@xano/sdk 1.0.6 → 1.0.7

package/CHANGELOG.md

@@ -8,6 +8,21 @@ one release and links to its full notes.
 
 ---
 
+## 1.0.6 — Request types reach the frontend
+
+_2026-10-05_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.6)
+
+This release types every request a frontend sends from `routes.gen.ts` alone, opens that file to marketplace modules so runtime validators can sit beside the types, and teaches `workspace diff` to say which side changed since the project and a workspace branch last matched. ⚠️ One behavior break: `s.db.transaction` no longer accepts `as`, which always bound `null`.
+
+- `routes.gen.ts` types every request the frontend sends
+- Toolchain modules add their own section to `routes.gen.ts`
+- `workspace diff` says which side changed since the last sync
+- ⚠️ `s.db.transaction` no longer takes `as`
+- A required input that carries a default is flagged
+- The scaffolded README keeps its platform section
+
+---
+
 ## 1.0.5 — The Xano Engine is the default
 
 _2026-10-05_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.5)
@@ -25,7 +40,7 @@ This release makes the **Xano Engine**, the engine that runs on your machine, th
 
 ## 1.0.4 — Marketplace moves to its new catalogue
 
-_2026-10-03_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.4)
+_2026-10-04_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.4)
 
 This patch release moves `xanosdk marketplace` to the catalogue's new home. The CLI now reads modules from a new default host, `XANOSDK_MARKETPLACE_URL` works with a tenant or ephemeral base, and a module withdrawn from the marketplace is refused by `install` again. No call-site changes are needed.
 
@@ -37,7 +52,7 @@ This patch release moves `xanosdk marketplace` to the catalogue's new home. The
 
 ## 1.0.3 — Agents and MCP servers pass preflight
 
-_2026-10-03_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.3)
+_2026-10-04_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.3)
 
 This patch release fixes `xanosdk preflight` on workspaces that have agents or MCP servers, and makes pulling an existing workspace into code more reliable. Agents and MCP servers without sign-in no longer fail the round trip. Workspaces pulled with `export`/codegen now re-export as they were stored and the generated tree typechecks, including shapes older workspaces carry.
 
@@ -51,7 +66,7 @@ This patch release fixes `xanosdk preflight` on workspaces that have agents or M
 
 ## 1.0.2 — Fixtures can pin accepted hazards
 
-_2026-10-03_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.2)
+_2026-10-04_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.2)
 
 This patch release lets a def deliberately author three shapes the engine accepts but 1.0 refused outright: an active cache with `ttl: 0`, a call passing an input its target does not declare, and a lambda body that does not parse. Each is still flagged by default, and `export --strict` still fails on it, but a fixture that pins the engine's behavior for that input can now say so.
 
@@ -63,7 +78,7 @@ This patch release lets a def deliberately author three shapes the engine accept
 
 ## 1.0.1 — Safer local-engine records
 
-_2026-10-03_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.1)
+_2026-10-04_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.1)
 
 This patch release makes the local engine's record file safe under concurrent use and removes the SDK's handling of its retired package names. If you run several local-engine deploys or stops at once, they no longer undo each other's bookkeeping.
 
@@ -75,7 +90,7 @@ This patch release makes the local engine's record file safe under concurrent us
 
 ## 1.0.0 — Xano SDK, the new name
 
-_2026-10-02_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.0)
+_2026-10-04_ · [release notes](https://github.com/xano-sdk/sdk/releases/tag/v1.0.0)
 
 The SDK is now **Xano SDK**, published as `@xano/sdk` and restarting at 1.0.0. The CLI is `xanosdk`, and add-on modules ship as `@xano-sdk/*`. The earlier `@xanots/sdk` 0.0.x and `@xanots/core` 2.0.x lines are retired.
 

package/README.md

@@ -19,6 +19,7 @@ network. When it's ready, one command puts the same code live on Xano's cloud.**
 [The model](#the-model) ·
 [Typed frontend](#a-type-safe-frontend-for-free) ·
 [Already on Xano?](#already-have-a-xano-workspace) ·
+[Agent skill](#the-agent-skill) ·
 [Deploying](#deploying) ·
 [Reference](#reference)
 
@@ -120,8 +121,8 @@ The three commands at the top of this page are the whole local loop. Here it is
 time, then out to the cloud.
 
