@platless/axom-cli 0.1.0

package/dist/credentials.js

@@ -0,0 +1,211 @@
+import { createHash } from 'node:crypto';
+import { AuthError, loadDeviceId } from './config.js';
+import { requestCredentialBroker, runCredentialBroker } from './credentialBroker.js';
+const service = 'com.platless.axom.cli';
+const account = (server) => createHash('sha256').update(server).digest('hex');
+const accessCache = new Map();
+const memoryStore = new Map();
+const usesTestMemoryStore = () => process.env.AXOM_CREDENTIAL_STORE === 'memory';
+export async function saveTokens(server, tokens) {
+    if (usesTestMemoryStore()) {
+        memoryStore.set(server, tokens);
+        return;
+    }
+    if (process.platform === 'darwin') {
+        await requestCredentialBroker({ action: 'save', server, tokens });
+        return;
+    }
+    await saveNativeTokens(server, tokens);
+}
+/** Returns only an access token. A macOS CLI process never receives the persisted refresh token. */
+export async function accessTokenFor(server, forceRefresh = false) {
+    // AXOM_ACCESS_TOKEN wins over every stored credential (gh / Claude Code convention) and returns
+    // before anything below touches the credential store. That's what makes a container work: on
+    // Linux the store goes through @napi-rs/keyring's Secret Service over DBus, which a container
+    // without DBus cannot reach — so this branch must stay first, not be added after a store lookup.
+    const fromEnv = process.env.AXOM_ACCESS_TOKEN?.trim();
+    if (fromEnv)
+        return fromEnv;
+    if (usesTestMemoryStore())
+        return accessTokenFromMemoryStore(server, forceRefresh);
+    if (process.platform === 'darwin') {
+        const response = await requestCredentialBroker({ action: 'access', server, forceRefresh });
+        return response.accessToken;
+    }
+    return accessTokenFromNativeStore(server, forceRefresh);
+}
+export async function clearTokens(server) {
+    if (usesTestMemoryStore()) {
+        memoryStore.delete(server);
+        return;
+    }
+    if (process.platform === 'darwin') {
+        await requestCredentialBroker({ action: 'clear', server });
+        return;
+    }
+    await clearNativeTokens(server);
+}
+export async function revokeAndClearTokens(server) {
+    if (usesTestMemoryStore()) {
+        const tokens = memoryStore.get(server);
+        if (tokens?.refreshToken)
+            await revokeRefreshToken(server, tokens.refreshToken);
+        memoryStore.delete(server);
+        return;
+    }
+    if (process.platform === 'darwin') {
+        await requestCredentialBroker({ action: 'revoke', server });
+        return;
+    }
+    const persisted = await loadNativeTokens(server);
+    if (persisted?.refreshToken)
+        await revokeRefreshToken(server, persisted.refreshToken);
+    await clearNativeTokens(server);
+}
+export { runCredentialBroker };
+/** Test-only inspection. Production callers must use accessTokenFor so refresh tokens stay private. */
+export async function loadTokens(server) {
+    if (!usesTestMemoryStore())
+        throw new Error('loadTokens is available only with the in-memory test credential store.');
+    return memoryStore.get(server);
+}
+export async function loadNativeTokens(server) {
+    const keyring = await import('@napi-rs/keyring');
+    // getPassword() returns null for "no entry" but the read can *throw* instead when the store
+    // itself is unreachable — on Linux that's the Secret Service over DBus, which a container
+    // without DBus cannot reach. In practice @napi-rs/keyring surfaces that failure as early as
+    // `new Entry(...)` (opening the store), not only from getPassword() itself, so both go inside
+    // the same try. For a read, an unreachable store and an empty one are the same answer: there is
+    // no credential to return. Reporting that (rather than propagating the native error) is what
+    // lets `accessTokenFor` fall through to its own refusal, which names AXOM_ACCESS_TOKEN and
+    // points at Settings → Security → Access Tokens, instead of the caller seeing a raw
+    // "PermissionDenied" from @napi-rs/keyring.
+    // Scoped to just the read attempt: the "credential stored in the system keyring is invalid"
+    // throw below is ours and must keep propagating, not get swallowed by a broader try/catch.
+    let raw;
+    try {
+        raw = new keyring.Entry(service, account(server)).getPassword();
+    }
+    catch {
+        return undefined;
+    }
+    if (!raw)
+        return undefined;
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.refreshToken !== 'string' || !parsed.refreshToken) {
+        throw new Error('The Axomwork credential stored in the system keyring is invalid. Run axom auth again.');
+    }
+    return { refreshToken: parsed.refreshToken };
+}
+export async function saveNativeTokens(server, tokens) {
+    const keyring = await import('@napi-rs/keyring');
+    new keyring.Entry(service, account(server)).setPassword(JSON.stringify({ refreshToken: tokens.refreshToken }));
