@growthub/cli 0.6.5 → 0.6.7

package/dist/starter/source-import/github-source.d.ts

@@ -1,66 +0,0 @@
-/**
- * Source Import Agent — GitHub repo source adapter.
- *
- * Combines two primitives for the `github-repo` source kind:
- *
- *   1. Access probe — mirrors the Fork Sync Agent's fixed-preference auth
- *      ordering (direct CLI → hosted bridge → public), returning a
- *      `GithubRepoAccessProbe` that downstream planners consume without
- *      knowing which source produced the token.
- *   2. Bounded clone — uses the existing `cli/src/kits/fork-remote.ts`
- *      `git` wrapper semantics (child_process-based, token embedded in
- *      HTTPS URL at invocation time, never written to git config).
- *
- * This module deliberately does not introduce a new transport or a new
- * auth primitive. Every token it returns was produced by the existing
- * `resolveGithubAccessToken()` resolver. Bridge-minted credentials remain
- * in-memory only and are discarded at the end of the import run.
- */
-import type { GithubRepoAccessProbe, GithubRepoSourceInput, SourceAccessMode } from "./types.js";
-/**
- * Resolve repo access using the Fork Sync Agent's preference ordering.
- * Returns a `GithubRepoAccessProbe` that downstream planners consume
- * without knowing which source produced the token.
- */
-export declare function probeGithubRepoSource(input: GithubRepoSourceInput): Promise<GithubRepoAccessProbe>;
-/**
- * Resolve an access token usable for a git clone over HTTPS.
- * Returns null for public probes — the caller should clone unauthenticated.
- *
- * IMPORTANT: this token is returned in memory only. The caller must not
- * persist it. For bridge-sourced tokens, this honours the fork-sync
- * invariant "bridge-minted credentials are never persisted to disk".
- */
-export declare function resolveGithubCloneToken(probe: GithubRepoAccessProbe): Promise<{
-    token: string;
-    source: SourceAccessMode;
-} | null>;
-export interface CloneGithubRepoInput {
-    probe: GithubRepoAccessProbe;
-    branch?: string;
-    destination: string;
-    /** Optional token (required for private clones). */
-    token?: string;
-    /** Optional depth. Defaults to 1 for safe, bounded clones. */
-    depth?: number;
-}
-export interface CloneGithubRepoResult {
-    destination: string;
-    branch: string;
-    sha?: string;
-    cloneUrl: string;
-}
-/**
- * Clone a GitHub repo into `destination`. Defaults to `--depth 1` to keep
- * the agent's blast radius small; callers can override via `input.depth=0`
- * for a full clone. The destination must not already exist — the agent is
- * responsible for its lifecycle (caller places it in a staging zone).
- */
-export declare function cloneGithubRepo(input: CloneGithubRepoInput): CloneGithubRepoResult;
-/**
- * Narrow a cloned worktree to a single subdirectory. Moves
- * `<root>/<subdirectory>` into place and removes everything else. Keeps
- * the operator's subdirectory choice bounded and obvious on disk.
- */
-export declare function narrowToSubdirectory(rootDir: string, subdirectory: string): void;
-//# sourceMappingURL=github-source.d.ts.map

package/dist/starter/source-import/github-source.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"github-source.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/github-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AA8CpB;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAiGhC;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG,IAAI,CAAC,CAK7D;AAMD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAmBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,qBAAqB,CA6ClF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAgBhF"}

