@iowarp/clio-coder 0.4.5 → 0.4.7

package/dist/chunk-YKRJTYNP.js

@@ -0,0 +1,1143 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  evaluateClioCompatibility,
+  extensionContentDigest,
+  extensionContentDigestWithCapture,
+  isSemanticVersion
+} from "./chunk-XW2UZICE.js";
+import {
+  canonicalizeExistingPath
+} from "./chunk-KQ6IDQIB.js";
+import {
+  require_dist
+} from "./chunk-B5GGDIHT.js";
+import {
+  safeResourceWrite
+} from "./chunk-ZZFWWYLX.js";
+import {
+  clioConfigDir
+} from "./chunk-CTTI7G3T.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/domains/resources/library-types.ts
+init_esm_shims();
+var LIBRARY_KINDS = ["plugin", "skill", "agent", "prompt", "fleet"];
+function isLibraryKind(value) {
+  return typeof value === "string" && LIBRARY_KINDS.includes(value);
+}
+var LIBRARY_RESOURCE_KINDS = ["skill", "agent", "prompt", "fleet"];
+function isLibraryResourceKind(value) {
+  return typeof value === "string" && LIBRARY_RESOURCE_KINDS.includes(value);
+}
+var LIBRARY_PROVIDES_LIMITS = { entries: 256, name: 128, description: 256 };
+
+// src/domains/plugins/discovery.ts
+init_esm_shims();
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readdirSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+
+// src/domains/plugins/integrity.ts
+init_esm_shims();
+
+// src/domains/plugins/discovery.ts
+var PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+var PLUGIN_EXTENSION_KEY = "ai.iowarp.clio";
+var PLUGIN_RESOURCE_KINDS = ["skills", "prompts", "agents", "fleets", "themes"];
+var COMPONENT_KINDS = /* @__PURE__ */ new Set(["prompt", "agent", "skill", "fleet", "script", "resource", "tool"]);
+var ROOT_KEYS = /* @__PURE__ */ new Set([
+  "$schema",
+  "name",
+  "version",
+  "description",
+  "author",
+  "homepage",
+  "repository",
+  "license",
+  "keywords",
+  "extensions"
+]);
+function isPluginId(value) {
+  return value.length <= 64 && /^(?!.*(?:--|\.\.))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/u.test(value) && value !== "state.json";
+}
+function pluginPathContained(root, target) {
+  const relative = path.relative(root, target);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function pluginResourcePath(root, value, allowRoot = false) {
+  if (!value || value.includes("\\") || path.isAbsolute(value))
+    throw new Error(`plugin path must be relative: ${value}`);
+  const lexicalRoot = path.resolve(root);
+  const lexical = path.resolve(lexicalRoot, value);
+  if (!allowRoot && lexical === lexicalRoot || !pluginPathContained(lexicalRoot, lexical))
+    throw new Error(`plugin path escapes root: ${value}`);
+  const canonicalRoot = realpathSync(lexicalRoot);
+  const canonical = realpathSync(lexical);
+  if (!pluginPathContained(canonicalRoot, canonical) || !allowRoot && canonical === canonicalRoot)
+    throw new Error(`plugin path escapes through a symbolic link: ${value}`);
+  return canonical;
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function requireKeys(value, allowed, label) {
+  for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`unknown ${label} key '${key}'`);
+}
+function components(value, root) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value) || value.length > 1024)
+    throw new Error("components must be an array of at most 1024 entries");
+  const refs = /* @__PURE__ */ new Map();
+  for (const raw of value) {
+    if (!record(raw)) throw new Error("component must be an object");
+    requireKeys(raw, /* @__PURE__ */ new Set(["kind", "id", "path", "requires"]), "component");
+    if (typeof raw.kind !== "string" || !COMPONENT_KINDS.has(raw.kind)) throw new Error("unsupported component kind");
+    if (typeof raw.id !== "string" || raw.id.length > 80 || !/^[a-z0-9][a-z0-9._-]*$/u.test(raw.id))
+      throw new Error("component id must be a stable lowercase identifier");
+    if (typeof raw.path !== "string") throw new Error(`component ${raw.id} must have a relative path`);
+    const file = pluginResourcePath(root, raw.path);
+    if (!statSync(file).isFile()) throw new Error(`component ${raw.id} path must be a file`);
+    if (raw.kind === "skill" && path.basename(file) !== "SKILL.md")
+      throw new Error(`skill component ${raw.id} must point to SKILL.md`);
+    if (raw.requires !== void 0 && (!Array.isArray(raw.requires) || raw.requires.some((ref2) => typeof ref2 !== "string")))
+      throw new Error(`component ${raw.id} requires must be an array of component references`);
+    const item = {
+      kind: raw.kind,
+      id: raw.id,
+      path: raw.path,
+      ...raw.requires !== void 0 ? { requires: raw.requires } : {}
+    };
+    const ref = `${item.kind}:${item.id}`;
+    if (refs.has(ref)) throw new Error(`duplicate component reference: ${ref}`);
+    refs.set(ref, item);
+  }
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (ref) => {
+    if (visiting.has(ref)) throw new Error(`component dependency cycle at ${ref}`);
+    if (visited.has(ref)) return;
+    const item = refs.get(ref);
+    if (!item) throw new Error(`missing component reference: ${ref}`);
+    visiting.add(ref);
+    for (const dependency of item.requires ?? []) visit(dependency);
+    visiting.delete(ref);
+    visited.add(ref);
+  };
+  for (const ref of refs.keys()) visit(ref);
+  return [...refs.values()];
+}
+function clioConfiguration(value, root) {
+  if (value !== void 0 && !record(value)) throw new Error(`${PLUGIN_EXTENSION_KEY} must be an object`);
+  const raw = value ?? {};
+  requireKeys(
+    raw,
+    /* @__PURE__ */ new Set(["manifestVersion", "kind", "requires", "evals", "compatibility", "resources", "components"]),
+    PLUGIN_EXTENSION_KEY
+  );
+  if (value !== void 0 && raw.manifestVersion !== 1) throw new Error("Clio plugin manifestVersion must be 1");
+  const kind = raw.kind ?? "plugin";
+  if (!isLibraryKind(kind)) throw new Error("package kind must be plugin, skill, agent, prompt, or fleet");
+  if (raw.requires !== void 0 && (!Array.isArray(raw.requires) || raw.requires.some(
+    (ref) => typeof ref !== "string" || !/^(plugin|skill|agent|prompt|fleet):[a-z0-9][a-z0-9.-]*$/.test(ref)
