quiver-cli 0.1.0

package/dist/cli.js

@@ -0,0 +1,3074 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/ui/prompts.ts
+var clackPromise, loadClack, QUIVER_ART, TAGLINE, colorEnabled, palette, block, banner, outro, step, info, success, warn, error, password, selectGrouped, selectGroupedText;
+var init_prompts = __esm({
+  "src/ui/prompts.ts"() {
+    "use strict";
+    loadClack = async () => {
+      if (clackPromise === void 0) {
+        clackPromise = import("@clack/prompts").catch(() => null);
+      }
+      return clackPromise;
+    };
+    QUIVER_ART = [
+      "  ___        _                 ",
+      " / _ \\ _   _(_)_   _____ _ __  ",
+      "| | | | | | | \\ \\ / / _ \\ '__| ",
+      "| |_| | |_| | |\\ V /  __/ |    ",
+      " \\__\\_\\\\__,_|_| \\_/ \\___|_|    "
+    ];
+    TAGLINE = "Compose skills, commands & MCP servers into any repo \u2014 lockfile-based drift awareness.";
+    colorEnabled = () => Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
+    palette = () => {
+      const on = colorEnabled();
+      const wrap = (code) => (s) => on ? `\x1B[${code}m${s}\x1B[0m` : s;
+      return {
+        green: wrap("32"),
+        yellow: wrap("33"),
+        cyan: wrap("36"),
+        dim: wrap("2"),
+        bold: wrap("1"),
+        red: wrap("31")
+      };
+    };
+    block = (lines) => {
+      console.log(lines.join("\n"));
+    };
+    banner = async () => {
+      const color = colorEnabled();
+      const cyan = color ? "\x1B[36m" : "";
+      const dim = color ? "\x1B[2m" : "";
+      const reset = color ? "\x1B[0m" : "";
+      console.log("");
+      for (const line of QUIVER_ART) {
+        console.log(`${cyan}${line}${reset}`);
+      }
+      console.log("");
+      console.log(`${dim}${TAGLINE}${reset}`);
+      console.log("");
+    };
+    outro = async (message) => {
+      const clack = await loadClack();
+      if (clack) clack.outro(message);
+      else console.log(`
+${message}
+`);
+    };
+    step = async (message) => {
+      const clack = await loadClack();
+      if (clack) clack.log.step(message);
+      else console.log(`  ${message}`);
+    };
+    info = async (message) => {
+      const clack = await loadClack();
+      if (clack) clack.log.info(message);
+      else console.log(`  ${message}`);
+    };
+    success = async (message) => {
+      const clack = await loadClack();
+      if (clack) clack.log.success(message);
+      else console.log(`  ${message}`);
+    };
+    warn = async (message) => {
+      const clack = await loadClack();
+      if (clack) clack.log.warn(message);
+      else console.warn(`  ${message}`);
+    };
+    error = async (message) => {
+      const clack = await loadClack();
+      if (clack) clack.log.error(message);
+      else console.error(message);
+    };
+    password = async (message) => {
+      const clack = await loadClack();
+      if (clack) {
+        const value = await clack.password({ message });
+        if (clack.isCancel(value)) return null;
+        return value;
+      }
+      const { createInterface } = await import("readline");
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const answer = await new Promise((res) => {
+        rl.question(`${message}: `, (a) => {
+          rl.close();
+          res(a);
+        });
+      });
+      return answer.trim() || null;
+    };
+    selectGrouped = async ({
+      message,
+      groups,
+      initialValues
+    }) => {
+      const clack = await loadClack();
+      if (clack) {
+        const options = {};
+        for (const group of groups) {
+          options[group.name] = group.items.map((i) => ({
+            value: i.value,
+            label: i.label,
+            ...i.hint !== void 0 ? { hint: i.hint } : {}
+          }));
+        }
+        const selected = await clack.groupMultiselect({
+          message,
+          // clack's Option<T> is structurally compatible; the Record index
+          // signature is invariant so an explicit cast is required here.
+          options,
+          initialValues,
+          required: false,
+          selectableGroups: false
+        });
+        if (clack.isCancel(selected)) {
+          clack.cancel("Cancelled - no changes made.");
+          process.exit(0);
+        }
+        return selected;
+      }
+      return selectGroupedText({ message, groups, initialValues });
+    };
+    selectGroupedText = async ({
+      message,
+      groups,
+      initialValues
+    }) => {
+      const { createInterface } = await import("readline");
+      const flat = groups.flatMap((g) => g.items.map((i) => i.value));
+      console.log(`
+${message}`);
+      let index = 0;
+      for (const group of groups) {
+        console.log(`  ${group.name}`);
+        for (const item of group.items) {
+          index += 1;
+          const mark = initialValues.includes(item.value) ? "*" : " ";
+          const hint = item.hint ? `  (${item.hint})` : "";
+          console.log(`    ${index}) [${mark}] ${item.label}${hint}`);
+        }
+      }
+      const preselected = flat.map((v, i) => initialValues.includes(v) ? i + 1 : null).filter((n) => n !== null).join(",");
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const answer = await new Promise((res) => {
+        rl.question(
+          `
+Enter numbers (comma-separated), 'all', or 'none' [${preselected || "none"}]: `,
+          (a) => {
+            rl.close();
+            res(a);
+          }
+        );
+      });
+      const trimmed = answer.trim().toLowerCase();
+      if (trimmed === "all" || trimmed === "a") return flat;
+      if (trimmed === "none" || trimmed === "n") return [];
+      if (trimmed === "") return flat.filter((v) => initialValues.includes(v));
+      const picked = /* @__PURE__ */ new Set();
+      for (const token of trimmed.split(/[\s,]+/).filter(Boolean)) {
+        const n = Number.parseInt(token, 10);
+        if (Number.isInteger(n) && n >= 1 && n <= flat.length) {
+          picked.add(flat[n - 1]);
+        }
+      }
+      return [...picked];
+    };
+  }
+});
+
+// src/catalog/digest.ts
+import { createHash } from "crypto";
+import { readdirSync, readFileSync, statSync } from "fs";
+import { relative, resolve } from "path";
+var sha256, fileDigest, treeDigest, jsonDigest, canonicalJson;
+var init_digest = __esm({
+  "src/catalog/digest.ts"() {
+    "use strict";
+    sha256 = (data) => "sha256:" + createHash("sha256").update(data).digest("hex");
+    fileDigest = (path) => sha256(readFileSync(path));
+    treeDigest = (dir) => {
+      const files = [];
+      const walk = (current) => {
+        for (const entry of readdirSync(current, { withFileTypes: true }).sort(
+          (a, b) => a.name.localeCompare(b.name)
+        )) {
+          const full = resolve(current, entry.name);
+          if (entry.isDirectory()) walk(full);
+          else if (entry.isFile()) files.push(full);
+        }
+      };
+      walk(dir);
+      const hash = createHash("sha256");
+      for (const file of files.sort()) {
+        const rel = relative(dir, file);
+        hash.update(rel);
+        hash.update("\0");
+        hash.update(createHash("sha256").update(readFileSync(file)).digest());
+        hash.update("\0");
+      }
+      return "sha256:" + hash.digest("hex");
+    };
+    jsonDigest = (value) => sha256(canonicalJson(value));
+    canonicalJson = (value) => {
+      if (value === null || typeof value !== "object") return JSON.stringify(value);
+      if (Array.isArray(value)) {
+        return "[" + value.map(canonicalJson).join(",") + "]";
+      }
+      const keys = Object.keys(value).sort();
+      return "{" + keys.map(
+        (k) => JSON.stringify(k) + ":" + canonicalJson(value[k])
+      ).join(",") + "}";
+    };
+  }
+});
+
+// src/catalog/frontmatter.ts
+var readFrontmatter;
+var init_frontmatter = __esm({
+  "src/catalog/frontmatter.ts"() {
+    "use strict";
