@vibe-agent-toolkit/cli 0.1.34-rc.2 → 0.1.35

package/dist/commands/claude/plugin/plugin-changelog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-changelog.d.ts","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/plugin-changelog.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,MAAM,EACvB,KAAK,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACxC,MAAM,GAAG,SAAS,CASpB"}

package/dist/commands/claude/plugin/plugin-changelog.js

@@ -0,0 +1,27 @@
+import { existsSync } from 'node:fs';
+import { safePath } from '@vibe-agent-toolkit/utils';
+/**
+ * Resolve the per-plugin CHANGELOG file path for a marketplace publish.
+ *
+ * Resolution order:
+ *   1. If `entry.changelog` is provided, treat it as a path relative to the
+ *      plugin source dir. Returns the absolute path if the file exists; else
+ *      `undefined` (a config-supplied path that doesn't resolve is a no-op).
+ *   2. Otherwise, default to `<pluginSourceDir>/CHANGELOG.md` if that file
+ *      exists; else `undefined`.
+ *
+ * The default path is anchored to the plugin's *source* dir (the `source`
+ * field on the marketplace plugin entry, default `plugins/<name>`). Callers
+ * pass the resolved source dir directly — this helper does not assume layout.
+ */
+export function resolvePluginChangelogPath(pluginSourceDir, entry) {
+    if (entry.changelog) {
+        const configured = safePath.join(pluginSourceDir, entry.changelog);
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        return existsSync(configured) ? configured : undefined;
+    }
+    const defaulted = safePath.join(pluginSourceDir, 'CHANGELOG.md');
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    return existsSync(defaulted) ? defaulted : undefined;
+}
+//# sourceMappingURL=plugin-changelog.js.map

package/dist/commands/claude/plugin/plugin-changelog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-changelog.js","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/plugin-changelog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,eAAuB,EACvB,KAAyC;IAEzC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACnE,mEAAmE;QACnE,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACjE,mEAAmE;IACnE,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/commands/claude/plugin/plugin-json-merge.d.ts

@@ -6,10 +6,21 @@
  *   - Author wins on: all other keys (keywords, repository, homepage, license, ...)
  *   - description:    config.description ?? author.description ?? `${name} plugin`
  *
+ * Version resolution lives in `resolveVersion` (config > plugin.json > root) and
+ * happens at the caller in `build.ts`. By the time `mergePluginJson` runs, the
+ * value passed in `vat.version` IS the resolved answer — this function does no
+ * additional precedence work for version.
+ *
  * Mismatches on VAT-winning fields produce warnings — never errors.
  */
 export interface VatGeneratedFields {
     name: string;
+    /**
+     * The resolved plugin version (already gone through the precedence chain in
+     * `resolveVersion`). `undefined` only when all sources (config, plugin.json,
+     * root package.json) are absent — in which case `version` is omitted from
+     * the merged output entirely.
+     */
     version: string | undefined;
     author: {
         name: string;
@@ -25,5 +36,23 @@ export interface MergePluginJsonResult {
     merged: Record<string, unknown>;
     warnings: string[];
 }
+export interface ResolveVersionLogger {
+    warn(message: string): void;
+}
+/**
+ * Resolve the effective plugin version using the precedence chain:
+ *   marketplace-config-supplied version > plugin.json:version > root package.json version
+ *
+ * If both the config and plugin.json supply a version and they disagree, a warning is
+ * emitted via the supplied logger (config still wins). When agreement holds — or when
+ * one side is absent — no warning is emitted.
+ *
+ * Returns `undefined` only when all three sources are absent.
+ */
+export declare function resolveVersion(configEntry: {
+    version?: string | undefined;
+} | undefined, authorJson: {
+    version?: string | undefined;
+} | undefined, rootVersion: string | undefined, logger?: ResolveVersionLogger): string | undefined;
 export declare function mergePluginJson(args: MergePluginJsonArgs): MergePluginJsonResult;
 //# sourceMappingURL=plugin-json-merge.d.ts.map

package/dist/commands/claude/plugin/plugin-json-merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-json-merge.d.ts","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/plugin-json-merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,kBAAkB,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA6ED,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,qBAAqB,CAgBhF"}
+{"version":3,"file":"plugin-json-merge.d.ts","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/plugin-json-merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,kBAAkB,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,EACzD,UAAU,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,EACxD,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,GAAE,oBAA8B,GACrC,MAAM,GAAG,SAAS,CAYpB;AAcD,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,qBAAqB,CAiBhF"}

