@openrig/cli 0.3.1 → 0.3.3-rc.0

package/daemon/dist/domain/bundle-plugins-router.js

@@ -0,0 +1,87 @@
+/**
+ * Bundle plugins router (Item 6 / slice-05 Checkpoint 7.3c).
+ *
+ * Pure function. Copies plugin trees declared in a bundle manifest's
+ * plugins[] block from the bundle's extracted tree to the operator plugins
+ * library (per-id subdir). Mirrors the bundle-skills-router pattern: FsOps
+ * injection; both-sides path containment (banked
+ * feedback_pre_existing_trust_boundary_reuse_canonical_helper addendum:
+ * contain BOTH source AND target when handling untrusted path input);
+ * missing source surfaces as status=missing; unsafe paths rejected with
+ * status=unsafe.
+ *
+ * Per orch-ratified HYBRID decision: v0 source.kind is local only (path
+ * under the bundle's extracted tree). Other kinds (external operator-host
+ * paths, remote fetch) reserved for future.
+ *
+ * /install handler integration lands at Checkpoint 7.3d.
+ */
+import nodePath from "node:path";
+/**
+ * Route each declared plugin from the bundle tree to the operator plugins
+ * library as <targetPluginsDir>/<id>/. Per-plugin safety: BOTH source path
+ * (under bundleRoot) AND target path (under targetPluginsDir) are
+ * containment-checked. Banked both-sides-of-trust-boundary lesson applied.
+ */
+export function routePlugins(input, fs) {
+    const records = [];
+    const bundleRootResolved = nodePath.resolve(input.bundleRoot);
+    const targetRootResolved = nodePath.resolve(input.targetPluginsDir);
+    fs.mkdirp(input.targetPluginsDir);
+    for (const plugin of input.declaredPlugins) {
+        if (!plugin.id || plugin.source.kind !== "local") {
+            records.push({
+                id: plugin.id || "(unknown)",
+                status: "unsafe",
+                detail: `plugin reference invalid: id required and source.kind must be 'local' (other kinds reserved for future)`,
+            });
+            continue;
+        }
+        // Source containment: source.path must resolve inside bundleRoot
+        const sourceAbs = nodePath.resolve(input.bundleRoot, plugin.source.path);
+        if (sourceAbs !== bundleRootResolved && !sourceAbs.startsWith(bundleRootResolved + nodePath.sep)) {
+            records.push({
+                id: plugin.id,
+                status: "unsafe",
+                detail: `plugin source path '${plugin.source.path}' escapes bundle workspace; rejected`,
+            });
+            continue;
+        }
+        if (!fs.exists(sourceAbs)) {
+            records.push({
+                id: plugin.id,
+                status: "missing",
+                detail: `plugin source '${plugin.source.path}' not present in bundle; skipped`,
+            });
+            continue;
+        }
+        if (!fs.isDirectory(sourceAbs)) {
+            records.push({
+                id: plugin.id,
+                status: "not_directory",
+                detail: `plugin source '${plugin.source.path}' is not a directory; skipped`,
+            });
+            continue;
+        }
+        // Target containment: id must produce a path inside targetPluginsDir
+        const targetAbs = nodePath.resolve(input.targetPluginsDir, plugin.id);
+        if (targetAbs !== targetRootResolved && !targetAbs.startsWith(targetRootResolved + nodePath.sep)) {
+            records.push({
+                id: plugin.id,
+                status: "unsafe",
+                detail: `plugin id '${plugin.id}' would resolve outside target plugins library; rejected`,
+            });
+            continue;
+        }
+        fs.copyDir(sourceAbs, targetAbs);
+        records.push({
+            id: plugin.id,
+            status: "routed",
+            installedAt: targetAbs,
+        });
+    }
+    const routedCount = records.filter((r) => r.status === "routed").length;
+    const rejectedCount = records.length - routedCount;
+    return { records, routedCount, rejectedCount };
+}
+//# sourceMappingURL=bundle-plugins-router.js.map

package/daemon/dist/domain/bundle-plugins-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-plugins-router.js","sourceRoot":"","sources":["../../src/domain/bundle-plugins-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,QAAQ,MAAM,WAAW,CAAC;AA+CjC;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB,EAAE,EAAsB;IAC3E,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAElC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,WAAW;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,yGAAyG;aAClH,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,iEAAiE;QACjE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,SAAS,KAAK,kBAAkB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,uBAAuB,MAAM,CAAC,MAAM,CAAC,IAAI,sCAAsC;aACxF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,kBAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,kCAAkC;aAC/E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,kBAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,+BAA+B;aAC5E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,SAAS,KAAK,kBAAkB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,cAAc,MAAM,CAAC,EAAE,0DAA0D;aAC1F,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACjD,CAAC"}

