@hardfin/cli 0.1.1-dev.83 → 0.1.1-dev.84

package/dist/check-Di68wbxY.js

@@ -0,0 +1,907 @@
+#!/usr/bin/env node
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b6b9e574-1128-56a3-a054-30dd2a567bf6")}catch(e){}}();
+import { createRequire } from "node:module";
+import { z } from "zod";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { dirname, join, posix, resolve, sep } from "node:path";
+import { parseEnv } from "node:util";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { gunzipSync } from "node:zlib";
+//#region src/report/expected.ts
+/**
+* ExpectedFailure is a failure the CLI anticipated: the person's input, their network, their
+* machine, or an answer from the API. It is shown to the person and never reported, and every
+* error that does not extend it is reported as a defect.
+*/
+var ExpectedFailure = class extends Error {};
+/** LockHeld is another hardfin command holding the credential lock for too long. */
+var LockHeld = class extends ExpectedFailure {
+	constructor() {
+		super("another hardfin command is holding the credential lock");
+		this.name = "LockHeld";
+	}
+};
+/**
+* Interrupted is a person stopping the CLI with Ctrl-C. It is something they chose to do,
+* not a failure, so the CLI stops quietly with the exit code a shell gives an interrupt.
+*/
+var Interrupted = class extends ExpectedFailure {
+	constructor() {
+		super("interrupted");
+		this.name = "Interrupted";
+	}
+};
+/** TimedOut is something the CLI waited on for longer than it allows, such as the browser. */
+var TimedOut = class extends ExpectedFailure {
+	constructor(message) {
+		super(message);
+		this.name = "TimedOut";
+	}
+};
+/** version is what this build reports, read from the published package manifest. */
+const version$1 = createRequire(import.meta.url)("../package.json").version;
+/** The values that mean no, for a variable that turns something on or off. */
+const OFF = /* @__PURE__ */ new Set([
+	"0",
+	"false",
+	"off",
+	"no"
+]);
+/**
+* toTelemetry decides whether defects are reported. A person's opt out wins over everything,
+* and a CLI run from a checkout reports only when its developer asks it to.
+*/
+function toTelemetry(env = process.env, isCheckout = isRunFromCheckout()) {
+	const dsn = env["HARDFIN_SENTRY_DSN"] || "https://a4819e652e9fa63c0ab67e9febe44565@o1388102.ingest.us.sentry.io/4512176532684800";
+	const base = {
+		dsn,
+		environment: isCheckout ? "local" : version$1.includes("-dev.") ? "preview" : "production",
+		release: toRelease$1(version$1)
+	};
+	if (env["DO_NOT_TRACK"] && !OFF.has(env["DO_NOT_TRACK"].toLowerCase())) return {
+		...base,
+		enabled: false,
+		from: "DO_NOT_TRACK"
+	};
+	const asked = env["HARDFIN_TELEMETRY"]?.toLowerCase();
+	if (asked !== void 0 && OFF.has(asked)) return {
+		...base,
+		enabled: false,
+		from: "HARDFIN_TELEMETRY"
+	};
+	if (!isDsn(dsn)) return {
+		...base,
+		enabled: false,
+		from: "HARDFIN_SENTRY_DSN is not a valid DSN"
+	};
+	if (asked !== void 0) return {
+		...base,
+		enabled: true,
+		from: "HARDFIN_TELEMETRY"
+	};
+	return isCheckout ? {
+		...base,
+		enabled: false,
+		from: "run from a checkout"
+	} : {
+		...base,
+		enabled: true,
+		from: "default"
+	};
+}
+/**
+* isRunFromCheckout answers whether this CLI runs from a clone of its repository, as npm link
+* and node dist/cli.js do. The published package holds dist and nothing beside it.
+*/
+function isRunFromCheckout() {
+	return existsSync(fileURLToPath(new URL("../src", import.meta.url)));
+}
+/** isDsn answers whether a DSN can be read as the URL of a Sentry project. */
+function isDsn(dsn) {
+	try {
+		return new URL(dsn).host !== "";
+	} catch {
+		return false;
+	}
+}
+/**
+* toRelease names a version as Sentry knows it. Sentry refuses a slash in a release name, so
+* the scoped package name @hardfin/cli cannot be used, and hardfin-cli stands in for it.
+*/
+function toRelease$1(of) {
+	return `hardfin-cli@${of}`;
+}
+//#endregion
+//#region src/command/api-version.generated.ts
+/** API_VERSION is the version of the API document the commands were generated from. */
+const API_VERSION = "2026-10-26";
+//#endregion
+//#region src/config/settings.ts
+/** The file a local build reads its overrides from, in the working directory. */
+const CONFIG_FILE = "config.local.json";
+const DEFAULT_API_URL = "https://api.hardfin.com/v2";
+/**
+* The client Hardfin seeded for this CLI. The key is generated from a fixed identifier, so
+* it names the same first-party client in every environment.