package/dist/commands/claude/plugin/plugin-json-merge.js

@@ -6,6 +6,11 @@
  *   - Author wins on: all other keys (keywords, repository, homepage, license, ...)
  *   - description:    config.description ?? author.description ?? `${name} plugin`
  *
+ * Version resolution lives in `resolveVersion` (config > plugin.json > root) and
+ * happens at the caller in `build.ts`. By the time `mergePluginJson` runs, the
+ * value passed in `vat.version` IS the resolved answer — this function does no
+ * additional precedence work for version.
+ *
  * Mismatches on VAT-winning fields produce warnings — never errors.
  */
 const VAT_OWNED_KEYS = new Set(['name', 'version', 'author']);
@@ -37,22 +42,30 @@ function collectWarnings(vat, authorJson, mergedAuthor) {
     if ('name' in authorJson && authorJson['name'] !== vat.name) {
         warnings.push(`plugin.json "name" mismatch: author value ${JSON.stringify(authorJson['name'])} ignored; using VAT-generated "${vat.name}".`);
     }
-    if (vat.version !== undefined &&
-        'version' in authorJson &&
-        authorJson['version'] !== vat.version) {
-        warnings.push(`plugin.json "version" mismatch: author value ${JSON.stringify(authorJson['version'])} ignored; using VAT-generated "${vat.version}".`);
-    }
     if ('author' in authorJson && !deepEqual(authorJson['author'], mergedAuthor)) {
         warnings.push(`plugin.json "author" mismatch: author-supplied value discarded; using VAT-generated author object.`);
     }
     return warnings;
 }
-function resolveVersion(vat, authorJson) {
-    if (vat.version !== undefined)
-        return vat.version;
-    if (authorJson && typeof authorJson['version'] === 'string')
-        return authorJson['version'];
-    return undefined;
+/**
+ * Resolve the effective plugin version using the precedence chain:
+ *   marketplace-config-supplied version > plugin.json:version > root package.json version
+ *
+ * If both the config and plugin.json supply a version and they disagree, a warning is
+ * emitted via the supplied logger (config still wins). When agreement holds — or when
+ * one side is absent — no warning is emitted.
+ *
+ * Returns `undefined` only when all three sources are absent.
+ */
+export function resolveVersion(configEntry, authorJson, rootVersion, logger = console) {
+    const config = configEntry?.version;
+    const author = authorJson?.version;
+    if (config && author && config !== author) {
+        logger.warn(`Plugin version mismatch: marketplace config declares ${config}, ` +
+            `plugin.json declares ${author}. Using config (${config}). ` +
+            `Reconcile by removing one or the other.`);
+    }
+    return config ?? author ?? rootVersion;
 }
 function resolveDescription(vat, configDescription, authorJson) {
     const authorDescription = authorJson && typeof authorJson['description'] === 'string'
@@ -64,9 +77,10 @@ export function mergePluginJson(args) {
     const { vat, configDescription, authorJson } = args;
     const merged = collectAuthorPassthrough(authorJson);
     merged['name'] = vat.name;
-    const version = resolveVersion(vat, authorJson);
-    if (version !== undefined) {
-        merged['version'] = version;
+    // Version is already resolved by the caller via resolveVersion.
+    // Omit entirely when no source supplied a value.
+    if (vat.version !== undefined) {
+        merged['version'] = vat.version;
     }
     merged['author'] = buildAuthorObject(vat);
     merged['description'] = resolveDescription(vat, configDescription, authorJson);