package/daemon/dist/domain/bundle-skills-router.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Bundle skills router (Item 6 / slice-05 Checkpoint 7.2).
+ *
+ * Pure function. Copies skill files declared in a bundle manifest's skills[]
+ * block from the bundle's extracted tree to the operator skills library.
+ * No daemon dependencies — fully unit-testable via FsOps injection.
+ *
+ * Safety: each declared skill path is treated as untrusted manifest content;
+ * the helper rejects paths that escape the bundle tree (path containment
+ * check mirrors the bundle-source-resolver pattern). The output target
+ * directory is created via mkdirp.
+ *
+ * Honest-scoping: missing source files surface as warnings in the result
+ * (NOT thrown errors) so the install lifecycle can continue with what's
+ * available. Same for absent skills library: caller decides to skip-or-fail.
+ *
+ * /install handler integration lands at Checkpoint 7.3.
+ */
+/** Filesystem injection point — real impl wraps node:fs. Tests substitute in-memory. */
+export interface SkillsRouterFsOps {
+    exists: (path: string) => boolean;
+    readFile: (path: string) => string;
+    writeFile: (path: string, content: string) => void;
+    mkdirp: (path: string) => void;
+}
+/** Inputs to routeSkills. */
+export interface RouteSkillsInput {
+    /** Absolute path to the bundle's extracted root (tmp dir from unpack). */
+    bundleRoot: string;
+    /** Relative skill paths declared in the manifest's skills[] block. */
+    declaredSkills: string[];
+    /** Absolute path to the operator skills library (default ~/.openrig/skills). */
+    targetSkillsDir: string;
+}
+/** One routed skill (or one rejection). */
+export interface RoutedSkillRecord {
+    /** Declared path from manifest.skills[]. */
+    declaredPath: string;
+    /** "routed" = copied successfully; "missing" = source not in bundle;
+     * "unsafe" = escapes bundle workspace; "no_library" = target dir not
+     * present and caller did not request creation (reserved for future
+     * library-reachability mode). */
+    status: "routed" | "missing" | "unsafe";
+    /** Where the skill landed in the target library (absolute path), if routed. */
+    installedAt?: string;
+    /** Human-readable detail (3-part error shape input for caller). */
+    detail?: string;
+}
+/** Aggregate routing result. */
+export interface RouteSkillsResult {
+    records: RoutedSkillRecord[];
+    routedCount: number;
+    rejectedCount: number;
+}
+/**
+ * Route each declared skill from the bundle tree to the operator skills
+ * library. Per-skill safety: resolved source path must stay inside bundleRoot;
+ * skipped if missing from bundle. Caller writes the install audit record
+ * (Item 4 chain) using the records returned here.
+ */
+export declare function routeSkills(input: RouteSkillsInput, fs: SkillsRouterFsOps): RouteSkillsResult;
+//# sourceMappingURL=bundle-skills-router.d.ts.map

package/daemon/dist/domain/bundle-skills-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-skills-router.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-skills-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,6BAA6B;AAC7B,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB;;;qCAGiC;IACjC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACxC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gCAAgC;AAChC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,GAAG,iBAAiB,CAiE7F"}

