loadout-ai 0.1.0

package/dist/src/core/health.js

@@ -0,0 +1,129 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { managedFileReadPath } from "./active-set.js";
+import { detectAgents } from "./paths.js";
+import { readInstallState } from "./state.js";
+import { buildUpdatePlan } from "./update.js";
+async function drift(record, activations) {
+    const changed = [];
+    for (const file of record.files) {
+        try {
+            const digest = createHash("sha256")
+                .update(await readFile(managedFileReadPath(record.packageId, file.path, activations)))
+                .digest("hex");
+            if (digest !== file.sha256)
+                changed.push(file.path);
+        }
+        catch {
+            changed.push(file.path);
+        }
+    }
+    return changed;
+}
+async function mcpDrift(configPath, serverName, expected) {
+    try {
+        const config = JSON.parse(await readFile(configPath, "utf8"));
+        return (createHash("sha256")
+            .update(JSON.stringify(config.mcpServers?.[serverName] ?? null))
+            .digest("hex") !== expected);
+    }
+    catch {
+        return true;
+    }
+}
+export async function buildHealthReport(options = {}) {
+    const [agents, state, updates] = await Promise.all([
+        detectAgents(),
+        readInstallState(),
+        options.updates
+            ? options.updates()
+            : options.checkUpdates
+                ? buildUpdatePlan()
+                : Promise.resolve([]),
+    ]);
+    const drifted = (await Promise.all(state.installs.map((record) => drift(record, state.activations ?? [])))).flat();
+    const driftedMcpServers = (await Promise.all((state.mcpInstalls ?? []).map((entry) => mcpDrift(entry.configPath, entry.serverName, entry.fingerprint)))).filter(Boolean).length;
+    const findings = [];
+    if (!agents.some((agent) => agent.installed))
+        findings.push({
+            level: "error",
+            code: "no-agents",
+            message: "No supported AI coding agent was detected.",
+            fix: "Install an agent or make its command available on PATH.",
+        });
+    for (const agent of agents.filter((item) => item.installed))
+        findings.push({
+            level: "ok",
+            code: `agent-${agent.id}`,
+            message: `${agent.displayName} is detected.`,
+        });
+    if (state.installs.length === 0)
+        findings.push({
+            level: "info",
+            code: "no-packages",
+            message: "No Loadout-managed packages are installed yet.",
+            fix: "Choose a profile or install a package.",
+        });
+    if (drifted.length)
+        findings.push({
+            level: "warning",
+            code: "managed-file-drift",
+            message: `${drifted.length} managed file(s) changed or disappeared outside Loadout.`,
+            fix: "Review the files, then reinstall or remove the owning package.",
+        });
+    if (driftedMcpServers)
+        findings.push({
+            level: "warning",
+            code: "managed-mcp-drift",
+            message: `${driftedMcpServers} managed MCP server entry or entries changed or disappeared outside Loadout.`,
+            fix: "Review the MCP config, then synchronize or remove the owning package.",
+        });
+    const available = updates.filter((update) => update.status === "update-available");
+    if (available.length)
+        findings.push({
+            level: available.some((update) => update.approvalRequired)
+                ? "warning"
+                : "info",
+            code: "updates-available",
+            message: `${available.length} package update(s) are available.`,
+            fix: "Run loadout update and review the safety findings.",
+        });
+    const errors = updates.filter((update) => update.status === "error");
+    if (errors.length)
+        findings.push({
+            level: "warning",
+            code: "update-check-failed",
+            message: `${errors.length} update check(s) could not be completed.`,
+            fix: "Check connectivity and retry.",
+        });
+    const status = findings.some((finding) => finding.level === "error")
+        ? "unhealthy"
+        : findings.some((finding) => finding.level === "warning")
+            ? "attention"
+            : "healthy";
+    return {
+        status,
+        generatedAt: new Date().toISOString(),
+        agents,
+        installedPackages: state.installs.length,
+        updatesChecked: Boolean(options.updates || options.checkUpdates),
+        updatesAvailable: available.length,
+        driftedFiles: drifted.length,
+        driftedMcpServers,
+        findings,
+    };
+}
+export function formatHealthReport(report) {
+    const icon = report.status === "healthy"
+        ? "✓"
+        : report.status === "attention"
+            ? "!"