package/dist/starter/source-import/github-source.js

@@ -1,233 +0,0 @@
-/**
- * Source Import Agent — GitHub repo source adapter.
- *
- * Combines two primitives for the `github-repo` source kind:
- *
- *   1. Access probe — mirrors the Fork Sync Agent's fixed-preference auth
- *      ordering (direct CLI → hosted bridge → public), returning a
- *      `GithubRepoAccessProbe` that downstream planners consume without
- *      knowing which source produced the token.
- *   2. Bounded clone — uses the existing `cli/src/kits/fork-remote.ts`
- *      `git` wrapper semantics (child_process-based, token embedded in
- *      HTTPS URL at invocation time, never written to git config).
- *
- * This module deliberately does not introduce a new transport or a new
- * auth primitive. Every token it returns was produced by the existing
- * `resolveGithubAccessToken()` resolver. Bridge-minted credentials remain
- * in-memory only and are discarded at the end of the import run.
- */
-import fs from "node:fs";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { resolveGithubAccessToken } from "../../integrations/github-resolver.js";
-import { parseRepoRef } from "../../github/client.js";
-import { buildTokenCloneUrl, gitAvailable } from "../../kits/fork-remote.js";
-const GITHUB_API_BASE = "https://api.github.com";
-// ---------------------------------------------------------------------------
-// Access probe
-// ---------------------------------------------------------------------------
-function baseHeaders() {
-    return {
-        "User-Agent": "growthub-cli",
-        Accept: "application/vnd.github+json",
-        "X-GitHub-Api-Version": "2022-11-28",
-    };
-}
-function withToken(token) {
-    return { ...baseHeaders(), Authorization: `Bearer ${token}` };
-}
-function pickVisibility(raw) {
-    const v = raw.visibility;
-    if (v === "public" || v === "private" || v === "internal")
-        return v;
-    if (raw.private === true)
-        return "private";
-    if (raw.private === false)
-        return "public";
-    return "unknown";
-}
-async function fetchRepoMetadata(ref, authHeaders) {
-    const res = await fetch(`${GITHUB_API_BASE}/repos/${ref.owner}/${ref.repo}`, {
-        headers: authHeaders,
-    });
-    if (res.status === 404 || res.status === 401 || res.status === 403) {
-        return null;
-    }
-    if (!res.ok) {
-        throw new Error(`GitHub repo probe failed: ${res.status} ${res.statusText}`);
-    }
-    return (await res.json());
-}
-/**
- * Resolve repo access using the Fork Sync Agent's preference ordering.
- * Returns a `GithubRepoAccessProbe` that downstream planners consume
- * without knowing which source produced the token.
- */
-export async function probeGithubRepoSource(input) {
-    const ref = parseRepoRef(input.repo);
-    const warnings = [];
-    if (input.skipProbe) {
-        return {
-            kind: "github-repo",
-            mode: "public",
-            repo: ref,
-            defaultBranch: "main",
-            htmlUrl: `https://github.com/${ref.owner}/${ref.repo}`,
-            cloneUrl: `https://github.com/${ref.owner}/${ref.repo}.git`,
-            visibility: "unknown",
-            warnings: ["--skip-probe set; default branch assumed 'main'"],
-        };
-    }
-    const resolved = await resolveGithubAccessToken();
-    const orderedProbes = [];
-    if (resolved) {
-        orderedProbes.push({
-            mode: resolved.source,
-            headers: withToken(resolved.accessToken),
-            handle: resolved.handle,
-        });
-    }
-    orderedProbes.push({ mode: "public", headers: baseHeaders() });
-    let meta = null;
-    let successfulProbe = null;
-    let lastError = null;
-    for (const probe of orderedProbes) {
-        try {
-            const result = await fetchRepoMetadata(ref, probe.headers);
-            if (result) {
-                meta = result;
-                successfulProbe = probe;
-                break;
-            }
-            if (probe.mode !== "public") {
-                warnings.push(`repo metadata not readable via ${probe.mode} auth — falling through`);
-            }
-        }
-        catch (err) {
-            lastError = err instanceof Error ? err.message : String(err);
-            warnings.push(`${probe.mode} probe errored: ${lastError}`);
-        }
-    }
-    if (!meta || !successfulProbe) {
-        if (input.privateRepo) {
-            throw new Error(`Private repo requested but no credential resolved access. ` +
-                `Run 'growthub github login' or connect GitHub inside Growthub. ` +
-                `Last error: ${lastError ?? "repo not found / not accessible"}`);
-        }
-        throw new Error(`Unable to resolve GitHub repo '${ref.owner}/${ref.repo}'. ` +
-            `Verify the slug and your auth. Last error: ${lastError ?? "not found"}`);
-    }
-    const visibility = pickVisibility(meta);
-    if (visibility === "private" && successfulProbe.mode === "public") {
-        throw new Error(`Repo '${ref.owner}/${ref.repo}' is private but only public access was probed. ` +
-            `This indicates a logic error — please report this probe trace.`);
-    }
-    const defaultBranch = typeof meta.default_branch === "string" ? meta.default_branch : "main";
-    const htmlUrl = typeof meta.html_url === "string"
-        ? meta.html_url
-        : `https://github.com/${ref.owner}/${ref.repo}`;
-    const cloneUrl = typeof meta.clone_url === "string"
-        ? meta.clone_url
-        : `https://github.com/${ref.owner}/${ref.repo}.git`;
-    return {
-        kind: "github-repo",
-        mode: successfulProbe.mode,
-        repo: ref,
-        defaultBranch,
-        htmlUrl,
-        cloneUrl,
-        visibility,
-        authHandle: successfulProbe.handle,
-        warnings,
-    };
-}
-/**
- * Resolve an access token usable for a git clone over HTTPS.
- * Returns null for public probes — the caller should clone unauthenticated.
- *
- * IMPORTANT: this token is returned in memory only. The caller must not
- * persist it. For bridge-sourced tokens, this honours the fork-sync
- * invariant "bridge-minted credentials are never persisted to disk".
- */
-export async function resolveGithubCloneToken(probe) {
-    if (probe.mode === "public")
-        return null;
-    const resolved = await resolveGithubAccessToken();
-    if (!resolved)
-        return null;
-    return { token: resolved.accessToken, source: resolved.source };
-}
-function runGit(cwd, args) {
-    const res = spawnSync("git", args, {
-        cwd,
-        encoding: "utf8",
-        maxBuffer: 20 * 1024 * 1024,
-    });
-    return {
-        ok: res.status === 0,
-        stdout: res.stdout ?? "",
-        stderr: res.stderr ?? "",
-        code: res.status ?? -1,
-    };
-}
-/**
- * Clone a GitHub repo into `destination`. Defaults to `--depth 1` to keep
- * the agent's blast radius small; callers can override via `input.depth=0`
- * for a full clone. The destination must not already exist — the agent is
- * responsible for its lifecycle (caller places it in a staging zone).
- */
-export function cloneGithubRepo(input) {
-    if (!gitAvailable()) {
-        throw new Error("`git` is not available on PATH — cannot clone.");
-    }
-    if (fs.existsSync(input.destination)) {
-        throw new Error(`Clone destination already exists: ${input.destination}`);
-    }
-    const cloneUrl = input.token
-        ? buildTokenCloneUrl(input.probe.repo, input.token)
-        : input.probe.cloneUrl;
-    const parent = path.dirname(input.destination);
-    fs.mkdirSync(parent, { recursive: true });
-    const depth = input.depth ?? 1;
-    const branch = input.branch ?? input.probe.defaultBranch;
-    const args = ["clone"];
-    if (depth > 0)
-        args.push("--depth", String(depth));
-    args.push("--single-branch", "--branch", branch, cloneUrl, input.destination);
-    const cloneRes = runGit(parent, args);
-    if (!cloneRes.ok) {
-        const sanitized = (cloneRes.stderr || "git clone failed").replace(/https:\/\/x-access-token:[^@]+@/g, "https://x-access-token:<redacted>@");
-        throw new Error(`git clone failed: ${sanitized}`);
-    }
-    const shaRes = runGit(input.destination, ["rev-parse", "HEAD"]);
-    const sha = shaRes.ok ? shaRes.stdout.trim() : undefined;
-    // Detach remote so a leaked token in history never lingers. The imported
-    // payload is a point-in-time snapshot; users can re-init git if they want
-    // their own origin.
-    runGit(input.destination, ["remote", "remove", "origin"]);
-    return {
-        destination: input.destination,
-        branch,
-        sha,
-        cloneUrl: input.probe.cloneUrl,
-    };
-}
-/**
- * Narrow a cloned worktree to a single subdirectory. Moves
- * `<root>/<subdirectory>` into place and removes everything else. Keeps
- * the operator's subdirectory choice bounded and obvious on disk.
- */
-export function narrowToSubdirectory(rootDir, subdirectory) {
-    const normalizedSub = subdirectory.replace(/^\/+|\/+$/g, "");
-    if (!normalizedSub)
-        return;
-    const abs = path.resolve(rootDir, normalizedSub);
-    if (!fs.existsSync(abs) || !fs.statSync(abs).isDirectory()) {
-        throw new Error(`Subdirectory not found in cloned repo: ${subdirectory}`);
-    }
-    const tmp = path.resolve(path.dirname(rootDir), `.${path.basename(rootDir)}-narrow-${Date.now().toString(36)}`);
-    fs.renameSync(abs, tmp);
-    fs.rmSync(rootDir, { recursive: true, force: true });
-    fs.renameSync(tmp, rootDir);
-}
-//# sourceMappingURL=github-source.js.map

