@growthub/cli 0.6.5 → 0.6.7

package/dist/starter/source-import/materialize.js

@@ -1,260 +0,0 @@
-/**
- * Source Import Agent — materializer.
- *
- * Executes a `SourceImportPlan`. Composes already-shipping primitives:
- *
- *   - `copyBundledKitSource`      (kits/service)
- *   - `registerKitFork`           (kits/fork-registry)
- *   - `writeKitForkPolicy`        (kits/fork-policy)
- *   - `appendKitForkTraceEvent`   (kits/fork-trace)
- *
- * Plus two source-specific fetch surfaces:
- *
- *   - `cloneGithubRepo` + `narrowToSubdirectory` (github-source)
- *   - `fetchSkillPayload`                        (skills-source)
- *
- * The materializer never runs a skill script, never executes an imported
- * shell command, and never opens a network port. Its job is to place the
- * fetched payload into the starter shell and write the canonical manifest,
- * policy, and trace entries.
- *
- * Confirmation gating:
- *   - If the plan has pending confirmations that the caller has not
- *     acknowledged, the materializer throws and the agent parks the job.
- *   - If the security report is `blocked`, the materializer refuses even
- *     when the caller passes confirmations.
- */
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { copyBundledKitSource } from "../../kits/service.js";
-import { registerKitFork } from "../../kits/fork-registry.js";
-import { makeDefaultKitForkPolicy, writeKitForkPolicy, } from "../../kits/fork-policy.js";
-import { appendKitForkTraceEvent } from "../../kits/fork-trace.js";
-import { cloneGithubRepo, narrowToSubdirectory, resolveGithubCloneToken, } from "./github-source.js";
-import { fetchSkillPayload } from "./skills-source.js";
-import { detectSourceShape } from "./detect.js";
-import { inspectSourcePayload } from "./security.js";
-import { writeImportSummary } from "./summarize.js";
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-const MANIFEST_RELATIVE_PATH = ".growthub-fork/source-import.json";
-const SUMMARY_RELATIVE_PATH = "IMPORT_SUMMARY.md";
-function resolveSourceKind(probe) {
-    return probe.kind === "github-repo" ? "github-repo" : "skills-skill";
-}
-function stagingDirFor(forkPath) {
-    return path.join(os.tmpdir(), `growthub-source-import-${path.basename(forkPath)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`);
-}
-async function fetchPayload(probe, stagingDir, opts) {
-    if (probe.kind === "github-repo") {
-        const ghProbe = probe;
-        const token = await resolveGithubCloneToken(ghProbe);
-        opts.onProgress?.(`[source-import] cloning ${ghProbe.repo.owner}/${ghProbe.repo.repo}` +
-            `@${opts.branch ?? ghProbe.defaultBranch} via ${ghProbe.mode}`);
-        const cloneRes = cloneGithubRepo({
-            probe: ghProbe,
-            branch: opts.branch,
-            destination: stagingDir,
-            token: token?.token,
-        });
-        if (opts.subdirectory) {
-            opts.onProgress?.(`[source-import] narrowing clone to subdirectory '${opts.subdirectory}'`);
-            narrowToSubdirectory(stagingDir, opts.subdirectory);
-        }
-        return { payloadRoot: stagingDir, gitSha: cloneRes.sha };
-    }
-    const skillProbe = probe;
-    opts.onProgress?.(`[source-import] fetching skill ${skillProbe.skillId}@${skillProbe.version}`);
-    await fetchSkillPayload({ probe: skillProbe, destination: stagingDir });
-    return { payloadRoot: stagingDir };
-}
-function movePayloadIntoFork(payloadRoot, forkPath, payloadRelativePath) {
-    const target = path.resolve(forkPath, payloadRelativePath);
-    if (fs.existsSync(target)) {
-        fs.rmSync(target, { recursive: true, force: true });
-    }
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    fs.renameSync(payloadRoot, target);
-    return target;
-}
-function writeManifest(forkPath, manifest) {
-    const p = path.resolve(forkPath, MANIFEST_RELATIVE_PATH);
