@lesliechan721/aw 0.1.0-beta.6 → 0.1.0-beta.60

package/dist/src/generators/local-plugin.js

@@ -4,14 +4,17 @@ import os from 'node:os';
 import path from 'node:path';
 import { promisify } from 'node:util';
 import fs from 'fs-extra';
+import { preparePluginNativeTools, validateManagedCommandSources } from '@lesliechan721/aw-plugin-core/manifest';
 import { renderResolvedHooksArtifact } from './hooks.js';
 import { buildGeneratedName } from './shared.js';
 import { applyFileRules } from '../utils/file-rules.js';
 import { calculateFileDigest } from '../utils/bundle-integrity.js';
 import { resolveCanonicalRuntimeSourceIdentity } from '../utils/catalog-runtime-projection.js';
 import { getArtifactSourceBundleRelativePath } from '../utils/artifact-sources.js';
+import { validateManagedCommandPackageClosure } from '../utils/managed-command-closure.js';
 import { resolvePlatformHookDefinitions } from '../utils/hooks-contract.js';
-import { assertManifestPlatformSupport, assertPluginInputTree, createBundleSourceManifest, createPlatformManifestBase, isIgnoredPluginInputDirectory, normalizePluginRelativePath, readPluginManifest, } from '../utils/manifest.js';
+import { assertManifestPlatformSupport, assertPluginInputTree, checkAwCapabilitySupport, computeAwCapabilitySetDigest, createAwPluginRequirementsReceipt, createBundleSourceManifest, createPlatformManifestBase, isIgnoredPluginInputDirectory, normalizePluginRelativePath, normalizeAwCapabilities, readPluginManifest, resolvePluginRequirements, } from '../utils/manifest.js';
+import { AwCapabilityUnsupportedError, IMPLEMENTED_AW_CAPABILITIES, } from '../commands/aw-capabilities.js';
 import { writeJsonFile } from '../utils/json.js';
 import { resolveSupportedPlatforms } from '../utils/platform-support.js';
 import { renderTemplate } from '../utils/template-engine.js';
@@ -21,7 +24,7 @@ import { isSkillAuthorOnlyPath, isSkillCollectionAuthorOnlyPath, } from '../util
 import { assertTestWritablePath } from '../utils/test-path-fence.js';
 import { resolveCliPackageRoot } from '../utils/paths.js';
 import { validateRuntimeSkillClosuresRoot, validateSkillRuntimeProjectionFreshness, } from '../utils/runtime-skill-closure.js';
-import { validatePortableSkillDirectoriesRoot } from '../utils/dynamic-skill-tree.js';
+import { AW_PLUGIN_REQUIREMENTS_RECEIPT_PATH, validatePortableSkillDirectoriesRoot, } from '../utils/dynamic-skill-tree.js';
 import { renderClaudeSlashCommand, renderCodexSlashCommandOpenAiYaml, renderCodexSlashCommandSkillMarkdown, resolveSlashCommands, } from '../utils/slash-commands.js';
 const execFileAsync = promisify(execFile);
 const requireFromCli = createRequire(import.meta.url);
@@ -32,7 +35,7 @@ const PLATFORM_MANIFEST_DIRS = {
     claude: '.claude-plugin',
     codex: '.codex-plugin',
 };
-const EXACT_PNPM_PACKAGE_MANAGER_PATTERN = /^pnpm@\d+\.\d+\.\d+$/u;
+const EXACT_PNPM_VERSION_PATTERN = /^\d+\.\d+\.\d+$/u;
 function assertLocalPluginStagingPathForTests(targetPath, source) {
     return assertTestWritablePath(targetPath, source, '用 createIsolatedTestEnv() 生成默认 TMPDIR，或通过 registerWritableStateRoot() 登记 local plugin staging 路径。');
 }
@@ -42,11 +45,14 @@ export async function validateStagingPackageManager(packageRoot) {
         readJsonObject(path.join(resolveCliPackageRoot(), 'package.json'), '@lesliechan721/aw package.json'),
         readJsonObject(path.join(packageRoot, 'package.json'), 'scripts.node.packageRoot.package.json'),
     ]);
-    const supportedPackageManager = cliPackageJson.packageManager;
-    if (typeof supportedPackageManager !== 'string'
-        || !EXACT_PNPM_PACKAGE_MANAGER_PATTERN.test(supportedPackageManager)) {
-        throw new Error('Invalid @lesliechan721/aw packageManager: expected an exact "pnpm@<version>" declaration.');
+    // pnpm pack removes packageManager, but preserves runtime dependencies.
