@lesliechan721/aw 0.1.0-beta.3

package/dist/src/utils/catalog-source-references.js

@@ -0,0 +1,1418 @@
+import path from 'node:path';
+import fs from 'fs-extra';
+import { readClaudeSettings } from '../adapters/helpers.js';
+import { readCodexConfigFile } from './codex-config.js';
+import { readJsonFileIfExists } from './json.js';
+import { getClaudeHome, getCodexHome, canonicalizePathThroughExistingAncestorSync, resolveAwHome, resolveAwHomeCanonical, resolveRepoRootSync, } from './state-paths.js';
+import { OWNED_TEXT_HEADER_PREFIX, parseSharedOwnerToken, parseOwnedTextHeader, readSkillOwnerMarker, SKILL_OWNER_MARKER, } from './ownership.js';
+import { createLifecycleProjectLocationKey, inspectLifecycleActiveSnapshotForInventory, } from './lifecycle-active-store.js';
+import { CodexNativeResidueProbeError, discoverCodexNativeResidueNames, } from '../commands/rebuild-integration.js';
+import { parseCodexSharedHooksFile } from './hooks-contract.js';
+import { sanitizeCatalogSourceErrorMessage } from './catalog-public-error.js';
+import { readPluginManifest } from './manifest.js';
+import { readStrictNamespacedMarketplaceRoot } from './local-marketplace.js';
+export function canonicalMarketplaceRegistrationNames(references, sourceId) {
+    return [...new Set(references.flatMap((reference) => reference.kind === 'namespacedMarketplace'
+            && reference.sourceId === sourceId
+            && reference.pluginName === undefined
+            && reference.marketplaceName
+            ? [reference.marketplaceName]
+            : []))];
+}
+function pluginNameFromMarketplaceId(pluginId, marketplaceName) {
+    const suffix = `@${marketplaceName}`;
+    return pluginId.endsWith(suffix) && pluginId.length > suffix.length
+        ? pluginId.slice(0, -suffix.length)
+        : null;
+}
+function claudeConsumersFromSettings(value, marketplaceName, scope) {
+    if (!value)
+        return [];
+    const output = [];
+    for (const pluginId of Object.keys(isRecord(value.enabledPlugins) ? value.enabledPlugins : {})) {
+        const pluginName = pluginNameFromMarketplaceId(pluginId, marketplaceName);
+        if (pluginName)
+            output.push({ pluginName, platform: 'claude', scope });
+    }
+    const plugins = isRecord(value.plugins) && isRecord(value.plugins.installed)
+        ? value.plugins.installed
+        : {};
+    for (const [key, raw] of Object.entries(plugins)) {
+        if (!isRecord(raw) || raw.marketplace !== marketplaceName)
+            continue;
+        const pluginName = typeof raw.name === 'string'
+            ? raw.name
+            : pluginNameFromMarketplaceId(key, marketplaceName) ?? key;
+        output.push({ pluginName, platform: 'claude', scope });
+    }
+    return output;
+}
+function claudeConsumersFromInstalled(value, marketplaceName, currentProject, includeHistoricalProjects) {
+    const output = [];
+    if (value !== null && !isRecord(value)) {
+        throw new Error('Claude installed_plugins must be a JSON object.');
+    }
+    if (value?.plugins !== undefined && !isRecord(value.plugins)) {
+        throw new Error('Claude installed_plugins.plugins must be a JSON object.');
+    }
+    const plugins = value?.plugins ?? {};
+    for (const [key, raw] of Object.entries(plugins)) {
+        for (const item of Array.isArray(raw) ? raw : [raw]) {
+            if (!isRecord(item)) {
+                throw new Error(`Claude installed_plugins record ${key} must be a JSON object.`);
+            }
+            if (item.marketplace !== undefined
+                && (typeof item.marketplace !== 'string' || item.marketplace.length === 0)) {
+                throw new Error(`Claude installed_plugins record ${key} has an invalid marketplace identity.`);
+            }
+            if (item.name !== undefined && (typeof item.name !== 'string' || item.name.length === 0)) {
+                throw new Error(`Claude installed_plugins record ${key} has an invalid plugin identity.`);
+            }
+            if (item.scope !== undefined
+                && item.scope !== 'user'
+                && item.scope !== 'project'
+                && item.scope !== 'local') {
+                throw new Error(`Claude installed_plugins record ${key} has an invalid scope.`);
+            }
+            if (item.projectPath !== undefined && typeof item.projectPath !== 'string') {
+                throw new Error(`Claude installed_plugins record ${key} has an invalid projectPath.`);
+            }
+            const itemMarketplace = typeof item.marketplace === 'string'
+                ? item.marketplace
+                : pluginNameFromMarketplaceId(key, marketplaceName) ? marketplaceName : undefined;
+            if (!itemMarketplace)
+                continue;
+            if (itemMarketplace !== marketplaceName)
+                continue;
+            const scope = item.scope === 'project' || item.scope === 'local' ? 'project' : 'user';
+            const projectKey = scope === 'project'
+                ? typeof item.projectPath === 'string' && path.isAbsolute(item.projectPath)
+                    ? canonicalizePathThroughExistingAncestorSync(item.projectPath)
+                    : null
+                : undefined;
+            if (!includeHistoricalProjects && scope === 'project' && projectKey !== currentProject)
+                continue;
+            const pluginName = typeof item.name === 'string'
+                ? item.name
+                : pluginNameFromMarketplaceId(key, marketplaceName) ?? key;
+            output.push({ pluginName, platform: 'claude', scope, ...(scope === 'project' ? { projectKey } : {}) });
+        }
+    }
+    return output;
+}
+function pathSegmentsWithin(root, location) {
+    const relative = path.relative(path.resolve(root), path.resolve(location));
+    if (relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative))) {
+        return relative === '' ? [] : relative.split(path.sep);
+    }
+    return null;
+}
+function inventoryErrorRelevance(location, env, cwd) {
+    const repoRoot = resolveRepoRootSync(cwd);
+    const awHome = resolveAwHome(env);
+    const canonicalRepoRoot = (() => {
+        try {
+            return fs.realpathSync(repoRoot);
+        }
+        catch {
+            return path.resolve(repoRoot);
+        }
+    })();
+    const canonicalAwHome = (() => {
+        try {
+            return canonicalizePathThroughExistingAncestorSync(awHome);
+        }
+        catch {
+            return path.resolve(awHome);
+        }
+    })();
+    const projectRoots = [
+        [path.join(repoRoot, '.codex'), 'codex'],
+        [path.join(repoRoot, '.agents'), 'codex'],
+        [path.join(repoRoot, '.claude'), 'claude'],
+    ];
+    for (const [root, platform] of projectRoots) {
+        if (pathSegmentsWithin(root, location) !== null) {
+            return { global: false, platform, scope: 'project' };
+        }
+    }
+    for (const fileName of ['installed_plugins.json', 'known_marketplaces.json']) {
+        if (pathSegmentsWithin(path.join(getClaudeHome(env), 'plugins', fileName), location) !== null) {
+            return { global: false, platform: 'claude' };
+        }
+    }
+    if (pathSegmentsWithin(getCodexHome(env), location) !== null) {
+        return { global: false, platform: 'codex', scope: 'user' };
+    }
+    if (pathSegmentsWithin(getClaudeHome(env), location) !== null) {
+        return { global: false, platform: 'claude', scope: 'user' };
+    }
+    for (const root of new Set([awHome, canonicalAwHome])) {
+        const marketplace = pathSegmentsWithin(path.join(root, 'marketplaces'), location);
+        if (marketplace?.[0])
+            return { global: false, sourceId: marketplace[0] };
+    }
+    for (const [root, scope] of [
+        [path.join(awHome, 'plugin-config'), 'user'],
+        [path.join(canonicalAwHome, 'plugin-config'), 'user'],
+        [path.join(repoRoot, '.agent-workflows', 'plugin-config'), 'project'],
+        [path.join(repoRoot, '.agent-workflows', 'plugin-config.local'), 'project'],
+        [path.join(canonicalRepoRoot, '.agent-workflows', 'plugin-config'), 'project'],
+        [path.join(canonicalRepoRoot, '.agent-workflows', 'plugin-config.local'), 'project'],
+    ]) {
