@openrig/cli 0.5.15 → 0.5.17

package/node_modules/@openrig/daemon/dist/domain/skill-catalog.js

@@ -1,827 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { execFileSync } from "node:child_process";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
-import nodePath from "node:path";
-import { parse as parseYaml } from "yaml";
-import { parseSkillFrontmatter } from "./skill-discovery.js";
-const CATALOG_SCHEMA = "openrig.skill-catalog/v1";
-const MANIFEST_SCHEMA = "openrig.skill-loadout/v1";
-const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
-const SAFE_TOPOLOGY_OWNER = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,255}$/;
-const SHA256 = /^[a-f0-9]{64}$/;
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function sha256(content) {
-    return createHash("sha256").update(content).digest("hex");
-}
-function compareBytes(a, b) {
-    return a < b ? -1 : a > b ? 1 : 0;
-}
-function pathEntryExists(path) {
-    try {
-        lstatSync(path);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function isSafeRelativePath(path) {
-    return path.length > 0
-        && !nodePath.posix.isAbsolute(path)
-        && !path.split("/").some((part) => part === "" || part === "." || part === "..");
-}
-function isWithin(parent, child) {
-    const relative = nodePath.relative(parent, child);
-    return relative !== "" && relative !== ".." && !relative.startsWith(`..${nodePath.sep}`) && !nodePath.isAbsolute(relative);
-}
-function readYamlObject(path) {
-    let parsed;
-    try {
-        parsed = parseYaml(readFileSync(path, "utf8"));
-    }
-    catch (err) {
-        throw new Error(`${path} is not valid YAML: ${err.message}`);
-    }
-    if (!isRecord(parsed))
-        throw new Error(`${path} must contain a YAML object`);
-    return parsed;
-}
-function readStringList(value, label) {
-    if (value === undefined || value === null)
-        return [];
-    if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && SAFE_ID.test(entry))) {
-        throw new Error(`${label} must be a list of bounded skill identities`);
-    }
-    return value;
-}
-export function readSystemSkillSelection(catalogRoot) {
-    const manifestPath = nodePath.join(catalogRoot, "catalog.yaml");
-    if (!existsSync(manifestPath))
-        return [];
-    const manifest = readYamlObject(manifestPath);
-    if (manifest["schema"] !== CATALOG_SCHEMA) {
-        throw new Error(`${manifestPath} must declare schema: ${CATALOG_SCHEMA}`);
-    }
-    return readStringList(manifest["system"], `${manifestPath} system`);
-}
-export function readProjectSkillSelection(projectRoot) {
-    const manifestPath = nodePath.join(projectRoot, "project.yaml");
-    if (!existsSync(manifestPath))
-        return [];
-    const manifest = readYamlObject(manifestPath);
-    const install = manifest["install"];
-    if (install === undefined || install === null)
-        return [];
-    if (!isRecord(install))
-        throw new Error(`${manifestPath} install must be a YAML object`);
-    return readStringList(install["skills"], `${manifestPath} install.skills`);
-}
-export function inspectSkillDirectory(root) {
-    const rootStat = lstatSync(root);
-    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
-        throw new Error(`managed skill target must be a real directory, not a symlink or file: ${root}`);
-    }
-    const files = {};
-    const fileModes = {};
-    const walk = (dir, prefix) => {
-        for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => compareBytes(a.name, b.name))) {
-            const absolute = nodePath.join(dir, entry.name);
-            const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
-            const stat = lstatSync(absolute);
-            if (stat.isSymbolicLink())
-                throw new Error(`symlink is not allowed in a managed skill: ${absolute}`);
-            if (stat.isDirectory())
-                walk(absolute, relative);
-            else if (stat.isFile()) {
-                files[relative] = sha256(readFileSync(absolute));
-                fileModes[relative] = stat.mode & 0o777;
-            }
-            else
-                throw new Error(`unsupported filesystem entry in a managed skill: ${absolute}`);
-        }
-    };
-    walk(root, "");
-    const digest = sha256(Object.keys(files).sort(compareBytes)
-        .map((path) => `${path}\0${fileModes[path].toString(8).padStart(3, "0")}\0${files[path]}`)
-        .join("\n"));
-    return { digest, files };
-}
-function gitRevision(catalogRoot) {
-    let repoRoot;
-    try {
-        repoRoot = execFileSync("git", ["-C", catalogRoot, "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
