mewkit 1.10.2 → 1.10.3

package/dist/core/install-metadata.d.ts

@@ -0,0 +1,158 @@
+import { z } from "zod";
+export declare const INSTALL_METADATA_FILENAME = "metadata.json";
+export declare const InstallFileEntrySchema: z.ZodObject<{
+    path: z.ZodString;
+    owner: z.ZodEnum<["meowkit", "user", "meowkit-modified"]>;
+    layer: z.ZodEnum<["core", "skill", "user"]>;
+    checksum: z.ZodString;
+    baseChecksum: z.ZodString;
+    installedVersion: z.ZodOptional<z.ZodString>;
+    sourceTimestamp: z.ZodOptional<z.ZodString>;
+    installedAt: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    checksum: string;
+    owner: "user" | "meowkit" | "meowkit-modified";
+    layer: "core" | "skill" | "user";
+    baseChecksum: string;
+    installedVersion?: string | undefined;
+    sourceTimestamp?: string | undefined;
+    installedAt?: string | undefined;
+}, {
+    path: string;
+    checksum: string;
+    owner: "user" | "meowkit" | "meowkit-modified";
+    layer: "core" | "skill" | "user";
+    baseChecksum: string;
+    installedVersion?: string | undefined;
+    sourceTimestamp?: string | undefined;
+    installedAt?: string | undefined;
+}>;
+export type InstallFileEntry = z.infer<typeof InstallFileEntrySchema>;
+export declare const InstallMetadataSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"1.0">;
+    tool: z.ZodDefault<z.ZodString>;
+    version: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    installedAt: z.ZodString;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        owner: z.ZodEnum<["meowkit", "user", "meowkit-modified"]>;
+        layer: z.ZodEnum<["core", "skill", "user"]>;
+        checksum: z.ZodString;
+        baseChecksum: z.ZodString;
+        installedVersion: z.ZodOptional<z.ZodString>;
+        sourceTimestamp: z.ZodOptional<z.ZodString>;
+        installedAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        checksum: string;
+        owner: "user" | "meowkit" | "meowkit-modified";
+        layer: "core" | "skill" | "user";
+        baseChecksum: string;
+        installedVersion?: string | undefined;
+        sourceTimestamp?: string | undefined;
+        installedAt?: string | undefined;
+    }, {
+        path: string;
+        checksum: string;
+        owner: "user" | "meowkit" | "meowkit-modified";
+        layer: "core" | "skill" | "user";
+        baseChecksum: string;
+        installedVersion?: string | undefined;
+        sourceTimestamp?: string | undefined;
+        installedAt?: string | undefined;
+    }>, "many">;
+    settings: z.ZodOptional<z.ZodObject<{
+        merged: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        merged: string[];
+    }, {
+        merged: string[];
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    version: string;
+    files: {
+        path: string;
+        checksum: string;
+        owner: "user" | "meowkit" | "meowkit-modified";
+        layer: "core" | "skill" | "user";
+        baseChecksum: string;
+        installedVersion?: string | undefined;
+        sourceTimestamp?: string | undefined;
+        installedAt?: string | undefined;
+    }[];
+    installedAt: string;
+    schemaVersion: "1.0";
+    tool: string;
+    scope?: string | undefined;
+    settings?: {
+        merged: string[];
+    } | undefined;
+}, {
+    version: string;
+    files: {
+        path: string;
+        checksum: string;
+        owner: "user" | "meowkit" | "meowkit-modified";
+        layer: "core" | "skill" | "user";
+        baseChecksum: string;
+        installedVersion?: string | undefined;
+        sourceTimestamp?: string | undefined;
+        installedAt?: string | undefined;
+    }[];
+    installedAt: string;
+    schemaVersion: "1.0";
+    tool?: string | undefined;
+    scope?: string | undefined;
+    settings?: {
+        merged: string[];
+    } | undefined;
+}>;
+export type InstallMetadata = z.infer<typeof InstallMetadataSchema>;
+export type MetadataSource = "new" | "legacy-manifest" | "legacy-metadata" | "none";
+export interface ReadInstallMetadataResult {
+    source: MetadataSource;
+    meta: InstallMetadata | null;
+}
+/** Thrown when a canonical metadata.json carries `schemaVersion` but fails validation. */
+export declare class CorruptInstallMetadataError extends Error {
+    readonly detail: string;
+    constructor(detail: string);
+}
+/** Index a file-entry list by its `.claude/`-relative path. */
+export declare function indexByPath(entries: InstallFileEntry[]): Record<string, InstallFileEntry>;
+/**
+ * Read installed metadata with explicit source precedence:
+ *   new (schemaVersion) > legacy checksum manifest > version-only metadata > none.
+ * The legacy-manifest branch never trusts `Manifest.version` (hardcoded upstream);
+ * it sources the version from a sibling version-only metadata.json when present.
+ * Throws CorruptInstallMetadataError when a schemaVersion-bearing file fails Zod.
+ */
+export declare function readInstallMetadata(claudeDir: string): ReadInstallMetadataResult;
+/**
+ * Read ONLY the legacy `meowkit.manifest.json` as canonical-shaped metadata,
+ * or null when absent. Used as a recovery path when the canonical metadata.json
+ * is present but corrupt, so user-edit protection still has a prior baseline.
+ */
+export declare function readLegacyManifestMetadata(claudeDir: string): InstallMetadata | null;
+export interface BuildInstallMetadataOptions {
+    /** Installed kit version (from release-manifest). */
+    version: string;
+    /** Per-path source commit timestamp (release-manifest `lastModified`). */
+    sourceTimestamps?: Record<string, string>;
+    /** Prior installed entries, indexed by `.claude/`-relative path. */
+    priorEntriesByPath?: Record<string, InstallFileEntry>;
+    /** Optional install scope marker (e.g. "local"). */
+    scope?: string;
+    /** settings.json files merged this install. */
+    mergedSettings?: string[];
+}
+/**
+ * Scan an installed `.claude/` and build canonical metadata. Ownership for kit
+ * (core/skill) files is computed against the prior state: a kit file whose disk
+ * hash differs from its prior `baseChecksum` is labeled `meowkit-modified`;
+ * `baseChecksum` preserves the as-shipped hash across upgrades.
+ */
+export declare function buildInstallMetadata(claudeDir: string, opts: BuildInstallMetadataOptions): InstallMetadata;
+//# sourceMappingURL=install-metadata.d.ts.map