+        const segments = pathSegmentsWithin(root, location);
+        if (segments !== null) {
+            return {
+                global: false,
+                ...(segments[0] ? { sourceId: segments[0] } : {}),
+                ...(segments[1] ? { pluginName: segments[1] } : {}),
+                scope,
+            };
+        }
+    }
+    for (const root of new Set([repoRoot, canonicalRepoRoot])) {
+        if (pathSegmentsWithin(path.join(root, '.agent-workflows'), location) !== null) {
+            return { global: false, scope: 'project' };
+        }
+    }
+    const lifecycle = pathSegmentsWithin(path.join(awHome, 'lifecycle-active'), location);
+    if (lifecycle?.[0]) {
+        const platform = lifecycle[1] === 'codex' || lifecycle[1] === 'claude'
+            ? lifecycle[1]
+            : undefined;
+        const scope = lifecycle[2] === 'user' || lifecycle[2] === 'project'
+            ? lifecycle[2]
+            : undefined;
+        const pluginName = platform && scope && lifecycle.length >= 5
+            && (scope === 'project' || lifecycle[3] === 'user')
+            ? lifecycle[4]
+            : undefined;
+        return {
+            global: false,
+            sourceId: lifecycle[0],
+            ...(pluginName ? { pluginName } : {}),
+            ...(platform ? { platform } : {}),
+            ...(scope ? { scope } : {}),
+        };
+    }
+    return { global: true };
+}
+function isAbsentState(error) {
+    const code = error.code;
+    return code === 'ENOENT';
+}
+function inventoryError(error, location, kind, env, cwd, relevance) {
+    const message = error instanceof Error ? error.message : String(error);
+    const sensitiveRoots = [getCodexHome(env), getClaudeHome(env), resolveRepoRootSync(cwd)];
+    return {
+        code: 'stateInventoryFailed',
+        kind,
+        location: sanitizeCatalogSourceErrorMessage(location, env, sensitiveRoots),
+        message: sanitizeCatalogSourceErrorMessage(message, env, sensitiveRoots),
+        relevance: relevance ?? inventoryErrorRelevance(location, env, cwd),
+    };
+}
+async function inventoryRead(options) {
+    try {
+        return await options.operation();
+    }
+    catch (error) {
+        if (options.reportAbsent || !isAbsentState(error)) {
+            options.errors.push(inventoryError(error, options.location, options.kind, options.env, options.cwd));
+        }
+        return options.absent;
+    }
+}
+async function inventoryCanonicalDirectory(options) {
+    const stats = await inventoryRead({
+        operation: () => fs.lstat(options.location),
+        absent: null,
+        errors: options.errors,
+        location: options.location,
+        kind: options.kind,
+        env: options.env,
+        cwd: options.cwd,
+    });
+    if (stats === null)
+        return false;
+    if (!stats.isDirectory() || stats.isSymbolicLink()) {
+        options.errors.push(inventoryError(new Error('State namespace root must be a canonical directory.'), options.location, options.kind, options.env, options.cwd));
+        return false;
+    }
+    return true;
+}
+async function inventoryCanonicalDirectoryEntries(options) {
+    if (!await inventoryCanonicalDirectory(options))
+        return [];
+    return inventoryRead({
+        operation: () => fs.readdir(options.location, { withFileTypes: true }),
+        absent: [],
+        errors: options.errors,
+        location: options.location,
+        kind: options.kind,
+        env: options.env,
+        cwd: options.cwd,
+    });
+}
+async function inventoryCanonicalDescendantDirectory(options) {
+    let location = options.root;
+    for (const segment of options.segments) {
+        location = path.join(location, segment);
+        if (!await inventoryCanonicalDirectory({
+            errors: options.errors,
+            location,
+            kind: options.kind,
+            env: options.env,
+            cwd: options.cwd,
+        }))
+            return null;
+    }
+    return location;
+}
+async function inventoryPluginConfigRoots(options) {
+    const roots = [];
+    const rawAwHome = resolveAwHome(options.env);
+    const awHome = await inventoryRead({
+        operation: () => resolveAwHomeCanonical(options.env),
+        absent: null,
+        errors: options.errors,
+        location: rawAwHome,
+        kind: 'configDirectoryRead',
+        env: options.env,
+        cwd: options.cwd,
+    });
+    if (awHome && await inventoryCanonicalDirectory({
+        errors: options.errors,
+        location: awHome,
+        kind: 'configDirectoryRead',
+        env: options.env,
+        cwd: options.cwd,
+    })) {
+        const userRoot = await inventoryCanonicalDescendantDirectory({
+            root: rawAwHome,
+            segments: ['plugin-config'],
+            errors: options.errors,
+            kind: 'configDirectoryRead',
+            env: options.env,
+            cwd: options.cwd,
+        });
+        if (userRoot)
+            roots.push(userRoot);
+    }
+    const rawRepoRoot = resolveRepoRootSync(options.cwd);
+    const repoRoot = await inventoryRead({
+        operation: () => fs.realpath(rawRepoRoot),
+        absent: null,
+        reportAbsent: true,
+        errors: options.errors,
+        location: rawRepoRoot,
+        kind: 'projectRootRead',
+        env: options.env,
+        cwd: options.cwd,
+    });
+    if (repoRoot && await inventoryCanonicalDirectory({
+        errors: options.errors,
+        location: repoRoot,
+        kind: 'projectRootRead',
+        env: options.env,
+        cwd: options.cwd,
+    })) {
+        for (const storeName of ['plugin-config', 'plugin-config.local']) {
+            const projectRoot = await inventoryCanonicalDescendantDirectory({
+                root: rawRepoRoot,
+                segments: ['.agent-workflows', storeName],
+                errors: options.errors,
+                kind: 'configDirectoryRead',
+                env: options.env,
+                cwd: options.cwd,
+            });
+            if (projectRoot)
+                roots.push(projectRoot);
+        }
+    }
+    return roots;
+}
+export async function inventoryLegacyOwnerReferences(options) {
+    const env = options.env ?? process.env;
+    const awHome = resolveAwHome(env);
+    const repoRoot = resolveRepoRootSync(options.cwd);
+    const references = [];
+    const errors = [];
+    const skillRoots = new Set([
+        path.join(getCodexHome(env), 'skills'),
+        path.join(getClaudeHome(env), 'skills'),
+        path.join(repoRoot, '.agents', 'skills'),
+        path.join(repoRoot, '.claude', 'skills'),
+    ]);
+    const legacyPluginsRoot = path.join(awHome, 'plugins');
+    const legacyPlugins = await inventoryRead({
+        operation: () => fs.readdir(legacyPluginsRoot, { withFileTypes: true }),
+        absent: [], errors, location: legacyPluginsRoot, kind: 'pluginDirectoryRead', env, cwd: options.cwd,
+    });
+    for (const plugin of legacyPlugins) {
+        if (!plugin.isDirectory() || plugin.isSymbolicLink())
+            continue;
+        for (const root of await resolveCanonicalPluginSkillRoots(path.join(legacyPluginsRoot, plugin.name), true, errors, env, options.cwd))
+            skillRoots.add(root);
+    }
+    const marketplacesRoot = path.join(awHome, 'marketplaces');
+    const marketplaces = await inventoryCanonicalDirectoryEntries({
+        errors, location: marketplacesRoot, kind: 'marketplaceDirectoryRead', env, cwd: options.cwd,
+    });
+    for (const entry of marketplaces) {
+        const marketplaceRoot = path.join(marketplacesRoot, entry.name);
+        if (!await inventoryCanonicalDirectory({
+            errors,
+            location: marketplaceRoot,
+            kind: 'marketplaceRootValidation',
+            env,
+            cwd: options.cwd,
+        }))
+            continue;
+        const pluginsRoot = path.join(marketplacesRoot, entry.name, 'plugins');
+        const plugins = await inventoryCanonicalDirectoryEntries({
+            errors, location: pluginsRoot, kind: 'pluginDirectoryRead', env, cwd: options.cwd,
+        });
+        for (const plugin of plugins) {
+            const pluginRoot = path.join(pluginsRoot, plugin.name);
+            if (!await inventoryCanonicalDirectory({