-    }
-    catch {
-        throw new Error(`managed skill catalog is not inside a readable Git repository: ${catalogRoot}`);
-    }
-    const rel = nodePath.relative(realpathSync(repoRoot), realpathSync(catalogRoot)) || ".";
-    const dirty = execFileSync("git", ["-C", repoRoot, "status", "--porcelain=v1", "--untracked-files=all", "--", rel], { encoding: "utf8" }).trim();
-    if (dirty) {
-        throw new Error(`managed skill catalog has uncommitted content at ${catalogRoot}; commit or restore it before projection`);
-    }
-    return execFileSync("git", ["-C", repoRoot, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-}
-function scanCatalog(catalogRoot) {
-    if (!existsSync(catalogRoot))
-        throw new Error(`managed skill catalog root does not exist: ${catalogRoot}`);
-    const rootStat = lstatSync(catalogRoot);
-    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
-        throw new Error(`managed skill catalog root must be a real directory, not a symlink: ${catalogRoot}`);
-    }
-    const revision = gitRevision(catalogRoot);
-    const skills = new Map();
-    for (const entry of readdirSync(catalogRoot, { withFileTypes: true }).sort((a, b) => compareBytes(a.name, b.name))) {
-        if (!entry.isDirectory())
-            continue;
-        const sourceDir = nodePath.join(catalogRoot, entry.name);
-        if (lstatSync(sourceDir).isSymbolicLink()) {
-            throw new Error(`symlinked skill directories are not allowed: ${sourceDir}`);
-        }
-        const skillFile = nodePath.join(sourceDir, "SKILL.md");
-        if (!existsSync(skillFile))
-            continue;
-        const parsed = parseSkillFrontmatter(readFileSync(skillFile, "utf8"));
-        if (!parsed.ok)
-            throw new Error(`${skillFile}: ${parsed.reason}`);
-        const id = parsed.frontmatter.name;
-        if (!SAFE_ID.test(id))
-            throw new Error(`${skillFile}: frontmatter name '${id}' is not a bounded skill identity`);
-        const prior = skills.get(id);
-        if (prior) {
-            throw new Error(`duplicate managed skill identity '${id}' at ${prior.sourceDir} and ${sourceDir}`);
-        }
-        const tree = inspectSkillDirectory(sourceDir);
-        skills.set(id, {
-            id,
-            sourceDir,
-            sourceRoot: catalogRoot,
-            revision,
-            digest: tree.digest,
-            files: tree.files,
-        });
-    }
-    const digest = sha256([...skills.values()].map((skill) => `${skill.id}\0${skill.digest}`).join("\n"));
-    return { revision, digest, skills };
-}
-export function resolveSkillLoadout(input) {
-    const errors = [];
-    let system = [];
-    let project = [];
-    const projectSelectionDeclared = input.projectSkills !== undefined
-        || (input.projectRoot !== undefined && existsSync(nodePath.join(input.projectRoot, "project.yaml")));
-    try {
-        system = input.systemSkills ?? readSystemSkillSelection(input.catalogRoot);
-        project = input.projectSkills ?? (input.projectRoot ? readProjectSkillSelection(input.projectRoot) : []);
-        readStringList(system, "system skill selection");
-        readStringList(input.topologySkills ?? [], "topology skill selection");
-    }
-    catch (err) {
-        return { ok: false, errors: [{ code: "selector_invalid", message: err.message }] };
-    }
-    const selected = new Map();
-    for (const [source, ids] of [
-        ["system", system],
-        ["topology", input.topologySkills ?? []],
-        ["project", project],
-    ]) {
-        for (const id of ids) {
-            const sources = selected.get(id) ?? [];
-            if (!sources.includes(source))
-                sources.push(source);
-            selected.set(id, sources);
-        }
-    }
-    const catalogManifestExists = existsSync(nodePath.join(input.catalogRoot, "catalog.yaml"));
-    const catalogRequired = system.length > 0 || project.length > 0 || (!input.allowMissingTopology && selected.size > 0);
-    if (!catalogManifestExists && !catalogRequired) {
-        return {
-            ok: true,
-            loadout: {
-                catalogRoot: input.catalogRoot,
-                catalogRevision: null,
-                catalogDigest: null,
-                projectSelectionDeclared,
-                projectSelection: [...project].sort(compareBytes),
-                entries: [],
-            },
-        };
-    }
-    let catalog;
-    try {
-        catalog = scanCatalog(input.catalogRoot);
-    }
-    catch (err) {
-        return { ok: false, errors: [{ code: "catalog_unavailable", message: err.message, path: input.catalogRoot }] };
