primitive-admin 1.0.61 → 1.0.63

package/dist/src/lib/run-status.generated.d.ts

@@ -0,0 +1,39 @@
+/**
+ * GENERATED FILE — do not edit by hand.
+ *
+ * The canonical workflow-run status vocabulary, as the CLI sees it.
+ * Generated from the server's `src/workflows/run-status.ts` by
+ * `scripts/gen-run-status-mirrors.mjs` (`pnpm gen:run-status`), because
+ * the CLI is a separately built package and cannot import worker
+ * source. A stale copy is worse than a missing feature: a poll loop whose
+ * terminal set predates a new status hangs until its own timeout, so the
+ * freshness check in `tests/unit/workflows/run-status-mirrors.test.ts` fails
+ * the build rather than letting the two drift.
+ *
+ * Hand-maintained values that belong to the CLI alone (labels, badge
+ * colours, help text) live in `cli/src/lib/run-status.ts`, which re-exports
+ * everything below.
+ */
+export declare const RUN_STATUSES: readonly ["queued", "running", "apply_pending", "apply_claimed", "completed", "failed", "terminated", "missing", "skipped"];
+export type RunStatus = (typeof RUN_STATUSES)[number];
+/** Comma-separated list for help text and error messages. */
+export declare const RUN_STATUS_LIST: string;
+/** True terminal: the run reached a known end state. */
+export declare const TERMINAL_RUN_STATUSES: ReadonlySet<string>;
+/**
+ * Apply-flow states: the run finished executing but is parked waiting for a
+ * client to claim and apply its result. It will not advance on its own.
+ */
+export declare const APPLY_RUN_STATUSES: ReadonlySet<string>;
+/** In-flight statuses — the run has not settled and polling should continue. */
+export declare const IN_FLIGHT_RUN_STATUSES: ReadonlySet<string>;
+/**
+ * Settled statuses: terminal ∪ apply-flow ∪ `missing` — the complement of
+ * `IN_FLIGHT_RUN_STATUSES` over the canonical vocabulary.
+ *
+ * This is the set every poll loop stops on. Waiting past any of these is
+ * pointless: a terminal run is done, an apply-flow run is parked until a client
+ * acts, and a `missing` run has no live instance to observe.
+ */
+export declare const SETTLED_RUN_STATUSES: ReadonlySet<string>;
+export declare function isRunStatus(value: unknown): value is RunStatus;

package/dist/src/lib/run-status.generated.js

@@ -0,0 +1,66 @@
+/**
+ * GENERATED FILE — do not edit by hand.
+ *
+ * The canonical workflow-run status vocabulary, as the CLI sees it.
+ * Generated from the server's `src/workflows/run-status.ts` by
+ * `scripts/gen-run-status-mirrors.mjs` (`pnpm gen:run-status`), because
+ * the CLI is a separately built package and cannot import worker
+ * source. A stale copy is worse than a missing feature: a poll loop whose
+ * terminal set predates a new status hangs until its own timeout, so the
+ * freshness check in `tests/unit/workflows/run-status-mirrors.test.ts` fails
+ * the build rather than letting the two drift.
+ *
+ * Hand-maintained values that belong to the CLI alone (labels, badge
+ * colours, help text) live in `cli/src/lib/run-status.ts`, which re-exports
+ * everything below.
+ */
+export const RUN_STATUSES = [
+    "queued",
+    "running",
+    "apply_pending",
+    "apply_claimed",
+    "completed",
+    "failed",
+    "terminated",
+    "missing",
+    "skipped",
+];
+/** Comma-separated list for help text and error messages. */
+export const RUN_STATUS_LIST = RUN_STATUSES.join(", ");
+/** True terminal: the run reached a known end state. */
+export const TERMINAL_RUN_STATUSES = new Set([
+    "completed",
+    "failed",
+    "terminated",
+    "skipped",
+]);
+/**
+ * Apply-flow states: the run finished executing but is parked waiting for a
+ * client to claim and apply its result. It will not advance on its own.
+ */
+export const APPLY_RUN_STATUSES = new Set([
+    "apply_pending",
+    "apply_claimed",
+]);
+/** In-flight statuses — the run has not settled and polling should continue. */
+export const IN_FLIGHT_RUN_STATUSES = new Set([
+    "queued",
+    "running",
+]);
+/**
+ * Settled statuses: terminal ∪ apply-flow ∪ `missing` — the complement of
+ * `IN_FLIGHT_RUN_STATUSES` over the canonical vocabulary.
+ *
+ * This is the set every poll loop stops on. Waiting past any of these is
+ * pointless: a terminal run is done, an apply-flow run is parked until a client
+ * acts, and a `missing` run has no live instance to observe.
+ */
+export const SETTLED_RUN_STATUSES = new Set([
+    ...TERMINAL_RUN_STATUSES,
+    ...APPLY_RUN_STATUSES,
+    "missing",
+]);
+export function isRunStatus(value) {
+    return (typeof value === "string" && RUN_STATUSES.includes(value));
+}
+//# sourceMappingURL=run-status.generated.js.map