+    readFrontmatter = (content) => {
+      const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+      if (!match) return {};
+      const fields = {};
+      const lines = match[1].split(/\r?\n/);
+      for (let i = 0; i < lines.length; i += 1) {
+        const rawLine = lines[i];
+        const line = rawLine.trimEnd();
+        if (!line || line.startsWith("#")) continue;
+        const colon = line.indexOf(":");
+        if (colon === -1) continue;
+        if (/^\s/.test(rawLine)) continue;
+        const key = line.slice(0, colon).trim();
+        let value = line.slice(colon + 1).trim();
+        if (value === ">" || value === "|") {
+          const folded = value === ">";
+          const block2 = [];
+          while (i + 1 < lines.length && /^\s+\S/.test(lines[i + 1])) {
+            block2.push(lines[i + 1].trim());
+            i += 1;
+          }
+          fields[key] = folded ? block2.join(" ") : block2.join("\n");
+          continue;
+        }
+        if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+          value = value.slice(1, -1);
+        }
+        fields[key] = value;
+      }
+      return fields;
+    };
+  }
+});
+
+// src/catalog/discover.ts
+import { existsSync, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import { relative as relative2, resolve as resolve2 } from "path";
+var readConfig, discoverSkills, discoverCommands, discoverMcp, loadCatalog;
+var init_discover = __esm({
+  "src/catalog/discover.ts"() {
+    "use strict";
+    init_digest();
+    init_frontmatter();
+    readConfig = (root) => {
+      const path = resolve2(root, "config.json");
+      if (!existsSync(path)) return { config: {}, path };
+      return { config: JSON.parse(readFileSync2(path, "utf8")), path };
+    };
+    discoverSkills = (root) => {
+      const skillsRoot = resolve2(root, "skills");
+      if (!existsSync(skillsRoot)) return [];
+      const found = [];
+      const walk = (dir, group) => {
+        for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+          if (!entry.isDirectory()) continue;
+          const childDir = resolve2(dir, entry.name);
+          if (existsSync(resolve2(childDir, "SKILL.md"))) {
+            const fm = readFrontmatter(
+              readFileSync2(resolve2(childDir, "SKILL.md"), "utf8")
+            );
+            found.push({
+              name: entry.name,
+              group: group ?? "general",
+              sourcePath: relative2(root, childDir),
+              absDir: childDir,
+              digest: treeDigest(childDir),
+              frontmatter: {
+                name: fm["name"] ?? null,
+                description: fm["description"] ?? null,
+                version: fm["version"] ?? null
+              }
+            });
+          } else {
+            walk(childDir, group ?? entry.name);
+          }
+        }
+      };
+      walk(skillsRoot, null);
+      const seen = /* @__PURE__ */ new Map();
+      for (const skill of found) {
+        const prev = seen.get(skill.name);
+        if (prev && prev !== skill.absDir) {
+          throw new Error(
+            `Duplicate skill name "${skill.name}": ${prev} and ${skill.absDir}`
+          );
+        }
+        seen.set(skill.name, skill.absDir);
+      }
+      return found.sort((a, b) => a.name.localeCompare(b.name));
+    };
+    discoverCommands = (root) => {
+      const commandsRoot = resolve2(root, "commands");
+      if (!existsSync(commandsRoot)) return [];
+      return readdirSync2(commandsRoot).filter((f) => f.endsWith(".md")).sort((a, b) => a.localeCompare(b)).map((file) => {
+        const absPath = resolve2(commandsRoot, file);
+        return {
+          name: file.replace(/\.md$/, ""),
+          sourcePath: relative2(root, absPath),
+          absPath,
+          digest: fileDigest(absPath)
+        };
+      });
+    };
+    discoverMcp = (config) => {
+      const servers = config.mcpServers ?? {};
+      return Object.keys(servers).sort((a, b) => a.localeCompare(b)).map((name) => ({
+        name,
+        server: servers[name],
+        configDigest: jsonDigest(servers[name])
+      }));
+    };
+    loadCatalog = (catalog) => {
+      const { config, path } = readConfig(catalog.root);
+      return {
+        config,
+        configPath: path,
+        skills: discoverSkills(catalog.root),
+        commands: discoverCommands(catalog.root),
+        mcp: discoverMcp(config)
+      };
+    };
+  }
+});
+
+// src/catalog/entries.ts
+var skillToEntry, commandToEntry, mcpToEntry;
+var init_entries = __esm({
+  "src/catalog/entries.ts"() {
+    "use strict";
+    skillToEntry = (skill) => ({
+      type: "skill",
+      sourcePath: skill.sourcePath,
+      digest: skill.digest,
+      pin: null,
+      frontmatter: skill.frontmatter
+    });
+    commandToEntry = (command) => ({
+      type: "command",
+      sourcePath: command.sourcePath,
+      digest: command.digest
+    });
+    mcpToEntry = (mcp) => ({
+      type: "mcp",
+      transport: mcp.server.transport,
+      configDigest: mcp.configDigest,
+      tools: null,
+      toolsFetchedAt: null
+    });
+  }
+});
+
+// src/secrets/interpolate.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve3 } from "path";
+import process2 from "process";
+var loadEnvLocal, collectEnvVars, interpolateEnvVars;
+var init_interpolate = __esm({
+  "src/secrets/interpolate.ts"() {
+    "use strict";
+    loadEnvLocal = (targetRoot) => {
+      const path = resolve3(targetRoot, ".env.local");
+      if (!existsSync2(path)) return;
+      for (const rawLine of readFileSync3(path, "utf8").split("\n")) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#")) continue;
+        const eq = line.indexOf("=");
+        if (eq === -1) continue;
+        const key = line.slice(0, eq).trim();
+        const value = line.slice(eq + 1).trim();
+        if (process2.env[key] === void 0) process2.env[key] = value;
+      }
+    };
+    collectEnvVars = (value) => {
+      const found = /* @__PURE__ */ new Set();
+      const visit = (v) => {
+        if (typeof v === "string") {
+          for (const m of v.matchAll(/\$\{([^}]+)\}/g)) found.add(m[1]);
+        } else if (Array.isArray(v)) {
+          v.forEach(visit);
+        } else if (v !== null && typeof v === "object") {
+          Object.values(v).forEach(visit);
+        }
+      };
+      visit(value);
+      return [...found].sort((a, b) => a.localeCompare(b));
+    };
+    interpolateEnvVars = (value, onMissing) => {
+      if (typeof value === "string") {
+        return value.replace(/\$\{([^}]+)\}/g, (match, name) => {
+          const env = process2.env[name];
+          if (env === void 0) {
+            onMissing?.(name);
+            return match;
+          }
+          return env;
+        });
+      }
+      if (Array.isArray(value)) {
+        return value.map((v) => interpolateEnvVars(v, onMissing));
+      }
+      if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+          out[k] = interpolateEnvVars(v, onMissing);
+        }
+        return out;
+      }
+      return value;
+    };
+  }
+});
+
+// src/catalog/materialize.ts
+import { cpSync, existsSync as existsSync3, mkdirSync, rmSync, writeFileSync } from "fs";
+import { dirname, resolve as resolve4 } from "path";
+var materializeCatalog, envExampleContent, removeArtifact;
+var init_materialize = __esm({
+  "src/catalog/materialize.ts"() {
+    "use strict";
+    init_interpolate();
+    materializeCatalog = (targetRoot, sourceCatalog, catalog, selection) => {
+      const destRoot = resolve4(targetRoot, ".agents");
+      mkdirSync(destRoot, { recursive: true });
+      const keptSkillDirs = [];
+      for (const skill of catalog.skills) {
+        if (!selection.skills.includes(skill.name)) continue;
+        const dest = resolve4(destRoot, skill.sourcePath);
+        mkdirSync(dirname(dest), { recursive: true });
