@skaile/workspaces 6.1.0 → 6.2.0

package/dist/chunk-BY5WIRCU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../cli/src/plugin-store/paths.ts","../cli/src/plugin-store/spec.ts","../cli/src/plugin-store/load.ts","../cli/src/plugin-store/reconcile.ts","../cli/src/plugin-store/index.ts"],"names":["existsSync","readFileSync","join"],"mappings":";;;;;;;;AAWO,SAAS,WAAW,UAAA,EAA4B;AACrD,EAAA,OAAO,IAAA,CAAK,UAAA,EAAY,SAAA,EAAW,SAAS,CAAA;AAC9C;AAGO,SAAS,eAAe,UAAA,EAA4B;AACzD,EAAA,OAAO,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,EAAG,cAAc,CAAA;AACpD;AAGO,SAAS,eAAe,UAAA,EAA4B;AACzD,EAAA,OAAO,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,EAAG,cAAc,CAAA;AACpD;AAGO,SAAS,kBAAkB,UAAA,EAA4B;AAC5D,EAAA,OAAO,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,EAAG,iBAAiB,CAAA;AACvD;AAGA,SAAS,cAAc,MAAA,EAAqC;AAC1D,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,MAAA;AACvC,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,IAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,MAAA,MAAM,GAAA,GAAM,cAAc,CAAC,CAAA;AAC3B,MAAA,IAAI,KAAK,OAAO,GAAA;AAAA,IAClB;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACxC,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,KAAA,MAAW,QAAQ,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,EAAG;AAC3D,MAAA,IAAI,QAAQ,GAAA,EAAK;AACf,QAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,IAAI,CAAC,CAAA;AACnC,QAAA,IAAI,KAAK,OAAO,GAAA;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAWO,SAAS,kBAAA,CAAmB,YAAoB,OAAA,EAAyB;AAC9E,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,cAAA,CAAe,UAAU,GAAG,OAAO,CAAA;AACvD,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,MAAA,EAAQ,cAAc,CAAA;AAC/C,EAAA,IAAI,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,MAAM,CAAA,SAAA,EAAY,OAAO,yBAAyB,cAAA,CAAe,UAAU,CAAC,CAAA,CAAE,CAAA;AAAA,EAC1F;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,WAAA,EAAa,MAAM,CAAC,CAAA;AAKxD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,GAAA,CAAI,YAAY,MAAA,EAAW;AAC7B,IAAA,MAAM,IAAA,GACJ,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,KAAY,QAAQ,CAAC,KAAA,CAAM,QAAQ,GAAA,CAAI,OAAO,IAC/E,GAAA,CAAI,OAAA,CAAoC,GAAG,CAAA,IAAK,GAAA,CAAI,UACtD,GAAA,CAAI,OAAA;AACV,IAAA,GAAA,GAAM,cAAc,IAAI,CAAA;AAAA,EAC1B;AACA,EAAA,GAAA,KAAQ,GAAA,CAAI,MAAA,IAAU,GAAA,CAAI,IAAA,IAAQ,UAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAA;AACjC,EAAA,IAAI,CAAC,UAAA,CAAW,KAAK,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,OAAO,CAAA,QAAA,EAAW,GAAG,CAAA,eAAA,CAAiB,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA;AACT;;;AC/DO,SAAS,UAAU,IAAA,EAA0B;AAClD,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAI1D,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,WAAA,CAAY,GAAG,CAAA;AAClC,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,GAAA,EAAI;AAAA,EACrC;AACA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,EAAA,GAAK,CAAC,CAAA;AAClC,EAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,MAAM,MAAA,GAAS,CAAA,GAAI,QAAQ,GAAA,EAAI;AACvD;AAGO,SAAS,SAAS,IAAA,EAAsB;AAC7C,EAAA,OAAO,SAAA,CAAU,IAAI,CAAA,CAAE,IAAA;AACzB;AAGA,IAAM,QAAA,GAAW,sDAAA;AASV,SAAS,aAAa,IAAA,EAAkC;AAC7D,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,EAAA,IAAI,YAAY,EAAA,EAAI;AAClB,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,UAAU,OAAO,CAAA;AACzC,IAAA,IAAI,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,KAAM,KAAA,CAAM,UAAA,CAAW,OAAO,CAAA,IAAK,CAAC,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI;AAChF,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OACE,gBAAgB,IAAI,CAAA,0LAAA,CAAA;AAIxB;;;AC1BA,eAAsB,YACpB,UAAA,EACA,OAAA,EACA,WAA2B,cAAA,EAC3B,IAAA,GAAoB,EAAC,EACA;AACrB,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,SAA4D,EAAC;AAEnE,EAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,SAAA,CAAU,IAAI,CAAA;AAC/B,MAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,UAAA,EAAY,IAAI,CAAA;AACjD,MAAA,MAAM,GAAA,GAAO,MAAM,OAAO,aAAA,CAAc,KAAK,CAAA,CAAE,IAAA,CAAA;AAC/C,MAAA,IAAI,OAAO,GAAA,CAAI,QAAA,KAAa,UAAA,EAAY;AACtC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,IAAI,CAAA,uCAAA,CAAyC,CAAA;AAAA,MAC1E;AACA,MAAA,GAAA,CAAI,SAAS,QAAQ,CAAA;AACrB,MAAA,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,IAClB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,CAAA,uBAAA,EAA0B,IAAI,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,EAAI,MAAA,EAAQ,OAAA,EAAS,CAAA;AAC3F,MAAA,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA,oBAAA,EAAuB,IAAI,IAAI,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,IAClE;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;ACZA,eAAe,UAAA,CACb,MACA,GAAA,EAC6D;AAC7D,EAAA,MAAM,EAAE,aAAA,EAAc,GAAI,MAAM,OAAO,iBAAyB,CAAA;AAChE,EAAA,MAAM,IAAA,GAAO,aAAA,CAAc,IAAA,EAAM,EAAE,KAAK,CAAA;AACxC,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,IAAA,GAAO,OAAO,MAAA,KAAuC;AACzD,IAAA,MAAM,MAAA,GAAS,OAAO,SAAA,EAAU;AAChC,IAAA,WAAS;AACP,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,MAAA,IAAI,IAAA,EAAM;AACV,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,OAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA;AAAA,IAChE;AAAA,EACF,CAAA;AACA,EAAA,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,MAAM,CAAC,CAAC,CAAA;AACxD,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA;AAExB,EAAA,OAAO,EAAE,OAAA,EAAS,IAAA,CAAK,GAAA,KAAQ,EAAA,EAAI,MAAM,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA,EAAE;AACnE;AAQO,IAAM,cAAA,GAA4B,OAAO,GAAA,EAAK,IAAA,GAAO,EAAC,KAAM;AACjE,EAAA,MAAM,UAAA,GAAaA,WAAW,CAAA,EAAG,GAAG,WAAW,CAAA,IAAKA,UAAAA,CAAW,CAAA,EAAG,GAAG,CAAA,UAAA,CAAY,CAAA;AACjF,EAAA,MAAM,UAAA,GAAaA,UAAAA,CAAW,CAAA,EAAG,GAAG,CAAA,kBAAA,CAAoB,CAAA;AACxD,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,KAAW,KAAA;AAE/B,EAAA,MAAM,OAAA,GACJ,MAAA,KAAW,UAAA,IAAc,UAAA,CAAA,GACrB,CAAC,KAAA,EAAO,SAAA,EAAW,mBAAmB,CAAA,GACtC,CAAC,KAAA,EAAO,SAAS,CAAA;AACvB,EAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,OAAA,EAAS,GAAG,CAAA;AAC7C,EAAA,IAAI,OAAA,CAAQ,OAAA,EAAS,OAAO,EAAE,EAAA,EAAI,QAAQ,IAAA,KAAS,CAAA,EAAG,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO;AAE7E,EAAA,MAAM,OAAA,GACJ,MAAA,IAAU,UAAA,GACN,CAAC,OAAO,IAAA,EAAM,kBAAA,EAAoB,YAAA,EAAc,WAAW,IAC3D,CAAC,KAAA,EAAO,SAAA,EAAW,kBAAA,EAAoB,cAAc,WAAW,CAAA;AACtE,EAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,OAAA,EAAS,GAAG,CAAA;AAC7C,EAAA,IAAI,OAAA,CAAQ,OAAA,EAAS,OAAO,EAAE,EAAA,EAAI,QAAQ,IAAA,KAAS,CAAA,EAAG,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO;AAC7E,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,MAAA,EACE;AAAA,GACJ;AACF,CAAA;AAOA,SAAS,gBAAA,CACP,YACA,OAAA,EACwD;AACxD,EAAA,MAAM,eAAuC,EAAC;AAC9C,EAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,UAAU,IAAI,CAAA;AACtC,IAAA,YAAA,CAAa,IAAI,CAAA,GAAI,KAAA;AAAA,EACvB;AACA,EAAA,MAAM,GAAA,GAAM;AAAA,IACV,IAAA,EAAM,wBAAA;AAAA,IACN,OAAA,EAAS,IAAA;AAAA,IACT;AAAA,GACF;AACA,EAAA,MAAM,IAAA,GAAO,eAAe,UAAU,CAAA;AACtC,EAAA,MAAM,WAAWA,UAAAA,CAAW,IAAI,IAAIC,YAAAA,CAAa,IAAA,EAAM,MAAM,CAAA,GAAI,MAAA;AACjE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAa,KAAA,CAAA,GAAY,KAAA,CAAA,GAAY,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,YAAA;AAAA,EACrE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAA,GAAS,MAAA;AAAA,EACX;AACA,EAAA,MAAM,UAAA,GAAa,CAAC,CAAA,KAClB,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA,CAAQ,CAAA,IAAK,EAAE,CAAA,CAAE,KAAK,CAAC,CAAC,CAAC,CAAA,EAAG,CAAC,CAAC,MAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAC,CAAA;AAC/E,EAAA,MAAM,cAAc,MAAA,KAAW,MAAA,IAAa,WAAW,MAAM,CAAA,KAAM,WAAW,YAAY,CAAA;AAC1F,EAAA,SAAA,CAAU,WAAW,UAAU,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACrD,EAAA,aAAA,CAAc,MAAM,CAAA,EAAG,IAAA,CAAK,UAAU,GAAA,EAAK,IAAA,EAAM,CAAC,CAAC;AAAA,CAAI,CAAA;AACvD,EAAA,OAAO,EAAE,UAAU,WAAA,EAAY;AACjC;AAUA,eAAsB,gBAAA,CACpB,UAAA,EACA,OAAA,EACA,IAAA,GAAyB,EAAC,EACA;AAC1B,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,YAAA,EAAa;AAAA,EAChD;AAEA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,oBAAA,CAAqB,UAAU,CAAA;AACnE,EAAA,MAAM,QAAA,GAAW,WAAW,QAAQ,CAAA,CACjC,OAAO,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,CAAC,GAAG,OAAO,CAAA,CAAE,MAAK,EAAG,IAAA,EAAM,WAAW,CAAC,CAAA,CACxE,MAAA,CAAO,KAAK,CAAA;AAEf,EAAA,MAAM,QAAA,GAAW,kBAAkB,UAAU,CAAA;AAC7C,EAAA,IAAID,UAAAA,CAAW,QAAQ,CAAA,EAAG;AACxB,IAAA,MAAM,IAAA,GAAOC,YAAAA,CAAa,QAAA,EAAU,MAAM,EAAE,IAAA,EAAK;AACjD,IAAA,IAAI,SAAS,QAAA,EAAU;AACrB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,YAAA,EAAa;AAAA,IAChD;AAAA,EACF;AAEA,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,gBAAA,CAAiB,YAAY,OAAO,CAAA;AAEtE,EAAA,MAAM,OAAA,GAAU,KAAK,UAAA,IAAc,cAAA;AACnC,EAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,GAAG,EAAE,MAAA,EAAQ,CAAC,WAAA,EAAa,CAAA;AAC7E,EAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AAGd,IAAA,IAAI,QAAA,KAAa,QAAW,MAAA,CAAO,cAAA,CAAe,UAAU,CAAA,EAAG,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,SACzE,aAAA,CAAc,cAAA,CAAe,UAAU,CAAA,EAAG,QAAQ,CAAA;AACvD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAA2B,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EAC5D;AAEA,EAAA,aAAA,CAAc,UAAU,QAAQ,CAAA;AAChC,EAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,YAAA,EAAa;AAC/C;AAYA,eAAsB,mBAAA,CACpB,UAAA,EACA,eAAA,EACA,IAAA,GAAyB,EAAC,EACX;AACf,EAAA,IAAI,eAAA,CAAgB,WAAW,CAAA,EAAG;AAChC,IAAA,MAAM,GAAA,GAAM,WAAW,UAAU,CAAA;AACjC,IAAA,MAAA,CAAO,eAAe,UAAU,CAAA,EAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAClD,IAAA,MAAA,CAAO,kBAAkB,UAAU,CAAA,EAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AACrD,IAAA,MAAA,CAAO,cAAA,CAAe,UAAU,CAAA,EAAG,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACnE,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,UAAA,EAAY,WAAA,EAAa,mBAAmB,CAAA,EAAG;AACjE,MAAA,MAAA,CAAOC,KAAK,GAAA,EAAK,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAAA,IACzC;AACA,IAAA;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAM,gBAAA,CAAiB,UAAA,EAAY,eAAA,EAAiB,IAAI,CAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;;;ACpLA,eAAsB,oBACpB,UAAA,EACA,OAAA,EACA,WAA2B,cAAA,EAC3B,IAAA,GAA6B,EAAC,EACT;AACrB,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACpC,IAAA,OAAO,EAAE,MAAA,EAAQ,EAAC,EAAG,MAAA,EAAQ,EAAC,EAAE;AAAA,EAClC;AACA,EAAA,MAAM,gBAAA,CAAiB,UAAA,EAAY,OAAA,EAAS,IAAI,CAAA;AAChD,EAAA,OAAO,WAAA,CAAY,YAAY,OAAA,EAAS,QAAA,EAAU,EAAE,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AACrE;AAWO,SAAS,sBAAsB,MAAA,EAAwB;AAC5D,EAAA,MAAM,QAAQ,MAAA,CACX,KAAA,CAAM,IAAI,CAAA,CACV,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,MAAA,CAAO,CAAC,CAAA,KAAM,MAAM,EAAE,CAAA;AACzB,EAAA,MAAM,CAAC,KAAA,EAAO,GAAG,IAAI,CAAA,GAAI,KAAA;AACzB,EAAA,IAAI,CAAC,OAAO,UAAA,CAAW,uBAAuB,KAAK,KAAA,KAAU,MAAA,IAAa,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG;AAC3F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,uBAAA;AAClB,EAAA,MAAM,QAAA,GAAW,IAAA,CACd,MAAA,CAAO,CAAC,CAAA,KAAM,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,IAAK,CAAC,0CAAA,CAA2C,IAAA,CAAK,CAAC,CAAC,CAAA,CACtF,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,OAAA,CAAQ,SAAA,EAAW,EAAE,CAAC,CAAA,CACnC,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,KAAM,EAAE,CAAA;AACzB,EAAA,MAAM,QAAA,GAAW,SAAS,IAAA,CAAK,CAAC,MAAM,cAAA,CAAe,IAAA,CAAK,CAAC,CAAC,CAAA;AAC5D,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,CAAQ,WAAA,EAAa,EAAE,CAAA;AAC7C,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAC,CAAC,CAAA;AACzE,IAAA,OAAO,CAAA,EAAG,IAAI,CAAA,MAAA,EAAS,IAAI,GAAG,MAAA,GAAS,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,EAC3D;AACA,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AAAA,IAClB,CAAC,CAAA,KAAM,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,IAAM,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,IAAK,CAAC,+BAAA,CAAgC,KAAK,CAAC;AAAA,GAC7F;AACA,EAAA,MAAM,QACJ,MAAA,CAAO,EAAA,CAAG,EAAE,CAAA,IAAK,KAAK,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,gCAAgC,IAAA,CAAK,CAAC,CAAC,CAAA,CAAE,GAAG,EAAE,CAAA;AACrF,EAAA,OAAO,GAAG,IAAI,CAAA,EAAA,EAAK,SAAS,IAAA,CAAK,EAAA,CAAG,EAAE,CAAC,CAAA,CAAA;AACzC;AAEA,SAAS,aAAa,CAAA,EAAmB;AACvC,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,sBAAA,EAAwB,MAAM,CAAA;AACjD;AAUO,SAAS,oBAAA,CACd,QACA,KAAA,EACqB;AACrB,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAoB;AACpC,EAAA,MAAM,SAAA,GAAY,sBAAsB,MAAM,CAAA;AAC9C,EAAA,IAAI,KAAA,CAAM,SAAS,CAAA,IAAK,CAAC,OAAO,UAAA,CAAW,uBAAuB,GAAG,OAAO,GAAA;AAC5E,EAAA,MAAM,KAAA,GAAQ,OACX,KAAA,CAAM,IAAI,EACV,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,KAAM,MAAM,CAAC,+BAAA,CAAgC,IAAA,CAAK,CAAC,CAAC,CAAA;AACrE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS;AAChC,IAAA,IAAI;AACF,MAAA,OAAO,SAAS,IAAI,CAAA;AAAA,IACtB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF,CAAC,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,CAAC,IAAA,EAAc,IAAA,KAA0B;AACxD,IAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAC,CAAA;AACvE,IAAA,OAAO,KAAA,CAAM,IAAA;AAAA,MAAK,CAAC,CAAA,KACjB,IAAI,MAAA,CAAO,CAAA,6BAAA,EAAgC,YAAA,CAAa,CAAC,CAAC,CAAA,iBAAA,CAAmB,CAAA,CAAE,IAAA,CAAK,IAAI;AAAA,KAC1F;AAAA,EACF,CAAA;AACA,EAAA,MAAM,KAAA,GAAQ,iEAAA;AACd,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,CAAA,KAAM;AACzB,IAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,SAAA,EAAW,IAAI,CAAA,GACjC,UAAU,OAAA,CAAQ,4BAAA,EAA8B,EAAE,CAAA,GAClD,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,QAAA,CAAS,CAAA,EAAG,IAAI,CAAA,IAAK,KAAA,CAAM,KAAK,CAAC,CAAC,CAAA,CAAE,EAAA,CAAG,EAAE,CAAA;AACjE,IAAA,IAAI,SAAS,MAAA,EAAW;AACxB,IAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AACf,IAAA,GAAA,CAAI,GAAA,CAAI,MAAM,CAAA,uBAAA,EAA0B,IAAA,CAAK,QAAQ,8BAAA,EAAgC,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F,CAAC,CAAA;AACD,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,2BAAW,GAAA,EAAI;AACvC,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,CAAA,KAAM;AACzB,IAAA,IAAI,CAAC,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,EAAG;AAClB,MAAA,GAAA,CAAI,GAAA;AAAA,QACF,IAAA;AAAA,QACA,CAAA,uBAAA,EAA0B,MAAM,CAAC,CAAC,8CAA8C,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OAClG;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACD,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,gBAAA,CAAiB,MAAc,MAAA,EAAsB;AAC5D,EAAA,IAAI,IAAA,GAAO,IAAA;AACX,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,SAAS,IAAI,CAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb,CAAA,EAAA,EAAK,EAAA,CAAG,MAAA,CAAO,GAAG,CAAC,WAAW,IAAI,CAAA,iBAAA,EAAoB,qBAAA,CAAsB,MAAM,CAAC;AAAA;AAAA,GACrF;AACF;AASA,eAAsB,oBAAoB,UAAA,EAAmC;AAC3E,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,wBAAA,EAAyB,GAAI,MAAM,OAAO,iBAAyB,CAAA;AAC3E,IAAA,OAAA,GAAU,wBAAA,CAAyB,UAAU,CAAA,CAAE,OAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,mBAAA,CAAoB,UAAA,EAAY,SAAS,cAAc,CAAA;AAC5E,IAAA,KAAA,MAAW,KAAK,MAAA,CAAO,MAAA,mBAAyB,CAAA,CAAE,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAClE,SAAS,GAAA,EAAK;AAEZ,IAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,IAAA,MAAM,OAAA,GAAU,oBAAA,CAAqB,MAAA,EAAQ,OAAO,CAAA;AACpD,IAAA,KAAA,MAAW,IAAA,IAAQ,SAAS,gBAAA,CAAiB,IAAA,EAAM,QAAQ,GAAA,CAAI,IAAI,KAAK,MAAM,CAAA;AAAA,EAChF;AACF","file":"chunk-BY5WIRCU.js","sourcesContent":["/**\n * Pure path helpers for the project-local plugin store.\n *\n * The store is a self-contained npm workspace owned by the CLI under\n * `<projectDir>/.skaile/plugins/`. Only `resolvePluginEntry` reads the filesystem.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\n\n/** `<projectDir>/.skaile/plugins` — the store root. */\nexport function pluginsDir(projectDir: string): string {\n  return join(projectDir, \".skaile\", \"plugins\");\n}\n\n/** `<store>/package.json` — generated, never user-edited. */\nexport function pluginsPkgJson(projectDir: string): string {\n  return join(pluginsDir(projectDir), \"package.json\");\n}\n\n/** `<store>/node_modules` — where reconciled plugin packages land. */\nexport function nodeModulesDir(projectDir: string): string {\n  return join(pluginsDir(projectDir), \"node_modules\");\n}\n\n/** `<store>/.reconcile-hash` — SHA of plugins-list + lock slice; skip reinstall when unchanged. */\nexport function reconcileHashFile(projectDir: string): string {\n  return join(pluginsDir(projectDir), \".reconcile-hash\");\n}\n\n/** Pick the file an `exports` target points at, preferring the ESM-friendly conditions. */\nfunction exportsTarget(target: unknown): string | undefined {\n  if (typeof target === \"string\") return target;\n  if (Array.isArray(target)) {\n    for (const t of target) {\n      const hit = exportsTarget(t);\n      if (hit) return hit;\n    }\n    return undefined;\n  }\n  if (target && typeof target === \"object\") {\n    const map = target as Record<string, unknown>;\n    for (const cond of [\"import\", \"node\", \"default\", \"require\"]) {\n      if (cond in map) {\n        const hit = exportsTarget(map[cond]);\n        if (hit) return hit;\n      }\n    }\n  }\n  return undefined;\n}\n\n/**\n * Absolute path to a plugin package's entry file under the store's\n * `node_modules`, resolved from its `package.json` (`exports[\".\"]`, then\n * `module`, then `main`, then `index.js`). Node's ESM loader rejects directory\n * imports, so the entry must be a file; `import()` of the result works inside\n * compiled binaries via `pathToFileURL`.\n *\n * @throws When the package is not installed or declares no resolvable entry.\n */\nexport function resolvePluginEntry(projectDir: string, pkgName: string): string {\n  const pkgDir = join(nodeModulesDir(projectDir), pkgName);\n  const pkgJsonPath = join(pkgDir, \"package.json\");\n  if (!existsSync(pkgJsonPath)) {\n    throw new Error(`package \"${pkgName}\" is not installed in ${nodeModulesDir(projectDir)}`);\n  }\n  const pkg = JSON.parse(readFileSync(pkgJsonPath, \"utf8\")) as {\n    exports?: unknown;\n    module?: string;\n    main?: string;\n  };\n  let rel: string | undefined;\n  if (pkg.exports !== undefined) {\n    const root =\n      typeof pkg.exports === \"object\" && pkg.exports !== null && !Array.isArray(pkg.exports)\n        ? ((pkg.exports as Record<string, unknown>)[\".\"] ?? pkg.exports)\n        : pkg.exports;\n    rel = exportsTarget(root);\n  }\n  rel ??= pkg.module ?? pkg.main ?? \"index.js\";\n  const entry = resolve(pkgDir, rel);\n  if (!existsSync(entry)) {\n    throw new Error(`package \"${pkgName}\" entry ${rel} does not exist`);\n  }\n  return entry;\n}\n","/**\n * Parse npm package specifiers from the `plugins:` list into name + range.\n *\n * The leading `@` of a scope is NOT a separator: only the last `@` at a\n * non-zero index splits the package name from its semver range.\n *   \"@skaile/provider-fly@^0.1.0\" → { name: \"@skaile/provider-fly\", range: \"^0.1.0\" }\n *   \"@skaile/connector-redis\"     → { name: \"@skaile/connector-redis\", range: \"*\" }\n *   \"lodash@^4\"                   → { name: \"lodash\", range: \"^4\" }\n */\n\n/** A parsed plugin specifier: package name plus a semver range (`\"*\"` when omitted). */\nexport interface PluginSpec {\n  name: string;\n  range: string;\n}\n\n/**\n * Parse a single plugin specifier into `{ name, range }`.\n *\n * @param spec - An npm specifier, e.g. `\"@skaile/provider-fly@^0.1.0\"` or `\"lodash\"`.\n * @returns The package name and semver range (range defaults to `\"*\"`).\n * @throws Error when the specifier is empty.\n */\nexport function parseSpec(spec: string): PluginSpec {\n  const trimmed = spec.trim();\n  if (!trimmed) throw new Error(\"parseSpec: empty specifier\");\n\n  // Find the version-separating `@` — the last one that is not the scope `@`\n  // at index 0. A bare `@scope/name` has its only `@` at index 0 (no range).\n  const at = trimmed.lastIndexOf(\"@\");\n  if (at <= 0) {\n    return { name: trimmed, range: \"*\" };\n  }\n  const name = trimmed.slice(0, at);\n  const range = trimmed.slice(at + 1);\n  return { name, range: range.length > 0 ? range : \"*\" };\n}\n\n/** Convenience: just the package name of a specifier. */\nexport function specName(spec: string): string {\n  return parseSpec(spec).name;\n}\n\n/** An npm package name: optional `@scope/`, then lowercase letters, digits and `. _ ~ -`. */\nconst NPM_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\\/)?