-    fs.mkdirSync(path.dirname(p), { recursive: true });
-    fs.writeFileSync(p, JSON.stringify(manifest, null, 2) + "\n", "utf8");
-    return p;
-}
-function assertConfirmationsSatisfied(plan, confirmations) {
-    const confirmed = new Set(confirmations);
-    const pending = plan.actions
-        .filter((a) => {
-        if (!a.needsConfirmation)
-            return false;
-        const token = a.confirmationLabel ?? a.targetPath;
-        return !confirmed.has(token);
-    })
-        .map((a) => a.confirmationLabel ?? a.targetPath);
-    if (pending.length > 0) {
-        throw new PendingConfirmationError(pending);
-    }
-}
-export class PendingConfirmationError extends Error {
-    pending;
-    constructor(pending) {
-        super(`Import plan has ${pending.length} action(s) awaiting confirmation: ${pending.join(", ")}`);
-        this.name = "PendingConfirmationError";
-        this.pending = pending;
-    }
-}
-// ---------------------------------------------------------------------------
-// Main executor
-// ---------------------------------------------------------------------------
-/**
- * Execute a `SourceImportPlan` end-to-end. Returns the final
- * `SourceImportResult`. Throws `PendingConfirmationError` when the plan
- * has unsatisfied confirmations.
- */
-export async function materializeImportPlan(input) {
-    const { plan } = input;
-    const onProgress = input.onProgress;
-    const remoteSyncMode = input.remoteSyncMode ?? "off";
-    // 0. Hard block: security report with `blocked: true` cannot be confirmed away.
-    if (plan.security?.blocked) {
-        throw new Error(`Refusing to import: security inspection blocked the payload (${plan.security.summaryLines[0] ?? "blocking finding"})`);
-    }
-    assertConfirmationsSatisfied(plan, input.confirmations ?? []);
-    const forkPath = plan.destination.forkPath;
-    const kitId = plan.destination.starterKitId;
-    const sourceKind = resolveSourceKind(plan.source);
-    // 1. Fetch payload into a staging directory.
-    onProgress?.("[source-import] fetching payload into staging directory");
-    const stagingDir = stagingDirFor(forkPath);
-    const fetchResult = await fetchPayload(plan.source, stagingDir, {
-        subdirectory: input.subdirectory,
-        branch: input.branch,
-        onProgress,
-    });
-    // 2. Security inspection (mandatory — plan may already carry a report,
-    //    but we always re-run against the materialised payload to catch any
-    //    mismatch between manifest-advertised files and fetched files).
-    onProgress?.("[source-import] running security inspection over fetched payload");
-    const security = inspectSourcePayload({
-        payloadRoot: fetchResult.payloadRoot,
-        requireSkillAcknowledgement: sourceKind === "skills-skill",
-    });
-    if (security.blocked) {
-        fs.rmSync(fetchResult.payloadRoot, { recursive: true, force: true });
-        throw new Error(`Security inspection blocked the fetched payload: ${security.summaryLines[0] ?? "blocking finding"}`);
-    }
-    // 3. Shape detection.
-    onProgress?.("[source-import] detecting payload shape");
-    const detection = detectSourceShape(fetchResult.payloadRoot);
-    // 4. Materialize starter shell. `copyBundledKitSource` wipes+rewrites the
-    //    destination, so we run it BEFORE moving the payload into place.
-    onProgress?.(`[source-import] materializing starter kit ${kitId}`);
-    const kitInfo = copyBundledKitSource(kitId, forkPath);
-    // 5. Move staged payload into `<forkPath>/imported/`.
-    onProgress?.(`[source-import] placing payload at ${forkPath}/imported/`);
-    movePayloadIntoFork(fetchResult.payloadRoot, forkPath, "imported");
-    // 6. Register as a kit-fork.
-    const reg = registerKitFork({
-        forkPath,
-        kitId: kitInfo.id,
-        baseVersion: kitInfo.version,
-        label: input.label ??