+    const dependencies = cliPackageJson.dependencies;
+    const supportedPnpmVersion = dependencies?.pnpm;
+    if (typeof supportedPnpmVersion !== 'string'
+        || !EXACT_PNPM_VERSION_PATTERN.test(supportedPnpmVersion)) {
+        throw new Error('Invalid @lesliechan721/aw dependencies.pnpm: expected an exact "<major>.<minor>.<patch>" version.');
     }
+    const supportedPackageManager = `pnpm@${supportedPnpmVersion}`;
     if (packageJson.packageManager !== supportedPackageManager) {
         throw new Error('Invalid scripts.node.packageRoot.package.json.packageManager: '
             + `expected "${supportedPackageManager}".`);
@@ -98,34 +104,36 @@ async function resolveRuntimePnpmEntry(supportedPackageManager) {
     const stats = await fs.stat(entryPath).catch(() => undefined);
     return stats?.isFile() ? entryPath : undefined;
 }
-const defaultStagingRunner = {
-    async installPackageRoot(packageRoot) {
-        const supportedPackageManager = await validateStagingPackageManager(packageRoot);
-        const fixedPnpmEntry = await resolveFixedPnpmEntry(supportedPackageManager, process.env)
-            ?? await resolveRuntimePnpmEntry(supportedPackageManager);
-        if (!fixedPnpmEntry) {
-            throw new Error(`Cannot stage scripts.node.packageRoot: missing bundled ${supportedPackageManager} runtime dependency.`);
-        }
-        const args = [
-            fixedPnpmEntry,
-            'install',
-            '--frozen-lockfile',
-            '--ignore-scripts',
-        ];
-        await execFileAsync(process.execPath, args, {
-            cwd: packageRoot,
-            env: process.env,
-            maxBuffer: 10 * 1024 * 1024,
-        });
-    },
-    async runNodeBuild({ pluginRoot, scriptPath, args, env }) {
-        await execFileAsync(process.execPath, [path.join(pluginRoot, stripDotSlash(scriptPath)), ...args], {
-            cwd: pluginRoot,
-            env,
-            maxBuffer: 10 * 1024 * 1024,
-        });
-    },
-};
+function createDefaultStagingRunner(commandEnv) {
+    return {
+        async installPackageRoot(packageRoot) {
+            const supportedPackageManager = await validateStagingPackageManager(packageRoot);
+            const fixedPnpmEntry = await resolveFixedPnpmEntry(supportedPackageManager, commandEnv)
+                ?? await resolveRuntimePnpmEntry(supportedPackageManager);
+            if (!fixedPnpmEntry) {
+                throw new Error(`Cannot stage scripts.node.packageRoot: missing bundled ${supportedPackageManager} runtime dependency.`);
+            }
+            const args = [
+                fixedPnpmEntry,
+                'install',
+                '--frozen-lockfile',
+                '--ignore-scripts',
+            ];
+            await execFileAsync(process.execPath, args, {
+                cwd: packageRoot,
+                env: commandEnv,
+                maxBuffer: 10 * 1024 * 1024,
+            });
+        },
+        async runNodeBuild({ pluginRoot, scriptPath, args, env }) {
+            await execFileAsync(process.execPath, [path.join(pluginRoot, stripDotSlash(scriptPath)), ...args], {
+                cwd: pluginRoot,
+                env,
+                maxBuffer: 10 * 1024 * 1024,
+            });
+        },
+    };
+}
 function stripDotSlash(value) {
     return value.startsWith('./') ? value.slice(2) : value;
 }
@@ -239,6 +247,9 @@ async function assertArtifactSourceTreePortable(rootDir, fieldName, relativeRoot
             continue;
         if (isMacOsMetadataName(entry.name))
             continue;
+        if (relativePath === AW_PLUGIN_REQUIREMENTS_RECEIPT_PATH) {
+            throw new Error(`Invalid ${fieldName}: source root cannot declare reserved file ${AW_PLUGIN_REQUIREMENTS_RECEIPT_PATH}.`);
+        }
         const entryPath = path.join(rootDir, entry.name);
         if (entry.isSymbolicLink()) {
             throw new Error(`Invalid ${fieldName}: symbolic links are not supported (${entry.name}).`);
@@ -271,6 +282,19 @@ async function copyArtifactSourceDirectories(plugin, outputRoot) {
         }
     }
 }
+async function copyManagedCommandPackages(plugin, outputRoot) {