+                errors,
+                location: pluginRoot,
+                kind: 'pluginDirectoryRead',
+                env,
+                cwd: options.cwd,
+            }))
+                continue;
+            for (const root of await resolveCanonicalPluginSkillRoots(pluginRoot, false, errors, env, options.cwd))
+                skillRoots.add(root);
+        }
+    }
+    for (const root of skillRoots) {
+        references.push(...await findDirectSkillOwnerMarkers(root, errors, env, options.cwd));
+    }
+    for (const configRoot of [
+        getCodexHome(env),
+        getClaudeHome(env),
+        path.join(repoRoot, '.codex'),
+        path.join(repoRoot, '.claude'),
+    ]) {
+        references.push(...await findOwnedHeadersInDirectory(path.join(configRoot, 'rules'), new Set(['.md', '.rules']), true, errors, env, options.cwd), ...await findOwnedHeadersInDirectory(path.join(configRoot, 'agents'), new Set(['.md', '.toml']), true, errors, env, options.cwd));
+    }
+    references.push(...await findOwnedHeadersInDirectory(path.join(repoRoot, '.agents', 'rules'), new Set(['.md']), false, errors, env, options.cwd), ...await findOwnedHeadersInDirectory(path.join(repoRoot, '.agents', 'agents'), new Set(['.md']), false, errors, env, options.cwd));
+    for (const filePath of [
+        path.join(getCodexHome(env), 'AGENTS.md'),
+        path.join(repoRoot, '.codex', 'AGENTS.md'),
+    ]) {
+        const reference = await readOwnedHeaderReference(filePath, false, errors, env, options.cwd);
+        if (reference)
+            references.push(reference);
+    }
+    const unique = [...new Map(references.map((reference) => [[
+                reference.kind,
+                reference.location,
+                reference.sourceId ?? '',
+                reference.sourceIdentity ?? '',
+                reference.pluginName ?? '',
+                reference.platform ?? '',
+                reference.scope ?? '',
+                reference.marketplaceName ?? '',
+            ].join('\0'), reference])).values()];
+    unique.sort((left, right) => left.location.localeCompare(right.location));
+    return { inventorySchemaVersion: 1, references: unique, errors };
+}
+export async function inventoryLegacyConfigReferences(options) {
+    const env = options.env ?? process.env;
+    const references = [];
+    const errors = [];
+    for (const directory of await inventoryPluginConfigRoots({ errors, env, cwd: options.cwd })) {
+        const entries = await inventoryRead({
+            operation: () => fs.readdir(directory, { withFileTypes: true }),
+            absent: [], errors, location: directory, kind: 'configDirectoryRead', env, cwd: options.cwd,
+        });
+        for (const entry of entries) {
+            const entryRoot = path.join(directory, entry.name);
+            if (!await inventoryCanonicalDirectory({
+                errors, location: entryRoot, kind: 'configNamespaceValidation', env, cwd: options.cwd,
+            }))
+                continue;
+            const legacyFile = path.join(directory, entry.name, 'config.json');
+            const stat = await inventoryRead({
+                operation: () => fs.stat(legacyFile),
+                absent: null, errors, location: legacyFile, kind: 'configFileStat', env, cwd: options.cwd,
+            });
+            if (stat?.isFile()) {
+                references.push({ kind: 'legacyConfig', location: legacyFile, pluginName: entry.name });
+            }
+        }
+    }
+    references.sort((left, right) => left.location.localeCompare(right.location));
+    return { inventorySchemaVersion: 1, references, errors };
+}
+function ownerReferenceFromRaw(entryPath, raw) {
+    if (raw?.schemaVersion === 1 && raw.owner === 'agent-workflows') {
+        return {
+            kind: 'legacyOwner',
+            location: entryPath,
+            ...(typeof raw.plugin === 'string' ? { pluginName: raw.plugin } : {}),
+            ...(typeof raw.platform === 'string' ? { platform: raw.platform } : {}),
+            ...(typeof raw.scope === 'string' ? { scope: raw.scope } : {}),
+        };
+    }
+    if (raw?.schemaVersion === 2 && raw.owner === 'agent-workflows'
+        && typeof raw.sourceId === 'string') {
+        return {
+            kind: 'namespacedOwner',
+            location: entryPath,
+            sourceId: raw.sourceId,
+            ...(typeof raw.sourceIdentity === 'string' ? { sourceIdentity: raw.sourceIdentity } : {}),
+            ...(typeof raw.plugin === 'string' ? { pluginName: raw.plugin } : {}),
+            ...(typeof raw.platform === 'string' ? { platform: raw.platform } : {}),
+            ...(typeof raw.scope === 'string' ? { scope: raw.scope } : {}),
+        };
+    }
+    return null;
+}
+async function readOwnedHeaderReference(filePath, requireGeneratedName, errors, env, cwd) {
+    const stats = await inventoryRead({
+        operation: () => fs.stat(filePath),
+        absent: null,
+        errors,
+        location: filePath,
+        kind: 'ownerHeaderStat',
+        env,
+        cwd,
+    });
+    if (!stats?.isFile() || stats.size > 1024 * 1024)
+        return null;
+    const content = await inventoryRead({
+        operation: () => fs.readFile(filePath, 'utf8'),
+        absent: null,
+        errors,
+        location: filePath,
+        kind: 'ownerHeaderRead',
+        env,
+        cwd,
+    });
+    if (content === null)
+        return null;
+    if (!content.includes(OWNED_TEXT_HEADER_PREFIX))
+        return null;
+    let parsed;
+    try {
+        parsed = parseOwnedTextHeader(content);
+    }
+    catch (error) {
+        errors.push(inventoryError(error, filePath, 'ownerHeaderParse', env, cwd));
+        return null;
+    }
+    if (!parsed)
+        return null;
+    if (requireGeneratedName
+        && !path.basename(filePath).startsWith(`aw-${parsed.identity.plugin}-`)) {
+        errors.push(inventoryError(new Error('Owned text header path does not match its plugin identity.'), filePath, 'ownerHeaderPathValidation', env, cwd));
+        return null;
+    }
+    return ownerReferenceFromRaw(filePath, {
+        schemaVersion: parsed.identity.sourceId === undefined ? 1 : 2,
+        ...parsed.identity,
+    });
+}
+async function findOwnedHeadersInDirectory(directory, extensions, requireGeneratedName, errors, env, cwd) {
+    const output = [];
+    const entries = await inventoryRead({
+        operation: () => fs.readdir(directory, { withFileTypes: true }),
+        absent: [],
+        errors,
+        location: directory,
+        kind: 'ownerDirectoryRead',
+        env,
+        cwd,
+    });
+    for (const entry of entries) {
+        if (!entry.isFile() || entry.isSymbolicLink() || !extensions.has(path.extname(entry.name)))
+            continue;
+        const reference = await readOwnedHeaderReference(path.join(directory, entry.name), requireGeneratedName, errors, env, cwd);
+        if (reference)
+            output.push(reference);
+    }
+    return output;
+}
+function safeRelativeSkillRoot(value) {
+    if (typeof value !== 'string' || value.trim() === '')
+        return null;
+    const normalized = path.posix.normalize(value.replace(/^\.\//u, ''));
+    return normalized === '..' || normalized.startsWith('../') || path.isAbsolute(normalized)
+        ? null
+        : normalized;
+}
+async function resolveCanonicalPluginSkillRoots(pluginRoot, includeLegacyFallbacks, errors, env, cwd) {
+    const [platformManifest, sourceManifest] = await Promise.all([
+        inventoryRead({
+            operation: () => fs.readJson(path.join(pluginRoot, '.codex-plugin', 'plugin.json')),
+            absent: null,
+            errors,
+            location: path.join(pluginRoot, '.codex-plugin', 'plugin.json'),
+            kind: 'pluginManifestRead',
+            env,
+            cwd,
+        }),
+        inventoryRead({
+            operation: () => fs.readJson(path.join(pluginRoot, '.agents-plugin', 'plugin.json')),
+            absent: null,
+            errors,
+            location: path.join(pluginRoot, '.agents-plugin', 'plugin.json'),
+            kind: 'pluginManifestRead',
+            env,
+            cwd,
+        }),
+    ]);
+    const declared = safeRelativeSkillRoot(platformManifest?.skills ?? sourceManifest?.skills)