-            (plan.source.kind === "github-repo"
-                ? `${plan.source.repo.owner}/${plan.source.repo.repo}`
-                : plan.source.title),
-    });
-    // 7. Seed policy.
-    const policy = {
-        ...makeDefaultKitForkPolicy(),
-        remoteSyncMode,
-    };
-    writeKitForkPolicy(forkPath, policy);
-    // 8. Build + write canonical in-fork manifest.
-    const summaryLines = [];
-    summaryLines.push(plan.source.kind === "github-repo"
-        ? `Imported GitHub repo ${plan.source.repo.owner}/${plan.source.repo.repo}`
-        : `Imported skills.sh skill ${plan.source.skillId}@${plan.source.version}`);
-    summaryLines.push(`Detection: framework=${detection.framework}, pm=${detection.packageManager}, confidence=${detection.confidence}`);
-    summaryLines.push(`Security: ${security.summaryLines[0] ?? "no findings"}`);
-    summaryLines.push(`Fork ID: ${reg.forkId}`);
-    summaryLines.push(`Policy: remoteSyncMode=${policy.remoteSyncMode}`);
-    const manifest = {
-        version: 1,
-        importId: plan.importId,
-        sourceKind,
-        source: plan.source,
-        importMode: plan.destination.importMode,
-        starterKitId: kitInfo.id,
-        starterKitVersion: kitInfo.version,
-        importedAt: new Date().toISOString(),
-        detection,
-        security,
-        payloadRelativePath: "imported",
-        payloadGitSha: fetchResult.gitSha,
-        summary: summaryLines,
-    };
-    const manifestPath = writeManifest(forkPath, manifest);
-    // 9. Append initial trace events (reuse existing event types — no new
-    //    event schema introduced).
-    appendKitForkTraceEvent(forkPath, {
-        forkId: reg.forkId,
-        kitId: reg.kitId,
-        type: "registered",
-        summary: `Source-imported workspace registered (importId=${plan.importId})`,
-        detail: {
-            sourceKind,
-            importMode: plan.destination.importMode,
-            accessMode: plan.source.mode,
-        },
-    });
-    appendKitForkTraceEvent(forkPath, {
-        forkId: reg.forkId,
-        kitId: reg.kitId,
-        type: "policy_updated",
-        summary: `Initial policy seeded (remoteSyncMode=${policy.remoteSyncMode})`,
-    });
-    appendKitForkTraceEvent(forkPath, {
-        forkId: reg.forkId,
-        kitId: reg.kitId,
-        type: "agent_checkpoint",
-        summary: `source-import/security riskClass=${security.riskClass}, findings=${security.findings.length}`,
-        detail: { riskClass: security.riskClass, findings: security.findings.length },
-    });
-    if (plan.source.kind === "github-repo" && fetchResult.gitSha) {
-        appendKitForkTraceEvent(forkPath, {
-            forkId: reg.forkId,
-            kitId: reg.kitId,
-            type: "agent_checkpoint",
-            summary: `source-import/payload gitSha=${fetchResult.gitSha}`,
-            detail: { gitSha: fetchResult.gitSha },
-        });
-    }
-    // 10. Write operator-facing summary.