+            : "✗";
+    const lines = [
+        `${icon} Loadout health: ${report.status}`,
+        `Packages: ${report.installedPackages} installed, ${report.updatesChecked ? `${report.updatesAvailable} update(s)` : "updates not checked (use --updates)"}, ${report.driftedFiles} drifted file(s), ${report.driftedMcpServers} drifted MCP server(s)`,
+    ];
+    for (const finding of report.findings)
+        lines.push(`${finding.level === "ok" ? "✓" : finding.level === "error" ? "✗" : finding.level === "warning" ? "!" : "•"} ${finding.message}${finding.fix ? ` ${finding.fix}` : ""}`);
+    return lines.join("\n");
+}

package/dist/src/core/improve.js

@@ -0,0 +1,223 @@
+import { buildHealthReport } from "./health.js";
+import { createHash } from "node:crypto";
+import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { loadoutHome } from "./paths.js";
+import { detectSecretKinds } from "./safety.js";
+export function proposeImprovements(report) {
+    const proposals = [];
+    if (report.driftedFiles)
+        proposals.push({
+            priority: 100,
+            problem: "Managed files have drifted from recorded hashes.",
+            evidence: [
+                `${report.driftedFiles} drifted file(s) in the health report.`,
+            ],
+            outcome: "Every drifted file is attributed to a package and can be safely reconciled or adopted.",
+            acceptanceTests: [
+                "Health reports exact owning packages without exposing content.",
+                "Sync dry-run explains restore, adopt, and ignore choices.",
+                "No unrelated file is changed.",
+            ],
+            requiresHumanReview: true,
+        });
+    if (report.driftedMcpServers)
+        proposals.push({
+            priority: 100,
+            problem: "Managed MCP configuration has drifted.",
+            evidence: [
+                `${report.driftedMcpServers} drifted MCP server entry or entries in the health report.`,
+            ],
+            outcome: "Every MCP change is attributed and can be reviewed, restored, adopted, or removed without changing unrelated servers.",
+            acceptanceTests: [
+                "Health identifies the owning package and config path without exposing secret values.",
+                "Sync dry-run preserves unrelated keys and servers.",
+                "Recovery restores exact previous configuration and state.",
+            ],
+            requiresHumanReview: true,
+        });
+    if (report.updatesAvailable)
+        proposals.push({
+            priority: 80,
+            problem: "Installed packages have pending updates.",
+            evidence: [`${report.updatesAvailable} update(s) in the health report.`],
+            outcome: "Produce reviewable update plans and safely apply approved updates.",
+            acceptanceTests: [
+                "Every update shows commit and changed components.",
+                "New scripts, hooks, domains, or environment names require approval.",
+                "Failed verification restores the prior snapshot.",
+            ],
+            requiresHumanReview: true,
+        });
+    if (!report.installedPackages)
+        proposals.push({
+            priority: 50,
+            problem: "The setup has no Loadout-managed packages.",
+            evidence: ["Health report contains zero installed packages."],
+            outcome: "Offer an explained tested profile or project-aware recommendations.",
+            acceptanceTests: [
+                "Recommendations include plain-language reasons.",
+                "No package installs without confirmation.",
+            ],
+            requiresHumanReview: false,
+        });
+    const missingAgents = report.agents.filter((agent) => !agent.installed);
+    if (missingAgents.length)
+        proposals.push({
+            priority: 20,
+            problem: "Some supported agents are not available.",
+            evidence: [missingAgents.map((agent) => agent.displayName).join(", ")],
+            outcome: "Keep unsupported targets disabled and explain how to enable them.",
+            acceptanceTests: [
+                "Plans never target an undetected agent by default.",
+                "Health output names missing agents without treating optional agents as corruption.",
+            ],
+            requiresHumanReview: false,
+        });
+    return proposals.sort((a, b) => b.priority - a.priority);
+}
+export async function buildImprovementCycle(health = buildHealthReport) {
+    const candidates = proposeImprovements(await health());