-    }
-    const entries = [];
-    for (const [id, selectedBy] of [...selected.entries()].sort(([a], [b]) => compareBytes(a, b))) {
-        const skill = catalog.skills.get(id);
-        if (!skill) {
-            if (input.allowMissingTopology && selectedBy.every((source) => source === "topology"))
-                continue;
-            errors.push({
-                code: "selected_skill_missing",
-                message: `selected skill '${id}' is missing from managed catalog ${input.catalogRoot}`,
-                path: input.catalogRoot,
-            });
-            continue;
-        }
-        entries.push({ ...skill, selectedBy });
-    }
-    if (errors.length > 0)
-        return { ok: false, errors };
-    return {
-        ok: true,
-        loadout: {
-            catalogRoot: input.catalogRoot,
-            catalogRevision: catalog.revision,
-            catalogDigest: catalog.digest,
-            projectSelectionDeclared,
-            projectSelection: [...project].sort(compareBytes),
-            entries,
-        },
-    };
-}
-function targetRootFor(runtime, cwd) {
-    return nodePath.join(cwd, runtime === "claude-code" ? ".claude" : ".agents", "skills");
-}
-function ownershipManifestPath(cwd, runtime) {
-    return nodePath.join(cwd, ".openrig", "skill-loadouts", `${runtime}.json`);
-}
-function readOwnershipManifest(path, runtime, targetRoot) {
-    if (!existsSync(path)) {
-        return { schema: MANIFEST_SCHEMA, runtime, targetRoot, updatedAt: "", topologySelections: {}, projectSelection: [], skills: [] };
-    }
-    let value;
-    try {
-        value = JSON.parse(readFileSync(path, "utf8"));
-    }
-    catch (err) {
-        throw new Error(`skill ownership manifest is unreadable at ${path}: ${err.message}`);
-    }
-    if (!isRecord(value) || value["schema"] !== MANIFEST_SCHEMA || value["runtime"] !== runtime || value["targetRoot"] !== targetRoot || !Array.isArray(value["skills"])) {
-        throw new Error(`skill ownership manifest has an incompatible shape at ${path}; move it aside and re-run inspection`);
-    }
-    const skills = value["skills"];
-    if (!skills.every((entry) => {
-        if (!isRecord(entry)
-            || typeof entry["id"] !== "string"
-            || !SAFE_ID.test(entry["id"])
-            || entry["target"] !== nodePath.join(targetRoot, entry["id"])
-            || typeof entry["sourceRoot"] !== "string"
-            || !nodePath.isAbsolute(entry["sourceRoot"])
-            || (entry["sourceDir"] !== undefined && typeof entry["sourceDir"] !== "string")
-            || typeof entry["revision"] !== "string"
-            || entry["revision"].length === 0
-            || typeof entry["digest"] !== "string"
-            || !SHA256.test(entry["digest"])
-            || !isRecord(entry["files"])
-            || !Object.entries(entry["files"]).every(([file, digest]) => isSafeRelativePath(file) && typeof digest === "string" && SHA256.test(digest))
-            || !Array.isArray(entry["selectedBy"])
-            || !entry["selectedBy"].every((source) => source === "system" || source === "topology" || source === "project"))
-            return false;
-        const sourceDir = entry["sourceDir"] ?? nodePath.join(entry["sourceRoot"], entry["id"]);
-        return nodePath.isAbsolute(sourceDir) && isWithin(entry["sourceRoot"], sourceDir);
-    })) {
-        throw new Error(`skill ownership manifest contains an invalid skill record at ${path}; move it aside and re-run inspection`);
-    }
-    if (new Set(skills.map((entry) => entry["id"])).size !== skills.length) {
-        throw new Error(`skill ownership manifest contains duplicate skill identities at ${path}; move it aside and re-run inspection`);
-    }
-    const rawTopology = value["topologySelections"];
-    if (rawTopology !== undefined
-        && (!isRecord(rawTopology)
-            || !Object.entries(rawTopology).every(([owner, ids]) => (SAFE_TOPOLOGY_OWNER.test(owner)
-                && Array.isArray(ids)
-                && ids.every((id) => typeof id === "string" && SAFE_ID.test(id))
-                && new Set(ids).size === ids.length)))) {
-        throw new Error(`skill ownership manifest contains invalid topology selections at ${path}; move it aside and re-run inspection`);
-    }
-    const rawProject = value["projectSelection"];
-    if (rawProject !== undefined
-        && (!Array.isArray(rawProject) || !rawProject.every((id) => typeof id === "string" && SAFE_ID.test(id)) || new Set(rawProject).size !== rawProject.length)) {
-        throw new Error(`skill ownership manifest contains an invalid project selection at ${path}; move it aside and re-run inspection`);