-    const summaryPath = writeImportSummary({
-        forkPath,
-        summaryRelativePath: SUMMARY_RELATIVE_PATH,
-        manifest,
-    });
-    return {
-        importId: plan.importId,
-        forkId: reg.forkId,
-        kitId: kitInfo.id,
-        forkPath,
-        baseVersion: kitInfo.version,
-        sourceKind,
-        source: plan.source,
-        importMode: plan.destination.importMode,
-        payloadRelativePath: "imported",
-        detection,
-        security,
-        summaryPath,
-        manifestPath,
-        policyMode: policy.remoteSyncMode,
-        warnings: [...plan.warnings, ...detection.warnings],
-    };
-}
-//# sourceMappingURL=materialize.js.map

package/dist/starter/source-import/materialize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"materialize.js","sourceRoot":"","sources":["../../../src/starter/source-import/materialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAuCpD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AACnE,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAwB;IACjD,OAAO,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,CAAC,MAAM,EAAE,EACX,0BAA0B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACzH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAwB,EACxB,UAAkB,EAClB,IAAqF;IAErF,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,KAA8B,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,EAAE,CACf,2BAA2B,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;YAClE,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,aAAa,QAAQ,OAAO,CAAC,IAAI,EAAE,CACjE,CAAC;QACF,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,KAAK,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,UAAU,EAAE,CACf,oDAAoD,IAAI,CAAC,YAAY,GAAG,CACzE,CAAC;YACF,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,KAA+B,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CACf,kCAAkC,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,CAC7E,CAAC;IACF,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAAmB,EACnB,QAAgB,EAChB,mBAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CACpB,QAAgB,EAChB,QAA8B;IAE9B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACzD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,4BAA4B,CACnC,IAAsB,EACtB,aAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,CAAC,CAAC,CAAC,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,UAAU,CAAC;QAClD,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,OAAO,CAAW;IAC3B,YAAY,OAAiB;QAC3B,KAAK,CACH,mBAAmB,OAAO,CAAC,MAAM,qCAAqC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAuB;IAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC;IAErD,gFAAgF;IAChF,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,gEAAgE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,GAAG,CACvH,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAE9D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;IAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,yDAAyD,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU;KACX,CAAC,CAAC;IAEH,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,UAAU,EAAE,CAAC,kEAAkE,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,2BAA2B,EAAE,UAAU,KAAK,cAAc;KAC3D,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,oDAAoD,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,EAAE,CACrG,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,UAAU,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAE7D,0EAA0E;IAC1E,qEAAqE;IACrE,UAAU,EAAE,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEtD,sDAAsD;IACtD,UAAU,EAAE,CAAC,sCAAsC,QAAQ,YAAY,CAAC,CAAC;IACzE,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,6BAA6B;IAC7B,MAAM,GAAG,GAAG,eAAe,CAAC;QAC1B,QAAQ;QACR,KAAK,EAAE,OAAO,CAAC,EAAE;QACjB,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,KAAK,EACH,KAAK,CAAC,KAAK;YACX,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;gBACjC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;gBACtD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KACzB,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,MAAM,GAAG;QACb,GAAG,wBAAwB,EAAE;QAC7B,cAAc;KACf,CAAC;IACF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAErC,+CAA+C;IAC/C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,YAAY,CAAC,IAAI,CACf,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;QAChC,CAAC,CAAC,wBAAwB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;QAC3E,CAAC,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAC7E,CAAC;IACF,YAAY,CAAC,IAAI,CAAC,wBAAwB,SAAS,CAAC,SAAS,QAAQ,SAAS,CAAC,cAAc,gBAAgB,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IACrI,YAAY,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IAC5E,YAAY,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,YAAY,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAErE,MAAM,QAAQ,GAAyB;QACrC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU;QACV,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU;QACvC,YAAY,EAAE,OAAO,CAAC,EAAE;QACxB,iBAAiB,EAAE,OAAO,CAAC,OAAO;QAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS;QACT,QAAQ;QACR,mBAAmB,EAAE,UAAU;QAC/B,aAAa,EAAE,WAAW,CAAC,MAAM;QACjC,OAAO,EAAE,YAAY;KACtB,CAAC;IACF,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEvD,sEAAsE;IACtE,+BAA+B;IAC/B,uBAAuB,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,kDAAkD,IAAI,CAAC,QAAQ,GAAG;QAC3E,MAAM,EAAE;YACN,UAAU;YACV,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU;YACvC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;SAC7B;KACF,CAAC,CAAC;IACH,uBAAuB,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yCAAyC,MAAM,CAAC,cAAc,GAAG;KAC3E,CAAC,CAAC;IACH,uBAAuB,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,oCAAoC,QAAQ,CAAC,SAAS,cAAc,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE;QACvG,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE;KAC9E,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QAC7D,uBAAuB,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,gCAAgC,WAAW,CAAC,MAAM,EAAE;YAC7D,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,MAAM,WAAW,GAAG,kBAAkB,CAAC;QACrC,QAAQ;QACR,mBAAmB,EAAE,qBAAqB;QAC1C,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,OAAO,CAAC,EAAE;QACjB,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,UAAU;QACV,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU;QACvC,mBAAmB,EAAE,UAAU;QAC/B,SAAS;QACT,QAAQ;QACR,WAAW;QACX,YAAY;QACZ,UAAU,EAAE,MAAM,CAAC,cAAc;QACjC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/starter/source-import/plan.d.ts

@@ -1,39 +0,0 @@
-/**
- * Source Import Agent — deterministic plan builder.