+        ?? 'codex/skills';
+    return [...new Set([
+            path.join(pluginRoot, ...declared.split('/')),
+            ...(includeLegacyFallbacks ? [
+                path.join(pluginRoot, 'skills'),
+                path.join(pluginRoot, 'codex', 'skills'),
+            ] : []),
+        ])];
+}
+async function findDirectSkillOwnerMarkers(root, errors, env, cwd) {
+    const output = [];
+    const entries = await inventoryRead({
+        operation: () => fs.readdir(root, { withFileTypes: true }),
+        absent: [],
+        errors,
+        location: root,
+        kind: 'skillRootRead',
+        env,
+        cwd,
+    });
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const skillRoot = path.join(root, entry.name);
+        const markerPath = path.join(root, entry.name, SKILL_OWNER_MARKER);
+        const markerStats = await inventoryRead({
+            operation: () => fs.lstat(markerPath),
+            absent: null,
+            errors,
+            location: markerPath,
+            kind: 'ownerMarkerRead',
+            env,
+            cwd,
+        });
+        if (!markerStats)
+            continue;
+        let marker;
+        try {
+            marker = await readSkillOwnerMarker({ skillRoot, allowedRoot: root });
+        }
+        catch (error) {
+            if (!isAbsentState(error)) {
+                const code = error.code;
+                const message = error instanceof Error ? error.message : String(error);
+                errors.push(inventoryError(error, markerPath, code !== undefined || message.includes('JSON') ? 'ownerMarkerRead' : 'ownerMarkerValidation', env, cwd));
+            }
+            continue;
+        }
+        if (!marker)
+            continue;
+        const reference = ownerReferenceFromRaw(markerPath, { ...marker });
+        if (reference)
+            output.push(reference);
+    }
+    return output;
+}
+function sharedOwnerTokenReferences(filePath, tokens, errors, env, cwd) {
+    const output = [];
+    for (const token of new Set(tokens)) {
+        let identity;
+        try {
+            identity = parseSharedOwnerToken(token);
+        }
+        catch (error) {
+            errors.push(inventoryError(error, filePath, 'sharedOwnerTokenParse', env, cwd));
+            continue;
+        }
+        if (!identity?.sourceId)
+            continue;
+        output.push({
+            kind: 'namespacedOwner',
+            location: filePath,
+            sourceId: identity.sourceId,
+            sourceIdentity: identity.sourceIdentity,
+            pluginName: identity.plugin,
+            platform: identity.platform,
+            scope: identity.scope,
+        });
+    }
+    return output;
+}
+async function codexSharedOwnerReferences(filePath, scope, errors, env, cwd) {
+    const config = await readCodexConfigFile(filePath);
+    const ownerValues = [
+        ...Object.keys(config.snapshot.developerInstructions.managedBlocks).map((value) => ({
+            value,
+            location: filePath,
+        })),
+        ...Object.values(config.snapshot.mcpServers).flatMap((server) => {
+            const env = server.value?.env;
+            const value = isRecord(env) && typeof env.AW_AGENT_WORKFLOWS_OWNER === 'string'
+                ? env.AW_AGENT_WORKFLOWS_OWNER
+                : null;
+            return value ? [{ value, location: filePath }] : [];
+        }),
+    ];
+    const references = sharedOwnerTokenReferences(filePath, ownerValues.map((entry) => entry.value).filter((value) => value.startsWith('aw-owner-v2:')), errors, env, cwd);
+    for (const { value, location } of ownerValues) {
+        if (value.startsWith('aw-owner-v2:') || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(value))
+            continue;
+        references.push({
+            kind: 'legacyOwner',
+            location,
+            pluginName: value,
+            platform: 'codex',
+            scope,
+        });
+    }
+    return references;
+}
+async function claudeSharedOwnerReferences(filePath, scope, errors, env, cwd) {
+    const settings = await readJsonFileIfExists(filePath);
+    const generated = settings && isRecord(settings.awGenerated) ? settings.awGenerated : null;
+    const permissions = generated && isRecord(generated.permissions) ? generated.permissions : {};
+    const keys = Object.keys(permissions);
+    const references = sharedOwnerTokenReferences(filePath, keys.filter((token) => token.startsWith('aw-owner-v2:')), errors, env, cwd);
+    for (const key of keys) {
+        if (key.startsWith('aw-owner-v2:') || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(key))
+            continue;
+        references.push({
+            kind: 'legacyOwner',
+            location: filePath,
+            pluginName: key,
+            platform: 'claude',
+            scope,
+        });
+    }
+    return references;
+}
+async function codexHookOwnerReferences(filePath, errors, env, cwd) {
+    const raw = await readJsonFileIfExists(filePath);
+    if (!raw)
+        return [];
+    const parsed = parseCodexSharedHooksFile(raw);
+    const output = [];
+    for (const hook of parsed.managedIdentities) {
+        if (!hook.command.includes(OWNED_TEXT_HEADER_PREFIX))
+            continue;
+        let owner;
+        try {
+            owner = parseOwnedTextHeader(hook.command)?.identity;
+        }
+        catch (error) {
+            errors.push(inventoryError(error, filePath, 'ownerHeaderParse', env, cwd));
+            continue;
+        }
+        if (!owner)
+            continue;
+        output.push(owner.sourceId ? {
+            kind: 'namespacedOwner',
+            location: filePath,
+            sourceId: owner.sourceId,
+            sourceIdentity: owner.sourceIdentity,
+            pluginName: owner.plugin,
+            platform: owner.platform,
+            scope: owner.scope,
+        } : {
+            kind: 'legacyOwner',
+            location: filePath,
+            pluginName: owner.plugin,
+            platform: owner.platform,
+            scope: owner.scope,
+        });
+    }
+    return output;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function assertNamespacedConfigEnvelope(value, sourceId, pluginName) {
+    if (!isRecord(value)
+        || value.schemaVersion !== 2
+        || typeof value.sourceId !== 'string'
+        || typeof value.sourceIdentity !== 'string'
+        || !/^sha256:[0-9a-f]{64}$/u.test(value.sourceIdentity)
+        || typeof value.pluginName !== 'string'
+        || !isRecord(value.values)
+        || Object.keys(value).some((key) => ![
+            'schemaVersion', 'sourceId', 'sourceIdentity', 'pluginName', 'values',
+        ].includes(key))) {
+        throw new Error('Namespaced plugin config is not a valid schema 2 envelope.');
+    }
+    if (value.sourceId !== sourceId || value.pluginName !== pluginName) {
+        throw new Error('Namespaced plugin config identity does not match its directory path.');
+    }
+}
+function hasClaudeMarketplaceConsumer(value) {
+    if (Array.isArray(value))
+        return value.some(hasClaudeMarketplaceConsumer);
+    if (!isRecord(value))
+        return false;
+    if (value.marketplace === 'aw')
+        return true;
+    return Object.values(value).some(hasClaudeMarketplaceConsumer);
+}
+function isAwPluginConsumerKey(value) {
+    return value.length > '@aw'.length && value.endsWith('@aw');
+}
+function hasAwPluginConsumerKeys(value) {
+    return isRecord(value) && Object.keys(value).some(isAwPluginConsumerKey);
+}
+async function oldMarketplaceReferences(env, cwd, errors) {
+    const codexPath = path.join(getCodexHome(env), 'config.toml');
+    const claudeSettingsPath = path.join(getClaudeHome(env), 'settings.json');
+    const claudeKnownPath = path.join(getClaudeHome(env), 'plugins', 'known_marketplaces.json');
+    const claudeInstalledPath = path.join(getClaudeHome(env), 'plugins', 'installed_plugins.json');
+    const output = [];
+    const marketplacesRoot = path.join(resolveAwHome(env), 'marketplaces');
+    const namespacedPrimaryRoots = new Set();
+    const marketplaceEntries = await inventoryCanonicalDirectoryEntries({
+        errors, location: marketplacesRoot, kind: 'marketplaceDirectoryRead', env, cwd,
