
+            ? {
+                repo: input.probe.repo,
+                defaultBranch: input.probe.defaultBranch,
+                accessMode: input.probe.mode,
+                cloneUrl: input.probe.cloneUrl,
+            }
+            : {
+                skillId: input.probe.skillId,
+                version: input.probe.version,
+                author: input.probe.author,
+                title: input.probe.title,
+            },
+    });
+    actions.push({
+        actionType: "inspect_security",
+        targetPath: ".source-staging",
+        description: "Run shared security inspection over the fetched payload",
+        detail: {
+            sourceKind: input.probe.kind,
+            riskClass: input.security?.riskClass,
+            blocked: input.security?.blocked ?? false,
+        },
+        needsConfirmation: securityNeedsConfirmation,
+        confirmationLabel: "security-report",
+    });
+    actions.push({
+        actionType: "materialize_starter_shell",
+        targetPath: ".",
+        description: `Materialize starter kit ${input.starterKitId} into destination`,
+        detail: { kitId: input.starterKitId },
+        needsConfirmation: state.nonEmpty,
+        confirmationLabel: state.nonEmpty ? "non-empty-destination" : undefined,
+    });
+    actions.push({
+        actionType: "place_imported_payload",
+        targetPath: payloadPath,
+        description: `Place imported payload under ${payloadPath}/ (mode=${input.importMode})`,
+        detail: {
+            importMode: input.importMode,
+            payloadRelativePath: payloadPath,
+        },
+    });
+    actions.push({
+        actionType: "write_import_manifest",
+        targetPath: ".growthub-fork/source-import.json",
+        description: "Write canonical in-fork import manifest",
+        detail: {
+            payloadRelativePath: payloadPath,
+            sourceKind: input.probe.kind,
+        },
+    });
+    actions.push({
+        actionType: "register_fork",
+        targetPath: ".growthub-fork/fork.json",
+        description: "Register imported workspace as a Growthub kit-fork",
+        detail: { kitId: input.starterKitId },
+    });
+    actions.push({
+        actionType: "seed_policy",
+        targetPath: ".growthub-fork/policy.json",
+        description: "Seed fork-sync policy with the requested remote-sync mode",
+    });
+    actions.push({
+        actionType: "seed_trace",
+        targetPath: ".growthub-fork/trace.jsonl",
+        description: "Append initial trace events for registration + import",
+    });
+    actions.push({
+        actionType: "summarize",
+        targetPath: "IMPORT_SUMMARY.md",
+        description: "Write operator-visible import summary",
+    });
+    return {
+        importId: generateImportId(),
+        source: input.probe,
+        destination: {
+            forkPath: absDest,
+            starterKitId: input.starterKitId,
+            importMode: input.importMode,
+        },
+        detection: input.detection,
+        security: input.security,
+        actions,
+        generatedAt: new Date().toISOString(),
+        warnings,
+    };
+}
+/**
+ * Return the list of target paths in a plan that require explicit operator
+ * confirmation before the agent will execute them.
+ */
+export function pendingConfirmations(plan) {
+    return [...new Set(plan.actions
+            .filter((a) => a.needsConfirmation)
+            .map((a) => a.confirmationLabel ?? a.targetPath))];
+}
+//# sourceMappingURL=plan.js.map

package/dist/starter/source-import/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../src/starter/source-import/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAqB7B,SAAS,gBAAgB;IACvB,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IAIvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAwB;IAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,CAAC,IAAI,OAAO,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,cAAc,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,CAAC;IAC/B,MAAM,QAAQ,GAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEhE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CACX,eAAe,OAAO,wDAAwD,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC;IACpD,MAAM,yBAAyB,GAC7B,OAAO;QACP,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;IAExE,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,cAAc;QAC1B,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,SAAS,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QACnD,MAAM,EACJ,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;YAChC,CAAC,CAAC;gBACE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBACtB,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;aAC/B;YACH,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;aACzB;KACR,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,kBAAkB;QAC9B,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,yDAAyD;QACtE,MAAM,EAAE;YACN,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS;YACpC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK;SAC1C;QACD,iBAAiB,EAAE,yBAAyB;QAC5C,iBAAiB,EAAE,iBAAiB;KACrC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,2BAA2B;QACvC,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,2BAA2B,KAAK,CAAC,YAAY,mBAAmB;QAC7E,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE;QACrC,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,wBAAwB;QACpC,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,gCAAgC,WAAW,WAAW,KAAK,CAAC,UAAU,GAAG;QACtF,MAAM,EAAE;YACN,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,WAAW;SACjC;KACF,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,uBAAuB;QACnC,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,yCAAyC;QACtD,MAAM,EAAE;YACN,mBAAmB,EAAE,WAAW;YAChC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;SAC7B;KACF,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,eAAe;QAC3B,UAAU,EAAE,0BAA0B;QACtC,WAAW,EAAE,oDAAoD;QACjE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE;KACtC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,aAAa;QACzB,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,2DAA2D;KACzE,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,uDAAuD;KACrE,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,uCAAuC;KACrD,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,gBAAgB,EAAE;QAC5B,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,WAAW,EAAE;YACX,QAAQ,EAAE,OAAO;YACjB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAsB;IACzD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/starter/source-import/security.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Source Import Agent — shared security inspector.
+ *
+ * Deterministic, bounded, read-only static analysis over a materialised
+ * source payload (cloned repo or unpacked skill). The inspector NEVER
+ * executes any script. It emits a `SourceSecurityReport` that:
+ *
+ *   - lists pattern-based findings (shell scripts, install hooks,
+ *     external downloads, prompt-injection patterns, env mutation,
+ *     privileged instructions, suspicious archives)
+ *   - aggregates a risk class (`safe` | `caution` | `high-risk` | `blocked`)
+ *   - produces short operator-facing summary lines rendered in the
+ *     confirmation prompt
+ *
+ * Two risk surfaces the caller uses downstream:
+ *
+ *   - `report.blocked` → agent MUST refuse to continue even on confirm.
+ *   - `report.riskClass !== "safe"` → plan flags the inspect action as
+ *     needing explicit confirmation.
+ *
+ * Skills imports ALWAYS require the inspection + confirmation, even when
+ * the report is "safe", because skills are agent primitives closer to
+ * executable content than generic repos.
+ */
+import type { SourceSecurityReport } from "./types.js";
+export interface InspectSourcePayloadInput {
+    /** Absolute path to the materialised payload root. */
+    payloadRoot: string;
+    /**
+     * When true, escalates minimum severity for `skills-skill` imports so a
+     * completely finding-free skill still parks on `caution` (forcing the
+     * operator to acknowledge the security report before import). Default
+     * is false.
+     */
+    requireSkillAcknowledgement?: boolean;
+}
+/**
+ * Inspect a materialised source payload and return a
+ * `SourceSecurityReport`. Pure read-only.
+ */
+export declare function inspectSourcePayload(input: InspectSourcePayloadInput): SourceSecurityReport;
+//# sourceMappingURL=security.d.ts.map

package/dist/starter/source-import/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAIV,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAsOpB,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAmGtB"}