package/dist/commands/claude/plugin/plugin-json-merge.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-json-merge.js","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/plugin-json-merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmBH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnF,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;QACpD,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,wBAAwB,CAC/B,UAA+C;IAE/C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC;IAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,KAAK,aAAa;YAAE,SAAS;QAClC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CACtB,GAAuB,EACvB,UAA+C,EAC/C,YAAqB;IAErB,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CACX,6CAA6C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kCAAkC,GAAG,CAAC,IAAI,IAAI,CAC9H,CAAC;IACJ,CAAC;IACD,IACE,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,SAAS,IAAI,UAAU;QACvB,UAAU,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,OAAO,EACrC,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,gDAAgD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,kCAAkC,GAAG,CAAC,OAAO,IAAI,CACvI,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,UAAU,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7E,QAAQ,CAAC,IAAI,CACX,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,GAAuB,EACvB,UAA+C;IAE/C,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAClD,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAuB,EACvB,iBAAqC,EACrC,UAA+C;IAE/C,MAAM,iBAAiB,GACrB,UAAU,IAAI,OAAO,UAAU,CAAC,aAAa,CAAC,KAAK,QAAQ;QACzD,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC;QAC3B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,iBAAiB,IAAI,iBAAiB,IAAI,GAAG,GAAG,CAAC,IAAI,SAAS,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEpD,MAAM,MAAM,GAA4B,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IAE1B,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,aAAa,CAAC,GAAG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAE/E,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"plugin-json-merge.js","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/plugin-json-merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA6BH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnF,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;QACpD,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,wBAAwB,CAC/B,UAA+C;IAE/C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC;IAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,KAAK,aAAa;YAAE,SAAS;QAClC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CACtB,GAAuB,EACvB,UAA+C,EAC/C,YAAqB;IAErB,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CACX,6CAA6C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kCAAkC,GAAG,CAAC,IAAI,IAAI,CAC9H,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,UAAU,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7E,QAAQ,CAAC,IAAI,CACX,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,WAAyD,EACzD,UAAwD,EACxD,WAA+B,EAC/B,SAA+B,OAAO;IAEtC,MAAM,MAAM,GAAG,WAAW,EAAE,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,EAAE,OAAO,CAAC;IAEnC,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CACT,wDAAwD,MAAM,IAAI;YAChE,wBAAwB,MAAM,mBAAmB,MAAM,KAAK;YAC5D,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,IAAI,MAAM,IAAI,WAAW,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAuB,EACvB,iBAAqC,EACrC,UAA+C;IAE/C,MAAM,iBAAiB,GACrB,UAAU,IAAI,OAAO,UAAU,CAAC,aAAa,CAAC,KAAK,QAAQ;QACzD,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC;QAC3B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,iBAAiB,IAAI,iBAAiB,IAAI,GAAG,GAAG,CAAC,IAAI,SAAS,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEpD,MAAM,MAAM,GAA4B,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IAE1B,gEAAgE;IAChE,iDAAiD;IACjD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,aAAa,CAAC,GAAG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAE/E,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/commands/corpus/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Corpus command group — Phase 1 ships only `scan`.
+ */
+import { Command } from 'commander';
+export declare function createCorpusCommand(): Command;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/corpus/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/corpus/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,mBAAmB,IAAI,OAAO,CAoD7C"}