package/daemon/dist/domain/bundle-skills-router.js

@@ -0,0 +1,90 @@
+/**
+ * Bundle skills router (Item 6 / slice-05 Checkpoint 7.2).
+ *
+ * Pure function. Copies skill files declared in a bundle manifest's skills[]
+ * block from the bundle's extracted tree to the operator skills library.
+ * No daemon dependencies — fully unit-testable via FsOps injection.
+ *
+ * Safety: each declared skill path is treated as untrusted manifest content;
+ * the helper rejects paths that escape the bundle tree (path containment
+ * check mirrors the bundle-source-resolver pattern). The output target
+ * directory is created via mkdirp.
+ *
+ * Honest-scoping: missing source files surface as warnings in the result
+ * (NOT thrown errors) so the install lifecycle can continue with what's
+ * available. Same for absent skills library: caller decides to skip-or-fail.
+ *
+ * /install handler integration lands at Checkpoint 7.3.
+ */
+import nodePath from "node:path";
+/**
+ * Route each declared skill from the bundle tree to the operator skills
+ * library. Per-skill safety: resolved source path must stay inside bundleRoot;
+ * skipped if missing from bundle. Caller writes the install audit record
+ * (Item 4 chain) using the records returned here.
+ */
+export function routeSkills(input, fs) {
+    const records = [];
+    const bundleRootResolved = nodePath.resolve(input.bundleRoot);
+    const targetRootResolved = nodePath.resolve(input.targetSkillsDir);
+    fs.mkdirp(input.targetSkillsDir);
+    for (const declared of input.declaredSkills) {
+        const sourceAbs = nodePath.resolve(input.bundleRoot, declared);
+        // Defense-in-depth path-containment on SOURCE (mirrors bundle-source-
+        // resolver pattern; the manifest validator already rejects unsafe paths
+        // via isRelativeSafePath but we re-check here in case the input bypassed
+        // validation upstream).
+        if (sourceAbs !== bundleRootResolved && !sourceAbs.startsWith(bundleRootResolved + nodePath.sep)) {
+            records.push({
+                declaredPath: declared,
+                status: "unsafe",
+                detail: `skill path '${declared}' escapes bundle workspace; rejected`,
+            });
+            continue;
+        }
+        if (!fs.exists(sourceAbs)) {
+            records.push({
+                declaredPath: declared,
+                status: "missing",
+                detail: `skill source '${declared}' not present in bundle; skipped`,
+            });
+            continue;
+        }
+        // Target path mirrors the declared path under the target skills directory.
+        // Operator's skill library inherits the bundle's directory layout for the
+        // declared skills (e.g., skills/foo/SKILL.md → <target>/foo/SKILL.md);
+        // strip the leading "skills/" prefix if present so the target dir is the
+        // root of the operator's skill tree.
+        const declaredTrimmed = declared.startsWith("skills/") ? declared.slice("skills/".length) : declared;
+        const targetAbs = nodePath.resolve(input.targetSkillsDir, declaredTrimmed);
+        // Defense-in-depth path-containment on TARGET (B1 repair on
+        // qitem-20260518215234-f84fff45). The leading "skills/" strip can promote
+        // a relative segment that looks safe under bundleRoot (e.g.
+        // "skills/../outside/SKILL.md" passes source-containment because the bundle
+        // tree may contain "outside/SKILL.md", but stripping yields
+        // "../outside/SKILL.md" which would escape targetSkillsDir). Reject if the
+        // target resolves outside the target library. Banked lesson:
+        // feedback_pre_existing_trust_boundary_reuse_canonical_helper — contain
+        // BOTH source and target when handling untrusted path input.
+        if (targetAbs !== targetRootResolved && !targetAbs.startsWith(targetRootResolved + nodePath.sep)) {
+            records.push({
+                declaredPath: declared,
+                status: "unsafe",
+                detail: `skill target path for '${declared}' escapes target skills library; rejected`,
+            });
+            continue;
+        }
+        fs.mkdirp(nodePath.dirname(targetAbs));
+        const content = fs.readFile(sourceAbs);
+        fs.writeFile(targetAbs, content);
+        records.push({
+            declaredPath: declared,
+            status: "routed",
+            installedAt: targetAbs,
+        });
+    }
+    const routedCount = records.filter((r) => r.status === "routed").length;
+    const rejectedCount = records.length - routedCount;
+    return { records, routedCount, rejectedCount };
+}
+//# sourceMappingURL=bundle-skills-router.js.map

package/daemon/dist/domain/bundle-skills-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-skills-router.js","sourceRoot":"","sources":["../../src/domain/bundle-skills-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,QAAQ,MAAM,WAAW,CAAC;AA0CjC;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB,EAAE,EAAqB;IACxE,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACnE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAEjC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/D,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,wBAAwB;QACxB,IAAI,SAAS,KAAK,kBAAkB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY,EAAE,QAAQ;gBACtB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,eAAe,QAAQ,sCAAsC;aACtE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY,EAAE,QAAQ;gBACtB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,iBAAiB,QAAQ,kCAAkC;aACpE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,qCAAqC;QACrC,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrG,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QAC3E,4DAA4D;QAC5D,0EAA0E;QAC1E,4DAA4D;QAC5D,4EAA4E;QAC5E,4DAA4D;QAC5D,2EAA2E;QAC3E,6DAA6D;QAC7D,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,SAAS,KAAK,kBAAkB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY,EAAE,QAAQ;gBACtB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,0BAA0B,QAAQ,2CAA2C;aACtF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC;YACX,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACjD,CAAC"}