+    const generatedAt = new Date().toISOString();
+    const priorOutcomes = await readPriorOutcomes();
+    const id = `${generatedAt.replace(/[:.]/g, "-")}-${createHash("sha256")
+        .update(JSON.stringify(candidates[0] ?? generatedAt))
+        .digest("hex")
+        .slice(0, 8)}`;
+    return {
+        id,
+        generatedAt,
+        rule: "evidence-first-human-reviewed",
+        selected: candidates[0],
+        candidates,
+        guardrails: [
+            "Never execute untrusted package code.",
+            "Never expose secrets.",
+            "Never weaken safety to make a test pass.",
+            "Never apply or publish without the required human approval.",
+            "Always prepare and verify rollback before mutation.",
+        ],
+        priorOutcomes,
+    };
+}
+export function formatImprovementCycle(cycle) {
+    if (!cycle.selected)
+        return "No evidence-backed improvement is currently required.";
+    const item = cycle.selected;
+    return [
+        `Next improvement: ${item.problem}`,
+        `Evidence: ${item.evidence.join(" ")}`,
+        `Desired outcome: ${item.outcome}`,
+        "Acceptance tests:",
+        ...item.acceptanceTests.map((test) => `  - ${test}`),
+        `Human review: ${item.requiresHumanReview ? "required" : "required before release"}`,
+    ].join("\n");
+}
+const improvementHome = () => join(loadoutHome(), "improvements");
+async function readPriorOutcomes() {
+    let names = [];
+    try {
+        names = (await readdir(improvementHome()))
+            .filter((name) => name.endsWith(".json"))
+            .sort()
+            .slice(-20);
+    }
+    catch {
+        return [];
+    }
+    const outcomes = [];
+    for (const name of names) {
+        try {
+            const cycle = JSON.parse(await readFile(join(improvementHome(), name), "utf8"));
+            const latest = cycle.feedback?.at(-1);
+            if (latest)
+                outcomes.push({
+                    id: cycle.id,
+                    outcome: latest.outcome,
+                    ...(latest.note ? { note: latest.note } : {}),
+                });
+        }
+        catch {
+            /* corrupt historical entries are ignored by proposal generation */
+        }
+    }
+    return outcomes;
+}
+export function improvementPrompt(cycle) {
+    const selected = cycle.selected;
+    return [
+        `# Loadout improvement cycle ${cycle.id}`,
+        "",
+        "You are improving Loadout using evidence, not guesses. Work only on the authorized developer branch.",
+        "",
+        "## Selected problem",
+        "",
+        selected?.problem ?? "No evidence-backed problem is currently selected.",
+        "",
+        "## Evidence",
+        "",
+        ...(selected?.evidence.map((item) => `- ${item}`) ?? ["- None"]),
+        "",
+        "## Required outcome",
+        "",
+        selected?.outcome ?? "Keep the current system stable.",
+        "",
+        "## Acceptance tests",
+        "",
+        ...(selected?.acceptanceTests.map((item) => `- ${item}`) ?? [
+            "- No change required",
+        ]),
+        "",
+        "## Loop rules",
+        "",
+        "1. Inspect current behavior before editing.",
+        "2. Implement the smallest complete solution without weakening safety or scope.",
+        "3. Add regression tests and plain-language documentation.",
+        "4. Run relevant unit, integration, security, build, and demo checks.",
+        "5. Stop for human review when trust, permissions, compatibility claims, publishing, or release behavior changes.",
+        "6. Never expose secrets, execute untrusted package code, rewrite Git history, force-push, merge, or publish automatically.",
+        "7. Record exact evidence, remaining risks, and the next priority.",
+        "",
+        "## Guardrails",
+        "",
+        ...cycle.guardrails.map((item) => `- ${item}`),
+        "",
+    ].join("\n");
+}
+export async function writeImprovementCycle(cycle, directory = improvementHome()) {
+    const root = resolve(directory);
+    await mkdir(root, { recursive: true });
+    const json = join(root, `${cycle.id}.json`);
+    const prompt = join(root, `${cycle.id}.md`);
+    await writeFile(json, `${JSON.stringify(cycle, null, 2)}\n`, {
+        mode: 0o600,
+        flag: "wx",
+    });
+    await writeFile(prompt, improvementPrompt(cycle), {
+        mode: 0o600,
+        flag: "wx",
+    });
+    return { json, prompt };
+}
+export async function recordImprovementOutcome(id, outcome, note, directory = improvementHome()) {