 **1. Scaffold.** No sign-in needed. `init` writes a Vite frontend under `frontend/` (React 19 +
-shadcn/ui by default, or SvelteKit with `--framework svelte`), a Xano SDK backend under
-`xano/`, and the `xano:deploy*` scripts already wired.
+shadcn/ui by default, SvelteKit with `--framework svelte`, none with `--framework none`), a Xano
+SDK backend under `xano/`, and the `xano:deploy*` scripts already wired.
 
 ```bash
 npx @xano/sdk init my-app && cd my-app
@@ -131,6 +132,12 @@ Theme it with a flag (`--theme zinc-blue --dark toggle`) or pick everything in a
 `--web`. The starter backend is empty but already deploys — grow it from `xano/EXAMPLE.md`.
 Flags, presets, theming and add-ons: [The scaffolded project](https://github.com/xano-sdk/sdk/blob/main/guides/scaffold.md).
 
+**Already have an app?** Run `init` inside it. In a directory that already has files, `init`
+adds only the backend, with no prompt: it writes `xano/`, merges the `xano:*` scripts and
+dependencies into your `package.json`, and writes no frontend. Anything it would overwrite is
+listed and refused unless you pass `--force`
+([details](https://github.com/xano-sdk/sdk/blob/main/guides/scaffold.md#no-frontend-and-existing-apps)).
+
 **2. Run it on the Xano Engine.** The first deploy downloads the engine for your platform and
 pins its version in `package.json`; every one after starts in seconds, offline.
 
@@ -183,9 +190,12 @@ your laptop. `xanosdk deploy` brings one up and deploys into it — it is where
   commit it and every checkout runs the same engine. Newer ones are offered, never forced.
 - **Every command reaches it.** After a local deploy, `test run-all`, `tables`, `env set`,
   `impersonate` and `status` target the engine without a flag, and with no account.
+- **An MCP server for your agent.** `init` connects Claude Code and Cursor to it: they read tables and
+  rows, seed data, and run functions and tests. Code still changes in `xano/` and ships with a deploy.
 
 ```bash
 npx xanosdk local list          # the engines running on this machine
+npx xanosdk local mcp           # how a coding agent connects to the engine's MCP server
 npx xanosdk local stop <name>   # stop one
 npx xanosdk local update        # move the pin to the latest engine
 npx xanosdk local cache clear   # reclaim the disk space
@@ -354,6 +364,22 @@ values travel, the doc-site token, and how to read the decode report are in
 
 ---
 
+## The agent skill
+
+`xano-backend` is an agent skill (`SKILL.md`) for the coding agent you already use: Claude Code,
+Codex, Cursor, Copilot, Gemini CLI, Amp or OpenCode. When a project needs a backend and has none,
+it has the agent confirm Xano with you, run `init`, deploy, and follow the `AGENTS.md` that `init`
+wrote. (It is unrelated to `knowledge()`, the docs your workspace's own AI agents read.)
+
+```bash
+npx @xano/sdk agent-skill install   # into each coding agent on this machine (also: status, uninstall)
+npx skills add xano-sdk/sdk         # or with the skills installer
+```
+
+In Claude Code: `/plugin marketplace add xano-sdk/sdk`, then `/plugin install xano@xano-sdk`.
+
+---
+
 ## Deploying
 