package/dist/starter/source-import/github-source.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"github-source.js","sourceRoot":"","sources":["../../../src/starter/source-import/github-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAQ7E,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAEjD,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,SAAS,WAAW;IAClB,OAAO;QACL,YAAY,EAAE,cAAc;QAC5B,MAAM,EAAE,6BAA6B;QACrC,sBAAsB,EAAE,YAAY;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,EAAE,GAAG,WAAW,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CACrB,GAA4B;IAE5B,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC;IACzB,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC3C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,WAAmC;IAEnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,UAAU,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE;QAC3E,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA4B;IAE5B,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,GAAG;YACT,aAAa,EAAE,MAAM;YACrB,OAAO,EAAE,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE;YACtD,QAAQ,EAAE,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,MAAM;YAC3D,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,CAAC,iDAAiD,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAClD,MAAM,aAAa,GAId,EAAE,CAAC;IAER,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,QAAQ,CAAC,MAAM;YACrB,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAE/D,IAAI,IAAI,GAAmC,IAAI,CAAC;IAChD,IAAI,eAAe,GAA0C,IAAI,CAAC;IAClE,IAAI,SAAS,GAAkB,IAAI,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,GAAG,MAAM,CAAC;gBACd,eAAe,GAAG,KAAK,CAAC;gBACxB,MAAM;YACR,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACX,kCAAkC,KAAK,CAAC,IAAI,yBAAyB,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,mBAAmB,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,4DAA4D;gBAC1D,iEAAiE;gBACjE,eAAe,SAAS,IAAI,iCAAiC,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK;YAC1D,8CAA8C,SAAS,IAAI,WAAW,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,UAAU,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,kDAAkD;YAC9E,gEAAgE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7F,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAC/C,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QACjD,CAAC,CAAC,IAAI,CAAC,SAAS;QAChB,CAAC,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC;IAEtD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,eAAe,CAAC,IAAI;QAC1B,IAAI,EAAE,GAAG;QACT,aAAa;QACb,OAAO;QACP,QAAQ;QACR,UAAU;QACV,UAAU,EAAE,eAAe,CAAC,MAAM;QAClC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA4B;IAE5B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAClE,CAAC;AAuBD,SAAS,MAAM,CACb,GAAW,EACX,IAAc;IAEd,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QACjC,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;KACvB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK;QAC1B,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;QACnD,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;IAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC;IAEzD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,IAAI,KAAK,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAC/D,kCAAkC,EAClC,oCAAoC,CACrC,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzD,yEAAyE;IACzE,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,GAAG;QACH,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,YAAoB;IACxE,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,0CAA0C,YAAY,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EACrB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC/D,CAAC;IACF,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/starter/source-import/index.d.ts