+    if (!/^[A-Za-z0-9-]+$/.test(id))
+        throw new Error("Invalid improvement cycle id");
+    if (note && note.length > 1_000)
+        throw new Error("Improvement outcome note is too long");
+    if (note && detectSecretKinds(note).length)
+        throw new Error("Improvement outcome note appears to contain secret material");
+    const path = join(resolve(directory), `${id}.json`);
+    const cycle = JSON.parse(await readFile(path, "utf8"));
+    if (cycle.id !== id)
+        throw new Error("Improvement cycle id does not match its file");
+    cycle.feedback = [
+        ...(cycle.feedback ?? []),
+        {
+            outcome,
+            ...(note ? { note } : {}),
+            recordedAt: new Date().toISOString(),
+        },
+    ];
+    await writeFile(path, `${JSON.stringify(cycle, null, 2)}\n`, { mode: 0o600 });
+    return cycle;
+}

package/dist/src/core/install.js

@@ -0,0 +1,233 @@
+import { existsSync } from "node:fs";
+import { cp, lstat, rm } from "node:fs/promises";
+import { basename, dirname, join, posix, relative, win32 } from "node:path";
+import { ensureDirectory, loadoutHome } from "./paths.js";
+import { planAdapterSkillInstall } from "./adapters.js";
+import { applySkillPlan, detectInstallConflicts, validateSkillDirectory, } from "./skills.js";
+import { activationLibraryPath, installStatePath, recordInstall, recordInstallBatch, recordLibraryInstallBatch, readInstallState, hashDirectory, } from "./state.js";
+import { runMutationTransaction } from "./transaction.js";
+export function installedAgents(agents, requested) {
+    const available = agents.filter((agent) => agent.installed);
+    if (!requested || requested.length === 0)
+        return available;
+    const selected = available.filter((agent) => requested.includes(agent.id));
+    if (selected.length !== requested.length) {
+        const missing = requested.filter((id) => !selected.some((agent) => agent.id === id));
+        throw new Error(`Requested agents are not detected: ${missing.join(", ")}`);
+    }
+    return selected;
+}
+async function assertActiveTargetsUnoccupied(plans, options = {}) {
+    const occupied = [];
+    for (const target of [
+        ...new Set(plans.flatMap((plan) => plan.files.map((file) => file.target))),
+    ])
+        try {
+            await lstat(target);
+            occupied.push(target);
+        }
+        catch (error) {
+            if (!error ||
+                typeof error !== "object" ||
+                !("code" in error) ||
+                error.code !== "ENOENT")
+                throw error;
+        }
+    if (occupied.length && options.allowManagedReplacement) {
+        const state = await readInstallState();
+        const allowed = new Set(plans.flatMap((plan) => {
+            const install = state.installs.find((record) => record.packageId === plan.packageId);
+            const packageActivations = (state.activations ?? []).filter((record) => record.packageId === plan.packageId);
+            const active = packageActivations.length === 0 ||
+                packageActivations.some((record) => record.installationState === "installed" &&
+                    record.activationState === "active");
+            if (!install || !active)
+                return [];
+            const recorded = install.files
+                .filter((file) => basename(file.path) === "SKILL.md")
+                .map((file) => dirname(file.path));
+            const legacy = packageActivations.length
+                ? []
+                : plan.files
+                    .map((file) => file.target)
+                    .filter((target) => basename(target) === plan.packageId);
+            return [...recorded, ...legacy];
+        }));
+        if (occupied.every((target) => allowed.has(target)))
+            return;
+    }
+    if (occupied.length)
+        throw new Error(`Installation refuses ${occupied.length} occupied skill target(s); scan, compare, or adopt them first. First target: ${occupied[0]}`);
+}
+export async function buildSkillPlan(source, packageId, agents, options = {}) {
+    if (!existsSync(source))
+        throw new Error(`Package source does not exist: ${source}`);
+    const sourceStat = await lstat(source);
+    if (!sourceStat.isDirectory() || sourceStat.isSymbolicLink()) {
+        throw new Error(`Package source must be a real directory: ${source}`);
+    }
+    // A repository may contain one skill at its root or several nested skills.
+    // Validate the root when present; planSkillInstall validates every nested skill.