+    accessCache.set(server, { accessToken: tokens.accessToken, expiresAt: tokens.expiresAt });
+}
+export async function clearNativeTokens(server) {
+    accessCache.delete(server);
+    const keyring = await import('@napi-rs/keyring');
+    new keyring.Entry(service, account(server)).deletePassword();
+}
+export async function accessTokenFromNativeStore(server, forceRefresh) {
+    const persisted = await loadNativeTokens(server);
+    if (!persisted)
+        return undefined;
+    const cached = accessCache.get(server);
+    if (!forceRefresh && cached?.accessToken && Date.parse(cached.expiresAt) - Date.now() >= 30_000) {
+        return cached.accessToken;
+    }
+    const response = await fetch(`${normalizedServer(server)}/oauth/token`, {
+        method: 'POST',
+        // `device_id` keeps this machine on the one session row it already has, and re-asserts it if
+        // the row was migrated from a pre-session token family.
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: 'axom-cli',
+            refresh_token: persisted.refreshToken,
+            device_id: await loadDeviceId(),
+        }),
+    });
+    if (response.status !== 200) {
+        if (response.status >= 400 && response.status < 500)
+            await clearNativeTokens(server);
+        // `AuthError`, not `Error`: `runCommand` turns this type into exit code 3 ("re-authenticate")
+        // and everything else into 1 ("it broke"). A dead refresh token is the former — the message
+        // already tells the reader to run `axom auth` — and it used to be typed that way, in `mcp.ts`,
+        // until the credential-broker refactor moved the throw here and dropped the type with it.
+        throw new AuthError(`Token refresh failed: ${await oauthError(response)}. Run: axom auth --server ${server}`);
+    }
+    const token = await parseTokenResponse(response);
+    await saveNativeTokens(server, token);
+    return token.accessToken;
+}
+async function accessTokenFromMemoryStore(server, forceRefresh) {
+    const tokens = memoryStore.get(server);
+    if (!tokens)
+        return undefined;
+    if (!forceRefresh && tokens.accessToken && Date.parse(tokens.expiresAt) - Date.now() >= 30_000)
+        return tokens.accessToken;
+    const response = await refreshRequest(server, tokens.refreshToken);
+    if (response.status !== 200) {
+        if (response.status >= 400 && response.status < 500)
+            memoryStore.delete(server);
+        // Same reasoning as the native-store path above: the store this token lived in does not change
+        // what a rejected refresh means to the caller.
+        throw new AuthError(`Token refresh failed: ${await oauthError(response)}. Run: axom auth --server ${server}`);
+    }
+    const refreshed = await parseTokenResponse(response);
+    memoryStore.set(server, refreshed);
+    return refreshed.accessToken;
+}
+async function refreshRequest(server, refreshToken) {
+    return fetch(`${normalizedServer(server)}/oauth/token`, {
+        method: 'POST',
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: 'axom-cli',
+            refresh_token: refreshToken,
+            device_id: await loadDeviceId(),
+        }),
+    });
+}
+export async function revokeRefreshToken(server, refreshToken) {
+    await fetch(`${normalizedServer(server)}/oauth/revoke`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ token: refreshToken, token_type_hint: 'refresh_token', client_id: 'axom-cli' }),
+    }).catch(() => undefined);
+}
+async function parseTokenResponse(response) {
+    const value = await response.json();
+    if (typeof value.access_token !== 'string' || typeof value.refresh_token !== 'string' ||
+        typeof value.expires_in !== 'number' || !Number.isFinite(value.expires_in) || value.expires_in <= 0) {
+        throw new Error('Axomwork OAuth server returned an invalid token response.');
+    }
+    return {
+        accessToken: value.access_token,
+        refreshToken: value.refresh_token,
+        expiresAt: new Date(Date.now() + value.expires_in * 1000).toISOString(),
+    };
+}
+async function oauthError(response) {
+    try {
+        const value = await response.json();
+        const error = typeof value.error === 'string' ? value.error : undefined;
+        const description = typeof value.error_description === 'string' ? value.error_description : undefined;
+        if (error && description)
+            return `${error}: ${description}`;
+        if (error)
+            return error;
+    }
+    catch {
+        // The status is sufficient when the server did not return an OAuth JSON error.
+    }
+    return `HTTP ${response.status}`;
+}
+function normalizedServer(server) {
+    const normalized = server.trim().replace(/\/+$/, '');
+    const url = new URL(normalized);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        throw new Error('Axomwork server must use HTTP or HTTPS.');
+    return normalized;
+}