package/dist/src/lib/run-status.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-status.generated.js","sourceRoot":"","sources":["../../../src/lib/run-status.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ;IACR,SAAS;IACT,eAAe;IACf,eAAe;IACf,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,SAAS;CACD,CAAC;AAIX,6DAA6D;AAC7D,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEvD,wDAAwD;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAS;IACxE,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,SAAS;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAS;IACrE,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAS;IACzE,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAS;IACvE,GAAG,qBAAqB;IACxB,GAAG,kBAAkB;IACrB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACjF,CAAC;AACJ,CAAC"}

package/dist/src/lib/run-status.js

@@ -0,0 +1,19 @@
+/**
+ * The canonical workflow-run status vocabulary, as the CLI sees it (#2348).
+ *
+ * The server reconciles every status surface (the app status endpoints,
+ * `listRuns`, and all three admin status handlers) onto exactly these values
+ * before they go on the wire, so the CLI never has to re-derive terminality
+ * from a raw Cloudflare spelling (`complete`, `errored`, `waiting`) again.
+ * Those spellings no longer reach a client.
+ *
+ * #2636 — the vocabulary itself is no longer copied by hand: it is GENERATED
+ * from the server's `src/workflows/run-status.ts` into
+ * `run-status.generated.ts` (`pnpm gen:run-status`) and re-exported here, so a
+ * future status is a one-site edit plus regeneration rather than four
+ * hand-edits that a lagging copy turns into a hung poll loop. This module stays
+ * the ONE place `cli/` imports the vocabulary from — every command and
+ * formatter reads it from here.
+ */
+export { RUN_STATUSES, RUN_STATUS_LIST, TERMINAL_RUN_STATUSES, APPLY_RUN_STATUSES, IN_FLIGHT_RUN_STATUSES, SETTLED_RUN_STATUSES, isRunStatus, } from "./run-status.generated.js";
+//# sourceMappingURL=run-status.js.map

package/dist/src/lib/run-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-status.js","sourceRoot":"","sources":["../../../src/lib/run-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,GACZ,MAAM,2BAA2B,CAAC"}

package/dist/src/lib/server-text-normalization.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The CLI's mirror of the server's normalization of accepted TEXT fields
+ * (issue #2880, DSO-003) — the scalar sibling of `integration-request-config`.
+ *
+ * Every write handler for the types this issue converted rewrites the text it
+ * accepts: display names, workflow keys and bucket names are trimmed
+ * (`src/admin-api.ts` for integrations and webhooks,
+ * `cron-triggers-controller.ts`, `blob-buckets-controller.ts`), descriptions
+ * are trimmed and a blank one is stored as `null`, and a `signingSecret` is
+ * stored as the canonical `{{secrets.KEY}}` form (`canonicalSecretReference`).
+ * So a hand-authored `displayName = " Billing "` is not the value the server
+ * returns — and compared raw it is a `Modified` row on every run, with push
+ * re-applying an update that changes nothing. Baseline restamping cannot fix
+ * it: after an apply the remote hash equals the fresh baseline while the local
+ * hash still does not.
+ *
+ * Applied to BOTH sides of a comparison (a spec's `canonicalize` hook runs on
+ * the projection, whichever side it came from), so these must be idempotent —
+ * and so a value some older write path stored untrimmed compares equal to the
+ * trimmed text a file states, rather than the two disagreeing forever.
+ *
+ * Mirrored rather than imported, for the reason the request-config mirror
+ * gives: the published CLI must not import server `src/` at runtime. Every
+ * step is total — a value the server would REJECT is left exactly as authored,
+ * so the server's own error is what the operator sees.
+ */
+/** `displayName`, `workflowKey`, bucket `name`: trimmed, never emptied. */
+export declare function canonicalizeTrimmedText(value: unknown): unknown;
+/**
+ * `description`: trimmed, and a blank one is the same state as none at all.
+ *
+ * The handlers spell this two ways — `description.trim() || null` (integrations,
+ * webhooks) and a bare `description || null` (cron triggers, blob buckets) —
+ * which differ only for a whitespace-only string. Trimming here is the
+ * stricter, idempotent reading: `"  "` and `null` are one state on both sides
+ * either way, and a stored `" x "` from either path meets an authored `"x"`.
+ */
+export declare function canonicalizeOptionalText(value: unknown): unknown;
+export declare function canonicalizeSecretReference(value: unknown): unknown;
+/**
+ * Apply the rules above to a parsed entity, in place.
+ *
+ * `undefined` stays `undefined`: a key the entity does not carry is not a
+ * cleared one, and the projection's own emission rules decide what an absent
+ * value means.
+ */
+export declare function canonicalizeServerTextFields(entity: any, fields: {
+    trimmed?: readonly string[];
+    optional?: readonly string[];
+    secretReference?: readonly string[];
+}): void;