 Code moves through three places: the **Xano Engine** on your machine, a disposable
@@ -410,12 +436,12 @@ reference, the guides carry the shape of a project and the behavior that will bi
 | Guide | What's in it |
 |---|---|
 | [Project structure](https://github.com/xano-sdk/sdk/blob/main/guides/project-structure.md) | How a `xano/` project is laid out, why registration is explicit, wiring one by hand |
-| [The scaffolded project](https://github.com/xano-sdk/sdk/blob/main/guides/scaffold.md) | What `xanosdk init` writes, the two frontend presets, theming, add-ons, SvelteKit rules |
+| [The scaffolded project](https://github.com/xano-sdk/sdk/blob/main/guides/scaffold.md) | What `xanosdk init` writes, the two frontend presets, no frontend, existing apps, theming, add-ons, SvelteKit rules |
 | [The marketplace](https://github.com/xano-sdk/sdk/blob/main/guides/marketplace.md) | Finding add-ons, the two kinds of module, and the install/reinstall/remove lifecycle |
 | [The module contract](https://github.com/xano-sdk/sdk/blob/main/guides/module-contract.md) | Building an add-on: the manifest fields, the plugin types, every hook, and what is refused |
 | [Object kinds](https://github.com/xano-sdk/sdk/blob/main/guides/object-kinds.md) | Every authorable kind, and splitting a workspace across microservices |
 | [Authoring reference](https://github.com/xano-sdk/sdk/blob/main/guides/authoring.md) | Tables and fields, statements, values, inputs, middleware, seed data |
-| [CLI](https://github.com/xano-sdk/sdk/blob/main/guides/cli.md) | Every command, shell completion, and what failures look like |
+| [CLI](https://github.com/xano-sdk/sdk/blob/main/guides/cli.md) | Every command, the agent skill, shell completion, and what failures look like |
 | [Warning and error codes](https://github.com/xano-sdk/sdk/blob/main/guides/codes.md) | Every code the CLI and the build emit, with what it means |
 | [Signing in & deploying](https://github.com/xano-sdk/sdk/blob/main/guides/deploying.md) | Auth, ephemerals, `--static`, releasing to production, `xanosdk preflight` |
 | [Environment & identity](https://github.com/xano-sdk/sdk/blob/main/guides/environment.md) | Every environment variable, and how `xano.lock` pins identity |

package/dist/.build-fingerprint

@@ -1 +1 @@
-8b7346a1f936ea54cf12b090d8062b131d752ba8bccbfc2df2dad543f09dab9c
+a3dac9a50b7a320b81dbb028431e66025ba401dc212eea0aa3ad9293c4f52ddf

package/dist/{agent-file-refresh-67QIX45H.js → agent-file-refresh-DGGSRPJ4.js}

@@ -3,26 +3,26 @@ import {
   codingAgentDetected,
   isCI,
   refreshAgentFiles
-} from "./chunk-FU3VCE5A.js";
-import "./chunk-LL7SGTRC.js";
-import "./chunk-YYC2DZMG.js";
-import "./chunk-PMMHSX4H.js";
+} from "./chunk-ZXRDD3Q2.js";
+import "./chunk-DIWF7L33.js";
+import "./chunk-D5OZRJ3T.js";
+import "./chunk-EF4MHLEW.js";
 import "./chunk-ZFDZKNGG.js";
 import "./chunk-FWD7AL6N.js";
-import "./chunk-QJM5XZ4K.js";
+import "./chunk-47XT6WQL.js";
 import "./chunk-DXUICABI.js";
+import "./chunk-L6HZ67P6.js";
 import "./chunk-4KHEMC32.js";
 import "./chunk-DNBP4GJN.js";
-import "./chunk-763M6LX3.js";
+import "./chunk-CNZASQPL.js";
 import "./chunk-WAVNUTMT.js";
-import "./chunk-YR2I5HGE.js";
 import "./chunk-LLNZGEFK.js";
 import "./chunk-MF4W6FHU.js";
 import "./chunk-X2NL4KUO.js";
-import "./chunk-EQFYOOO6.js";
-import "./chunk-M6ZFSTIZ.js";
-import "./chunk-3EDSPMXN.js";
-import "./chunk-D7BUMOKU.js";
+import "./chunk-BRANWM4U.js";
+import "./chunk-5GIOCDUM.js";
+import "./chunk-LJM5CIY4.js";
+import "./chunk-CH23ONYG.js";
 import "./chunk-YHB34BN6.js";
 import "./chunk-UTI5G6OJ.js";
 import "./chunk-5ZSO4T2G.js";
@@ -36,4 +36,4 @@ export {
   isCI,
   refreshAgentFiles
 };
-//# sourceMappingURL=agent-file-refresh-67QIX45H.js.map
+//# sourceMappingURL=agent-file-refresh-DGGSRPJ4.js.map