+    await validateManagedCommandSources(plugin.rootDir, plugin.manifest);
+    for (const commandPackage of plugin.manifest.managedCommands?.packages ?? []) {
+        const relativePath = stripDotSlash(commandPackage.sourceDir);
+        await fs.copy(path.join(plugin.rootDir, relativePath), path.join(outputRoot, relativePath), {
+            overwrite: true,
+            dereference: false,
+        });
+        const entries = (plugin.manifest.managedCommands?.sets ?? []).flatMap((set) => set.producer.kind === 'package' && set.producer.packageKey === commandPackage.key && set.mode === 'static' ? set.entries : []);
+        await validateManagedCommandPackageClosure(path.join(outputRoot, relativePath), entries);
+    }
+    await validateManagedCommandSources(outputRoot, plugin.manifest);
+}
 async function copyPortableStaticSkills(plugin, outputRoot) {
     const skillsPath = plugin.manifest.distributions?.agentSkills?.skills;
     if (!skillsPath)
@@ -289,6 +313,8 @@ async function copyPortableStaticSkills(plugin, outputRoot) {
 }
 async function resolveArtifactRuntimeImports(options) {
     const manifest = createBundleSourceManifest(options.plugin);
+    const requiredCapabilities = [];
+    const projections = [];
     for (const [targetIndex, target] of (manifest.artifacts?.targets ?? []).entries()) {
         for (const [importIndex, runtimeImport] of (target.runtimeImports ?? []).entries()) {
             if (!options.resolver) {
@@ -299,27 +325,64 @@ async function resolveArtifactRuntimeImports(options) {
                 reference: runtimeImport,
                 purpose: 'artifact-runtime',
             });
+            requiredCapabilities.push(...resolution.requiredCapabilities);
             const relativePath = `./.agents-plugin/runtime-imports/${target.id}/${runtimeImport.name}`;
             const targetPath = path.join(options.outputRoot, stripDotSlash(relativePath));
-            await fs.ensureDir(path.dirname(targetPath));
-            await fs.copyFile(resolution.sourcePath, targetPath);
-            const digest = await calculateFileDigest(targetPath);
-            if (digest !== resolution.sourceDigest) {
-                throw new Error(`Artifact runtime import digest mismatch at "${target.id}/${runtimeImport.name}".`);
-            }
+            const digest = resolution.sourceDigest;
+            projections.push({
+                sourcePath: resolution.sourcePath,
+                targetPath,
+                sourceDigest: resolution.sourceDigest,
+                label: `${target.id}/${runtimeImport.name}`,
+            });
             runtimeImport.resolved = {
                 path: relativePath,
                 digest,
                 providerPluginId: resolution.provider,
                 providerVersion: resolution.providerVersion,
                 source: resolution.source,
+                requiredCapabilities: resolution.requiredCapabilities,
+                capabilitySetDigest: resolution.capabilitySetDigest,
             };
         }
     }
     if (manifest.distributions?.agentSkills?.skills) {
         manifest.distributions.agentSkills.skills = './agent-skills/skills';
     }
-    return manifest;
+    return {
+        manifest,
+        requiredCapabilities: normalizeAwCapabilities(requiredCapabilities),
+        projections,
+    };
+}
+async function materializeArtifactRuntimeImports(projections) {
+    for (const projection of projections) {
+        await fs.ensureDir(path.dirname(projection.targetPath));
+        await fs.copyFile(projection.sourcePath, projection.targetPath);
+        if (await calculateFileDigest(projection.targetPath) !== projection.sourceDigest) {
+            throw new Error(`Artifact runtime import digest mismatch at "${projection.label}".`);
+        }
+    }
+}
+async function injectRequirementsReceipts(options) {
+    const receipt = createAwPluginRequirementsReceipt({ name: options.plugin.manifest.name, version: options.plugin.manifest.version }, options.requiredCapabilities);
+    for (const relativeRoot of ['claude/skills', 'codex/skills', 'agent-skills/skills']) {