+  )))
+    throw new Error("package requires must contain kind:name references");
+  const evals = {};
+  if (raw.evals !== void 0) {
+    if (!record(raw.evals)) throw new Error("package evals must map names to Suite v2 files");
+    for (const [id, file] of Object.entries(raw.evals)) {
+      if (!isPluginId(id) || typeof file !== "string" || !statSync(pluginResourcePath(root, file)).isFile())
+        throw new Error(`invalid package eval: ${id}`);
+      evals[id] = file;
+    }
+  }
+  let compatibility;
+  if (raw.compatibility !== void 0) {
+    if (!record(raw.compatibility)) throw new Error("compatibility must be an object");
+    requireKeys(raw.compatibility, /* @__PURE__ */ new Set(["clio"]), "compatibility");
+    if (raw.compatibility.clio !== void 0 && (typeof raw.compatibility.clio !== "string" || !evaluateClioCompatibility(raw.compatibility.clio).rangeValid))
+      throw new Error("compatibility.clio must be a valid SemVer range");
+    compatibility = raw.compatibility;
+  }
+  const resources = {};
+  if (existsSync(path.join(root, "skills"))) resources.skills = "skills";
+  if (raw.resources !== void 0) {
+    if (!record(raw.resources)) throw new Error("resources must be an object");
+    requireKeys(raw.resources, new Set(PLUGIN_RESOURCE_KINDS), "resources");
+    for (const kind2 of PLUGIN_RESOURCE_KINDS) {
+      const resource = raw.resources[kind2];
+      if (resource === void 0) continue;
+      if (typeof resource !== "string") throw new Error(`resources.${kind2} must be a relative directory`);
+      resources[kind2] = resource;
+    }
+  }
+  for (const [resourceKind, relative] of Object.entries(resources)) {
+    const full = pluginResourcePath(root, relative, kind === "skill" && relative === ".");
+    if (!statSync(full).isDirectory()) throw new Error(`resources.${resourceKind} must be a directory`);
+    if (resourceKind === "skills" && relative !== "." && path.resolve(root, relative) !== path.join(path.resolve(root), "skills"))
+      throw new Error("portable skills must use the root skills directory");
+  }
+  const inventory = components(raw.components, root);
+  const componentRoots = {
+    prompt: "prompts",
+    agent: "agents",
+    skill: "skills",
+    fleet: "fleets"
+  };
+  for (const item of inventory) {
+    const resourceKind = componentRoots[item.kind];
+    if (!resourceKind) continue;
+    const resource = resources[resourceKind];
+    if (!resource || !pluginPathContained(
+      pluginResourcePath(root, resource, kind === "skill" && resource === "."),
+      pluginResourcePath(root, item.path)
+    ))
+      throw new Error(`component ${item.kind}:${item.id} is outside its declared resource root`);
+  }
+  if (kind !== "plugin") {
+    const publicItems = inventory.filter((item) => ["prompt", "agent", "skill", "fleet"].includes(item.kind));
+    if (publicItems.length !== 1 || publicItems[0]?.kind !== kind)
+      throw new Error(`a ${kind} package must declare exactly one public ${kind} component`);
+    if (Object.keys(resources).some((resource2) => resource2 !== `${kind}s`))
+      throw new Error(`a ${kind} package may only declare its ${kind}s resource root`);
+    const resource = resources[`${kind}s`];
+    if (!resource) throw new Error(`a ${kind} package must declare its resource root`);
+    const discovered = [];
+    const scan = (directory, ancestors) => {
+      const canonical = realpathSync(directory);
+      if (ancestors.has(canonical)) throw new Error("cyclic package resource directory");
+      const visited = /* @__PURE__ */ new Set([...ancestors, canonical]);
+      for (const item of readdirSync(directory)) {
+        const file = path.join(directory, item);
+        if (statSync(file).isDirectory()) scan(file, visited);
+        else if (kind === "skill" ? item === "SKILL.md" : item.endsWith(".md")) discovered.push(file);
+      }
+    };
+    scan(pluginResourcePath(root, resource, kind === "skill" && resource === "."), /* @__PURE__ */ new Set());
+    const declared = publicItems[0];
+    if (discovered.length !== 1 || !declared || path.resolve(discovered[0]) !== pluginResourcePath(root, declared.path))
+      throw new Error(`a ${kind} package must expose only its declared ${kind} file`);
+  }
+  return {
+    manifestVersion: 1,
+    kind,
+    resources,
+    components: inventory,
+    ...raw.requires ? { requires: raw.requires } : {},
+    ...raw.evals ? { evals } : {},
+    ...compatibility ? { compatibility } : {}
+  };
+}
+function parsePluginManifest(raw, root) {
+  const value = JSON.parse(raw);
+  if (!record(value)) throw new Error("plugin manifest must be an object");
+  requireKeys(value, ROOT_KEYS, "plugin manifest");
+  if (value.$schema !== PLUGIN_SCHEMA) throw new Error(`plugin $schema must be ${PLUGIN_SCHEMA}`);
+  if (typeof value.name !== "string" || !isPluginId(value.name))
+    throw new Error("plugin name must be a portable identifier of 1 to 64 characters and may not be state.json");
+  for (const field of ["version", "description", "homepage", "repository", "license"]) {
+    if (value[field] !== void 0 && typeof value[field] !== "string") throw new Error(`${field} must be a string`);
+  }
+  if (!isSemanticVersion(value.version))
+    throw new Error("package version must be an explicit Semantic Version (for example 1.0.0)");
+  if (value.author !== void 0) {
+    if (!record(value.author)) throw new Error("author must be an object");
+    requireKeys(value.author, /* @__PURE__ */ new Set(["name", "email", "url"]), "author");
+    if (Object.values(value.author).some((field) => typeof field !== "string"))
+      throw new Error("author fields must be strings");
+  }
+  if (value.keywords !== void 0 && (!Array.isArray(value.keywords) || value.keywords.some((field) => typeof field !== "string")))
+    throw new Error("keywords must be an array of strings");
+  if (value.extensions !== void 0 && (!record(value.extensions) || Object.values(value.extensions).some((field) => !record(field))))
+    throw new Error("extensions must contain namespaced objects");