+*/
+const DEFAULT_CLIENT_ID = "oacl_10e2etq297nhjfhb";
+const DEFAULT_ENV_FILE = ".env";
+const FileSettings = z.strictObject({
+	apiUrl: z.string().optional(),
+	apiKey: z.string().optional(),
+	clientId: z.string().optional(),
+	issuerUrl: z.string().optional()
+});
+/** ConfigFailure is a config file that cannot be read or does not match the schema. */
+var ConfigFailure = class extends ExpectedFailure {
+	constructor(message) {
+		super(message);
+		this.name = "ConfigFailure";
+	}
+};
+/** toSettings resolves what this invocation talks to, and where each value came from. */
+function toSettings(flags = {}, directory = process.cwd()) {
+	const fromEnvFile = loadEnvFile(directory);
+	const file = toFileSettings(directory);
+	const sources = {};
+	const pick = (key, flag, variable, fromFile, fallback) => {
+		const [value, source] = toLayer(flag, process.env[variable], fromEnvFile.has(variable), fromFile, fallback);
+		sources[key] = source;
+		return value;
+	};
+	const apiUrl = toTrimmedUrl(pick("apiUrl", flags.apiUrl, "HARDFIN_API_URL", file.apiUrl, DEFAULT_API_URL) ?? DEFAULT_API_URL);
+	return {
+		settings: {
+			apiUrl,
+			apiKey: pick("apiKey", flags.apiKey, "HARDFIN_API_KEY", file.apiKey),
+			clientId: pick("clientId", flags.clientId, "HARDFIN_CLIENT_ID", file.clientId, DEFAULT_CLIENT_ID) ?? DEFAULT_CLIENT_ID,
+			issuerUrl: pick("issuerUrl", flags.issuerUrl, "HARDFIN_ISSUER_URL", file.issuerUrl, toOrigin(apiUrl)) ?? ""
+		},
+		sources
+	};
+}
+function toLayer(flag, environment, isFromEnvFile, file, fallback) {
+	if (flag) return [flag, "flag"];
+	if (environment) return [environment, isFromEnvFile ? "env file" : "environment"];
+	if (file) return [file, "config file"];
+	return [fallback, "default"];
+}
+/** toFileSettings reads the local override file, which a local build is expected to have. */
+function toFileSettings(directory) {
+	const path = resolve(directory, CONFIG_FILE);
+	if (!existsSync(path)) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		throw new ConfigFailure(`${CONFIG_FILE} does not hold JSON`);
+	}
+	const result = FileSettings.safeParse(parsed);
+	if (!result.success) {
+		const issue = result.error.issues[0];
+		throw new ConfigFailure(`${CONFIG_FILE} is not valid: ${issue?.path.join(".") || "root"} ${issue?.message ?? ""}`.trim());
+	}
+	return result.data;
+}
+/** The variables an env file may set, which are the settings and nothing else the CLI reads. */
+const SETTING_VARIABLES = /* @__PURE__ */ new Set([
+	"HARDFIN_API_URL",
+	"HARDFIN_API_KEY",
+	"HARDFIN_CLIENT_ID",
+	"HARDFIN_ISSUER_URL"
+]);
+/**
+* isTakenFromFile answers whether an env file may set a variable. A file in a folder supplies
+* the settings, and may turn error reports off. Where reports go, where a sign in is kept,
+* and anything a started program reads are for the person to set themselves.
+*/
+function isTakenFromFile(name, value) {
+	if (SETTING_VARIABLES.has(name)) return true;
+	if (name === "DO_NOT_TRACK") return !OFF.has(value.toLowerCase());
+	return name === "HARDFIN_TELEMETRY" && OFF.has(value.toLowerCase());
+}
+/**
+* loadEnvFile reads a .env beside the command, so a local build needs no exports, and
+* answers which variables it supplied. An exported variable is left alone, so a shell
+* export still wins over the file.
+*/
+function loadEnvFile(directory) {
+	const path = process.env["HARDFIN_ENV_FILE"] ?? resolve(directory, DEFAULT_ENV_FILE);
+	if (!existsSync(path)) return /* @__PURE__ */ new Set();
+	let held;
+	try {
+		held = parseEnv(readFileSync(path, "utf8"));
+	} catch {
+		throw new ConfigFailure(`${path} cannot be read as an env file`);
+	}
+	const supplied = /* @__PURE__ */ new Set();
+	for (const [name, value] of Object.entries(held)) {
+		if (value === void 0 || process.env[name] !== void 0 || !isTakenFromFile(name, value)) continue;
+		process.env[name] = value;
+		supplied.add(name);
+	}
+	return supplied;
+}
+function toTrimmedUrl(url) {
+	return url.replace(/\/+$/, "");
+}
+/** toOrigin drops the API's path, because the authorization server sits at the host root. */
+function toOrigin(apiUrl) {
+	try {
+		return new URL(apiUrl).origin;
+	} catch {
+		return apiUrl;
+	}
+}
+//#endregion
+//#region src/output/writer.ts
+/**
+* toText reads a value a caller supplied, which arrives typed as unknown. An object would
+* otherwise reach a request as the text "[object Object]".
+*/
+function toText$1(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
+	if (value === void 0 || value === null) return "";
+	return JSON.stringify(value);
+}
+/** Every control character but a newline and a tab, which are the two a line of text needs. */
+const CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
+/**
+* toPrintable makes text safe to show at a terminal. A name or a message from the API can
+* hold an escape sequence, which a terminal would act on. Each such character is written
+* as its code, so the text reads as what it holds.