package/dist/src/lib/server-text-normalization.js

@@ -0,0 +1,90 @@
+/**
+ * The CLI's mirror of the server's normalization of accepted TEXT fields
+ * (issue #2880, DSO-003) — the scalar sibling of `integration-request-config`.
+ *
+ * Every write handler for the types this issue converted rewrites the text it
+ * accepts: display names, workflow keys and bucket names are trimmed
+ * (`src/admin-api.ts` for integrations and webhooks,
+ * `cron-triggers-controller.ts`, `blob-buckets-controller.ts`), descriptions
+ * are trimmed and a blank one is stored as `null`, and a `signingSecret` is
+ * stored as the canonical `{{secrets.KEY}}` form (`canonicalSecretReference`).
+ * So a hand-authored `displayName = " Billing "` is not the value the server
+ * returns — and compared raw it is a `Modified` row on every run, with push
+ * re-applying an update that changes nothing. Baseline restamping cannot fix
+ * it: after an apply the remote hash equals the fresh baseline while the local
+ * hash still does not.
+ *
+ * Applied to BOTH sides of a comparison (a spec's `canonicalize` hook runs on
+ * the projection, whichever side it came from), so these must be idempotent —
+ * and so a value some older write path stored untrimmed compares equal to the
+ * trimmed text a file states, rather than the two disagreeing forever.
+ *
+ * Mirrored rather than imported, for the reason the request-config mirror
+ * gives: the published CLI must not import server `src/` at runtime. Every
+ * step is total — a value the server would REJECT is left exactly as authored,
+ * so the server's own error is what the operator sees.
+ */
+/** `displayName`, `workflowKey`, bucket `name`: trimmed, never emptied. */
+export function canonicalizeTrimmedText(value) {
+    return typeof value === "string" ? value.trim() : value;
+}
+/**
+ * `description`: trimmed, and a blank one is the same state as none at all.
+ *
+ * The handlers spell this two ways — `description.trim() || null` (integrations,
+ * webhooks) and a bare `description || null` (cron triggers, blob buckets) —
+ * which differ only for a whitespace-only string. Trimming here is the
+ * stricter, idempotent reading: `"  "` and `null` are one state on both sides
+ * either way, and a stored `" x "` from either path meets an authored `"x"`.
+ */
+export function canonicalizeOptionalText(value) {
+    if (typeof value !== "string")
+        return value;
+    const trimmed = value.trim();
+    return trimmed === "" ? null : trimmed;
+}
+/**
+ * A whole `{{secrets.KEY}}` reference, in the canonical at-rest spelling.
+ *
+ * Mirrors `canonicalSecretReference`: interior spacing is dropped and the value
+ * is trimmed, because a stored reference has to resolve to exactly the secret's
+ * value. Anything that is not plainly one whole reference is returned as
+ * authored — including a reference spoiled by invisible text beside it, which
+ * the server refuses (`isSpoiledSecretReference`, #2297): only ORDINARY
+ * whitespace is stripped here, so a value carrying a byte-order mark does not
+ * quietly canonicalize into the reference the server will not store.
+ */
+const WHOLE_SECRET_REFERENCE_RE = /^\{\{[ \t]*secrets\.([A-Z][A-Z0-9_]{0,63})[ \t]*\}\}$/;
+export function canonicalizeSecretReference(value) {
+    if (typeof value !== "string")
+        return value;
+    const match = WHOLE_SECRET_REFERENCE_RE.exec(value.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, ""));
+    return match ? `{{secrets.${match[1]}}}` : value;
+}
+/**
+ * Apply the rules above to a parsed entity, in place.
+ *
+ * `undefined` stays `undefined`: a key the entity does not carry is not a
+ * cleared one, and the projection's own emission rules decide what an absent
+ * value means.
+ */
+export function canonicalizeServerTextFields(entity, fields) {
+    if (!entity || typeof entity !== "object")
+        return;
+    for (const field of fields.trimmed ?? []) {
+        if (entity[field] === undefined)
+            continue;
+        entity[field] = canonicalizeTrimmedText(entity[field]);
+    }
+    for (const field of fields.optional ?? []) {
+        if (entity[field] === undefined)
+            continue;
+        entity[field] = canonicalizeOptionalText(entity[field]);
+    }
+    for (const field of fields.secretReference ?? []) {
+        if (entity[field] === undefined)
+            continue;
+        entity[field] = canonicalizeSecretReference(entity[field]);
+    }
+}
+//# sourceMappingURL=server-text-normalization.js.map