+    });
+    for (const entry of marketplaceEntries) {
+        const marketplaceRoot = path.join(marketplacesRoot, entry.name);
+        if (!await inventoryCanonicalDirectory({
+            errors, location: marketplaceRoot, kind: 'marketplaceRootValidation', env, cwd,
+        }))
+            continue;
+        const manifestPath = path.join(marketplacesRoot, entry.name, '.agents', 'plugins', 'marketplace.json');
+        const configPath = path.join(marketplacesRoot, entry.name, 'config.json');
+        const manifest = await inventoryRead({
+            operation: () => fs.readJson(manifestPath), absent: null, errors,
+            location: manifestPath, kind: 'marketplaceManifestRead', env, cwd,
+        });
+        const config = await inventoryRead({
+            operation: () => fs.readJson(configPath), absent: null, errors,
+            location: configPath, kind: 'marketplaceConfigRead', env, cwd,
+        });
+        if (manifest?.name === 'aw' && config?.schemaVersion === 2 && config.sourceId === entry.name) {
+            namespacedPrimaryRoots.add(path.normalize(path.join(marketplacesRoot, entry.name)));
+        }
+    }
+    const codex = await inventoryRead({
+        operation: () => readCodexConfigFile(codexPath), absent: null, errors,
+        location: codexPath, kind: 'nativeStateRead', env, cwd,
+    });
+    const codexAw = codex?.snapshot.marketplaces.aw;
+    const codexAwIsNamespaced = codexAw?.sourceType === 'local'
+        && !codexAw.sourcePointsToManifest
+        && namespacedPrimaryRoots.has(path.normalize(codexAw.source ?? ''));
+    if (codex && (Object.hasOwn(codex.snapshot.marketplaces, 'aw') || Object.keys(codex.snapshot.plugins).some(isAwPluginConsumerKey))
+        && !codexAwIsNamespaced) {
+        output.push({ kind: 'legacyMarketplace', location: codexPath });
+        for (const pluginId of Object.keys(codex.snapshot.plugins)) {
+            const pluginName = pluginNameFromMarketplaceId(pluginId, 'aw');
+            if (pluginName)
+                output.push({
+                    kind: 'legacyMarketplace',
+                    location: codexPath,
+                    pluginName,
+                    platform: 'codex',
+                    scope: 'user',
+                });
+        }
+    }
+    const settings = await inventoryRead({
+        operation: () => readClaudeSettings(claudeSettingsPath), absent: null, errors,
+        location: claudeSettingsPath, kind: 'nativeStateRead', env, cwd,
+    });
+    const known = await inventoryRead({
+        operation: () => readJsonFileIfExists(claudeKnownPath), absent: null, errors,
+        location: claudeKnownPath, kind: 'nativeStateRead', env, cwd,
+    });
+    const declarationPaths = [
+        settings?.extraKnownMarketplaces?.aw,
+        known?.aw,
+        isRecord(known?.marketplaces) ? known.marketplaces.aw : undefined,
+    ].flatMap((value) => collectMarketplaceDeclarationPaths(value));
+    const claudeAwIsNamespaced = declarationPaths.length > 0
+        && declarationPaths.every((entry) => namespacedPrimaryRoots.has(path.normalize(entry)));
+    if ((settings && (Object.hasOwn(settings.extraKnownMarketplaces ?? {}, 'aw')
+        || hasAwPluginConsumerKeys(settings.enabledPlugins)
+        || hasAwPluginConsumerKeys(settings.plugins?.installed)
+        || hasClaudeMarketplaceConsumer(settings.plugins?.installed))) && !claudeAwIsNamespaced) {
+        output.push({ kind: 'legacyMarketplace', location: claudeSettingsPath });
+        for (const consumer of claudeConsumersFromSettings(settings, 'aw', 'user')) {
+            output.push({ kind: 'legacyMarketplace', location: claudeSettingsPath, ...consumer });
+        }
+    }
+    if (known && (Object.hasOwn(known, 'aw')
+        || (isRecord(known.marketplaces) && Object.hasOwn(known.marketplaces, 'aw'))
+        || hasClaudeMarketplaceConsumer(known)) && !claudeAwIsNamespaced) {
+        output.push({ kind: 'legacyMarketplace', location: claudeKnownPath });
+    }
+    const installed = await inventoryRead({
+        operation: () => readJsonFileIfExists(claudeInstalledPath), absent: null, errors,
+        location: claudeInstalledPath, kind: 'nativeStateRead', env, cwd,
+    });
+    if (installed && (hasAwPluginConsumerKeys(installed.plugins)
+        || hasClaudeMarketplaceConsumer(installed.plugins)) && !claudeAwIsNamespaced) {
+        output.push({ kind: 'legacyMarketplace', location: claudeInstalledPath });
+        const canonicalProjectRoot = await inventoryRead({
+            operation: () => fs.realpath(resolveRepoRootSync(cwd)),
+            absent: path.resolve(resolveRepoRootSync(cwd)), errors,
+            location: resolveRepoRootSync(cwd), kind: 'projectRootRead', env, cwd,
+        });
+        try {
+            for (const consumer of claudeConsumersFromInstalled(installed, 'aw', path.normalize(canonicalProjectRoot), false)) {
+                output.push({ kind: 'legacyMarketplace', location: claudeInstalledPath, ...consumer });
+            }
+        }
+        catch (error) {
+            errors.push(inventoryError(error, claudeInstalledPath, 'nativeStateRead', env, cwd));
+        }
+    }
+    const projectSettingsPath = path.join(resolveRepoRootSync(cwd), '.claude', 'settings.json');
+    const projectSettings = await inventoryRead({
+        operation: () => readJsonFileIfExists(projectSettingsPath), absent: null, errors,
+        location: projectSettingsPath, kind: 'nativeStateRead', env, cwd,
+    });
+    if (!claudeAwIsNamespaced) {
+        for (const consumer of claudeConsumersFromSettings(projectSettings, 'aw', 'project')) {
+            output.push({ kind: 'legacyMarketplace', location: projectSettingsPath, ...consumer });
+        }
+    }
+    return output;
+}
+function collectMarketplaceDeclarationPaths(value) {
+    if (!isRecord(value))
+        return [];
+    const output = [];
+    for (const [key, entry] of Object.entries(value)) {
+        if ((key === 'path' || key === 'installLocation') && typeof entry === 'string') {
+            output.push(entry);
+        }
+        else if (key === 'source' && typeof entry === 'string' && path.isAbsolute(entry)) {
+            output.push(entry);
+        }
+        else if (isRecord(entry)) {
+            output.push(...collectMarketplaceDeclarationPaths(entry));
+        }
+    }
+    return output;
+}
+function marketplaceNamesRegisteredAtRoot(value, marketplaceRoot) {
+    if (!isRecord(value))
+        return [];
+    return Object.entries(value).flatMap(([name, declaration]) => collectMarketplaceDeclarationPaths(declaration).some((candidate) => path.normalize(candidate) === path.normalize(marketplaceRoot))
+        ? [name]
+        : []);
+}
+function sourceIdFromCanonicalMarketplacePath(candidate, marketplacesRoot) {
+    if (!path.isAbsolute(candidate))
+        return null;
+    const resolved = path.resolve(candidate);
+    const root = path.resolve(marketplacesRoot);
+    if (path.dirname(resolved) !== root)
+        return null;
+    const sourceId = path.basename(resolved);
+    return sourceId !== '' && sourceId !== '.' && sourceId !== '..' ? sourceId : null;
+}
+function registeredMarketplaceRoots(value, marketplacesRoot) {
+    if (!isRecord(value))
+        return [];
+    return Object.entries(value).flatMap(([marketplaceName, declaration]) => collectMarketplaceDeclarationPaths(declaration).flatMap((candidate) => {
+        const sourceId = sourceIdFromCanonicalMarketplacePath(candidate, marketplacesRoot);
+        return sourceId ? [{ marketplaceName, sourceId }] : [];
+    }));
+}
+export async function inventoryCatalogSourceReferences(options) {
+    const env = options.env ?? process.env;
+    const awHome = resolveAwHome(env);
+    const references = [];
+    const errors = [];
+    const legacyConfig = await inventoryLegacyConfigReferences(options);
+    references.push(...legacyConfig.references);
+    errors.push(...legacyConfig.errors);
+    for (const configRoot of await inventoryPluginConfigRoots({ errors, env, cwd: options.cwd })) {
+        const sourceEntries = await inventoryRead({
+            operation: () => fs.readdir(configRoot, { withFileTypes: true }),