-    }
-    const parsed = value;
-    const parsedSkills = parsed.skills.map((skill) => ({
-        ...skill,
-        sourceDir: skill.sourceDir ?? nodePath.join(skill.sourceRoot, skill.id),
-    }));
-    return {
-        ...parsed,
-        topologySelections: parsed.topologySelections ?? {},
-        projectSelection: parsed.projectSelection
-            ?? parsedSkills.filter((skill) => skill.selectedBy.includes("project")).map((skill) => skill.id).sort(compareBytes),
-        skills: parsedSkills,
-    };
-}
-function copyDirectoryExact(source, target) {
-    mkdirSync(target, { recursive: true });
-    for (const entry of readdirSync(source, { withFileTypes: true })) {
-        const src = nodePath.join(source, entry.name);
-        const dest = nodePath.join(target, entry.name);
-        const stat = lstatSync(src);
-        if (stat.isSymbolicLink())
-            throw new Error(`symlink is not allowed in a managed skill: ${src}`);
-        if (stat.isDirectory())
-            copyDirectoryExact(src, dest);
-        else if (stat.isFile()) {
-            writeFileSync(dest, readFileSync(src));
-            chmodSync(dest, stat.mode & 0o777);
-        }
-        else
-            throw new Error(`unsupported filesystem entry in a managed skill: ${src}`);
-    }
-}
-function gitIgnorePattern(base, path, directory) {
-    const relative = nodePath.relative(base, path);
-    if (!relative || relative === ".." || relative.startsWith(`..${nodePath.sep}`) || nodePath.isAbsolute(relative)) {
-        throw new Error(`managed skill projection path is outside its Git working tree: ${path}`);
-    }
-    const escaped = relative
-        .split(nodePath.sep)
-        .join("/")
-        .replace(/([\\*?\[\] !#])/g, "\\$1");
-    return `/${escaped}${directory ? "/" : ""}`;
-}
-function replaceGitIgnoreBlock(original, begin, end, patterns) {
-    const beginAt = original.indexOf(begin);
-    const endAt = original.indexOf(end);
-    if ((beginAt === -1) !== (endAt === -1)) {
-        throw new Error(`managed Git exclusion block is incomplete (${begin})`);
-    }
-    if (beginAt !== -1) {
-        if (original.indexOf(begin, beginAt + begin.length) !== -1
-            || original.indexOf(end, endAt + end.length) !== -1
-            || (beginAt > 0 && original[beginAt - 1] !== "\n")
-            || endAt < beginAt
-            || (original[endAt + end.length] !== undefined && original[endAt + end.length] !== "\n")) {
-            throw new Error(`managed Git exclusion block is ambiguous (${begin})`);
-        }
-        const after = original[endAt + end.length] === "\n" ? endAt + end.length + 1 : endAt + end.length;
-        const block = patterns === null ? "" : `${begin}\n${patterns.join("\n")}\n${end}\n`;
-        return `${original.slice(0, beginAt)}${block}${original.slice(after)}`;
-    }
-    if (patterns === null)
-        return original;
-    const separator = original.length > 0 && !original.endsWith("\n") ? "\n" : "";
-    return `${original}${separator}${begin}\n${patterns.join("\n")}\n${end}\n`;
-}
-function isGitIgnored(repoRoot, path) {
-    try {
-        execFileSync("git", ["-C", repoRoot, "check-ignore", "-q", "--no-index", "--", path], { stdio: "ignore" });
-        return true;
-    }
-    catch (err) {
-        if (err.status === 1)
-            return false;
-        throw err;
-    }
-}
-function isGitTracked(repoRoot, path) {
-    const relative = nodePath.relative(repoRoot, path);
-    try {
-        execFileSync("git", ["-C", repoRoot, "ls-files", "--error-unmatch", "--", relative], { stdio: "ignore" });
-        return true;
-    }
-    catch (err) {
-        if (err.status === 1)
-            return false;
-        throw err;
-    }
-}
-function planGitIgnoreFile(input) {
-    const originalExists = existsSync(input.path);
-    const originalContent = originalExists ? readFileSync(input.path, "utf8") : "";
-    const hasManagedBlock = originalContent.includes(input.begin) || originalContent.includes(input.end);
-    const hasOtherManagedBlock = ["claude-code", "codex"].some((runtime) => originalContent.includes(`# BEGIN OpenRig managed skill loadout ${runtime}`)
-        && originalContent.includes(`# END OpenRig managed skill loadout ${runtime}`));
-    if (!hasManagedBlock && !hasOtherManagedBlock) {
-        if (input.coveragePaths.every((path) => isGitIgnored(input.repoRoot, path)))
-            return null;
-        if (originalExists) {
-            throw new Error(`refusing to modify an existing unmanaged Git ignore file at ${input.path}`);
-        }
-    }
-    const patterns = input.targets.length === 0