+  const extensions = value.extensions;
+  const clio = clioConfiguration(extensions?.[PLUGIN_EXTENSION_KEY], root);
+  return { ...value, clio };
+}
+function readPluginManifest(root) {
+  const resolved = path.resolve(root);
+  const manifestPath = path.join(resolved, "plugin.json");
+  const diagnostics = [];
+  try {
+    if (existsSync(path.join(resolved, "state.json")))
+      throw new Error("root state.json is reserved for plugin installation state");
+    const digest = extensionContentDigestWithCapture(resolved, { capture: ["plugin.json"] });
+    const bytes = digest.captured.get("plugin.json");
+    if (!bytes) throw new Error("plugin.json must be a regular file at the plugin root");
+    const manifest = parsePluginManifest(bytes.toString("utf8"), resolved);
+    if (existsSync(path.join(resolved, "mcp.json")))
+      diagnostics.push({
+        type: "warning",
+        message: "MCP declarations are preserved; this Clio version does not execute MCP servers",
+        path: path.join(resolved, "mcp.json")
+      });
+    return {
+      path: resolved,
+      manifestPath,
+      manifest,
+      valid: true,
+      diagnostics,
+      contentDigest: digest.digest,
+      manifestDigest: createHash("sha256").update(bytes).digest("hex")
+    };
+  } catch (error) {
+    diagnostics.push({
+      type: "error",
+      message: error instanceof Error ? error.message : String(error),
+      path: manifestPath
+    });
+    return { path: resolved, manifestPath, valid: false, diagnostics };
+  }
+}
+function discoverPluginPackages(root) {
+  if (existsSync(path.join(root, "plugin.json"))) return [readPluginManifest(root)];
+  try {
+    return readdirSync(root).sort().filter((name) => !name.startsWith(".") && lstatSync(path.join(root, name)).isDirectory()).map((name) => readPluginManifest(path.join(root, name)));
+  } catch {
+    return [readPluginManifest(root)];
+  }
+}
+
+// src/domains/plugins/state.ts
+init_esm_shims();
+import { randomBytes } from "node:crypto";
+import {
+  closeSync,
+  cpSync,
+  existsSync as existsSync2,
+  lstatSync as lstatSync2,
+  mkdirSync,
+  openSync,
+  readdirSync as readdirSync2,
+  readFileSync,
+  realpathSync as realpathSync2,
+  renameSync,
+  rmSync
+} from "node:fs";
+import path2 from "node:path";
+
+// src/domains/plugins/types.ts
+init_esm_shims();
+function isForeignPluginOrigin(origin) {
+  return typeof origin === "object" && (origin.kind === "interop" || origin.kind === "import");
+}
+
+// src/domains/plugins/state.ts
+function installLibraryPackage(input) {
+  const { kind, sourcePath, ...options } = input;
+  return installPlugin(sourcePath, { ...options, expectedKind: kind });
+}
+function pluginBaseDir(scope, cwd = process.cwd()) {
+  return scope === "user" ? path2.join(clioConfigDir(), "plugins") : path2.join(path2.resolve(cwd), ".clio-coder", "plugins");
+}
+function pluginStatePath(scope, cwd = process.cwd()) {
+  return path2.join(pluginBaseDir(scope, cwd), "state.json");
+}
+function record2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function plainFile(file) {
+  const stat = lstatSync2(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
+    throw new Error(`plugin state must be a regular unlinked file: ${file}`);
+}
+function stateBytes(file) {
+  if (!existsSync2(file)) return void 0;
+  plainFile(file);
+  return readFileSync(file, "utf8");
+}
+function readState(scope, cwd) {
+  const bytes = stateBytes(pluginStatePath(scope, cwd));
+  if (bytes === void 0) return { state: { version: 1, disabled: [], installed: {} } };
+  const raw = JSON.parse(bytes);
+  if (!record2(raw) || raw.version !== 1 || !Array.isArray(raw.disabled) || !raw.disabled.every((id) => typeof id === "string" && isPluginId(id)) || !record2(raw.installed))
+    throw new Error("plugin install state is malformed");
+  for (const [id, entry] of Object.entries(raw.installed)) {
+    if (!isPluginId(id) || !record2(entry) || typeof entry.installedAt !== "string" || typeof entry.source !== "string" || typeof entry.contentDigest !== "string" || !/^[a-f0-9]{64}$/u.test(entry.contentDigest))
+      throw new Error(`invalid plugin install record: ${id}`);
+    if (entry.origin !== void 0 && typeof entry.origin !== "string" && !validOrigin(entry.origin))
+      throw new Error(`invalid plugin origin: ${id}`);
+    if (entry.kind !== void 0 && !isLibraryKind(entry.kind)) throw new Error(`invalid package kind: ${id}`);
+    if (entry.trust !== void 0 && entry.trust !== "trusted" && entry.trust !== "foreign")
+      throw new Error(`invalid package trust: ${id}`);
+  }
+  return { state: raw, bytes };
+}
+var FOREIGN_FORMATS = /* @__PURE__ */ new Set(["portable", "claude-code", "codex"]);
+function validOrigin(origin) {
+  if (!record2(origin) || typeof origin.source !== "string") return false;
+  const optional = (origin.marketplace === void 0 || typeof origin.marketplace === "string") && (origin.host === void 0 || typeof origin.host === "string");
+  switch (origin.kind) {
+    case "local":
+    case "catalog":
+    case "github":
+      return true;
+    case "interop":
+      return typeof origin.host === "string" && path2.isAbsolute(origin.source) && optional && (origin.format === void 0 || FOREIGN_FORMATS.has(String(origin.format)));
+    case "import":
+      return FOREIGN_FORMATS.has(String(origin.format)) && optional && (origin.transport === "local" && path2.isAbsolute(origin.source) || origin.transport === "github" && /^https:\/\/github\.com\//u.test(origin.source));
+    default:
+      return false;
+  }
+}
+function assertUnchangedState(file, expected) {
+  if (stateBytes(file) !== expected)
+    throw new Error("plugin install state changed during the operation; retry after reviewing concurrent edits");
+}
+function writeState(scope, cwd, state, expected) {
+  const file = pluginStatePath(scope, cwd);
+  assertUnchangedState(file, expected);
+  safeResourceWrite(file, `${JSON.stringify(state, null, 2)}
+`, {
+    mode: 384,
+    beforeRename: () => assertUnchangedState(file, expected)