package/dist/core/install-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-metadata.d.ts","sourceRoot":"","sources":["../../src/core/install-metadata.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,yBAAyB,kBAAkB,CAAC;AAEzD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;EASjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,MAAM,CAAC;AACpF,MAAM,WAAW,yBAAyB;IACzC,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;CAC7B;AAED,0FAA0F;AAC1F,qBAAa,2BAA4B,SAAQ,KAAK;aACzB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI1C;AAED,+DAA+D;AAC/D,wBAAgB,WAAW,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAIzF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAyChF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAGpF;AA6BD,MAAM,WAAW,2BAA2B;IAC3C,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtD,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,GAAG,eAAe,CA2C1G"}

package/dist/core/install-metadata.js

@@ -0,0 +1,180 @@
+// Canonical installed-metadata model for a MeowKit install under `.claude/`.
+// Declares the Zod schema, a compatibility reader that recognizes the new file,
+// the legacy checksum manifest, and the old version-only metadata, and a builder
+// that labels per-file ownership (meowkit / user / meowkit-modified) against the
+// prior installed state. The locked atomic writer lives in install-metadata-writer.ts.
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { collectFiles, hashFile, classifyLayer, readManifest } from "./compute-checksums.js";
+export const INSTALL_METADATA_FILENAME = "metadata.json";
+export const InstallFileEntrySchema = z.object({
+    path: z.string(),
+    owner: z.enum(["meowkit", "user", "meowkit-modified"]),
+    layer: z.enum(["core", "skill", "user"]),
+    checksum: z.string(),
+    baseChecksum: z.string(),
+    installedVersion: z.string().optional(),
+    sourceTimestamp: z.string().optional(),
+    installedAt: z.string().optional(),
+});
+export const InstallMetadataSchema = z.object({
+    schemaVersion: z.literal("1.0"),
+    tool: z.string().default("meowkit"),
+    version: z.string(),
+    scope: z.string().optional(),
+    installedAt: z.string(),
+    files: z.array(InstallFileEntrySchema),
+    settings: z.object({ merged: z.array(z.string()) }).optional(),
+});
+/** Thrown when a canonical metadata.json carries `schemaVersion` but fails validation. */
+export class CorruptInstallMetadataError extends Error {
+    detail;
+    constructor(detail) {
+        super(`Corrupt .claude/metadata.json: ${detail}`);
+        this.detail = detail;
+        this.name = "CorruptInstallMetadataError";
+    }
+}
+/** Index a file-entry list by its `.claude/`-relative path. */
+export function indexByPath(entries) {
+    const out = {};
+    for (const e of entries)
+        out[e.path] = e;
+    return out;
+}
+/**
+ * Read installed metadata with explicit source precedence:
+ *   new (schemaVersion) > legacy checksum manifest > version-only metadata > none.
+ * The legacy-manifest branch never trusts `Manifest.version` (hardcoded upstream);
+ * it sources the version from a sibling version-only metadata.json when present.
+ * Throws CorruptInstallMetadataError when a schemaVersion-bearing file fails Zod.
+ */
+export function readInstallMetadata(claudeDir) {
+    const metadataPath = join(claudeDir, INSTALL_METADATA_FILENAME);
+    let legacyMetadataVersion = null;
+    if (existsSync(metadataPath)) {
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(metadataPath, "utf-8"));
+        }
+        catch {
+            // mid-write or garbage; `parsed` stays undefined and we fall through.
+        }
+        if (typeof parsed === "object" && parsed !== null) {
+            const obj = parsed;
+            if ("schemaVersion" in obj) {
+                const result = InstallMetadataSchema.safeParse(parsed);
+                if (!result.success)
+                    throw new CorruptInstallMetadataError(result.error.message);
+                return { source: "new", meta: result.data };
+            }