-        ? null
-        : ["/.gitignore", ...input.targets
-                .map((target) => gitIgnorePattern(nodePath.dirname(input.path), target.path, target.directory))
-                .sort(compareBytes)];
-    const nextContent = replaceGitIgnoreBlock(originalContent, input.begin, input.end, patterns);
-    if (nextContent !== originalContent && isGitTracked(input.repoRoot, input.path)) {
-        throw new Error(`refusing to modify a tracked Git ignore file at ${input.path}`);
-    }
-    return { path: input.path, originalExists, originalContent, nextContent, changed: nextContent !== originalContent };
-}
-function planGitIgnores(input) {
-    let repoRoot;
-    try {
-        repoRoot = execFileSync("git", ["-C", input.cwd, "rev-parse", "--show-toplevel"], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
-        }).trim();
-    }
-    catch {
-        return [];
-    }
-    const canonicalRepoRoot = realpathSync(repoRoot);
-    const canonicalCwd = realpathSync(input.cwd);
-    const fromCanonicalCwd = (path) => {
-        const relative = nodePath.relative(input.cwd, path);
-        if (!relative || relative === ".." || relative.startsWith(`..${nodePath.sep}`) || nodePath.isAbsolute(relative)) {
-            throw new Error(`managed skill projection path is outside its working directory: ${path}`);
-        }
-        return nodePath.join(canonicalCwd, relative);
-    };
-    const canonicalTargetRoot = fromCanonicalCwd(input.targetRoot);
-    const canonicalManifestPath = fromCanonicalCwd(input.manifestPath);
-    const key = input.runtime;
-    const begin = `# BEGIN OpenRig managed skill loadout ${key}`;
-    const end = `# END OpenRig managed skill loadout ${key}`;
-    const plans = [
-        planGitIgnoreFile({
-            repoRoot: canonicalRepoRoot,
-            path: nodePath.join(canonicalTargetRoot, ".gitignore"),
-            begin,
-            end,
-            targets: input.owned.map((skill) => ({ path: fromCanonicalCwd(skill.target), directory: true })),
-            coveragePaths: input.owned.flatMap((skill) => Object.keys(skill.files)
-                .map((path) => nodePath.join(fromCanonicalCwd(skill.target), path))),
-        }),
-        planGitIgnoreFile({
-            repoRoot: canonicalRepoRoot,
-            path: nodePath.join(nodePath.dirname(canonicalManifestPath), ".gitignore"),
-            begin,
-            end,
-            targets: [{ path: canonicalManifestPath, directory: false }],
-            coveragePaths: [canonicalManifestPath],
-        }),
-    ];
-    return plans.filter((plan) => plan !== null);
-}
-function writeFileAtomic(path, content) {
-    mkdirSync(nodePath.dirname(path), { recursive: true });
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    try {
-        writeFileSync(temporary, content, "utf8");
-        if (existsSync(path))
-            chmodSync(temporary, lstatSync(path).mode & 0o777);
-        renameSync(temporary, path);
-    }
-    finally {
-        rmSync(temporary, { force: true });
-    }
-}
-function applyGitIgnore(plan) {
-    if (plan.nextContent.length === 0)
-        rmSync(plan.path, { force: true });
-    else
-        writeFileAtomic(plan.path, plan.nextContent);
-}
-function restoreGitIgnore(plan) {
-    if (plan.nextContent.length === 0) {
-        if (existsSync(plan.path))
-            return;
-    }
-    else if (!existsSync(plan.path) || readFileSync(plan.path, "utf8") !== plan.nextContent)
-        return;
-    if (plan.originalExists)
-        writeFileAtomic(plan.path, plan.originalContent);
-    else
-        rmSync(plan.path, { force: true });
-}
-function classifySkillProjectionTarget(skill, prior, target) {
-    if (!pathEntryExists(target)) {
-        return { status: "missing", detail: "selected skill is not projected" };
-    }
-    try {
-        const actual = inspectSkillDirectory(target);
-        if (actual.digest === skill.digest) {
-            return prior
-                ? { status: "current", detail: "owned target matches catalog bytes" }
-                : { status: "shadowed", detail: "equal unowned target already supplies these bytes" };
-        }
-        if (prior && actual.digest === prior.digest) {
-            return { status: "stale", detail: "owned target still matches the prior projection and can be refreshed safely" };
-        }
-        return {
-            status: "conflicting",
-            detail: prior
-                ? "target differs from both the catalog and OpenRig's last owned projection; refusing to overwrite an operator edit"
-                : "unowned target differs from the selected catalog skill; move it aside or reconcile its bytes explicitly",
