@rayul/kordis 0.0.1

package/dist/index.js

@@ -0,0 +1,2483 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../../packages/contracts/src/primitives.ts
+import { z } from "zod";
+var UuidSchema, IsoDateTimeSchema, UsernameSchema, SlugSchema, FullSlugSchema, SemverSchema, SemverRangeSchema, CursorSchema, ToolSlugSchema, TagSchema, UrlSchema;
+var init_primitives = __esm({
+  "../../packages/contracts/src/primitives.ts"() {
+    "use strict";
+    UuidSchema = z.string().uuid();
+    IsoDateTimeSchema = z.string().datetime({ offset: true });
+    UsernameSchema = z.string().min(3).max(32).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "username must be lowercase alphanumeric with single hyphens");
+    SlugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "slug must be lowercase alphanumeric with single hyphens");
+    FullSlugSchema = z.string().min(5).max(128).regex(/^[a-z0-9](-?[a-z0-9])*\/[a-z0-9](-?[a-z0-9])*$/, "full_slug must match {username}/{slug}");
+    SemverSchema = z.string().regex(
+      // eslint-disable-next-line no-useless-escape
+      /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/,
+      "must be a valid semver version"
+    );
+    SemverRangeSchema = z.string().min(1).max(32);
+    CursorSchema = z.string().min(1).max(512);
+    ToolSlugSchema = z.enum([
+      "claude-code",
+      "codex",
+      "cursor",
+      "antigravity",
+      "windsurf",
+      "continue",
+      "copilot",
+      "opencode",
+      "gemini-cli"
+    ]);
+    TagSchema = z.string().min(1).max(32).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/);
+    UrlSchema = z.string().url().startsWith("http");
+  }
+});
+
+// ../../packages/contracts/src/enums.ts
+import { z as z2 } from "zod";
+var HarnessTypeSchema, PHASE_1_TYPES, TierSchema, TIER_OF_TYPE, SortModeSchema, TimeWindowSchema, VisibilitySchema, ReviewStatusSchema, PublishStatusSchema, DependencyKindSchema, OAuthProviderSchema, UserRoleSchema, ReportReasonSchema;
+var init_enums = __esm({
+  "../../packages/contracts/src/enums.ts"() {
+    "use strict";
+    HarnessTypeSchema = z2.enum([
+      "mcp-server",
+      "project-rules",
+      "skill",
+      "custom-agent",
+      "hook",
+      "scoped-rule",
+      "mdc-rule",
+      "plugin"
+    ]);
+    PHASE_1_TYPES = [
+      "mcp-server",
+      "project-rules",
+      "skill",
+      "custom-agent",
+      "hook"
+    ];
+    TierSchema = z2.enum(["A", "B", "C", "D"]);
+    TIER_OF_TYPE = {
+      "mcp-server": "A",
+      "project-rules": "A",
+      skill: "A",
+      "custom-agent": "B",
+      "scoped-rule": "B",
+      hook: "C",
+      "mdc-rule": "C",
+      plugin: "D"
+    };
+    SortModeSchema = z2.enum([
+      "stars",
+      "downloads",
+      "recent",
+      "updated",
+      "trending",
+      "rising",
+      "relevance"
+    ]);
+    TimeWindowSchema = z2.enum(["24h", "7d", "30d"]);
+    VisibilitySchema = z2.enum(["public", "draft", "unlisted", "archived"]);
+    ReviewStatusSchema = z2.enum(["passed", "rejected", "pending_review"]);
+    PublishStatusSchema = z2.enum(["published", "rejected", "pending"]);
+    DependencyKindSchema = z2.enum(["required", "recommended"]);
+    OAuthProviderSchema = z2.enum(["discord", "github", "google"]);
+    UserRoleSchema = z2.enum(["user", "moderator", "admin"]);
+    ReportReasonSchema = z2.enum([
+      "spam",
+      "harmful",
+      "incorrect",
+      "copyright",
+      "other"
+    ]);
+  }
+});
+
+// ../../packages/contracts/src/errors.ts
+import { z as z3 } from "zod";
+var ErrorCodeSchema, ERROR_EXIT_CODES, ReviewFlagSchema, ApiErrorSchema;
+var init_errors = __esm({
+  "../../packages/contracts/src/errors.ts"() {
+    "use strict";
+    ErrorCodeSchema = z3.enum([
+      "generic_failure",
+      // 1
+      "usage_error",
+      // 2
+      "not_authenticated",
+      // 10
+      "not_authorized",
+      // 11
+      "network_unreachable",
+      // 20
+      "validation_failed",
+      // 30  (structure stage)
+      "rate_limited",
+      // 31
+      "ai_review_rejected",
+      // 32
+      /**
+       * jit_blocked — `kordis read` (POST /:u/:s/read) refused.
+       * Reasons surfaced via `flags`: type ineligible (mcp-server, hook),
+       * review not passed (and `--allow-pending` not set). See plan v1.1 JIT Read.
+       */
+      "jit_blocked",
+      // 33
+      "conflict",
+      // 40 (slug taken, version exists)
+      "filesystem_error",
+      // 50
+      "not_found",
+      "internal_error"
+    ]);
+    ERROR_EXIT_CODES = {
+      generic_failure: 1,
+      usage_error: 2,
+      not_authenticated: 10,
+      not_authorized: 11,
+      network_unreachable: 20,
+      validation_failed: 30,
+      rate_limited: 31,
+      ai_review_rejected: 32,
+      jit_blocked: 33,
+      conflict: 40,
+      filesystem_error: 50,
+      not_found: 1,
+      internal_error: 1
+    };
+    ReviewFlagSchema = z3.object({
+      code: z3.string().min(1).max(64),
+      message: z3.string().optional(),
+      field: z3.string().optional(),
+      hint: z3.string().optional()
+    });
+    ApiErrorSchema = z3.object({
+      error: z3.object({
+        code: ErrorCodeSchema,
+        message: z3.string(),
+        flags: z3.array(ReviewFlagSchema).optional(),
+        retry_after_seconds: z3.number().int().nonnegative().optional(),
+        request_id: z3.string().optional()
+      })
+    });
+  }
+});
+
+// ../../packages/contracts/src/pagination.ts
+import { z as z4 } from "zod";
+function paginatedResponseSchema(item) {
+  return z4.object({
+    results: z4.array(item),
+    next_cursor: z4.string().nullable(),
+    total: z4.number().int().nonnegative().nullable(),
+    sort: SortModeSchema.nullable(),
+    window: TimeWindowSchema.nullable()
+  });
+}
+var ListQuerySchema;
+var init_pagination = __esm({
+  "../../packages/contracts/src/pagination.ts"() {
+    "use strict";
+    init_primitives();
+    init_enums();
+    ListQuerySchema = z4.object({
+      sort: SortModeSchema.optional(),
+      limit: z4.coerce.number().int().min(1).max(100).default(20),
+      cursor: CursorSchema.optional()
+    });
+  }
+});
+
+// ../../packages/contracts/src/user.ts
+import { z as z5 } from "zod";
+var PublicUserSchema, SelfUserSchema, UserStatsSchema;
+var init_user = __esm({
+  "../../packages/contracts/src/user.ts"() {
+    "use strict";
+    init_primitives();
+    init_enums();
+    PublicUserSchema = z5.object({
+      id: UuidSchema,
+      username: UsernameSchema,
+      display_name: z5.string().max(64).nullable(),
+      bio: z5.string().max(500).nullable(),
+      avatar_url: UrlSchema.nullable(),
+      is_verified: z5.boolean(),
+      package_count: z5.number().int().nonnegative(),
+      follower_count: z5.number().int().nonnegative(),
+      created_at: IsoDateTimeSchema
+    });
+    SelfUserSchema = PublicUserSchema.extend({
+      primary_provider: OAuthProviderSchema,
+      role: UserRoleSchema,
+      following_count: z5.number().int().nonnegative(),
+      last_active_at: IsoDateTimeSchema.nullable()
+    });
+    UserStatsSchema = z5.object({
+      username: UsernameSchema,
+      package_count: z5.number().int().nonnegative(),
+      total_stars: z5.number().int().nonnegative(),
+      total_downloads: z5.number().int().nonnegative(),
+      total_pulls_7d: z5.number().int().nonnegative(),
+      trending_count: z5.number().int().nonnegative(),
+      first_published_at: IsoDateTimeSchema.nullable(),
+      last_published_at: IsoDateTimeSchema.nullable()
+    });
+  }
+});
+
+// ../../packages/contracts/src/package.ts
+import { z as z6 } from "zod";
+var DependencySpecSchema, PackageFrontmatterSchema, PackageSummarySchema, PackageDetailSchema, PackageVersionSchema, PackageVersionSummarySchema, VersionDiffSchema;
+var init_package = __esm({
+  "../../packages/contracts/src/package.ts"() {
+    "use strict";
+    init_primitives();
+    init_enums();
+    init_user();
+    init_errors();
+    DependencySpecSchema = z6.object({
+      full_slug: FullSlugSchema,
+      version_range: SemverRangeSchema.default("*"),
+      kind: DependencyKindSchema
+    });
+    PackageFrontmatterSchema = z6.object({
+      title: z6.string().min(1).max(200),
+      description: z6.string().min(1).max(500),
+      type: HarnessTypeSchema,
+      tools: z6.array(ToolSlugSchema).optional().default([]),
+      tags: z6.array(TagSchema).max(16).optional().default([]),
+      version: SemverSchema.optional(),
+      depends: z6.array(z6.string()).optional().default([]),
+      recommends: z6.array(z6.string()).optional().default([]),
+      meta: z6.record(z6.unknown()).optional().default({})
+    });
+    PackageSummarySchema = z6.object({
+      full_slug: FullSlugSchema,
+      title: z6.string(),
+      description: z6.string(),
+      type: HarnessTypeSchema,
+      tier: TierSchema,
+      current_version: SemverSchema,
+      author: PublicUserSchema.pick({
+        username: true,
+        display_name: true,
+        avatar_url: true,
+        is_verified: true
+      }),
+      stars: z6.number().int().nonnegative(),
+      downloads: z6.number().int().nonnegative(),
+      trending_score: z6.number().nullable(),
+      tools_compatible: z6.array(ToolSlugSchema),
+      tags: z6.array(TagSchema),
+      agent_skills_compliant: z6.boolean().optional(),
+      review_status: ReviewStatusSchema,
+      visibility: VisibilitySchema,
+      installed_locally: z6.boolean().optional(),
+      // stitched in by CLI, not server
+      quick_install: z6.string(),
+      url: UrlSchema,
+      created_at: IsoDateTimeSchema,
+      updated_at: IsoDateTimeSchema
+    });
+    PackageDetailSchema = PackageSummarySchema.extend({
+      id: UuidSchema,
+      slug: SlugSchema,
+      username: UsernameSchema,
+      pulls_7d: z6.number().int().nonnegative(),
+      pulls_30d: z6.number().int().nonnegative(),
+      comment_count: z6.number().int().nonnegative(),
+      rising_delta_ratio: z6.number().nullable(),
+      depends: z6.array(DependencySpecSchema),
+      recommends: z6.array(DependencySpecSchema),
+      categories: z6.array(z6.string()).optional().default([]),
+      verified_by_kordis: z6.boolean()
+    });
+    PackageVersionSchema = z6.object({
+      id: UuidSchema,
+      package_id: UuidSchema,
+      version: SemverSchema,
+      content: z6.string(),
+      changelog: z6.string().nullable(),
+      author: PublicUserSchema.pick({ username: true, display_name: true }),
+      is_prerelease: z6.boolean(),
+      review_status: ReviewStatusSchema,