+  });
+}
+function assertManagedBase(scope, cwd) {
+  const boundary = scope === "user" ? path2.resolve(clioConfigDir()) : path2.resolve(cwd);
+  const base = pluginBaseDir(scope, cwd);
+  let cursor = boundary;
+  for (const part of path2.relative(boundary, base).split(path2.sep)) {
+    cursor = path2.join(cursor, part);
+    try {
+      const stat = lstatSync2(cursor);
+      if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw new Error(`plugin managed path must be a directory without symbolic links: ${cursor}`);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+}
+var PluginWriterRefusal = class extends Error {
+  constructor(code, message, changed) {
+    super(message);
+    this.code = code;
+    this.changed = changed;
+    this.name = "PluginWriterRefusal";
+  }
+  code;
+  changed;
+};
+function acquireScopeLock(scope, cwd) {
+  assertManagedBase(scope, cwd);
+  mkdirSync(pluginBaseDir(scope, cwd), { recursive: true });
+  const lock = path2.join(pluginBaseDir(scope, cwd), ".mutation.lock");
+  let fd;
+  try {
+    fd = openSync(lock, "wx", 384);
+  } catch (error) {
+    if (error.code === "EEXIST")
+      throw new PluginWriterRefusal("locked", "another plugin operation holds the installation lock");
+    throw error;
+  }
+  return () => {
+    closeSync(fd);
+    rmSync(lock, { force: true });
+  };
+}
+function withPluginScopeLock(scope, cwd, fn) {
+  const release = acquireScopeLock(scope, cwd);
+  try {
+    return fn();
+  } finally {
+    release();
+  }
+}
+function withMutation(scope, cwd, work) {
+  try {
+    return withPluginScopeLock(scope, cwd, work);
+  } catch (error) {
+    return {
+      diagnostics: [
+        {
+          type: "error",
+          message: error instanceof Error ? error.message : String(error),
+          ...error instanceof PluginWriterRefusal ? { code: error.code } : {},
+          ...error instanceof PluginWriterRefusal && error.changed ? { changed: error.changed } : {}
+        }
+      ]
+    };
+  }
+}
+function observePluginCopy(scope, id, cwd) {
+  const saved = readState(scope, cwd).state.installed[id];
+  const target = path2.join(pluginBaseDir(scope, cwd), id);
+  let tree = "absent";
+  if (existsSync2(target)) {
+    try {
+      tree = extensionContentDigest(target);
+    } catch {
+      tree = "unreadable";
+    }
+  }
+  return {
+    scope,
+    id,
+    recorded: saved !== void 0,
+    tree,
+    enabled: !readState(scope, cwd).state.disabled.includes(id),
+    ...saved ? { recordedDigest: saved.contentDigest } : {},
+    ...saved?.kind ? { kind: saved.kind } : {},
+    ...saved?.trust ? { trust: saved.trust } : {},
+    ...saved?.origin !== void 0 ? { origin: saved.origin } : {}
+  };
+}
+function assertExpectedState(expect, cwd) {
+  for (const expected of expect?.copies ?? []) {
+    let observed;
+    try {
+      observed = observePluginCopy(expected.scope, expected.id, cwd);
+    } catch (error) {
+      throw new PluginWriterRefusal(
+        "stale_plan",
+        `reviewed state for ${expected.scope}:${expected.id} is no longer readable: ${error instanceof Error ? error.message : String(error)}; review a fresh plan`
+      );
+    }
+    const facts = new Set(
+      expected.partial ? Object.keys(expected) : [...Object.keys(expected), ...Object.keys(observed)]
+    );
+    for (const fact of facts) {
+      if (fact === "scope" || fact === "id" || fact === "partial") continue;
+      const want = JSON.stringify(expected[fact] ?? null);
+      const have = JSON.stringify(observed[fact] ?? null);
+      if (want !== have)
+        throw new PluginWriterRefusal(
+          "stale_plan",
+          `reviewed ${fact} changed for ${expected.scope}:${expected.id} (expected ${want}, observed ${have}); review a fresh plan`,
+          { scope: expected.scope, id: expected.id, fact, expected: expected[fact], observed: observed[fact] }
+        );
+    }
+  }
+}
+function resolvePluginPrecedence(entries) {
+  for (const entry of entries) {
+    const winner = entries.filter((peer) => peer.id === entry.id && peer.valid && peer.compatible).sort((a, b) => Number(a.scope === "project") - Number(b.scope === "project")).at(-1);
+    entry.effective = entry === winner;
+    entry.loadable = entry.valid && entry.compatible && entry.enabled && entry.effective;
+    delete entry.overriddenBy;
+    if (winner && winner !== entry) entry.overriddenBy = winner.scope;
+  }
+}
+function unmetRequirementsOf(entry, entries) {
+  return (entry.manifest?.clio.requires ?? []).filter(
+    (requirement) => !entries.some((peer) => peer.loadable && `${peer.kind ?? "plugin"}:${peer.id}` === requirement)
+  );
+}
+function newlyBrokenDependents(entries, mutation) {
+  const before = entries.map((entry) => ({ ...entry }));
+  resolvePluginPrecedence(before);
+  const after = before.filter((entry) => !(mutation.operation === "remove" && entry.id === mutation.id && entry.scope === mutation.scope)).map((entry) => ({
+    ...entry,
+    enabled: mutation.operation === "disable" && entry.id === mutation.id && entry.scope === mutation.scope ? false : entry.enabled
+  }));
+  resolvePluginPrecedence(after);
+  const newlyBroken = [];
+  const preexisting = [];
+  for (const entry of before) {
+    if (entry.id === mutation.id && entry.scope === mutation.scope) continue;
+    const later = after.find((peer) => peer.id === entry.id && peer.scope === entry.scope);
+    if (!later?.loadable) continue;
+    const missingBefore = entry.loadable ? unmetRequirementsOf(entry, before) : [];
+    const missingAfter = unmetRequirementsOf(later, after);
+    const ref = `${entry.kind ?? "plugin"}:${entry.id}`;
+    const fresh = missingAfter.filter((requirement) => !missingBefore.includes(requirement));
+    if (fresh.length) newlyBroken.push({ ref, scope: entry.scope, missing: fresh });
+    else if (missingAfter.length) preexisting.push({ ref, scope: entry.scope, missing: missingAfter });
+  }
+  const effectiveAfter = after.find((entry) => entry.id === mutation.id && entry.effective);