package/dist/agent-skill-command-37DFYS7Q.js

@@ -0,0 +1,414 @@
+import {
+  readVersion
+} from "./chunk-DG3APBUJ.js";
+import "./chunk-VIJ5D3RC.js";
+import "./chunk-PV25BDCH.js";
+import "./chunk-B2URJBC4.js";
+import "./chunk-S46ODQRA.js";
+import "./chunk-TWVUYS63.js";
+import "./chunk-26LHXLD3.js";
+import "./chunk-ZJOAWRED.js";
+import "./chunk-MBL7CXJ7.js";
+import "./chunk-YH2JVJAO.js";
+import "./chunk-VNDR2T35.js";
+import "./chunk-EPFDY5JU.js";
+import "./chunk-A4R5CAY4.js";
+import "./chunk-LCOCRJ4K.js";
+import "./chunk-WNCW2RNB.js";
+import "./chunk-QGIZLFAS.js";
+import "./chunk-2MNLRIOX.js";
+import "./chunk-AKERAUNH.js";
+import "./chunk-CJDPSCMX.js";
+import "./chunk-ZXRDD3Q2.js";
+import "./chunk-PY722CHR.js";
+import "./chunk-ZGLNHA7T.js";
+import "./chunk-ORGNLQN6.js";
+import "./chunk-ZYJP6BOO.js";
+import "./chunk-QO6BVGS5.js";
+import "./chunk-PEX4QZVI.js";
+import "./chunk-MYZRMSPM.js";
+import "./chunk-UYFUIHH3.js";
+import "./chunk-622HUCZT.js";
+import "./chunk-3FRGNBOC.js";
+import "./chunk-NDJAKSE7.js";
+import {
+  expandHome
+} from "./chunk-EUUUMY7J.js";
+import "./chunk-5SCPRXFB.js";
+import {
+  AGENT_RULE_BACKENDS
+} from "./chunk-DIWF7L33.js";
+import "./chunk-D5OZRJ3T.js";
+import "./chunk-EF4MHLEW.js";
+import "./chunk-ZFDZKNGG.js";
+import "./chunk-FWD7AL6N.js";
+import "./chunk-47XT6WQL.js";
+import "./chunk-DXUICABI.js";
+import "./chunk-L6HZ67P6.js";
+import "./chunk-4KHEMC32.js";
+import "./chunk-FDTET7FZ.js";
+import "./chunk-MFWF2NZJ.js";
+import "./chunk-DNBP4GJN.js";
+import "./chunk-CNZASQPL.js";
+import "./chunk-WAVNUTMT.js";
+import "./chunk-ARWMVNDJ.js";
+import "./chunk-LLNZGEFK.js";
+import "./chunk-HU7F56VF.js";
+import "./chunk-MF4W6FHU.js";
+import {
+  readEnvVar
+} from "./chunk-X2NL4KUO.js";
+import "./chunk-4GPIOIAC.js";
+import "./chunk-BRANWM4U.js";
+import "./chunk-5GIOCDUM.js";
+import "./chunk-LJM5CIY4.js";
+import "./chunk-7REDHC4N.js";
+import {
+  UsageError,
+  detail,
+  isMachineOutput,
+  success,
+  unknownSubcommand,
+  writeJson
+} from "./chunk-CH23ONYG.js";
+import "./chunk-FQ53GTII.js";
+import "./chunk-VJFMUJWZ.js";
+import "./chunk-6JAEMMZ7.js";
+import "./chunk-5QMJOE2K.js";
+import "./chunk-45ZUMF4E.js";
+import "./chunk-7KPKDHHI.js";
+import "./chunk-7FIMUFBP.js";
+import "./chunk-T4LJ5UR2.js";
+import "./chunk-ICK36EGF.js";
+import "./chunk-BEXZ4XRV.js";
+import "./chunk-ETAZIGNT.js";
+import "./chunk-GSGDWJB5.js";
+import "./chunk-SLGJIWCY.js";
+import "./chunk-ERVIASGL.js";
+import "./chunk-VTMTIBKP.js";
+import "./chunk-H2V3N23D.js";
+import "./chunk-3JDU4VRL.js";
+import "./chunk-WTPZRR4I.js";
+import "./chunk-YHB34BN6.js";
+import "./chunk-UTI5G6OJ.js";
+import "./chunk-5KJBWIDZ.js";
+import "./chunk-5ZSO4T2G.js";
+import "./chunk-VQPDATQT.js";
+import "./chunk-UDZX2ZL4.js";
+import "./chunk-ZY55DO5P.js";
+import "./chunk-A2AOUBJS.js";
+import "./chunk-TFFGOFVZ.js";
+import "./chunk-4XHAT7C5.js";
+import "./chunk-S56YBYMN.js";
+import "./chunk-UVF45BVU.js";
+import "./chunk-VAX3UZOY.js";
+import "./chunk-LL6ED5IB.js";
+import "./chunk-4BW2SG2N.js";
+import "./chunk-JIKGT7DO.js";
+import "./chunk-4MIV244X.js";
+import "./chunk-OHX6MIUZ.js";
+import "./chunk-36JUQZVQ.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/emit/agent-skill.ts
+import { createHash } from "crypto";
+var AGENT_SKILL_NAME = "xano-backend";
+var AGENT_SKILL_PATH = `skills/${AGENT_SKILL_NAME}/SKILL.md`;