package/daemon/dist/domain/bundle-types.d.ts

@@ -1,3 +1,85 @@
+/**
+ * Provenance block — attribution metadata for a bundle artifact. All fields
+ * optional for backward compat; bundles without provenance install unchanged.
+ * Captured by the bundle-assembler at create time; surfaced in inspect output
+ * and audit-trail records. Not cryptographically signed at this stage.
+ */
+export interface BundleProvenance {
+    /** ISO timestamp; mirrors root createdAt at create time. */
+    createdAt?: string;
+    /** os.hostname() of the host that ran rig bundle create. */
+    sourceHost?: string;
+    /** Canonical session name of the creator (e.g. velocity-driver@openrig-velocity). */
+    authorSession?: string;
+    /** ULID of the source rig, if creating from a live rig. */
+    sourceRigId?: string;
+    /** Name of the source rig, if creating from a live rig. */
+    sourceRigName?: string;
+    /** Daemon version at create time (e.g. 0.3.2). */
+    daemonVersion?: string;
+    /** CLI version at create time (e.g. 0.3.2). */
+    cliVersion?: string;
+    /** Operator-authored notes from the --notes flag on rig bundle create. */
+    notes?: string;
+}
+/**
+ * Cross-primitive bundling — Item 6 / slice-05 Checkpoint 7.1.
+ *
+ * Manifest may optionally declare typed sibling primitives the bundle should
+ * route to their respective libraries on install. v0 ships the `skills` kind
+ * (Checkpoint 7.1). Plugins + workflow_specs + context_packs + agent_images
+ * land additively in subsequent checkpoints as their libraries are reachable.
+ *
+ * PRD §Item 6: bundles list these alongside the existing rig + agents +
+ * packages fields (no `contents:` re-grouping — that would be a schema
+ * reorg violating the no-bump constraint). Each kind is an optional top-
+ * level field; missing kinds keep backward compat.
+ */
+/**
+ * Plugin reference — Item 6 / slice-05 Checkpoint 7.3b. Bundle manifest may
+ * declare plugin references the bundle includes (in HYBRID mode the bundle
+ * REFERENCES the existing 0.3.1 plugin rather than forking its content; per
+ * orch-ratified decision doc).
+ */
+export interface BundlePluginReference {
+    /** Plugin id (matches the plugin primitive's id surface). */
+    id: string;
+    /** Where to resolve the plugin from. v0 supports local-path source. */
+    source: {
+        kind: "local";
+        path: string;
+    };
+}
+/**
+ * Compatibility block — operator-declared install-time requirements for a
+ * bundle artifact. All fields optional; missing block keeps backward compat
+ * (bundles install unchanged). Install-time version check (Item 2 Checkpoint
+ * 3.3) consults this block before bootstrap delegation; --skip-version-check
+ * is the operator-explicit override.
+ */
+export interface BundleCompatibility {
+    /** Minimum daemon version required to install this bundle (semver string). */
+    minDaemonVersion?: string;
+    /** Minimum CLI version required to install this bundle (semver string). */
+    minCliVersion?: string;
+    /** Schema version reaffirmed; mirrors root schemaVersion when set. */
+    schemaVersion?: number;
+}
+/**
+ * Normalize raw snake_case compatibility to typed camelCase BundleCompatibility.
+ * Returns undefined when absent or empty. Exported alongside the provenance
+ * normalizer so the v2 inspect-route projection can produce a single
+ * camelCase shape for both manifest schemas.
+ */
+export declare function normalizeCompatibilityBlock(raw: unknown): BundleCompatibility | undefined;
+/**
+ * Normalize raw snake_case provenance (as parsed from YAML or received from
+ * a request body) to typed camelCase BundleProvenance. Returns undefined when
+ * absent or empty. Exported so both the v1 normalizer pipeline and the v2
+ * inspect-route projection produce identical camelCase shapes — the
+ * /api/bundles/inspect contract is one shape regardless of schema version.
+ */
+export declare function normalizeProvenanceBlock(raw: unknown): BundleProvenance | undefined;
 export interface PodBundleAgentImportEntry {
     name: string;
     version: string;
@@ -22,6 +104,18 @@ export interface PodBundleManifest {
     agents: PodBundleAgentEntry[];
     cultureFile?: string;
     integrity?: BundleIntegrity;
+    provenance?: BundleProvenance;
+    compatibility?: BundleCompatibility;
+    /** Item 6 cross-primitive bundling: skill paths to route to the operator skills library on install. */
+    skills?: string[];
+    /** Item 6 cross-primitive bundling: plugin references to install via the plugin primitive (HYBRID-mode bundles reference existing plugins rather than forking content). */
+    plugins?: BundlePluginReference[];
+    /** Item 6 cross-primitive bundling: workflow spec YAML paths to route to the operator workflow-specs library on install (Checkpoint 7.3e). */
+    workflowSpecs?: string[];
+    /** Item 6 cross-primitive bundling: paths to context-pack manifest.yaml files; router copies the parent dir to the operator context-packs library on install (Checkpoint 7.3f). */
+    contextPacks?: string[];
+    /** Item 6 cross-primitive bundling: paths to agent-image DIRECTORIES (per PRD §Item 6 line 197); router copies the declared directory to the operator agent-images library on install. Consumer requires manifest.yaml inside each image dir. (Checkpoint 7.3g) */
+    agentImages?: string[];
 }
 export declare function validatePodBundleManifest(raw: unknown): {
     valid: boolean;
@@ -52,6 +146,18 @@ export interface LegacyBundleManifest {
     rigSpec: string;
     packages: LegacyBundlePackageEntry[];
     integrity?: BundleIntegrity;
+    provenance?: BundleProvenance;
+    compatibility?: BundleCompatibility;
+    /** Item 6 cross-primitive bundling: skill paths to route to the operator skills library on install. */
+    skills?: string[];
+    /** Item 6 cross-primitive bundling: plugin references to install via the plugin primitive (HYBRID-mode bundles reference existing plugins rather than forking content). */
+    plugins?: BundlePluginReference[];
+    /** Item 6 cross-primitive bundling: workflow spec YAML paths to route to the operator workflow-specs library on install (Checkpoint 7.3e). */
+    workflowSpecs?: string[];
+    /** Item 6 cross-primitive bundling: paths to context-pack manifest.yaml files; router copies the parent dir to the operator context-packs library on install (Checkpoint 7.3f). */
+    contextPacks?: string[];
+    /** Item 6 cross-primitive bundling: paths to agent-image DIRECTORIES (per PRD §Item 6 line 197); router copies the declared directory to the operator agent-images library on install. Consumer requires manifest.yaml inside each image dir. (Checkpoint 7.3g) */
+    agentImages?: string[];
 }
 /** Validation options */
 interface ValidateOptions {