+  return { newlyBroken, preexisting, ...effectiveAfter ? { effectiveAfter } : {} };
+}
+function refuseBrokenDependents(cwd, mutation) {
+  const { newlyBroken } = newlyBrokenDependents(listInstalledPlugins(cwd, { all: true }), mutation);
+  if (newlyBroken.length)
+    throw new PluginWriterRefusal(
+      "dependents",
+      `${mutation.operation} of ${mutation.scope}:${mutation.id} would break ${newlyBroken.map((item) => `${item.scope}:${item.ref} (missing ${item.missing.join(", ")})`).join("; ")}; disable or remove those dependents first`
+    );
+}
+function scopeEntries(scope, cwd) {
+  const base = pluginBaseDir(scope, cwd);
+  if (!existsSync2(base)) return [];
+  let names;
+  try {
+    assertManagedBase(scope, cwd);
+    names = readdirSync2(base).sort().filter(isPluginId);
+  } catch (error) {
+    return [
+      {
+        id: `invalid-${scope}-plugin-root`,
+        name: "Plugin installation directory",
+        version: "0.0.0",
+        description: "",
+        scope,
+        rootPath: base,
+        manifestPath: pluginStatePath(scope, cwd),
+        enabled: false,
+        valid: false,
+        compatible: true,
+        effective: false,
+        loadable: false,
+        resources: {},
+        diagnostics: [
+          {
+            type: "error",
+            message: `plugin directory cannot be read: ${error instanceof Error ? error.message : String(error)}`,
+            path: base
+          }
+        ]
+      }
+    ];
+  }
+  let state = { version: 1, disabled: [], installed: {} };
+  let stateError;
+  try {
+    assertManagedBase(scope, cwd);
+    state = readState(scope, cwd).state;
+  } catch (error) {
+    stateError = error instanceof Error ? error.message : String(error);
+  }
+  const entries = [];
+  for (const id of names) {
+    const rootPath = path2.join(base, id);
+    const candidate = readPluginManifest(rootPath);
+    const manifest = candidate.manifest;
+    const diagnostics = [...candidate.diagnostics];
+    const saved = state.installed[id];
+    if (manifest && manifest.name !== id)
+      diagnostics.push({
+        type: "error",
+        message: `installed directory ${id} does not match plugin identity ${manifest.name}`,
+        path: rootPath
+      });
+    if (stateError)
+      diagnostics.push({
+        type: "error",
+        message: `plugin install state cannot be read: ${stateError}`,
+        path: pluginStatePath(scope, cwd)
+      });
+    else if (!saved)
+      diagnostics.push({
+        type: "error",
+        message: "plugin is not recorded in install state; install it through plugins install",
+        path: rootPath
+      });
+    else if (candidate.contentDigest !== saved.contentDigest)
+      diagnostics.push({
+        type: "error",
+        message: `installed plugin content drift detected (expected ${saved.contentDigest}, observed ${candidate.contentDigest ?? "unreadable"})`,
+        path: rootPath
+      });
+    const range = manifest?.clio.compatibility?.clio;
+    const compatible = range === void 0 || evaluateClioCompatibility(range).satisfied;
+    if (!compatible)
+      diagnostics.push({
+        type: "error",
+        message: `plugin requires Clio ${range}`,
+        path: candidate.manifestPath ?? rootPath
+      });
+    const valid = candidate.valid && !stateError && !!saved && candidate.contentDigest === saved.contentDigest && manifest?.name === id;
+    entries.push({
+      id,
+      kind: saved?.kind ?? manifest?.clio.kind ?? "plugin",
+      trust: saved?.trust ?? (isForeignPluginOrigin(saved?.origin) ? "foreign" : "trusted"),
+      name: manifest?.name ?? id,
+      version: manifest?.version ?? "0.0.0",
+      description: manifest?.description ?? "",
+      scope,
+      rootPath,
+      manifestPath: candidate.manifestPath ?? path2.join(rootPath, "plugin.json"),
+      enabled: !state.disabled.includes(id),
+      valid,
+      compatible,
+      effective: false,
+      loadable: false,
+      resources: manifest?.clio.resources ?? {},
+      ...manifest ? { manifest } : {},
+      diagnostics,
+      ...candidate.contentDigest ? { observedContentDigest: candidate.contentDigest } : {},
+      ...valid && candidate.manifestDigest && saved ? {
+        provenance: {
+          id,
+          scope,
+          sourcePath: saved.source,
+          canonicalRoot: realpathSync2(rootPath),
+          manifestDigest: candidate.manifestDigest,
+          contentDigest: saved.contentDigest
+        }
+      } : {}
+    });
+  }
+  return entries;
+}
+function listInstalledPlugins(cwd = process.cwd(), options = {}) {
+  const scopes = options.scope ? [options.scope] : ["user", "project"];
+  const entries = scopes.flatMap((scope) => scopeEntries(scope, cwd));
+  resolvePluginPrecedence(entries);
+  return entries.filter((entry) => options.all || entry.effective || !entry.valid || !entry.compatible).sort((a, b) => a.id.localeCompare(b.id) || a.scope.localeCompare(b.scope));
+}
+function readPluginInstallRecord(id, options = {}) {
+  if (!isPluginId(id)) return void 0;
+  const cwd = options.cwd ?? process.cwd();
+  if (options.scope) return readState(options.scope, cwd).state.installed[id];
+  return readState("project", cwd).state.installed[id] ?? readState("user", cwd).state.installed[id];
+}
+function selectedScope(id, options) {
+  if (options.scope) return options.scope;
+  return existsSync2(path2.join(pluginBaseDir("project", options.cwd), id)) ? "project" : "user";
+}
+function uniqueSibling(target, purpose) {
+  return path2.join(
+    path2.dirname(target),
+    `.${path2.basename(target)}.${purpose}-${process.pid}-${randomBytes(8).toString("hex")}`
+  );
+}
+function retainRecovery(backup, expectedDigest) {
+  try {
+    if (!expectedDigest || extensionContentDigest(backup) !== expectedDigest) return true;
+    rmSync(backup, { recursive: true, force: true });
+    return false;
+  } catch {
+    return true;
+  }
+}
+function installPlugin(sourcePath, options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const scope = options.scope ?? "user";