+        const skillsRoot = path.join(options.outputRoot, relativeRoot);
+        if (!(await fs.pathExists(skillsRoot)))
+            continue;
+        for (const entry of await fs.readdir(skillsRoot, { withFileTypes: true })) {
+            if (!entry.isDirectory() || entry.isSymbolicLink())
+                continue;
+            const skillRoot = path.join(skillsRoot, entry.name);
+            if (!(await fs.pathExists(path.join(skillRoot, 'SKILL.md'))))
+                continue;
+            const receiptPath = path.join(skillRoot, 'aw-plugin-requirements.json');
+            if (await fs.pathExists(receiptPath)) {
+                throw new Error(`Reserved runtime requirements receipt conflicts with source content: ${receiptPath}`);
+            }
+            await writeJsonFile(receiptPath, receipt);
+        }
+    }
 }
 async function copySlashCommandAsset(pluginRoot, outputRoot, skillName, sourceRelativePath, generatedRelativePath) {
     const sourcePath = path.join(pluginRoot, sourceRelativePath);
@@ -433,30 +496,13 @@ async function addDeclaredLspServerFiles(plugin, value, targetFiles) {
     }
     return value;
 }
-function isNodeRuntimeEntry(entry) {
-    return entry.runner === 'node' || (entry.runner === 'auto' &&
-        NODE_RUNTIME_EXTENSIONS.has(path.posix.extname(entry.path).toLowerCase()));
-}
-function addLifecycleRuntimeEntries(plugin, rootFiles, nodeEntries) {
-    const lifecycle = plugin.manifest.scripts?.lifecycle;
-    if (!lifecycle) {
+function addPreApplyRuntimeEntry(plugin, rootFiles, nodeEntries) {
+    const entry = plugin.manifest.scripts?.preApply;
+    if (!entry)
         return;
-    }
-    for (const selector of Object.values(lifecycle)) {
-        if (!selector) {
-            continue;
-        }
-        for (const entry of Object.values(selector)) {
-            if (!entry) {
-                continue;
-            }
-            const filePath = stripDotSlash(entry.path);
-            rootFiles.add(filePath);
-            if (isNodeRuntimeEntry(entry)) {
-                nodeEntries.add(filePath);
-            }
-        }
-    }
+    const filePath = stripDotSlash(entry.path);
+    rootFiles.add(filePath);
+    nodeEntries.add(filePath);
 }
 function addHelperRuntimeEntries(plugin, rootFiles, nodeEntries) {
     const configHelper = plugin.manifest.scripts?.helpers?.config;
@@ -520,6 +566,9 @@ async function collectRuntimeClosureFiles(plugin, entryFiles) {
         entryFiles,
         dependencies,
         devDependencies,
+        runtimeConfigSkillRoots: (plugin.manifest.artifacts?.targets ?? [])
+            .filter((target) => target.runtimeConfig !== undefined)
+            .flatMap((target) => target.sourceDirs ?? []),
     });
     if (scan.errors.length > 0) {
         throw new Error(`Invalid scripts.node runtime imports:\n${scan.errors.join('\n')}`);
@@ -529,12 +578,25 @@ async function collectRuntimeClosureFiles(plugin, entryFiles) {
 async function collectAwRuntimeFiles(plugin) {
     const rootFiles = new Set();
     const nodeEntries = new Set();
-    addLifecycleRuntimeEntries(plugin, rootFiles, nodeEntries);
+    addPreApplyRuntimeEntry(plugin, rootFiles, nodeEntries);
     addHelperRuntimeEntries(plugin, rootFiles, nodeEntries);
     addArtifactRendererRuntimeEntry(plugin, rootFiles, nodeEntries);
-    for (const filePath of await collectRuntimeClosureFiles(plugin, [...nodeEntries])) {
+    if (plugin.manifest.nativeTools) {
+        rootFiles.add(stripDotSlash(plugin.manifest.nativeTools.reader));
+    }
+    const closureFiles = await collectRuntimeClosureFiles(plugin, [...nodeEntries]);
+    for (const filePath of closureFiles) {
         rootFiles.add(filePath);
     }
+    const configHelper = plugin.manifest.scripts?.helpers?.config;
+    if (configHelper) {
+        const helperDir = path.posix.dirname(stripDotSlash(configHelper));
+        const re2RuntimeRoot = path.posix.join(helperDir, 're2-wasm');
+        if (closureFiles.includes(path.posix.join(re2RuntimeRoot, 'build/src/re2.js'))) {
+            rootFiles.add(path.posix.join(re2RuntimeRoot, 'build/wasm/re2.wasm'));