package/dist/commands/corpus/index.js

@@ -0,0 +1,53 @@
+/**
+ * Corpus command group — Phase 1 ships only `scan`.
+ */
+import { Command } from 'commander';
+import { corpusScanCommand } from './scan.js';
+export function createCorpusCommand() {
+    const corpus = new Command('corpus');
+    corpus
+        .description('Run vat audit (and optionally vat skill review) at scale across a tracked plugin seed')
+        .helpCommand(false);
+    corpus
+        .command('scan [seed-file]')
+        .description('Audit each plugin in the seed; write a per-run snapshot under --out')
+        .argument('[seed-file]', 'Path to seed YAML (default: corpus/seed.yaml)')
+        .requiredOption('--out <dir>', 'Output directory for the run snapshot (no default — must be specified)')
+        .option('--with-review', 'Also invoke vat skill review per plugin (LLM-backed; uses API tokens)')
+        .option('--debug', 'Enable debug logging and preserve cloned tempdirs')
+        .action(async function (seedFile) {
+        await corpusScanCommand(seedFile, this.optsWithGlobals());
+    })
+        .addHelpText('after', `
+Description:
+  Reads a seed YAML listing plugins to audit (each entry: { source, name,
+  validation? }), runs 'vat audit' against each (and optionally 'vat skill
+  review' with --with-review), writes summary.yaml plus per-plugin sibling
+  files into a date-sha subdirectory of --out.
+
+  source forms accepted (same as vat audit):
+    - local path (absolute or relative)
+    - https://host/owner/repo.git[#ref[:subpath]]
+    - GitHub web URL (https://github.com/owner/repo/tree/<ref>/<subpath>)
+    - GitHub shorthand (owner/repo, with optional #ref:subpath)
+    - SSH URL (git@host:owner/repo.git or ssh://...)
+    - file:// URL (local bare-repo testing)
+
+Output:
+  <--out>/<UTC-date>-<vat-short-sha>/
+    summary.yaml          # index: per-plugin status + totals
+    <name>-audit.yaml     # full audit output per plugin
+    <name>-review.md      # full skill-review output (only with --with-review)
+
+Exit codes:
+  0  - scan completed (regardless of unloadable plugins)
+  2  - scan failed to start (seed missing, --out missing, etc.)
+  130 - interrupted by SIGINT (partial results written)
+
+Example:
+  $ vat corpus scan --out ~/scratch/vat-corpus-runs
+  $ vat corpus scan corpus/seed.yaml --out ~/scratch/vat-corpus-runs --with-review
+`);
+    return corpus;
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/corpus/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/corpus/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAA0B,MAAM,WAAW,CAAC;AAEtE,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErC,MAAM;SACH,WAAW,CAAC,uFAAuF,CAAC;SACpG,WAAW,CAAC,KAAK,CAAC,CAAC;IAEtB,MAAM;SACH,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,qEAAqE,CAAC;SAClF,QAAQ,CAAC,aAAa,EAAE,+CAA+C,CAAC;SACxE,cAAc,CAAC,aAAa,EAAE,wEAAwE,CAAC;SACvG,MAAM,CAAC,eAAe,EAAE,uEAAuE,CAAC;SAChG,MAAM,CAAC,SAAS,EAAE,mDAAmD,CAAC;SACtE,MAAM,CAAC,KAAK,WAA0B,QAA4B;QACjE,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAuB,CAAC,CAAC;IACjF,CAAC,CAAC;SACD,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BL,CACI,CAAC;IAEJ,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/commands/corpus/report.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Run-summary types + writer for `vat corpus scan`.
+ *
+ * `summary.yaml` is the index for one scan run. Per-plugin full audit
+ * outputs and full skill-review outputs are written as sibling files
+ * referenced by relative `output_path`. Totals are derived from the
+ * per-plugin rows so callers can pass raw rows and let this module
+ * compute aggregates.
+ */
+export type AuditStatus = 'success' | 'warning' | 'error' | 'unloadable';
+export type ReviewStatus = 'ok' | 'error' | 'skipped';
+export interface AuditSummary {
+    errors: number;
+    warnings: number;
+    info: number;
+    files_scanned: number;
+}
+export interface AuditOutcome {
+    status: AuditStatus;
+    duration_ms: number;
+    summary?: AuditSummary;
+    findings_emitted?: number;
+    output_path?: string;
+    error?: string;
+}
+export interface ReviewOutcome {
+    status: ReviewStatus;
+    duration_ms: number;
+    output_path?: string;
+    error?: string;
+}
+export interface PluginRow {
+    source: string;
+    name: string;
+    validation_applied: boolean;
+    audit: AuditOutcome;
+    review: ReviewOutcome;
+}
+export interface RunReport {
+    schema_version: 1;
+    generated_at: string;
+    vat_version: string;
+    vat_commit: string;
+    seed_file: string;
+    flags: {
+        with_review: boolean;
+        debug: boolean;
+    };
+    plugins: PluginRow[];
+}
+export interface RunTotals {
+    plugins: number;
+    audit_clean: number;
+    audit_warning: number;
+    audit_error: number;
+    unloadable: number;
+    reviewed?: number;
+}
+/**
+ * Compute totals over the per-plugin rows.
+ */
+export declare function computeTotals(report: RunReport): RunTotals;
+/**
+ * Build the run directory name: `<YYYY-MM-DD>-<vat-short-sha>`.
+ * Date is the UTC date of `generated_at`.
+ */
+export declare function runDirectoryName(report: RunReport): string;
+/**
+ * Write `summary.yaml` (and create the run directory) under `outDir`.
+ * Returns the absolute path of the created run directory. Per-plugin
+ * sibling files (audit outputs, review outputs) are written by the
+ * runner — this function only writes the summary index.
+ */
+export declare function writeRunReport(report: RunReport, outDir: string): Promise<string>;
+//# sourceMappingURL=report.d.ts.map

package/dist/commands/corpus/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../src/commands/corpus/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;AACzE,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;AAEtD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,OAAO,CAAC;IAC5B,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,cAAc,EAAE,CAAC,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAChD,OAAO,EAAE,SAAS,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAmC1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAG1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBvF"}