package/dist/src/lib/server-text-normalization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-text-normalization.js","sourceRoot":"","sources":["../../../src/lib/server-text-normalization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAC7B,uDAAuD,CAAC;AAE1D,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAC1C,KAAK,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAC9C,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAW,EACX,MAIC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO;IAClD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,SAAS;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,SAAS;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,SAAS;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,2BAA2B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC"}

package/dist/src/lib/server-url.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The one server-URL validator the CLI shares (issue #2927).
+ *
+ * It returns the `string | true` shape `@inquirer/prompts` expects from a
+ * `validate` callback, so the same function backs the `primitive init` prompt,
+ * the `--server` flag check and init-config validation, `project-config.ts`'s
+ * `apiUrl` check, and `env add --api-url`. It used to live in the
+ * init-specific `resolve-init-server.ts` while the last two hand-rolled their
+ * own `try { new URL(x) } catch`.
+ *
+ * The parse deliberately runs on the *raw* string: JavaScript `trim()` strips
+ * Unicode whitespace (U+00A0, U+2028, U+FEFF, …) that the WHATWG URL parser
+ * does not, so trimming first would accept values like `" https://x"`
+ * that later URL construction cannot use — and `env add` would persist them.
+ * `trim()` is therefore used only to decide whether the input is empty; the
+ * URL parser already ignores the ASCII padding it is willing to strip.
+ */
+/**
+ * Validates a server URL. Returns `true` when valid, otherwise the message to
+ * show the user.
+ */
+export declare function validateServerUrl(url: string): string | true;

package/dist/src/lib/server-url.js

@@ -0,0 +1,33 @@
+/**
+ * The one server-URL validator the CLI shares (issue #2927).
+ *
+ * It returns the `string | true` shape `@inquirer/prompts` expects from a
+ * `validate` callback, so the same function backs the `primitive init` prompt,
+ * the `--server` flag check and init-config validation, `project-config.ts`'s
+ * `apiUrl` check, and `env add --api-url`. It used to live in the
+ * init-specific `resolve-init-server.ts` while the last two hand-rolled their
+ * own `try { new URL(x) } catch`.
+ *
+ * The parse deliberately runs on the *raw* string: JavaScript `trim()` strips
+ * Unicode whitespace (U+00A0, U+2028, U+FEFF, …) that the WHATWG URL parser
+ * does not, so trimming first would accept values like `" https://x"`
+ * that later URL construction cannot use — and `env add` would persist them.
+ * `trim()` is therefore used only to decide whether the input is empty; the
+ * URL parser already ignores the ASCII padding it is willing to strip.
+ */
+/**
+ * Validates a server URL. Returns `true` when valid, otherwise the message to
+ * show the user.
+ */
+export function validateServerUrl(url) {
+    if (typeof url !== "string" || !url.trim())
+        return "Server URL cannot be empty";
+    try {
+        new URL(url);
+        return true;
+    }
+    catch {
+        return "Please enter a valid URL (e.g., https://example.com)";
+    }
+}
+//# sourceMappingURL=server-url.js.map