+            rootFiles.add(path.posix.join(re2RuntimeRoot, 'LICENSE'));
+        }
+    }
     return [...rootFiles].sort();
 }
 function packageRootPath(plugin) {
@@ -718,6 +780,8 @@ function toRuntimeImportProvenance(resolution) {
         name: resolution.name,
         source: resolution.source,
         sourceDigest: resolution.sourceDigest,
+        requiredCapabilities: resolution.requiredCapabilities,
+        capabilitySetDigest: resolution.capabilitySetDigest,
     };
 }
 async function resolveOwnSkillRuntimeSource(plugin, source) {
@@ -823,6 +887,8 @@ async function projectSkillRuntimeFiles(options) {
                     name: entry.source,
                     source: entry.source,
                     sourceDigest,
+                    requiredCapabilities: [],
+                    capabilitySetDigest: computeAwCapabilitySetDigest([]),
                 };
             }
             else {
@@ -842,31 +908,37 @@ async function projectSkillRuntimeFiles(options) {
                 runtimeProvenance = toRuntimeImportProvenance(resolution);
             }
             const targetPath = path.join(options.outputRoot, platform ?? distribution, 'skills', entry.skill, ...entry.target.split('/'));
-            if (await fs.pathExists(targetPath)) {
-                throw new Error(`Invalid buildConfig.skillRuntimeFiles: bundle target already exists at "${claim}".`);
-            }
-            await fs.ensureDir(path.dirname(targetPath));
-            await fs.copyFile(sourcePath, targetPath);
-            const targetDigest = await calculateFileDigest(targetPath);
-            if (sourceDigest !== targetDigest) {
-                throw new Error(`Invalid buildConfig.skillRuntimeFiles: digest mismatch at "${claim}".`);
-            }
             projections.push({
                 bindingKey,
                 canonicalSource,
+                sourcePath,
+                targetPath,
                 provenance: {
                     ...runtimeProvenance,
                     platform,
                     distribution,
                     skill: entry.skill,
                     target: entry.target,
-                    targetDigest,
+                    targetDigest: sourceDigest,
                 },
             });
         }
     }
     return projections;
 }
+async function materializeSkillRuntimeFiles(projections) {
+    for (const projection of projections) {
+        if (await fs.pathExists(projection.targetPath)) {
+            const surface = projection.provenance.platform ?? projection.provenance.distribution;
+            throw new Error(`Invalid buildConfig.skillRuntimeFiles: bundle target already exists at "${surface}:${projection.provenance.skill}/${projection.provenance.target}".`);
+        }
+        await fs.ensureDir(path.dirname(projection.targetPath));
+        await fs.copyFile(projection.sourcePath, projection.targetPath);
+        if (await calculateFileDigest(projection.targetPath) !== projection.provenance.sourceDigest) {
+            throw new Error(`Canonical source "${projection.provenance.source}" changed during runtime Skill projection.`);
+        }
+    }
+}
 function hasSameCanonicalSource(left, right) {
     return left.rootPath === right.rootPath
         && left.rootRealPath === right.rootRealPath
@@ -883,6 +955,9 @@ async function validateSkillRuntimeProjectionSources(projections) {
                 || existing.provenance.name !== projection.provenance.name
                 || existing.provenance.source !== projection.provenance.source
                 || existing.provenance.sourceDigest !== projection.provenance.sourceDigest
+                || existing.provenance.capabilitySetDigest !== projection.provenance.capabilitySetDigest
+                || JSON.stringify(existing.provenance.requiredCapabilities)
+                    !== JSON.stringify(projection.provenance.requiredCapabilities)
                 || !hasSameCanonicalSource(existing.canonicalSource, projection.canonicalSource))) {
             throw new Error(`Canonical source "${projection.provenance.source}" changed during runtime Skill projection.`);