-        };
-    }
-    catch (err) {
-        return { status: "conflicting", detail: err.message };
-    }
-}
-export function reconcileSkillLoadout(input) {
-    const cwd = nodePath.resolve(input.cwd);
-    const targetRoot = targetRootFor(input.runtime, cwd);
-    const manifestPath = ownershipManifestPath(cwd, input.runtime);
-    const receipts = [];
-    const errors = [];
-    let manifest;
-    try {
-        manifest = readOwnershipManifest(manifestPath, input.runtime, targetRoot);
-    }
-    catch (err) {
-        return { ok: false, applied: false, freshLaunchRequired: false, runtime: input.runtime, targetRoot, manifestPath, receipts, removed: [], errors: [{ code: "ownership_manifest_invalid", message: err.message, path: manifestPath }] };
-    }
-    const owned = new Map(manifest.skills.map((skill) => [skill.id, skill]));
-    if (input.loadout.catalogRevision === null
-        && input.loadout.entries.length === 0
-        && manifest.skills.length === 0
-        && manifest.projectSelection.length === 0
-        && Object.keys(manifest.topologySelections).length === 0) {
-        return { ok: true, applied: false, freshLaunchRequired: false, runtime: input.runtime, targetRoot, manifestPath, receipts, removed: [], errors };
-    }
-    const topologyOwner = input.topologyOwner?.trim() || "workspace";
-    if (!SAFE_TOPOLOGY_OWNER.test(topologyOwner)) {
-        return {
-            ok: false,
-            applied: false,
-            freshLaunchRequired: false,
-            runtime: input.runtime,
-            targetRoot,
-            manifestPath,
-            receipts,
-            removed: [],
-            errors: [{ code: "topology_owner_invalid", message: `topology owner '${topologyOwner}' is not a bounded seat identity` }],
-        };
-    }
-    const topologySelections = Object.create(null);
-    for (const owner of Object.keys(manifest.topologySelections).sort(compareBytes)) {
-        topologySelections[owner] = [...manifest.topologySelections[owner]].sort(compareBytes);
-    }
-    const currentTopology = input.loadout.entries
-        .filter((entry) => entry.selectedBy.includes("topology"))
-        .map((entry) => entry.id)
-        .sort(compareBytes);
-    if (currentTopology.length > 0)
-        topologySelections[topologyOwner] = currentTopology;
-    else
-        delete topologySelections[topologyOwner];
-    const canonicalTopologySelections = Object.create(null);
-    for (const owner of Object.keys(topologySelections).sort(compareBytes)) {
-        canonicalTopologySelections[owner] = topologySelections[owner];
-    }
-    const retainedTopology = new Set(Object.values(topologySelections).flat());
-    const effectiveEntries = [...input.loadout.entries];
-    for (const id of [...retainedTopology].sort(compareBytes)) {
-        const current = effectiveEntries.find((entry) => entry.id === id);
-        if (current) {
-            current.selectedBy = ["system", "topology", "project"]
-                .filter((source) => current.selectedBy.includes(source) || source === "topology");
-            continue;
-        }
-        const prior = owned.get(id);
-        if (!prior) {
-            errors.push({
-                code: "topology_selection_unavailable",
-                message: `topology owner still selects '${id}', but its owned source record is absent; relaunch that owner or clear its selection explicitly`,
-                path: manifestPath,
-            });
-            continue;
-        }
-        effectiveEntries.push({
-            id: prior.id,
-            sourceDir: prior.sourceDir,
-            sourceRoot: prior.sourceRoot,
-            revision: prior.revision,
-            digest: prior.digest,
-            files: prior.files,
-            selectedBy: ["topology"],
-        });
-    }
-    const projectSelection = (input.loadout.projectSelectionDeclared
-        ? input.loadout.projectSelection
-        : manifest.projectSelection).slice().sort(compareBytes);
-    for (const id of projectSelection) {
-        const current = effectiveEntries.find((entry) => entry.id === id);
-        if (current) {
-            current.selectedBy = ["system", "topology", "project"]
-                .filter((source) => current.selectedBy.includes(source) || source === "project");
-            continue;
-        }
-        const prior = owned.get(id);
-        if (!prior) {
-            errors.push({
-                code: "project_selection_unavailable",
-                message: `installed project still selects '${id}', but its owned source record is absent; run an explicit project install to repair or clear it`,