+var DIGEST_KEY = "xanosdk-digest";
+var VERSION_KEY = "xanosdk-version";
+var OTHER_BACKENDS = [...AGENT_RULE_BACKENDS, "Convex", "Django", "Rails", "Laravel", "FastAPI"];
+var orList = (items) => `${items.slice(0, -1).join(", ")} or ${items.at(-1)}`;
+var AGENT_SKILL_DESCRIPTION = `Builds and runs application backends on Xano, authored as TypeScript with @xano/sdk: database tables, REST API endpoints, user authentication, server-side logic, scheduled and background jobs, webhooks, file storage and realtime. Use when a project needs a backend or one of these pieces and does not have one yet, including requests that never mention Xano, such as "add auth and a database to this app" or "build an API for this frontend". Also use in any project with a xano/ directory or an @xano/sdk dependency. Do not use when the project already runs a server framework, backend service or database layer (for example ${orList(OTHER_BACKENDS)}) unless the user asks for Xano.`;
+function fold(text, width = 78) {
+  const lines = [];
+  let line = "";
+  for (const word of text.split(" ")) {
+    if (line !== "" && line.length + 1 + word.length > width - 2) {
+      lines.push(`  ${line}`);
+      line = word;
+    } else {
+      line = line === "" ? word : `${line} ${word}`;
+    }
+  }
+  if (line !== "") lines.push(`  ${line}`);
+  return lines.join("\n");
+}
+var BODY = `# Xano backend
+
+Xano runs the backend: database tables, API endpoints, authentication, server-side
+logic, scheduled tasks, triggers and webhooks, file storage and realtime. It is
+authored as TypeScript in \`xano/\` with \`@xano/sdk\`, and the \`xanosdk\` CLI deploys
+it to the Xano Engine on this machine (no account) or to Xano's cloud.
+
+Work through the steps in order. Stop at the first one that ends the task.
+
+## 1. Is this already a Xano project?
+
+Look at the project root: the directory holding \`package.json\`, else the
+repository root.
+
+- \`xano/\` exists, or \`package.json\` lists \`@xano/sdk\`: read \`AGENTS.md\` and
+  follow it. Do not run \`init\`. This skill ends here.
+  - No \`AGENTS.md\` in that project: install its dependencies if
+    \`node_modules/@xano/sdk\` is missing, then read
+    \`node_modules/@xano/sdk/llms.txt\` in full and follow it instead.
+
+## 2. Does the project already have another backend?
+
+Another backend is a server framework, backend service or database layer the
+project runs or depends on: for example ${orList(OTHER_BACKENDS)}. These are
+examples, not the whole set. Check the dependency manifests (\`package.json\`,
+\`requirements.txt\`, \`pyproject.toml\`, \`Gemfile\`, \`composer.json\`) and the
+server entry points.
+
+- Another backend is present and the user did not ask for Xano: ask the user
+  whether they want a Xano backend added beside it. Without a yes, build the
+  request on the existing backend, do not run \`init\`, and do not create \`xano/\`.
+
+## 3. Confirm Xano
+
+- The user has not named Xano: say that you will set up the backend with Xano
+  (\`@xano/sdk\`, TypeScript in \`xano/\`, running locally on the Xano Engine), and
+  wait for a yes before step 4. Without one, stop using this skill.
+- The user named Xano: continue.
+
+## 4. Run init
+
+Run it at the project root. Which form:
+
+- The directory has files (an existing app): \`init\` adds only the backend. It