+        cpSync(skill.absDir, dest, { recursive: true, force: true });
+        keptSkillDirs.push(skill.sourcePath);
+      }
+      for (const command of catalog.commands) {
+        if (!selection.commands.includes(command.name)) continue;
+        const dest = resolve4(destRoot, command.sourcePath);
+        mkdirSync(dirname(dest), { recursive: true });
+        cpSync(command.absPath, dest, { force: true });
+      }
+      const filteredConfig = {};
+      if (catalog.config.shared) filteredConfig["shared"] = catalog.config.shared;
+      const mcpServers = {};
+      for (const mcp of catalog.mcp) {
+        if (selection.mcp.includes(mcp.name)) mcpServers[mcp.name] = mcp.server;
+      }
+      if (Object.keys(mcpServers).length) filteredConfig["mcpServers"] = mcpServers;
+      if (catalog.config.claude) filteredConfig["claude"] = catalog.config.claude;
+      writeFileSync(
+        resolve4(destRoot, "config.json"),
+        JSON.stringify(filteredConfig, null, 2) + "\n"
+      );
+      for (const file of ["AGENTS.md", "README.md"]) {
+        const src = resolve4(sourceCatalog.root, file);
+        if (existsSync3(src)) {
+          cpSync(src, resolve4(destRoot, file), { force: true });
+        }
+      }
+      const envVars = collectEnvVars(mcpServers);
+      const exampleDest = resolve4(targetRoot, ".env.local.example");
+      if (envVars.length && !existsSync3(exampleDest)) {
+        writeFileSync(exampleDest, envExampleContent(envVars));
+      }
+      return { source: sourceCatalog.source, root: destRoot };
+    };
+    envExampleContent = (vars) => [
+      "# Secrets for the selected MCP servers (generated by quiver).",
+      "# Copy to `.env.local` (gitignored), fill in the values, then re-run",
+      "# `quiver-cli sync`. Never commit `.env.local`.",
+      "",
+      ...vars.map((v) => `${v}=`),
+      ""
+    ].join("\n");
+    removeArtifact = (targetRoot, sourcePath) => {
+      const path = resolve4(targetRoot, ".agents", sourcePath);
+      rmSync(path, { recursive: true, force: true });
+    };
+  }
+});
+
+// src/github/auth.ts
+import { execFileSync } from "child_process";
+import {
+  chmodSync,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync4,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir } from "os";
+import { resolve as resolve5 } from "path";
+var configDir, authFilePath, readAuthFile, readStoredToken, writeStoredToken, deleteStoredToken, cachedToken, ghToken, resolveGithubToken, resetTokenCache, validateToken;
+var init_auth = __esm({
+  "src/github/auth.ts"() {
+    "use strict";
+    configDir = () => {
+      const base = process.env["XDG_CONFIG_HOME"] || resolve5(homedir(), ".config");
+      return resolve5(base, "quiver");
+    };
+    authFilePath = () => resolve5(configDir(), "auth.json");
+    readAuthFile = () => {
+      const path = authFilePath();
+      if (!existsSync4(path)) return null;
+      try {
+        return JSON.parse(readFileSync4(path, "utf8"));
+      } catch {
+        return null;
+      }
+    };
+    readStoredToken = () => readAuthFile()?.github?.token ?? null;
+    writeStoredToken = (token, login2) => {
+      mkdirSync2(configDir(), { recursive: true });
+      const file = {
+        github: { token, login: login2, createdAt: (/* @__PURE__ */ new Date()).toISOString() }
+      };
+      writeFileSync2(authFilePath(), JSON.stringify(file, null, 2) + "\n", {
+        mode: 384
+      });
+      chmodSync(authFilePath(), 384);
+      resetTokenCache();
+    };
+    deleteStoredToken = () => {
+      const path = authFilePath();
+      if (!existsSync4(path)) return false;
+      rmSync2(path);
+      resetTokenCache();
+      return true;
+    };
+    ghToken = () => {
+      try {
+        const out = execFileSync("gh", ["auth", "token"], {
+          encoding: "utf8",
+          timeout: 3e3,
+          stdio: ["ignore", "pipe", "ignore"]
+        }).trim();
+        return out || null;
+      } catch {
+        return null;
+      }
+    };
+    resolveGithubToken = () => {
+      if (cachedToken !== void 0) return cachedToken;
+      cachedToken = process.env["GITHUB_TOKEN"] ?? process.env["GH_TOKEN"] ?? readStoredToken() ?? ghToken();
+      return cachedToken;
+    };
+    resetTokenCache = () => {
+      cachedToken = void 0;
+    };
+    validateToken = async (token) => {
+      let res;
+      try {
+        res = await fetch("https://api.github.com/user", {
+          headers: {
+            Accept: "application/vnd.github+json",
+            "User-Agent": "quiver-cli",
+            Authorization: `Bearer ${token}`
+          }
+        });
+      } catch (err) {
+        return {
+          ok: false,
+          reason: err instanceof Error ? err.message : "fetch failed"
+        };
+      }
+      if (res.status === 401) return { ok: false, reason: "token is invalid or expired" };
+      if (!res.ok) return { ok: false, reason: `HTTP ${res.status}` };
+      const body = await res.json();
+      return { ok: true, login: body.login ?? "unknown" };
+    };
+  }
+});
+
+// src/github/api.ts
+import { mkdirSync as mkdirSync3 } from "fs";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+import * as tar from "tar";
+var headers, failureReason, apiFetch, fetchDefaultBranch, resolveCommitSha, downloadTarball;
+var init_api = __esm({
+  "src/github/api.ts"() {
+    "use strict";
+    init_auth();
+    headers = () => {
+      const h = {
+        Accept: "application/vnd.github+json",
+        "User-Agent": "quiver-cli"
+      };
+      const token = resolveGithubToken();
+      if (token) h["Authorization"] = `Bearer ${token}`;
+      return h;
+    };
+    failureReason = (status2) => {
+      if (status2 === 401) return "authentication failed - run `quiver-cli login` with a valid token";
+      if (status2 === 403 || status2 === 429)
+        return "rate-limited or access denied (run `quiver-cli login` or set GITHUB_TOKEN)";
+      if (status2 === 404)
+        return "repo or ref not found (private repo? run `quiver-cli login`)";
+      return `HTTP ${status2}`;
+    };
+    apiFetch = async (url) => {
+      let res;
+      try {
+        res = await fetch(url, { headers: headers() });
+      } catch (err) {
+        return {
+          ok: false,
+          reason: err instanceof Error ? err.message : "fetch failed"
+        };
+      }
+      if (!res.ok) return { ok: false, reason: failureReason(res.status) };
+      return { ok: true, value: res };
+    };
+    fetchDefaultBranch = async (repo) => {
+      const res = await apiFetch(`https://api.github.com/repos/${repo}`);
+      if (!res.ok) return res;
+      const body = await res.value.json();
+      if (!body.default_branch) return { ok: false, reason: "no default branch" };
+      return { ok: true, value: body.default_branch };
+    };
+    resolveCommitSha = async (repo, ref) => {
+      const res = await apiFetch(
+        `https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref)}`
+      );
+      if (!res.ok) return res;
+      const body = await res.value.json();
+      if (!body.sha) return { ok: false, reason: "no commit sha in response" };
+      return { ok: true, value: body.sha };
+    };
+    downloadTarball = async (repo, sha, destDir) => {
+      const res = await apiFetch(
+        `https://api.github.com/repos/${repo}/tarball/${sha}`
+      );
+      if (!res.ok) return res;
+      if (!res.value.body) return { ok: false, reason: "empty tarball response" };
+      mkdirSync3(destDir, { recursive: true });
+      try {
+        await pipeline(
+          Readable.fromWeb(res.value.body),
+          tar.x({ cwd: destDir, strip: 1 })
+        );
+      } catch (err) {
+        return {
+          ok: false,
+          reason: err instanceof Error ? err.message : "tarball extraction failed"
+        };
+      }
+      return { ok: true, value: null };
+    };
+  }
+});
+