package/dist/src/lib/server-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-url.js","sourceRoot":"","sources":["../../../src/lib/server-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,4BAA4B,CAAC;IAChF,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,sDAAsD,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/src/lib/signing-secret-status.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Platform ceiling on a webhook's `secretGracePeriodMs`, mirrored from the
+ * server's `MAX_SECRET_GRACE_PERIOD_MS` (#2383). Read-only now: the field is
+ * authored as `webhook.secretGracePeriodMs` and applied by `config push` (#2645),
+ * so this ceiling is used to RENDER a stored value, not to pre-validate a flag.
+ * The server remains the authority and returns
+ * `SECRET_GRACE_PERIOD_OUT_OF_RANGE` on a bad push.
+ */
+export declare const MAX_SECRET_GRACE_PERIOD_MS: number;
+/**
+ * The platform default applied when a webhook stores no `secretGracePeriodMs`,
+ * mirrored from the server's `DEFAULT_SECRET_GRACE_PERIOD_MS` (#2383). Only
+ * used to label the unset case on a read surface — nothing is computed from it
+ * CLI-side.
+ */
+export declare const DEFAULT_SECRET_GRACE_PERIOD_MS: number;
+/**
+ * Render a webhook's stored `secretGracePeriodMs` for a read surface.
+ *
+ * A stored `0` and an absent field mean opposite things — immediate cutover vs
+ * the 24 h platform default — so they must not render the same. Naming the
+ * default explicitly matches how `Max Body Bytes` reports its own unset case.
+ */
+export declare function formatGracePeriodMs(value: number | null | undefined): string;
+/**
+ * The operator-facing warning for a webhook whose stored `signingSecret` is not
+ * a `{{secrets.KEY}}` reference (#2332).
+ *
+ * Two commands report it — `webhooks get` on a single row and `config pull` on
+ * every pulled row — and each has two statuses to describe. Those four strings
+ * were written out in full and had already drifted twice, so the wording lives
+ * here once and the call sites supply only what genuinely differs: how the
+ * field is named in that context, and what the un-migrated value blocks.
+ *
+ * Returns `null` for a status that needs no warning (`reference`, `unset`, or
+ * anything a newer server adds), so a call site is one `if` rather than two.
+ */
+export declare function signingSecretStatusWarning(status: string | null | undefined, context: {
+    /** How to name the field, e.g. `"Signing secret"`. Starts the sentence. */
+    subject: string;
+    /** What an un-migrated value blocks, e.g. `"this webhook cannot be updated"`. */
+    blocks: string;
+}): string | null;
+/**
+ * The operator-facing warning for a stored signing secret whose HEALTH is not
+ * `ok` — the second axis the server reports alongside the status (#2383).
+ *
+ * Written as "anything that is not `ok` needs attention" rather than as a list
+ * of known members, so a member a newer server adds is surfaced rather than
+ * silently read as fine. `signingSecretStatusWarning` above deliberately keeps
+ * the opposite rule for the STATUS axis, whose union is closed.
+ *
+ * Returns `null` for `ok`, for an absent field (a server that predates the
+ * health axis), and when the slot holds nothing to assess.
+ */
+export declare function signingSecretHealthWarning(health: string | null | undefined, context: {
+    /** How to name the field, e.g. `"Signing secret"`. Starts the sentence. */
+    subject: string;
+}): string | null;
+/**
+ * The warning for the GRACE SLOT — a value in `previousSigningSecret` that the
+ * receiver still accepts until the rotation window closes.
+ *
+ * Split from the current-slot wording because the remediation differs: there is
+ * nothing to migrate here, the value simply has to stop being accepted.
+ *
+ * The two statuses need separate wording, because only one of them describes
+ * live credential material. A `legacy-literal` in this slot is grandfathered
+ * and really does keep verifying deliveries until the window closes, so
+ * `secretGracePeriodMs` is the operator's lever. A `malformed-reference` is
+ * dropped by the receiver before it reaches the verifier
+ * (`webhook-receiver.ts`: an unresolved previous reference yields no grace
+ * key), so it verifies nothing and lowering the grace period does nothing to
+ * it — telling the operator otherwise points them at a knob with no effect.
+ * This is the same distinction `signingSecretStatusWarning` draws for the
+ * current slot.
+ */
+export declare function previousSigningSecretWarning(status: string | null | undefined, context: {
+    /** How to name the row, e.g. `"webhooks/foo.toml: 'foo'"`. */
+    subject: string;
+}): string | null;