+      review_score: z6.number().nullable(),
+      review_flags: z6.array(ReviewFlagSchema),
+      published_at: IsoDateTimeSchema
+    });
+    PackageVersionSummarySchema = PackageVersionSchema.omit({ content: true });
+    VersionDiffSchema = z6.object({
+      full_slug: FullSlugSchema,
+      from: SemverSchema,
+      to: SemverSchema,
+      unified_diff: z6.string(),
+      stats: z6.object({
+        additions: z6.number().int().nonnegative(),
+        deletions: z6.number().int().nonnegative(),
+        files_changed: z6.number().int().nonnegative()
+      })
+    });
+  }
+});
+
+// ../../packages/contracts/src/comment.ts
+import { z as z7 } from "zod";
+var CommentKindSchema, CommentStatusSchema, CommentSchema, CommentTreeSchema, CreateCommentRequestSchema, UpdateCommentRequestSchema, UpdateCommentStatusRequestSchema;
+var init_comment = __esm({
+  "../../packages/contracts/src/comment.ts"() {
+    "use strict";
+    init_primitives();
+    init_user();
+    CommentKindSchema = z7.enum([
+      "comment",
+      "tip",
+      "report",
+      "praise",
+      "question"
+    ]);
+    CommentStatusSchema = z7.enum(["open", "resolved"]);
+    CommentSchema = z7.object({
+      id: UuidSchema,
+      package_id: UuidSchema,
+      author: PublicUserSchema.pick({
+        username: true,
+        display_name: true,
+        avatar_url: true
+      }),
+      kind: CommentKindSchema,
+      title: z7.string().min(1).max(140).nullable(),
+      status: CommentStatusSchema.nullable(),
+      body: z7.string().min(1).max(1e4),
+      parent_id: UuidSchema.nullable(),
+      depth: z7.number().int().nonnegative(),
+      path: z7.string(),
+      reply_count: z7.number().int().nonnegative(),
+      reaction_count: z7.number().int().nonnegative(),
+      is_edited: z7.boolean(),
+      edited_at: IsoDateTimeSchema.nullable(),
+      is_deleted: z7.boolean(),
+      created_at: IsoDateTimeSchema
+    });
+    CommentTreeSchema = CommentSchema.extend({
+      replies: z7.lazy(() => z7.array(CommentTreeSchema))
+    });
+    CreateCommentRequestSchema = z7.object({
+      body: z7.string().min(1).max(1e4),
+      parent_id: UuidSchema.nullable().optional(),
+      kind: CommentKindSchema.optional().default("comment"),
+      title: z7.string().min(1).max(140).nullable().optional()
+    });
+    UpdateCommentRequestSchema = z7.object({
+      body: z7.string().min(1).max(1e4),
+      /** Allow editing the headline at the same time. */
+      title: z7.string().min(1).max(140).nullable().optional()
+    });
+    UpdateCommentStatusRequestSchema = z7.object({
+      status: CommentStatusSchema
+    });
+  }
+});
+
+// ../../packages/contracts/src/auth.ts
+import { z as z8 } from "zod";
+var PrincipalSchema, OAuthStartQuerySchema, DeviceCodeRequestSchema, DeviceCodeResponseSchema, DeviceTokenRequestSchema, TokenPairSchema, RefreshRequestSchema, SessionInfoSchema;
+var init_auth = __esm({
+  "../../packages/contracts/src/auth.ts"() {
+    "use strict";
+    init_primitives();
+    init_enums();
+    PrincipalSchema = z8.object({
+      user_id: UuidSchema,
+      session_id: UuidSchema.nullable(),
+      // null when authenticated via API token
+      api_token_id: UuidSchema.nullable(),
+      role: UserRoleSchema,
+      scopes: z8.array(z8.string()).default([])
+    });
+    OAuthStartQuerySchema = z8.object({
+      /**
+       * Optional redirect to complete after login. Client-initiated.
+       * Must match one of the registered return URLs.
+       */
+      return_to: z8.string().url().optional(),
+      /**
+       * Set when the CLI triggers login. The server writes the session into a
+       * transient cookie and the CLI polls a device-code endpoint to claim it.
+       */
+      from: z8.enum(["web", "cli"]).default("web")
+    });
+    DeviceCodeRequestSchema = z8.object({
+      provider: OAuthProviderSchema.default("discord")
+    });
+    DeviceCodeResponseSchema = z8.object({
+      device_code: z8.string().min(16),
+      user_code: z8.string().length(8),
+      // shown to the user: e.g. "KORDIS-AB12"
+      verification_url: z8.string().url(),
+      expires_in: z8.number().int().positive(),
+      // seconds
+      interval: z8.number().int().positive()
+      // polling interval hint
+    });
+    DeviceTokenRequestSchema = z8.object({
+      device_code: z8.string().min(16)
+    });
+    TokenPairSchema = z8.object({
+      access_token: z8.string(),
+      refresh_token: z8.string(),
+      token_type: z8.literal("Bearer"),
+      expires_in: z8.number().int().positive(),
+      session_id: UuidSchema
+    });
+    RefreshRequestSchema = z8.object({
+      refresh_token: z8.string()
+    });
+    SessionInfoSchema = z8.object({
+      id: UuidSchema,
+      provider: OAuthProviderSchema,
+      device_name: z8.string().nullable(),
+      ip_hash: z8.string().nullable(),
+      user_agent: z8.string().nullable(),
+      created_at: IsoDateTimeSchema,
+      last_seen_at: IsoDateTimeSchema,
+      expires_at: IsoDateTimeSchema,
+      is_current: z8.boolean()
+    });
+  }
+});
+
+// ../../packages/contracts/src/api.ts
+import { z as z9 } from "zod";
+var SearchQuerySchema, SearchResponseSchema, TrendingQuerySchema, RisingQuerySchema, PublishPackageRequestSchema, PublishWaitQuerySchema, PublishPackageResponseSchema, PackagePathParamsSchema, ContentQuerySchema, PackageContentResponseSchema, JitReadRequestSchema, JitReadResponseSchema, PullPackageResponseSchema, ListVersionsResponseSchema, VersionDiffQuerySchema, ListCommentsQuerySchema, ListCommentsResponseSchema, UserProfileResponseSchema, UserPackagesQuerySchema;
+var init_api = __esm({
+  "../../packages/contracts/src/api.ts"() {
+    "use strict";
+    init_primitives();
+    init_enums();
+    init_errors();
+    init_package();
+    init_pagination();
+    init_comment();
+    init_user();
+    SearchQuerySchema = z9.object({
+      q: z9.string().max(200).optional(),
+      type: z9.union([HarnessTypeSchema, z9.array(HarnessTypeSchema)]).optional().transform((v) => v === void 0 ? void 0 : Array.isArray(v) ? v : [v]),
+      tool: z9.union([ToolSlugSchema, z9.array(ToolSlugSchema)]).optional().transform((v) => v === void 0 ? void 0 : Array.isArray(v) ? v : [v]),
+      tier: TierSchema.optional(),
+      author: UsernameSchema.optional(),
+      tag: TagSchema.optional(),
+      sort: SortModeSchema.default("relevance"),
+      limit: z9.coerce.number().int().min(1).max(100).default(20),
+      cursor: CursorSchema.optional()
+    });
+    SearchResponseSchema = paginatedResponseSchema(PackageSummarySchema);
+    TrendingQuerySchema = z9.object({
+      window: TimeWindowSchema.default("24h"),
+      type: HarnessTypeSchema.optional(),
+      limit: z9.coerce.number().int().min(1).max(100).default(20),
+      cursor: CursorSchema.optional()
+    });
+    RisingQuerySchema = z9.object({
+      window: z9.enum(["7d"]).default("7d"),
+      type: HarnessTypeSchema.optional(),
+      limit: z9.coerce.number().int().min(1).max(100).default(20)
+    });
+    PublishPackageRequestSchema = z9.object({
+      /**
+       * Raw source content — YAML frontmatter + markdown body. Server parses and
+       * dispatches to the per-type validator in `@kordis/harness-schema`.
+       */
+      content: z9.string().min(50).max(1e5),
+      /**
+       * Inline overrides for frontmatter fields. Merged into parsed frontmatter
+       * server-side; existing frontmatter wins if both present.
+       */
+      title: z9.string().min(1).max(200).optional(),
+      description: z9.string().min(1).max(500).optional(),
+      type: HarnessTypeSchema.optional(),
+      slug: SlugSchema.optional(),
+      /**
+       * When updating, the target full_slug. Omitted for new packages (server
+       * derives slug from title or accepts inline `slug`).
+       */
+      target_full_slug: FullSlugSchema.optional(),
+      /**
+       * Bump strategy when updating. Ignored for first publish.
+       */
+      bump: z9.enum(["patch", "minor", "major"]).optional(),
+      changelog: z9.string().max(2e3).optional(),
+      depends: z9.array(z9.string()).optional(),
+      recommends: z9.array(z9.string()).optional(),
+      visibility: VisibilitySchema.optional(),
+      /**
+       * Skip draft validation (preview mode) — only allowed in dev builds.
+       */
+      dry_run: z9.boolean().optional()
+    });
+    PublishWaitQuerySchema = z9.object({
+      /**
+       * Synchronous AI-review wait window. 0 = never wait (always 202 + pending).
+       * Default 3000ms matches the fail-open plan.
+       */
+      wait_for_review: z9.coerce.number().int().min(0).max(15e3).default(3e3)
+    });
+    PublishPackageResponseSchema = z9.object({
+      status: PublishStatusSchema,
+      full_slug: FullSlugSchema,
+      version: SemverSchema,
+      tier: TierSchema,
+      type: HarnessTypeSchema,
+      url: z9.string().url(),
+      review: z9.object({
+        result: ReviewStatusSchema,
+        score: z9.number().nullable(),
+        flags: z9.array(ReviewFlagSchema),
+        duration_ms: z9.number().int().nonnegative().nullable(),
+        prompt_version: z9.string().nullable()
+      }),
+      diff: z9.object({
+        version_from: SemverSchema.nullable(),
+        version_to: SemverSchema
+      }).nullable(),
+      published_at: z9.string().datetime()
+    });
+    PackagePathParamsSchema = z9.object({
+      username: UsernameSchema,
+      slug: SlugSchema
+    });
+    ContentQuerySchema = z9.object({
+      /**
+       * Output format. `canonical` = Kordis internal form. Tool-specific formats
+       * run through `@kordis/translators`.
+       */
+      format: z9.enum(["canonical", ...ToolSlugSchema.options]).default("canonical"),
+      version: SemverSchema.optional()
+    });
+    PackageContentResponseSchema = z9.object({
+      full_slug: FullSlugSchema,
+      version: SemverSchema,
+      format: z9.string(),
+      content: z9.string(),
+      notes: z9.array(z9.string()).default([])
+      // translator warnings, e.g. ".mdc → Claude: @filepath unsupported"
+    });
+    JitReadRequestSchema = z9.object({
+      /**
+       * When true, packages with review_status='pending_review' are still
+       * returned. Default false — JIT trust gate is stricter than install
+       * because there's no human-inspection moment in the agent flow.
+       */
+      allow_pending: z9.boolean().optional().default(false),
+      /**
+       * Pin to a specific version. Bare slug → latest passed.