+    if (existsSync(join(source, "SKILL.md")) &&
+        (!options.include ||
+            options.include({
+                path: source,
+                targetName: basename(source),
+            })))
+        await validateSkillDirectory(source);
+    const plans = await Promise.all(agents.map((agent) => planAdapterSkillInstall(source, packageId, agent, options)));
+    const files = plans.flatMap((plan) => plan.files);
+    const conflicts = detectInstallConflicts([
+        {
+            packageId,
+            files,
+            targetAgents: agents.map((agent) => agent.id),
+            warnings: [],
+        },
+    ]);
+    return {
+        packageId,
+        files,
+        targetAgents: agents.map((agent) => agent.id),
+        warnings: conflicts
+            .filter((item) => item.severity === "warning")
+            .map((item) => item.message),
+        conflicts,
+    };
+}
+export async function applySkillInstall(plan, metadata, options = {}) {
+    const blocking = (plan.conflicts ?? []).filter((conflict) => conflict.severity === "blocking");
+    if (blocking.length > 0)
+        throw new Error(`Installation blocked by conflicts: ${blocking.map((conflict) => conflict.message).join("; ")}`);
+    const applied = await runMutationTransaction(async () => {
+        await options.validateCurrentState?.();
+        await assertActiveTargetsUnoccupied([plan], options);
+        return {
+            targets: [...plan.files.map((file) => file.target), installStatePath()],
+            value: plan,
+        };
+    }, async (freshPlan, snapshot) => {
+        if (options.replaceManagedTargets)
+            for (const target of [
+                ...new Set(freshPlan.files.map((file) => file.target)),
+            ])
+                await rm(target, { recursive: true, force: true });
+        await applySkillPlan(freshPlan);
+        if (options.replaceManagedTargets)
+            for (const file of freshPlan.files) {
+                const expected = (await hashDirectory(file.source))
+                    .map((entry) => ({
+                    path: relative(file.source, entry.path),
+                    sha256: entry.sha256,
+                }))
+                    .sort((left, right) => left.path.localeCompare(right.path));
+                const actual = (await hashDirectory(file.target))
+                    .map((entry) => ({
+                    path: relative(file.target, entry.path),
+                    sha256: entry.sha256,
+                }))
+                    .sort((left, right) => left.path.localeCompare(right.path));
+                if (JSON.stringify(actual) !== JSON.stringify(expected))
+                    throw new Error(`Exact update copy verification failed for ${file.target}`);
+            }
+        await recordInstall(freshPlan, snapshot.id, metadata);
+        await options.verifyBeforeCommit?.(snapshot.id);
+    });
+    return applied.snapshotId;
+}
+/** Apply all selected packages as one filesystem transaction and one state update. */
+export async function applySkillInstallBatch(entries, extraSnapshotPaths = []) {
+    if (!entries.length)
+        throw new Error("Installation batch is empty");
+    const conflicts = detectInstallConflicts(entries.map((entry) => entry.plan));
+    const blocking = conflicts.filter((conflict) => conflict.severity === "blocking");
+    if (blocking.length)
+        throw new Error(`Installation blocked by conflicts: ${blocking.map((item) => item.message).join("; ")}`);
+    const applied = await runMutationTransaction(async () => {
+        await assertActiveTargetsUnoccupied(entries.map((entry) => entry.plan));
+        for (const entry of entries) {
+            entry.plan.conflicts = [
+                ...(entry.plan.conflicts ?? []),
+                ...conflicts.filter((conflict) => conflict.packageIds.includes(entry.plan.packageId)),
+            ];
+            entry.plan.warnings = [
+                ...new Set([
+                    ...entry.plan.warnings,
+                    ...conflicts
+                        .filter((conflict) => conflict.severity === "warning" &&
+                        conflict.packageIds.includes(entry.plan.packageId))
+                        .map((conflict) => conflict.message),
+                ]),
+            ];
+        }
+        return {
+            targets: [
+                ...entries.flatMap((entry) => entry.plan.files.map((file) => file.target)),
+                installStatePath(),
+                ...extraSnapshotPaths,
+            ],
+            value: entries,
+        };
+    }, async (freshEntries, snapshot) => {
+        for (const entry of freshEntries)
+            await applySkillPlan(entry.plan);
+        await recordInstallBatch(freshEntries, snapshot.id);
+    });
+    return applied.snapshotId;
+}
+/**
+ * Download a batch into the reviewed library without exposing any skill to an
+ * agent yet. This is the safe destination for Maximum Library.
+ */
+export async function applySkillLibraryBatch(entries) {
+    if (!entries.length)
+        throw new Error("Library batch is empty");
+    const conflicts = detectInstallConflicts(entries.map((entry) => entry.plan));
+    const blocking = conflicts.filter((conflict) => conflict.severity === "blocking");
+    if (blocking.length)
+        throw new Error(`Library installation blocked by conflicts: ${blocking.map((item) => item.message).join("; ")}`);
+    const libraryPaths = [
+        ...new Set(entries.flatMap((entry) => entry.plan.targetAgents.map((agent) => activationLibraryPath(entry.plan.packageId, agent)))),
+    ];
+    const applied = await runMutationTransaction(async () => {
+        const state = await readInstallState();
+        const selected = new Set(entries.map((entry) => entry.plan.packageId));
+        const active = (state.activations ?? []).filter((record) => selected.has(record.packageId) &&
+            record.installationState === "installed" &&
+            record.activationState === "active");
+        if (active.length)
+            throw new Error(`Maximum Library will not relabel ${active.length} active managed skill(s) as disabled. Disable the selected packages first, then retry.`);
+        return {
+            targets: [...libraryPaths, installStatePath()],
+            value: entries,
+        };
+    }, async (freshEntries, snapshot) => {
+        for (const path of libraryPaths)
+            await rm(path, { recursive: true, force: true });
+        for (const entry of freshEntries) {
+            for (const file of entry.plan.files) {
+                const agent = file.targetAgent ??