package/dist/src/lib/signing-secret-status.js

@@ -0,0 +1,116 @@
+/**
+ * Platform ceiling on a webhook's `secretGracePeriodMs`, mirrored from the
+ * server's `MAX_SECRET_GRACE_PERIOD_MS` (#2383). Read-only now: the field is
+ * authored as `webhook.secretGracePeriodMs` and applied by `config push` (#2645),
+ * so this ceiling is used to RENDER a stored value, not to pre-validate a flag.
+ * The server remains the authority and returns
+ * `SECRET_GRACE_PERIOD_OUT_OF_RANGE` on a bad push.
+ */
+export const MAX_SECRET_GRACE_PERIOD_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * The platform default applied when a webhook stores no `secretGracePeriodMs`,
+ * mirrored from the server's `DEFAULT_SECRET_GRACE_PERIOD_MS` (#2383). Only
+ * used to label the unset case on a read surface — nothing is computed from it
+ * CLI-side.
+ */
+export const DEFAULT_SECRET_GRACE_PERIOD_MS = 24 * 60 * 60 * 1000;
+/**
+ * Render a webhook's stored `secretGracePeriodMs` for a read surface.
+ *
+ * A stored `0` and an absent field mean opposite things — immediate cutover vs
+ * the 24 h platform default — so they must not render the same. Naming the
+ * default explicitly matches how `Max Body Bytes` reports its own unset case.
+ */
+export function formatGracePeriodMs(value) {
+    if (value === undefined || value === null) {
+        return `default (${DEFAULT_SECRET_GRACE_PERIOD_MS}ms, 24 h)`;
+    }
+    return `${value}ms`;
+}
+/**
+ * The operator-facing warning for a webhook whose stored `signingSecret` is not
+ * a `{{secrets.KEY}}` reference (#2332).
+ *
+ * Two commands report it — `webhooks get` on a single row and `config pull` on
+ * every pulled row — and each has two statuses to describe. Those four strings
+ * were written out in full and had already drifted twice, so the wording lives
+ * here once and the call sites supply only what genuinely differs: how the
+ * field is named in that context, and what the un-migrated value blocks.
+ *
+ * Returns `null` for a status that needs no warning (`reference`, `unset`, or
+ * anything a newer server adds), so a call site is one `if` rather than two.
+ */
+export function signingSecretStatusWarning(status, context) {
+    const remediation = 'Store the value with `primitive secrets set KEY --value <value>` and set signingSecret = "{{secrets.KEY}}".';
+    if (status === "legacy-literal") {
+        return (`${context.subject} still holds a raw value. Deliveries still verify, but ` +
+            `${context.blocks} until it is migrated. ${remediation}`);
+    }
+    // Not a working legacy literal: the stored value carries reference syntax
+    // that resolves to nothing, so it is not a usable signing key and every
+    // signed delivery is already being rejected.
+    if (status === "malformed-reference") {
+        return (`${context.subject} is neither a {{secrets.KEY}} reference nor a plain stored value — ` +
+            "it carries reference syntax that does not resolve, so every signed delivery is being REJECTED. " +
+            `${remediation}`);
+    }
+    return null;
+}
+/**
+ * The operator-facing warning for a stored signing secret whose HEALTH is not
+ * `ok` — the second axis the server reports alongside the status (#2383).
+ *
+ * Written as "anything that is not `ok` needs attention" rather than as a list
+ * of known members, so a member a newer server adds is surfaced rather than
+ * silently read as fine. `signingSecretStatusWarning` above deliberately keeps
+ * the opposite rule for the STATUS axis, whose union is closed.
+ *
+ * Returns `null` for `ok`, for an absent field (a server that predates the
+ * health axis), and when the slot holds nothing to assess.
+ */
+export function signingSecretHealthWarning(health, context) {
+    if (health === undefined || health === null || health === "ok")
+        return null;
+    if (health === "weak-literal") {
+        return (`${context.subject} is a short raw value — too short to be a strong ` +
+            "HMAC key, so a sender's signature is easier to forge. Deliveries still " +
+            "verify; replace it with a strong value stored as a secret: " +
+            '`primitive secrets set KEY --value <value>`, then set signingSecret = "{{secrets.KEY}}".');
+    }
+    return (`${context.subject} was reported as '${health}' by the server, which this ` +
+        "CLI does not recognize — upgrade the CLI for the full explanation.");
+}
+/**
+ * The warning for the GRACE SLOT — a value in `previousSigningSecret` that the
+ * receiver still accepts until the rotation window closes.
+ *
+ * Split from the current-slot wording because the remediation differs: there is
+ * nothing to migrate here, the value simply has to stop being accepted.
+ *
+ * The two statuses need separate wording, because only one of them describes
+ * live credential material. A `legacy-literal` in this slot is grandfathered
+ * and really does keep verifying deliveries until the window closes, so
+ * `secretGracePeriodMs` is the operator's lever. A `malformed-reference` is
+ * dropped by the receiver before it reaches the verifier
+ * (`webhook-receiver.ts`: an unresolved previous reference yields no grace
+ * key), so it verifies nothing and lowering the grace period does nothing to
+ * it — telling the operator otherwise points them at a knob with no effect.
+ * This is the same distinction `signingSecretStatusWarning` draws for the
+ * current slot.
+ */
+export function previousSigningSecretWarning(status, context) {
+    if (status === "legacy-literal") {
+        return (`${context.subject}: the ROTATED-OUT signing secret is a raw stored value, ` +
+            "not a {{secrets.KEY}} reference. It keeps verifying deliveries until the " +
+            "rotation grace window closes (secretRotatedAt + secretGracePeriodMs). To " +
+            "stop accepting it sooner, lower secretGracePeriodMs (0 cuts over immediately).");
+    }
+    if (status === "malformed-reference") {
+        return (`${context.subject}: the ROTATED-OUT signing secret carries reference syntax ` +
+            "that does not resolve, so it verifies nothing — it is inert, not a live " +
+            "grace key, and secretGracePeriodMs has no effect on it. No action is " +
+            "required; it clears on the next rotation.");
+    }
+    return null;
+}
+//# sourceMappingURL=signing-secret-status.js.map