+            if (typeof obj.version === "string")
+                legacyMetadataVersion = obj.version;
+        }
+    }
+    const legacyManifest = readManifest(claudeDir);
+    if (legacyManifest !== null) {
+        return { source: "legacy-manifest", meta: mapLegacyManifest(legacyManifest, legacyMetadataVersion) };
+    }
+    if (legacyMetadataVersion !== null) {
+        return {
+            source: "legacy-metadata",
+            meta: {
+                schemaVersion: "1.0",
+                tool: "meowkit",
+                version: legacyMetadataVersion,
+                installedAt: "",
+                files: [],
+            },
+        };
+    }
+    return { source: "none", meta: null };
+}
+/**
+ * Read ONLY the legacy `meowkit.manifest.json` as canonical-shaped metadata,
+ * or null when absent. Used as a recovery path when the canonical metadata.json
+ * is present but corrupt, so user-edit protection still has a prior baseline.
+ */
+export function readLegacyManifestMetadata(claudeDir) {
+    const manifest = readManifest(claudeDir);
+    return manifest === null ? null : mapLegacyManifest(manifest, null);
+}
+/**
+ * Project a legacy `meowkit.manifest.json` onto the canonical shape. The legacy
+ * `sha256` maps to BOTH `checksum` and `baseChecksum` so the user-edit comparison
+ * stays equivalent. Version comes from a sibling version-only metadata.json or "".
+ */
+function mapLegacyManifest(manifest, legacyVersion) {
+    const files = [];
+    for (const [path, entry] of Object.entries(manifest.checksums)) {
+        files.push({
+            path,
+            owner: entry.owner ?? (entry.layer === "user" ? "user" : "meowkit"),
+            layer: entry.layer,
+            checksum: entry.sha256,
+            baseChecksum: entry.baseChecksum ?? entry.sha256,
+            installedVersion: entry.installedVersion,
+            installedAt: entry.installedAt,
+        });
+    }
+    return {
+        schemaVersion: "1.0",
+        tool: "meowkit",
+        version: legacyVersion ?? "",
+        installedAt: manifest.generatedAt,
+        files,
+    };
+}
+/**
+ * Scan an installed `.claude/` and build canonical metadata. Ownership for kit
+ * (core/skill) files is computed against the prior state: a kit file whose disk
+ * hash differs from its prior `baseChecksum` is labeled `meowkit-modified`;
+ * `baseChecksum` preserves the as-shipped hash across upgrades.
+ */
+export function buildInstallMetadata(claudeDir, opts) {
+    const installedAt = new Date().toISOString();
+    const prior = opts.priorEntriesByPath ?? {};
+    const timestamps = opts.sourceTimestamps ?? {};
+    const files = [];
+    for (const relPath of collectFiles(claudeDir, claudeDir)) {
+        const diskHash = hashFile(join(claudeDir, relPath));
+        const layer = classifyLayer(relPath);
+        const priorEntry = prior[relPath];
+        const baseChecksum = priorEntry ? priorEntry.baseChecksum : diskHash;
+        let owner;
+        if (layer === "user")
+            owner = "user";
+        else if (!priorEntry || diskHash === priorEntry.baseChecksum)
+            owner = "meowkit";
+        else
+            owner = "meowkit-modified";
+        const entry = {
+            path: relPath,
+            owner,
+            layer,
+            checksum: diskHash,
+            baseChecksum,
+            installedVersion: opts.version,
+            installedAt,
+        };
+        const sourceTimestamp = timestamps[relPath];
+        if (sourceTimestamp)
+            entry.sourceTimestamp = sourceTimestamp;
+        files.push(entry);
+    }
+    files.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    const meta = {
+        schemaVersion: "1.0",
+        tool: "meowkit",
+        version: opts.version,
+        installedAt,
+        files,
+    };
+    if (opts.scope)
+        meta.scope = opts.scope;
+    if (opts.mergedSettings && opts.mergedSettings.length > 0)
+        meta.settings = { merged: opts.mergedSettings };
+    return meta;
+}
+//# sourceMappingURL=install-metadata.js.map