+*/
+function toPrintable(text) {
+	return text.replace(CONTROL, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+* toJSON writes a value for whoever is reading the stream. A person at a terminal gets it
+* indented. A program gets it on one line, because the indentation of a page of records is
+* close to half of what an agent would otherwise have to read.
+*/
+function toJSON(value, stream) {
+	return stream.isTTY ? JSON.stringify(value, null, 2) : JSON.stringify(value);
+}
+/** writeData prints a command's result on stdout. */
+function writeData(value) {
+	if (typeof value === "string") {
+		const text = toPrintable(value);
+		process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+		return;
+	}
+	process.stdout.write(`${toJSON(value ?? null, process.stdout)}\n`);
+}
+/** The code of the last failure written, which decides whether the CLI checks for an update. */
+let lastFailureCode;
+/** toLastFailureCode answers the code of the last failure this run wrote. */
+function toLastFailureCode() {
+	return lastFailureCode;
+}
+/** writeFailure prints why a command failed on stderr, with a code only a machine reading JSON sees. */
+function writeFailure(code, message, isJSON, errors, requestId, status) {
+	lastFailureCode = code;
+	if (!isJSON) {
+		process.stderr.write(`error: ${toPrintable(message)}${status === void 0 ? "" : ` (HTTP ${status})`}\n`);
+		for (const entry of errors?.slice(1) ?? []) process.stderr.write(`  ${toPrintable(entry.error)} (${entry.statusCode})\n`);
+		if (requestId) process.stderr.write(`  request ${toPrintable(requestId)}\n`);
+		return;
+	}
+	const payload = {
+		code,
+		message,
+		errors: errors ?? [{
+			error: message,
+			statusCode: 0
+		}],
+		requestId: requestId ?? null,
+		status: status ?? null
+	};
+	process.stderr.write(`${toJSON(payload, process.stderr)}\n`);
+}
+/** isJSONOutput decides whether this invocation prints machine-readable output. */
+function isJSONOutput(flags) {
+	if (flags["json"] === true) return true;
+	return !process.stdout.isTTY;
+}
+//#endregion
+//#region src/system/state.ts
+/** toStateDirectory names the folder the CLI keeps what it remembers between runs in. */
+function toStateDirectory() {
+	const base = process.env["XDG_STATE_HOME"] ?? join(homedir(), ".local", "state");
+	return join(base, "hardfin");
+}
+/** The newest API version any answer in this run asked the CLI to move to. */
+let outdatedTo;
+/** noteNotices keeps what an answer's notices say about the version this CLI speaks. */
+function noteNotices(notices) {
+	if (!Array.isArray(notices)) return;
+	for (const notice of notices) {
+		const { code, latestVersion } = typeof notice === "object" && notice !== null ? notice : {};
+		if (code !== "API_VERSION_OUTDATED" || typeof latestVersion !== "string") continue;
+		if (outdatedTo === void 0 || latestVersion > outdatedTo) outdatedTo = latestVersion;
+	}
+}
+/** toOutdatedTo answers the API version an answer said to move to, or nothing when none did. */
+function toOutdatedTo() {
+	return outdatedTo;
+}
+//#endregion
+//#region src/system/package.ts
+/** The folders this package ships, beside its manifest. */
+const SHIPPED = ["dist", "templates"];
+/** toPackageDirectory finds this package's own folder, which holds the templates it ships. */
+function toPackageDirectory(from = dirname(fileURLToPath(import.meta.url))) {
+	for (let directory = from;; directory = dirname(directory)) {
+		const manifest = join(directory, "package.json");
+		if (existsSync(manifest) && JSON.parse(readFileSync(manifest, "utf8")).name === "@hardfin/cli") return directory;
+		if (dirname(directory) === directory) throw new Error("the @hardfin/cli package folder could not be found, so its templates cannot be read");
+	}
+}
+/**
+* isShipped answers whether a path is one of the files this package installs. A file of the
+* CLI's own that cannot be read is a broken install, not the person's machine refusing them.
+*/
+function isShipped(path, packageDirectory) {
+	let directory;
+	try {
+		directory = packageDirectory ?? toPackageDirectory();
+	} catch {
+		return false;
+	}
+	return path === join(directory, "package.json") || SHIPPED.some((folder) => path === join(directory, folder) || path.startsWith(join(directory, folder) + sep));
+}
+//#endregion
+//#region src/skills/archive.ts
+/** The largest archive this reads, unpacked. A skills release is tens of kilobytes. */
+const MAX_UNPACKED_BYTES = 52428800;
+const BLOCK = 512;
+/**
+* toArchiveFiles reads the regular files out of a gzipped tar archive. It refuses links and any
+* path that would land outside the folder the archive is unpacked into.