[a-z0-9][a-z0-9._~-]*$/;\n\n/**\n * The refusal for a specifier that is not an npm package name with an optional version range\n * (`./dir`, `../dir`, `/abs/dir`, `file:../dir`, `git+https://…`), or `undefined` when it is\n * one. A bare path or `file:` URL has no package name: the package manager would send it to the\n * registry and fail with its registry error (p1737). A local folder is installed under its\n * package name, `name@file:/path/to/dir`, which this accepts.\n */\nexport function npmSpecError(spec: string): string | undefined {\n  const trimmed = spec.trim();\n  if (trimmed !== \"\") {\n    const { name, range } = parseSpec(trimmed);\n    if (NPM_NAME.test(name) && (range.startsWith(\"file:\") || !/[\\s/\\\\]/.test(range))) {\n      return undefined;\n    }\n  }\n  return (\n    `plugin spec '${spec}' is not an npm package name. Give an npm name with an optional version ` +\n    \"range, for example @scope/name@1.2.0. To try a local plugin folder, give its package name: \" +\n    \"name@file:/path/to/dir.\"\n  );\n}\n","/**\n * Runtime plugin loader: dynamic-import each reconciled plugin and let it\n * self-register into the `pluginRegistry`.\n *\n * Each plugin specifier resolves to an absolute path under the store's\n * `node_modules`; we import it via a `file://` URL so the import works inside\n * `bun --compile` binaries (which bundle only the literal-string switches, but\n * can still execute a `file://` import against the unpacked store on disk).\n * Failures are caught per-plugin so one broken plugin never aborts the rest.\n */\n\nimport { pathToFileURL } from \"node:url\";\nimport { type PluginRegistry, pluginRegistry } from \"@skaile/workspaces/plugin-registry\";\nimport type { Logger } from \"@skaile/workspaces/types\";\nimport { resolvePluginEntry } from \"./paths.js\";\nimport { parseSpec } from \"./spec.js\";\n\n/** Options for {@link loadPlugins}. */\nexport interface LoadOptions {\n  log?: Logger;\n}\n\n/** Result of a load pass: which specs registered and which failed. */\nexport interface LoadResult {\n  loaded: string[];\n  failed: { spec: string; error: string; reason: string }[];\n}\n\n/** The self-registration entrypoint a plugin module is expected to export. */\ntype PluginModule = { register?: (registry: PluginRegistry) => void };\n\n/**\n * Load and register each plugin in `plugins` into `registry`.\n *\n * @param projectDir - Project root holding `.skaile/plugins/node_modules`.\n * @param plugins - The `skaile.yaml` `plugins:` list (npm specifiers).\n * @param registry - Registry to register into. Defaults to the process-wide `pluginRegistry`.\n * @param opts - Optional logger.\n * @returns Loaded specs + per-plugin failures (never throws).\n */\nexport async function loadPlugins(\n  projectDir: string,\n  plugins: string[],\n  registry: PluginRegistry = pluginRegistry,\n  opts: LoadOptions = {},\n): Promise<LoadResult> {\n  const loaded: string[] = [];\n  const failed: { spec: string; error: string; reason: string }[] = [];\n\n  for (const spec of plugins) {\n    try {\n      const { name } = parseSpec(spec);\n      const entry = resolvePluginEntry(projectDir, name);\n      const mod = (await import(pathToFileURL(entry).href)) as PluginModule;\n      if (typeof mod.register !== \"function\") {\n        throw new Error(`plugin \"${name}\" does not export a register() function`);\n      }\n      mod.register(registry);\n      loaded.push(spec);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      failed.push({ spec, error: `failed to load plugin \"${spec}\": ${message}`, reason: message });\n      opts.log?.warn(`plugin load failed: ${spec}`, { error: message });\n    }\n  }\n\n  return { loaded, failed };\n}\n","/**\n * Reconcile the project-local plugin store (`<projectDir>/.skaile/plugins/`).\n *\n * The reconciler is hash-skipped: it computes a SHA-256 over the sorted plugin\n * list plus the lock file's `plugins` slice and compares it to the stored\n * `.reconcile-hash`. On a match it returns with zero further I/O; otherwise it\n * regenerates the store's `package.json` and runs `bun install` against it.\n *\n * The install step is injectable (`InstallFn`) so tests stay hermetic — they\n * pass a fake installer that records calls and writes a stub `node_modules`.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { readPluginsLockSlice } from \"@skaile/workspaces/core\";\nimport { nodeModulesDir, pluginsDir, pluginsPkgJson, reconcileHashFile } from \"./paths.js\";\nimport { parseSpec } from \"./spec.js\";\n\n/** How `InstallFn` may treat the store's lock: `frozen` forbids lock changes. */\nexport interface InstallOptions {\n  /**\n   * `false` when the spec list changed since the last `package.json`, so the\n   * lock has to change too. Defaults to `true` (frozen when a lock exists).\n   */\n  frozen?: boolean;\n}\n\n/**\n * Installs the store's dependencies. Returns `ok: false` (never throws) on a\n * failed install so the reconciler can surface the captured `output`.\n */\nexport type InstallFn = (\n  pluginsDir: string,\n  opts?: InstallOptions,\n) => Promise<{ ok: boolean; output: string }>;\n\n/** Options for {@link reconcilePlugins}. */\nexport interface ReconcileOptions {\n  /** Injectable installer. Defaults to a real `bun install` of the store. */\n  runInstall?: InstallFn;\n  /**\n   * Lock slice to fold into the reconcile-hash. Defaults to\n   * `readPluginsLockSlice(projectDir)` so a lock edit invalidates the hash.\n   */\n  lockSlice?: unknown;\n}\n\n/** Result of a reconcile pass. */\nexport interface ReconcileResult {\n  changed: boolean;\n  reason: \"no-plugins\" | \"up-to-date\" | \"reconciled\";\n}\n\n/** Run a command to completion, capturing stdout+stderr. `started: false` when it cannot spawn. */\nasync function runCapture(\n  args: string[],\n  cwd: string,\n): Promise<{ started: boolean; code: number; output: string }> {\n  const { portableSpawn } = await import(\"@skaile/workspaces/core\");\n  const proc = portableSpawn(args, { cwd });\n  const chunks: string[] = [];\n  const decoder = new TextDecoder();\n  const pump = async (stream: ReadableStream<Uint8Array>) => {\n    const reader = stream.getReader();\n    for (;;) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (value) chunks.push(decoder.decode(value, { stream: true }));\n    }\n  };\n  await Promise.all([pump(proc.stdout), pump(proc.stderr)]);\n  const code = await proc.exited;\n  // `portableSpawn` reports a spawn error (ENOENT) as exit -1 with no pid.\n  return { started: proc.pid !== -1, code, output: chunks.join(\"\") };\n}\n\n/**\n * The default real installer: `bun install` inside the store directory, or\n * `npm install` when `bun` is not on PATH. Frozen only when a lock exists and\n * the spec list did not change (`opts.frozen !== false`): a changed list has to\n * rewrite the lock, which a frozen install refuses.\n */\nexport const defaultInstall: InstallFn = async (dir, opts = {}) => {\n  const hasBunLock = existsSync(`${dir}/bun.lock`) || existsSync(`${dir}/bun.lockb`);\n  const hasNpmLock = existsSync(`${dir}/package-lock.json`);\n  const frozen = opts.frozen !== false;\n\n  const bunArgs =\n    frozen && (hasBunLock || hasNpmLock)\n      ? [\"bun\", \"install\", \"--frozen-lockfile\"]\n      : [\"bun\", \"install\"];\n  const withBun = await runCapture(bunArgs, dir);\n  if (withBun.started) return { ok: withBun.code === 0, output: withBun.output };\n\n  const npmArgs =\n    frozen && hasNpmLock\n      ? [\"npm\", \"ci\", \"--ignore-scripts\", \"--no-audit\", \"--no-fund\"]\n      : [\"npm\", \"install\", \"--ignore-scripts\", \"--no-audit\", \"--no-fund\"];\n  const withNpm = await runCapture(npmArgs, dir);\n  if (withNpm.started) return { ok: withNpm.code === 0, output: withNpm.output };\n  return {\n    ok: false,\n    output:\n      \"neither bun nor npm found on PATH; plugin install needs one of them (https://bun.sh or https://nodejs.org)\",\n  };\n};\n\n/**\n * Generate the store's `package.json` from the plugin specs. Returns the\n * previous file content (`undefined` when there was none) and whether the\n * dependency set changed.\n */\nfunction writePackageJson(\n  projectDir: string,\n  plugins: string[],\n): { previous: string | undefined; depsChanged: boolean } {\n  const dependencies: Record<string, string> = {};\n  for (const spec of plugins) {\n    const { name, range } = parseSpec(spec);\n    dependencies[name] = range;\n  }\n  const pkg = {\n    name: \"skaile-project-plugins\",\n    private: true,\n    dependencies,\n  };\n  const file = pluginsPkgJson(projectDir);\n  const previous = existsSync(file) ? readFileSync(file, \"utf8\") : undefined;\n  let before: Record<string, string> | undefined;\n  try {\n    before = previous === undefined ? undefined : JSON.parse(previous).dependencies;\n  } catch {\n    before = undefined;\n  }\n  const sortedJson = (d: Record<string, string> | undefined) =>\n    JSON.stringify(Object.entries(d ?? {}).sort(([a], [b]) => a.localeCompare(b)));\n  const depsChanged = before === undefined || sortedJson(before) !== sortedJson(dependencies);\n  mkdirSync(pluginsDir(projectDir), { recursive: true });\n  writeFileSync(file, `${JSON.stringify(pkg, null, 2)}\\n`);\n  return { previous, depsChanged };\n}\n\n/**\n * Reconcile the plugin store for a project.\n *\n * @param projectDir - Project root containing `skaile.yaml` / `skaile.lock.yaml`.\n * @param plugins - The `skaile.yaml` `plugins:` list (npm specifiers).\n * @param opts - Optional injectable installer + lock slice override.\n * @returns Whether the store changed and why.\n */\nexport async function reconcilePlugins(\n  projectDir: string,\n  plugins: string[],\n  opts: ReconcileOptions = {},\n): Promise<ReconcileResult> {\n  if (plugins.length === 0) {\n    return { changed: false, reason: \"no-plugins\" };\n  }\n\n  const lockSlice = opts.lockSlice ?? readPluginsLockSlice(projectDir);\n  const wantHash = createHash(\"sha256\")\n    .update(JSON.stringify({ plugins: [...plugins].sort(), lock: lockSlice }))\n    .digest(\"hex\");\n\n  const hashFile = reconcileHashFile(projectDir);\n  if (existsSync(hashFile)) {\n    const have = readFileSync(hashFile, \"utf8\").trim();\n    if (have === wantHash) {\n      return { changed: false, reason: \"up-to-date\" };\n    }\n  }\n\n  const { previous, depsChanged } = writePackageJson(projectDir, plugins);\n\n  const install = opts.runInstall ?? defaultInstall;\n  const result = await install(pluginsDir(projectDir), { frozen: !depsChanged });\n  if (!result.ok) {\n    // A failed install must not leave the spec behind: the next reconcile\n    // would compare against it and treat the store as already changed.\n    if (previous === undefined) rmSync(pluginsPkgJson(projectDir), { force: true });\n    else writeFileSync(pluginsPkgJson(projectDir), previous);\n    throw new Error(`plugin install failed:\\n${result.output}`);\n  }\n\n  writeFileSync(hashFile, wantHash);\n  return { changed: true, reason: \"reconciled\" };\n}\n\n/**\n * Put the store back to `previousPlugins` after `plugin install` failed past\n * the reconcile (the plugin installed but does not load). Best effort: a\n * failing reinstall is swallowed, the store is then rebuilt by the next\n * reconcile because the hash no longer matches the declared list.\n *\n * With no previous plugins every generated file of the store goes away\n * (`package.json`, hash, lock file and `node_modules`), so the store keeps\n * neither the rejected spec nor its installed package.\n */\nexport async function rollbackPluginStore(\n  projectDir: string,\n  previousPlugins: string[],\n  opts: ReconcileOptions = {},\n): Promise<void> {\n  if (previousPlugins.length === 0) {\n    const dir = pluginsDir(projectDir);\n    rmSync(pluginsPkgJson(projectDir), { force: true });\n    rmSync(reconcileHashFile(projectDir), { force: true });\n    rmSync(nodeModulesDir(projectDir), { recursive: true, force: true });\n    for (const lock of [\"bun.lock\", \"bun.lockb\", \"package-lock.json\"]) {\n      rmSync(join(dir, lock), { force: true });\n    }\n    return;\n  }\n  try {\n    await reconcilePlugins(projectDir, previousPlugins, opts);\n  } catch {\n    // the next reconcile retries\n  }\n}\n","/**\n * The project-local plugin store: reconcile (`<projectDir>/.skaile/plugins/`)\n * then load the reconciled plugins into the `pluginRegistry`.\n *\n * `ensurePluginsLoaded` is the single entrypoint commands wire in. It is a\n * guarded no-op when `plugins` is empty/undefined — zero overhead for the\n * common case where no project declares `plugins:` in `skaile.yaml`.\n */\n\nimport { type PluginRegistry, pluginRegistry } from \"@skaile/workspaces/plugin-registry\";\nimport type { Logger } from \"@skaile/workspaces/types\";\nimport pc from \"picocolors\";\nimport { type LoadResult, loadPlugins } from \"./load.js\";\nimport { type ReconcileOptions, reconcilePlugins } from \"./reconcile.js\";\nimport { specName } from \"./spec.js\";\n\nexport type { LoadResult } from \"./load.js\";\nexport { loadPlugins } from \"./load.js\";\nexport type { ReconcileOptions } from \"./reconcile.js\";\nexport { reconcilePlugins, rollbackPluginStore } from \"./reconcile.js\";\nexport { npmSpecError, specName } from \"./spec.js\";\n\n/** Options for {@link ensurePluginsLoaded}. */\nexport interface EnsurePluginsOptions extends ReconcileOptions {\n  log?: Logger;\n}\n\n/**\n * Reconcile the plugin store then load each plugin into `registry`.\n *\n * No-op (returns immediately) when `plugins` is empty/undefined, so the common\n * no-plugins path costs nothing.\n *\n * @param projectDir - Project root.\n * @param plugins - The `skaile.yaml` `plugins:` list (may be undefined).\n * @param registry - Registry to register into. Defaults to `pluginRegistry`.\n * @param opts - Injectable installer / lock slice + optional logger.\n * @returns The load result, or an empty result when there are no plugins.\n */\nexport async function ensurePluginsLoaded(\n  projectDir: string,\n  plugins: string[] | undefined,\n  registry: PluginRegistry = pluginRegistry,\n  opts: EnsurePluginsOptions = {},\n): Promise<LoadResult> {\n  if (!plugins || plugins.length === 0) {\n    return { loaded: [], failed: [] };\n  }\n  await reconcilePlugins(projectDir, plugins, opts);\n  return loadPlugins(projectDir, plugins, registry, { log: opts.log });\n}\n\n/**\n * The installer's output of a failed `plugin install` is a dump (bun's banner, resolver\n * progress, then the `error:` lines). A load warning keeps the first line and the cause of it\n * (p1113); `skaile plugin install <spec>` prints the whole output.\n *\n * bun: the last `error:` line. npm: its `code` line and the first detail line after it\n * (`E404: 404 Not Found - GET …`), never the trailing `A complete log of this run can be found\n * in: …` pointer (p1272).\n */\nexport function condensePluginFailure(reason: string): string {\n  const lines = reason\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l !== \"\");\n  const [first, ...rest] = lines;\n  if (!reason.startsWith(\"plugin install failed\") || first === undefined || rest.length === 0) {\n    return reason;\n  }\n  const head = first.replace(/:$/, \"\");\n  const npmPrefix = /^npm (ERR!|error)\\s*/i;\n  const npmLines = rest\n    .filter((l) => npmPrefix.test(l) && !/^npm \\S+\\s+A complete log of this run\\b/i.test(l))\n    .map((l) => l.replace(npmPrefix, \"\"))\n    .filter((l) => l !== \"\");\n  const codeLine = npmLines.find((l) => /^code\\s+\\S+/i.test(l));\n  if (codeLine) {\n    const code = codeLine.replace(/^code\\s+/i, \"\");\n    const detail = npmLines.find((l) => l !== codeLine && !/^code\\s/i.test(l));\n    return `${head}: npm ${code}${detail ? `: ${detail}` : \"\"}`;\n  }\n  const causes = rest.filter(\n    (l) => /^error\\b/i.test(l) || (npmPrefix.test(l) && !/A complete log of this run\\b/i.test(l)),\n  );\n  const cause =\n    causes.at(-1) ?? rest.filter((l) => !/A complete log of this run\\b/i.test(l)).at(-1);\n  return `${head}: ${cause ?? rest.at(-1)}`;\n}\n\nfunction escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\/]/g, \"\\\\$&\");\n}\n\n/**\n * Split the output of one failed install of the whole plugin store into one reason per plugin\n * (p1272): the package manager runs once for every spec, so its output names the plugins that\n * failed. A plugin gets the line that names it (also its URL-encoded form `@scope%2fname`); a\n * plugin the output never names says it was not installed and which plugin the install stopped\n * at. With one plugin, or when the output names none (no `bun` and no `npm`), every plugin keeps\n * the whole condensed reason.\n */\nexport function pluginFailureReasons(\n  reason: string,\n  specs: readonly string[],\n): Map<string, string> {\n  const out = new Map<string, string>();\n  const condensed = condensePluginFailure(reason);\n  if (specs.length < 2 || !reason.startsWith(\"plugin install failed\")) return out;\n  const lines = reason\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l !== \"\" && !/A complete log of this run\\b/i.test(l));\n  const names = specs.map((spec) => {\n    try {\n      return specName(spec);\n    } catch {\n      return spec;\n    }\n  });\n  const mentions = (text: string, name: string): boolean => {\n    const forms = [name, name.replace(\"/\", \"%2f\"), name.replace(\"/\", \"%2F\")];\n    return forms.some((f) =>\n      new RegExp(`(?<![\\\\w@.-])(?<!@[\\\\w.~-]+/)${escapeRegExp(f)}(?![\\\\w-]|\\\\.\\\\w)`).test(text),\n    );\n  };\n  const cause = /\\berror\\b|\\bE[A-Z0-9]{3,}\\b|\\b404\\b|notarget|failed to resolve/i;\n  const named: string[] = [];\n  specs.forEach((spec, i) => {\n    const name = names[i] as string;\n    const line = mentions(condensed, name)\n      ? condensed.replace(/^plugin install failed:\\s*/, \"\")\n      : lines.filter((l) => mentions(l, name) && cause.test(l)).at(-1);\n    if (line === undefined) return;\n    named.push(name);\n    out.set(spec, `plugin install failed: ${line.replace(/^(npm\\s+)?(ERR!|error:?)\\s*/i, \"\")}`);\n  });\n  if (named.length === 0) return new Map();\n  specs.forEach((spec, i) => {\n    if (!out.has(spec)) {\n      out.set(\n        spec,\n        `plugin install failed: ${names[i]} was not installed, the install stopped at ${named.join(\", \")}`,\n      );\n    }\n  });\n  return out;\n}\n\n/** One `! plugin <name> failed to load: <reason>` line on stderr (stdout carries a run's answer). */\nfunction warnPluginFailed(spec: string, reason: string): void {\n  let name = spec;\n  try {\n    name = specName(spec);\n  } catch {\n    /* a spec that does not parse is named as written */\n  }\n  process.stderr.write(\n    `  ${pc.yellow(\"!\")} plugin ${name} failed to load: ${condensePluginFailure(reason)}\\n`,\n  );\n}\n\n/**\n * Reconcile + load the `plugins:` of the project's `skaile.yaml` into the process registry, so a\n * plugin's harness is known to `run`, `repl` and `config set harness`. A plugin that fails to\n * reconcile or load is skipped (its harness stays unknown, the command goes on) and named in one\n * `! plugin <name> failed to load: <reason>` line on stderr. An unreadable config is not this\n * function's to report: the command reads it again and says so.\n */\nexport async function loadDeclaredPlugins(projectDir: string): Promise<void> {\n  let plugins: string[] | undefined;\n  try {\n    const { resolveSkWorkspaceConfig } = await import(\"@skaile/workspaces/core\");\n    plugins = resolveSkWorkspaceConfig(projectDir).plugins;\n  } catch {\n    return;\n  }\n  if (!plugins || plugins.length === 0) return;\n  try {\n    const result = await ensurePluginsLoaded(projectDir, plugins, pluginRegistry);\n    for (const f of result.failed) warnPluginFailed(f.spec, f.reason);\n  } catch (err) {\n    // The store could not be reconciled: no plugin was loaded.\n    const reason = err instanceof Error ? err.message : String(err);\n    const reasons = pluginFailureReasons(reason, plugins);\n    for (const spec of plugins) warnPluginFailed(spec, reasons.get(spec) ?? reason);\n  }\n}\n"]}