package/dist/commands/corpus/report.js

@@ -0,0 +1,83 @@
+/**
+ * Run-summary types + writer for `vat corpus scan`.
+ *
+ * `summary.yaml` is the index for one scan run. Per-plugin full audit
+ * outputs and full skill-review outputs are written as sibling files
+ * referenced by relative `output_path`. Totals are derived from the
+ * per-plugin rows so callers can pass raw rows and let this module
+ * compute aggregates.
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { safePath } from '@vibe-agent-toolkit/utils';
+import * as yaml from 'js-yaml';
+/**
+ * Compute totals over the per-plugin rows.
+ */
+export function computeTotals(report) {
+    const totals = {
+        plugins: report.plugins.length,
+        audit_clean: 0,
+        audit_warning: 0,
+        audit_error: 0,
+        unloadable: 0,
+    };
+    for (const row of report.plugins) {
+        switch (row.audit.status) {
+            case 'success': {
+                totals.audit_clean += 1;
+                break;
+            }
+            case 'warning': {
+                totals.audit_warning += 1;
+                break;
+            }
+            case 'error': {
+                totals.audit_error += 1;
+                break;
+            }
+            case 'unloadable': {
+                totals.unloadable += 1;
+                break;
+            }
+        }
+    }
+    if (report.flags.with_review) {
+        totals.reviewed = report.plugins.filter((p) => p.review.status !== 'skipped').length;
+    }
+    return totals;
+}
+/**
+ * Build the run directory name: `<YYYY-MM-DD>-<vat-short-sha>`.
+ * Date is the UTC date of `generated_at`.
+ */
+export function runDirectoryName(report) {
+    const datePart = report.generated_at.slice(0, 10); // 'YYYY-MM-DD'
+    return `${datePart}-${report.vat_commit}`;
+}
+/**
+ * Write `summary.yaml` (and create the run directory) under `outDir`.
+ * Returns the absolute path of the created run directory. Per-plugin
+ * sibling files (audit outputs, review outputs) are written by the
+ * runner — this function only writes the summary index.
+ */
+export async function writeRunReport(report, outDir) {
+    const runDir = safePath.join(outDir, runDirectoryName(report));
+    // eslint-disable-next-line local/no-fs-mkdirSync, security/detect-non-literal-fs-filename -- the corpus output dir is caller-supplied; mkdir-recursive is the right call here
+    mkdirSync(runDir, { recursive: true });
+    const totals = computeTotals(report);
+    const dump = {
+        schema_version: report.schema_version,
+        generated_at: report.generated_at,
+        vat_version: report.vat_version,
+        vat_commit: report.vat_commit,
+        seed_file: report.seed_file,
+        flags: report.flags,
+        plugins: report.plugins,
+        totals,
+    };
+    const summaryPath = safePath.join(runDir, 'summary.yaml');
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- summaryPath composed under our run dir
+    writeFileSync(summaryPath, yaml.dump(dump, { lineWidth: -1 }), 'utf-8');
+    return runDir;
+}
+//# sourceMappingURL=report.js.map

package/dist/commands/corpus/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/commands/corpus/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAuDhC;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,MAAM,MAAM,GAAc;QACxB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAC9B,WAAW,EAAE,CAAC;QACd,aAAa,EAAE,CAAC;QAChB,WAAW,EAAE,CAAC;QACd,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,QAAQ,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;gBACxB,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;gBAC1B,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;gBACxB,MAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;gBACvB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IACvF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe;IAClE,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,8KAA8K;IAC9K,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG;QACX,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;KACP,CAAC;IAEF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1D,6GAA6G;IAC7G,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAExE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/commands/corpus/runner.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Per-plugin orchestrator for `vat corpus scan`.
+ *
+ * Phase 1 scope: resolve source (local or URL), optionally overlay a
+ * synthetic `vibe-agent-toolkit.config.yaml` from the entry's `validation:`
+ * block, run `vat audit` in-process, optionally invoke `vat skill review`,
+ * write per-plugin sibling files into the run directory, and return a
+ * PluginRow. Per-plugin failures never abort the loop.
+ *
+ * URL handling clones via Layer 1's `withClonedRepo` helper. Validation
+ * overlay (Task 5) is added on top of this base.
+ */
+import type { PluginRow } from './report.js';
+import type { PluginEntry } from './seed.js';
+export interface RunnerOptions {
+    runDir: string;
+    withReview: boolean;
+    debug: boolean;
+}
+/**
+ * Run audit + optional review against one plugin entry.
+ */
+export declare function auditOnePlugin(entry: PluginEntry, opts: RunnerOptions): Promise<PluginRow>;
+//# sourceMappingURL=runner.d.ts.map

package/dist/commands/corpus/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/commands/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,KAAK,EAA2C,SAAS,EAAiB,MAAM,aAAa,CAAC;AACrG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAqB7C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;CAChB;AA0BD;;GAEG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,SAAS,CAAC,CAKpB"}