package/dist/install/agentsDir.js

@@ -0,0 +1,35 @@
+import { promises as fs, existsSync } from 'node:fs';
+import path from 'node:path';
+import { SKILL_NAMES } from './installer.js';
+/**
+ * Materializes the bundled Axom skills into `<projectDir>/.agents/skills/<skill>/SKILL.md` — the
+ * convention Codex, Cursor, OpenCode, Pi and others already read on their own, needing no
+ * per-agent adapter code. This is the default `axom skills add` path; `--claude` is the one
+ * agent that still needs bespoke materialization (see install/claude/materialize.ts) because
+ * Claude Code reads skills through its own plugin/marketplace mechanism instead.
+ */
+export async function materializeAgentsSkills(sourceDir, projectDir) {
+    const files = [];
+    for (const name of SKILL_NAMES) {
+        const destination = path.join(projectDir, '.agents/skills', name, 'SKILL.md');
+        await fs.mkdir(path.dirname(destination), { recursive: true });
+        await fs.copyFile(path.join(sourceDir, name, 'SKILL.md'), destination);
+        files.push(destination);
+    }
+    return { files };
+}
+/**
+ * Removes only the skill directories `materializeAgentsSkills` creates. A user's own directory
+ * under `.agents/skills/` (anything not in SKILL_NAMES) is left untouched.
+ */
+export async function removeAgentsSkills(projectDir) {
+    const removed = [];
+    for (const name of SKILL_NAMES) {
+        const dir = path.join(projectDir, '.agents/skills', name);
+        if (existsSync(dir)) {
+            await fs.rm(dir, { recursive: true });
+            removed.push(dir);
+        }
+    }
+    return { removed };
+}