+       */
+      version: SemverSchema.optional()
+    });
+    JitReadResponseSchema = z9.object({
+      full_slug: FullSlugSchema,
+      version: SemverSchema,
+      /** Raw canonical body. Agent inlines this into its context. */
+      body: z9.string(),
+      type: HarnessTypeSchema,
+      tier: TierSchema,
+      /**
+       * One-line attribution string the agent SHOULD include in its reply when
+       * citing this skill, e.g. "following rayul/hwp-reader@0.3.1". Optional —
+       * KORDIS.md recommends but does not enforce.
+       */
+      attribution: z9.string(),
+      read_at: z9.string().datetime({ offset: true })
+    });
+    PullPackageResponseSchema = z9.object({
+      status: z9.enum(["installed", "already_installed", "skipped"]),
+      full_slug: FullSlugSchema,
+      version: SemverSchema,
+      installed_paths: z9.array(z9.string()),
+      tool_detected: ToolSlugSchema.nullable(),
+      format: z9.string(),
+      dependencies: z9.object({
+        required: z9.array(
+          z9.object({
+            full_slug: FullSlugSchema,
+            version: SemverSchema,
+            status: z9.enum(["installed", "already_installed", "skipped", "failed"]),
+            paths: z9.array(z9.string()).optional()
+          })
+        ),
+        recommended: z9.array(
+          z9.object({
+            full_slug: FullSlugSchema,
+            version: SemverSchema,
+            status: z9.enum(["installed", "skipped"]),
+            paths: z9.array(z9.string()).optional()
+          })
+        )
+      }),
+      recommends_hint: z9.string().nullable()
+    });
+    ListVersionsResponseSchema = z9.object({
+      full_slug: FullSlugSchema,
+      current_version: SemverSchema,
+      versions: z9.array(PackageVersionSummarySchema)
+    });
+    VersionDiffQuerySchema = z9.object({
+      from: SemverSchema,
+      to: SemverSchema
+    });
+    ListCommentsQuerySchema = z9.object({
+      sort: z9.enum(["recent", "old"]).default("recent"),
+      cursor: CursorSchema.optional(),
+      limit: z9.coerce.number().int().min(1).max(50).default(20),
+      /** Filter top-level posts by kind. Replies always come along with their root. */
+      kind: CommentKindSchema.optional()
+    });
+    ListCommentsResponseSchema = z9.object({
+      results: z9.array(CommentTreeSchema),
+      next_cursor: z9.string().nullable(),
+      total: z9.number().int().nonnegative()
+    });
+    UserProfileResponseSchema = PublicUserSchema.extend({
+      stats: UserStatsSchema
+    });
+    UserPackagesQuerySchema = z9.object({
+      sort: SortModeSchema.default("stars"),
+      type: HarnessTypeSchema.optional(),
+      limit: z9.coerce.number().int().min(1).max(100).default(20),
+      cursor: CursorSchema.optional()
+    });
+  }
+});
+
+// ../../packages/contracts/src/index.ts
+var init_src = __esm({
+  "../../packages/contracts/src/index.ts"() {
+    "use strict";
+    init_primitives();
+    init_enums();
+    init_errors();
+    init_pagination();
+    init_user();
+    init_package();
+    init_comment();
+    init_auth();
+    init_api();
+  }
+});
+
+// ../../packages/api-client/src/errors.ts
+var KordisApiError, KordisNetworkError;
+var init_errors2 = __esm({
+  "../../packages/api-client/src/errors.ts"() {
+    "use strict";
+    init_src();
+    KordisApiError = class extends Error {
+      code;
+      status;
+      flags;
+      retryAfter;
+      requestId;
+      constructor(status, envelope, requestId) {
+        super(envelope.error.message || `api_error(${envelope.error.code})`);
+        this.name = "KordisApiError";
+        this.code = envelope.error.code;
+        this.status = status;
+        this.flags = envelope.error.flags ?? [];
+        this.retryAfter = envelope.error.retry_after_seconds;
+        this.requestId = envelope.error.request_id ?? requestId;
+      }
+      exitCode() {
+        return ERROR_EXIT_CODES[this.code];
+      }
+    };
+    KordisNetworkError = class extends Error {
+      code = "network_unreachable";
+      constructor(message, cause) {
+        super(message, { cause });
+        this.name = "KordisNetworkError";
+      }
+      exitCode() {
+        return ERROR_EXIT_CODES.network_unreachable;
+      }
+    };
+  }
+});
+
+// ../../packages/api-client/src/client.ts
+var KordisClient;
+var init_client = __esm({
+  "../../packages/api-client/src/client.ts"() {
+    "use strict";
+    init_errors2();
+    KordisClient = class {
+      baseUrl;
+      fetchImpl;
+      config;
+      constructor(config) {
+        this.config = config;
+        this.baseUrl = config.baseUrl.replace(/\/$/, "");
+        this.fetchImpl = config.fetch ?? globalThis.fetch;
+        if (!this.fetchImpl) {
+          throw new Error("fetch is not available; pass config.fetch or run on Node 20+");
+        }
+      }
+      async authHeaders() {
+        const headers = {};
+        const token = await this.config.getAccessToken?.();
+        if (token) headers.authorization = `Bearer ${token}`;
+        if (this.config.userAgent) headers["user-agent"] = this.config.userAgent;
+        return headers;
+      }
+      async request(path, opts = {}) {
+        const url = new URL(this.baseUrl + path);
+        if (opts.query) {
+          for (const [k, v] of Object.entries(opts.query)) {
+            if (v === void 0) continue;
+            if (Array.isArray(v)) for (const item of v) url.searchParams.append(k, String(item));
+            else url.searchParams.append(k, String(v));
+          }
+        }
+        const headers = {
+          accept: "application/json",
+          ...await this.authHeaders(),
+          ...opts.headers ?? {}
+        };
+        if (opts.body !== void 0) headers["content-type"] = "application/json";
+        let res;
+        try {
+          const init = {
+            method: opts.method ?? "GET",
+            headers,
+            cache: "no-store"
+          };
+          if (opts.body !== void 0) init.body = JSON.stringify(opts.body);
+          res = await this.fetchImpl(url, init);
+        } catch (err) {
+          throw new KordisNetworkError(
+            `cannot reach ${url.hostname}: ${err.message}`,
+            err
+          );
+        }
+        const requestId = res.headers.get("x-request-id") ?? void 0;
+        if (res.status === 204) return void 0;
+        const text = await res.text();
+        const parsed = text ? JSON.parse(text) : void 0;
+        if (!res.ok) {
+          throw new KordisApiError(res.status, parsed, requestId);
+        }
+        return parsed;
+      }
+      // ─── auth ──────────────────────────────────────────────────────────────
+      startDeviceFlow(provider = "discord") {
+        return this.request("/auth/device/code", {
+          method: "POST",
+          body: { provider }
+        });
+      }
+      pollDeviceFlow(deviceCode) {
+        return this.request("/auth/device/token", {
+          method: "POST",
+          body: { device_code: deviceCode }
+        });
+      }
+      refreshSession(refreshToken) {
+        return this.request("/auth/sessions/refresh", {
+          method: "POST",
+          body: { refresh_token: refreshToken }
+        });
+      }
+      listSessions() {
+        return this.request("/auth/sessions");
+      }
+      revokeSession(id) {
+        return this.request(`/auth/sessions/${id}`, { method: "DELETE" });
+      }
+      revokeAllSessions() {
+        return this.request("/auth/sessions/revoke-all", { method: "POST" });
+      }
+      // ─── users ─────────────────────────────────────────────────────────────
+      me() {
+        return this.request("/api/me");
+      }
+      // ─── packages ──────────────────────────────────────────────────────────
+      publish(body, opts = {}) {
+        return this.request("/api/packages", {
+          method: "POST",
+          body,
+          query: opts.waitForReviewMs !== void 0 ? { wait_for_review: opts.waitForReviewMs } : void 0
+        });
+      }
+      update(username, slug, body) {
+        return this.request(`/api/packages/${username}/${slug}`, {
+          method: "PUT",
+          body
+        });
+      }
+      getPackage(username, slug) {
+        return this.request(`/api/packages/${username}/${slug}`);
+      }
+      getContent(username, slug, opts = {}) {
+        return this.request(
+          `/api/packages/${username}/${slug}/content`,
+          { query: opts }
+        );
+      }
+      pull(username, slug) {
+        return this.request(
+          `/api/packages/${username}/${slug}/pull`,
+          { method: "POST" }
+        );
+      }
+      /**
+       * JIT read — fetch the canonical body into agent context. Plan v1.1.
+       * Server enforces type eligibility (text-bearing types only) and trust gate
+       * (passed-only unless `allow_pending=true`).
+       */
+      jitRead(username, slug, body = {}) {
+        return this.request(
+          `/api/packages/${username}/${slug}/read`,
+          { method: "POST", body }
+        );
+      }
+      search(query) {
+        return this.request("/api/packages/search", {
+          query
+        });
+      }
+      recent() {
+        return this.request("/api/packages/recent");
+      }
+      trending(window = "24h") {
+        return this.request("/api/packages/trending", { query: { window } });
+      }
+      popular() {
+        return this.request("/api/packages/popular");
+      }
+      versions(username, slug) {
+        return this.request(
+          `/api/packages/${username}/${slug}/versions`
+        );
+      }
+      diff(username, slug, from, to) {
+        return this.request(`/api/packages/${username}/${slug}/diff`, {
+          query: { from, to }
+        });
+      }
+      // ─── comments ──────────────────────────────────────────────────────────
+      listComments(username, slug, query = {}) {
+        return this.request(
+          `/api/packages/${username}/${slug}/comments`,
+          { query }
+        );
+      }
+      createComment(username, slug, body) {
+        return this.request(`/api/packages/${username}/${slug}/comments`, {
+          method: "POST",
+          body
+        });
+      }
+      updateComment(id, body) {
+        return this.request(`/api/comments/${id}`, {
+          method: "PATCH",
+          body
+        });
+      }
+      /**
+       * Flip a `report` between `open` and `resolved`. Allowed parties: report
+       * author, package owner, moderators. Server returns 422 (`usage`) on a
+       * non-report or already-deleted target.