@@ -1,31 +0,0 @@
-/**
- * Source Import Agent — public module surface.
- *
- * The canonical entrypoint for the Portable Source → Agent Environment
- * Pipeline. Re-exports the types, source adapters, shared security
- * inspector, planner, materializer, and background runner so every
- * caller (CLI commands, discovery UX, test suites) imports from a
- * single location.
- */
-export * from "./types.js";
-export { probeGithubRepoSource, resolveGithubCloneToken, cloneGithubRepo, narrowToSubdirectory, } from "./github-source.js";
-export { browseSkills, probeSkillsSource, fetchSkillPayload, parseSkillRef, } from "./skills-source.js";
-export { detectSourceShape } from "./detect.js";
-export { inspectSourcePayload } from "./security.js";
-export { buildSourceImportPlan, pendingConfirmations } from "./plan.js";
-export { materializeImportPlan, PendingConfirmationError } from "./materialize.js";
-export { writeImportSummary } from "./summarize.js";
-export { runSourceImportJob, confirmAndResumeSourceImportJob, dispatchSourceImportJobBackground, getSourceImportJob, listSourceImportJobs, cancelSourceImportJob, pruneSourceImportJobs, } from "./agent.js";
-import type { SourceImportInput, SourceImportJob, SourceImportResult } from "./types.js";
-/**
- * One-shot foreground entrypoint used by the CLI and discovery UX.
- * Delegates to the background-capable runner but waits for terminal
- * status before returning. When the job parks on confirmation, the
- * returned job has `status === "awaiting_confirmation"` and the caller
- * is responsible for prompting + calling `confirmAndResumeSourceImportJob`.
- */
-export declare function importSourceAsWorkspace(input: SourceImportInput): Promise<{
-    job: SourceImportJob;
-    result?: SourceImportResult;
-}>;
-//# sourceMappingURL=index.d.ts.map

package/dist/starter/source-import/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,iCAAiC,EACjC,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGzF;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAGhE"}