package/daemon/dist/domain/bundle-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-types.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-types.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,yBAAyB,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAyB5F;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAyB9E;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAKD,oDAAoD;AACpD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,QAAQ,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,+BAA+B;AAC/B,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,yBAAyB;AACzB,UAAU,eAAe;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CASrD;AAED,4CAA4C;AAC5C,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,OAAO,EACZ,IAAI,CAAC,EAAE,eAAe,GACrB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAgEtC;AAED,+CAA+C;AAC/C,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,kEAAkE;AAClE,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAiChF;AAED,+CAA+C;AAC/C,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAwBpF"}
+{"version":3,"file":"bundle-types.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-types.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0CD;;;;;;;;;;;;GAYG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAoLD;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA8BD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAQzF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAanF;AAID,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,yBAAyB,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2KAA2K;IAC3K,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClC,8IAA8I;IAC9I,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,mLAAmL;IACnL,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mQAAmQ;IACnQ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAiC5F;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAgC9E;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAKD,oDAAoD;AACpD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,QAAQ,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,+BAA+B;AAC/B,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2KAA2K;IAC3K,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClC,8IAA8I;IAC9I,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,mLAAmL;IACnL,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mQAAmQ;IACnQ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,yBAAyB;AACzB,UAAU,eAAe;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CASrD;AAED,4CAA4C;AAC5C,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,OAAO,EACZ,IAAI,CAAC,EAAE,eAAe,GACrB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAwEtC;AAED,+CAA+C;AAC/C,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,kEAAkE;AAClE,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAsDhF;AAED,+CAA+C;AAC/C,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAkCpF"}