package/dist/install/claude/commands.js

@@ -0,0 +1,89 @@
+export const COMMANDS = {
+    struct: `---
+description: Inspect Axomwork applications and models (structure, attributes, operations)
+---
+
+Use the Axomwork MCP tools to answer this structural question about the platform:
+
+$ARGUMENTS
+
+Workflow:
+1. \`axom__struct__list_applications\` to see applications; \`axom__struct__get_application\` for one app's models and menus.
+2. \`axom__struct__list_models\` / \`axom__struct__get_model\` for a model's attributes, operations, and display metadata.
+3. Prefer read-only struct tools here; do not mutate anything from this command.
+
+For the underlying concepts (applications, models, attributes, references), load guide \`concepts/data-model/index.md\` with \`axom__guide__load\`.
+`,
+    record: `---
+description: Query, create, update, upsert, or delete Axomwork records
+---
+
+Use the Axomwork MCP record tools to fulfil this request:
+
+$ARGUMENTS
+
+Workflow:
+1. Discover structure first when unsure: \`axom__struct__get_model\` for attribute names and types.
+2. Query with \`axom__record__query\` (filters/sorts/page criteria — for criteria syntax, load guide \`agent-integration/mcp/record-query-criteria.md\`).
+3. Mutate with \`axom__record__create\` / \`axom__record__update\` / \`axom__record__upsert\` / \`axom__record__delete\`. Read the record first before updating; confirm with the user before deleting.
+4. \`axom__record__upsert\` needs \`identityField\` and the identity value inside \`record\`.
+
+For safe mutation patterns, load guide \`agent-integration/operating-patterns/safe-record-mutations.md\`.
+`,
+    execute: `---
+description: Execute Axomwork operations and services, following async runs to completion
+---
+
+Execute the requested Axomwork operation or service:
+
+$ARGUMENTS
+
+Workflow:
+1. Find the operation on its model (\`axom__struct__get_model\`) or the service by name.
+2. Call \`axom__operation__execute\` (applicationName/modelName/operationName/input) or \`axom__service__execute\` (serviceName/input).
+3. Interpret the ExecuteResult payload: \`status\` (success/failure/running), \`message\`, \`text\`, \`returnValue\`, \`runId\`/\`runType\`, \`errors[]\` ({target,code,message}).
+4. When \`status\` is \`running\`, follow \`runId\` (see \`runType\`) until a terminal state before reporting the outcome.
+
+For sync-vs-job semantics load guide \`concepts/execution/synchronous-and-task-execution.md\`; for run following load guide \`agent-integration/operating-patterns/following-runs.md\`.
+`,
+    definition: `---
+description: Develop Axomwork definitions — apps, models, attributes, operations, workflows (requires ADMIN)
+---
+
+You are editing Axomwork application definitions with the canonical \`axom__definition__*\` MCP tools (ADMIN token required).
+
+$ARGUMENTS
+
+Rules:
+1. ETag workflow: read the resource first, send its \`etag\` back as \`expectedEtag\` (bodies use \`expectedBodyEtag\`). On conflict, re-read and merge intentionally.
+2. Before authoring \`.axom.kts\` script bodies, load guide \`script-language/sdk/index.md\`; workflow DSL: \`script-language/workflows/index.md\`; sync/job/streaming patterns: \`script-language/patterns/index.md\`.
+3. For definition semantics (apps, models, attributes, operations, workflows), load guide \`application-development/index.md\`.
+4. Confirm destructive definition deletes with the user first.
+`,
+    platform: `---
+description: Operate Axomwork platform configuration — AI vendors/profiles, cowork agents, datasources, platform skills and settings (requires ADMIN)
+---
+
+You are operating Axomwork platform configuration with the canonical \`axom__platform__*\` MCP tools (skills, settings, AI vendors/profiles/memory, cowork agents, data sources; ADMIN token required).
+
+$ARGUMENTS
+
+Rules:
+1. Read current configuration before editing; respect ETag guards where tools expose them.
+2. For configuration semantics (AI vendors and profiles, cowork agents, datasources, platform skills and settings), load guide \`platform-operations/index.md\` first.
+3. Confirm with the user before changes that can interrupt running workflows or agent sessions.
+`,
+    guide: `---
+description: Look something up in the Axomwork Guide (platform manual)
+---
+
+Answer using the Axomwork Guide:
+
+$ARGUMENTS
+
+Workflow:
+1. \`axom__guide__search\` with keywords or the question itself; read the ranked snippets.
+2. \`axom__guide__load\` a hit's \`path\` for the full page (omit \`path\` for the table of contents).
+3. Answer from guide content and cite the guide paths you used. If the guide has no answer, say so and fall back to tool discovery (\`tools/list\`).
+`,
+};

package/dist/install/claude/materialize.js

@@ -0,0 +1,42 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { packageVersion, SKILL_NAMES } from '../installer.js';
+import { COMMANDS } from './commands.js';
+export function claudeAgentDir(home) {
+    return path.join(home, '.axom/agents/claude');
+}
+export async function materializePlugin(ctx) {
+    const marketplaceDir = path.join(claudeAgentDir(ctx.home), 'marketplace');
+    const pluginDir = path.join(marketplaceDir, 'axom');
+    await fs.rm(marketplaceDir, { recursive: true, force: true });
+    const files = [];
+    const write = async (relative, content) => {
+        const file = path.join(marketplaceDir, relative);
+        await fs.mkdir(path.dirname(file), { recursive: true });
+        await fs.writeFile(file, content);
+        files.push(file);
+    };
+    await write('.claude-plugin/marketplace.json', `${JSON.stringify({
+        name: 'axom',
+        owner: { name: 'axom-cli' },
+        plugins: [{ name: 'axom', source: './axom', description: 'Operate the Axomwork platform' }],
+    }, null, 2)}\n`);
+    await write('axom/.claude-plugin/plugin.json', `${JSON.stringify({
+        name: 'axom',
+        version: await packageVersion(),
+        description: 'Query, mutate, execute, develop, and operate the Axomwork platform via MCP tools.',
+    }, null, 2)}\n`);
+    await write('axom/.mcp.json', `${JSON.stringify({
+        mcpServers: { axom: { type: 'http', url: `${ctx.serverUrl.replace(/\/+$/, '')}/mcp` } },
+    }, null, 2)}\n`);
+    for (const [name, content] of Object.entries(COMMANDS)) {
+        await write(`axom/commands/${name}.md`, content);
+    }
+    for (const skill of SKILL_NAMES) {
+        const destination = path.join(pluginDir, 'skills', skill, 'SKILL.md');
+        await fs.mkdir(path.dirname(destination), { recursive: true });
+        await fs.copyFile(path.join(ctx.skillsSourceDir, skill, 'SKILL.md'), destination);
+        files.push(destination);
+    }
+    return { marketplaceDir, files };
+}