+// src/catalog/remote.ts
+var remote_exports = {};
+__export(remote_exports, {
+  catalogCacheDir: () => catalogCacheDir,
+  catalogCacheRoot: () => catalogCacheRoot,
+  fetchRemoteCatalog: () => fetchRemoteCatalog,
+  parseGithubSource: () => parseGithubSource
+});
+import { existsSync as existsSync5, mkdtempSync, renameSync, rmSync as rmSync3, mkdirSync as mkdirSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, resolve as resolve6 } from "path";
+var parseGithubSource, catalogCacheRoot, catalogCacheDir, fetchRemoteCatalog;
+var init_remote = __esm({
+  "src/catalog/remote.ts"() {
+    "use strict";
+    init_api();
+    parseGithubSource = (source) => {
+      const spec = source.startsWith("github:") ? source.slice("github:".length) : source;
+      const [location = "", ...refParts] = spec.split("#");
+      const ref = refParts.length ? refParts.join("#") : null;
+      const segments = location.split("/").filter(Boolean);
+      const [owner, repo, ...pathParts] = segments;
+      if (!owner || !repo) {
+        throw new Error(
+          `Invalid catalog source "${source}". Expected github:owner/repo[/path][#ref].`
+        );
+      }
+      if (ref !== null && !ref) {
+        throw new Error(`Invalid catalog source "${source}": empty #ref.`);
+      }
+      return { repo: `${owner}/${repo}`, path: pathParts.join("/"), ref };
+    };
+    catalogCacheRoot = () => {
+      const base = process.env["XDG_CACHE_HOME"] || resolve6(homedir2(), ".cache");
+      return resolve6(base, "quiver", "catalogs");
+    };
+    catalogCacheDir = (repo, sha) => resolve6(catalogCacheRoot(), `${repo.replace("/", "-")}-${sha.slice(0, 12)}`);
+    fetchRemoteCatalog = async (source, options = {}) => {
+      const spec = parseGithubSource(source);
+      let ref = spec.ref;
+      let sha = options.pinnedSha ?? null;
+      if (!sha) {
+        if (!ref) {
+          const branch = await fetchDefaultBranch(spec.repo);
+          if (!branch.ok) {
+            throw new Error(`Cannot resolve ${spec.repo}: ${branch.reason}`);
+          }
+          ref = branch.value;
+        }
+        const commit = await resolveCommitSha(spec.repo, ref);
+        if (!commit.ok) {
+          throw new Error(`Cannot resolve ${spec.repo}@${ref}: ${commit.reason}`);
+        }
+        sha = commit.value;
+      }
+      const cacheDir = catalogCacheDir(spec.repo, sha);
+      if (!existsSync5(cacheDir)) {
+        mkdirSync4(dirname2(cacheDir), { recursive: true });
+        const tmp = mkdtempSync(`${cacheDir}.tmp-`);
+        const result = await downloadTarball(spec.repo, sha, tmp);
+        if (!result.ok) {
+          rmSync3(tmp, { recursive: true, force: true });
+          throw new Error(`Cannot download ${spec.repo}@${sha.slice(0, 12)}: ${result.reason}`);
+        }
+        try {
+          renameSync(tmp, cacheDir);
+        } catch {
+          rmSync3(tmp, { recursive: true, force: true });
+        }
+      }
+      const root = spec.path ? resolve6(cacheDir, spec.path) : cacheDir;
+      if (!existsSync5(root)) {
+        throw new Error(
+          `Catalog path "${spec.path}" not found in ${spec.repo}@${sha.slice(0, 12)}.`
+        );
+      }
+      return { source, root, ref, resolved: sha, fetchedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    };
+  }
+});
+
+// src/catalog/resolve.ts
+var resolve_exports = {};
+__export(resolve_exports, {
+  DEFAULT_CATALOG_SOURCE: () => DEFAULT_CATALOG_SOURCE,
+  packageRoot: () => packageRoot,
+  resolveCatalog: () => resolveCatalog
+});
+import { existsSync as existsSync6 } from "fs";
+import { dirname as dirname3, resolve as resolve7 } from "path";
+import { fileURLToPath } from "url";
+var packageRoot, DEFAULT_CATALOG_SOURCE, resolveCatalog;
+var init_resolve = __esm({
+  "src/catalog/resolve.ts"() {
+    "use strict";
+    packageRoot = resolve7(dirname3(fileURLToPath(import.meta.url)), "..");
+    DEFAULT_CATALOG_SOURCE = "local:template/.agents";
+    resolveCatalog = async (source = DEFAULT_CATALOG_SOURCE, options = {}) => {
+      const [scheme, ...rest] = source.split(":");
+      const spec = rest.join(":");
+      if (scheme === "local") {
+        const root = resolve7(packageRoot, spec);
+        if (!existsSync6(root)) {
+          throw new Error(`Catalog not found at ${root} (source: ${source}).`);
+        }
+        return { source, root };
+      }
+      if (scheme === "github") {
+        const { fetchRemoteCatalog: fetchRemoteCatalog2 } = await Promise.resolve().then(() => (init_remote(), remote_exports));
+        return fetchRemoteCatalog2(source, options);
+      }
+      throw new Error(`Unknown catalog source scheme: ${source}`);
+    };
+  }
+});
+
+// src/lockfile/schema.ts
+var LOCKFILE_VERSION, LOCKFILE_NAME, PROVIDERS, isProvider, entryId, parseEntryId;
+var init_schema = __esm({
+  "src/lockfile/schema.ts"() {
+    "use strict";
+    LOCKFILE_VERSION = 1;
+    LOCKFILE_NAME = "quiver.lock";
+    PROVIDERS = ["claude", "opencode", "codex"];
+    isProvider = (v) => PROVIDERS.includes(v);
+    entryId = (type, name) => `${type}:${name}`;
+    parseEntryId = (id) => {
+      const idx = id.indexOf(":");
+      if (idx === -1) return null;
+      const type = id.slice(0, idx);
+      const name = id.slice(idx + 1);
+      if (type !== "skill" && type !== "command" && type !== "mcp") return null;
+      if (!name) return null;
+      return { type, name };
+    };
+  }
+});
+
+// src/lockfile/io.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve8 } from "path";
+var lockfilePath, lockfileExists, readLockfile, writeLockfile, emptyLockfile;
+var init_io = __esm({
+  "src/lockfile/io.ts"() {
+    "use strict";
+    init_schema();
+    lockfilePath = (targetRoot) => resolve8(targetRoot, LOCKFILE_NAME);
+    lockfileExists = (targetRoot) => existsSync7(lockfilePath(targetRoot));
+    readLockfile = (targetRoot) => {
+      const path = lockfilePath(targetRoot);
+      if (!existsSync7(path)) return null;
+      const parsed = JSON.parse(readFileSync5(path, "utf8"));
+      if (parsed.version !== LOCKFILE_VERSION) {
+        throw new Error(
+          `Unsupported ${LOCKFILE_NAME} version ${parsed.version}; expected ${LOCKFILE_VERSION}.`
+        );
+      }
+      return parsed;
+    };
+    writeLockfile = (targetRoot, lock) => {
+      const sortedEntries = {};
+      for (const key of Object.keys(lock.entries).sort()) {
+        sortedEntries[key] = lock.entries[key];
+      }
+      const ordered = {
+        version: lock.version,
+        catalog: lock.catalog,
+        ...lock.providers !== void 0 ? { providers: lock.providers } : {},
+        entries: sortedEntries
+      };
+      writeFileSync3(lockfilePath(targetRoot), JSON.stringify(ordered, null, 2) + "\n");
+    };
+    emptyLockfile = (catalogSource, remote = {}) => ({
+      version: LOCKFILE_VERSION,
+      catalog: {
+        source: catalogSource,
+        ref: remote.ref ?? null,
+        resolved: remote.resolved ?? null,
+        fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      entries: {}
+    });
+  }
+});
+
+// src/providers/claude.ts
+import { resolve as resolve9 } from "path";
+var formatMcpJson, planClaude;
+var init_claude = __esm({
+  "src/providers/claude.ts"() {
+    "use strict";
+    formatMcpJson = (servers) => {
+      if (Object.keys(servers).length === 0) return null;
+      return JSON.stringify({ mcpServers: servers }, null, 2) + "\n";
+    };
+    planClaude = (inputs) => {
+      const { targetRoot, selected, mcpServers, claudeSettings } = inputs;
+      const files = [];
+      const removeFiles = [];
+      if (claudeSettings) {
+        files.push({
+          path: resolve9(targetRoot, ".claude/settings.json"),
+          content: JSON.stringify(claudeSettings, null, 2) + "\n"
+        });
+      }
+      const mcp = formatMcpJson(mcpServers);
+      const mcpPath = resolve9(targetRoot, ".mcp.json");