package/dist/{chunk-Z7ZEZZB6.js → chunk-C5HFK34M.js}

@@ -1,5 +1,5 @@
 // core/src/framework.ts
-var DEFAULT_HARNESS_ID = "omp";
+var DEFAULT_HARNESS_ID = "claude-sdk";
 var HARNESS_DEFAULTS = {
   "claude-sdk": {
     skillsDir: ".claude/skills",
@@ -28,5 +28,5 @@ function resolveHarnessPaths(settings) {
 }
 
 export { DEFAULT_HARNESS_ID, HARNESS_DEFAULTS, resolveHarnessPaths };
-//# sourceMappingURL=chunk-Z7ZEZZB6.js.map
-//# sourceMappingURL=chunk-Z7ZEZZB6.js.map
+//# sourceMappingURL=chunk-C5HFK34M.js.map
+//# sourceMappingURL=chunk-C5HFK34M.js.map

package/dist/chunk-C5HFK34M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/src/framework.ts"],"names":[],"mappings":";AA8BO,IAAM,kBAAA,GAAqB;AAO3B,IAAM,gBAAA,GAAiD;AAAA,EAC5D,YAAA,EAAc;AAAA,IACZ,SAAA,EAAW,gBAAA;AAAA,IACX,SAAA,EAAW,gBAAA;AAAA,IACX,UAAA,EAAY;AAAA,GACd;AAAA,EACA,KAAA,EAAO;AAAA,IACL,SAAA,EAAW,eAAA;AAAA,IACX,SAAA,EAAW,eAAA;AAAA,IACX,UAAA,EAAY;AAAA,GACd;AAAA,EACA,GAAA,EAAK;AAAA,IACH,SAAA,EAAW,aAAA;AAAA,IACX,SAAA,EAAW,aAAA;AAAA,IACX,UAAA,EAAY;AAAA;AAEhB;AA0BO,SAAS,oBAAoB,QAAA,EAAsC;AACxE,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,kBAAA;AACpC,EAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,OAAO,CAAA,IAAK,iBAAiB,kBAAkB,CAAA;AACjF,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,QAAA,CAAS,SAAA,IAAa,QAAA,CAAU,SAAA;AAAA,IAC3C,SAAA,EAAW,QAAA,CAAS,SAAA,IAAa,QAAA,CAAU,SAAA;AAAA,IAC3C,UAAA,EAAY,QAAA,CAAS,UAAA,IAAc,QAAA,CAAU;AAAA,GAC/C;AACF","file":"chunk-C5HFK34M.js","sourcesContent":["/**\n * Harness path resolution — maps execution harness names to their runtime paths.\n */\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\n/**\n * Resolved runtime path structure for a bridge harness.\n * All three directories are relative to the project root.\n * @docLink packages/core/concepts#harness-paths\n */\nexport interface HarnessPaths {\n  /** Where skills (SKILL.md dirs) are installed relative to projectDir */\n  skillsDir: string;\n  /** Where agent definitions are installed relative to projectDir */\n  agentsDir: string;\n  /** Where prompt files are installed relative to projectDir */\n  promptsDir: string;\n}\n\n// ── Harness defaults ───────────────────────────────────────────────────────────\n\n/**\n * The harness a session runs on when no settings layer, flag or profile names\n * one: the Claude Agent SDK, which deploys to `.claude/` like the `claude-code`\n * target `add` and `install` use for a project without `agent-config` (p1670).\n * The single definition: settings defaults, path resolution and the runner's\n * session build all import it.\n * @docLink packages/core/concepts#harness-defaults\n */\nexport const DEFAULT_HARNESS_ID = \"claude-sdk\";\n\n/**\n * Built-in per-harness runtime path conventions (relative to project root).\n * Covers `claude-sdk`, `codex`, and `omp`. Used as defaults by `resolveHarnessPaths`.\n * @docLink packages/core/concepts#harness-defaults\n */\nexport const HARNESS_DEFAULTS: Record<string, HarnessPaths> = {\n  \"claude-sdk\": {\n    skillsDir: \".claude/skills\",\n    agentsDir: \".claude/agents\",\n    promptsDir: \".claude/commands\",\n  },\n  codex: {\n    skillsDir: \".codex/skills\",\n    agentsDir: \".codex/agents\",\n    promptsDir: \".codex/rules\",\n  },\n  omp: {\n    skillsDir: \".omp/skills\",\n    agentsDir: \".omp/agents\",\n    promptsDir: \".omp/prompts\",\n  },\n};\n\n// ── Harness resolution ─────────────────────────────────────────────────────────\n\n/** Settings interface — minimal subset needed for harness path resolution. */\ninterface SettingsLike {\n  skillsDir?: string;\n  agentsDir?: string;\n  promptsDir?: string;\n  harness?: string;\n}\n\n/**\n * Resolve the effective runtime paths for a bridge harness.\n *\n * Looks up `HARNESS_DEFAULTS[settings.harness]`, then overlays any per-field\n * overrides from `settings.skillsDir`, `settings.agentsDir`, `settings.promptsDir`.\n * Falls back to the `omp` defaults for unknown harness values.\n *\n * To look up file install paths for a specific IDE/tool target, use\n * `HARNESS_TARGETS[harnessName]` from `harness-targets.ts` directly.\n *\n * @param settings - Minimal settings object providing `harness` and optional path overrides\n * @returns `HarnessPaths` with resolved relative paths for skills, agents, and prompts\n * @docLink packages/core/concepts#resolve-harness-paths\n */\nexport function resolveHarnessPaths(settings: SettingsLike): HarnessPaths {\n  const harness = settings.harness ?? DEFAULT_HARNESS_ID;\n  const defaults = HARNESS_DEFAULTS[harness] ?? HARNESS_DEFAULTS[DEFAULT_HARNESS_ID];\n  return {\n    skillsDir: settings.skillsDir ?? defaults!.skillsDir,\n    agentsDir: settings.agentsDir ?? defaults!.agentsDir,\n    promptsDir: settings.promptsDir ?? defaults!.promptsDir,\n  };\n}\n"]}

package/dist/{chunk-ABFPSVIS.js → chunk-COAFAYBS.js}

@@ -1,6 +1,6 @@
-import { normalizeAnthropicModel, ANTHROPIC_MODEL_ALIASES } from './chunk-E572OHGY.js';
-import { buildAgentPromptSections } from './chunk-VMVDAZLA.js';
-import { existsSync, readFileSync, mkdirSync, writeFileSync, lstatSync, unlinkSync, readdirSync } from 'fs';
+import { normalizeAnthropicModel, ANTHROPIC_MODEL_ALIASES } from './chunk-76FLBODK.js';
+import { buildAgentPromptSections } from './chunk-BRK5QZKI.js';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, lstatSync, unlinkSync, readdirSync, chmodSync } from 'fs';
 import { join, dirname, relative, resolve, normalize, basename } from 'path';
 import { stringify } from 'yaml';
 
@@ -64,14 +64,19 @@ function copyTree(from, to, workspaceRoot, changed) {
   if (!stat.isFile()) return;
   const bytes = readFileSync(from);
   dropSymlink(to);
+  const executable = (stat.mode & 73) !== 0;
   if (existsSync(to)) {
     try {
-      if (bytes.equals(readFileSync(to))) return;
+      if (bytes.equals(readFileSync(to))) {
+        if (executable && (lstatSync(to).mode & 64) === 0) chmodSync(to, stat.mode & 511);
+        return;
+      }
     } catch {
     }
   }
   mkdirSync(dirname(to), { recursive: true });
   writeFileSync(to, bytes);
+  if (executable) chmodSync(to, stat.mode & 511);
   changed.push(relative(workspaceRoot, to));
 }
 function bundleLocalComposes(composes, srcDir, destDir, workspaceRoot, changed, warnings) {
@@ -314,7 +319,26 @@ var AGENT_RENDERERS = {
 function harnessTargetSupportsAgents(harnessTarget) {
   return harnessTarget in AGENT_RENDERERS;
 }
+function agentRenderFiles(harnessTarget, agentDeployDir, agentName) {
+  switch (harnessTarget) {
+    case "claude-code":
+      return [join(agentDeployDir, `${agentName}.md`)];
+    case "codex":
+      return [
+        join(agentDeployDir, `${agentName}.toml`),
+        join(dirname(agentDeployDir), CODEX_IDENTITY_DIR, `${agentName}.md`)
+      ];
+    case "omp":
+      return [
+        join(agentDeployDir, agentName, "agent.yaml"),
+        join(agentDeployDir, agentName, "SOUL.md"),
+        join(agentDeployDir, `${agentName}.md`)
+      ];
+    default:
+      return [];
+  }
+}
 
-export { AGENT_RENDERERS, CODEX_IDENTITY_DIR, claudeCodeRenderer, codexRenderer, harnessTargetSupportsAgents, ompRenderer, renderAgentToFramework };
-//# sourceMappingURL=chunk-ABFPSVIS.js.map
-//# sourceMappingURL=chunk-ABFPSVIS.js.map
+export { AGENT_RENDERERS, CODEX_IDENTITY_DIR, agentRenderFiles, claudeCodeRenderer, codexRenderer, harnessTargetSupportsAgents, ompRenderer, renderAgentToFramework };
+//# sourceMappingURL=chunk-COAFAYBS.js.map
+//# sourceMappingURL=chunk-COAFAYBS.js.map