+       */
+      setCommentStatus(id, body) {
+        return this.request(`/api/comments/${id}/status`, {
+          method: "PATCH",
+          body
+        });
+      }
+      deleteComment(id) {
+        return this.request(`/api/comments/${id}`, { method: "DELETE" });
+      }
+      listReplies(id) {
+        return this.request(
+          `/api/comments/${id}/replies`
+        );
+      }
+    };
+  }
+});
+
+// ../../packages/api-client/src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  KordisApiError: () => KordisApiError,
+  KordisClient: () => KordisClient,
+  KordisNetworkError: () => KordisNetworkError
+});
+var init_src2 = __esm({
+  "../../packages/api-client/src/index.ts"() {
+    "use strict";
+    init_client();
+    init_errors2();
+  }
+});
+
+// src/index.ts
+init_src2();
+import { Command as Command10 } from "commander";
+
+// src/commands/login.ts
+import { Command } from "commander";
+
+// src/client.ts
+init_src2();
+
+// src/config.ts
+import { homedir } from "os";
+import { join } from "path";
+import { mkdir, readFile, writeFile } from "fs/promises";
+function configDir() {
+  return process.env["KORDIS_HOME"] ?? join(homedir(), ".kordis");
+}
+function configPath() {
+  return join(configDir(), "config.json");
+}
+async function loadCliConfig() {
+  const apiUrlFromEnv = process.env["KORDIS_API_URL"];
+  try {
+    const raw = await readFile(configPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      apiUrl: apiUrlFromEnv ?? parsed.apiUrl ?? "https://api.kordis.dev",
+      ...parsed.username ? { username: parsed.username } : {},
+      ...parsed.sessionId ? { sessionId: parsed.sessionId } : {}
+    };
+  } catch {
+    return { apiUrl: apiUrlFromEnv ?? "https://api.kordis.dev" };
+  }
+}
+async function saveCliConfig(cfg) {
+  await mkdir(configDir(), { recursive: true });
+  await writeFile(configPath(), JSON.stringify(cfg, null, 2) + "\n", "utf8");
+}
+
+// src/keychain.ts
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, unlink } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var SERVICE = "kordis";
+async function loadKeytar() {
+  try {
+    const mod = await import("keytar");
+    return mod.default ?? mod;
+  } catch {
+    return null;
+  }
+}
+function fallbackPath() {
+  return join2(process.env["KORDIS_HOME"] ?? join2(homedir2(), ".kordis"), ".tokens.json");
+}
+async function createKeychain() {
+  const keytar = await loadKeytar();
+  if (keytar) {
+    return {
+      async save(username, tokens) {
+        await keytar.setPassword(SERVICE, username, JSON.stringify(tokens));
+      },
+      async load(username) {
+        const str = await keytar.getPassword(SERVICE, username);
+        return str ? JSON.parse(str) : null;
+      },
+      async remove(username) {
+        await keytar.deletePassword(SERVICE, username);
+      }
+    };
+  }
+  const store = await readAll();
+  return {
+    async save(username, tokens) {
+      store[username] = tokens;
+      await mkdir2(join2(fallbackPath(), ".."), { recursive: true });
+      await writeFile2(fallbackPath(), JSON.stringify(store, null, 2), { mode: 384 });
+    },
+    async load(username) {
+      return store[username] ?? null;
+    },
+    async remove(username) {
+      delete store[username];
+      if (Object.keys(store).length === 0) {
+        await unlink(fallbackPath()).catch(() => {
+        });
+      } else {
+        await writeFile2(fallbackPath(), JSON.stringify(store, null, 2), { mode: 384 });
+      }
+    }
+  };
+}
+async function readAll() {
+  try {
+    const raw = await readFile2(fallbackPath(), "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+
+// src/client.ts
+async function useClient() {
+  const cfg = await loadCliConfig();
+  const keychain = await createKeychain();
+  const username = cfg.username ?? null;
+  let currentTokens = username ? await keychain.load(username) : null;
+  const api = new KordisClient({
+    baseUrl: cfg.apiUrl,
+    userAgent: `kordis-cli/0.0.1 node/${process.version}`,
+    getAccessToken: async () => currentTokens?.access_token
+  });
+  const authedRequest = async (fn) => {
+    try {
+      return await fn(api);
+    } catch (err) {
+      if (err instanceof KordisApiError && err.code === "not_authenticated" && currentTokens && username) {
+        try {
+          const refreshed = await api.refreshSession(currentTokens.refresh_token);
+          currentTokens = {
+            access_token: refreshed.access_token,
+            refresh_token: refreshed.refresh_token,
+            session_id: refreshed.session_id,
+            expires_at_epoch: Math.floor(Date.now() / 1e3) + refreshed.expires_in
+          };
+          await keychain.save(username, currentTokens);
+          await saveCliConfig({ ...cfg, sessionId: refreshed.session_id });
+          return await fn(api);
+        } catch {
+          throw err;
+        }
+      }
+      throw err;
+    }
+  };
+  return { api, keychain, username, apiUrl: cfg.apiUrl, authedRequest };
+}
+
+// src/ui.ts
+import kleur from "kleur";
+import ora from "ora";
+var jsonMode = false;
+function setJsonMode(on) {
+  jsonMode = on;
+}
+function isJsonMode() {
+  return jsonMode;
+}
+function printHuman(text) {
+  if (!jsonMode) process.stdout.write(text + "\n");
+}
+function printJson(obj) {
+  if (jsonMode) process.stdout.write(JSON.stringify(obj) + "\n");
+}
+function printDual(args) {
+  if (jsonMode) printJson(args.json);
+  else args.human();
+}
+function spinner(text) {
+  if (jsonMode) {
+    return {
+      succeed: () => {
+      },
+      fail: () => {
+      },
+      stop: () => {
+      }
+    };
+  }
+  return ora({ text, color: "cyan" }).start();
+}
+var c = kleur;
+
+// src/commands/login.ts
+function loginCommand() {
+  return new Command("login").description("authenticate with the Kordis registry").option("--provider <name>", "OAuth provider", "discord").action(async (opts) => {
+    const bundle = await useClient();
+    const started = spinner("Requesting device code");
+    const device = await bundle.api.startDeviceFlow(
+      opts.provider ?? "discord"
+    );
+    started.succeed();
+    printHuman("");
+    printHuman(c.bold("To continue, open this URL in a browser:"));
+    printHuman("  " + c.cyan(device.verification_url));
+    printHuman(c.bold("And confirm the code:"));
+    printHuman("  " + c.yellow(device.user_code));
+    printHuman("");
+    const poll = spinner("Waiting for browser confirmation");
+    const start = Date.now();
+    const deadline = start + device.expires_in * 1e3;
+    while (Date.now() < deadline) {
+      try {
+        const tokens = await bundle.api.pollDeviceFlow(device.device_code);
+        poll.succeed();
+        await bundle.keychain.save(
+          // username set below after /me call
+          "pending",
+          {
+            access_token: tokens.access_token,
+            refresh_token: tokens.refresh_token,
+            session_id: tokens.session_id,
+            expires_at_epoch: Math.floor(Date.now() / 1e3) + tokens.expires_in
+          }
+        );
+        const me = await new (await Promise.resolve().then(() => (init_src2(), src_exports))).KordisClient({
+          baseUrl: bundle.apiUrl,
+          getAccessToken: () => tokens.access_token
+        }).me();
+        await bundle.keychain.remove("pending");
+        await bundle.keychain.save(me.username, {
+          access_token: tokens.access_token,
+          refresh_token: tokens.refresh_token,
+          session_id: tokens.session_id,
+          expires_at_epoch: Math.floor(Date.now() / 1e3) + tokens.expires_in
+        });
+        const cfg = await loadCliConfig();
+        await saveCliConfig({ ...cfg, username: me.username, sessionId: tokens.session_id });
+        printDual({
+          json: { status: "logged_in", username: me.username, session_id: tokens.session_id },
+          human: () => printHuman(c.green(`
+\u2713 Logged in as ${c.bold(me.username)}.`))
+        });
+        return;
+      } catch (err) {
+        const msg = err.code;
+        if (msg && msg !== "authorization_pending") throw err;
+        await new Promise((r) => setTimeout(r, (device.interval || 5) * 1e3));
+      }
+    }
+    poll.fail("Timed out");
+    throw new Error("device code expired; run `kordis login` again");
+  });
+}
+
+// src/commands/whoami.ts
+import { Command as Command2 } from "commander";
+function whoamiCommand() {
+  return new Command2("whoami").description("show the currently authenticated user").action(async () => {
+    const bundle = await useClient();
+    if (!bundle.username) {
+      printHuman(c.yellow("Not logged in. Run `kordis login`."));
+      process.exitCode = 10;
+      return;
+    }
+    const me = await bundle.authedRequest((api) => api.me());
+    printDual({
+      json: me,
+      human: () => {
+        printHuman(c.bold(me.username));
+        if (me.display_name) printHuman(`  ${me.display_name}`);
+        printHuman(`  ${me.package_count} packages \xB7 ${me.follower_count} followers`);
+      }
+    });
+  });
+}
+
+// src/commands/search.ts
+import { Command as Command3 } from "commander";
+function searchCommand() {
+  return new Command3("search").description("search the Kordis registry").argument("[query...]", "keywords to match against title/description").option("--type <type>", "filter by harness type (skill|mcp-server|project-rules|custom-agent|hook)").option("--tool <tool>", "filter by compatible tool (claude-code|codex|cursor|...)").option("--limit <n>", "max results", (v) => parseInt(v, 10), 20).action(async (query, opts) => {
+    const bundle = await useClient();
+    const res = await bundle.api.search({
+      q: query.join(" ") || void 0,
+      type: opts.type ? [opts.type] : void 0,
+      tool: opts.tool ? [opts.tool] : void 0,
+      limit: opts.limit
+    });
+    printDual({
+      json: res,
+      human: () => {
+        if (res.results.length === 0) {
+          printHuman(c.yellow("(no results)"));
+          return;
+        }
+        for (const p of res.results) {
+          printHuman(
+            `${c.bold(p.full_slug)} ${c.gray(`v${p.current_version}`)} ${c.cyan(`[${p.type}]`)}`
+          );
+          printHuman(`  ${p.description}`);
+          printHuman(
+            c.gray(`  \u2605 ${p.stars}  \u21E3 ${p.downloads}  ${p.author.username}${p.author.is_verified ? " \u2713" : ""}`)
+          );
+          printHuman("");
+        }
+      }
+    });
+  });
+}
+
+// src/commands/push.ts
+import { Command as Command4 } from "commander";
+import { readFile as readFile3 } from "fs/promises";
+import { resolve } from "path";
+function pushCommand() {
+  return new Command4("push").description("publish a new package or a new version").argument("<file>", "path to the canonical package source").option("--bump <strategy>", "patch|minor|major (update only)", "patch").option("--slug <slug>", "override slug (for first publish)").option("--type <type>", "override type inference").option("--changelog <text>", "optional changelog entry").option("--dry-run", "validate only; do not publish").option("--no-wait", "return immediately without waiting for review").action(
+    async (file, opts) => {
+      const bundle = await useClient();