package/dist/src/lib/signing-secret-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-secret-status.js","sourceRoot":"","sources":["../../../src/lib/signing-secret-status.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAGlE;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAgC;IAEhC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,YAAY,8BAA8B,WAAW,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiC,EACjC,OAKC;IAED,MAAM,WAAW,GACf,6GAA6G,CAAC;IAChH,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,yDAAyD;YAC3E,GAAG,OAAO,CAAC,MAAM,0BAA0B,WAAW,EAAE,CACzD,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,6CAA6C;IAC7C,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,qEAAqE;YACvF,iGAAiG;YACjG,GAAG,WAAW,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiC,EACjC,OAGC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,mDAAmD;YACrE,yEAAyE;YACzE,6DAA6D;YAC7D,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,qBAAqB,MAAM,8BAA8B;QAC3E,oEAAoE,CACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAiC,EACjC,OAGC;IAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,0DAA0D;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,4DAA4D;YAC9E,0EAA0E;YAC1E,uEAAuE;YACvE,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lib/skill-installer.js

@@ -127,7 +127,10 @@ async function refreshInternalSkill() {
     if (content) {
         const hash = writeInternalSkill(content, cliVersion);
         if (hash !== stamp.hash) {
-            console.log(chalk.dim("Updated Primitive internal skill for Claude Code"));
+            // Diagnostic, not payload: post-command notices must stay off stdout so
+            // `primitive <verb> --json | jq .` parses (#2357). Same stream choice as
+            // the update banner in version-check.ts.
+            console.error(chalk.dim("Updated Primitive internal skill for Claude Code"));
         }
     }
     else {
@@ -156,7 +159,7 @@ export async function checkSkillStatus() {
                 mkdirSync(SKILL_DIR, { recursive: true });
                 writeFileSync(SKILL_FILE, bundledContent);
                 writeFileSync(HASH_FILE, bundledHash);
-                console.log(chalk.dim("Updated Primitive platform skill for Claude Code"));
+                console.error(chalk.dim("Updated Primitive platform skill for Claude Code"));
             }
             // Internal skill (if installed) refreshes from the private repo, at
             // most once per CLI release.
@@ -164,7 +167,7 @@ export async function checkSkillStatus() {
         }
         else {
             // Not installed — show a non-blocking hint
-            console.log(chalk.dim(`Claude Code skill available — run ${chalk.cyan("primitive skill install")} to set up`));
+            console.error(chalk.dim(`Claude Code skill available — run ${chalk.cyan("primitive skill install")} to set up`));
         }
     }
     catch {