+                    (entry.plan.targetAgents.length === 1
+                        ? entry.plan.targetAgents[0]
+                        : undefined);
+                if (!agent)
+                    throw new Error(`Cannot place ${entry.plan.packageId} in the library: target agent is ambiguous`);
+                const unitId = basename(file.target);
+                const unitLibraryPath = activationLibraryPath(entry.plan.packageId, agent, unitId);
+                await ensureDirectory(unitLibraryPath);
+                const destination = join(unitLibraryPath, basename(file.target));
+                await cp(file.source, destination, {
+                    recursive: true,
+                    errorOnExist: true,
+                    force: false,
+                });
+            }
+        }
+        await recordLibraryInstallBatch(freshEntries, snapshot.id);
+    });
+    return applied.snapshotId;
+}
+export function snapshotPath(snapshotId, environment = process.env, platform = process.platform) {
+    const path = platform === "win32" ? win32 : posix;
+    return path.join(loadoutHome(environment, platform), "snapshots", `${snapshotId}.json`);
+}

package/dist/src/core/intelligence-feed-build.js

@@ -0,0 +1,59 @@
+import { intelligenceFeedPayloadSchema, } from "./intelligence-feed.js";
+function publicDiscoveryArtifact(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Discovery artifact must be an object");
+    const artifact = value;
+    if (artifact.schemaVersion !== 1 ||
+        typeof artifact.generatedAt !== "string" ||
+        !Number.isFinite(Date.parse(artifact.generatedAt)) ||
+        !Array.isArray(artifact.repositories) ||
+        artifact.repositories.length > 5_000)
+        throw new Error("Discovery artifact schema is invalid");
+    const seen = new Set();
+    for (const repository of artifact.repositories) {
+        if (!repository ||
+            typeof repository.repository !== "string" ||
+            !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository.repository) ||
+            repository.url !== `https://github.com/${repository.repository}` ||
+            !["candidate", "reviewed"].includes(repository.catalogStatus))
+            throw new Error("Discovery repository contains a non-public or invalid identity");
+        const key = repository.repository.toLowerCase();
+        if (seen.has(key))
+            throw new Error(`Duplicate discovery repository: ${key}`);
+        seen.add(key);
+    }
+    return artifact;
+}
+/**
+ * Convert central public discovery metadata into the signed feed's strict public
+ * subset. Descriptions, code, prompts, project data, and private identities are
+ * deliberately not accepted by this API.
+ */
+export function buildIntelligenceFeedPayload(options) {
+    const discovery = publicDiscoveryArtifact(options.discovery);
+    return intelligenceFeedPayloadSchema.parse({
+        schemaVersion: 1,
+        sequence: options.sequence,
+        createdAt: discovery.generatedAt,
+        expiresAt: options.expiresAt,
+        publicDataOnly: true,
+        discoveryObservations: discovery.repositories.map((repository) => ({
+            id: `github:${repository.repository.toLowerCase()}`,
+            source: "github",
+            observedAt: repository.lastObservedAt ??
+                repository.firstObservedAt ??
+                discovery.generatedAt,
+            sourceUrl: repository.url,
+            identityKey: `github:${repository.repository.toLowerCase()}`,
+            signal: repository.catalogStatus === "reviewed"
+                ? "public repository observed; separately present in the reviewed catalog"
+                : "public repository observed; candidate only, not trusted or recommended",
+        })),
+        compatibilityNotices: options.compatibilityNotices ?? [],
+        candidateSummaries: options.candidateSummaries ?? [],
+        benchmarkChanges: options.benchmarkChanges ?? [],
+        ...(options.catalogRelease
+            ? { catalogRelease: options.catalogRelease }
+            : {}),
+    });
+}