package/dist/install/installer.js

@@ -0,0 +1,45 @@
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { UsageError } from '../config.js';
+import { claudeTarget } from './targets/claude.js';
+/**
+ * The bundled skills every install path materializes. Single source of truth shared by both
+ * the `.agents/skills` convention path (agentsDir.ts) and the Claude plugin path
+ * (claude/materialize.ts) — two copies of this list would let the two paths drift apart.
+ */
+export const SKILL_NAMES = ['axom', 'axom-definition', 'axom-platform'];
+export const TARGETS = {
+    claude: claudeTarget,
+};
+export async function installAgent(targetName, ctx) {
+    return requireTarget(targetName).install(fullContext(ctx));
+}
+export async function uninstallAgent(targetName, ctx) {
+    return requireTarget(targetName).uninstall(fullContext(ctx));
+}
+function requireTarget(targetName) {
+    const target = TARGETS[targetName];
+    if (!target) {
+        throw new UsageError(`Unknown agent target "${targetName}". Valid targets: ${Object.keys(TARGETS).join(', ')}`);
+    }
+    return target;
+}
+function fullContext(ctx) {
+    return { ...ctx, home: ctx.home ?? targetHome(), cwd: ctx.cwd ?? process.cwd(), skillsSourceDir: skillsSourceDir() };
+}
+export function skillsSourceDir() {
+    const sourceDir = fileURLToPath(new URL('../../skills', import.meta.url));
+    if (!existsSync(sourceDir)) {
+        throw new Error(`Bundled Axomwork skills directory not found: ${sourceDir}`);
+    }
+    return sourceDir;
+}
+export function targetHome() {
+    return process.env.AXOM_AGENT_HOME ?? homedir();
+}
+export async function packageVersion() {
+    const raw = await readFile(new URL('../../package.json', import.meta.url), 'utf8');
+    return JSON.parse(raw).version;
+}