+*/
+function toArchiveFiles(gzipped) {
+	const tar = gunzipSync(gzipped, { maxOutputLength: MAX_UNPACKED_BYTES });
+	const files = [];
+	let offset = 0;
+	let nextPath;
+	while (offset + BLOCK <= tar.length) {
+		const header = tar.subarray(offset, offset + BLOCK);
+		if (header.every((byte) => byte === 0)) break;
+		const size = toOctal(header.subarray(124, 136));
+		const type = String.fromCharCode(header[156] ?? 0);
+		const body = tar.subarray(offset + BLOCK, offset + BLOCK + size);
+		offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK;
+		if (type === "x") {
+			nextPath = toPaxPath(body.toString("utf8")) ?? nextPath;
+			continue;
+		}
+		if (type === "L") {
+			nextPath = body.toString("utf8").replace(/\0+$/, "");
+			continue;
+		}
+		if (type === "g" || type === "5") continue;
+		const path = toSafePath(nextPath ?? toHeaderPath(header));
+		nextPath = void 0;
+		if (type !== "0" && type !== "\0") throw new Error(`the archive holds ${path} as something other than a file, which a skills release never does`);
+		files.push({
+			path,
+			content: Buffer.from(body)
+		});
+	}
+	return files;
+}
+/** toHeaderPath reads an entry's path from its header, joining the ustar prefix when there is one. */
+function toHeaderPath(header) {
+	const name = toText(header.subarray(0, 100));
+	const prefix = toText(header.subarray(257, 263)).startsWith("ustar") ? toText(header.subarray(345, 500)) : "";
+	return prefix ? `${prefix}/${name}` : name;
+}
+/** toPaxPath finds the path record in a pax header, whose records read "<length> path=<value>". */
+function toPaxPath(records) {
+	for (const record of records.split("\n")) {
+		const match = /^\d+ path=(.*)$/.exec(record);
+		if (match) return match[1];
+	}
+}
+/** toSafePath normalizes a path, and refuses one that is absolute or climbs out of the archive. */
+function toSafePath(raw) {
+	const path = posix.normalize(raw.replace(/^\.\//, ""));
+	if (path.startsWith("/") || path === ".." || path.startsWith("../") || raw.includes("\\")) throw new Error(`the archive holds ${JSON.stringify(raw)}, which would land outside the folder it is unpacked into`);
+	return path;
+}
+function toText(field) {
+	const end = field.indexOf(0);
+	return field.subarray(0, end < 0 ? field.length : end).toString("utf8");
+}
+function toOctal(field) {
+	const text = toText(field).trim();
+	return text === "" ? 0 : Number.parseInt(text, 8);
+}
+//#endregion
+//#region src/update/check.ts
+/** The package the CLI is published as, which an update installs. */
+const PACKAGE = "@hardfin/cli";
+/** How long a registry request may take, which is short because no command waits on it for long. */
+const REGISTRY_TIMEOUT_MS = 3e3;
+/** A version as npm publishes this package, a release or a dev preview. */
+const VERSION = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
+/**
+* toUpdateCheckRefusal says why the CLI should not ask the registry, or nothing when it may.
+* A person turns it off with HARDFIN_NO_UPDATE_CHECK, and a CI run never asks.
+*/
+function toUpdateCheckRefusal(env = process.env) {
+	const asked = env["HARDFIN_NO_UPDATE_CHECK"];
+	if (asked !== void 0 && asked !== "" && !OFF.has(asked.toLowerCase())) return "HARDFIN_NO_UPDATE_CHECK is set";
+	if (env["CI"] && !OFF.has(env["CI"].toLowerCase())) return "CI is set";
+}
+/**
+* toCheck answers whether a newer version is published. It reads the cache while it is less
+* than a day old, unless isFresh asks the registry regardless.
+*/
+async function toCheck(options = {}) {
+	const cache = toCache();
+	const isCurrent = cache !== void 0 && Date.now() - Date.parse(cache.checkedAt) < 864e5;
+	if (cache && (options.isCachedOnly || isCurrent && !options.isFresh)) return toUpdateCheck(cache.tags, cache.checkedAt, true);
+	if (options.isCachedOnly) return;
+	const tags = await toRegistryTags(options.signal);
+	if (!tags) return;
+	const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+	writeCache({
+		...cache,
+		checkedAt,
+		tags
+	});
+	return toUpdateCheck(tags, checkedAt, false);
+}
+/** toUpdateCheck compares the installed version with the newest one on its channel. */
+function toUpdateCheck(tags, checkedAt, isCached, version = version$1) {
+	const tag = toChannel(version);
+	const latest = (tag === "dev" ? [tags.dev, tags.latest] : [tags.latest]).filter((entry) => entry !== void 0).reduce((newest, entry) => newest === void 0 || toCompared(entry, newest) > 0 ? entry : newest, void 0);
+	if (latest === void 0 || !VERSION.test(version)) return;
+	return {
+		version,
+		latest,
+		tag,
+		isOutdated: toCompared(latest, version) > 0,
+		checkedAt,
+		isCached
+	};
+}
+/** toChannel names the npm tag a version was published under. */
+function toChannel(version) {
+	return /-dev\./.test(version) ? "dev" : "latest";
+}
+/** isVersion answers whether text is a version this package is published as. */
+function isVersion(text) {
+	return VERSION.test(text);
+}
+/**
+* toCompared orders two versions by semver precedence. A release sorts after its own
+* previews, and dev.10 after dev.9, because a numeric part compares as a number.