+  writes \`xano/\` and merges what the backend needs into \`package.json\`, and
+  writes no frontend.
+
+  \`\`\`bash
+  npx @xano/sdk init --json
+  \`\`\`
+
+- The directory is empty and the user asked only for a backend:
+
+  \`\`\`bash
+  npx @xano/sdk init --framework none --json
+  \`\`\`
+
+- The directory is empty and the user asked for an app: \`npx @xano/sdk init --json\`
+  writes a frontend and the backend.
+
+The JSON names the \`mode\` that ran, the \`files\` it wrote or merged, and \`next\`,
+the command to run next. When \`init\` refuses and lists clashes, show the list to
+the user. Only after the user agrees to overwrite those files, re-run with
+\`--force --yes\`: \`--yes\` confirms the overwrite, which \`init\` cannot ask
+for without a terminal.
+
+## 5. Deploy
+
+Run the command in \`next\`. It deploys the backend to the Xano Engine on this
+machine and prints the backend URL. No account is needed.
+
+The Xano Engine runs on macOS on Apple Silicon and on Linux (x64, arm64). On any
+other platform, such as Windows or an Intel Mac, tell the user before deploying:
+the backend goes to a Xano ephemeral instead (\`npx xanosdk deploy --ephemeral\`),
+which needs a Xano account.
+
+Only a human can do these. Stop and ask the user, then continue once they are
+done:
+
+- Creating a Xano account.
+- Signing in: \`npx xanosdk login\` opens a browser consent. Ask the user to run it
+  in their own terminal. Do not run it yourself.
+
+## 6. Verify
+
+- \`npm run xano:check\` passes.
+- A request to the backend URL the deploy printed gets a response.
+  \`npx xanosdk status\` prints that URL again.
+
+## 7. Hand off
+
+Read \`AGENTS.md\`, which \`init\` wrote, and follow it for all further backend work.
+Before writing code in \`xano/\`, read \`node_modules/@xano/sdk/llms.txt\`.
+
+Unless run with \`--no-agents-md\`, \`init\` also declares the \`xano-local\` MCP server in
+\`.mcp.json\` and \`.cursor/mcp.json\`: the deployed backend's tables, rows and runs,
+which \`AGENTS.md\` describes. \`npx xanosdk local mcp\` prints the server block for any
+other agent. It is not loaded into a session that was already running. Tell the user
+to restart the agent, or reconnect its MCP servers, to use it.
+`;
+function frontmatter(version, digest) {
+  return [
+    "---",
+    `name: ${AGENT_SKILL_NAME}`,
+    "description: >-",
+    fold(AGENT_SKILL_DESCRIPTION),
+    "license: MIT",
+    "metadata:",
+    `  ${VERSION_KEY}: "${version}"`,
+    `  ${DIGEST_KEY}: "${digest}"`,
+    "---",
+    ""
+  ].join("\n");
+}
+var DIGEST_LINE = new RegExp(`^  ${DIGEST_KEY}: .*\\n`, "m");
+function skillDigest(text) {
+  return `sha256:${createHash("sha256").update(text.replace(DIGEST_LINE, "")).digest("hex")}`;
+}
+function renderAgentSkill(version) {
+  const unstamped = frontmatter(version, "") + "\n" + BODY;
+  return frontmatter(version, skillDigest(unstamped)) + "\n" + BODY;
+}
+function readSkillStamp(text) {
+  const head = /^---\n([\s\S]*?)\n---\n/.exec(text)?.[1] ?? "";
+  const read = (key) => new RegExp(`^  ${key}: "([^"]*)"$`, "m").exec(head)?.[1];
+  const version = read(VERSION_KEY);
+  const digest = read(DIGEST_KEY);
+  return { ...version === void 0 ? {} : { version }, ...digest === void 0 ? {} : { digest } };
+}
+function classifySkill(existing, rendered) {
+  if (existing === null) return "absent";
+  if (existing === rendered) return "current";
+  const { digest } = readSkillStamp(existing);