package/dist/chunk-COAFAYBS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../asset-manager/src/renderers.ts"],"names":["stringifyYaml"],"mappings":";;;;;;AA6GA,SAAS,YAAY,IAAA,EAAoB;AACvC,EAAA,IAAI;AACF,IAAA,IAAI,UAAU,IAAI,CAAA,CAAE,cAAA,EAAe,aAAc,IAAI,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQA,SAAS,UAAA,CACP,QAAA,EACA,OAAA,EACA,aAAA,EACA,SACA,OAAA,EACM;AACN,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,aAAA,EAAe,QAAQ,CAAA;AAC5C,EAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAChB,EAAA,WAAA,CAAY,QAAQ,CAAA;AACpB,EAAA,IAAI,UAAA,CAAW,QAAQ,CAAA,EAAG;AACxB,IAAA,IAAI;AACF,MAAA,IAAI,YAAA,CAAa,QAAA,EAAU,OAAO,CAAA,KAAM,OAAA,EAAS;AAAA,IACnD,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,SAAA,CAAU,QAAQ,QAAQ,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,EAAA,aAAA,CAAc,QAAA,EAAU,SAAS,OAAO,CAAA;AACxC,EAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAClB;AAeA,SAAS,kBACP,IAAA,EACA,KAAA,EACA,QACA,WAAA,EACA,YAAA,EACA,oBACA,gBAAA,EACQ;AACR,EAAA,MAAM,WAAW,wBAAA,CAAyB;AAAA,IACxC,IAAA;AAAA,IACA,WAAA,EAAa,KAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA,EAAW,WAAA;AAAA,IACX,SAAA,EAAW,YAAA;AAAA,IACX,kBAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,OAAO,CAAA,EAAG,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA,CAAE,IAAA,CAAK,MAAM,CAAC;AAAA,CAAA;AACpD;AAGA,SAAS,sBAAsB,CAAA,EAAmB;AAEhD,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,WAAW,CAAA;AACtC;AASA,SAAS,aAAa,KAAA,EAAmE;AACvF,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,MAAM,UAAA,GAAa,CAAC,CAAA,KACjB,uBAAA,CAA8C,SAAS,CAAC,CAAA;AAC3D,EAAA,MAAM,EAAE,SAAA,EAAW,QAAA,EAAU,GAAG,MAAK,GAAI,KAAA;AACzC,EAAA,MAAM,IAAA,GAA4C,EAAE,GAAG,IAAA,EAAK;AAC5D,EAAA,IAAI,aAAa,CAAC,UAAA,CAAW,SAAS,CAAA,OAAQ,SAAA,GAAY,SAAA;AAC1D,EAAA,MAAM,SAAA,GAAA,CAAa,QAAA,IAAY,EAAC,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,UAAA,CAAW,CAAC,CAAC,CAAA;AAC/D,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,QAAA,GAAW,SAAA;AAC1C,EAAA,OAAO,OAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,GAAS,IAAI,IAAA,GAAO,MAAA;AAC/C;AAGA,IAAM,SAAA,uBAAgB,GAAA,CAAI,CAAC,QAAQ,WAAA,EAAa,cAAA,EAAgB,aAAa,CAAC,CAAA;AAG9E,SAAS,QAAA,CAAS,IAAA,EAAc,EAAA,EAAY,aAAA,EAAuB,OAAA,EAAyB;AAC1F,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,IAAA,CAAK,gBAAe,EAAG;AAC3B,EAAA,IAAI,IAAA,CAAK,aAAY,EAAG;AACtB,IAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AACpC,MAAA,IAAI,UAAU,GAAA,CAAI,IAAI,KAAK,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,MAAM,IAAI,CAAA,EAAG,KAAK,EAAA,EAAI,IAAI,CAAA,EAAG,aAAA,EAAe,OAAO,CAAA;AAAA,IACnE;AACA,IAAA;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,EAAG;AACpB,EAAA,MAAM,KAAA,GAAQ,aAAa,IAAI,CAAA;AAC/B,EAAA,WAAA,CAAY,EAAE,CAAA;AAEd,EAAA,MAAM,UAAA,GAAA,CAAc,IAAA,CAAK,IAAA,GAAO,EAAA,MAAW,CAAA;AAC3C,EAAA,IAAI,UAAA,CAAW,EAAE,CAAA,EAAG;AAClB,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,CAAM,MAAA,CAAO,YAAA,CAAa,EAAE,CAAC,CAAA,EAAG;AAClC,QAAA,IAAI,UAAA,IAAA,CAAe,SAAA,CAAU,EAAE,CAAA,CAAE,IAAA,GAAO,EAAA,MAAW,CAAA,EAAG,SAAA,CAAU,EAAA,EAAI,IAAA,CAAK,IAAA,GAAO,GAAK,CAAA;AACrF,QAAA;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,SAAA,CAAU,QAAQ,EAAE,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1C,EAAA,aAAA,CAAc,IAAI,KAAK,CAAA;AACvB,EAAA,IAAI,UAAA,EAAY,SAAA,CAAU,EAAA,EAAI,IAAA,CAAK,OAAO,GAAK,CAAA;AAC/C,EAAA,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,aAAA,EAAe,EAAE,CAAC,CAAA;AAC1C;AAQA,SAAS,oBACP,QAAA,EACA,MAAA,EACA,OAAA,EACA,aAAA,EACA,SACA,QAAA,EACwC;AACxC,EAAA,IAAI,CAAC,QAAQ,OAAO,QAAA;AACpB,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,CAAC,IAAA,KAAS;AAC5B,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,IAAK,CAAC,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,IAAA;AACtE,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG;AACrB,MAAA,QAAA,CAAS,IAAA,CAAK,eAAe,IAAA,CAAK,GAAG,iBAAiB,IAAI,CAAA,kBAAA,EAAqB,OAAO,CAAA,CAAE,CAAA;AACxF,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,GAAA,GAAM,SAAA,CAAU,IAAA,CAAK,GAAG,CAAA;AAC9B,IAAA,MAAM,MAAA,GAAS,CAAC,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA;AACnC,IAAA,MAAM,SAAS,MAAA,GAAS,GAAA,GAAM,KAAK,UAAA,EAAY,QAAA,CAAS,IAAI,CAAC,CAAA;AAC7D,IAAA,QAAA,CAAS,MAAM,IAAA,CAAK,OAAA,EAAS,MAAM,CAAA,EAAG,eAAe,OAAO,CAAA;AAC5D,IAAA,OAAO,MAAA,GAAS,OAAO,EAAE,GAAG,MAAM,GAAA,EAAK,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,EAAG;AAAA,EACvD,CAAC,CAAA;AACH;AAyBO,IAAM,qBAAoC,CAAC;AAAA,EAChD,QAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA,KAAM;AACJ,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,IAAA,EAAM,SAAA;AAAA,IACN,WAAA,EAAa,QAAA,CAAS,WAAA,IAAe,CAAA,EAAG,SAAS,CAAA,MAAA;AAAA,GACnD;AAKA,EAAA,IAAI,QAAA,CAAS,OAAO,SAAA,EAAW;AAC7B,IAAA,MAAM,GAAA,GAAM,SAAS,KAAA,CAAM,SAAA;AAC3B,IAAA,MAAM,UAAA,GAAa,wBAAwB,GAAG,CAAA;AAC9C,IAAA,IAAI,eAAe,GAAA,EAAK;AACtB,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,CAAA,MAAA,EAAS,SAAS,CAAA,SAAA,EAAY,GAAG,0DAA0D,UAAU,CAAA,qBAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,WAAA,CAAY,KAAA,GAAQ,UAAA;AAAA,EACtB;AAGA,EAAA,IAAI,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,MAAA,EAAQ;AACnC,IAAA,WAAA,CAAY,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,QAAA,CAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ;AAClC,IAAA,WAAA,CAAY,eAAA,GAAkB,QAAA,CAAS,KAAA,CAAM,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,EAC/D;AAEA,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,MAAA,GAAS,MAAA;AAC5C,EAAA,IAAI,UAAA,CAAW,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,UAAA,GAAa,UAAA;AAGpD,EAAA,IAAI,QAAA,CAAS,SAAS,SAAA,EAAW;AAC/B,IAAA,WAAA,CAAY,QAAA,GAAW,SAAS,OAAA,CAAQ,SAAA;AAAA,EAC1C;AACA,EAAA,IAAI,SAAA,KAAc,MAAA,IAAU,QAAA,CAAS,OAAA,EAAS,eAAe,IAAA,EAAM;AACjE,IAAA,WAAA,CAAY,UAAA,GAAa,IAAA;AAAA,EAC3B;AAGA,EAAA,IAAI,SAAS,QAAA,EAAU,KAAA,EAAO,WAAA,CAAY,KAAA,GAAQ,SAAS,QAAA,CAAS,KAAA;AACpE,EAAA,IAAI,SAAS,QAAA,EAAU,MAAA,EAAQ,WAAA,CAAY,MAAA,GAAS,SAAS,QAAA,CAAS,MAAA;AACtE,EAAA,IAAI,SAAS,QAAA,EAAU,SAAA,EAAW,WAAA,CAAY,SAAA,GAAY,SAAS,QAAA,CAAS,SAAA;AAE5E,EAAA,MAAM,IAAA,GAAO,iBAAA;AAAA,IACX,IAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,CAAA;AAAA,EAAQA,SAAA,CAAc,WAAW,CAAA,CAAE,IAAA,EAAM;AAAA;;AAAA,EAAY,IAAI,CAAA,CAAA;AACzE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,cAAA,EAAgB,CAAA,EAAG,SAAS,CAAA,GAAA,CAAK,CAAA;AACvD,EAAA,UAAA,CAAW,QAAA,EAAU,OAAA,EAAS,aAAA,EAAe,OAAA,EAAS,OAAO,CAAA;AAE7D,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,EAAS;AACtC;AAYA,IAAM,iBAAiB,CAAC,OAAA,EAAS,MAAA,EAAQ,WAAA,EAAa,gBAAgB,MAAM,CAAA;AAG5E,SAAS,iBAAiB,KAAA,EAAwD;AAChF,EAAA,MAAM,OAAA,GAAU,KAAA,EAAO,OAAA,IAAW,EAAC;AACnC,EAAA,MAAM,SAAS,IAAI,GAAA,CAAI,KAAA,EAAO,MAAA,IAAU,EAAE,CAAA;AAC1C,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,IAAM,cAAA,CAAqC,QAAA,CAAS,CAAC,CAAC,IAC1F,MAAA,GACA,WAAA;AAAA,EACN;AAEA,EAAA,OAAO,cAAA,CAAe,MAAM,CAAC,CAAA,KAAM,OAAO,GAAA,CAAI,CAAC,CAAC,CAAA,GAAI,WAAA,GAAc,MAAA;AACpE;AAGO,IAAM,kBAAA,GAAqB;AAiB3B,IAAM,gBAA+B,CAAC;AAAA,EAC3C,QAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAA,KAAM;AACJ,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,YAAA,GAAe,iBAAA;AAAA,IACnB,IAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,sBAAsB,YAAY,CAAA;AAElD,EAAA,MAAM,KAAA,GAAkB;AAAA,IACtB,CAAA,OAAA,EAAU,IAAA,CAAK,SAAA,CAAU,SAAS,CAAC,CAAA,CAAA;AAAA,IACnC,CAAA,cAAA,EAAiB,KAAK,SAAA,CAAU,QAAA,CAAS,eAAe,CAAA,EAAG,SAAS,QAAQ,CAAC,CAAA;AAAA,GAC/E;AAEA,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA,EAAG,SAAA;AAC5C,EAAA,IAAI,KAAA,QAAa,IAAA,CAAK,CAAA,QAAA,EAAW,KAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AACxD,EAAA,MAAM,WAAA,GAAc,gBAAA,CAAiB,QAAA,CAAS,KAAK,CAAA;AACnD,EAAA,IAAI,WAAA,QAAmB,IAAA,CAAK,CAAA,eAAA,EAAkB,KAAK,SAAA,CAAU,WAAW,CAAC,CAAA,CAAE,CAAA;AAC3E,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,4BAAA,CAAA,EAAgC,OAAA,CAAQ,IAAA,IAAQ,CAAA,GAAA,CAAK,CAAA;AAEhE,EAAA,MAAM,OAAA,GAAU,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAA;AACnC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,cAAA,EAAgB,CAAA,EAAG,SAAS,CAAA,KAAA,CAAO,CAAA;AACzD,EAAA,UAAA,CAAW,QAAA,EAAU,OAAA,EAAS,aAAA,EAAe,OAAA,EAAS,OAAO,CAAA;AAK7D,EAAA,MAAM,WAAA,GAAc,KAAK,OAAA,CAAQ,cAAc,GAAG,kBAAA,EAAoB,CAAA,EAAG,SAAS,CAAA,GAAA,CAAK,CAAA;AACvF,EAAA,UAAA,CAAW,WAAA,EAAa,YAAA,EAAc,aAAA,EAAe,OAAA,EAAS,OAAO,CAAA;AAErE,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,EAAS;AACtC;AA4BO,IAAM,cAA6B,CAAC;AAAA,EACzC,QAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA,KAAM;AACJ,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,cAAA,EAAgB,SAAS,CAAA;AAG9C,EAAA,MAAM,SAAA,GAAqC;AAAA,IACzC,YAAA,EAAc,SAAS,YAAA,IAAgB,KAAA;AAAA,IACvC,IAAA,EAAM,SAAA;AAAA,IACN,OAAA,EAAS,SAAS,OAAA,IAAW,OAAA;AAAA,IAC7B,WAAA,EAAa,QAAA,CAAS,WAAA,IAAe,CAAA,EAAG,SAAS,CAAA,MAAA,CAAA;AAAA,IACjD;AAAA,GACF;AAUA,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA;AACzC,EAAA,IAAI,KAAA,YAAiB,KAAA,GAAQ,KAAA;AAC7B,EAAA,IAAI,QAAA,CAAS,KAAA,EAAO,SAAA,CAAU,KAAA,GAAQ,QAAA,CAAS,KAAA;AAC/C,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,SAAA,CAAU,UAAA,GAAa,QAAA,CAAS,UAAA;AACzD,EAAA,IAAI,QAAA,CAAS,OAAA,EAAS,SAAA,CAAU,OAAA,GAAU,QAAA,CAAS,OAAA;AACnD,EAAA,IAAI,QAAA,CAAS,EAAA,EAAI,SAAA,CAAU,EAAA,GAAK,QAAA,CAAS,EAAA;AACzC,EAAA,IAAI,QAAA,CAAS,MAAA,EAAQ,SAAA,CAAU,MAAA,GAAS,QAAA,CAAS,MAAA;AACjD,EAAA,IAAI,QAAA,CAAS,QAAA,EAAU,MAAA,EAAQ,SAAA,CAAU,WAAW,QAAA,CAAS,QAAA;AAC7D,EAAA,IAAI,QAAA,CAAS,YAAA,EAAc,MAAA,EAAQ,SAAA,CAAU,eAAe,QAAA,CAAS,YAAA;AACrE,EAAA,IAAI,QAAA,CAAS,UAAU,MAAA,EAAQ;AAC7B,IAAA,SAAA,CAAU,QAAA,GAAW,mBAAA;AAAA,MACnB,QAAA,CAAS,QAAA;AAAA,MACT,MAAA;AAAA,MACA,OAAA;AAAA,MACA,aAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,IAAA,EAAM,MAAA,EAAQ,SAAA,CAAU,OAAO,QAAA,CAAS,IAAA;AACrD,EAAA,IAAI,QAAA,CAAS,QAAA,EAAU,SAAA,CAAU,QAAA,GAAW,QAAA,CAAS,QAAA;AAErD,EAAA,UAAA,CAAW,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA,EAAGA,SAAA,CAAc,SAAS,CAAA,EAAG,aAAA,EAAe,EAAC,EAAG,OAAO,CAAA;AAG5F,EAAA,MAAM,YAAA,GAAe,iBAAA;AAAA,IACnB,IAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,UAAA,CAAW,IAAA,CAAK,SAAS,SAAS,CAAA,EAAG,cAAc,aAAA,EAAe,IAAI,OAAO,CAAA;AAK7E,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,IAAA,EAAM,SAAA;AAAA,IACN,WAAA,EAAa,QAAA,CAAS,WAAA,IAAe,CAAA,EAAG,SAAS,CAAA,MAAA;AAAA,GACnD;AACA,EAAA,IAAI,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,MAAA,EAAQ,WAAA,CAAY,QAAQ,QAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA;AACzF,EAAA,MAAM,WAAW,KAAA,EAAO,SAAA;AACxB,EAAA,IAAI,QAAA,cAAsB,KAAA,GAAQ,QAAA;AAClC,EAAA,UAAA;AAAA,IACE,IAAA,CAAK,cAAA,EAAgB,CAAA,EAAG,SAAS,CAAA,GAAA,CAAK,CAAA;AAAA,IACtC,CAAA;AAAA,EAAQA,SAAA,CAAc,WAAW,CAAA,CAAE,IAAA,EAAM;AAAA;;AAAA,EAAY,YAAY,CAAA,CAAA;AAAA,IACjE,aAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,aAAA,EAAe,OAAO,CAAC,CAAA;AAC7C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,EAAS;AACtC;AAKA,IAAM,OAAY,MAAM;AAAC,CAAA;AAalB,SAAS,sBAAA,CACd,KAAA,EACA,aAAA,EACA,GAAA,GAAW,IAAA,EACQ;AACnB,EAAA,MAAM,QAAA,GAAW,gBAAgB,aAAa,CAAA;AAC9C,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,OAAO;AAAA,MACL,SAAS,EAAC;AAAA,MACV,SAAS,EAAC;AAAA,MACV,QAAA,EAAU,CAAC,CAAA,2BAAA,EAA8B,aAAa,CAAA,CAAA,CAAG;AAAA,KAC3D;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,SAAS,KAAK,CAAA;AAC7B,EAAA,KAAA,MAAW,KAAK,MAAA,CAAO,OAAA,EAAS,GAAA,CAAI,CAAA,kBAAA,EAAqB,CAAC,CAAA,CAAE,CAAA;AAC5D,EAAA,KAAA,MAAW,KAAK,MAAA,CAAO,QAAA,EAAU,GAAA,CAAI,CAAA,QAAA,EAAW,CAAC,CAAA,CAAE,CAAA;AACnD,EAAA,OAAO,MAAA;AACT;AAUO,IAAM,eAAA,GAAiD;AAAA,EAC5D,aAAA,EAAe,kBAAA;AAAA,EACf,GAAA,EAAK,WAAA;AAAA,EACL,KAAA,EAAO;AACT;AASO,SAAS,4BAA4B,aAAA,EAAgC;AAC1E,EAAA,OAAO,aAAA,IAAiB,eAAA;AAC1B;AAQO,SAAS,gBAAA,CACd,aAAA,EACA,cAAA,EACA,SAAA,EACU;AACV,EAAA,QAAQ,aAAA;AAAe,IACrB,KAAK,aAAA;AACH,MAAA,OAAO,CAAC,IAAA,CAAK,cAAA,EAAgB,CAAA,EAAG,SAAS,KAAK,CAAC,CAAA;AAAA,IACjD,KAAK,OAAA;AACH,MAAA,OAAO;AAAA,QACL,IAAA,CAAK,cAAA,EAAgB,CAAA,EAAG,SAAS,CAAA,KAAA,CAAO,CAAA;AAAA,QACxC,KAAK,OAAA,CAAQ,cAAc,GAAG,kBAAA,EAAoB,CAAA,EAAG,SAAS,CAAA,GAAA,CAAK;AAAA,OACrE;AAAA,IACF,KAAK,KAAA;AACH,MAAA,OAAO;AAAA,QACL,IAAA,CAAK,cAAA,EAAgB,SAAA,EAAW,YAAY,CAAA;AAAA,QAC5C,IAAA,CAAK,cAAA,EAAgB,SAAA,EAAW,SAAS,CAAA;AAAA,QACzC,IAAA,CAAK,cAAA,EAAgB,CAAA,EAAG,SAAS,CAAA,GAAA,CAAK;AAAA,OACxC;AAAA,IACF;AACE,MAAA,OAAO,EAAC;AAAA;AAEd","file":"chunk-COAFAYBS.js","sourcesContent":["/**\n * Framework-specific renderers for GitAgent packages.\n *\n * Each renderer transforms a parsed GitAgent package (agent.yaml + SOUL.md + RULES.md)\n * into the native file format that the target agent framework natively reads.\n *\n * Only harnesses with a full bridge harness (runtime execution) are included:\n *   claude-code → .claude/agents/<name>.md     (YAML frontmatter + markdown body)\n *   omp         → .omp/agents/<name>/          (directory with agent.yaml + SOUL.md)\n *   codex       → .codex/agents/<name>.toml    (TOML)\n *\n * Removed (no bridge harness): cursor, roo, github-copilot, gemini, amp.\n * Add them back when a bridge harness is implemented.