-                path: manifestPath,
-            });
-            continue;
-        }
-        effectiveEntries.push({
-            id: prior.id,
-            sourceDir: prior.sourceDir,
-            sourceRoot: prior.sourceRoot,
-            revision: prior.revision,
-            digest: prior.digest,
-            files: prior.files,
-            selectedBy: ["project"],
-        });
-    }
-    effectiveEntries.sort((a, b) => compareBytes(a.id, b.id));
-    for (const skill of effectiveEntries) {
-        const target = nodePath.join(targetRoot, skill.id);
-        const prior = owned.get(skill.id);
-        let { status, detail } = classifySkillProjectionTarget(skill, prior, target);
-        receipts.push({
-            id: skill.id,
-            selectedBy: skill.selectedBy,
-            sourceRoot: skill.sourceRoot,
-            revision: skill.revision,
-            digest: skill.digest,
-            target,
-            status,
-            detail,
-        });
-        if (status === "missing" || status === "stale") {
-            try {
-                const source = inspectSkillDirectory(skill.sourceDir);
-                if (source.digest !== skill.digest) {
-                    status = "conflicting";
-                    detail = "catalog source bytes no longer match the resolved loadout; resolve a fresh loadout before applying";
-                    receipts[receipts.length - 1].status = status;
-                    receipts[receipts.length - 1].detail = detail;
-                }
-            }
-            catch (err) {
-                status = "conflicting";
-                detail = `catalog source cannot be projected safely: ${err.message}`;
-                receipts[receipts.length - 1].status = status;
-                receipts[receipts.length - 1].detail = detail;
-            }
-        }
-        if (status === "conflicting")
-            errors.push({ code: "target_conflict", message: `${skill.id}: ${detail}`, path: target });
-    }
-    const selectedIds = new Set(effectiveEntries.map((entry) => entry.id));
-    const safeRemovals = [];
-    for (const prior of manifest.skills) {
-        if (selectedIds.has(prior.id))
-            continue;
-        if (!pathEntryExists(prior.target))
-            continue;
-        try {
-            const actual = inspectSkillDirectory(prior.target);
-            if (actual.digest === prior.digest)
-                safeRemovals.push(prior);
-            else
-                errors.push({
-                    code: "stale_target_modified",
-                    message: `${prior.id}: deselected owned target was modified after projection; refusing to remove it`,
-                    path: prior.target,
-                });
-        }
-        catch (err) {
-            errors.push({ code: "stale_target_unreadable", message: `${prior.id}: ${err.message}`, path: prior.target });
-        }
-    }
-    if (errors.length > 0 || !input.apply) {
-        return { ok: errors.length === 0, applied: false, freshLaunchRequired: false, runtime: input.runtime, targetRoot, manifestPath, receipts, removed: [], errors };
-    }
-    const changed = receipts.filter((receipt) => receipt.status === "missing" || receipt.status === "stale");
-    const nextOwned = effectiveEntries
-        .filter((skill) => receipts.find((receipt) => receipt.id === skill.id)?.status !== "shadowed")
-        .map((skill) => ({
-        id: skill.id,
-        target: nodePath.join(targetRoot, skill.id),
-        sourceDir: skill.sourceDir,
-        sourceRoot: skill.sourceRoot,
-        revision: skill.revision,
-        digest: skill.digest,
-        files: skill.files,
-        selectedBy: skill.selectedBy,
-    }))
-        .sort((a, b) => compareBytes(a.id, b.id));
-    let gitIgnorePlans;
-    try {
-        gitIgnorePlans = planGitIgnores({ cwd, runtime: input.runtime, targetRoot, manifestPath, owned: nextOwned });
-    }
-    catch (err) {
-        return {
-            ok: false,
-            applied: false,
-            freshLaunchRequired: false,
-            runtime: input.runtime,
-            targetRoot,
-            manifestPath,
-            receipts,
-            removed: [],
-            errors: [{ code: "git_exclusion_failed", message: `skill projection could not preserve clean Git state: ${err.message}` }],
-        };
-    }
-    if (changed.length === 0
-        && safeRemovals.length === 0
-        && JSON.stringify(manifest.skills) === JSON.stringify(nextOwned)
-        && JSON.stringify(manifest.topologySelections) === JSON.stringify(canonicalTopologySelections)