+*/
+function toCompared(a, b) {
+	const [left, right] = [VERSION.exec(a), VERSION.exec(b)];
+	if (!left || !right) return 0;
+	for (let index = 1; index <= 3; index++) {
+		const difference = Number(left[index]) - Number(right[index]);
+		if (difference !== 0) return Math.sign(difference);
+	}
+	const [leftPre, rightPre] = [left[4], right[4]];
+	if (leftPre === void 0 || rightPre === void 0) return leftPre === rightPre ? 0 : leftPre === void 0 ? 1 : -1;
+	const [leftParts, rightParts] = [leftPre.split("."), rightPre.split(".")];
+	for (let index = 0; index < Math.max(leftParts.length, rightParts.length); index++) {
+		const [l, r] = [leftParts[index], rightParts[index]];
+		if (l === void 0 || r === void 0) return l === void 0 ? -1 : 1;
+		const difference = /^\d+$/.test(l) && /^\d+$/.test(r) ? Number(l) - Number(r) : l.localeCompare(r);
+		if (difference !== 0) return Math.sign(difference);
+	}
+	return 0;
+}
+/** toRegistryTags asks npm which versions the package's tags name, or nothing when it cannot answer. */
+async function toRegistryTags(signal) {
+	const registry = (process.env["npm_config_registry"] || "https://registry.npmjs.org").replace(/\/+$/, "");
+	const timeout = AbortSignal.timeout(REGISTRY_TIMEOUT_MS);
+	try {
+		const response = await fetch(`${registry}/-/package/${PACKAGE}/dist-tags`, {
+			headers: { Accept: "application/json" },
+			signal: signal ? AbortSignal.any([signal, timeout]) : timeout
+		});
+		if (!response.ok) return;
+		return toTags(await response.json());
+	} catch {
+		return;
+	}
+}
+/** toTags keeps the tags that name a version, since a tag's value reaches an npm command line. */
+function toTags(answer) {
+	if (typeof answer !== "object" || answer === null) return;
+	const tags = {};
+	for (const name of ["latest", "dev"]) {
+		const value = answer[name];
+		if (typeof value === "string" && VERSION.test(value)) tags[name] = value;
+	}
+	return tags.latest === void 0 && tags.dev === void 0 ? void 0 : tags;
+}
+/**
+* isReminderDue answers whether a daily reminder of this version may be printed, and marks it
+* printed. A person told once a day is told enough, and an agent running many commands is not
+* told on every one.
+*/
+function isReminderDue(latest) {
+	const cache = toCache();
+	if (!cache) return true;
+	if (cache.remindedOf === latest && Date.now() - Date.parse(cache.remindedAt ?? "") < 864e5) return false;
+	writeCache({
+		...cache,
+		remindedOf: latest,
+		remindedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	return true;
+}
+function toCachePath() {
+	return join(toStateDirectory(), "update-check.json");
+}
+function toCache() {
+	try {
+		const parsed = JSON.parse(readFileSync(toCachePath(), "utf8"));
+		const tags = toTags(parsed.tags);
+		return typeof parsed.checkedAt === "string" && tags ? {
+			...parsed,
+			checkedAt: parsed.checkedAt,
+			tags
+		} : void 0;
+	} catch {
+		return;
+	}
+}
+function writeCache(cache) {
+	try {
+		mkdirSync(dirname(toCachePath()), { recursive: true });
+		writeFileSync(toCachePath(), `${JSON.stringify(cache)}\n`);
+	} catch {}
+}
+//#endregion
+//#region src/skills/release.ts
+/** The repository the Hardfin skills are released from. */
+const SKILLS_REPOSITORY = "hardfinhq/skills";
+/**
+* The skills releases this CLI works with, from minimum up to but not including below. The
+* hardfin-cli skill names commands and flags, so a major release of the skills needs a CLI
+* that declares it.
+*/
+const SKILLS_RANGE = {
+	minimum: "1.0.0",
+	below: "2.0.0"
+};
+/** How long one request to GitHub may take before the install gives up on it. */
+const REQUEST_TIMEOUT_MS = 2e4;
+/** toRangeText writes the range the way an npm user reads one. */
+function toRangeText() {
+	return `>=${SKILLS_RANGE.minimum} <${SKILLS_RANGE.below}`;
+}
+/** isInRange answers whether this CLI works with a skills release. A prerelease never is. */
+function isInRange(version) {
+	return isVersion(version) && !version.includes("-") && toCompared(version, SKILLS_RANGE.minimum) >= 0 && toCompared(version, SKILLS_RANGE.below) < 0;
+}
+/**
+* toManualInstall says how to install the skills without this CLI and without git, which most
+* people running an agent do not have. A known release gets its own archive's address.
+*/
+function toManualInstall(version) {
+	return `Download ${version === void 0 ? `the hardfin-skills archive from https://github.com/${SKILLS_REPOSITORY}/releases/latest` : `https://github.com/${SKILLS_REPOSITORY}/releases/download/v${version}/hardfin-skills-${version}.tar.gz`}, unpack it, and copy each folder under its skills/ into .agents/skills/ and .claude/skills/. With git installed, npx skills add ${SKILLS_REPOSITORY} does the same.`;
+}
+/**
+* toSkillsRelease fetches a skills release: the one asked for, or else the newest this CLI works
+* with. It answers why it could not, rather than throwing, so a setup carries on without it.