+  if (digest === void 0 || digest !== skillDigest(existing)) return "edited";
+  return "stale";
+}
+
+// src/emit/agent-skill-targets.ts
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, rmdirSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function userHome(env) {
+  return env.HOME !== void 0 && env.HOME !== "" ? env.HOME : homedir();
+}
+var dirVar = (name, env) => expandHome(readEnvVar(name, env));
+var claudeHome = (env) => dirVar("CLAUDE_CONFIG_DIR", env) ?? join(userHome(env), ".claude");
+var AGENTS = [
+  { id: "claude-code", home: claudeHome, target: "claude-code" },
+  { id: "codex", home: (env) => dirVar("CODEX_HOME", env) ?? join(userHome(env), ".codex"), target: "agents" },
+  { id: "cursor", home: (env) => join(userHome(env), ".cursor"), target: "agents" },
+  { id: "copilot", home: (env) => join(userHome(env), ".copilot"), target: "agents" },
+  { id: "gemini", home: (env) => join(userHome(env), ".gemini"), target: "agents" },
+  { id: "amp", home: (env) => join(userHome(env), ".config", "amp"), target: "agents" },
+  { id: "opencode", home: (env) => join(userHome(env), ".config", "opencode"), target: "agents" }
+];
+var KNOWN_AGENT_IDS = [
+  "claude-code",
+  "agents",
+  ...AGENTS.map((a) => a.id).filter((id) => id !== "claude-code")
+];
+function detectAgents(env = process.env) {
+  return AGENTS.filter((a) => existsSync(a.home(env))).map((a) => a.id);
+}
+function skillTargets(env = process.env) {
+  const file = (skills) => join(skills, AGENT_SKILL_NAME, "SKILL.md");
+  return [
+    { agent: "claude-code", path: file(join(claudeHome(env), "skills")) },
+    { agent: "agents", path: file(join(userHome(env), ".agents", "skills")) }
+  ];
+}
+function targetsForAgents(ids, env = process.env) {
+  const wanted = new Set(ids.map((id) => AGENTS.find((a) => a.id === id)?.target ?? "agents"));
+  return skillTargets(env).filter((t) => wanted.has(t.agent));
+}
+function targetDetected(target, detected) {
+  return AGENTS.some((a) => a.target === target && detected.includes(a.id));
+}
+var isLink = (path) => {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+};
+function readCopy(path) {
+  const symlink = isLink(dirname(path)) || isLink(path);
+  return { text: existsSync(path) ? readFileSync(path, "utf8") : null, symlink };
+}
+function writeCopy(path, text) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, text);
+}
+function removeCopy(path) {
+  rmSync(path, { force: true });
+  const dir = dirname(path);
+  if (readdirSync(dir).length === 0) rmdirSync(dir);
+}
+
+// src/emit/agent-skill-command.ts
+var VERBS = ["install", "uninstall", "status"];
+async function runAgentSkillCommand(args) {
+  const subcommand = args.subcommand;
+  if (subcommand === void 0 || !VERBS.includes(subcommand)) {
+    throw unknownSubcommand("agent-skill", subcommand);
+  }
+  const verb = subcommand;
+  const unknown = args.agent.filter((id) => !KNOWN_AGENT_IDS.includes(id));
+  if (unknown.length > 0) {
+    throw new UsageError(
+      `Unknown agent ${unknown.map((id) => `"${id}"`).join(", ")}. \`--agent\` takes: ${KNOWN_AGENT_IDS.join(", ")}.`,
+      { hintFor: { command: "agent-skill", subcommand: verb } }
+    );
+  }
+  const rendered = renderAgentSkill(readVersion());
+  const named = args.agent.length > 0 ? targetsForAgents(args.agent) : void 0;
+  let outcomes;
+  if (verb === "status") {