+            absent: [], errors, location: configRoot, kind: 'configDirectoryRead', env, cwd: options.cwd,
+        });
+        for (const sourceEntry of sourceEntries) {
+            const sourceConfigRoot = path.join(configRoot, sourceEntry.name);
+            const pluginEntries = await inventoryCanonicalDirectoryEntries({
+                errors, location: sourceConfigRoot, kind: 'configNamespaceValidation', env, cwd: options.cwd,
+            });
+            for (const pluginEntry of pluginEntries) {
+                if (pluginEntry.name === 'config.json')
+                    continue;
+                const pluginConfigRoot = path.join(sourceConfigRoot, pluginEntry.name);
+                if (!await inventoryCanonicalDirectory({
+                    errors,
+                    location: pluginConfigRoot,
+                    kind: 'configPluginRootValidation',
+                    env,
+                    cwd: options.cwd,
+                }))
+                    continue;
+                const configPath = path.join(configRoot, sourceEntry.name, pluginEntry.name, 'config.json');
+                const configStats = await inventoryRead({
+                    operation: () => fs.lstat(configPath), absent: null, errors,
+                    location: configPath, kind: 'configFileRead', env, cwd: options.cwd,
+                });
+                if (configStats === null)
+                    continue;
+                if (!configStats.isFile() || configStats.isSymbolicLink()) {
+                    errors.push(inventoryError(new Error('Config inventory target must be a regular file.'), configPath, 'configFileValidation', env, options.cwd));
+                    continue;
+                }
+                const value = await inventoryRead({
+                    operation: () => fs.readJson(configPath), absent: null, errors,
+                    location: configPath, kind: 'configFileRead', env, cwd: options.cwd,
+                });
+                if (value === null)
+                    continue;
+                try {
+                    assertNamespacedConfigEnvelope(value, sourceEntry.name, pluginEntry.name);
+                }
+                catch (error) {
+                    errors.push(inventoryError(error, configPath, 'configFileValidation', env, options.cwd));
+                    continue;
+                }
+                references.push({
+                    kind: 'namespacedConfig',
+                    location: configPath,
+                    sourceId: sourceEntry.name,
+                    sourceIdentity: value.sourceIdentity,
+                    pluginName: pluginEntry.name,
+                });
+            }
+        }
+    }
+    const lifecycleRoot = path.join(awHome, 'lifecycle-active');
+    const lifecycleSources = await inventoryCanonicalDirectoryEntries({
+        errors, location: lifecycleRoot, kind: 'lifecycleDirectoryRead', env, cwd: options.cwd,
+    });
+    for (const platform of ['codex', 'claude']) {
+        const legacyRoot = path.join(lifecycleRoot, platform);
+        if (!lifecycleSources.some((entry) => entry.name === platform))
+            continue;
+        const legacyEntries = await inventoryCanonicalDirectoryEntries({
+            errors, location: legacyRoot, kind: 'lifecycleNamespaceValidation', env, cwd: options.cwd,
+        });
+        if (legacyEntries.length > 0) {
+            references.push({ kind: 'legacyLifecycle', location: legacyRoot });
+        }
+    }
+    const canonicalProjectRoot = await inventoryRead({
+        operation: () => fs.realpath(resolveRepoRootSync(options.cwd)),
+        absent: path.resolve(resolveRepoRootSync(options.cwd)), errors,
+        location: resolveRepoRootSync(options.cwd), kind: 'projectRootRead', env, cwd: options.cwd,
+    });
+    const projectLocationKey = createLifecycleProjectLocationKey(canonicalProjectRoot);
+    for (const sourceEntry of lifecycleSources) {
+        if (sourceEntry.name === 'codex' || sourceEntry.name === 'claude')
+            continue;
+        const sourceLifecycleRoot = path.join(lifecycleRoot, sourceEntry.name);
+        if (!await inventoryCanonicalDirectory({
+            errors,
+            location: sourceLifecycleRoot,
+            kind: 'lifecycleNamespaceValidation',
+            env,
+            cwd: options.cwd,
+        }))
+            continue;
+        const relevantRoots = [];
+        for (const platform of ['codex', 'claude']) {
+            const userRoot = await inventoryCanonicalDescendantDirectory({
+                root: sourceLifecycleRoot,
+                segments: [platform, 'user', 'user'],
+                errors,
+                kind: 'lifecycleDirectoryRead',
+                env,
+                cwd: options.cwd,
+            });
+            if (userRoot)
+                relevantRoots.push(userRoot);
+            const projectRoot = await inventoryCanonicalDescendantDirectory({
+                root: sourceLifecycleRoot,
+                segments: [platform, 'project'],
+                errors,
+                kind: 'lifecycleDirectoryRead',
+                env,
+                cwd: options.cwd,
+            });
+            if (!projectRoot)
+                continue;
+            if (options.includeHistoricalProjects) {
+                const projectLocations = await inventoryRead({
+                    operation: () => fs.readdir(projectRoot, { withFileTypes: true }),
+                    absent: [], errors, location: projectRoot, kind: 'lifecycleDirectoryRead', env, cwd: options.cwd,
+                });
+                for (const location of projectLocations) {
+                    const projectLocationRoot = path.join(projectRoot, location.name);
+                    if (await inventoryCanonicalDirectory({
+                        errors,
+                        location: projectLocationRoot,
+                        kind: 'lifecycleLocationValidation',
+                        env,
+                        cwd: options.cwd,
+                    }))
+                        relevantRoots.push(projectLocationRoot);
+                }
+            }
+            else {
+                const projectLocationRoot = path.join(projectRoot, projectLocationKey);
+                if (await inventoryCanonicalDirectory({
+                    errors,
+                    location: projectLocationRoot,
+                    kind: 'lifecycleLocationValidation',
+                    env,
+                    cwd: options.cwd,
+                }))
+                    relevantRoots.push(projectLocationRoot);
+            }
+        }
+        for (const relevantRoot of relevantRoots) {
+            const pluginEntries = await inventoryRead({
+                operation: () => fs.readdir(relevantRoot, { withFileTypes: true }),
+                absent: [], errors, location: relevantRoot, kind: 'lifecycleDirectoryRead', env, cwd: options.cwd,
+            });
+            const parts = path.relative(sourceLifecycleRoot, relevantRoot).split(path.sep);
+            const platform = parts[0];
+            const scope = parts[1];
+            if ((platform !== 'codex' && platform !== 'claude')
+                || (scope !== 'user' && scope !== 'project'))
+                continue;
+            for (const pluginEntry of pluginEntries) {
+                const pluginName = pluginEntry.name;
+                const pluginRoot = path.join(relevantRoot, pluginName);
+                if (!await inventoryCanonicalDirectory({
+                    errors,
+                    location: pluginRoot,
+                    kind: 'lifecyclePluginRootValidation',
+                    env,
+                    cwd: options.cwd,
+                }))
+                    continue;
+                const metadataPath = path.join(relevantRoot, pluginName, 'active', 'metadata.json');
+                const raw = await inventoryRead({
+                    operation: () => fs.readJson(metadataPath), absent: null, errors,
+                    location: metadataPath, kind: 'lifecycleMetadataRead', env, cwd: options.cwd,
+                });
+                if (!raw)
+                    continue;
+                if (raw.schemaVersion !== 2 || typeof raw.sourceIdentity !== 'string') {