+*/
+async function toSkillsRelease(options = {}) {
+	const env = options.env ?? process.env;
+	const token = env["GH_TOKEN"] || env["GITHUB_TOKEN"] || void 0;
+	const request = (url, accept) => toResponse(url, accept, token, options.signal);
+	try {
+		const release = await toRelease(request, options.version);
+		if ("reason" in release) return release;
+		const version = release.tag_name.replace(/^v/, "");
+		const archiveName = `hardfin-skills-${version}.tar.gz`;
+		const archive = release.assets.find((asset) => asset.name === archiveName);
+		const checksum = release.assets.find((asset) => asset.name === `${archiveName}.sha256`);
+		if (!archive || !checksum) return {
+			reason: `release ${version} has no ${archiveName} and checksum beside it`,
+			install: toManualInstall(version)
+		};
+		const download = (asset) => token === void 0 ? request(asset.browser_download_url, "*/*") : request(asset.url, "application/octet-stream");
+		const [archiveResponse, checksumResponse] = await Promise.all([download(archive), download(checksum)]);
+		if (!archiveResponse.ok || !checksumResponse.ok) return toUnavailable(archiveResponse.ok ? checksumResponse : archiveResponse, version);
+		const bytes = Buffer.from(await archiveResponse.arrayBuffer());
+		if ((await checksumResponse.text()).trim().split(/\s+/)[0]?.toLowerCase() !== createHash("sha256").update(bytes).digest("hex")) return {
+			reason: `${archiveName} does not match the checksum published beside it`,
+			install: toManualInstall(version)
+		};
+		let files;
+		try {
+			files = toArchiveFiles(bytes).filter((file) => file.path.startsWith("skills/"));
+		} catch (error) {
+			return {
+				reason: `${archiveName} could not be read, because ${toMessage(error)}`,
+				install: toManualInstall(version)
+			};
+		}
+		if (files.length === 0) return {
+			reason: `${archiveName} holds no skills`,
+			install: toManualInstall(version)
+		};
+		return {
+			version,
+			files,
+			source: archive.browser_download_url
+		};
+	} catch (error) {
+		return {
+			reason: error instanceof Error && error.name === "TimeoutError" ? "GitHub did not answer in time" : toReason(error),
+			install: toManualInstall(options.version)
+		};
+	}
+}
+/** toRelease finds the release asked for, or else the newest one this CLI works with. */
+async function toRelease(request, version) {
+	const api = `https://api.github.com/repos/${SKILLS_REPOSITORY}/releases`;
+	if (version !== void 0) {
+		const response = await request(`${api}/tags/v${version}`, "application/vnd.github+json");
+		return response.ok ? await response.json() : toUnavailable(response, version);
+	}
+	const response = await request(`${api}?per_page=100`, "application/vnd.github+json");
+	if (!response.ok) return toUnavailable(response);
+	return (await response.json()).filter((release) => !release.draft && !release.prerelease && isInRange(release.tag_name.replace(/^v/, ""))).sort((a, b) => toCompared(b.tag_name.replace(/^v/, ""), a.tag_name.replace(/^v/, "")))[0] ?? {
+		reason: `hardfinhq/skills has no release in ${toRangeText()}, which this CLI works with`,
+		install: toManualInstall()
+	};
+}
+function toResponse(url, accept, token, signal) {
+	const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+	const headers = {
+		Accept: accept,
+		"User-Agent": "hardfin-cli"
+	};
+	if (token !== void 0) headers["Authorization"] = `Bearer ${token}`;
+	return fetch(url, {
+		headers,
+		signal: signal ? AbortSignal.any([signal, timeout]) : timeout
+	});
+}
+/**
+* toUnavailable says why GitHub refused, in the terms a person can act on. GitHub answers 404
+* for a private repository as it does for one that does not exist, so a 404 names both.
+*/
+function toUnavailable(response, version) {
+	const install = toManualInstall(version);
+	const what = version === void 0 ? `the releases of ${SKILLS_REPOSITORY}` : `release ${version} of ${SKILLS_REPOSITORY}`;
+	if (response.status === 403 && response.headers.get("x-ratelimit-remaining") === "0") return {
+		reason: `GitHub's hourly limit for unsigned requests is used up. Set GH_TOKEN to a GitHub token to lift it`,
+		install
+	};
+	if (response.status === 401 || response.status === 403 || response.status === 404) return {
+		reason: `GitHub answered ${response.status} for ${what}, which it also answers while a repository is private. Set GH_TOKEN to a token that can read it, or install the skills by hand`,
+		install
+	};
+	return {
+		reason: `GitHub answered ${response.status} for ${what}`,
+		install
+	};
+}
+function toMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function toReason(error) {
+	const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
+	return error instanceof Error ? `GitHub could not be reached${cause}` : "GitHub could not be reached";
+}
+//#endregion
+//#region src/skills/marker.ts
+/** The frontmatter key, under metadata, that records which skills release wrote a SKILL.md. */
+const RELEASE_KEY = "hardfin-skills-release";
+const FRONTMATTER = /^---\r?\n([\s\S]*?)\r?\n---(\r?\n|$)/;
+const STAMP = new RegExp(`^[ \\t]+${RELEASE_KEY}:`);
+/**
+* toStamped records a release in a SKILL.md's frontmatter, under metadata, replacing a release an
+* earlier install recorded. A file without frontmatter is not a skill, and is left as it is.