\n */\n\nimport {\n  chmodSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { basename, dirname, join, normalize, relative, resolve } from \"node:path\";\nimport { buildAgentPromptSections } from \"@skaile/workspaces/core\";\nimport {\n  ANTHROPIC_MODEL_ALIASES,\n  type AgentLifecycle,\n  type AgentManifest,\n  normalizeAnthropicModel,\n} from \"@skaile/workspaces/types/manifests\";\nimport { stringify as stringifyYaml } from \"yaml\";\nimport type { AbilityRef, ContractRef } from \"./fragments.js\";\n\n// ── Types ─────────────────────────────────��───────────────────────────────────\n\nexport type { AgentManifest };\n\n/**\n * All data an {@link AgentRenderer} needs to produce a native agent definition file.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport interface AgentRenderInput {\n  /** Parsed `agent.yaml` manifest for the GitAgent being rendered. */\n  manifest: AgentManifest;\n  /** Raw content of `SOUL.md`, or `null` if absent. */\n  soul: string | null;\n  /** Raw content of `RULES.md`, or `null` if absent. */\n  rules: string | null;\n  /** Raw content of `DUTIES.md`, or `null` if absent. */\n  duties: string | null;\n  /** Agent name used as the output filename and frontmatter `name` field. */\n  agentName: string;\n  /** Resolved absolute path to the framework's agent deploy directory (e.g. `.claude/agents/`). */\n  agentDeployDir: string;\n  /** Absolute path to the workspace root. */\n  workspaceRoot: string;\n  /** Resolved ability refs — installed skills referenced in the `## Installed Abilities` section. */\n  abilityRefs: AbilityRef[];\n  /** Resolved contract refs — installed in the skills dir, listed in the `## Contracts` section. */\n  contractRefs: ContractRef[];\n  /** Resolved framework fragment markdown blocks (agent-mode, handoff, skill-discovery, etc.). */\n  frameworkFragments: string[];\n  /** Per-project prompt extension markdown blocks loaded from `skaile.yaml` `agent.prompt-extensions`. */\n  promptExtensions: string[];\n  /** `standing` (long-running identity) or `role` (short-lived, callable). */\n  lifecycle: AgentLifecycle;\n  /** Names of the skills the agent composes (`composes[{kind: skill}]`), as installed. */\n  skills: string[];\n  /** Names of the MCP servers the agent's `mcp-server` slots are bound to. */\n  mcpServers: string[];\n  /**\n   * Absolute path of the agent's source directory (where `agent.yaml` lives). The omp renderer\n   * copies the local `composes` directories out of it.\n   */\n  srcDir?: string;\n}\n\n/**\n * Result returned by every {@link AgentRenderer}.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport interface AgentRenderResult {\n  /** Paths to files/dirs rendered, relative to `workspaceRoot`. */\n  created: string[];\n  /** The subset of `created` whose bytes differ from what was on disk before (new or edited); an identical rewrite is skipped. */\n  changed: string[];\n  /** Non-fatal warnings (e.g. experimental feature notices). */\n  warnings: string[];\n}\n\n/**\n * A function that transforms an {@link AgentRenderInput} into framework-native agent definition files.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport type AgentRenderer = (input: AgentRenderInput) => AgentRenderResult;\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\n/**\n * Unlink a symlink (dangling or not) at a path skaile is about to write. `writeFileSync` follows\n * a link, so the write would land in the file the link points at: the user's own file, outside\n * the project (p1060). The link is replaced by the rendered file instead.\n */\nfunction dropSymlink(path: string): void {\n  try {\n    if (lstatSync(path).isSymbolicLink()) unlinkSync(path);\n  } catch {\n    // nothing at the path: the write creates it\n  }\n}\n\n/**\n * Write an agent definition file. Agents are compiled artifacts — they must\n * reflect the current canonical source — but a file that already holds exactly\n * these bytes is left untouched (mtime included), so a repeat install is a no-op.\n * `created` lists every rendered path; `changed` only those that were (re)written.\n */\nfunction writeAgent(\n  filePath: string,\n  content: string,\n  workspaceRoot: string,\n  created: string[],\n  changed: string[],\n): void {\n  const rel = relative(workspaceRoot, filePath);\n  created.push(rel);\n  dropSymlink(filePath);\n  if (existsSync(filePath)) {\n    try {\n      if (readFileSync(filePath, \"utf-8\") === content) return;\n    } catch {\n      // unreadable (e.g. a directory in the way): fall through to the write\n    }\n  }\n  mkdirSync(dirname(filePath), { recursive: true });\n  writeFileSync(filePath, content, \"utf-8\");\n  changed.push(rel);\n}\n\n/**\n * Build the full agent system prompt body baked into the framework-native agent file.\n *\n * This is the sole source of the agent's system prompt body. Agent identity is rendered at install time; the harness reads it natively at runtime.\n * The rendered output ends up in .claude/agents/<name>.md, .omp/agents/<name>/SOUL.md,\n * .codex/agents/<name>.toml and is read natively by the framework on every agent invocation.\n *\n * Section order is owned by the shared builder (`buildAgentPromptSections` in\n * core, the same one the runner assembles its system prompt with):\n * soul → `<MEMORY>` → framework fragments → `## Constraints` (RULES) →\n * `## Duties` → `## Installed Abilities` → `## Contracts` → composed inline\n * blocks → prompt extensions.\n */\nfunction buildMarkdownBody(\n  soul: string | null,\n  rules: string | null,\n  duties: string | null,\n  abilityRefs: AbilityRef[],\n  contractRefs: ContractRef[],\n  frameworkFragments: string[],\n  promptExtensions: string[],\n): string {\n  const sections = buildAgentPromptSections({\n    soul,\n    constraints: rules,\n    duties,\n    abilities: abilityRefs,\n    contracts: contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  });\n  return `${sections.map((s) => s.text).join(\"\\n\\n\")}\\n`;\n}\n\n/** Escape a string for use as a TOML multi-line basic string (triple-quote). */\nfunction toTomlMultilineString(s: string): string {\n  // Replace \"\"\" with \\\\\"\"\" to avoid breaking the TOML literal\n  return s.replace(/\"\"\"/g, '\\\\\"\\\\\"\\\\\"');\n}\n\n/**\n * The manifest's `model` as a harness other than Claude Code can take it: the Claude Code\n * aliases (`inherit`, `opus`, `sonnet`, `haiku`) name no model of another harness' provider, so a\n * `preferred` that is one of them is dropped (the harness starts the agent on its own default) and\n * so is a `fallback` entry that is. Any other selector (`provider/model`, a full id, `@role`) is\n * the author's choice and is passed through. `undefined` when nothing is left.\n */\nfunction harnessModel(model: AgentManifest[\"model\"]): AgentManifest[\"model\"] | undefined {\n  if (!model) return undefined;\n  const claudeOnly = (m: string): boolean =>\n    (ANTHROPIC_MODEL_ALIASES as readonly string[]).includes(m);\n  const { preferred, fallback, ...rest } = model;\n  const kept: NonNullable<AgentManifest[\"model\"]> = { ...rest };\n  if (preferred && !claudeOnly(preferred)) kept.preferred = preferred;\n  const fallbacks = (fallback ?? []).filter((m) => !claudeOnly(m));\n  if (fallbacks.length > 0) kept.fallback = fallbacks;\n  return Object.keys(kept).length > 0 ? kept : undefined;\n}\n\n/** Directory entries that are never part of an asset (build and OS leftovers). */\nconst COPY_SKIP = new Set([\".git\", \".DS_Store\", \"node_modules\", \"__pycache__\"]);\n\n/** Copy a file or directory tree byte for byte; a file that already holds these bytes is left alone. */\nfunction copyTree(from: string, to: string, workspaceRoot: string, changed: string[]): void {\n  const stat = lstatSync(from);\n  if (stat.isSymbolicLink()) return;\n  if (stat.isDirectory()) {\n    for (const name of readdirSync(from)) {\n      if (COPY_SKIP.has(name) || name.endsWith(\".pyc\")) continue;\n      copyTree(join(from, name), join(to, name), workspaceRoot, changed);\n    }\n    return;\n  }\n  if (!stat.isFile()) return;\n  const bytes = readFileSync(from);\n  dropSymlink(to);\n  // A script keeps its exec bit: a copy that loses it shows as a mode change in `git status` (p1657).\n  const executable = (stat.mode & 0o111) !== 0;\n  if (existsSync(to)) {\n    try {\n      if (bytes.equals(readFileSync(to))) {\n        if (executable && (lstatSync(to).mode & 0o100) === 0) chmodSync(to, stat.mode & 0o777);\n        return;\n      }\n    } catch {\n      // unreadable (e.g. a directory in the way): fall through to the write\n    }\n  }\n  mkdirSync(dirname(to), { recursive: true });\n  writeFileSync(to, bytes);\n  if (executable) chmodSync(to, stat.mode & 0o777);\n  changed.push(relative(workspaceRoot, to));\n}\n\n/**\n * Make the `composes` of an omp `agent.yaml` resolvable from where it is written: every local ref\n * (`./rules-local/house-rules`) is copied next to the `agent.yaml`, at the path the ref names, and a\n * local ref that climbs out of the agent directory (`../shared/rules`) is copied to\n * `composes/<name>` and rewritten to that path. Catalog refs (`skill:@pub/name`) are kept as written.\n */\nfunction bundleLocalComposes(\n  composes: NonNullable<AgentManifest[\"composes\"]>,\n  srcDir: string | undefined,\n  destDir: string,\n  workspaceRoot: string,\n  changed: string[],\n  warnings: string[],\n): NonNullable<AgentManifest[\"composes\"]> {\n  if (!srcDir) return composes;\n  return composes.map((item) => {\n    if (!item.ref.startsWith(\"./\") && !item.ref.startsWith(\"../\")) return item;\n    const from = resolve(srcDir, item.ref);\n    if (!existsSync(from)) {\n      warnings.push(`compose ref ${item.ref} not found at ${from}: not copied into ${destDir}`);\n      return item;\n    }\n    const rel = normalize(item.ref);\n    const inside = !rel.startsWith(\"..\");\n    const target = inside ? rel : join(\"composes\", basename(from));\n    copyTree(from, join(destDir, target), workspaceRoot, changed);\n    return inside ? item : { ...item, ref: `./${target}` };\n  });\n}\n\n// ── Claude Code ────────────��──────────────────────────────────────────────────\n// Format: .claude/agents/<name>.md\n// Sub-agent support: automatic (description-based) + @-mention\n// Required frontmatter: name, description\n//\n// Installation → runtime handoff:\n//   skaile install (claudeCodeRenderer) creates the .md file from GitAgent source\n//   ClaudeSdkHarness.startQuery() passes options.agent = agentName to the SDK query\n//   The SDK reads .claude/agents/<agentName>.md to get model, tools, and system prompt\n//   This is equivalent to running: claude --agent <agentName>\n\n/**\n * Render a GitAgent to Claude Code's `.claude/agents/<name>.md` format.\n *\n * Writes YAML frontmatter (name, description, model, tools, skills, mcpServers,\n * maxTurns, background) followed by the enriched system prompt body. `skills`\n * lists the composed skills, `mcpServers` the MCP servers the agent's\n * `mcp-server` slots are bound to, and `background: true` marks a `role`\n * instance whose `runtime.background` is set. Always overwrites to reflect\n * current source.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport const claudeCodeRenderer: AgentRenderer = ({\n  manifest,\n  soul,\n  rules,\n  duties,\n  agentName,\n  agentDeployDir,\n  workspaceRoot,\n  abilityRefs,\n  contractRefs,\n  frameworkFragments,\n  promptExtensions,\n  lifecycle,\n  skills,\n  mcpServers,\n}) => {\n  const created: string[] = [];\n  const changed: string[] = [];\n  const warnings: string[] = [];\n\n  const frontmatter: Record<string, unknown> = {\n    name: agentName,\n    description: manifest.description ?? `${agentName} agent`,\n  };\n\n  // Model: map to Claude Code's model field. Accepts aliases (sonnet/opus/haiku/inherit)\n  // or a full Anthropic ID. Unrecognized values (e.g. legacy `claude-opus-4`) are\n  // coerced to the matching family alias so the agent still loads.\n  if (manifest.model?.preferred) {\n    const raw = manifest.model.preferred;\n    const normalized = normalizeAnthropicModel(raw);\n    if (normalized !== raw) {\n      warnings.push(\n        `agent ${agentName}: model \"${raw}\" is not a valid Claude model ID; normalized to alias \"${normalized}\". Update agent.yaml.