package/dist/core/install-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-metadata.js","sourceRoot":"","sources":["../../src/core/install-metadata.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAEzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAC;AASH,0FAA0F;AAC1F,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACzB;IAA5B,YAA4B,MAAc;QACzC,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;QADvB,WAAM,GAAN,MAAM,CAAQ;QAEzC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC3C,CAAC;CACD;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CAAC,OAA2B;IACtD,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAChE,IAAI,qBAAqB,GAAkB,IAAI,CAAC;IAEhD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACR,sEAAsE;QACvE,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,IAAI,eAAe,IAAI,GAAG,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,2BAA2B,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACjF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7C,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAAE,qBAAqB,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1E,CAAC;IACF,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,CAAC,cAAc,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACtG,CAAC;IAED,IAAI,qBAAqB,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO;YACN,MAAM,EAAE,iBAAiB;YACzB,IAAI,EAAE;gBACL,aAAa,EAAE,KAAK;gBACpB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,qBAAqB;gBAC9B,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,EAAE;aACT;SACD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC3D,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAkB,EAAE,aAA4B;IAC1E,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC;YACV,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACnE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM;YAChD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC9B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO;QACN,aAAa,EAAE,KAAK;QACpB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,aAAa,IAAI,EAAE;QAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK;KACL,CAAC;AACH,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,IAAiC;IACxF,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAuB,EAAE,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;QAErE,IAAI,KAAgC,CAAC;QACrC,IAAI,KAAK,KAAK,MAAM;YAAE,KAAK,GAAG,MAAM,CAAC;aAChC,IAAI,CAAC,UAAU,IAAI,QAAQ,KAAK,UAAU,CAAC,YAAY;YAAE,KAAK,GAAG,SAAS,CAAC;;YAC3E,KAAK,GAAG,kBAAkB,CAAC;QAEhC,MAAM,KAAK,GAAqB;YAC/B,IAAI,EAAE,OAAO;YACb,KAAK;YACL,KAAK;YACL,QAAQ,EAAE,QAAQ;YAClB,YAAY;YACZ,gBAAgB,EAAE,IAAI,CAAC,OAAO;YAC9B,WAAW;SACX,CAAC;QACF,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,eAAe;YAAE,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,MAAM,IAAI,GAAoB;QAC7B,aAAa,EAAE,KAAK;QACpB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW;QACX,KAAK;KACL,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAC3G,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/core/release-metadata.d.ts