+*/
+function toStamped(content, release) {
+	const match = FRONTMATTER.exec(content);
+	if (!match) return content;
+	const lines = (match[1] ?? "").split("\n").filter((line) => !STAMP.test(line));
+	const stamp = `  ${RELEASE_KEY}: "${release}"`;
+	const metadata = lines.findIndex((line) => /^metadata:\s*$/.test(line));
+	if (metadata >= 0) lines.splice(metadata + 1, 0, stamp);
+	else lines.push("metadata:", stamp);
+	return `---\n${lines.join("\n")}\n---${match[2] ?? ""}${content.slice(match[0].length)}`;
+}
+/** toStampedRelease answers the release a SKILL.md records, or undefined when it records none. */
+function toStampedRelease(content) {
+	const frontmatter = FRONTMATTER.exec(content)?.[1] ?? "";
+	return new RegExp(`^[ \\t]+${RELEASE_KEY}:\\s*"?([^"\\s]+)"?\\s*$`, "m").exec(frontmatter)?.[1];
+}
+/** toPluginRelease answers the release a plugin's marker names, or undefined when it is not Hardfin's. */
+function toPluginRelease(path) {
+	try {
+		const marker = JSON.parse(readFileSync(path, "utf8"));
+		return marker.name === "hardfin" && typeof marker.version === "string" ? marker.version : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/skills/check.ts
+/** Where agents read skills: Codex and most others, then Claude Code. */
+const SKILL_DIRECTORIES = [".agents/skills", ".claude/skills"];
+/** The skill every install has, whose SKILL.md records the release. */
+const ANCHOR_SKILL = "hardfin-cli";
+/** The folders under a plugin root that hold marketplace catalogs, which list plugins without installing them. */
+const CATALOG_FOLDERS = /* @__PURE__ */ new Set(["marketplaces"]);
+/** How deep, and through how many folders, the plugin search goes, so a check on every call stays quick. */
+const PLUGIN_DEPTH = 6;
+const PLUGIN_FOLDER_LIMIT = 2e3;
+/** toSkillsCheck looks for the Hardfin skills everywhere an agent working here would read them. */
+function toSkillsCheck(options = {}) {
+	const cwd = resolve(options.cwd ?? process.cwd());
+	const home = options.home ?? homedir();
+	const env = options.env ?? process.env;
+	return toVerdict([
+		...toProjectLocations(cwd, home),
+		...toUserLocations(home, env),
+		...toPluginLocations(toPluginRoots(home, env, options.platform ?? process.platform))
+	]);
+}
+/**
+* toPluginRoots names where each agent tool installs plugins, following the variable that moves
+* its folder. Claude Code and Codex keep a cache under their own folder, Cursor under
+* ~/.cursor/plugins, Copilot CLI under installed-plugins, and VS Code under its user data folder.
+*/
+function toPluginRoots(home, env, platform) {
+	const claude = env["CLAUDE_CONFIG_DIR"] || join(home, ".claude");
+	const codex = env["CODEX_HOME"] || join(home, ".codex");
+	const copilot = env["COPILOT_HOME"] || join(home, ".copilot");
+	const vscode = platform === "darwin" ? join(home, "Library", "Application Support", "Code") : platform === "win32" ? join(env["APPDATA"] || join(home, "AppData", "Roaming"), "Code") : join(env["XDG_CONFIG_HOME"] || join(home, ".config"), "Code");
+	return [
+		join(claude, "plugins"),
+		join(codex, "plugins"),
+		join(home, ".cursor", "plugins"),
+		join(copilot, "installed-plugins"),
+		join(vscode, "agentPlugins"),
+		join(home, ".vscode", "agent-plugins")
+	];
+}
+/** toVerdict answers one state for every location, judging by the copy that needs the most attention. */
+function toVerdict(locations) {
+	const range = toRangeText();
+	if (locations.length === 0) return {
+		state: "missing",
+		release: null,
+		range,
+		locations,
+		command: "hardfin init"
+	};
+	const older = locations.find((location) => location.release === null || toCompared(location.release, SKILLS_RANGE.minimum) < 0);
+	if (older) return {
+		state: "outdated",
+		release: older.release,
+		range,
+		locations,
+		command: "hardfin init --skills-only"
+	};
+	const newer = locations.find((location) => location.release !== null && !isInRange(location.release));
+	if (newer) return {
+		state: "newer",
+		release: newer.release,
+		range,
+		locations,
+		command: "hardfin update"
+	};
+	return {
+		state: "current",
+		release: locations.map((location) => location.release).sort((a, b) => toCompared(b ?? "0.0.0", a ?? "0.0.0"))[0] ?? null,
+		range,
+		locations,
+		command: null
+	};
+}
+/** toSkillsSentence says what a check found, and the command or skill that fixes it. */
+function toSkillsSentence(check) {
+	switch (check.state) {
+		case "missing": return "Hardfin skills are not installed here. Run hardfin init.";
+		case "outdated": return check.release === null ? `Hardfin skills here predate skills releases, and this CLI needs ${check.range}. Run hardfin init --skills-only, or follow the hardfin-upgrade skill.` : `Hardfin skills here are release ${check.release}, and this CLI needs ${check.range}. Run hardfin init --skills-only, or follow the hardfin-upgrade skill.`;
+		case "newer": return `Hardfin skills here are release ${check.release}, newer than this CLI works with (${check.range}). Run hardfin update, or follow the hardfin-upgrade skill.`;
+		default: return;
+	}
+}
+/**
+* isSkillsReminderDue answers whether a person at a terminal should be told again in this folder,
+* and marks them told. An agent is told on every call, since each session starts without memory.