         }
@@ -912,6 +987,9 @@ async function validateBuildImportProjectionSources(projections) {
                 || existing.provenance.name !== projection.provenance.name
                 || existing.provenance.source !== projection.provenance.source
                 || existing.provenance.sourceDigest !== projection.provenance.sourceDigest
+                || existing.provenance.capabilitySetDigest !== projection.provenance.capabilitySetDigest
+                || JSON.stringify(existing.provenance.requiredCapabilities)
+                    !== JSON.stringify(projection.provenance.requiredCapabilities)
                 || !hasSameCanonicalSource(existing.canonicalSource, projection.canonicalSource))) {
             throw new Error(`Catalog runtime import "${projection.provenance.provider}/${projection.provenance.name}" changed during build import projection.`);
         }
@@ -930,7 +1008,7 @@ async function validateBuildImportProjectionSources(projections) {
         }
     }
 }
-async function createStagedPlugin(plugin, runner, resolver) {
+async function createStagedPlugin(plugin, runner, resolver, commandEnv = process.env) {
     const stagingRoot = await fs.mkdtemp(assertLocalPluginStagingPathForTests(path.join(os.tmpdir(), 'aw-plugin-staging-'), 'local plugin bundle staging root'));
     const stagingPluginRoot = assertLocalPluginStagingPathForTests(path.join(stagingRoot, 'plugin'), 'local plugin staged plugin root');
     try {
@@ -940,19 +1018,25 @@ async function createStagedPlugin(plugin, runner, resolver) {
                     && !isMacOsMetadataName(path.basename(source));
             },
         });
+        const nativeReader = await preparePluginNativeTools(stagingPluginRoot, plugin.manifest);
         const sourceBuild = plugin.manifest.scripts?.node?.build;
         const declaredBuildImports = plugin.manifest.buildConfig?.buildImports ?? [];
         if (declaredBuildImports.length > 0 && !sourceBuild) {
             throw new Error(`Invalid plugin "${plugin.manifest.name}": buildConfig.buildImports requires scripts.node.build.`);
         }
-        const buildEnv = { ...process.env };
+        const buildEnv = { ...commandEnv };
+        for (const key of Object.keys(buildEnv))
+            if (key.toUpperCase() === 'AW_PLUGIN_NATIVE_READER')
+                delete buildEnv[key];
+        if (nativeReader)
+            buildEnv.AW_PLUGIN_NATIVE_READER = nativeReader;
         const buildImportProvenance = [];
         const buildImportProjections = [];
         for (const buildImport of declaredBuildImports) {
             if (!resolver) {
                 throw new Error(`Cannot resolve buildConfig.buildImports for plugin "${plugin.manifest.name}": catalog runtime import resolver is required.`);
             }
-            if (Object.hasOwn(process.env, buildImport.env)) {
+            if (Object.hasOwn(commandEnv, buildImport.env)) {
                 throw new Error(`Invalid buildConfig.buildImports env "${buildImport.env}": refusing to overwrite an existing environment variable.`);
             }
             const resolution = await resolver.resolve({
@@ -1044,34 +1128,119 @@ async function resolveBuildPlugin(plugin, options) {
             cleanup: async () => { },
         };
     }
-    return createStagedPlugin(plugin, options.stagingRunner, options.runtimeResolver);
+    return createStagedPlugin(plugin, options.stagingRunner, options.runtimeResolver, options.commandEnv);
 }
 export async function prepareLocalPluginBundleSource(plugin, options = {}) {
     await assertPluginInputTree(plugin.rootDir);
     const buildOptions = {
         buildMode: options.buildMode ?? 'staging',
-        stagingRunner: options.stagingRunner ?? defaultStagingRunner,
+        stagingRunner: options.stagingRunner
+            ?? createDefaultStagingRunner(options.commandEnv ?? process.env),
+        commandEnv: options.commandEnv,
         runtimeResolver: options.runtimeResolver,
         preparedRuntimeContext: undefined,
     };
     return resolveBuildPlugin(plugin, buildOptions);
 }
+function assertPluginRequirementsSupported(pluginName, requirements, strictRequirements = false) {