- *
- * Pure function: takes a union source probe, an optional detection report,
- * an optional security report, and operator options — emits a
- * `SourceImportPlan` with an ordered list of actions the materializer
- * will execute.
- *
- * The plan shape mirrors the Fork Sync Agent's heal plan: fully structured,
- * traceable, and explicit about which actions require operator
- * confirmation. Two mandatory confirmation surfaces:
- *
- *   1. `inspect_security` for every skill import, and for any repo import
- *      with a non-safe risk class.
- *   2. `materialize_starter_shell` for non-empty destinations (agent
- *      refuses silent overwrites).
- */
-import type { SourceAccessProbe, SourceDetectionReport, SourceImportMode, SourceImportPlan, SourceSecurityReport } from "./types.js";
-export interface BuildSourceImportPlanInput {
-    probe: SourceAccessProbe;
-    destination: string;
-    starterKitId: string;
-    importMode: SourceImportMode;
-    /** Shape detection (optional — produced post-fetch by the agent). */
-    detection?: SourceDetectionReport;
-    /** Security inspection report (required for skill imports at execution time). */
-    security?: SourceSecurityReport;
-}
-/**
- * Build a deterministic import plan. No side effects besides a `fs.statSync`
- * on the destination directory.
- */
-export declare function buildSourceImportPlan(input: BuildSourceImportPlanInput): SourceImportPlan;
-/**
- * Return the list of target paths in a plan that require explicit operator
- * confirmation before the agent will execute them.
- */
-export declare function pendingConfirmations(plan: SourceImportPlan): string[];
-//# sourceMappingURL=plan.d.ts.map

package/dist/starter/source-import/plan.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAEV,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,qEAAqE;IACrE,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,iFAAiF;IACjF,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC;AA0BD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,0BAA0B,GAChC,gBAAgB,CAyHlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAIrE"}

package/dist/starter/source-import/plan.js

@@ -1,158 +0,0 @@
-/**
- * Source Import Agent — deterministic plan builder.
- *
- * Pure function: takes a union source probe, an optional detection report,
- * an optional security report, and operator options — emits a
- * `SourceImportPlan` with an ordered list of actions the materializer
- * will execute.
- *
- * The plan shape mirrors the Fork Sync Agent's heal plan: fully structured,
- * traceable, and explicit about which actions require operator
- * confirmation. Two mandatory confirmation surfaces:
- *
- *   1. `inspect_security` for every skill import, and for any repo import
- *      with a non-safe risk class.
- *   2. `materialize_starter_shell` for non-empty destinations (agent
- *      refuses silent overwrites).
- */
-import fs from "node:fs";
-import path from "node:path";
-function generateImportId() {
-    return `si-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 7)}`;
-}
-function destinationState(absDest) {
-    if (!fs.existsSync(absDest))
-        return { exists: false, nonEmpty: false };
-    const stats = fs.statSync(absDest);
-    if (!stats.isDirectory()) {
-        throw new Error(`Destination is not a directory: ${absDest}`);
-    }
-    const entries = fs.readdirSync(absDest);
-    return { exists: true, nonEmpty: entries.length > 0 };
-}
-function describeSource(probe) {
-    if (probe.kind === "github-repo") {
-        return `${probe.repo.owner}/${probe.repo.repo} via ${probe.mode} auth`;
-    }
-    return `skill ${probe.skillId}@${probe.version} (skills.sh)`;
-}
-/**
- * Build a deterministic import plan. No side effects besides a `fs.statSync`
- * on the destination directory.