+      const abs = resolve(process.cwd(), file);
+      const content = await readFile3(abs, "utf8");
+      const spin = spinner(opts.dryRun ? "Validating" : "Publishing");
+      const res = await bundle.authedRequest(
+        (api) => api.publish(
+          {
+            content,
+            bump: opts.bump,
+            slug: opts.slug,
+            type: opts.type,
+            changelog: opts.changelog,
+            dry_run: !!opts.dryRun
+          },
+          {
+            waitForReviewMs: opts.wait === false ? 0 : 3e3
+          }
+        )
+      );
+      spin.succeed();
+      printDual({
+        json: res,
+        human: () => {
+          printHuman(
+            `${c.bold(res.full_slug)} ${c.gray(`v${res.version}`)} \u2192 ${res.status === "published" ? c.green("published") : res.status === "pending" ? c.yellow("pending review") : c.red("rejected")}`
+          );
+          printHuman(`  ${c.cyan(res.url)}`);
+          if (res.review.flags.length > 0) {
+            printHuman(c.yellow(`  ${res.review.flags.length} review flag(s):`));
+            for (const f of res.review.flags) {
+              printHuman(c.yellow(`    - ${f.code}${f.message ? `: ${f.message}` : ""}`));
+            }
+          }
+        }
+      });
+    }
+  );
+}
+
+// src/commands/pull.ts
+import { Command as Command5 } from "commander";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { dirname, join as join3 } from "path";
+
+// ../../packages/harness-schema/src/parser.ts
+import { parse as parseYaml } from "yaml";
+var FRONTMATTER_FENCE_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+function parseFrontmatter(source) {
+  const stripped = source.replace(/^\uFEFF/, "");
+  const match = FRONTMATTER_FENCE_RE.exec(stripped);
+  if (!match) {
+    return { frontmatter: null, body: stripped, bodyOffset: 0 };
+  }
+  const raw = match[1] ?? "";
+  let parsed;
+  try {
+    parsed = parseYaml(raw);
+  } catch (err) {
+    throw new FrontmatterParseError(
+      `YAML frontmatter is malformed: ${err.message}`,
+      { cause: err }
+    );
+  }
+  if (parsed === null || parsed === void 0) {
+    return { frontmatter: {}, body: stripped.slice(match[0].length), bodyOffset: match[0].length };
+  }
+  if (typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new FrontmatterParseError(
+      "YAML frontmatter must decode to an object, got " + typeof parsed
+    );
+  }
+  return {
+    frontmatter: parsed,
+    body: stripped.slice(match[0].length),
+    bodyOffset: match[0].length
+  };
+}
+var FrontmatterParseError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "FrontmatterParseError";
+  }
+};
+
+// ../../packages/harness-schema/src/deps.ts
+init_src();
+import { z as z10 } from "zod";
+var StringDepRe = /^([a-z0-9](-?[a-z0-9])*\/[a-z0-9](-?[a-z0-9])*)(?:@(.+))?$/;
+var ObjectDepSchema = z10.object({
+  full_slug: FullSlugSchema,
+  version_range: SemverRangeSchema.default("*")
+});
+function normaliseDepList(list) {
+  if (list === void 0 || list === null) return [];
+  if (!Array.isArray(list)) {
+    throw new Error("depends/recommends must be an array");
+  }
+  return list.map((entry, idx) => normaliseDep(entry, idx));
+}
+function normaliseDep(entry, idx) {
+  if (typeof entry === "string") {
+    const m = StringDepRe.exec(entry);
+    if (!m) {
+      throw new Error(
+        `entry #${idx + 1} "${entry}" must be "{username}/{slug}" optionally followed by "@<range>"`
+      );
+    }
+    return {
+      full_slug: m[1],
+      version_range: (m[3] ?? "*").trim()
+    };
+  }
+  if (typeof entry === "object" && entry !== null) {
+    const parsed = ObjectDepSchema.parse(entry);
+    return parsed;
+  }
+  throw new Error(`entry #${idx + 1} must be a string or object, got ${typeof entry}`);
+}
+
+// ../../packages/harness-schema/src/validator.ts
+init_src();
+
+// ../../packages/harness-schema/src/types/skill.ts
+init_src();
+import { z as z11 } from "zod";
+var SkillFrontmatterSchema = z11.object({
+  name: z11.string().min(1).max(64).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "name must be lowercase-with-hyphens (Agent Skills spec)"),
+  description: z11.string().min(1).max(500),
+  version: SemverSchema.optional(),
+  // Agent Skills optional metadata
+  license: z11.string().max(64).optional(),
+  homepage: z11.string().url().optional(),
+  model: z11.string().optional(),
+  // model override hint
+  "allowed-tools": z11.array(z11.string()).optional(),
+  "disable-model-invocation": z11.boolean().optional(),
+  // Kordis-forwarded cross-type fields (kept minimal to not pollute the spec)
+  title: z11.string().min(1).max(200).optional(),
+  tags: z11.array(TagSchema).max(16).optional(),
+  tools: z11.array(ToolSlugSchema).optional()
+}).strict();
+
+// ../../packages/harness-schema/src/types/mcp-server.ts
+init_src();
+import { z as z12 } from "zod";
+var McpTransportSchema = z12.union([
+  z12.object({
+    type: z12.literal("stdio"),
+    command: z12.string().min(1),
+    args: z12.array(z12.string()).optional().default([]),
+    env: z12.record(z12.string()).optional().default({})
+  }),
+  z12.object({
+    type: z12.enum(["http", "sse"]),
+    url: z12.string().url(),
+    headers: z12.record(z12.string()).optional().default({})
+  })
+]);
+var McpCapabilitiesSchema = z12.object({
+  tools: z12.array(z12.string()).optional().default([]),
+  resources: z12.array(z12.string()).optional().default([]),
+  prompts: z12.array(z12.string()).optional().default([])
+});
+var McpServerFrontmatterSchema = z12.object({
+  name: z12.string().min(1).max(64).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/),
+  description: z12.string().min(1).max(500),
+  version: SemverSchema,
+  mcp_spec_version: z12.string().default("2026-03"),
+  transport: McpTransportSchema,
+  capabilities: McpCapabilitiesSchema.optional().default({
+    tools: [],
+    resources: [],
+    prompts: []
+  }),
+  /** Human-readable setup / auth instructions. Surfaced in `kordis info`. */
+  auth_notes: z12.string().optional(),
+  /** Required env vars with description + whether they must be secret. */
+  env_schema: z12.record(
+    z12.object({
+      description: z12.string(),
+      required: z12.boolean().default(true),
+      secret: z12.boolean().default(false)
+    })
+  ).optional(),
+  homepage: z12.string().url().optional(),
+  repository: z12.string().url().optional(),
+  license: z12.string().max(64).optional(),
+  title: z12.string().min(1).max(200).optional()
+}).strict();
+
+// ../../packages/harness-schema/src/types/project-rules.ts
+init_src();
+import { z as z13 } from "zod";
+var ProjectRulesFrontmatterSchema = z13.object({
+  title: z13.string().min(1).max(200),
+  description: z13.string().min(1).max(500),
+  version: SemverSchema.optional(),
+  scope: z13.enum(["root", "nested", "globs"]).default("root"),
+  target_path: z13.string().optional(),
+  globs: z13.array(z13.string()).optional(),
+  target_tools: z13.array(ToolSlugSchema).optional().default([]),
+  /** When true, installation is idempotent via `<!-- kordis:... -->` markers. */
+  mergeable: z13.boolean().default(true),
+  license: z13.string().max(64).optional()
+}).strict().refine(
+  (v) => v.scope !== "nested" || !!v.target_path,
+  { message: 'scope="nested" requires target_path' }
+).refine(
+  (v) => v.scope !== "globs" || v.globs && v.globs.length > 0,
+  { message: 'scope="globs" requires a non-empty globs list' }
+);
+
+// ../../packages/harness-schema/src/types/custom-agent.ts
+init_src();
+import { z as z14 } from "zod";
+var CustomAgentFrontmatterSchema = z14.object({
+  name: z14.string().min(1).max(64).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/),
+  description: z14.string().min(1).max(500),
+  title: z14.string().min(1).max(200).optional(),
+  version: SemverSchema.optional(),
+  /** System prompt that defines the agent's persona + rules. Required. */
+  system_prompt: z14.string().min(1).max(5e4),
+  /** Optional model override — string passed verbatim to the host. */
+  model: z14.string().optional(),
+  /** Tools this agent can call. Host-specific names (no uniform namespace). */
+  allowed_tools: z14.array(z14.string()).optional().default([]),
+  disallowed_tools: z14.array(z14.string()).optional().default([]),
+  /** Fork/context behaviour hint (Claude: `context: fork` etc.). */
+  context: z14.enum(["inherit", "fork", "isolated"]).optional(),
+  /** Known-good tool runtimes. Empty = untested everywhere. */
+  tool_compat: z14.array(ToolSlugSchema).optional().default([]),
+  /** Pre-load skills when this agent activates. */
+  preload_skills: z14.array(z14.string()).optional().default([]),
+  license: z14.string().max(64).optional(),
+  homepage: z14.string().url().optional()
+}).strict();
+
+// ../../packages/harness-schema/src/types/hook.ts
+init_src();
+import { z as z15 } from "zod";
+var HookEventSchema = z15.enum([
+  "PreToolUse",
+  "PostToolUse",
+  "UserPromptSubmit",
+  "PreCompact",
+  "Stop",
+  "SessionStart",
+  "SessionEnd",
+  "SubagentStart",
+  "SubagentStop",
+  "Background"
+]);
+var HookActionSchema = z15.union([
+  z15.object({
+    type: z15.literal("command"),
+    command: z15.string().min(1),
+    timeout_ms: z15.number().int().positive().max(6e5).optional(),
+    blocking: z15.boolean().default(false)
+  }),
+  z15.object({
+    type: z15.literal("http"),
+    url: z15.string().url(),
+    method: z15.enum(["GET", "POST", "PUT", "PATCH"]).default("POST"),
+    headers: z15.record(z15.string()).optional().default({}),
+    timeout_ms: z15.number().int().positive().max(6e5).optional(),
+    blocking: z15.boolean().default(false)
+  })
+]);
+var HookBindingSchema = z15.object({
+  event: HookEventSchema,
+  matcher: z15.string().optional(),
+  action: HookActionSchema
+});
+var HookFrontmatterSchema = z15.object({
+  name: z15.string().min(1).max(64).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/),
+  description: z15.string().min(1).max(500),
+  title: z15.string().min(1).max(200).optional(),
+  version: SemverSchema.optional(),
+  /** One or more hook bindings. */
+  hooks: z15.array(HookBindingSchema).min(1),
+  /** Declared to surface in search filters — always "claude-code" for now. */
+  tool_compat: z15.array(z15.enum(["claude-code"])).default(["claude-code"]),
+  license: z15.string().max(64).optional()
+}).strict();
+
+// ../../packages/harness-schema/src/validator.ts
+function flag(code, message, extra = {}) {
+  return { code, message, ...extra };
+}
+function validatePackageSource(source) {
+  const flags = [];
+  let body = source;
+  let rawFrontmatter = null;
+  try {
+    const parsed = parseFrontmatter(source);
+    body = parsed.body;
+    rawFrontmatter = parsed.frontmatter;
+  } catch (err) {
+    if (err instanceof FrontmatterParseError) {
+      return earlyExit(flag("malformed_frontmatter", err.message));
+    }
+    throw err;
+  }
+  if (!rawFrontmatter) {
+    return earlyExit(flag("missing_frontmatter", "package must start with a YAML frontmatter block"));
+  }
+  const typeValue = rawFrontmatter["type"];
+  if (typeof typeValue !== "string") {
+    return earlyExit(
+      flag("missing_required_frontmatter", "`type` is required in frontmatter", { field: "type" })