`,\n      );\n    }\n    frontmatter.model = normalized;\n  }\n\n  // Tool restrictions\n  if (manifest.tools?.allowed?.length) {\n    frontmatter.tools = manifest.tools.allowed.join(\", \");\n  }\n  if (manifest.tools?.denied?.length) {\n    frontmatter.disallowedTools = manifest.tools.denied.join(\", \");\n  }\n\n  if (skills.length > 0) frontmatter.skills = skills;\n  if (mcpServers.length > 0) frontmatter.mcpServers = mcpServers;\n\n  // Runtime\n  if (manifest.runtime?.max_turns) {\n    frontmatter.maxTurns = manifest.runtime.max_turns;\n  }\n  if (lifecycle === \"role\" && manifest.runtime?.background === true) {\n    frontmatter.background = true;\n  }\n\n  // Metadata pass-through for Claude Code-specific fields\n  if (manifest.metadata?.color) frontmatter.color = manifest.metadata.color;\n  if (manifest.metadata?.effort) frontmatter.effort = manifest.metadata.effort;\n  if (manifest.metadata?.isolation) frontmatter.isolation = manifest.metadata.isolation;\n\n  const body = buildMarkdownBody(\n    soul,\n    rules,\n    duties,\n    abilityRefs,\n    contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  );\n  const content = `---\\n${stringifyYaml(frontmatter).trim()}\\n---\\n\\n${body}`;\n  const filePath = join(agentDeployDir, `${agentName}.md`);\n  writeAgent(filePath, content, workspaceRoot, created, changed);\n\n  return { created, changed, warnings };\n};\n\n// ── OpenAI Codex ──────────────────────────────────────────────────────────────\n// Format: .codex/agents/<name>.toml\n// Sub-agent support: explicit user request only (not automatic)\n// Required fields: name, description, developer_instructions\n\n/**\n * Tools that change the workspace or run commands. Codex has no per-agent tool\n * allowlist; the closest per-agent control is `sandbox_mode`, so an agent whose\n * declared tool surface contains none of these is rendered `read-only`.\n */\nconst MUTATING_TOOLS = [\"Write\", \"Edit\", \"MultiEdit\", \"NotebookEdit\", \"Bash\"] as const;\n\n/** `read-only` when the manifest's tool surface cannot mutate anything, else `undefined` (inherit). */\nfunction codexSandboxMode(tools: AgentManifest[\"tools\"]): \"read-only\" | undefined {\n  const allowed = tools?.allowed ?? [];\n  const denied = new Set(tools?.denied ?? []);\n  if (allowed.length > 0) {\n    return allowed.some((t) => !denied.has(t) && (MUTATING_TOOLS as readonly string[]).includes(t))\n      ? undefined\n      : \"read-only\";\n  }\n  // No allowlist: everything not denied is available.\n  return MUTATING_TOOLS.every((t) => denied.has(t)) ? \"read-only\" : undefined;\n}\n\n/** Directory (next to `agents/`) holding each Codex agent's markdown identity, one file per agent. */\nexport const CODEX_IDENTITY_DIR = \"skaile-agents\";\n\n/**\n * Render a GitAgent to OpenAI Codex's `.codex/agents/<name>.toml` format.\n *\n * Produces a TOML file with `name`, `description`, `model`, `sandbox_mode` and\n * `developer_instructions`. `sandbox_mode = \"read-only\"` is the per-agent tool\n * restriction: it is emitted when the manifest's `tools` leave the agent no way\n * to write or run commands (Codex has no per-tool allowlist). Triple-quoted\n * TOML multi-line strings are escaped to avoid syntax errors.\n *\n * Also writes the agent's identity as `.codex/skaile-agents/<name>.md`, which\n * the Codex harness combines with the session's runtime prompt (one file per\n * agent, so several instances never overwrite each other).\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport const codexRenderer: AgentRenderer = ({\n  manifest,\n  soul,\n  rules,\n  duties,\n  agentName,\n  agentDeployDir,\n  workspaceRoot,\n  abilityRefs,\n  contractRefs,\n  frameworkFragments,\n  promptExtensions,\n}) => {\n  const created: string[] = [];\n  const changed: string[] = [];\n  const warnings: string[] = [];\n\n  const instructions = buildMarkdownBody(\n    soul,\n    rules,\n    duties,\n    abilityRefs,\n    contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  );\n  const escaped = toTomlMultilineString(instructions);\n\n  const lines: string[] = [\n    `name = ${JSON.stringify(agentName)}`,\n    `description = ${JSON.stringify(manifest.description ?? `${agentName} agent`)}`,\n  ];\n  // A Claude Code alias (`sonnet`) names no Codex model: leave `model` out and Codex uses its own.\n  const model = harnessModel(manifest.model)?.preferred;\n  if (model) lines.push(`model = ${JSON.stringify(model)}`);\n  const sandboxMode = codexSandboxMode(manifest.tools);\n  if (sandboxMode) lines.push(`sandbox_mode = ${JSON.stringify(sandboxMode)}`);\n  lines.push(`developer_instructions = \"\"\"`, escaped.trim(), `\"\"\"`);\n\n  const content = `${lines.join(\"\\n\")}\\n`;\n  const filePath = join(agentDeployDir, `${agentName}.toml`);\n  writeAgent(filePath, content, workspaceRoot, created, changed);\n\n  // Write the full agent identity as markdown for the Codex harness to read at runtime.\n  // The harness combines this with the session's dynamic content (resources, context)\n  // and passes the result via model_instructions_file.\n  const agentMdPath = join(dirname(agentDeployDir), CODEX_IDENTITY_DIR, `${agentName}.md`);\n  writeAgent(agentMdPath, instructions, workspaceRoot, created, changed);\n\n  return { created, changed, warnings };\n};\n\n// ── oh-my-pi ─��────────────��────────────────────────────────��─────────────────\n// Format: .omp/agents/<name>/ (directory with agent.yaml + SOUL.md + RULES.md)\n// oh-my-pi reads GitAgent directories natively via PI_CODING_AGENT_DIR.\n// The renderer copies/enriches the source directory rather than flattening to .md.\n//\n// Installation → runtime handoff:\n//   skaile install (ompRenderer) creates .omp/agents/<name>/ from GitAgent source\n//   OmpHarness._start() sets env.PI_CODING_AGENT_DIR = agentDir in the child process\n//   omp reads SOUL.md/RULES.md/knowledge/ from that directory natively on startup\n//\n// Note: REPL mode can bypass the install step — agentDir can point directly to the\n// GitAgent source directory, and omp will read it natively via PI_CODING_AGENT_DIR.\n// The rendered .omp/agents/ copy is only needed when the source is not accessible\n// from the project cwd (e.g. different repo, remote workspace).\n\n/**\n * Render a GitAgent to oh-my-pi's `.omp/agents/<name>/` directory format.\n *\n * Writes `agent.yaml` (resolved model/tools/delegation plus the 0.2\n * declaration — `composes` verbatim, `lifecycle`, `io`, `memory`, `triggers`,\n * `capabilities`) and an enriched `SOUL.md` that includes fragments and\n * extensions. omp reads this directory natively via the `PI_CODING_AGENT_DIR`\n * environment variable.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport const ompRenderer: AgentRenderer = ({\n  manifest,\n  soul,\n  rules,\n  duties,\n  agentName,\n  agentDeployDir,\n  workspaceRoot,\n  abilityRefs,\n  contractRefs,\n  frameworkFragments,\n  promptExtensions,\n  lifecycle,\n  srcDir,\n}) => {\n  const created: string[] = [];\n  const changed: string[] = [];\n  const warnings: string[] = [];\n\n  const destDir = join(agentDeployDir, agentName);\n\n  // Write agent.yaml with tools resolved\n  const agentYaml: Record<string, unknown> = {\n    spec_version: manifest.spec_version ?? \"0.2\",\n    name: agentName,\n    version: manifest.version ?? \"1.0.0\",\n    description: manifest.description ?? `${agentName} agent`,\n    lifecycle,\n  };\n  // The model: omp takes provider-prefixed full IDs and `@role` selectors, and resolves the\n  // family aliases it knows (verified live 2026-09-20 against omp v18.1.10 through\n  // teamclaude.postxl.com: `--model anthropic/opus` produced\n  // `model_change {\"model\":\"anthropic/claude-opus-5\",\"resolvedModelIsFallback\":false}`).\n  // The Claude Code aliases the manifest writes (`sonnet`, `haiku`, `opus`, `inherit`) name no\n  // model of an omp deployment on another provider, so they are left out and omp starts the agent\n  // on its own default. Any other selector is passed through verbatim: it is not checked here, and\n  // not coerced by `normalizeAnthropicModel`, which would substitute a different model on any\n  // provider but Anthropic (see `resolveManifestModel` in `@skaile/workspaces/bridge`).\n  const model = harnessModel(manifest.model);\n  if (model) agentYaml.model = model;\n  if (manifest.tools) agentYaml.tools = manifest.tools;\n  if (manifest.delegation) agentYaml.delegation = manifest.delegation;\n  if (manifest.runtime) agentYaml.runtime = manifest.runtime;\n  if (manifest.io) agentYaml.io = manifest.io;\n  if (manifest.memory) agentYaml.memory = manifest.memory;\n  if (manifest.triggers?.length) agentYaml.triggers = manifest.triggers;\n  if (manifest.capabilities?.length) agentYaml.capabilities = manifest.capabilities;\n  if (manifest.composes?.length) {\n    agentYaml.composes = bundleLocalComposes(\n      manifest.composes,\n      srcDir,\n      destDir,\n      workspaceRoot,\n      changed,\n      warnings,\n    );\n  }\n  if (manifest.tags?.length) agentYaml.tags = manifest.tags;\n  if (manifest.metadata) agentYaml.metadata = manifest.metadata;\n\n  writeAgent(join(destDir, \"agent.yaml\"), stringifyYaml(agentYaml), workspaceRoot, [], changed);\n\n  // Write SOUL.md (enriched with fragments and extensions, like other renderers)\n  const enrichedSoul = buildMarkdownBody(\n    soul,\n    rules,\n    duties,\n    abilityRefs,\n    contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  );\n  writeAgent(join(destDir, \"SOUL.md\"), enrichedSoul, workspaceRoot, [], changed);\n\n  // omp lists the agents it can spawn from flat `.omp/agents/<name>.md` files only (verified live\n  // against omp 18.12.5: a `<name>/agent.yaml` directory is not listed, a flat file is), so the\n  // directory above carries the full GitAgent package and this file is what omp loads.\n  const frontmatter: Record<string, unknown> = {\n    name: agentName,\n    description: manifest.description ?? `${agentName} agent`,\n  };\n  if (manifest.tools?.allowed?.length) frontmatter.tools = manifest.tools.allowed.join(\", \");\n  const selector = model?.preferred;\n  if (selector) frontmatter.model = selector;\n  writeAgent(\n    join(agentDeployDir, `${agentName}.md`),\n    `---\\n${stringifyYaml(frontmatter).trim()}\\n---\\n\\n${enrichedSoul}`,\n    workspaceRoot,\n    created,\n    changed,\n  );\n\n  created.push(relative(workspaceRoot, destDir));\n  return { created, changed, warnings };\n};\n\n// ── Renderer registry ──────────────────────────────���──────────────────────────\n\nexport type Log = (msg: string) => void;\nconst noop: Log = () => {};\n\n/**\n * Render an agent to framework-native format via the renderer registry.\n *\n * Shared by both the simple deploy path (`deployAsset`) and the enriched scaffold path (agents layer).\n *\n * @param input - Full render input including manifest, SOUL/RULES text, and resolved refs.\n * @param harnessTarget - Agent framework ID to look up in {@link AGENT_RENDERERS}.\n * @param log - Optional logger callback for progress messages.\n * @returns Object with `created` file paths and `warnings` list.\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport function renderAgentToFramework(\n  input: AgentRenderInput,\n  harnessTarget: string,\n  log: Log = noop,\n): AgentRenderResult {\n  const renderer = AGENT_RENDERERS[harnessTarget];\n  if (!renderer) {\n    return {\n      created: [],\n      changed: [],\n      warnings: [`No renderer for framework \"${harnessTarget}\"`],\n    };\n  }\n  const result = renderer(input);\n  for (const c of result.created) log(`  rendered agent: ${c}`);\n  for (const w of result.warnings) log(`  warn: ${w}`);\n  return result;\n}\n\n/**\n * Registry mapping framework IDs to their {@link AgentRenderer} functions.\n *\n * Only harnesses with a full bridge harness are registered. Add new entries\n * when a bridge harness is implemented in `workspaces/bridge/src/harnesses/`.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport const AGENT_RENDERERS: Record<string, AgentRenderer> = {\n  \"claude-code\": claudeCodeRenderer,\n  omp: ompRenderer,\n  codex: codexRenderer,\n};\n\n/**\n * Returns `true` if the given harness target supports file-based sub-agent installation.\n *\n * @param harnessTarget - Agent framework ID to check.\n * @returns `true` when `harnessTarget` has a registered entry in {@link AGENT_RENDERERS}.\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport function harnessTargetSupportsAgents(harnessTarget: string): boolean {\n  return harnessTarget in AGENT_RENDERERS;\n}\n\n/**\n * The files the renderer of `harnessTarget` writes for the agent `agentName` into the agent deploy\n * directory `agentDeployDir` (`.claude/agents`, `.codex/agents`, `.omp/agents`): what `add\n * --dry-run` lists (p1621). Files a `composes:` of local refs adds to omp are not listed. Empty\n * for a harness target without an agent renderer.\n */\nexport function agentRenderFiles(\n  harnessTarget: string,\n  agentDeployDir: string,\n  agentName: string,\n): string[] {\n  switch (harnessTarget) {\n    case \"claude-code\":\n      return [join(agentDeployDir, `${agentName}.md`)];\n    case \"codex\":\n      return [\n        join(agentDeployDir, `${agentName}.toml`),\n        join(dirname(agentDeployDir), CODEX_IDENTITY_DIR, `${agentName}.md`),\n      ];\n    case \"omp\":\n      return [\n        join(agentDeployDir, agentName, \"agent.yaml\"),\n        join(agentDeployDir, agentName, \"SOUL.md\"),\n        join(agentDeployDir, `${agentName}.md`),\n      ];\n    default:\n      return [];\n  }\n}\n"]}