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import type { Manifest } from "./compute-checksums.js";
+export declare const RELEASE_MANIFEST_FILENAME = "release-manifest.json";
+export declare const ReleaseFileEntrySchema: z.ZodObject<{
+    path: z.ZodString;
+    checksum: z.ZodString;
+    size: z.ZodOptional<z.ZodNumber>;
+    lastModified: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    checksum: string;
+    size?: number | undefined;
+    lastModified?: string | undefined;
+}, {
+    path: string;
+    checksum: string;
+    size?: number | undefined;
+    lastModified?: string | undefined;
+}>;
+export type ReleaseFileEntry = z.infer<typeof ReleaseFileEntrySchema>;
+export declare const ReleaseManifestSchema: z.ZodObject<{
+    version: z.ZodString;
+    generatedAt: z.ZodString;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        checksum: z.ZodString;
+        size: z.ZodOptional<z.ZodNumber>;
+        lastModified: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        checksum: string;
+        size?: number | undefined;
+        lastModified?: string | undefined;
+    }, {
+        path: string;
+        checksum: string;
+        size?: number | undefined;
+        lastModified?: string | undefined;
+    }>, "many">;
+    deletions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    version: string;
+    generatedAt: string;
+    files: {
+        path: string;
+        checksum: string;
+        size?: number | undefined;
+        lastModified?: string | undefined;
+    }[];
+    deletions: string[];
+}, {
+    version: string;
+    generatedAt: string;
+    files: {
+        path: string;
+        checksum: string;
+        size?: number | undefined;
+        lastModified?: string | undefined;
+    }[];
+    deletions?: string[] | undefined;
+}>;
+export type ReleaseManifest = z.infer<typeof ReleaseManifestSchema>;
+/** Thrown when `release-manifest.json` is present but does not match the schema. */
+export declare class CorruptReleaseManifestError extends Error {
+    readonly detail: string;
+    constructor(detail: string);
+}
+/**
+ * Read `release-manifest.json` from an extracted release root.
+ * Returns null when the file is absent; throws on a present-but-corrupt manifest.
+ */
+export declare function readReleaseMetadata(sourceDir: string): ReleaseManifest | null;
+/** Map each release file path to its source commit timestamp (when recorded). */
+export declare function mapPathToLastModified(release: ReleaseManifest | null): Record<string, string>;
+/**
+ * Project a release manifest onto the `Manifest` shape `findOrphans` consumes —
+ * only the checksum keys matter for orphan detection.
+ */
+export declare function toOrphanManifest(release: ReleaseManifest): Manifest;
+//# sourceMappingURL=release-metadata.d.ts.map

package/dist/core/release-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-metadata.d.ts","sourceRoot":"","sources":["../../src/core/release-metadata.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;EAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,oFAAoF;AACpF,qBAAa,2BAA4B,SAAQ,KAAK;aACzB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI1C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAY7E;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAMnE"}