+    );
+  }
+  const typeParse = HarnessTypeSchema.safeParse(typeValue);
+  if (!typeParse.success) {
+    return earlyExit(
+      flag(
+        "unknown_type",
+        `type "${typeValue}" is not a recognised Harness type`,
+        { field: "type" }
+      )
+    );
+  }
+  const type = typeParse.data;
+  if (!PHASE_1_TYPES.includes(type)) {
+    flags.push(
+      flag(
+        "type_not_phase1",
+        `type "${type}" is planned for Phase 2+ and is not yet accepted`,
+        { field: "type" }
+      )
+    );
+    return earlyExit(null, { flags, body });
+  }
+  const {
+    type: _discard_type,
+    depends: _discard_depends,
+    recommends: _discard_recommends,
+    ...typeSpecific
+  } = rawFrontmatter;
+  void _discard_type;
+  void _discard_depends;
+  void _discard_recommends;
+  const result = dispatchValidation(type, typeSpecific);
+  if (!result.ok) {
+    flags.push(...result.flags);
+    return earlyExit(null, { flags, body });
+  }
+  const common = {
+    title: typeof rawFrontmatter["title"] === "string" ? rawFrontmatter["title"] : typeof rawFrontmatter["name"] === "string" ? rawFrontmatter["name"] : null,
+    description: typeof rawFrontmatter["description"] === "string" ? rawFrontmatter["description"] : null
+  };
+  if (!common.title) flags.push(flag("missing_title", "title (or name) is required"));
+  if (!common.description) flags.push(flag("missing_description", "description is required"));
+  let depends = [];
+  let recommends = [];
+  try {
+    depends = normaliseDepList(rawFrontmatter["depends"]).map((d) => ({
+      full_slug: d.full_slug,
+      version_range: d.version_range,
+      kind: DependencyKindSchema.parse("required")
+    }));
+  } catch (err) {
+    flags.push(flag("invalid_depends", err.message, { field: "depends" }));
+  }
+  try {
+    recommends = normaliseDepList(rawFrontmatter["recommends"]).map((d) => ({
+      full_slug: d.full_slug,
+      version_range: d.version_range,
+      kind: DependencyKindSchema.parse("recommended")
+    }));
+  } catch (err) {
+    flags.push(flag("invalid_recommends", err.message, { field: "recommends" }));
+  }
+  if (body.trim().length < 50) {
+    flags.push(flag("content_too_short", "body must be at least 50 non-whitespace characters"));
+  }
+  if (body.length > 1e5) {
+    flags.push(flag("content_too_long", "body exceeds 100 kB cap"));
+  }
+  const ok = flags.every((f) => !BLOCKING_CODES.has(f.code));
+  return {
+    ok,
+    type,
+    tier: TIER_OF_TYPE[type],
+    frontmatter: result.frontmatter,
+    body,
+    common,
+    depends,
+    recommends,
+    flags
+  };
+}
+var BLOCKING_CODES = /* @__PURE__ */ new Set([
+  "missing_frontmatter",
+  "malformed_frontmatter",
+  "missing_required_frontmatter",
+  "unknown_type",
+  "type_not_phase1",
+  "missing_title",
+  "missing_description",
+  "invalid_frontmatter",
+  "content_too_short",
+  "content_too_long"
+]);
+function earlyExit(firstFlag, override = {}) {
+  return {
+    ok: false,
+    type: null,
+    tier: null,
+    frontmatter: null,
+    body: "",
+    common: { title: null, description: null },
+    depends: [],
+    recommends: [],
+    flags: firstFlag ? [firstFlag] : [],
+    ...override
+  };
+}
+function dispatchValidation(type, raw) {
+  switch (type) {
+    case "skill": {
+      const r = SkillFrontmatterSchema.safeParse(raw);
+      if (!r.success) return zodFail(r.error.issues);
+      return { ok: true, frontmatter: { type, data: r.data }, flags: [] };
+    }
+    case "mcp-server": {
+      const r = McpServerFrontmatterSchema.safeParse(raw);
+      if (!r.success) return zodFail(r.error.issues);
+      return { ok: true, frontmatter: { type, data: r.data }, flags: [] };
+    }
+    case "project-rules": {
+      const r = ProjectRulesFrontmatterSchema.safeParse(raw);
+      if (!r.success) return zodFail(r.error.issues);
+      return { ok: true, frontmatter: { type, data: r.data }, flags: [] };
+    }
+    case "custom-agent": {
+      const r = CustomAgentFrontmatterSchema.safeParse(raw);
+      if (!r.success) return zodFail(r.error.issues);
+      return { ok: true, frontmatter: { type, data: r.data }, flags: [] };
+    }
+    case "hook": {
+      const r = HookFrontmatterSchema.safeParse(raw);
+      if (!r.success) return zodFail(r.error.issues);
+      return { ok: true, frontmatter: { type, data: r.data }, flags: [] };
+    }
+    default:
+      return {
+        ok: false,
+        frontmatter: null,
+        flags: [
+          flag("type_not_phase1", `type "${type}" not accepted in Phase 1`, { field: "type" })
+        ]
+      };
+  }
+}
+function zodFail(issues) {
+  return {
+    ok: false,
+    frontmatter: null,
+    flags: issues.map(
+      (i) => flag("invalid_frontmatter", i.message, { field: i.path.join(".") || void 0 })
+    )
+  };
+}
+
+// ../../packages/translators/src/skill/identity.ts
+function buildSkillFile(input, outputPath) {
+  const body = input.body.trimStart();
+  const fm = input.frontmatter;
+  const name = typeof fm["name"] === "string" ? fm["name"] : input.fullSlug.split("/")[1];
+  const frontmatter = ["---"];
+  for (const [k, v] of Object.entries(fm)) {
+    if (v === void 0 || v === null) continue;
+    if (Array.isArray(v)) {
+      if (v.length === 0) continue;
+      frontmatter.push(`${k}:`);
+      for (const item of v) frontmatter.push(`  - ${JSON.stringify(item)}`);
+    } else if (typeof v === "object") {
+      frontmatter.push(`${k}: ${JSON.stringify(v)}`);
+    } else {
+      frontmatter.push(`${k}: ${JSON.stringify(v)}`);
+    }
+  }
+  frontmatter.push("---");
+  const content = frontmatter.join("\n") + "\n\n" + body;
+  return {
+    files: [
+      {
+        path: outputPath.replace("{name}", String(name)),
+        content,
+        mergeable: false,
+        format: "markdown"
+      }
+    ],
+    notes: [],
+    format: "agent-skills"
+  };
+}
+var skillToClaude = (input) => buildSkillFile(input, ".claude/skills/{name}/SKILL.md");
+var skillToCodex = (input) => buildSkillFile(input, ".codex/skills/{name}.md");
+var skillToCursor = (input) => buildSkillFile(input, ".cursor/skills/{name}.md");
+var skillToWindsurf = (input) => buildSkillFile(input, ".windsurf/skills/{name}.md");
+var skillToContinue = (input) => buildSkillFile(input, ".continue/skills/{name}.md");
+var skillToCopilot = (input) => buildSkillFile(input, ".github/skills/{name}.md");
+var skillToGeminiCli = (input) => buildSkillFile(input, ".gemini/skills/{name}.md");
+var skillToOpenCode = (input) => buildSkillFile(input, ".opencode/skills/{name}.md");
+var skillToAntigravity = (input) => buildSkillFile(input, ".antigravity/skills/{name}.md");
+var skillCanonical = (input) => {
+  const res = buildSkillFile(input, "SKILL.md");
+  res.format = "agent-skills-canonical";
+  return res;
+};
+
+// ../../packages/translators/src/project-rules/all.ts
+function fence(input) {
+  const body = input.body.trimEnd();
+  return `<!-- kordis:${input.fullSlug}:${input.version}:start -->
+` + body + `
+<!-- kordis:${input.fullSlug}:end -->
+`;
+}
+var TOOL_FILE_SPEC = {
+  claude: { path: "CLAUDE.md", format: "markdown" },
+  codex: { path: "AGENTS.md", format: "markdown" },
+  gemini: { path: "GEMINI.md", format: "markdown" },
+  cursor: {
+    path: ".cursorrules",
+    format: "plain",
+    notes: [
+      "Cursor .cursorrules is a flat text file; fence markers are preserved as HTML comments."
+    ]
+  },
+  windsurf: { path: ".windsurfrules", format: "plain" },
+  copilot: {
+    path: ".github/copilot-instructions.md",
+    format: "markdown",
+    notes: [
+      "Copilot reads .github/copilot-instructions.md for project-level guidance (2026 spec)."
+    ]
+  },
+  continue: {
+    path: ".continue/rules/project.md",
+    format: "markdown",
+    notes: ["Continue supports per-rule files under .continue/rules/ as of v0.12."]
+  },
+  antigravity: {
+    path: ".antigravity/rules/project.md",
+    format: "markdown"
+  },
+  "gemini-cli": {
+    path: ".gemini/rules/project.md",
+    format: "markdown"
+  },
+  opencode: { path: ".opencode/rules/project.md", format: "markdown" }
+};
+function build(spec, input, formatName) {
+  return {
+    files: [
+      {
+        path: spec.path,
+        content: fence(input),
+        mergeable: true,
+        format: spec.format
+      }
+    ],
+    notes: spec.notes ?? [],
+    format: formatName
+  };
+}
+var projectRulesToClaude = (input) => build(TOOL_FILE_SPEC["claude"], input, "claude-md");
+var projectRulesToCodex = (input) => build(TOOL_FILE_SPEC["codex"], input, "agents-md");
+var projectRulesToGemini = (input) => build(TOOL_FILE_SPEC["gemini"], input, "gemini-md");
+var projectRulesToCursor = (input) => build(TOOL_FILE_SPEC["cursor"], input, "cursorrules");
+var projectRulesToWindsurf = (input) => build(TOOL_FILE_SPEC["windsurf"], input, "windsurfrules");
+var projectRulesToCopilot = (input) => build(TOOL_FILE_SPEC["copilot"], input, "copilot-instructions-md");
+var projectRulesToContinue = (input) => build(TOOL_FILE_SPEC["continue"], input, "continue-rules-md");
+var projectRulesToAntigravity = (input) => build(TOOL_FILE_SPEC["antigravity"], input, "antigravity-rules-md");
+var projectRulesToGeminiCli = (input) => build(TOOL_FILE_SPEC["gemini-cli"], input, "gemini-cli-rules-md");
+var projectRulesToOpenCode = (input) => build(TOOL_FILE_SPEC["opencode"], input, "opencode-rules-md");
+var projectRulesCanonical = (input) => ({
+  files: [
+    {
+      path: `kordis/project-rules/${input.fullSlug}.md`,
+      content: fence(input),
+      mergeable: true,
+      format: "markdown"
+    }
+  ],
+  notes: [],
+  format: "kordis-project-rules"
+});
+
+// ../../packages/translators/src/mcp-server/all.ts
+import tomlLib from "@iarna/toml";
+function getName(input) {
+  const n = input.frontmatter["name"];
+  return typeof n === "string" ? n : input.fullSlug.split("/")[1] ?? input.fullSlug;
+}
+function getTransport(input) {
+  const t = input.frontmatter["transport"];
+  if (!t || typeof t !== "object") {
+    throw new Error("mcp-server frontmatter missing `transport`");
+  }
+  return t;
+}
+var mcpToClaude = (input) => {
+  const name = getName(input);
+  const t = getTransport(input);
+  const servers = {};
+  if (t.type === "stdio") {
+    servers[name] = {
+      command: t.command,
+      args: t.args ?? [],
+      env: t.env ?? {}
+    };
+  } else {
+    servers[name] = {
+      url: t.url,
+      transport: t.type,
+      headers: t.headers ?? {}
+    };
+  }
+  const doc = { mcpServers: servers };
+  return {
+    files: [
+      {
+        path: ".mcp.json",
+        content: JSON.stringify(doc, null, 2) + "\n",
+        mergeable: true,
+        format: "json"
+      }
+    ],
+    notes: [],
+    format: "claude-mcp-json"
+  };
+};
+var mcpToCodex = (input) => {
+  const name = getName(input);
+  const t = getTransport(input);
+  const notes = [];
+  const body = {};
+  if (t.type === "stdio") {
+    body.command = t.command;
+    body.args = t.args ?? [];
+    if (t.env && Object.keys(t.env).length > 0) body.env = t.env;
+  } else {
+    notes.push(
+      "Codex does not yet support HTTP/SSE MCP transports; emitting placeholder. Re-pull after Codex 2026-Q2 adds support."