+      if (mcp) files.push({ path: mcpPath, content: mcp });
+      else removeFiles.push(mcpPath);
+      const skillNames = selected.skills.map((s) => s.name);
+      const commandFiles = selected.commands.map((c) => `${c.name}.md`);
+      const symlinks = [
+        ...selected.skills.map((s) => ({
+          path: resolve9(targetRoot, ".claude/skills", s.name),
+          target: s.absDir
+        })),
+        ...selected.commands.map((c) => ({
+          path: resolve9(targetRoot, ".claude/commands", `${c.name}.md`),
+          target: c.absPath
+        }))
+      ];
+      const managedDirs = [
+        {
+          path: resolve9(targetRoot, ".claude/skills"),
+          expected: new Set(skillNames)
+        },
+        {
+          path: resolve9(targetRoot, ".claude/commands"),
+          expected: new Set(commandFiles)
+        }
+      ];
+      return { files, removeFiles, symlinks, managedDirs };
+    };
+  }
+});
+
+// src/providers/codex.ts
+import { resolve as resolve10 } from "path";
+import TOML from "@iarna/toml";
+var buildConfig, planCodex;
+var init_codex = __esm({
+  "src/providers/codex.ts"() {
+    "use strict";
+    buildConfig = (servers) => {
+      if (Object.keys(servers).length === 0) return null;
+      const mcpServers = {};
+      for (const [name, server] of Object.entries(servers)) {
+        if (server.transport === "http") {
+          const httpHeaders = {};
+          const envHeaders = {};
+          for (const [key, value] of Object.entries(server.headers ?? {})) {
+            const single = value.match(/^\$\{([^}]+)\}$/);
+            const embedded = value.match(/\$\{([^}]+)\}/);
+            if (single) {
+              envHeaders[key] = single[1];
+            } else if (embedded) {
+              envHeaders[key] = embedded[1];
+            } else {
+              httpHeaders[key] = value;
+            }
+          }
+          mcpServers[name] = {
+            url: server.url,
+            ...Object.keys(httpHeaders).length ? { http_headers: httpHeaders } : {},
+            ...Object.keys(envHeaders).length ? { env_http_headers: envHeaders } : {}
+          };
+        } else {
+          mcpServers[name] = {
+            command: server.command,
+            ...server.args && server.args.length ? { args: server.args } : {},
+            ...server.env ? { env: server.env } : {}
+          };
+        }
+      }
+      return { mcp_servers: mcpServers };
+    };
+    planCodex = (inputs) => {
+      const { targetRoot, rawMcpServers } = inputs;
+      const files = [];
+      const removeFiles = [];
+      const config = buildConfig(rawMcpServers);
+      const path = resolve10(targetRoot, ".codex/config.toml");
+      if (config) {
+        files.push({
+          path,
+          content: "# Generated by quiver. Source of truth: .agents/config.json\n" + TOML.stringify(config)
+        });
+      } else {
+        removeFiles.push(path);
+      }
+      return { files, removeFiles, symlinks: [], managedDirs: [] };
+    };
+  }
+});
+
+// src/providers/fsops.ts
+import {
+  existsSync as existsSync8,
+  lstatSync,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync6,
+  readlinkSync,
+  rmdirSync,
+  rmSync as rmSync4,
+  symlinkSync,
+  unlinkSync,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { dirname as dirname4, relative as relative3, resolve as resolve11 } from "path";
+var isENOENT, isMatchingSymlink, removePath, applyOutputs, checkOutputs;
+var init_fsops = __esm({
+  "src/providers/fsops.ts"() {
+    "use strict";
+    isENOENT = (e) => !!e && typeof e === "object" && "code" in e && e.code === "ENOENT";
+    isMatchingSymlink = (path, target) => {
+      const stats = lstatSync(path);
+      if (!stats.isSymbolicLink()) return false;
+      return resolve11(dirname4(path), readlinkSync(path)) === target;
+    };
+    removePath = (path) => {
+      let stats;
+      try {
+        stats = lstatSync(path);
+      } catch (e) {
+        if (isENOENT(e)) return;
+        throw e;
+      }
+      if (stats.isSymbolicLink()) unlinkSync(path);
+      else rmSync4(path, { force: true, recursive: true });
+    };
+    applyOutputs = ({
+      files,
+      symlinks,
+      removeFiles,
+      removeDirs = [],
+      managedDirs
+    }) => {
+      const result = { generated: [], linked: [], removed: [] };
+      for (const out of files) {
+        let current = null;
+        try {
+          current = readFileSync6(out.path, "utf8");
+        } catch (e) {
+          if (!isENOENT(e)) throw e;
+        }
+        if (current === out.content) continue;
+        mkdirSync5(dirname4(out.path), { recursive: true });
+        writeFileSync4(out.path, out.content);
+        result.generated.push(out.path);
+      }
+      for (const path of removeFiles) {
+        if (!existsSync8(path)) continue;
+        rmSync4(path, { force: true });
+        result.removed.push(path);
+      }
+      for (const path of removeDirs) {
+        if (!existsSync8(path)) continue;
+        removePath(path);
+        result.removed.push(path);
+      }
+      for (const path of removeDirs) {
+        try {
+          rmdirSync(dirname4(path));
+        } catch {
+        }
+      }
+      for (const link of symlinks) {
+        mkdirSync5(dirname4(link.path), { recursive: true });
+        try {
+          if (isMatchingSymlink(link.path, link.target)) continue;
+        } catch (e) {
+          if (!isENOENT(e)) throw e;
+        }
+        removePath(link.path);
+        symlinkSync(
+          relative3(dirname4(link.path), link.target),
+          link.path,
+          lstatSync(link.target).isDirectory() ? "dir" : "file"
+        );
+        result.linked.push(link.path);
+      }
+      for (const dir of managedDirs) {
+        if (!existsSync8(dir.path)) continue;
+        for (const child of readdirSync3(dir.path)) {
+          if (dir.expected.has(child)) continue;
+          const childPath = resolve11(dir.path, child);
+          removePath(childPath);
+          result.removed.push(childPath);
+        }
+      }
+      return result;
+    };
+    checkOutputs = ({
+      files,
+      symlinks,
+      removeFiles,
+      removeDirs = [],
+      managedDirs
+    }) => {
+      const problems = [];
+      for (const out of files) {
+        try {
+          if (readFileSync6(out.path, "utf8") !== out.content) {
+            problems.push(`out of sync: ${out.path}`);
+          }
+        } catch (e) {
+          if (isENOENT(e)) problems.push(`missing: ${out.path}`);
+          else throw e;
+        }
+      }
+      for (const path of removeFiles) {
+        if (existsSync8(path)) problems.push(`stale (should be removed): ${path}`);
+      }
+      for (const path of removeDirs) {
+        if (existsSync8(path)) problems.push(`stale (should be removed): ${path}`);
+      }
+      for (const link of symlinks) {
+        try {
+          if (!isMatchingSymlink(link.path, link.target)) {
+            problems.push(`out of sync symlink: ${link.path}`);
+          }
+        } catch (e) {
+          if (isENOENT(e)) problems.push(`missing symlink: ${link.path}`);
+          else throw e;
+        }
+      }
+      for (const dir of managedDirs) {
+        if (!existsSync8(dir.path)) continue;
+        for (const child of readdirSync3(dir.path)) {
+          if (!dir.expected.has(child)) {
+            problems.push(`unexpected shim: ${resolve11(dir.path, child)}`);
+          }
+        }
+      }
+      return problems;
+    };
+  }
+});
+
+// src/providers/opencode.ts
+import { resolve as resolve12 } from "path";
+var formatOpenCodeJson, planOpenCode;
+var init_opencode = __esm({
+  "src/providers/opencode.ts"() {
+    "use strict";
+    formatOpenCodeJson = (servers) => {
+      if (Object.keys(servers).length === 0) return null;
+      const mcp = {};
+      for (const [name, server] of Object.entries(servers)) {