+  const source = path2.resolve(cwd, sourcePath);
+  const candidate = readPluginManifest(source);
+  if (!candidate.valid || !candidate.manifest || !candidate.contentDigest) return { diagnostics: candidate.diagnostics };
+  const manifest = candidate.manifest;
+  const digest = candidate.contentDigest;
+  const range = manifest.clio.compatibility?.clio;
+  if (range && !evaluateClioCompatibility(range).satisfied)
+    return { diagnostics: [{ type: "error", message: `plugin requires Clio ${range}` }] };
+  if (options.expectedKind !== void 0 && options.expectedKind !== (manifest.clio.kind ?? "plugin") || options.expectedDigest !== void 0 && options.expectedDigest !== digest || options.expectedId !== void 0 && options.expectedId !== manifest.name || options.expectedVersion !== void 0 && options.expectedVersion !== manifest.version)
+    return {
+      diagnostics: [{ type: "error", message: "plugin source does not match the pinned digest, identity, or version" }]
+    };
+  const target = path2.join(pluginBaseDir(scope, cwd), manifest.name);
+  const resolvedBase = pluginBaseDir(scope, cwd);
+  if (pluginPathContained(canonicalizeExistingPath(source), canonicalizeExistingPath(resolvedBase)) || pluginPathContained(canonicalizeExistingPath(target), canonicalizeExistingPath(source)))
+    return { diagnostics: [{ type: "error", message: "plugin source overlaps its managed installation destination" }] };
+  return withMutation(scope, cwd, () => {
+    const { state, bytes } = readState(scope, cwd);
+    assertExpectedState(options.expect, cwd);
+    const previouslyInstalled = Object.hasOwn(state.installed, manifest.name);
+    const previousDigest = state.installed[manifest.name]?.contentDigest;
+    const previousOrigin = state.installed[manifest.name]?.origin;
+    if (isForeignPluginOrigin(previousOrigin))
+      throw new Error("interop packages require a new reviewed adoption; remove the installed copy and adopt it again");
+    const previousKind = state.installed[manifest.name]?.kind ?? readPluginManifest(target).manifest?.clio.kind;
+    if (previousKind && previousKind !== (manifest.clio.kind ?? "plugin"))
+      throw new Error("package kind cannot change during replacement; remove it explicitly first");
+    if (existsSync2(target) && !options.force)
+      throw new Error(`plugin ${manifest.name} is already installed; use --force to replace it`);
+    if (existsSync2(target) && lstatSync2(target).isSymbolicLink())
+      throw new Error("installed plugin root must not be a symbolic link");
+    const staging = uniqueSibling(target, "install");
+    const backup = uniqueSibling(target, "backup");
+    let moved = false;
+    let published = false;
+    let preserveBackup = false;
+    if (existsSync2(target)) {
+      try {
+        preserveBackup = extensionContentDigest(target) !== state.installed[manifest.name]?.contentDigest;
+      } catch {
+        preserveBackup = true;
+      }
+    }
+    try {
+      cpSync(source, staging, { recursive: true, verbatimSymlinks: true, errorOnExist: true, force: false });
+      const staged = readPluginManifest(staging);
+      if (!staged.valid || staged.manifest?.name !== manifest.name || staged.contentDigest !== digest)
+        throw new Error("staged plugin differs from the verified source tree");
+      if (extensionContentDigest(source) !== digest) throw new Error("plugin source changed while staging");
+      assertUnchangedState(pluginStatePath(scope, cwd), bytes);
+      if (existsSync2(target)) {
+        renameSync(target, backup);
+        moved = true;
+      }
+      renameSync(staging, target);
+      published = true;
+      if (extensionContentDigest(target) !== digest) throw new Error("plugin changed during publication");
+      const origin = options.origin ?? { kind: "local", source };
+      const trust = isForeignPluginOrigin(origin) ? "foreign" : options.trust ?? state.installed[manifest.name]?.trust ?? "trusted";
+      state.installed[manifest.name] = {
+        kind: manifest.clio.kind ?? "plugin",
+        installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: typeof origin === "string" ? origin : origin.source,
+        origin,
+        contentDigest: digest,
+        trust
+      };
+      if (!previouslyInstalled) state.disabled = state.disabled.filter((id) => id !== manifest.name);
+      writeState(scope, cwd, state, bytes);
+    } catch (error) {
+      rmSync(staging, { recursive: true, force: true });
+      if (published && existsSync2(target)) {
+        let unchanged = false;
+        try {
+          unchanged = extensionContentDigest(target) === digest;
+        } catch {
+        }
+        if (!unchanged)
+          return {
+            recovery: { ...moved ? { packageBackup: backup } : {} },
+            diagnostics: [
+              {
+                type: "error",
+                message: `plugin installation failed and changed content was preserved: ${String(error)}`,
+                path: target
+              }
+            ]
+          };
+        rmSync(target, { recursive: true, force: true });
+      }
+      if (moved) renameSync(backup, target);
+      throw error;
+    }
+    if (moved && !preserveBackup) preserveBackup = retainRecovery(backup, previousDigest);
+    const plugin = listInstalledPlugins(cwd, { scope, all: true }).find((entry) => entry.id === manifest.name);
+    return {
+      ...plugin ? { plugin } : {},
+      ...moved && preserveBackup ? { recovery: { packageBackup: backup } } : {},
+      diagnostics: plugin?.diagnostics ?? []
+    };
+  });
+}
+function updatePlugin(id, options = {}) {
+  if (!isPluginId(id)) return { diagnostics: [{ type: "error", message: "invalid plugin id" }] };
+  try {
+    const scope = selectedScope(id, options);
+    const installed = readPluginInstallRecord(id, { ...options, scope });
+    if (!installed) throw new Error(`plugin ${id} is not installed`);
+    if (isForeignPluginOrigin(installed.origin))
+      throw new Error("interop packages require a new reviewed adoption; remove the installed copy and adopt it again");