+    );
+    body.url = t.url;
+    body.transport = t.type;
+  }
+  const doc = { mcp_servers: { [name]: body } };
+  return {
+    files: [
+      {
+        path: ".codex/config.toml",
+        content: tomlLib.stringify(doc),
+        mergeable: true,
+        format: "toml"
+      }
+    ],
+    notes,
+    format: "codex-toml"
+  };
+};
+var mcpToContinue = (input) => {
+  const name = getName(input);
+  const t = getTransport(input);
+  const lines = [`name: ${name}`];
+  if (t.type === "stdio") {
+    lines.push("type: stdio", `command: ${JSON.stringify(t.command)}`);
+    if (t.args && t.args.length > 0) {
+      lines.push("args:");
+      for (const a of t.args) lines.push(`  - ${JSON.stringify(a)}`);
+    }
+    if (t.env && Object.keys(t.env).length > 0) {
+      lines.push("env:");
+      for (const [k, v] of Object.entries(t.env)) lines.push(`  ${k}: ${JSON.stringify(v)}`);
+    }
+  } else {
+    lines.push(`type: ${t.type}`, `url: ${JSON.stringify(t.url)}`);
+    if (t.headers && Object.keys(t.headers).length > 0) {
+      lines.push("headers:");
+      for (const [k, v] of Object.entries(t.headers)) lines.push(`  ${k}: ${JSON.stringify(v)}`);
+    }
+  }
+  return {
+    files: [
+      {
+        path: `.continue/mcpServers/${name}.yaml`,
+        content: lines.join("\n") + "\n",
+        mergeable: false,
+        format: "yaml"
+      }
+    ],
+    notes: [],
+    format: "continue-mcp-yaml"
+  };
+};
+var mcpCanonical = (input) => {
+  const name = getName(input);
+  const t = getTransport(input);
+  const doc = { name, transport: t, version: input.version };
+  return {
+    files: [
+      {
+        path: `kordis/mcp-servers/${name}.json`,
+        content: JSON.stringify(doc, null, 2) + "\n",
+        mergeable: false,
+        format: "json"
+      }
+    ],
+    notes: [],
+    format: "kordis-mcp-manifest"
+  };
+};
+
+// ../../packages/translators/src/custom-agent/claude.ts
+var customAgentToClaude = (input) => {
+  const fm = input.frontmatter;
+  const name = typeof fm["name"] === "string" ? fm["name"] : input.fullSlug.split("/")[1] ?? input.fullSlug;
+  const description = typeof fm["description"] === "string" ? fm["description"] : "";
+  const systemPrompt = typeof fm["system_prompt"] === "string" ? fm["system_prompt"] : "";
+  const model = typeof fm["model"] === "string" ? fm["model"] : null;
+  const context = typeof fm["context"] === "string" ? fm["context"] : null;
+  const allowed = Array.isArray(fm["allowed_tools"]) ? fm["allowed_tools"] : [];
+  const disallowed = Array.isArray(fm["disallowed_tools"]) ? fm["disallowed_tools"] : [];
+  const lines = ["---", `name: ${name}`, `description: ${JSON.stringify(description)}`];
+  if (model) lines.push(`model: ${JSON.stringify(model)}`);
+  if (context) lines.push(`context: ${context}`);
+  if (allowed.length > 0) {
+    lines.push("allowed_tools:");
+    for (const t of allowed) lines.push(`  - ${JSON.stringify(t)}`);
+  }
+  if (disallowed.length > 0) {
+    lines.push("disallowed_tools:");
+    for (const t of disallowed) lines.push(`  - ${JSON.stringify(t)}`);
+  }
+  lines.push("---", "", systemPrompt.trimEnd(), "");
+  if (input.body.trim().length > 0) {
+    lines.push("", "<!-- body (README-style) -->", input.body.trimStart());
+  }
+  return {
+    files: [
+      {
+        path: `.claude/agents/${name}.md`,
+        content: lines.join("\n"),
+        mergeable: false,
+        format: "markdown"
+      }
+    ],
+    notes: [],
+    format: "claude-agent-md"
+  };
+};
+var customAgentCanonical = (input) => {
+  const res = customAgentToClaude(input);
+  if (res.files[0]) {
+    res.files[0].path = `kordis/custom-agents/${input.fullSlug.replace("/", "__")}.md`;
+  }
+  res.format = "kordis-custom-agent";
+  return res;
+};
+
+// ../../packages/translators/src/hook/claude.ts
+var hookToClaude = (input) => {
+  const hooks = input.frontmatter["hooks"];
+  if (!Array.isArray(hooks)) {
+    throw new Error("hook frontmatter missing `hooks` array");
+  }
+  const byEvent = {};
+  for (const raw of hooks) {
+    if (!raw || typeof raw !== "object") continue;
+    const list = byEvent[raw.event] ?? (byEvent[raw.event] = []);
+    const entry = {};
+    if (raw.matcher) entry.matcher = raw.matcher;
+    const hookSpec = { type: raw.action.type };
+    if (raw.action.type === "command") {
+      hookSpec.command = raw.action.command;
+    } else {
+      hookSpec.url = raw.action.url;
+      hookSpec.method = raw.action.method ?? "POST";
+      if (raw.action.headers) hookSpec.headers = raw.action.headers;
+    }
+    if (raw.action.timeout_ms !== void 0) hookSpec.timeout = raw.action.timeout_ms;
+    if (raw.action.blocking) hookSpec.blocking = true;
+    entry.hooks = [hookSpec];
+    list.push(entry);
+  }
+  const doc = { hooks: byEvent };
+  return {
+    files: [
+      {
+        path: ".claude/settings.json",
+        content: JSON.stringify(doc, null, 2) + "\n",
+        mergeable: true,
+        format: "json"
+      }
+    ],
+    notes: [],
+    format: "claude-hooks-json"
+  };
+};
+var hookCanonical = (input) => {
+  const res = hookToClaude(input);
+  if (res.files[0]) {
+    res.files[0].path = `kordis/hooks/${input.fullSlug.replace("/", "__")}.json`;
+  }
+  res.format = "kordis-hook";
+  return res;
+};
+
+// ../../packages/translators/src/registry.ts
+var REGISTRY = {
+  skill: {
+    canonical: skillCanonical,
+    "claude-code": skillToClaude,
+    codex: skillToCodex,
+    cursor: skillToCursor,
+    windsurf: skillToWindsurf,
+    continue: skillToContinue,
+    copilot: skillToCopilot,
+    "gemini-cli": skillToGeminiCli,
+    opencode: skillToOpenCode,
+    antigravity: skillToAntigravity
+  },
+  "project-rules": {
+    canonical: projectRulesCanonical,
+    "claude-code": projectRulesToClaude,
+    codex: projectRulesToCodex,
+    cursor: projectRulesToCursor,
+    windsurf: projectRulesToWindsurf,
+    continue: projectRulesToContinue,
+    copilot: projectRulesToCopilot,
+    "gemini-cli": projectRulesToGeminiCli,
+    opencode: projectRulesToOpenCode,
+    antigravity: projectRulesToAntigravity
+    // `gemini` CLI vs codex's GEMINI.md — codex reads both; we map "gemini-cli"
+    // to its own dir and "codex" to AGENTS.md. GEMINI.md alias below.
+  },
+  "mcp-server": {
+    canonical: mcpCanonical,
+    "claude-code": mcpToClaude,
+    codex: mcpToCodex,
+    continue: mcpToContinue
+  },
+  "custom-agent": {
+    canonical: customAgentCanonical,
+    "claude-code": customAgentToClaude
+  },
+  hook: {
+    canonical: hookCanonical,
+    "claude-code": hookToClaude
+  }
+};
+REGISTRY["project-rules"]["gemini-cli"] = projectRulesToGemini;
+var TranslatorNotSupportedError = class extends Error {
+  type;
+  format;
+  constructor(type, format) {
+    super(
+      `No translator registered for type="${type}" format="${format}". Fall back to "canonical" or choose a supported tool for this type.`
+    );
+    this.name = "TranslatorNotSupportedError";
+    this.type = type;
+    this.format = format;
+  }
+};
+function getTranslator(type, format) {
+  const fn = REGISTRY[type]?.[format];
+  if (!fn) throw new TranslatorNotSupportedError(type, format);
+  return fn;
+}
+
+// src/commands/pull.ts
+function pullCommand() {
+  return new Command5("pull").description("install a package into the current project").argument("<full_slug>", "package identifier {username}/{slug}").option("--tool <name>", "target tool format (default: auto-detect)").option("--target <path>", "install into a subdirectory (default: cwd)").option("--with-recommends", "also install recommended dependencies", false).action(
+    async (fullSlug, opts) => {
+      const [username, slug] = fullSlug.split("/");
+      if (!username || !slug) {
+        throw new Error('full_slug must be "{username}/{slug}"');
+      }
+      const bundle = await useClient();
+      const userCwd = process.env["INIT_CWD"] ?? process.cwd();
+      const installRoot = opts.target ?? userCwd;
+      const detected = opts.tool ?? await detectTool(installRoot);
+      const spin = spinner(`Pulling ${fullSlug}`);
+      const detail = await bundle.api.getPackage(username, slug);
+      await bundle.api.pull(username, slug);
+      const contentRes = await bundle.api.getContent(username, slug, {
+        format: "canonical"
+      });
+      spin.succeed();
+      const parsed = validatePackageSource(contentRes.content);
+      if (!parsed.ok || !parsed.type || !parsed.frontmatter) {
+        throw new Error("package stored content is not currently valid");
+      }
+      const written = [];
+      const notes = [];
+      const format = detected ?? "canonical";
+      try {
+        const translator = getTranslator(parsed.type, format);
+        const result = translator({
+          fullSlug,
+          frontmatter: parsed.frontmatter.data,
+          body: parsed.body,
+          version: contentRes.version
+        });
+        for (const f of result.files) {
+          const abs = join3(installRoot, f.path);
+          await mkdir3(dirname(abs), { recursive: true });
+          await writeFile3(abs, f.content, "utf8");
+          written.push(abs);
+        }
+        notes.push(...result.notes);
+      } catch (err) {
+        if (err instanceof TranslatorNotSupportedError) {
+          const canonical = getTranslator(parsed.type, "canonical");
+          const result = canonical({
+            fullSlug,
+            frontmatter: parsed.frontmatter.data,
+            body: parsed.body,
+            version: contentRes.version
+          });
+          notes.push(
+            `Tool "${format}" is not supported for type "${parsed.type}"; installed canonical form instead.`
+          );
+          for (const f of result.files) {
+            const abs = join3(installRoot, f.path);
+            await mkdir3(dirname(abs), { recursive: true });
+            await writeFile3(abs, f.content, "utf8");
+            written.push(abs);
+          }
+        } else {
+          throw err;
+        }
+      }
+      printDual({
+        json: {
+          status: "installed",
+          full_slug: fullSlug,
+          version: detail.current_version,
+          tool_detected: detected ?? null,
+          installed_paths: written,
+          notes
+        },
+        human: () => {
+          printHuman(
+            c.green(`\u2713 Installed ${c.bold(fullSlug)} v${detail.current_version}`)
+          );
+          for (const w of written) printHuman(`  ${c.gray("wrote")} ${w}`);
+          for (const n of notes) printHuman(c.yellow(`  ! ${n}`));
+        }
+      });
+    }
+  );
+}
+async function detectTool(root) {
+  const { stat } = await import("fs/promises");
+  const checks = [
+    [".claude", "claude-code"],
+    [".cursor", "cursor"],