+        if (server.transport === "http") {
+          mcp[name] = {
+            type: "remote",
+            url: server.url,
+            ...server.headers ? { headers: server.headers } : {}
+          };
+        } else {
+          mcp[name] = {
+            type: "local",
+            command: [server.command, ...server.args ?? []],
+            ...server.env ? { environment: server.env } : {}
+          };
+        }
+      }
+      return JSON.stringify(
+        { $schema: "https://opencode.ai/config.json", mcp },
+        null,
+        2
+      ) + "\n";
+    };
+    planOpenCode = (inputs) => {
+      const { targetRoot, selected, mcpServers } = inputs;
+      const files = [];
+      const removeFiles = [];
+      const json = formatOpenCodeJson(mcpServers);
+      const jsonPath = resolve12(targetRoot, "opencode.json");
+      if (json) files.push({ path: jsonPath, content: json });
+      else removeFiles.push(jsonPath);
+      const symlinks = [
+        ...selected.skills.map((s) => ({
+          path: resolve12(targetRoot, ".opencode/skills", s.name),
+          target: s.absDir
+        })),
+        ...selected.commands.map((c) => ({
+          path: resolve12(targetRoot, ".opencode/commands", `${c.name}.md`),
+          target: c.absPath
+        }))
+      ];
+      const managedDirs = [
+        {
+          path: resolve12(targetRoot, ".opencode/skills"),
+          expected: new Set(selected.skills.map((s) => s.name))
+        },
+        {
+          path: resolve12(targetRoot, ".opencode/commands"),
+          expected: new Set(selected.commands.map((c) => `${c.name}.md`))
+        }
+      ];
+      return { files, removeFiles, symlinks, managedDirs };
+    };
+  }
+});
+
+// src/providers/selection.ts
+var resolveSelection;
+var init_selection = __esm({
+  "src/providers/selection.ts"() {
+    "use strict";
+    init_schema();
+    resolveSelection = (catalog, lock) => {
+      const skillNames = /* @__PURE__ */ new Set();
+      const commandNames = /* @__PURE__ */ new Set();
+      const mcpNames = /* @__PURE__ */ new Set();
+      for (const id of Object.keys(lock.entries)) {
+        const parsed = parseEntryId(id);
+        if (!parsed) continue;
+        if (parsed.type === "skill") skillNames.add(parsed.name);
+        else if (parsed.type === "command") commandNames.add(parsed.name);
+        else if (parsed.type === "mcp") mcpNames.add(parsed.name);
+      }
+      return {
+        skills: catalog.skills.filter((s) => skillNames.has(s.name)),
+        commands: catalog.commands.filter((c) => commandNames.has(c.name)),
+        mcp: catalog.mcp.filter((m) => mcpNames.has(m.name))
+      };
+    };
+  }
+});
+
+// src/providers/write.ts
+import { existsSync as existsSync9, lstatSync as lstatSync2 } from "fs";
+import { basename, resolve as resolve13 } from "path";
+var isLinkable, buildPlan, writeProviders, checkProviders;
+var init_write = __esm({
+  "src/providers/write.ts"() {
+    "use strict";
+    init_schema();
+    init_interpolate();
+    init_claude();
+    init_codex();
+    init_fsops();
+    init_opencode();
+    init_selection();
+    isLinkable = (path) => {
+      try {
+        return lstatSync2(path).isSymbolicLink();
+      } catch {
+        return true;
+      }
+    };
+    buildPlan = (targetRoot, catalog, lock, onMissingEnv, onSkippedRootFile) => {
+      loadEnvLocal(targetRoot);
+      const selected = resolveSelection(catalog, lock);
+      const rawMcpServers = {};
+      for (const mcp of selected.mcp) rawMcpServers[mcp.name] = mcp.server;
+      const mcpServers = interpolateEnvVars(rawMcpServers, onMissingEnv);
+      const agentsRoot = resolve13(targetRoot, ".agents");
+      const inputs = {
+        targetRoot,
+        agentsRoot,
+        selected,
+        mcpServers,
+        rawMcpServers,
+        claudeSettings: catalog.config.claude?.settings ?? null
+      };
+      const active = lock.providers?.length ? lock.providers : [...PROVIDERS];
+      const planByProvider = {
+        claude: planClaude(inputs),
+        opencode: planOpenCode(inputs),
+        codex: planCodex(inputs)
+      };
+      const plans = [];
+      const removeDirs = [];
+      const removedOutputs = [];
+      for (const provider of PROVIDERS) {
+        const plan = planByProvider[provider];
+        if (active.includes(provider)) {
+          plans.push(plan);
+        } else {
+          removedOutputs.push(...plan.files.map((f) => f.path), ...plan.removeFiles);
+          removeDirs.push(
+            ...plan.symlinks.map((s) => s.path),
+            ...plan.managedDirs.map((d) => d.path)
+          );
+        }
+      }
+      const rootSymlinks = [];
+      const agentsMd = resolve13(agentsRoot, "AGENTS.md");
+      if (existsSync9(agentsMd)) {
+        const rootAgents = resolve13(targetRoot, "AGENTS.md");
+        for (const link of [
+          { path: rootAgents, target: agentsMd },
+          { path: resolve13(targetRoot, "CLAUDE.md"), target: rootAgents }
+        ]) {
+          if (isLinkable(link.path)) rootSymlinks.push(link);
+          else onSkippedRootFile?.(basename(link.path));
+        }
+      }
+      return {
+        files: plans.flatMap((p) => p.files),
+        removeFiles: [...plans.flatMap((p) => p.removeFiles), ...removedOutputs],
+        removeDirs,
+        symlinks: [...rootSymlinks, ...plans.flatMap((p) => p.symlinks)],
+        managedDirs: plans.flatMap((p) => p.managedDirs)
+      };
+    };
+    writeProviders = (targetRoot, catalog, lock) => {
+      const missing = /* @__PURE__ */ new Set();
+      const skipped = /* @__PURE__ */ new Set();
+      const plan = buildPlan(
+        targetRoot,
+        catalog,
+        lock,
+        (n) => missing.add(n),
+        (n) => skipped.add(n)
+      );
+      const result = applyOutputs(plan);
+      if (missing.size) {
+        console.warn(
+          `Warning: unset env vars left un-interpolated: ${[...missing].join(", ")}. Set them in .env.local and re-run quiver-cli sync.`
+        );
+      }
+      if (skipped.size) {
+        console.warn(
+          `Warning: ${[...skipped].join(", ")} already exist(s) and is not managed by quiver - left untouched. Merge .agents/AGENTS.md manually if desired.`
+        );
+      }
+      return result;
+    };
+    checkProviders = (targetRoot, catalog, lock) => {
+      const plan = buildPlan(targetRoot, catalog, lock, () => {
+      });
+      return checkOutputs(plan);
+    };
+  }
+});
+
+// src/commands/gitignore.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve14 } from "path";
+var HEADER, SECRETS_COMMENT, PROVIDER_ENTRIES, SHARED_ENTRIES, SECRET_ENTRIES, patchGitignore, ignoredSourcePaths;
+var init_gitignore = __esm({
+  "src/commands/gitignore.ts"() {
+    "use strict";
+    init_schema();
+    HEADER = "# Generated by quiver (source of truth: .agents/ + quiver.lock)";
+    SECRETS_COMMENT = "# Local secrets for MCP env-var interpolation";
+    PROVIDER_ENTRIES = {
+      claude: [".claude/", ".mcp.json"],
+      opencode: [".opencode/", "opencode.json"],
+      codex: [".codex/"]
+    };
+    SHARED_ENTRIES = ["AGENTS.md", "CLAUDE.md"];
+    SECRET_ENTRIES = [".env.local"];
+    patchGitignore = (targetRoot, providers) => {
+      const path = resolve14(targetRoot, ".gitignore");
+      const current = existsSync10(path) ? readFileSync7(path, "utf8") : "";
+      const lines = new Set(current.split("\n").map((l) => l.trim()));
+      const active = providers?.length ? providers : [...PROVIDERS];
+      const shimEntries = [
+        ...active.flatMap((p) => PROVIDER_ENTRIES[p]),
+        ...SHARED_ENTRIES
+      ];
+      const missingShims = shimEntries.filter((e) => !lines.has(e));
+      const missingSecrets = SECRET_ENTRIES.filter((e) => !lines.has(e));
+      if (missingShims.length === 0 && missingSecrets.length === 0) return false;