+    const current = listInstalledPlugins(options.cwd ?? process.cwd(), { scope, all: true }).find(
+      (entry) => entry.id === id
+    );
+    if (!options.force && !current?.valid)
+      throw new Error(
+        `plugin ${id} has changed or unverifiable content; use --force to preserve a recovery copy and replace it`
+      );
+    if (/^[a-z][a-z0-9+.-]*:\/\//iu.test(installed.source))
+      throw new Error("remote plugin updates must resolve a verified library catalog source");
+    return installPlugin(installed.source, {
+      ...options,
+      scope,
+      force: true,
+      expectedId: id,
+      origin: installed.origin ?? installed.source
+    });
+  } catch (error) {
+    return { diagnostics: [{ type: "error", message: error instanceof Error ? error.message : String(error) }] };
+  }
+}
+function setEnabled(id, enabled, options) {
+  if (!isPluginId(id)) return { diagnostics: [{ type: "error", message: "invalid plugin id" }] };
+  const cwd = options.cwd ?? process.cwd();
+  const scope = selectedScope(id, options);
+  return withMutation(scope, cwd, () => {
+    const { state, bytes } = readState(scope, cwd);
+    assertExpectedState(options.expect, cwd);
+    const plugin = listInstalledPlugins(cwd, { scope, all: true }).find((entry) => entry.id === id);
+    if (!plugin) throw new Error(`plugin ${id} is not installed`);
+    if (enabled && (!plugin.valid || !plugin.compatible))
+      throw new Error(`plugin ${id} cannot be enabled: ${plugin.diagnostics.map((entry) => entry.message).join("; ")}`);
+    if (!enabled && plugin.enabled) refuseBrokenDependents(cwd, { scope, id, operation: "disable" });
+    state.disabled = state.disabled.filter((value) => value !== id);
+    if (!enabled) state.disabled.push(id);
+    writeState(scope, cwd, state, bytes);
+    const updated = listInstalledPlugins(cwd, { scope, all: true }).find((entry) => entry.id === id);
+    return { ...updated ? { plugin: updated } : {}, diagnostics: [] };
+  });
+}
+function enablePlugin(id, options = {}) {
+  return setEnabled(id, true, options);
+}
+function disablePlugin(id, options = {}) {
+  return setEnabled(id, false, options);
+}
+function removePlugin(id, options = {}) {
+  if (!isPluginId(id)) return { diagnostics: [{ type: "error", message: "invalid plugin id" }] };
+  const cwd = options.cwd ?? process.cwd();
+  const scope = selectedScope(id, options);
+  return withMutation(scope, cwd, () => {
+    const { state, bytes } = readState(scope, cwd);
+    assertExpectedState(options.expect, cwd);
+    const target = path2.join(pluginBaseDir(scope, cwd), id);
+    const previousDigest = state.installed[id]?.contentDigest;
+    if (!existsSync2(target) && !state.installed[id]) throw new Error(`plugin ${id} is not installed`);
+    refuseBrokenDependents(cwd, { scope, id, operation: "remove" });
+    const backup = uniqueSibling(target, "removed");
+    const moved = existsSync2(target);
+    let preserve = false;
+    if (moved) {
+      try {
+        preserve = extensionContentDigest(target) !== state.installed[id]?.contentDigest;
+      } catch {
+        preserve = true;
+      }
+      renameSync(target, backup);
+    }
+    try {
+      delete state.installed[id];
+      state.disabled = state.disabled.filter((value) => value !== id);
+      writeState(scope, cwd, state, bytes);
+    } catch (error) {
+      if (moved) renameSync(backup, target);
+      throw error;
+    }
+    if (moved && !preserve) preserve = retainRecovery(backup, previousDigest);
+    return {
+      removed: { id, scope, path: target },
+      ...preserve ? { recovery: { packageBackup: backup } } : {},
+      diagnostics: preserve ? [
+        {
+          type: "warning",
+          message: "removed plugin contained changed or unverified files; preserved recovery copy",
+          path: backup
+        }
+      ] : []
+    };
+  });
+}
+
+// src/domains/plugins/resources.ts
+init_esm_shims();
+import { createHash as createHash2 } from "node:crypto";
+import { realpathSync as realpathSync3 } from "node:fs";
+import path3 from "node:path";
+var snapshots = /* @__PURE__ */ new Map();
+var generation = 0;
+function keyFor(cwd) {
+  return `${path3.resolve(clioConfigDir())}\0${realpathSync3(path3.resolve(cwd))}`;
+}
+function freeze(value) {
+  if (value !== null && typeof value === "object" && !Object.isFrozen(value)) {
+    for (const child of Object.values(value)) freeze(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+function buildPluginSnapshot(cwd = process.cwd(), snapshotGeneration = 0) {
+  const canonicalCwd = realpathSync3(path3.resolve(cwd));
+  const packages = listInstalledPlugins(canonicalCwd, { all: true });
+  const resourceRoots = {
+    skills: [],
+    prompts: [],
+    agents: [],
+    fleets: [],
+    themes: []
+  };
+  for (const item of packages) {
+    if (!item.loadable || !item.provenance) continue;
+    for (const kind of PLUGIN_RESOURCE_KINDS) {
+      const relative = item.resources[kind];
+      if (!relative) continue;
+      resourceRoots[kind].push({
+        id: item.id,
+        scope: item.scope,
+        path: pluginResourcePath(item.rootPath, relative, item.kind === "skill" && relative === "."),
+        rootPath: item.rootPath,
+        source: `plugin:${item.scope}:${item.id}`,
+        provenance: item.provenance,
+        generation: snapshotGeneration,
+        trust: item.trust ?? "trusted"
+      });
+    }
+  }
+  const identity = packages.map((item) => ({
+    id: item.id,
+    scope: item.scope,
+    rootPath: item.rootPath,
+    enabled: item.enabled,
+    loadable: item.loadable,
+    contentDigest: item.observedContentDigest
+  }));
+  return freeze({
+    version: 1,
+    generation: snapshotGeneration,
+    cwd: canonicalCwd,
+    digest: createHash2("sha256").update(JSON.stringify(identity)).digest("hex"),
+    packages,
+    resourceRoots
+  });
+}
+function pluginSnapshotFor(cwd = process.cwd()) {
+  return snapshots.get(keyFor(cwd)) ?? buildPluginSnapshot(cwd);
+}
+function reloadPluginResources(cwd = process.cwd()) {