package/dist/{chunk-YLLVSR2U.js → chunk-E5NQRHEB.js}

@@ -1,7 +1,8 @@
-import { compositeSha256 } from './chunk-ZBHZLWV3.js';
-import { parseAssetRef } from './chunk-LSSYC5IC.js';
+import { compositeSha256 } from './chunk-KPKGWXUJ.js';
+import { parseAssetRef } from './chunk-IZQOO6MN.js';
 import { createHash } from 'crypto';
-import { rm, mkdir, writeFile } from 'fs/promises';
+import { openSync, fstatSync, readSync, chmodSync, closeSync } from 'fs';
+import { rm, mkdir, writeFile, chmod } from 'fs/promises';
 import { isAbsolute, resolve, sep, join, dirname } from 'path';
 
 function assertSafeManifestPath(installPath, p) {
@@ -33,9 +34,29 @@ function longestCommonDirPrefix(paths) {
   }
   return common.join("/");
 }
+function isScriptBytes(bytes) {
+  return bytes.length >= 2 && bytes[0] === 35 && bytes[1] === 33;
+}
+var EXECUTABLE_MODE = 493;
+function restoreScriptModes(root, relPaths) {
+  for (const rel of relPaths) {
+    let fd;
+    try {
+      fd = openSync(join(root, rel), "r");
+      if ((fstatSync(fd).mode & 73) !== 0) continue;
+      const head = Buffer.alloc(2);
+      if (readSync(fd, head, 0, 2, 0) === 2 && isScriptBytes(head)) {
+        chmodSync(join(root, rel), EXECUTABLE_MODE);
+      }
+    } catch {
+    } finally {
+      if (fd !== void 0) closeSync(fd);
+    }
+  }
+}
 async function installFromManifest(opts) {
   const { manifest, libraryRoot } = opts;
-  const fetcher = opts.fetcher ?? (await import('./source-fetch-github-ST4MFL3D.js')).fetchAssetFilesFromGitHub;
+  const fetcher = opts.fetcher ?? (await import('./source-fetch-github-RWHV4I5Z.js')).fetchAssetFilesFromGitHub;
   if (opts.targetDir !== void 0) {
     return installFlat(manifest, opts.targetDir, fetcher);
   }
@@ -86,6 +107,7 @@ async function installFromManifest(opts) {
       const target = join(installPath, f.path);
       await mkdir(dirname(target), { recursive: true });
       await writeFile(target, bytes[f.path]);
+      if (isScriptBytes(bytes[f.path])) await chmod(target, EXECUTABLE_MODE);
     }
   } catch (e) {
     await rm(installPath, { recursive: true, force: true }).catch(() => {
@@ -118,10 +140,11 @@ async function installFlat(manifest, targetDir, fetcher) {
     const dest = join(target, relPath);
     await mkdir(dirname(dest), { recursive: true });
     await writeFile(dest, buf);
+    if (isScriptBytes(buf)) await chmod(dest, EXECUTABLE_MODE);
   }
   return { installPath: target };
 }
 
-export { assertSafeManifestPath, installFromManifest, longestCommonDirPrefix };
-//# sourceMappingURL=chunk-YLLVSR2U.js.map
-//# sourceMappingURL=chunk-YLLVSR2U.js.map
+export { assertSafeManifestPath, installFromManifest, isScriptBytes, longestCommonDirPrefix, restoreScriptModes };
+//# sourceMappingURL=chunk-E5NQRHEB.js.map
+//# sourceMappingURL=chunk-E5NQRHEB.js.map

package/dist/chunk-E5NQRHEB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;;;AAiDO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAOO,SAAS,cAAc,KAAA,EAA4B;AACxD,EAAA,OAAO,KAAA,CAAM,UAAU,CAAA,IAAK,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA,IAAQ,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA;AAChE;AAGA,IAAM,eAAA,GAAkB,GAAA;AAQjB,SAAS,kBAAA,CAAmB,MAAc,QAAA,EAAmC;AAClF,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,IAAI,EAAA;AACJ,IAAA,IAAI;AACF,MAAA,EAAA,GAAK,QAAA,CAAS,IAAA,CAAK,IAAA,EAAM,GAAG,GAAG,GAAG,CAAA;AAClC,MAAA,IAAA,CAAK,SAAA,CAAU,EAAE,CAAA,CAAE,IAAA,GAAO,QAAW,CAAA,EAAG;AACxC,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC3B,MAAA,IAAI,QAAA,CAAS,EAAA,EAAI,IAAA,EAAM,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,IAAK,aAAA,CAAc,IAAI,CAAA,EAAG;AAC5D,QAAA,SAAA,CAAU,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA,EAAG,eAAe,CAAA;AAAA,MAC5C;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER,CAAA,SAAE;AACA,MAAA,IAAI,EAAA,KAAO,MAAA,EAAW,SAAA,CAAU,EAAE,CAAA;AAAA,IACpC;AAAA,EACF;AACF;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,QAAA,CAAS,KAAK,CAAA;AACtD,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AACtC,MAAA,IAAI,aAAA,CAAc,MAAM,CAAA,CAAE,IAAI,CAAE,CAAA,EAAG,MAAM,KAAA,CAAM,MAAA,EAAQ,eAAe,CAAA;AAAA,IACxE;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AACzB,IAAA,IAAI,cAAc,GAAG,CAAA,EAAG,MAAM,KAAA,CAAM,MAAM,eAAe,CAAA;AAAA,EAC3D;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-E5NQRHEB.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { chmodSync, closeSync, fstatSync, openSync, readSync } from \"node:fs\";\nimport { chmod, mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\nimport { compositeSha256 } from \"../../../core/src/publish-manifest.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Whether `bytes` start a script (`#!`). A pointer manifest and GitHub's raw host carry no file\n * modes, while the library or clone the same asset comes from keeps its script executable, so a\n * shebang is what marks a file executable here (p1657).\n */\nexport function isScriptBytes(bytes: Uint8Array): boolean {\n  return bytes.length >= 2 && bytes[0] === 0x23 && bytes[1] === 0x21;\n}\n\n/** The mode of an executable file written from store bytes. */\nconst EXECUTABLE_MODE = 0o755;\n\n/**\n * Make every file of `relPaths` under `root` that starts with `#!` executable. For bytes an\n * earlier install already wrote (a project store cache from before exec bits were kept), so a\n * restore from them deploys the same modes as a fresh fetch. A missing or unreadable file is\n * skipped.\n */\nexport function restoreScriptModes(root: string, relPaths: readonly string[]): void {\n  for (const rel of relPaths) {\n    let fd: number | undefined;\n    try {\n      fd = openSync(join(root, rel), \"r\");\n      if ((fstatSync(fd).mode & 0o111) !== 0) continue;\n      const head = Buffer.alloc(2);\n      if (readSync(fd, head, 0, 2, 0) === 2 && isScriptBytes(head)) {\n        chmodSync(join(root, rel), EXECUTABLE_MODE);\n      }\n    } catch {\n      // Not readable or not a file: nothing to fix.\n    } finally {\n      if (fd !== undefined) closeSync(fd);\n    }\n  }\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const actualComposite = compositeSha256(manifest.files);\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n      if (isScriptBytes(bytes[f.path]!)) await chmod(target, EXECUTABLE_MODE);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n    if (isScriptBytes(buf)) await chmod(dest, EXECUTABLE_MODE);\n  }\n\n  return { installPath: target };\n}\n"]}

package/dist/{chunk-BFMYYNDT.js → chunk-F3D25RGM.js}

@@ -35,12 +35,14 @@ async function fetchAssetFilesFromGitHub(opts) {
   } catch (e) {
     if (e.status === 401) {
       try {
-        return await fetchFromRawHost({
+        const files = await fetchFromRawHost({
           owner,
           repo,
           commitSha: opts.commitSha,
           paths: opts.paths
         });
+        warnRejectedPat(hasPat);
+        return files;
       } catch {
         throw new Error(
           `unreachable: cannot read tree at ${opts.commitSha}: ${describeGitHubError(e, hasPat)}`
@@ -83,6 +85,12 @@ async function fetchAssetFilesFromGitHub(opts) {
   }
   return result;
 }
+var warnedRejectedPat = false;
+function warnRejectedPat(hasPat) {
+  if (!hasPat || warnedRejectedPat) return;
+  warnedRejectedPat = true;
+  console.warn(`skaile: ${GITHUB_PAT_ENV} was rejected (401); continuing anonymously`);
+}
 var RAW_REQUEST_TIMEOUT_MS = 3e4;
 var RAW_CONCURRENCY = 8;
 function describeGitHubError(e, hasPat) {
@@ -140,5 +148,5 @@ async function fetchFromRawHost(args) {
 }
 
 export { GITHUB_PAT_ENV, fetchAssetFilesFromGitHub };
-//# sourceMappingURL=chunk-BFMYYNDT.js.map
-//# sourceMappingURL=chunk-BFMYYNDT.js.map
+//# sourceMappingURL=chunk-F3D25RGM.js.map
+//# sourceMappingURL=chunk-F3D25RGM.js.map