-        && JSON.stringify(manifest.projectSelection) === JSON.stringify(projectSelection)
-        && !gitIgnorePlans.some((plan) => plan.changed)) {
-        return { ok: true, applied: false, freshLaunchRequired: false, runtime: input.runtime, targetRoot, manifestPath, receipts, removed: [], errors: [] };
-    }
-    const removed = [];
-    const rollback = [];
-    let stagingRoot = null;
-    const appliedGitIgnores = [];
-    try {
-        mkdirSync(nodePath.dirname(targetRoot), { recursive: true });
-        stagingRoot = nodePath.join(nodePath.dirname(targetRoot), `.openrig-skill-stage-${randomUUID()}`);
-        mkdirSync(stagingRoot, { recursive: true });
-        const staged = nodePath.join(stagingRoot, "new");
-        const backups = nodePath.join(stagingRoot, "old");
-        mkdirSync(staged, { recursive: true });
-        mkdirSync(backups, { recursive: true });
-        for (const receipt of changed) {
-            const skill = effectiveEntries.find((entry) => entry.id === receipt.id);
-            copyDirectoryExact(skill.sourceDir, nodePath.join(staged, skill.id));
-        }
-        for (const plan of gitIgnorePlans.filter((candidate) => candidate.changed)) {
-            applyGitIgnore(plan);
-            appliedGitIgnores.push(plan);
-        }
-        mkdirSync(targetRoot, { recursive: true });
-        for (const receipt of changed) {
-            const backup = pathEntryExists(receipt.target) ? nodePath.join(backups, receipt.id) : null;
-            if (backup)
-                renameSync(receipt.target, backup);
-            renameSync(nodePath.join(staged, receipt.id), receipt.target);
-            rollback.push({ target: receipt.target, backup });
-            receipt.status = "current";
-            receipt.detail = "projected exact catalog bytes";
-        }
-        for (const prior of safeRemovals) {
-            const backup = nodePath.join(backups, `removed-${prior.id}`);
-            renameSync(prior.target, backup);
-            rollback.push({ target: prior.target, backup });
-            removed.push(prior.id);
-        }
-        mkdirSync(nodePath.dirname(manifestPath), { recursive: true });
-        const nextManifest = {
-            schema: MANIFEST_SCHEMA,
-            runtime: input.runtime,
-            targetRoot,
-            updatedAt: new Date().toISOString(),
-            topologySelections: canonicalTopologySelections,
-            projectSelection,
-            skills: nextOwned,
-        };
-        const tmpManifest = `${manifestPath}.${randomUUID()}.tmp`;
-        writeFileSync(tmpManifest, `${JSON.stringify(nextManifest, null, 2)}\n`, "utf8");
-        renameSync(tmpManifest, manifestPath);
-        rmSync(stagingRoot, { recursive: true, force: true });
-        return {
-            ok: true,
-            applied: true,
-            freshLaunchRequired: changed.length > 0 || removed.length > 0,
-            runtime: input.runtime,
-            targetRoot,
-            manifestPath,
-            receipts,
-            removed,
-            errors: [],
-        };
-    }
-    catch (err) {
-        for (const action of rollback.reverse()) {
-            try {
-                if (pathEntryExists(action.target))
-                    rmSync(action.target, { recursive: true, force: true });
-                if (action.backup && pathEntryExists(action.backup))
-                    renameSync(action.backup, action.target);
-            }
-            catch { /* retain the original failure; rollback is best-effort */ }
-        }
-        for (const plan of appliedGitIgnores.reverse()) {
-            try {
-                restoreGitIgnore(plan);
-            }
-            catch { /* retain the original failure; rollback is best-effort */ }
-        }
-        for (const receipt of changed) {
-            const skill = effectiveEntries.find((entry) => entry.id === receipt.id);
-            const restored = classifySkillProjectionTarget(skill, owned.get(receipt.id), receipt.target);
-            receipt.status = restored.status;
-            receipt.detail = restored.detail;
-        }
-        if (stagingRoot)
-            rmSync(stagingRoot, { recursive: true, force: true });
-        return {
-            ok: false,
-            applied: false,
-            freshLaunchRequired: false,
-            runtime: input.runtime,
-            targetRoot,
-            manifestPath,
-            receipts,
-            removed: [],
-            errors: [{ code: "projection_failed", message: `skill projection failed and was rolled back: ${err.message}` }],
-        };
-    }
-}
-//# sourceMappingURL=skill-catalog.js.map