+      const block2 = [];
+      if (missingShims.length) block2.push(HEADER, ...missingShims);
+      if (missingSecrets.length) block2.push(SECRETS_COMMENT, ...missingSecrets);
+      const prefix = current && !current.endsWith("\n") ? "\n" : "";
+      writeFileSync5(
+        path,
+        current + prefix + (current ? "\n" : "") + block2.join("\n") + "\n"
+      );
+      return true;
+    };
+    ignoredSourcePaths = (targetRoot) => {
+      try {
+        const out = execFileSync2(
+          "git",
+          ["check-ignore", ".agents", "quiver.lock"],
+          { cwd: targetRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+        );
+        return out.split("\n").map((l) => l.trim()).filter(Boolean);
+      } catch {
+        return [];
+      }
+    };
+  }
+});
+
+// src/commands/select.ts
+var DEFAULT_SKILLS, DEFAULT_COMMANDS, skillHint, serverDetail, selectFromCatalog;
+var init_select = __esm({
+  "src/commands/select.ts"() {
+    "use strict";
+    init_prompts();
+    DEFAULT_SKILLS = ["find-skills", "skill-creator"];
+    DEFAULT_COMMANDS = ["cp"];
+    skillHint = (fm) => {
+      const parts = [];
+      if (fm.version) parts.push(`v${fm.version}`);
+      if (fm.description) {
+        const flat = fm.description.replace(/\s+/g, " ").trim();
+        const max = 70;
+        parts.push(flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat);
+      }
+      return parts.join(" \xB7 ");
+    };
+    serverDetail = (catalog, name) => {
+      const entry = catalog.mcp.find((m) => m.name === name);
+      if (!entry) return "";
+      const s = entry.server;
+      return s.transport === "http" ? s.url : [s.command, ...s.args ?? []].filter(Boolean).join(" ");
+    };
+    selectFromCatalog = async (catalog, { interactive }) => {
+      const allSkills = catalog.skills.map((s) => s.name);
+      const allCommands = catalog.commands.map((c) => c.name);
+      const allMcp = catalog.mcp.map((m) => m.name);
+      if (!interactive || !process.stdin.isTTY) {
+        return { skills: allSkills, commands: allCommands, mcp: allMcp };
+      }
+      const groupNames = [...new Set(catalog.skills.map((s) => s.group))].sort(
+        (a, b) => a === "general" ? -1 : b === "general" ? 1 : a.localeCompare(b)
+      );
+      const skillGroups = groupNames.map((name) => ({
+        name,
+        items: catalog.skills.filter((s) => s.group === name).sort((a, b) => {
+          if (name === "general") {
+            const ad = DEFAULT_SKILLS.includes(a.name);
+            const bd = DEFAULT_SKILLS.includes(b.name);
+            if (ad !== bd) return ad ? -1 : 1;
+          }
+          return a.name.localeCompare(b.name);
+        }).map((s) => {
+          const hint = skillHint(s.frontmatter);
+          return { value: s.name, label: s.name, ...hint ? { hint } : {} };
+        })
+      }));
+      const skills = catalog.skills.length ? await selectGrouped({
+        message: "Select skills (space toggles, a all, enter confirms)",
+        groups: skillGroups,
+        initialValues: allSkills.filter((s) => DEFAULT_SKILLS.includes(s))
+      }) : [];
+      const commands = catalog.commands.length ? await selectGrouped({
+        message: "Select commands (space toggles, a all, enter confirms)",
+        groups: [
+          {
+            name: "commands",
+            items: catalog.commands.map((c) => ({
+              value: c.name,
+              label: `/${c.name}`
+            }))
+          }
+        ],
+        initialValues: allCommands.filter((c) => DEFAULT_COMMANDS.includes(c))
+      }) : [];
+      const remote = catalog.mcp.filter((m) => m.server.transport === "http");
+      const local = catalog.mcp.filter((m) => m.server.transport !== "http");
+      const mcpGroups = [
+        { name: "remote", items: remote },
+        { name: "local", items: local }
+      ].filter((g) => g.items.length).map((g) => ({
+        name: g.name,
+        items: g.items.map((m) => ({
+          value: m.name,
+          label: m.name,
+          hint: serverDetail(catalog, m.name)
+        }))
+      }));
+      const mcp = catalog.mcp.length ? await selectGrouped({
+        message: "Select MCP servers (space toggles, a all, enter confirms)",
+        groups: mcpGroups,
+        initialValues: []
+      }) : [];
+      return { skills, commands, mcp };
+    };
+  }
+});
+
+// src/commands/init.ts
+var init_exports = {};
+__export(init_exports, {
+  init: () => init
+});
+var init, resolveProviders;
+var init_init = __esm({
+  "src/commands/init.ts"() {
+    "use strict";
+    init_discover();
+    init_entries();
+    init_materialize();
+    init_resolve();
+    init_io();
+    init_schema();
+    init_write();
+    init_interpolate();
+    init_prompts();
+    init_gitignore();
+    init_select();
+    init = async (options) => {
+      await banner();
+      if (lockfileExists(options.targetRoot) && !options.force) {
+        await warn(
+          "quiver.lock already exists. Use `quiver-cli add/remove` to change it, or --force to re-init."
+        );
+        return;
+      }
+      const catalogSource = options.catalog ?? DEFAULT_CATALOG_SOURCE;
+      const source = await resolveCatalog(catalogSource);
+      if (source.resolved) {
+        await step(
+          `Catalog: ${source.source} @ ${source.resolved.slice(0, 12)}${source.ref ? ` (${source.ref})` : ""}`
+        );
+      }
+      const sourceCatalog = loadCatalog(source);
+      const selection = await selectFromCatalog(sourceCatalog, {
+        interactive: !options.all
+      });
+      const providers = await resolveProviders(options);
+      if (providers === null) return;
+      const resolved = materializeCatalog(
+        options.targetRoot,
+        source,
+        sourceCatalog,
+        selection
+      );
+      const catalog = loadCatalog(resolved);
+      const lock = emptyLockfile(resolved.source, {
+        ref: source.ref ?? null,
+        resolved: source.resolved ?? null
+      });
+      lock.providers = providers;
+      for (const skill of catalog.skills) {
+        if (selection.skills.includes(skill.name)) {
+          lock.entries[entryId("skill", skill.name)] = skillToEntry(skill);
+        }
+      }
+      for (const command of catalog.commands) {
+        if (selection.commands.includes(command.name)) {
+          lock.entries[entryId("command", command.name)] = commandToEntry(command);
+        }
+      }
+      for (const mcp of catalog.mcp) {
+        if (selection.mcp.includes(mcp.name)) {
+          lock.entries[entryId("mcp", mcp.name)] = mcpToEntry(mcp);
+        }
+      }
+      writeLockfile(options.targetRoot, lock);
+      await step(
+        `Wrote quiver.lock (${selection.skills.length} skills, ${selection.commands.length} commands, ${selection.mcp.length} MCP servers)`
+      );
+      const result = writeProviders(options.targetRoot, catalog, lock);
+      if (result.generated.length || result.linked.length) {
+        await step(
+          `Provider configs: ${result.generated.length} generated, ${result.linked.length} linked`
+        );
+      }
+      if (patchGitignore(options.targetRoot, providers)) {
+        await step("Updated .gitignore (generated shims + .env.local ignored)");
+      }
+      const ignored = ignoredSourcePaths(options.targetRoot);
+      if (ignored.length) {
+        await warn(
+          `Source of truth is gitignored: ${ignored.join(", ")}. Remove those .gitignore entries - a fresh clone would miss them.`
+        );
+      }
+      const envVars = collectEnvVars(catalog.config.mcpServers ?? {});
+      if (envVars.length) {
+        await info(
+          `MCP secrets needed: ${envVars.join(", ")} - fill them in .env.local (template: .env.local.example)`
+        );
+      }
+      await outro(
+        "Done. Commit .agents/ and quiver.lock; restart your AI tool to load the config."