package/dist/chunk-F3D25RGM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../library/src/install/source-fetch-github.ts"],"names":[],"mappings":";;;AAmBO,IAAM,cAAA,GAAiB;AAsB9B,SAAS,UAAU,GAAA,EAA8C;AAI/D,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,0DAA0D,CAAA;AAC9E,EAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AACxD,EAAA,OAAO,EAAE,OAAO,CAAA,CAAE,CAAC,GAAI,IAAA,EAAM,CAAA,CAAE,CAAC,CAAA,EAAG;AACrC;AAYA,eAAsB,0BAA0B,IAAA,EAAkD;AAMhG,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mDAAA,EAAsD,KAAK,SAAS,CAAA,uDAAA;AAAA,KAEtE;AAAA,EACF;AACA,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,SAAA,CAAU,KAAK,GAAG,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAC,CAAA;AAKlD,EAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,MAAA,EAAQ;AAC5B,IAAA,OAAO,gBAAA,CAAiB,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,CAAA;AAAA,EACvF;AAGA,EAAA,MAAM,KAAA,GAAQ,EAAE,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAG,MAAM,MAAM;AAAA,EAAC,CAAA,EAAG,MAAM,MAAM;AAAA,EAAC,CAAA,EAAG,OAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACjF,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,IAAW,IAAI,OAAA,CAAQ,EAAE,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAAG,GAAA,EAAK,OAAO,CAAA;AAE1F,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ;AAAA,MACjC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAU,IAAA,CAAK,SAAA;AAAA,MACf,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AAIV,IAAA,IAAK,CAAA,CAA0B,WAAW,GAAA,EAAK;AAC7C,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAQ,MAAM,gBAAA,CAAiB;AAAA,UACnC,KAAA;AAAA,UACA,IAAA;AAAA,UACA,WAAW,IAAA,CAAK,SAAA;AAAA,UAChB,OAAO,IAAA,CAAK;AAAA,SACb,CAAA;AAED,QAAA,eAAA,CAAgB,MAAM,CAAA;AACtB,QAAA,OAAO,KAAA;AAAA,MACT,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,oCAAoC,IAAA,CAAK,SAAS,KAAK,mBAAA,CAAoB,CAAA,EAAG,MAAM,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oCAAoC,IAAA,CAAK,SAAS,KAAK,mBAAA,CAAoB,CAAA,EAAG,MAAM,CAAC,CAAA;AAAA,KACvF;AAAA,EACF;AAGA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM;AACjC,IAAA,IAAI,KAAK,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,IAAA,IAAQ,KAAK,GAAA,EAAK;AACjD,MAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,GAAG,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,OAAA,EAAS;AAKZ,MAAA,IAAI,IAAA,CAAK,KAAK,SAAA,EAAW;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,8DAAA,EAA4D,KAAK,SAAS,CAAA;AAAA,SAC5E;AAAA,MACF;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+BAAA,EAAkC,IAAI,CAAA,CAAE,CAAA;AAAA,IAC1D;AACA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,EAAE,KAAA,EAAO,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,CAAA;AAAA,IACvE,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,yBAAA,EAA4B,IAAI,KAAK,mBAAA,CAAoB,CAAA,EAAG,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,IACvF;AAGA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,QAAA,KAAa,QAAA,EAAU;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kBAAA,EAAqB,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAK,QAAQ,CAAA,oBAAA;AAAA,OAC3E;AAAA,IACF;AACA,IAAA,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA,CAAO,KAAK,IAAA,CAAK,IAAA,CAAK,SAAS,QAAQ,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,MAAA;AACT;AAEA,IAAI,iBAAA,GAAoB,KAAA;AAGxB,SAAS,gBAAgB,MAAA,EAAuB;AAC9C,EAAA,IAAI,CAAC,UAAU,iBAAA,EAAmB;AAClC,EAAA,iBAAA,GAAoB,IAAA;AACpB,EAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,QAAA,EAAW,cAAc,CAAA,2CAAA,CAA6C,CAAA;AACrF;AAGA,IAAM,sBAAA,GAAyB,GAAA;AAE/B,IAAM,eAAA,GAAkB,CAAA;AAMxB,SAAS,mBAAA,CAAoB,GAAY,MAAA,EAAyB;AAChE,EAAA,MAAM,GAAA,GAAM,CAAA;AAKZ,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,IAAA,OAAO,MAAA,GACH,CAAA,EAAG,cAAc,CAAA,4EAAA,CAAA,GACjB,uDAAA;AAAA,EACN;AACA,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,QAAA,EAAU,OAAA,IAAW,EAAC;AAC1C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,OAAA,CAAQ,uBAAuB,CAAC,CAAA,KAAM,GAAA;AAC/D,EAAA,IACE,GAAA,CAAI,MAAA,KAAW,GAAA,IACd,GAAA,CAAI,MAAA,KAAW,GAAA,KAAQ,SAAA,IAAa,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,CAAA,EACzE;AACA,IAAA,OAAO,gBAAA,CAAiB,OAAA,CAAQ,mBAAmB,CAAA,EAAG,MAAM,CAAA;AAAA,EAC9D;AACA,EAAA,OAAO,GAAA,CAAI,OAAA,IAAW,MAAA,CAAO,CAAC,CAAA;AAChC;AAEA,SAAS,gBAAA,CAAiB,OAAoC,MAAA,EAAyB;AACrF,EAAA,MAAM,EAAA,GAAK,OAAO,KAAK,CAAA;AACvB,EAAA,MAAM,IAAA,GACJ,MAAA,CAAO,QAAA,CAAS,EAAE,KAAK,EAAA,GAAK,CAAA,GAAI,CAAA,SAAA,EAAY,IAAI,KAAK,EAAA,GAAK,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,CAAA,GAAM,EAAA;AACrF,EAAA,OAAO,SACH,CAAA,0BAAA,EAA6B,IAAI,yBACjC,CAAA,0BAAA,EAA6B,IAAI,SAAS,cAAc,CAAA,8BAAA,CAAA;AAC9D;AAOA,eAAe,iBAAiB,IAAA,EAKI;AAClC,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,IAAA,CAAK,KAAK,CAAA;AAC5B,EAAA,MAAM,SAAS,YAA2B;AACxC,IAAA,KAAA,IAAS,IAAA,GAAO,MAAM,KAAA,EAAM,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,KAAA,CAAM,KAAA,EAAM,EAAG;AACvE,MAAA,MAAM,MACJ,CAAA,kCAAA,EAAqC,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,CAAA,CAAA,GAC9E,IAAA,CAAK,MAAM,GAAG,CAAA,CAAE,IAAI,kBAAkB,CAAA,CAAE,KAAK,GAAG,CAAA;AAClD,MAAA,IAAI,GAAA;AACJ,MAAA,IAAI;AACF,QAAA,GAAA,GAAM,MAAM,MAAM,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,sBAAsB,CAAA,EAAG,CAAA;AAAA,MAChF,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,KAAA,GAAS,CAAA,CAAoC,KAAA,EAAO,IAAA,IAAS,CAAA,CAAY,OAAA;AAC/E,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,yBAAA,EAA4B,IAAI,CAAA,iCAAA,EAAoC,KAAK,CAAA;AAAA,SAC3E;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,+BAAA,EAAkC,IAAI,CAAA,SAAA,EAAY,IAAA,CAAK,SAAS,CAAA,IAAA,EAAO,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,uBAAA,EACpE,cAAc,CAAA,CAAA;AAAA,SAC1C;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,QAAA,MAAM,QAAQ,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AACnD,QAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,KAAK,KAAK,KAAA,GAAQ,CAAA,GAAI,CAAA,WAAA,EAAc,KAAK,CAAA,GAAA,CAAA,GAAQ,EAAA;AAC9E,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,4BAAA,EAA+B,IAAI,CAAA,MAAA,EAAS,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,SAAS,cAAc,CAAA,kBAAA;AAAA,SACtF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,IAAI,CAAA,kBAAA,EAAqB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACnF;AACA,MAAA,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA,CAAO,KAAK,MAAM,GAAA,CAAI,aAAa,CAAA;AAAA,IACpD;AAAA,EACF,CAAA;AACA,EAAA,MAAM,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,KAAA,CAAM,MAAM,CAAA,EAAE,EAAG,MAAM,CAAC,CAAA;AACzF,EAAA,OAAO,MAAA;AACT","file":"chunk-F3D25RGM.js","sourcesContent":["/**\n * GitHub asset-byte fetcher for the pointer-only install path.\n *\n * Given an upstream repo URL and a pinned commit SHA, walks the recursive\n * git tree at that commit and fetches the blob bytes for each requested path.\n * The Catalog never serves asset bytes — it only hands clients the Pointer\n * Triple (`source.url` + `source.commitSha` + per-file `{path, sha256}`),\n * and `installFromManifest` verifies every byte against those hashes.\n *\n * Authentication: an optional GitHub PAT is read from the `SKAILE_GITHUB_PAT`\n * environment variable when no `octokit` instance is injected. Public repos\n * work unauthenticated (subject to GitHub's anonymous rate limit).\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { Octokit } from \"@octokit/rest\";\n\n/** GitHub PAT environment variable used when no Octokit is injected. */\nexport const GITHUB_PAT_ENV = \"SKAILE_GITHUB_PAT\";\n\n/**\n * Options for {@link fetchAssetFilesFromGitHub}.\n */\nexport interface FetchOpts {\n  /** Upstream repo URL (e.g. `https://github.com/skaile-ai/skaile-ai-assets`). */\n  url: string;\n  /** Immutable 40-char git commit SHA the asset version was pinned at. */\n  commitSha: string;\n  /** Repo-relative paths to fetch. */\n  paths: string[];\n  /** Optional Octokit instance — injectable for tests. */\n  octokit?: Octokit;\n}\n\n/**\n * Parse `{ owner, repo }` out of a GitHub repo URL.\n *\n * Accepts both HTTPS (`https://github.com/owner/repo[.git]`) and SCP-style\n * SSH (`git@github.com:owner/repo[.git]`) forms.\n */\nfunction parseRepo(url: string): { owner: string; repo: string } {\n  // Repo names may contain dots (e.g. `skaile-ai/www.skaile.ai`). Capture the\n  // full repo segment up to a path separator / end-of-string, and strip an\n  // optional trailing `.git` suffix only.\n  const m = url.match(/github\\.com[/:]([^/]+)\\/([^/]+?)(?:\\.git)?(?:[/#?].*)?$/i);\n  if (!m) throw new Error(`unsupported source URL: ${url}`);\n  return { owner: m[1]!, repo: m[2]! };\n}\n\n/**\n * Fetch the bytes of each requested path from a GitHub repo at a pinned commit.\n *\n * Reads the recursive git tree at `commitSha`, maps each blob path to its blob\n * SHA, then fetches each requested path's blob and base64-decodes it.\n *\n * @returns A `{ path → Buffer }` map covering every requested path.\n * @throws An error whose message matches `/unreachable/i` if the tree cannot\n *   be read or any requested path is absent from the tree.\n */\nexport async function fetchAssetFilesFromGitHub(opts: FetchOpts): Promise<Record<string, Buffer>> {\n  // The pointer-only integrity model depends on `commitSha` being an immutable\n  // git commit SHA. GitHub's tree API also accepts branch/tag names, which\n  // would produce a mutable fetch and a non-pinned `Instance.sourceCommitSha` —\n  // silently breaking the auditable/re-verifiable guarantee. Reject anything\n  // that is not exactly 40 hex characters.\n  if (!/^[0-9a-f]{40}$/i.test(opts.commitSha)) {\n    throw new Error(\n      `pinned commit must be a 40-character hex SHA, got '${opts.commitSha}' — ` +\n        \"a branch or tag would make the install mutable\",\n    );\n  }\n  const { owner, repo } = parseRepo(opts.url);\n  const hasPat = Boolean(process.env[GITHUB_PAT_ENV]);\n  // Anonymous reads of a public repo go to the raw-content host: one request per file, and\n  // none counts against the 60-calls-per-hour anonymous limit of the REST API (the tree +\n  // blob route spent about six API calls per skill). A token, or an injected Octokit, uses\n  // the API (a private repo is only readable there).\n  if (!opts.octokit && !hasPat) {\n    return fetchFromRawHost({ owner, repo, commitSha: opts.commitSha, paths: opts.paths });\n  }\n  // Octokit logs every failed request (`GET /repos/... - 401 with id ...`) through its\n  // default console logger; the thrown error below is the one message the user gets.\n  const quiet = { debug: () => {}, info: () => {}, warn: () => {}, error: () => {} };\n  const octo = opts.octokit ?? new Octokit({ auth: process.env[GITHUB_PAT_ENV], log: quiet });\n\n  let tree: Awaited<ReturnType<typeof octo.rest.git.getTree>>;\n  try {\n    tree = await octo.rest.git.getTree({\n      owner,\n      repo,\n      tree_sha: opts.commitSha,\n      recursive: \"true\",\n    });\n  } catch (e) {\n    // A rejected token (a stale or mistyped `SKAILE_GITHUB_PAT`) must not fail a public repo:\n    // the raw-content host needs no token. A private repo is a 404 there, and the error then\n    // says the token was the problem.\n    if ((e as { status?: number }).status === 401) {\n      try {\n        const files = await fetchFromRawHost({\n          owner,\n          repo,\n          commitSha: opts.commitSha,\n          paths: opts.paths,\n        });\n        // The repo is public, so the install worked; the user still has a bad token (p1692).\n        warnRejectedPat(hasPat);\n        return files;\n      } catch {\n        throw new Error(\n          `unreachable: cannot read tree at ${opts.commitSha}: ${describeGitHubError(e, hasPat)}`,\n        );\n      }\n    }\n    throw new Error(\n      `unreachable: cannot read tree at ${opts.commitSha}: ${describeGitHubError(e, hasPat)}`,\n    );\n  }\n\n  // path → blob SHA\n  const byPath = new Map<string, string>();\n  for (const node of tree.data.tree) {\n    if (node.type === \"blob\" && node.path && node.sha) {\n      byPath.set(node.path, node.sha);\n    }\n  }\n\n  const result: Record<string, Buffer> = {};\n  for (const path of opts.paths) {\n    const blobSha = byPath.get(path);\n    if (!blobSha) {\n      // [H1] A recursive tree listing is truncated for large repos\n      // (`data.truncated: true`). A path missing from a truncated listing is\n      // not necessarily absent from the repo — surface a distinct, accurate\n      // error rather than the misleading \"path not in tree\".\n      if (tree.data.truncated) {\n        throw new Error(\n          `tree truncated — repo too large for recursive listing at ${opts.commitSha}`,\n        );\n      }\n      throw new Error(`unreachable: path not in tree: ${path}`);\n    }\n    let blob: Awaited<ReturnType<typeof octo.rest.git.getBlob>>;\n    try {\n      blob = await octo.rest.git.getBlob({ owner, repo, file_sha: blobSha });\n    } catch (e) {\n      throw new Error(`unreachable: cannot read ${path}: ${describeGitHubError(e, hasPat)}`);\n    }\n    // [L2] GitHub returns `encoding: \"none\"` (with empty content) for blobs\n    // larger than ~1MB. Only base64 is decodable here — fail loudly otherwise.\n    if (blob.data.encoding !== \"base64\") {\n      throw new Error(\n        `unreachable: blob ${path} has unsupported encoding '${blob.data.encoding}' (likely too large)`,\n      );\n    }\n    result[path] = Buffer.from(blob.data.content, \"base64\");\n  }\n  return result;\n}\n\nlet warnedRejectedPat = false;\n\n/** Say once per process that `SKAILE_GITHUB_PAT` was rejected and the read went on without it. */\nfunction warnRejectedPat(hasPat: boolean): void {\n  if (!hasPat || warnedRejectedPat) return;\n  warnedRejectedPat = true;\n  console.warn(`skaile: ${GITHUB_PAT_ENV} was rejected (401); continuing anonymously`);\n}\n\n/** Per-request ceiling for the raw-content host. */\nconst RAW_REQUEST_TIMEOUT_MS = 30_000;\n/** Files fetched at once from the raw-content host. */\nconst RAW_CONCURRENCY = 8;\n\n/**\n * The text for a failed GitHub API call. An exhausted rate limit names the fix\n * (`SKAILE_GITHUB_PAT`) and when the window resets; any other error keeps GitHub's message.\n */\nfunction describeGitHubError(e: unknown, hasPat: boolean): string {\n  const err = e as {\n    status?: number;\n    message?: string;\n    response?: { headers?: Record<string, string | number | undefined> };\n  };\n  if (err.status === 401) {\n    return hasPat\n      ? `${GITHUB_PAT_ENV} is set but GitHub rejected it (401 Bad credentials); unset it or replace it`\n      : \"GitHub rejected the credentials (401 Bad credentials)\";\n  }\n  const headers = err.response?.headers ?? {};\n  const exhausted = String(headers[\"x-ratelimit-remaining\"]) === \"0\";\n  if (\n    err.status === 429 ||\n    (err.status === 403 && (exhausted || /rate limit/i.test(err.message ?? \"\")))\n  ) {\n    return rateLimitMessage(headers[\"x-ratelimit-reset\"], hasPat);\n  }\n  return err.message ?? String(e);\n}\n\nfunction rateLimitMessage(reset: string | number | undefined, hasPat: boolean): string {\n  const at = Number(reset);\n  const when =\n    Number.isFinite(at) && at > 0 ? ` (resets ${new Date(at * 1000).toISOString()})` : \"\";\n  return hasPat\n    ? `GitHub rate limit exceeded${when}; wait for the reset`\n    : `GitHub rate limit exceeded${when}; set ${GITHUB_PAT_ENV} to a GitHub token to raise it`;\n}\n\n/**\n * Read each path from `raw.githubusercontent.com/<owner>/<repo>/<sha>/<path>`. The commit\n * is a full SHA, so the bytes are as immutable as through the API; `installFromManifest`\n * still verifies every file against the pinned hashes.\n */\nasync function fetchFromRawHost(args: {\n  owner: string;\n  repo: string;\n  commitSha: string;\n  paths: string[];\n}): Promise<Record<string, Buffer>> {\n  const result: Record<string, Buffer> = {};\n  const queue = [...args.paths];\n  const worker = async (): Promise<void> => {\n    for (let path = queue.shift(); path !== undefined; path = queue.shift()) {\n      const url =\n        `https://raw.githubusercontent.com/${args.owner}/${args.repo}/${args.commitSha}/` +\n        path.split(\"/\").map(encodeURIComponent).join(\"/\");\n      let res: Response;\n      try {\n        res = await fetch(url, { signal: AbortSignal.timeout(RAW_REQUEST_TIMEOUT_MS) });\n      } catch (e) {\n        const cause = (e as { cause?: { code?: string } }).cause?.code ?? (e as Error).message;\n        throw new Error(\n          `unreachable: cannot read ${path} from raw.githubusercontent.com: ${cause}`,\n        );\n      }\n      if (res.status === 404) {\n        throw new Error(\n          `unreachable: path not in tree: ${path} (not at ${args.commitSha} in ${args.owner}/${args.repo}; ` +\n            `a private repo needs ${GITHUB_PAT_ENV})`,\n        );\n      }\n      if (res.status === 429 || res.status === 403) {\n        const retry = Number(res.headers.get(\"retry-after\"));\n        const when = Number.isFinite(retry) && retry > 0 ? ` (retry in ${retry} s)` : \"\";\n        throw new Error(\n          `unreachable: GitHub refused ${path} with ${res.status}${when}; set ${GITHUB_PAT_ENV} to a GitHub token`,\n        );\n      }\n      if (!res.ok) {\n        throw new Error(`unreachable: cannot read ${path}: GitHub answered ${res.status}`);\n      }\n      result[path] = Buffer.from(await res.arrayBuffer());\n    }\n  };\n  await Promise.all(Array.from({ length: Math.min(RAW_CONCURRENCY, queue.length) }, worker));\n  return result;\n}\n"]}

package/dist/{chunk-QAKUD6QN.js → chunk-GF5JXQIZ.js}

@@ -1,4 +1,4 @@
-import { DEFAULT_HARNESS_ID } from './chunk-Z7ZEZZB6.js';
+import { DEFAULT_HARNESS_ID } from './chunk-C5HFK34M.js';
 import { createLogger } from './chunk-BOFL7GIF.js';
 import { readFileSync } from 'fs';
 import { dirname, join } from 'path';
@@ -305,5 +305,5 @@ function resolveProjectDir(additionalEnvVars) {
 }
 
 export { PluginStore, WorkspacePlugin, buildClaudePluginFiles, resolveProjectDir };
-//# sourceMappingURL=chunk-QAKUD6QN.js.map
-//# sourceMappingURL=chunk-QAKUD6QN.js.map
+//# sourceMappingURL=chunk-GF5JXQIZ.js.map
+//# sourceMappingURL=chunk-GF5JXQIZ.js.map