package/dist/install/targets/claude.js

@@ -0,0 +1,154 @@
+import { execFile, execFileSync } from 'node:child_process';
+import { promises as fs, existsSync } from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { UsageError } from '../../config.js';
+import { materializePlugin, claudeAgentDir } from '../claude/materialize.js';
+const execFileAsync = promisify(execFile);
+// NOTE: the exact column format of `claude plugin marketplace list` / `claude plugin list`
+// output has NOT been verified against a live `claude` install (deferred site-adaptation).
+// This assumes the entry name is the first whitespace-delimited token on each line. If the
+// real output puts the name elsewhere (e.g. a leading marker/icon column), this parse must
+// be revisited.
+function listContainsName(stdout, name) {
+    return stdout.split('\n').some((line) => {
+        const first = line.trim().split(/\s+/)[0];
+        return first === name || first === `${name}@${name}`;
+    });
+}
+function systemClaudeCli() {
+    // Synchronous probe at construction time: PATH 上无 claude 时返回 null，
+    // 让 install 走 manual 分支而不是等到 execFileAsync 抛异常。
+    try {
+        execFileSync('claude', ['--version'], { stdio: 'ignore' });
+        return {
+            async run(args) {
+                const { stdout } = await execFileAsync('claude', args);
+                return { stdout };
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function createClaudeTarget(cli) {
+    return {
+        name: 'claude',
+        async install(ctx) {
+            const { marketplaceDir, files } = await materializePlugin(ctx);
+            if (cli === null) {
+                return {
+                    target: this.name,
+                    installedFiles: files,
+                    mcpRegistration: [
+                        'claude executable not found; plugin materialized. Manual steps:',
+                        `  claude plugin marketplace add ${marketplaceDir}`,
+                        '  claude plugin install axom@axom',
+                    ].join('\n'),
+                    manual: true,
+                };
+            }
+            const marketplaces = (await cli.run(['plugin', 'marketplace', 'list'])).stdout;
+            if (listContainsName(marketplaces, 'axom')) {
+                await cli.run(['plugin', 'marketplace', 'update', 'axom']);
+            }
+            else {
+                await cli.run(['plugin', 'marketplace', 'add', marketplaceDir]);
+            }
+            const plugins = (await cli.run(['plugin', 'list'])).stdout;
+            if (listContainsName(plugins, 'axom')) {
+                await cli.run(['plugin', 'update', 'axom']);
+            }
+            else {
+                await cli.run(['plugin', 'install', 'axom@axom']);
+            }
+            if (ctx.scope === 'project') {
+                await enableInProject(ctx.cwd);
+            }
+            return {
+                target: this.name,
+                installedFiles: files,
+                mcpRegistration: 'axom plugin installed into Claude Code; MCP OAuth happens in-app on first connection',
+                manual: false,
+            };
+        },
+        async uninstall(ctx) {
+            const removed = [];
+            const notes = [];
+            if (cli !== null) {
+                for (const args of [['plugin', 'uninstall', 'axom'], ['plugin', 'marketplace', 'remove', 'axom']]) {
+                    try {
+                        await cli.run(args);
+                        removed.push(`claude ${args.join(' ')}`);
+                    }
+                    catch (error) {
+                        notes.push(`claude ${args.join(' ')} failed: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                }
+            }
+            else {
+                notes.push('claude executable not found; remove the plugin from Claude Code manually if installed');
+            }
+            const agentDir = claudeAgentDir(ctx.home);
+            if (existsSync(agentDir)) {
+                await fs.rm(agentDir, { recursive: true });
+                removed.push(agentDir);
+            }
+            if (ctx.scope === 'project') {
+                await disableInProject(ctx.cwd, removed);
+            }
+            return {
+                target: this.name,
+                removed,
+                notes: notes.length > 0 ? notes.join('\n') : (removed.length === 0 ? 'nothing to remove (not installed)' : 'axom removed from Claude Code'),
+            };
+        },
+    };
+}
+async function enableInProject(cwd) {
+    const file = path.join(cwd, '.claude/settings.json');
+    const settings = await readJson(file);
+    const enabled = isRecord(settings.enabledPlugins) ? settings.enabledPlugins : {};
+    settings.enabledPlugins = { ...enabled, 'axom@axom': true };
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, `${JSON.stringify(settings, null, 2)}\n`);
+}
+async function disableInProject(cwd, removed) {
+    const file = path.join(cwd, '.claude/settings.json');
+    if (!existsSync(file))
+        return;
+    const settings = await readJson(file);
+    if (isRecord(settings.enabledPlugins) && 'axom@axom' in settings.enabledPlugins) {
+        delete settings.enabledPlugins['axom@axom'];
+        await fs.writeFile(file, `${JSON.stringify(settings, null, 2)}\n`);
+        removed.push(`${file} (enabledPlugins["axom@axom"])`);
+    }
+}
+async function readJson(file) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(file, 'utf8'));
+        if (!isRecord(parsed))
+            throw new UsageError(`Refusing to overwrite ${file}: not a JSON object.`);
+        return parsed;
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT')
+            return {};
+        throw error;
+    }
+}
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+let resolvedClaudeTarget = null;
+function resolveClaudeTarget() {
+    if (resolvedClaudeTarget === null)
+        resolvedClaudeTarget = createClaudeTarget(systemClaudeCli());
+    return resolvedClaudeTarget;
+}
+export const claudeTarget = {
+    name: 'claude',
+    install: (ctx) => resolveClaudeTarget().install(ctx),
+    uninstall: (ctx) => resolveClaudeTarget().uninstall(ctx),
+};