package/dist/src/lib/skill-installer.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installer.js","sourceRoot":"","sources":["../../../src/lib/skill-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAE9C,2EAA2E;AAC3E,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAC1D,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AACjE,MAAM,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;AACjE,MAAM,qBAAqB,GAAG,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;AACnE,MAAM,wBAAwB,GAC5B,+FAA+F,CAAC;AAElG,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,mBAAmB;IAC1B,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,0DAA0D,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrH,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,uDAAuD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,aAAa;IACpB,6EAA6E;IAC7E,sDAAsD;IACtD,0EAA0E;IAC1E,wDAAwD;IACxD,KAAK,MAAM,GAAG,IAAI,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACpD,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtE,OAAO,GAAG,CAAC,OAAO,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,gBAAgB,EAAE,KAAK,IAAI,CAAC;AACrC,CAAC;AASD,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA2B;IACrD,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAC1C,IAAI,EACJ,CAAC,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,wBAAwB,CAAC,EAC7E,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAC/C,CAAC;QACF,8DAA8D;QAC9D,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,mBAAmB,EAAE,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,UAAkB;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB;IACjC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,wCAAwC;IAC5D,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO;IAE3D,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QAEpC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QAEzC,IAAI,aAAa,EAAE,CAAC;YAClB,qDAAqD;YACrD,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;gBAClC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1C,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;gBAC1C,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;YAC7E,CAAC;YACD,oEAAoE;YACpE,6BAA6B;YAC7B,MAAM,oBAAoB,EAAE,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,2CAA2C;YAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAEhD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1C,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC,CAAC;IAElD,MAAM,YAAY,GAAG,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACjD,MAAM,eAAe,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACnD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,kBAAkB,CAAC,eAAe,EAAE,aAAa,EAAE,IAAI,SAAS,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,mBAAmB,EAAE,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sGAAsG,CAAC,CAAC,CAAC;IACpI,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,UAAU,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,aAAa,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,aAAa,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,mBAAmB,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,aAAa,CAAC,IAAI,qBAAqB,aAAa,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC"}
+{"version":3,"file":"skill-installer.js","sourceRoot":"","sources":["../../../src/lib/skill-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAE9C,2EAA2E;AAC3E,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAC1D,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AACjE,MAAM,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;AACjE,MAAM,qBAAqB,GAAG,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;AACnE,MAAM,wBAAwB,GAC5B,+FAA+F,CAAC;AAElG,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,mBAAmB;IAC1B,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,0DAA0D,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrH,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,uDAAuD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,aAAa;IACpB,6EAA6E;IAC7E,sDAAsD;IACtD,0EAA0E;IAC1E,wDAAwD;IACxD,KAAK,MAAM,GAAG,IAAI,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACpD,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtE,OAAO,GAAG,CAAC,OAAO,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,gBAAgB,EAAE,KAAK,IAAI,CAAC;AACrC,CAAC;AASD,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA2B;IACrD,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAC1C,IAAI,EACJ,CAAC,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,wBAAwB,CAAC,EAC7E,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAC/C,CAAC;QACF,8DAA8D;QAC9D,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,mBAAmB,EAAE,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,UAAkB;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB;IACjC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,wCAAwC;IAC5D,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO;IAE3D,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACxB,wEAAwE;YACxE,yEAAyE;YACzE,yCAAyC;YACzC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QAEpC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QAEzC,IAAI,aAAa,EAAE,CAAC;YAClB,qDAAqD;YACrD,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;gBAClC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1C,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;gBAC1C,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;YAC/E,CAAC;YACD,oEAAoE;YACpE,6BAA6B;YAC7B,MAAM,oBAAoB,EAAE,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,2CAA2C;YAC3C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAEhD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1C,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC,CAAC;IAElD,MAAM,YAAY,GAAG,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACjD,MAAM,eAAe,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACnD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,kBAAkB,CAAC,eAAe,EAAE,aAAa,EAAE,IAAI,SAAS,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,mBAAmB,EAAE,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sGAAsG,CAAC,CAAC,CAAC;IACpI,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,UAAU,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,aAAa,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,aAAa,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,mBAAmB,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,aAAa,CAAC,IAAI,qBAAqB,aAAa,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC"}

package/dist/src/lib/snapshots.d.ts

@@ -1,6 +1,6 @@
 /**
  * Sync snapshots — point-in-time backups of a sync directory taken before a
- * destructive `sync pull` overwrites local TOML state (issue #578, Phase 1).
+ * destructive `config pull` overwrites local TOML state (issue #578, Phase 1).
  *
  * A snapshot is a full recursive copy of the live sync tree (including
  * `.primitive-sync.json`, the content-hash baseline) into a timestamped slot
@@ -15,7 +15,7 @@
  * copy is detectable: `restoreSnapshot` refuses any snapshot missing it.
  *
  * Snapshots fail LOUD — `createSnapshot` throws if it can't write a complete
- * snapshot. The caller (sync pull) aborts before touching any local file so we
+ * snapshot. The caller (config pull) aborts before touching any local file so we
  * never perform a destructive pull without a recoverable backup.
  *
  * Restore is staged-then-swapped: the snapshot is materialized into a sibling