+    if (requirements.unsupportedByCurrentAw.length > 0) {
+        throw new AwCapabilityUnsupportedError(pluginName, requirements.unsupportedByCurrentAw);
+    }
+    if (!strictRequirements)
+        return;
+    const satisfied = new Set([...requirements.declared, ...requirements.derived]);
+    const strictObservations = requirements.observations.filter((observation) => (observation.code !== 'aw-command-detected'
+        || observation.capability === undefined
+        || !satisfied.has(observation.capability)));
+    if (strictObservations.length > 0) {
+        const error = new Error(`Official strict requirements failed: ${strictObservations.map((observation) => (`plugin=${JSON.stringify(pluginName)} path=${JSON.stringify(observation.path)} `
+            + `command=${JSON.stringify(observation.command ?? '<dynamic>')} `
+            + `capability=${JSON.stringify(observation.capability ?? (observation.code === 'aw-command-dynamic' ? '<dynamic>' : '<unmapped>'))}`)).join('; ')}`);
+        error.code = 'awCapabilityStrictRequirements';
+        error.observations = strictObservations;
+        throw error;
+    }
+}
+function assertRequiredCapabilitiesSupported(pluginName, requiredCapabilities) {
+    const support = checkAwCapabilitySupport(requiredCapabilities, IMPLEMENTED_AW_CAPABILITIES);
+    if (!support.supported) {
+        throw new AwCapabilityUnsupportedError(pluginName, support.missing);
+    }
+}
 export async function bundleLocalPlugin(plugin, outputRoot, options = {}) {
+    const historicalComparison = options.runtimeSkillClosureValidation === 'historical';
     const buildOptions = {
         buildMode: options.buildMode ?? 'build-free',
-        stagingRunner: options.stagingRunner ?? defaultStagingRunner,
+        stagingRunner: options.stagingRunner
+            ?? createDefaultStagingRunner(options.commandEnv ?? process.env),
+        commandEnv: options.commandEnv,
         runtimeResolver: options.runtimeResolver,
         preparedRuntimeContext: options.preparedRuntimeContext,
     };
     await assertPluginInputTree(plugin.rootDir);
+    const sourceRequirements = await resolvePluginRequirements({
+        pluginRoot: plugin.rootDir,
+        manifest: plugin.manifest,
+        implementedCapabilities: IMPLEMENTED_AW_CAPABILITIES,
+    });
+    if (!historicalComparison) {
+        assertPluginRequirementsSupported(plugin.manifest.name, sourceRequirements, options.strictRequirements ?? false);
+    }
     await fs.remove(outputRoot);
     const buildPlugin = await resolveBuildPlugin(plugin, buildOptions);
     try {
         plugin = buildPlugin.plugin;
+        const requirements = await resolvePluginRequirements({
+            pluginRoot: plugin.rootDir,
+            manifest: plugin.manifest,
+            implementedCapabilities: IMPLEMENTED_AW_CAPABILITIES,
+        });
+        if (!historicalComparison) {
+            assertPluginRequirementsSupported(plugin.manifest.name, requirements, options.strictRequirements ?? false);
+        }
         assertManifestPlatformSupport(plugin.manifest.name, plugin.manifest);
-        await fs.ensureDir(outputRoot);
         const supportedPlatforms = resolveSupportedPlatforms(plugin.manifest);
         await assertSkillRuntimeProjectionTargets(plugin);
+        const skillRuntimeFileProjections = await projectSkillRuntimeFiles({
+            plugin,
+            outputRoot,
+            supportedPlatforms,
+            resolver: buildPlugin.runtimeContext.resolver,
+        });
+        const skillRuntimeFiles = skillRuntimeFileProjections.map(({ provenance }) => provenance);
+        const portableRuntimeFiles = skillRuntimeFiles
+            .filter((entry) => entry.distribution === 'agent-skills')
+            .map((entry) => ({
+            skill: entry.skill,
+            target: entry.target,
+            path: `./agent-skills/skills/${entry.skill}/${entry.target}`,
+            digest: entry.targetDigest,
+            provider: entry.provider,
+            providerVersion: entry.providerVersion,
+            exportName: entry.name,