package/dist/core/release-metadata.js

@@ -0,0 +1,70 @@
+// CLI-side reader for the release-metadata carrier: `release-manifest.json` at
+// the extracted release root. This is the single parser for that file — it
+// supplies the installed kit version, per-file source timestamps, and the
+// optional maintainer-curated `deletions[]` list.
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+export const RELEASE_MANIFEST_FILENAME = "release-manifest.json";
+export const ReleaseFileEntrySchema = z.object({
+    path: z.string(),
+    checksum: z.string(),
+    size: z.number().optional(),
+    lastModified: z.string().optional(),
+});
+export const ReleaseManifestSchema = z.object({
+    version: z.string(),
+    generatedAt: z.string(),
+    files: z.array(ReleaseFileEntrySchema),
+    deletions: z.array(z.string()).default([]),
+});
+/** Thrown when `release-manifest.json` is present but does not match the schema. */
+export class CorruptReleaseManifestError extends Error {
+    detail;
+    constructor(detail) {
+        super(`Corrupt release-manifest.json: ${detail}`);
+        this.detail = detail;
+        this.name = "CorruptReleaseManifestError";
+    }
+}
+/**
+ * Read `release-manifest.json` from an extracted release root.
+ * Returns null when the file is absent; throws on a present-but-corrupt manifest.
+ */
+export function readReleaseMetadata(sourceDir) {
+    const manifestPath = join(sourceDir, RELEASE_MANIFEST_FILENAME);
+    if (!existsSync(manifestPath))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(manifestPath, "utf-8"));
+    }
+    catch (err) {
+        throw new CorruptReleaseManifestError(err.message);
+    }
+    const result = ReleaseManifestSchema.safeParse(parsed);
+    if (!result.success)
+        throw new CorruptReleaseManifestError(result.error.message);
+    return result.data;
+}
+/** Map each release file path to its source commit timestamp (when recorded). */
+export function mapPathToLastModified(release) {
+    const out = {};
+    for (const f of release?.files ?? []) {
+        if (f.lastModified)
+            out[f.path] = f.lastModified;
+    }
+    return out;
+}
+/**
+ * Project a release manifest onto the `Manifest` shape `findOrphans` consumes —
+ * only the checksum keys matter for orphan detection.
+ */
+export function toOrphanManifest(release) {
+    const checksums = {};
+    for (const f of release.files) {
+        checksums[f.path] = { sha256: f.checksum, layer: "core" };
+    }
+    return { version: release.version, generatedAt: release.generatedAt, checksums };
+}
+//# sourceMappingURL=release-metadata.js.map

package/dist/core/release-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-metadata.js","sourceRoot":"","sources":["../../src/core/release-metadata.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,kDAAkD;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACzB;IAA5B,YAA4B,MAAc;QACzC,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;QADvB,WAAM,GAAN,MAAM,CAAQ;QAEzC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC3C,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,2BAA2B,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,2BAA2B,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACpE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,YAAY;YAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACxD,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;AAClF,CAAC"}

package/dist/core/smart-update.d.ts

@@ -6,6 +6,14 @@ export interface UpdateStats {
     userModified: string[];
     orphansDeleted: string[];
     orphansSkipped: string[];
+    /** Paths from release `deletions[]` removed because they were pristine kit-owned files. */
+    deletionsDeleted: string[];
+    /** Listed deletions left in place (user-modified, not kit-owned, or declined). */
+    deletionsSkipped: string[];
+    /** Listed deletions that were already absent on disk. */
+    deletionsAlreadyGone: string[];
+    /** Listed deletions a dry-run would remove. */
+    deletionsPreview: string[];
 }
 export interface SmartUpdateOptions {
     /** Default true. Set false to disable orphan deletion (CLI: `--no-cleanup`). */

package/dist/core/smart-update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smart-update.d.ts","sourceRoot":"","sources":["../../src/core/smart-update.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAO/D,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAClC,gFAAgF;IAChF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAChC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,EACf,KAAK,UAAQ,EACb,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAkQtB"}
+{"version":3,"file":"smart-update.d.ts","sourceRoot":"","sources":["../../src/core/smart-update.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAmB/D,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2FAA2F;IAC3F,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,yDAAyD;IACzD,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,+CAA+C;IAC/C,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IAClC,gFAAgF;IAChF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAChC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,EACf,KAAK,UAAQ,EACb,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,WAAW,CAAC,CA8VtB"}