+    [".continue", "continue"],
+    [".windsurf", "windsurf"],
+    [".antigravity", "antigravity"],
+    [".codex", "codex"],
+    ["AGENTS.md", "codex"],
+    ["CLAUDE.md", "claude-code"],
+    [".cursorrules", "cursor"],
+    [".windsurfrules", "windsurf"],
+    [".github/copilot-instructions.md", "copilot"]
+  ];
+  for (const [path, tool] of checks) {
+    try {
+      await stat(join3(root, path));
+      return tool;
+    } catch {
+    }
+  }
+  return null;
+}
+
+// src/commands/read.ts
+import { Command as Command6 } from "commander";
+function readCommand() {
+  return new Command6("read").description("fetch a package body into the agent context (no install)").argument("<full_slug>", "package identifier {username}/{slug} or {username}/{slug}@{version}").option("--allow-pending", "allow versions whose AI review has not passed", false).option("--version <semver>", "pin to an exact version (overrides @suffix)").action(
+    async (rawSlug, opts) => {
+      const atIdx = rawSlug.lastIndexOf("@");
+      const fullSlug = atIdx > 0 ? rawSlug.slice(0, atIdx) : rawSlug;
+      const inlineVersion = atIdx > 0 ? rawSlug.slice(atIdx + 1) : void 0;
+      const version = opts.version ?? inlineVersion;
+      const [username, slug] = fullSlug.split("/");
+      if (!username || !slug) {
+        throw new Error('full_slug must be "{username}/{slug}" (optional "@version")');
+      }
+      const bundle = await useClient();
+      const res = await bundle.api.jitRead(username, slug, {
+        allow_pending: opts.allowPending,
+        ...version ? { version } : {}
+      });
+      if (isJsonMode()) {
+        printJson(res);
+        return;
+      }
+      process.stdout.write(res.body);
+      if (!res.body.endsWith("\n")) process.stdout.write("\n");
+      process.stderr.write(
+        `${c.gray("\u2014")} ${c.bold(res.full_slug)}${c.gray("@")}${res.version} ${c.gray("\xB7")} ${res.type} (tier ${res.tier}) ${c.gray("\xB7")} ${c.cyan(res.attribution)}
+`
+      );
+      printHuman("");
+    }
+  );
+}
+
+// src/commands/info.ts
+import { Command as Command7 } from "commander";
+function infoCommand() {
+  return new Command7("info").description("show details about a package").argument("<full_slug>", "package identifier {username}/{slug}").action(async (fullSlug) => {
+    const [username, slug] = fullSlug.split("/");
+    if (!username || !slug) throw new Error('full_slug must be "{username}/{slug}"');
+    const bundle = await useClient();
+    const detail = await bundle.api.getPackage(username, slug);
+    printDual({
+      json: detail,
+      human: () => {
+        printHuman(c.bold(detail.full_slug) + " " + c.gray(`v${detail.current_version}`));
+        printHuman("  " + detail.description);
+        printHuman("");
+        printHuman(`  ${c.cyan("Type")}: ${detail.type} (tier ${detail.tier})`);
+        printHuman(`  ${c.cyan("Author")}: ${detail.author.username}`);
+        printHuman(`  ${c.cyan("Stats")}: \u2605 ${detail.stars} \xB7 \u21E3 ${detail.downloads}`);
+        if (detail.tools_compatible.length > 0) {
+          printHuman(`  ${c.cyan("Tools")}: ${detail.tools_compatible.join(", ")}`);
+        }
+        if (detail.depends.length > 0) {
+          printHuman(`  ${c.cyan("Depends")}:`);
+          for (const d of detail.depends) {
+            printHuman(`    - ${d.full_slug} ${d.version_range}`);
+          }
+        }
+        if (detail.recommends.length > 0) {
+          printHuman(`  ${c.cyan("Recommends")}:`);
+          for (const d of detail.recommends) {
+            printHuman(`    - ${d.full_slug} ${d.version_range}`);
+          }
+        }
+      }
+    });
+  });
+}
+
+// src/commands/logout.ts
+import { Command as Command8 } from "commander";
+function logoutCommand() {
+  return new Command8("logout").description("revoke the current session and clear local credentials").action(async () => {
+    const bundle = await useClient();
+    if (!bundle.username) {
+      printHuman(c.yellow("Not logged in; nothing to do."));
+      return;
+    }
+    try {
+      await bundle.authedRequest((api) => api.revokeAllSessions());
+    } catch {
+    }
+    await bundle.keychain.remove(bundle.username);
+    const cfg = await loadCliConfig();
+    delete cfg.username;
+    delete cfg.sessionId;
+    await saveCliConfig(cfg);
+    printDual({
+      json: { status: "logged_out" },
+      human: () => printHuman(c.green("\u2713 Logged out."))
+    });
+  });
+}
+
+// src/commands/setup.ts
+import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir4, access } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { join as join4, dirname as dirname2 } from "path";
+import { fileURLToPath } from "url";
+import { Command as Command9 } from "commander";
+var MARKER_START = "<!-- kordis-start -->";
+var MARKER_END = "<!-- kordis-end -->";
+var TARGETS = [
+  { tool: "Claude Code", dir: ".claude", file: ".claude/CLAUDE.md" },
+  { tool: "Codex CLI", dir: ".codex", file: ".codex/AGENTS.md" },
+  { tool: "Gemini CLI", dir: ".gemini", file: ".gemini/GEMINI.md" }
+];
+async function exists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loadGuideContent() {
+  const __dir = dirname2(fileURLToPath(import.meta.url));
+  const bundled = join4(__dir, "..", "assets", "KORDIS.md");
+  const source = join4(__dir, "..", "..", "..", "..", "packages", "skills", "KORDIS.md");
+  const path = await exists(bundled) ? bundled : source;
+  const raw = await readFile4(path, "utf-8");
+  if (raw.startsWith("---")) {
+    const end = raw.indexOf("\n---", 4);
+    if (end !== -1) return raw.slice(end + 4).trimStart();
+  }
+  return raw;
+}
+async function injectBlock(filePath, content, dryRun) {
+  const block = `${MARKER_START}
+${content.trimEnd()}
+${MARKER_END}`;
+  let existing = "";
+  let fileExists = true;
+  try {
+    existing = await readFile4(filePath, "utf-8");
+  } catch {
+    fileExists = false;
+  }
+  if (!fileExists) {
+    if (!dryRun) {
+      await mkdir4(dirname2(filePath), { recursive: true });
+      await writeFile4(filePath, block + "\n", "utf-8");
+    }
+    return "injected";
+  }
+  const startIdx = existing.indexOf(MARKER_START);
+  const endIdx = existing.indexOf(MARKER_END);
+  if (startIdx !== -1 && endIdx !== -1) {
+    const current = existing.slice(startIdx, endIdx + MARKER_END.length);
+    if (current === block) return "unchanged";
+    if (!dryRun) {
+      const updated = existing.slice(0, startIdx) + block + existing.slice(endIdx + MARKER_END.length);
+      await writeFile4(filePath, updated, "utf-8");
+    }
+    return "updated";
+  }
+  if (!dryRun) {
+    await writeFile4(filePath, existing.trimEnd() + "\n\n" + block + "\n", "utf-8");
+  }
+  return "injected";
+}
+function setupCommand() {
+  return new Command9("setup").description("inject kordis usage guide into global agent instruction files").option("--silent", "suppress errors \u2014 safe for postinstall").option("--dry-run", "detect installed tools without writing any files").action(async (opts) => {
+    const home = homedir3();
+    const dryRun = opts.dryRun ?? false;
+    let guideContent;
+    try {
+      guideContent = await loadGuideContent();
+    } catch (err) {
+      if (opts.silent) return;
+      throw err;
+    }
+    let anyFound = false;
+    for (const target of TARGETS) {
+      const dirPath = join4(home, target.dir);
+      const filePath = join4(home, target.file);
+      if (!await exists(dirPath)) {
+        if (!opts.silent) {
+          printHuman(c.gray(`  - ${target.tool.padEnd(12)} not installed, skipped`));
+        }
+        continue;
+      }
+      anyFound = true;
+      try {
+        const result = await injectBlock(filePath, guideContent, dryRun);
+        const label = `${target.tool.padEnd(12)}`;
+        const dest = `~/${target.file}`;
+        if (result === "unchanged") {
+          printHuman(c.gray(`  \u2713 ${label} already up-to-date`));
+        } else if (dryRun) {
+          printHuman(`  ~ ${label} ${c.cyan(dest)} (dry-run: would ${result})`);
+        } else {
+          printHuman(c.green(`  \u2713 ${label} \u2192 ${dest}`));
+        }
+      } catch (err) {
+        if (opts.silent) continue;
+        printHuman(c.red(`  \u2717 ${target.tool}: ${err.message}`));
+      }
+    }
+    if (!anyFound && !opts.silent) {
+      printHuman(c.gray("No supported agent tools detected."));
+      printHuman(c.gray("Run `kordis setup` again after installing Claude Code, Codex, or Gemini CLI."));
+    }
+  });
+}
+
+// src/index.ts
+var VERSION = "0.0.1";
+function buildProgram() {
+  const program = new Command10("kordis").version(VERSION).description("Kordis \u2014 registry for agentic-coding packages").option("--json", "emit JSON output to stdout (default: human)", false).hook("preAction", (thisCommand) => {
+    const opts = thisCommand.optsWithGlobals();
+    if (opts.json) setJsonMode(true);
+  });
+  program.addCommand(loginCommand());
+  program.addCommand(logoutCommand());
+  program.addCommand(whoamiCommand());
+  program.addCommand(searchCommand());
+  program.addCommand(pushCommand());
+  program.addCommand(pullCommand());
+  program.addCommand(readCommand());
+  program.addCommand(infoCommand());
+  program.addCommand(setupCommand());
+  return program;
+}
+async function main(argv) {
+  const program = buildProgram();
+  try {
+    const cleaned = argv.filter((a, i) => !(a === "--" && i >= 2));
+    await program.parseAsync(cleaned);
+  } catch (err) {
+    handleError(err);
+  }
+}
+function handleError(err) {
+  if (err instanceof KordisApiError) {
+    if (isJsonMode()) {
+      printJson({
+        error: {
+          code: err.code,
+          message: err.message,
+          flags: err.flags,
+          request_id: err.requestId
+        }
+      });
+    } else {
+      printHuman(c.red(`\u2717 ${err.code}: ${err.message}`));
+      for (const f of err.flags) {
+        printHuman(c.red(`  - ${f.code}${f.message ? `: ${f.message}` : ""}`));
+      }
+      if (err.requestId) {
+        printHuman(c.gray(`  (request-id: ${err.requestId})`));
+      }
+    }
+    process.exit(err.exitCode());
+  }
+  if (err instanceof KordisNetworkError) {
+    if (isJsonMode()) printJson({ error: { code: "network_unreachable", message: err.message } });
+    else printHuman(c.red(`\u2717 ${err.message}`));
+    process.exit(err.exitCode());
+  }
+  if (err instanceof Error) {
+    if (isJsonMode()) printJson({ error: { code: "generic_failure", message: err.message } });
+    else printHuman(c.red(`\u2717 ${err.message}`));
+    process.exit(1);
+  }
+  if (isJsonMode()) printJson({ error: { code: "generic_failure", message: String(err) } });
+  else printHuman(c.red(`\u2717 ${String(err)}`));
+  process.exit(1);
+}
+main(process.argv).catch(handleError);