+                    errors.push(inventoryError(new Error('Lifecycle active metadata is not valid schema 2 state.'), metadataPath, 'lifecycleMetadataValidation', env, options.cwd));
+                    continue;
+                }
+                const snapshot = await inventoryRead({
+                    operation: () => inspectLifecycleActiveSnapshotForInventory({
+                        sourceId: sourceEntry.name,
+                        sourceIdentity: raw.sourceIdentity,
+                        pluginName,
+                        platform,
+                        scope,
+                        cwd: scope === 'project' && typeof raw.projectKey === 'string'
+                            ? raw.projectKey
+                            : options.cwd,
+                        env,
+                        loadPlugin: (bundleRoot) => readPluginManifest(bundleRoot, { mode: 'bundle' }),
+                    }),
+                    absent: null,
+                    errors,
+                    location: metadataPath,
+                    kind: 'lifecycleSnapshotValidation',
+                    env,
+                    cwd: options.cwd,
+                });
+                if (!snapshot)
+                    continue;
+                references.push({
+                    kind: 'namespacedLifecycle',
+                    location: snapshot.activeRoot,
+                    sourceId: snapshot.metadata.sourceId,
+                    sourceIdentity: snapshot.metadata.sourceIdentity,
+                    pluginName: snapshot.metadata.pluginName,
+                    platform: snapshot.metadata.platform,
+                    scope: snapshot.metadata.scope,
+                    projectKey: snapshot.metadata.projectKey,
+                });
+            }
+        }
+    }
+    const ownerInventory = await inventoryLegacyOwnerReferences(options);
+    references.push(...ownerInventory.references);
+    errors.push(...ownerInventory.errors);
+    for (const [location, kind, operation] of [
+        [path.join(getCodexHome(env), 'config.toml'), 'nativeStateRead', () => codexSharedOwnerReferences(path.join(getCodexHome(env), 'config.toml'), 'user', errors, env, options.cwd)],
+        [path.join(getClaudeHome(env), 'settings.json'), 'nativeStateRead', () => claudeSharedOwnerReferences(path.join(getClaudeHome(env), 'settings.json'), 'user', errors, env, options.cwd)],
+        [path.join(resolveRepoRootSync(options.cwd), '.codex', 'config.toml'), 'nativeStateRead', () => codexSharedOwnerReferences(path.join(resolveRepoRootSync(options.cwd), '.codex', 'config.toml'), 'project', errors, env, options.cwd)],
+        [path.join(resolveRepoRootSync(options.cwd), '.claude', 'settings.json'), 'nativeStateRead', () => claudeSharedOwnerReferences(path.join(resolveRepoRootSync(options.cwd), '.claude', 'settings.json'), 'project', errors, env, options.cwd)],
+        [path.join(resolveRepoRootSync(options.cwd), '.codex', 'hooks.json'), 'nativeStateRead', () => codexHookOwnerReferences(path.join(resolveRepoRootSync(options.cwd), '.codex', 'hooks.json'), errors, env, options.cwd)],
+    ]) {
+        references.push(...await inventoryRead({
+            operation, absent: [], errors, location, kind, env, cwd: options.cwd,
+        }));
+    }
+    references.push(...await oldMarketplaceReferences(env, options.cwd, errors));
+    const marketplacesRoot = path.join(awHome, 'marketplaces');
+    const codexConfigPath = path.join(getCodexHome(env), 'config.toml');
+    const codexConfig = await inventoryRead({
+        operation: () => readCodexConfigFile(codexConfigPath), absent: null, errors,
+        location: codexConfigPath, kind: 'nativeStateRead', env, cwd: options.cwd,
+    });
+    const userClaudeSettingsPath = path.join(getClaudeHome(env), 'settings.json');
+    const userClaudeSettings = await inventoryRead({
+        operation: () => readJsonFileIfExists(userClaudeSettingsPath), absent: null, errors,
+        location: userClaudeSettingsPath, kind: 'nativeStateRead', env, cwd: options.cwd,
+    });
+    const projectClaudeSettingsPath = path.join(resolveRepoRootSync(options.cwd), '.claude', 'settings.json');
+    const projectClaudeSettings = await inventoryRead({
+        operation: () => readJsonFileIfExists(projectClaudeSettingsPath), absent: null, errors,
+        location: projectClaudeSettingsPath, kind: 'nativeStateRead', env, cwd: options.cwd,
+    });
+    const claudeKnownPath = path.join(getClaudeHome(env), 'plugins', 'known_marketplaces.json');
+    const claudeKnown = await inventoryRead({
+        operation: () => readJsonFileIfExists(claudeKnownPath), absent: null, errors,
+        location: claudeKnownPath, kind: 'nativeStateRead', env, cwd: options.cwd,
+    });
+    const claudeInstalledPath = path.join(getClaudeHome(env), 'plugins', 'installed_plugins.json');
+    const claudeInstalled = await inventoryRead({
+        operation: () => readJsonFileIfExists(claudeInstalledPath), absent: null, errors,
+        location: claudeInstalledPath, kind: 'nativeStateRead', env, cwd: options.cwd,
+    });
+    const marketplaceEntries = await inventoryCanonicalDirectoryEntries({
+        errors, location: marketplacesRoot, kind: 'marketplaceDirectoryRead', env, cwd: options.cwd,
+    });
+    for (const pluginId of Object.keys(codexConfig?.snapshot.plugins ?? {})) {
+        const separator = pluginId.lastIndexOf('@');
+        if (separator <= 0 || separator === pluginId.length - 1)
+            continue;
+        references.push({
+            kind: 'namespacedMarketplace',
+            location: codexConfigPath,
+            pluginName: pluginId.slice(0, separator),
+            marketplaceName: pluginId.slice(separator + 1),
+            platform: 'codex',
+            scope: 'user',
+        });
+    }
+    for (const [location, registrations] of [
+        [codexConfigPath, Object.entries(codexConfig?.snapshot.marketplaces ?? {}).flatMap(([marketplaceName, marketplace]) => {
+                const sourceId = marketplace.sourceType === 'local' && !marketplace.sourcePointsToManifest
+                    && marketplace.source
+                    ? sourceIdFromCanonicalMarketplacePath(marketplace.source, marketplacesRoot)
+                    : null;
+                return sourceId ? [{ marketplaceName, sourceId }] : [];
+            })],
+        [userClaudeSettingsPath, registeredMarketplaceRoots(userClaudeSettings?.extraKnownMarketplaces, marketplacesRoot)],
+        [projectClaudeSettingsPath, registeredMarketplaceRoots(projectClaudeSettings?.extraKnownMarketplaces, marketplacesRoot)],
+        [claudeKnownPath, [
+                ...registeredMarketplaceRoots(claudeKnown, marketplacesRoot),
+                ...registeredMarketplaceRoots(claudeKnown?.marketplaces, marketplacesRoot),
+            ]],
+    ]) {
+        for (const registration of registrations)
+            references.push({
+                kind: 'namespacedMarketplace',
+                location,
+                sourceId: registration.sourceId,
+                marketplaceName: registration.marketplaceName,
+            });
+    }
+    for (const sourceEntry of marketplaceEntries) {
+        const marketplaceRoot = path.join(marketplacesRoot, sourceEntry.name);
+        const configPath = path.join(marketplaceRoot, 'config.json');
+        const agentsManifestPath = path.join(marketplaceRoot, '.agents', 'plugins', 'marketplace.json');
+        const canonicalRoot = await inventoryCanonicalDirectory({
+            errors,
+            location: marketplaceRoot,
+            kind: 'marketplaceRootValidation',
+            env,
+            cwd: options.cwd,
+        });
+        const strictRoot = canonicalRoot
+            ? await inventoryRead({
+                operation: () => readStrictNamespacedMarketplaceRoot({
+                    rootDir: marketplaceRoot,
+                    sourceId: sourceEntry.name,
+                }),
+                absent: null,
+                reportAbsent: true,
+                errors,
+                location: marketplaceRoot,
+                kind: 'marketplaceRootValidation',
+                env,
+                cwd: options.cwd,
+            })
+            : null;
+        const [rawConfig, rawAgentsManifest, rawClaudeManifest] = strictRoot