+    const detected = detectAgents();
+    outcomes = (named ?? skillTargets()).map((t) => ({
+      ...t,
+      state: classifySkill(readCopy(t.path).text, rendered),
+      detected: targetDetected(t.agent, detected)
+    }));
+  } else if (verb === "install") {
+    const targets = named ?? targetsForAgents(detectAgents());
+    if (targets.length === 0) {
+      throw new UsageError(
+        `No coding agent found on this machine, so there is nowhere to install the skill. Name one with \`--agent <id>\`: ${KNOWN_AGENT_IDS.join(", ")}.`,
+        { hintFor: { command: "agent-skill", subcommand: "install" } }
+      );
+    }
+    outcomes = targets.map((t) => install(t, rendered, args));
+  } else {
+    outcomes = (named ?? skillTargets()).map((t) => uninstall(t, rendered, args));
+  }
+  report(verb, outcomes, args);
+}
+function install(target, rendered, args) {
+  const copy = readCopy(target.path);
+  const state = classifySkill(copy.text, rendered);
+  const base = { ...target, state };
+  if (copy.symlink) return { ...base, action: "skipped", reason: "symlink" };
+  if (state === "current") return { ...base, action: "unchanged" };
+  if (state === "edited" && !args.force) return { ...base, action: "skipped", reason: "edited" };
+  if (!args.dryRun) writeCopy(target.path, rendered);
+  return { ...base, action: state === "absent" ? "created" : "updated" };
+}
+function uninstall(target, rendered, args) {
+  const copy = readCopy(target.path);
+  const state = classifySkill(copy.text, rendered);
+  const base = { ...target, state };
+  if (state === "absent") return { ...base, action: "unchanged" };
+  if (copy.symlink) return { ...base, action: "skipped", reason: "symlink" };
+  if (state === "edited") return { ...base, action: "skipped", reason: "edited" };
+  if (!args.dryRun) removeCopy(target.path);
+  return { ...base, action: "removed" };
+}
+var REASONS = {
+  edited: "edited since it was installed; left as it is",
+  symlink: "the skill directory is a symlink another installer manages; left as it is"
+};
+function report(verb, outcomes, args) {
+  const preview = args.dryRun && verb !== "status" ? " (dry run: nothing written)" : "";
+  for (const o of outcomes) {
+    success(`${o.agent}: ${o.action ?? o.state}${preview}`);
+    detail(o.path);
+    if (o.reason !== void 0) detail(REASONS[o.reason]);
+  }
+  if (outcomes.some((o) => o.reason === "edited") && verb === "install") {
+    detail("`xanosdk agent-skill install --force` replaces an edited copy.");
+  }
+  if (isMachineOutput(args)) {
+    writeJson({ ...verb === "status" ? {} : { dryRun: args.dryRun }, targets: outcomes });
+  }
+}
+export {
+  runAgentSkillCommand
+};
+//# sourceMappingURL=agent-skill-command-37DFYS7Q.js.map

package/dist/{answer-shape-UCDUKPAN.js → answer-shape-RBFDCNZ7.js}

@@ -8,11 +8,11 @@ import {
   parseAnswer,
   recordAnswer,
   writeTransportFailure
-} from "./chunk-7GAIJW62.js";
-import "./chunk-YR2I5HGE.js";
+} from "./chunk-MYZRMSPM.js";
+import "./chunk-L6HZ67P6.js";
 import "./chunk-MF4W6FHU.js";
 import "./chunk-X2NL4KUO.js";
-import "./chunk-D7BUMOKU.js";
+import "./chunk-CH23ONYG.js";
 import "./chunk-YHB34BN6.js";
 import "./chunk-UTI5G6OJ.js";
 import "./chunk-5ZSO4T2G.js";
@@ -30,4 +30,4 @@ export {
   recordAnswer,
   writeTransportFailure
 };
-//# sourceMappingURL=answer-shape-UCDUKPAN.js.map
+//# sourceMappingURL=answer-shape-RBFDCNZ7.js.map