- */
-export function buildSourceImportPlan(input) {
-    const absDest = path.resolve(input.destination);
-    const state = destinationState(absDest);
-    const payloadPath = "imported";
-    const warnings = [...input.probe.warnings];
-    if (input.detection)
-        warnings.push(...input.detection.warnings);
-    if (state.nonEmpty) {
-        warnings.push(`Destination ${absDest} is not empty — import requires operator confirmation.`);
-    }
-    const isSkill = input.probe.kind === "skills-skill";
-    const securityNeedsConfirmation = isSkill ||
-        (input.security !== undefined && input.security.riskClass !== "safe");
-    const actions = [];
-    actions.push({
-        actionType: "fetch_source",
-        targetPath: ".source-staging",
-        description: `Fetch ${describeSource(input.probe)}`,
-        detail: input.probe.kind === "github-repo"
-            ? {
-                repo: input.probe.repo,
-                defaultBranch: input.probe.defaultBranch,
-                accessMode: input.probe.mode,
-                cloneUrl: input.probe.cloneUrl,
-            }
-            : {
-                skillId: input.probe.skillId,
-                version: input.probe.version,
-                author: input.probe.author,
-                title: input.probe.title,
-            },
-    });
-    actions.push({
-        actionType: "inspect_security",
-        targetPath: ".source-staging",
-        description: "Run shared security inspection over the fetched payload",
-        detail: {
-            sourceKind: input.probe.kind,
-            riskClass: input.security?.riskClass,
-            blocked: input.security?.blocked ?? false,
-        },
-        needsConfirmation: securityNeedsConfirmation,
-        confirmationLabel: "security-report",
-    });
-    actions.push({
-        actionType: "materialize_starter_shell",
-        targetPath: ".",
-        description: `Materialize starter kit ${input.starterKitId} into destination`,
-        detail: { kitId: input.starterKitId },
-        needsConfirmation: state.nonEmpty,
-        confirmationLabel: state.nonEmpty ? "non-empty-destination" : undefined,
-    });
-    actions.push({
-        actionType: "place_imported_payload",
-        targetPath: payloadPath,
-        description: `Place imported payload under ${payloadPath}/ (mode=${input.importMode})`,
-        detail: {
-            importMode: input.importMode,
-            payloadRelativePath: payloadPath,
-        },
-    });
-    actions.push({
-        actionType: "write_import_manifest",
-        targetPath: ".growthub-fork/source-import.json",
-        description: "Write canonical in-fork import manifest",
-        detail: {
-            payloadRelativePath: payloadPath,
-            sourceKind: input.probe.kind,
-        },
-    });
-    actions.push({
-        actionType: "register_fork",
-        targetPath: ".growthub-fork/fork.json",
-        description: "Register imported workspace as a Growthub kit-fork",
-        detail: { kitId: input.starterKitId },
-    });
-    actions.push({
-        actionType: "seed_policy",
-        targetPath: ".growthub-fork/policy.json",
-        description: "Seed fork-sync policy with the requested remote-sync mode",
-    });
-    actions.push({
-        actionType: "seed_trace",
-        targetPath: ".growthub-fork/trace.jsonl",
-        description: "Append initial trace events for registration + import",
-    });
-    actions.push({
-        actionType: "summarize",
-        targetPath: "IMPORT_SUMMARY.md",
-        description: "Write operator-visible import summary",
-    });
-    return {
-        importId: generateImportId(),
-        source: input.probe,
-        destination: {
-            forkPath: absDest,
-            starterKitId: input.starterKitId,
-            importMode: input.importMode,
-        },
-        detection: input.detection,
-        security: input.security,
-        actions,
-        generatedAt: new Date().toISOString(),
-        warnings,
-    };
-}
-/**
- * Return the list of target paths in a plan that require explicit operator
- * confirmation before the agent will execute them.