+            ? [strictRoot.config, strictRoot.agentsManifest, strictRoot.claudeManifest]
+            : canonicalRoot ? await Promise.all([
+                fs.readJson(configPath).catch(() => null),
+                fs.readJson(agentsManifestPath).catch(() => null),
+                fs.readJson(path.join(marketplaceRoot, '.claude-plugin', 'marketplace.json'))
+                    .catch(() => null),
+            ]) : [null, null, null];
+        const candidateMarketplaceNames = new Set();
+        for (const candidate of [
+            rawConfig?.marketplaceName,
+            rawAgentsManifest?.name,
+            rawClaudeManifest?.name,
+        ]) {
+            if (typeof candidate === 'string' && candidate.length > 0) {
+                candidateMarketplaceNames.add(candidate);
+            }
+        }
+        for (const [name, marketplace] of Object.entries(codexConfig?.snapshot.marketplaces ?? {})) {
+            if (marketplace.sourceType === 'local'
+                && !marketplace.sourcePointsToManifest
+                && path.normalize(marketplace.source ?? '') === path.normalize(marketplaceRoot)) {
+                candidateMarketplaceNames.add(name);
+            }
+        }
+        for (const name of [
+            ...marketplaceNamesRegisteredAtRoot(userClaudeSettings?.extraKnownMarketplaces, marketplaceRoot),
+            ...marketplaceNamesRegisteredAtRoot(projectClaudeSettings?.extraKnownMarketplaces, marketplaceRoot),
+            ...marketplaceNamesRegisteredAtRoot(claudeKnown, marketplaceRoot),
+            ...marketplaceNamesRegisteredAtRoot(claudeKnown?.marketplaces, marketplaceRoot),
+        ])
+            candidateMarketplaceNames.add(name);
+        const marketplaceName = strictRoot?.config.marketplaceName
+            ?? (candidateMarketplaceNames.size === 1 ? [...candidateMarketplaceNames][0] : null);
+        const sourceIdentity = typeof rawConfig?.sourceIdentity === 'string'
+            && /^sha256:[0-9a-f]{64}$/.test(rawConfig.sourceIdentity)
+            ? rawConfig.sourceIdentity
+            : undefined;
+        const codexMarketplace = marketplaceName
+            ? codexConfig?.snapshot.marketplaces[marketplaceName]
+            : undefined;
+        const codexMarketplaceIsCanonical = codexMarketplace?.sourceType === 'local'
+            && !codexMarketplace.sourcePointsToManifest
+            && path.normalize(codexMarketplace.source ?? '') === path.normalize(marketplaceRoot);
+        const consumers = [];
+        if (marketplaceName !== null
+            && (strictRoot !== null || (canonicalRoot && codexMarketplaceIsCanonical))) {
+            let residueNames = [];
+            try {
+                residueNames = await discoverCodexNativeResidueNames({
+                    cwd: options.cwd,
+                    env,
+                    marketplaceName,
+                    marketplaceRoot,
+                });
+            }
+            catch (error) {
+                const residueError = error instanceof CodexNativeResidueProbeError ? error : null;
+                const pluginName = residueError?.pluginName;
+                errors.push(inventoryError(error, residueError?.location ?? configPath, 'nativeStateRead', env, options.cwd, {
+                    global: false,
+                    sourceId: sourceEntry.name,
+                    ...(pluginName ? { pluginName } : {}),
+                    platform: 'codex',
+                    scope: 'user',
+                }));
+            }
+            for (const pluginName of residueNames) {
+                consumers.push({ pluginName, platform: 'codex', scope: 'user' });
+            }
+        }
+        if (marketplaceName !== null && (strictRoot !== null || codexMarketplaceIsCanonical)) {
+            for (const pluginId of Object.keys(codexConfig?.snapshot.plugins ?? {})) {
+                const pluginName = pluginNameFromMarketplaceId(pluginId, marketplaceName);
+                if (pluginName)
+                    consumers.push({ pluginName, platform: 'codex', scope: 'user' });
+            }
+        }
+        if (marketplaceName !== null) {
+            consumers.push(...claudeConsumersFromSettings(userClaudeSettings, marketplaceName, 'user'), ...claudeConsumersFromSettings(projectClaudeSettings, marketplaceName, 'project'));
+            try {
+                consumers.push(...claudeConsumersFromInstalled(claudeInstalled, marketplaceName, path.normalize(canonicalProjectRoot), options.includeHistoricalProjects === true));
+            }
+            catch (error) {
+                errors.push(inventoryError(error, claudeInstalledPath, 'nativeStateRead', env, options.cwd));
+            }
+        }
+        if (marketplaceName !== null && strictRoot !== null) {
+            references.push({
+                kind: 'namespacedMarketplace',
+                location: configPath,
+                sourceId: sourceEntry.name,
+                ...(sourceIdentity ? { sourceIdentity } : {}),
+                marketplaceName,
+            });
+        }
+        if (marketplaceName !== null) {
+            for (const consumer of consumers)
+                references.push({
+                    kind: 'namespacedMarketplace',
+                    location: configPath,
+                    sourceId: sourceEntry.name,
+                    ...(sourceIdentity ? { sourceIdentity } : {}),
+                    marketplaceName,
+                    ...consumer,
+                });
+        }
+    }
+    for (const reference of references) {
+        if (reference.scope === 'project' && reference.projectKey === undefined) {
+            reference.projectKey = canonicalProjectRoot;
+        }
+    }
+    const unique = [...new Map(references.map((reference) => [[
+                reference.kind,
+                reference.location,
+                reference.sourceId ?? '',
+                reference.sourceIdentity ?? '',
+                reference.pluginName ?? '',
+                reference.platform ?? '',
+                reference.scope ?? '',
+                reference.marketplaceName ?? '',
+                reference.projectKey ?? '',
+            ].join('\0'), reference])).values()];
+    unique.sort((left, right) => left.location.localeCompare(right.location));
+    return { inventorySchemaVersion: 1, references: unique, errors };
+}
+export class LegacyCatalogStateUnsupportedError extends Error {
+    code = 'legacyStateUnsupported';
+    inventory;
+    constructor(inventory) {
+        super('legacyStateUnsupported: legacy owner, config, lifecycle, or marketplace state must be migrated before catalog source identity changes.');
+        this.name = 'LegacyCatalogStateUnsupportedError';
+        this.inventory = inventory;
+    }
+}
+export class CatalogSourceReferencedError extends Error {
+    code = 'catalogSourceInUse';
+    inventory;
+    constructor(inventory) {
+        super(`catalogSourceInUse: catalog source has active references: ${inventory.references.map((reference) => reference.location).join(', ')}`);
+        this.name = 'CatalogSourceReferencedError';
+        this.inventory = inventory;
+    }
+}
+export class CatalogSourceInventoryIncompleteError extends Error {
+    code = 'stateInventoryFailed';
+    inventory;
+    constructor(inventory) {
+        super(`stateInventoryFailed: catalog source state inventory is incomplete: ${(inventory.errors ?? []).map((error) => `${error.kind}@${error.location}: ${error.message}`).join('; ')}`);
+        this.name = 'CatalogSourceInventoryIncompleteError';
+        this.inventory = inventory;
+    }
+}
+export function assertCatalogSourceInventoryComplete(inventory) {
+    if ((inventory.errors ?? []).length > 0)
+        throw new CatalogSourceInventoryIncompleteError(inventory);
+}
+export function assertCatalogSourceReferencesSupported(inventory) {
+    assertCatalogSourceInventoryComplete(inventory);
+    if (inventory.references.length > 0) {
+        if (inventory.references.some((reference) => reference.kind.startsWith('legacy'))) {
+            throw new LegacyCatalogStateUnsupportedError(inventory);
+        }
+        throw new CatalogSourceReferencedError(inventory);
+    }
+}
+//# sourceMappingURL=catalog-source-references.js.map