+*/
+function isSkillsReminderDue(cwd = process.cwd()) {
+	const path = join(toStateDirectory(), "skills-reminders.json");
+	let reminded = {};
+	try {
+		reminded = JSON.parse(readFileSync(path, "utf8"));
+	} catch {}
+	const folder = resolve(cwd);
+	if (Date.now() - Date.parse(reminded[folder] ?? "") < 864e5) return false;
+	try {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, `${JSON.stringify({
+			...reminded,
+			[folder]: (/* @__PURE__ */ new Date()).toISOString()
+		})}\n`);
+	} catch {}
+	return true;
+}
+/**
+* toProjectLocations walks from the working folder up to the repository's root, found by its .git
+* folder rather than by running git, which many people running an agent do not have. Outside a
+* repository it walks to the home folder, whose skills are the user's own and are counted there.
+*/
+function toProjectLocations(cwd, home) {
+	const locations = [];
+	let folder = cwd;
+	while (folder !== resolve(home)) {
+		locations.push(...toFolderLocations(folder, "project"));
+		if (existsSync(join(folder, ".git")) || dirname(folder) === folder) break;
+		folder = dirname(folder);
+	}
+	return locations;
+}
+/** toUserLocations reads the user's own skills, in ~/.agents/skills and in Claude Code's folder, which CLAUDE_CONFIG_DIR moves. */
+function toUserLocations(home, env) {
+	const claude = env["CLAUDE_CONFIG_DIR"] || join(home, ".claude");
+	return [join(home, ".agents", "skills"), join(claude, "skills")].flatMap((place) => toSkillsAt(place, "user"));
+}
+function toFolderLocations(folder, kind) {
+	return SKILL_DIRECTORIES.flatMap((place) => toSkillsAt(join(folder, place), kind));
+}
+/** toSkillsAt reads the release the anchor skill in one skills folder records, if the folder has it. */
+function toSkillsAt(place, kind) {
+	try {
+		return [{
+			path: place,
+			kind,
+			release: toStampedRelease(readFileSync(join(place, ANCHOR_SKILL, "SKILL.md"), "utf8")) ?? null
+		}];
+	} catch {
+		return [];
+	}
+}
+/**
+* toPluginLocations finds a Hardfin plugin's marker under the folders agent tools install plugins
+* in. A marketplace catalog holds the marker too, without the plugin being installed, so it is skipped.
+*/
+function toPluginLocations(roots) {
+	const locations = [];
+	let visited = 0;
+	const walk = (folder, depth) => {
+		if (depth > PLUGIN_DEPTH || visited++ > PLUGIN_FOLDER_LIMIT) return;
+		let entries;
+		try {
+			entries = readdirSync(folder, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) if (entry.isFile() && entry.name === "hardfin-skills.json") {
+			const release = toPluginRelease(join(folder, entry.name));
+			if (release !== void 0) locations.push({
+				path: folder,
+				kind: "plugin",
+				release
+			});
+		} else if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".git" && !CATALOG_FOLDERS.has(entry.name)) walk(join(folder, entry.name), depth + 1);
+	};
+	for (const root of roots) walk(root, 0);
+	return locations;
+}
+//#endregion
+export { version$1 as A, writeData as C, toSettings as D, ConfigFailure as E, Interrupted as M, LockHeld as N, API_VERSION as O, TimedOut as P, toText$1 as S, CONFIG_FILE as T, toOutdatedTo as _, toStamped as a, toJSON as b, toRangeText as c, isReminderDue as d, toCheck as f, noteNotices as g, toPackageDirectory as h, toSkillsSentence as i, ExpectedFailure as j, toTelemetry as k, toSkillsRelease as l, isShipped as m, isSkillsReminderDue as n, SKILLS_REPOSITORY as o, toUpdateCheckRefusal as p, toSkillsCheck as r, isInRange as s, SKILL_DIRECTORIES as t, PACKAGE as u, toStateDirectory as v, writeFailure as w, toLastFailureCode as x, isJSONOutput as y };
+
+//# sourceMappingURL=check-Di68wbxY.js.map
+//# debugId=b6b9e574-1128-56a3-a054-30dd2a567bf6