- */
-export function pendingConfirmations(plan) {
-    return [...new Set(plan.actions
-            .filter((a) => a.needsConfirmation)
-            .map((a) => a.confirmationLabel ?? a.targetPath))];
-}
-//# sourceMappingURL=plan.js.map

package/dist/starter/source-import/plan.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../src/starter/source-import/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAqB7B,SAAS,gBAAgB;IACvB,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IAIvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAwB;IAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,CAAC,IAAI,OAAO,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,cAAc,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,CAAC;IAC/B,MAAM,QAAQ,GAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEhE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CACX,eAAe,OAAO,wDAAwD,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC;IACpD,MAAM,yBAAyB,GAC7B,OAAO;QACP,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;IAExE,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,cAAc;QAC1B,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,SAAS,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QACnD,MAAM,EACJ,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;YAChC,CAAC,CAAC;gBACE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBACtB,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;aAC/B;YACH,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;aACzB;KACR,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,kBAAkB;QAC9B,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,yDAAyD;QACtE,MAAM,EAAE;YACN,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS;YACpC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK;SAC1C;QACD,iBAAiB,EAAE,yBAAyB;QAC5C,iBAAiB,EAAE,iBAAiB;KACrC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,2BAA2B;QACvC,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,2BAA2B,KAAK,CAAC,YAAY,mBAAmB;QAC7E,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE;QACrC,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,wBAAwB;QACpC,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,gCAAgC,WAAW,WAAW,KAAK,CAAC,UAAU,GAAG;QACtF,MAAM,EAAE;YACN,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,WAAW;SACjC;KACF,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,uBAAuB;QACnC,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,yCAAyC;QACtD,MAAM,EAAE;YACN,mBAAmB,EAAE,WAAW;YAChC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;SAC7B;KACF,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,eAAe;QAC3B,UAAU,EAAE,0BAA0B;QACtC,WAAW,EAAE,oDAAoD;QACjE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE;KACtC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,aAAa;QACzB,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,2DAA2D;KACzE,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,uDAAuD;KACrE,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC;QACX,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,uCAAuC;KACrD,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,gBAAgB,EAAE;QAC5B,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,WAAW,EAAE;YACX,QAAQ,EAAE,OAAO;YACjB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAsB;IACzD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/starter/source-import/security.d.ts

@@ -1,42 +0,0 @@
-/**
- * Source Import Agent — shared security inspector.
- *
- * Deterministic, bounded, read-only static analysis over a materialised
- * source payload (cloned repo or unpacked skill). The inspector NEVER
- * executes any script. It emits a `SourceSecurityReport` that:
- *
- *   - lists pattern-based findings (shell scripts, install hooks,
- *     external downloads, prompt-injection patterns, env mutation,
- *     privileged instructions, suspicious archives)
- *   - aggregates a risk class (`safe` | `caution` | `high-risk` | `blocked`)
- *   - produces short operator-facing summary lines rendered in the
- *     confirmation prompt
- *
- * Two risk surfaces the caller uses downstream:
- *
- *   - `report.blocked` → agent MUST refuse to continue even on confirm.
- *   - `report.riskClass !== "safe"` → plan flags the inspect action as
- *     needing explicit confirmation.
- *
- * Skills imports ALWAYS require the inspection + confirmation, even when
- * the report is "safe", because skills are agent primitives closer to
- * executable content than generic repos.
- */
-import type { SourceSecurityReport } from "./types.js";
-export interface InspectSourcePayloadInput {
-    /** Absolute path to the materialised payload root. */
-    payloadRoot: string;
-    /**
-     * When true, escalates minimum severity for `skills-skill` imports so a
-     * completely finding-free skill still parks on `caution` (forcing the
-     * operator to acknowledge the security report before import). Default
-     * is false.
-     */
-    requireSkillAcknowledgement?: boolean;
-}
-/**
- * Inspect a materialised source payload and return a
- * `SourceSecurityReport`. Pure read-only.
- */
-export declare function inspectSourcePayload(input: InspectSourcePayloadInput): SourceSecurityReport;
-//# sourceMappingURL=security.d.ts.map

package/dist/starter/source-import/security.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAIV,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAsOpB,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAmGtB"}