+            source: entry.source,
+            sourceDigest: entry.sourceDigest,
+            requiredCapabilities: entry.requiredCapabilities,
+            capabilitySetDigest: entry.capabilitySetDigest,
+        }));
+        const artifactRuntimeProjection = await resolveArtifactRuntimeImports({
+            plugin,
+            outputRoot,
+            resolver: buildPlugin.runtimeContext.resolver,
+        });
+        const finalEffective = normalizeAwCapabilities([
+            ...requirements.effective,
+            ...skillRuntimeFiles.flatMap((entry) => entry.requiredCapabilities),
+            ...artifactRuntimeProjection.requiredCapabilities,
+        ]);
+        if (!historicalComparison) {
+            assertRequiredCapabilitiesSupported(plugin.manifest.name, finalEffective);
+        }
+        artifactRuntimeProjection.manifest.requires = {
+            aw: { capabilities: finalEffective },
+        };
+        const bundleManifest = artifactRuntimeProjection.manifest;
+        await fs.ensureDir(outputRoot);
         const platformFiles = {};
         const platformManifests = {};
         const buildConfig = plugin.manifest.buildConfig;
@@ -1186,26 +1355,7 @@ export async function bundleLocalPlugin(plugin, outputRoot, options = {}) {
                 }
             }
         }
-        const skillRuntimeFileProjections = await projectSkillRuntimeFiles({
-            plugin,
-            outputRoot,
-            supportedPlatforms,
-            resolver: buildPlugin.runtimeContext.resolver,
-        });
-        const skillRuntimeFiles = skillRuntimeFileProjections.map(({ provenance }) => provenance);
-        const portableRuntimeFiles = skillRuntimeFiles
-            .filter((entry) => entry.distribution === 'agent-skills')
-            .map((entry) => ({
-            skill: entry.skill,
-            target: entry.target,
-            path: `./agent-skills/skills/${entry.skill}/${entry.target}`,
-            digest: entry.targetDigest,
-            provider: entry.provider,
-            providerVersion: entry.providerVersion,
-            exportName: entry.name,
-            source: entry.source,
-            sourceDigest: entry.sourceDigest,
-        }));
+        await materializeSkillRuntimeFiles(skillRuntimeFileProjections);
         await copyPortableStaticSkills(plugin, outputRoot);
         if (await fs.pathExists(path.join(plugin.rootDir, 'README.md'))) {
             await copyBundleRootFile(plugin.rootDir, outputRoot, 'README.md');
@@ -1214,12 +1364,9 @@ export async function bundleLocalPlugin(plugin, outputRoot, options = {}) {
             await copyBundleRootFile(plugin.rootDir, outputRoot, filePath);
         }
         await copyArtifactSourceDirectories(plugin, outputRoot);
+        await copyManagedCommandPackages(plugin, outputRoot);
         await copyProductionPackageRoot(plugin, outputRoot);
-        const bundleManifest = await resolveArtifactRuntimeImports({
-            plugin,
-            outputRoot,
-            resolver: buildPlugin.runtimeContext.resolver,
-        });
+        await materializeArtifactRuntimeImports(artifactRuntimeProjection.projections);
         await writeJsonFile(path.join(outputRoot, '.agents-plugin', 'plugin.json'), bundleManifest);
         if (portableRuntimeFiles.length > 0) {
             await writeJsonFile(path.join(outputRoot, '.agents-plugin', 'portable-runtime-files.json'), portableRuntimeFiles);
@@ -1231,6 +1378,11 @@ export async function bundleLocalPlugin(plugin, outputRoot, options = {}) {
             }
             await writeJsonFile(path.join(outputRoot, PLATFORM_MANIFEST_DIRS[platform], 'plugin.json'), manifest);
         }
+        await injectRequirementsReceipts({
+            outputRoot,
+            plugin,
+            requiredCapabilities: finalEffective,
+        });
         await validateSkillRuntimeProjectionSources(skillRuntimeFileProjections);
         await validateSkillRuntimeProjectionFreshness(outputRoot, skillRuntimeFiles.filter((entry) => entry.platform !== undefined));
         await validateGeneratedSkillRuntimeFiles(plugin, outputRoot, supportedPlatforms);