package/dist/starter/source-import/index.js

@@ -1,31 +0,0 @@
-/**
- * Source Import Agent — public module surface.
- *
- * The canonical entrypoint for the Portable Source → Agent Environment
- * Pipeline. Re-exports the types, source adapters, shared security
- * inspector, planner, materializer, and background runner so every
- * caller (CLI commands, discovery UX, test suites) imports from a
- * single location.
- */
-export * from "./types.js";
-export { probeGithubRepoSource, resolveGithubCloneToken, cloneGithubRepo, narrowToSubdirectory, } from "./github-source.js";
-export { browseSkills, probeSkillsSource, fetchSkillPayload, parseSkillRef, } from "./skills-source.js";
-export { detectSourceShape } from "./detect.js";
-export { inspectSourcePayload } from "./security.js";
-export { buildSourceImportPlan, pendingConfirmations } from "./plan.js";
-export { materializeImportPlan, PendingConfirmationError } from "./materialize.js";
-export { writeImportSummary } from "./summarize.js";
-export { runSourceImportJob, confirmAndResumeSourceImportJob, dispatchSourceImportJobBackground, getSourceImportJob, listSourceImportJobs, cancelSourceImportJob, pruneSourceImportJobs, } from "./agent.js";
-import { runSourceImportJob } from "./agent.js";
-/**
- * One-shot foreground entrypoint used by the CLI and discovery UX.
- * Delegates to the background-capable runner but waits for terminal
- * status before returning. When the job parks on confirmation, the
- * returned job has `status === "awaiting_confirmation"` and the caller
- * is responsible for prompting + calling `confirmAndResumeSourceImportJob`.
- */
-export async function importSourceAsWorkspace(input) {
-    const job = await runSourceImportJob(input);
-    return { job, result: job.result };
-}
-//# sourceMappingURL=index.js.map

package/dist/starter/source-import/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/starter/source-import/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,iCAAiC,EACjC,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACrC,CAAC"}

package/dist/starter/source-import/materialize.d.ts

@@ -1,61 +0,0 @@
-/**
- * Source Import Agent — materializer.
- *
- * Executes a `SourceImportPlan`. Composes already-shipping primitives:
- *
- *   - `copyBundledKitSource`      (kits/service)
- *   - `registerKitFork`           (kits/fork-registry)
- *   - `writeKitForkPolicy`        (kits/fork-policy)
- *   - `appendKitForkTraceEvent`   (kits/fork-trace)
- *
- * Plus two source-specific fetch surfaces:
- *
- *   - `cloneGithubRepo` + `narrowToSubdirectory` (github-source)
- *   - `fetchSkillPayload`                        (skills-source)
- *
- * The materializer never runs a skill script, never executes an imported
- * shell command, and never opens a network port. Its job is to place the
- * fetched payload into the starter shell and write the canonical manifest,
- * policy, and trace entries.
- *
- * Confirmation gating:
- *   - If the plan has pending confirmations that the caller has not
- *     acknowledged, the materializer throws and the agent parks the job.
- *   - If the security report is `blocked`, the materializer refuses even
- *     when the caller passes confirmations.
- */
-import type { SourceImportPlan, SourceImportResult } from "./types.js";
-export interface MaterializeInput {
-    plan: SourceImportPlan;
-    /**
-     * Operator-supplied confirmations (by `targetPath`) for actions the plan
-     * flagged as needing confirmation.
-     */
-    confirmations?: string[];
-    /**
-     * Remote-sync mode seeded into policy. Defaults to "off".
-     */
-    remoteSyncMode?: "off" | "branch" | "pr";
-    /** Human label for the registered fork. */
-    label?: string;
-    /** Progress callback. */
-    onProgress?: (step: string) => void;
-    /**
-     * Optional subdirectory filter for github-repo sources. Mirrored into the
-     * manifest detail.
-     */
-    subdirectory?: string;
-    /** Optional explicit branch override for github-repo sources. */
-    branch?: string;
-}
-export declare class PendingConfirmationError extends Error {
-    readonly pending: string[];
-    constructor(pending: string[]);
-}
-/**
- * Execute a `SourceImportPlan` end-to-end. Returns the final
- * `SourceImportResult`. Throws `PendingConfirmationError` when the plan
- * has unsatisfied confirmations.
- */
-export declare function materializeImportPlan(input: MaterializeInput): Promise<SourceImportResult>;
-//# sourceMappingURL=materialize.d.ts.map

package/dist/starter/source-import/materialize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"materialize.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/materialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAqBH,OAAO,KAAK,EAKV,gBAAgB,EAChB,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;OAEG;IACH,cAAc,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC;IACzC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgGD,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACf,OAAO,EAAE,MAAM,EAAE;CAO9B;AAMD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAmK7B"}