+  const key = keyFor(cwd);
+  const next = buildPluginSnapshot(cwd, ++generation);
+  snapshots.set(key, next);
+  return next;
+}
+function clearPluginSnapshots() {
+  snapshots.clear();
+}
+function enabledPluginResourceRoots(kind, cwd = process.cwd()) {
+  const snapshot = pluginSnapshotFor(cwd);
+  if (snapshot.generation === 0) return [...snapshot.resourceRoots[kind]];
+  const current = listInstalledPlugins(cwd, { all: true });
+  return snapshot.resourceRoots[kind].filter(
+    (root) => current.some(
+      (item) => item.loadable && item.id === root.id && item.scope === root.scope && item.provenance?.canonicalRoot === root.provenance.canonicalRoot && item.provenance?.manifestDigest === root.provenance.manifestDigest && item.provenance?.contentDigest === root.provenance.contentDigest
+    )
+  );
+}
+
+// src/domains/plugins/index.ts
+init_esm_shims();
+
+// src/domains/plugins/extension.ts
+init_esm_shims();
+function createPluginsBundle(_context) {
+  return {
+    extension: {
+      start() {
+      },
+      stop() {
+        clearPluginSnapshots();
+      }
+    },
+    contract: {
+      list: listInstalledPlugins,
+      discover: discoverPluginPackages,
+      install: installPlugin,
+      update: updatePlugin,
+      enable: enablePlugin,
+      disable: disablePlugin,
+      remove: removePlugin,
+      resourceRoots: enabledPluginResourceRoots,
+      snapshot: pluginSnapshotFor,
+      reload: reloadPluginResources
+    }
+  };
+}
+
+// src/domains/plugins/manifest.ts
+init_esm_shims();
+var PluginsManifest = { name: "plugins", dependsOn: ["config"] };
+
+// src/domains/plugins/index.ts
+var PluginsDomainModule = {
+  manifest: PluginsManifest,
+  createExtension: createPluginsBundle
+};
+
+// src/domains/resources/package-references.ts
+init_esm_shims();
+import { realpathSync as realpathSync4 } from "node:fs";
+import path4 from "node:path";
+var REFERENCE_PATTERN = /\$\{(pluginRoot|component:([^}]+))\}(\/[A-Za-z0-9._~%+@/-]*)?/g;
+var COMPLETE_REFERENCE = /^\$\{(pluginRoot|component:([^}]+))\}(\/[\s\S]*)?$/u;
+function referenceResolver(context) {
+  const root = realpathSync4(context.rootPath);
+  let components2;
+  return (reference, _token, ref, suffix) => {
+    if (suffix && /[\\\0\r\n]/u.test(suffix)) throw new Error(`unsupported package path syntax: ${reference}`);
+    let relative = "";
+    if (ref !== void 0) {
+      if (!components2) {
+        const candidate = readPluginManifest(root);
+        if (!candidate.valid || !candidate.manifest) throw new Error("plugin manifest unavailable for component reference");
+        components2 = new Map(
+          candidate.manifest.clio.components.map((component) => [`${component.kind}:${component.id}`, component.path])
+        );
+      }
+      const componentPath = components2.get(ref);
+      if (componentPath === void 0) throw new Error(`unresolved component reference: ${ref}`);
+      relative = componentPath;
+    }
+    const target = path4.resolve(root, relative + (suffix ?? ""));
+    const contained = (value) => {
+      const rel = path4.relative(root, value);
+      return rel !== ".." && !rel.startsWith(`..${path4.sep}`) && !path4.isAbsolute(rel);
+    };
+    try {
+      const resolved = ref === void 0 ? path4.resolve(root, `.${suffix ?? ""}`) : target;
+      if (!contained(resolved) || !contained(realpathSync4(resolved))) throw new Error("outside package");
+      return resolved;
+    } catch {
+      throw new Error(`unresolved or escaping package reference: ${reference}`);
+    }
+  };
+}
+function resolvePackageReferences(body, context) {
+  if (!context.rootPath || !context.plugin || !body.includes("${")) return body;
+  return body.replace(REFERENCE_PATTERN, referenceResolver({ ...context, rootPath: context.rootPath }));
+}
+function resolvePackagePathReference(value, context) {
+  if (!context.rootPath || !context.plugin || !/\$\{(?:pluginRoot|component:)/u.test(value)) return value;
+  const match = COMPLETE_REFERENCE.exec(value);
+  if (!match || match[3]?.includes("${"))
+    throw new Error("package path references must occupy one complete argument with no embedded expressions");
+  return referenceResolver({ ...context, rootPath: context.rootPath })(value, match[1] ?? "", match[2], match[3]);
+}
+
+// src/domains/agents/frontmatter.ts
+init_esm_shims();
+var import_yaml = __toESM(require_dist(), 1);
+function parseFrontmatter(raw, sourcePath) {
+  const opening = raw.match(/^---\r?\n/);
+  if (!opening) {
+    throw new Error(`frontmatter: ${sourcePath}: missing YAML frontmatter opening delimiter`);
+  }
+  const closeRegex = /\r?\n---(?:\r?\n|$)/g;
+  closeRegex.lastIndex = opening[0].length;
+  const closing = closeRegex.exec(raw);
+  if (!closing) {
+    throw new Error(`frontmatter: ${sourcePath}: missing YAML frontmatter closing delimiter`);
+  }
+  const frontmatterText = raw.slice(opening[0].length, closing.index);
+  const body = raw.slice(closing.index + closing[0].length);
+  let parsed;
+  try {
+    parsed = import_yaml.default.parse(frontmatterText);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`frontmatter: ${sourcePath}: invalid YAML frontmatter (${reason})`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`frontmatter: ${sourcePath}: frontmatter must be a YAML object`);
+  }
+  return {
+    frontmatter: parsed,
+    body
+  };
+}
+
+export {
+  isLibraryKind,
+  LIBRARY_RESOURCE_KINDS,
+  isLibraryResourceKind,
+  LIBRARY_PROVIDES_LIMITS,
+  PLUGIN_SCHEMA,
+  PLUGIN_EXTENSION_KEY,
+  isPluginId,
+  pluginResourcePath,
+  readPluginManifest,
+  installLibraryPackage,
+  pluginBaseDir,
+  PluginWriterRefusal,
+  withPluginScopeLock,
+  observePluginCopy,
+  newlyBrokenDependents,
+  listInstalledPlugins,
+  readPluginInstallRecord,
+  installPlugin,
+  enablePlugin,
+  disablePlugin,
+  removePlugin,
+  pluginSnapshotFor,
+  reloadPluginResources,
+  enabledPluginResourceRoots,
+  PluginsDomainModule,
+  resolvePackageReferences,
+  resolvePackagePathReference,
+  parseFrontmatter
+};
+//# sourceMappingURL=chunk-YKRJTYNP.js.map