+      );
+    };
+    resolveProviders = async (options) => {
+      if (options.providers) {
+        const invalid = options.providers.filter((p) => !isProvider(p));
+        if (invalid.length) {
+          await error(
+            `Unknown provider(s): ${invalid.join(", ")}. Valid: ${PROVIDERS.join(", ")}.`
+          );
+          process.exitCode = 1;
+          return null;
+        }
+        return options.providers.filter(isProvider);
+      }
+      if (options.all || !process.stdin.isTTY) return [...PROVIDERS];
+      const picked = await selectGrouped({
+        message: "Generate configs for (space toggles, enter confirms)",
+        groups: [
+          {
+            name: "providers",
+            items: [
+              { value: "claude", label: "Claude Code" },
+              { value: "opencode", label: "opencode" },
+              { value: "codex", label: "Codex" }
+            ]
+          }
+        ],
+        initialValues: [...PROVIDERS]
+      });
+      return picked.length ? picked : [...PROVIDERS];
+    };
+  }
+});
+
+// src/catalog/repo.ts
+import { existsSync as existsSync11 } from "fs";
+import { resolve as resolve15 } from "path";
+var repoCatalogRoot, repoCatalogExists, loadRepoCatalog;
+var init_repo = __esm({
+  "src/catalog/repo.ts"() {
+    "use strict";
+    init_discover();
+    repoCatalogRoot = (targetRoot) => resolve15(targetRoot, ".agents");
+    repoCatalogExists = (targetRoot) => existsSync11(repoCatalogRoot(targetRoot));
+    loadRepoCatalog = (targetRoot, source) => {
+      const resolved = {
+        source,
+        root: repoCatalogRoot(targetRoot)
+      };
+      return { resolved, catalog: loadCatalog(resolved) };
+    };
+  }
+});
+
+// src/commands/add.ts
+var add_exports = {};
+__export(add_exports, {
+  add: () => add
+});
+var add, selectionFromLock;
+var init_add = __esm({
+  "src/commands/add.ts"() {
+    "use strict";
+    init_discover();
+    init_entries();
+    init_materialize();
+    init_repo();
+    init_resolve();
+    init_io();
+    init_schema();
+    init_write();
+    init_prompts();
+    add = async (options) => {
+      const id = options.positionals[0];
+      if (!id) {
+        await error("Usage: quiver-cli add <skill:name|command:name|mcp:name>");
+        process.exitCode = 1;
+        return;
+      }
+      const parsed = parseEntryId(id);
+      if (!parsed) {
+        await error(`Invalid id "${id}". Expected skill:<name>, command:<name> or mcp:<name>.`);
+        process.exitCode = 1;
+        return;
+      }
+      const lock = readLockfile(options.targetRoot);
+      if (!lock) {
+        await error("No quiver.lock found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      if (lock.entries[id]) {
+        await info(`${id} is already installed.`);
+        return;
+      }
+      const source = await resolveCatalog(lock.catalog.source, {
+        pinnedSha: lock.catalog.resolved
+      });
+      const sourceCatalog = loadCatalog(source);
+      const skill = sourceCatalog.skills.find((s) => s.name === parsed.name);
+      const command = sourceCatalog.commands.find((c) => c.name === parsed.name);
+      const mcp = sourceCatalog.mcp.find((m) => m.name === parsed.name);
+      const entry = parsed.type === "skill" && skill ? skillToEntry(skill) : parsed.type === "command" && command ? commandToEntry(command) : parsed.type === "mcp" && mcp ? mcpToEntry(mcp) : null;
+      if (!entry) {
+        await error(`${id} not found in catalog.`);
+        process.exitCode = 1;
+        return;
+      }
+      const selection = selectionFromLock(lock);
+      if (parsed.type === "skill") selection.skills.push(parsed.name);
+      if (parsed.type === "command") selection.commands.push(parsed.name);
+      if (parsed.type === "mcp") selection.mcp.push(parsed.name);
+      materializeCatalog(options.targetRoot, source, sourceCatalog, selection);
+      lock.entries[id] = entry;
+      writeLockfile(options.targetRoot, lock);
+      const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
+      writeProviders(options.targetRoot, catalog, lock);
+      await success(`Added ${id}.`);
+    };
+    selectionFromLock = (lock) => {
+      const selection = { skills: [], commands: [], mcp: [] };
+      for (const lid of Object.keys(lock.entries)) {
+        const p = parseEntryId(lid);
+        if (!p) continue;
+        if (p.type === "skill") selection.skills.push(p.name);
+        else if (p.type === "command") selection.commands.push(p.name);
+        else if (p.type === "mcp") selection.mcp.push(p.name);
+      }
+      return selection;
+    };
+  }
+});
+
+// src/commands/remove.ts
+var remove_exports = {};
+__export(remove_exports, {
+  remove: () => remove
+});
+import { existsSync as existsSync12, readdirSync as readdirSync4, readFileSync as readFileSync8, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
+import { resolve as resolve16 } from "path";
+var remove, cleanupEmptyGroups, rewriteRepoMcp;
+var init_remove = __esm({
+  "src/commands/remove.ts"() {
+    "use strict";
+    init_materialize();
+    init_repo();
+    init_io();
+    init_schema();
+    init_write();
+    init_prompts();
+    remove = async (options) => {
+      const id = options.positionals[0];
+      if (!id) {
+        await error("Usage: quiver remove <skill:name|command:name|mcp:name>");
+        process.exitCode = 1;
+        return;
+      }
+      const parsed = parseEntryId(id);
+      if (!parsed) {
+        await error(`Invalid id "${id}".`);
+        process.exitCode = 1;
+        return;
+      }
+      const lock = readLockfile(options.targetRoot);
+      if (!lock) {
+        await error("No quiver.lock found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      const entry = lock.entries[id];
+      if (!entry) {
+        await info(`${id} is not installed.`);
+        return;
+      }
+      if (entry.type === "skill" || entry.type === "command") {
+        removeArtifact(options.targetRoot, entry.sourcePath);
+        cleanupEmptyGroups(options.targetRoot);
+      }
+      delete lock.entries[id];
+      writeLockfile(options.targetRoot, lock);
+      rewriteRepoMcp(options.targetRoot, lock);
+      const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
+      writeProviders(options.targetRoot, catalog, lock);
+      await success(`Removed ${id}.`);
+    };
+    cleanupEmptyGroups = (targetRoot) => {
+      const skillsRoot = resolve16(targetRoot, ".agents/skills");
+      if (!existsSync12(skillsRoot)) return;
+      for (const entry of readdirSync4(skillsRoot, { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        const dir = resolve16(skillsRoot, entry.name);
+        if (existsSync12(resolve16(dir, "SKILL.md"))) continue;
+        if (readdirSync4(dir).length === 0) rmSync5(dir, { recursive: true, force: true });
+      }
+    };
+    rewriteRepoMcp = (targetRoot, lock) => {
+      const configPath = resolve16(targetRoot, ".agents/config.json");
+      if (!existsSync12(configPath)) return;
+      const config = JSON.parse(readFileSync8(configPath, "utf8"));
+      if (!config.mcpServers) return;
+      const keep = new Set(
+        Object.keys(lock.entries).map(parseEntryId).filter((p) => p?.type === "mcp").map((p) => p.name)
+      );
+      const kept = {};
+      for (const [name, server] of Object.entries(config.mcpServers)) {
+        if (keep.has(name)) kept[name] = server;
+      }
+      if (Object.keys(kept).length) config.mcpServers = kept;
+      else delete config.mcpServers;
+      writeFileSync6(configPath, JSON.stringify(config, null, 2) + "\n");
+    };
+  }
+});
+
+// src/commands/locksync.ts
+var refreshLockDigests;
+var init_locksync = __esm({
+  "src/commands/locksync.ts"() {
+    "use strict";
+    refreshLockDigests = (catalog, lock) => {
+      const drift = [];
+      const skillByName = new Map(catalog.skills.map((s) => [s.name, s]));
+      const commandByName = new Map(catalog.commands.map((c) => [c.name, c]));
+      const mcpByName = new Map(catalog.mcp.map((m) => [m.name, m]));
+      for (const [id, entry] of Object.entries(lock.entries)) {
+        if (entry.type === "skill") {
+          const cat = skillByName.get(id.slice("skill:".length));
+          if (!cat) continue;
+          if (cat.digest !== entry.digest) {
+            drift.push(`${id}: skill content changed`);
+            entry.digest = cat.digest;
+            entry.frontmatter = cat.frontmatter;
+          }
+        } else if (entry.type === "command") {
+          const cat = commandByName.get(id.slice("command:".length));
+          if (!cat) continue;
+          if (cat.digest !== entry.digest) {
+            drift.push(`${id}: command content changed`);
+            entry.digest = cat.digest;
+          }
+        } else if (entry.type === "mcp") {
+          const cat = mcpByName.get(id.slice("mcp:".length));
+          if (!cat) continue;
+          if (cat.configDigest !== entry.configDigest) {
+            drift.push(`${id}: MCP server definition changed`);
+            entry.configDigest = cat.configDigest;
+            entry.transport = cat.server.transport;
+          }
+        }
+      }
+      return drift;
+    };
+  }
+});
+
+// src/commands/sync.ts
+var sync_exports = {};
+__export(sync_exports, {
+  sync: () => sync
+});
+var sync;
+var init_sync = __esm({
+  "src/commands/sync.ts"() {
+    "use strict";
+    init_repo();
+    init_io();
+    init_schema();
+    init_write();
+    init_prompts();
+    init_gitignore();
+    init_locksync();
+    sync = async (options) => {
+      const lock = readLockfile(options.targetRoot);
+      if (!lock) {
+        await error("No quiver.lock found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      if (!repoCatalogExists(options.targetRoot)) {
+        await error("No .agents/ directory found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
+      const haveSkills = new Set(catalog.skills.map((s) => s.name));
+      const haveCommands = new Set(catalog.commands.map((c) => c.name));
+      const haveMcp = new Set(catalog.mcp.map((m) => m.name));
+      const orphans = [];
+      for (const id of Object.keys(lock.entries)) {
+        const p = parseEntryId(id);
+        if (!p) continue;
+        const present = p.type === "skill" && haveSkills.has(p.name) || p.type === "command" && haveCommands.has(p.name) || p.type === "mcp" && haveMcp.has(p.name);
+        if (!present) orphans.push(id);
+      }
+      if (orphans.length) {
+        await warn(
+          `Lockfile references missing catalog entries: ${orphans.join(", ")}. Run \`quiver-cli remove <id>\` to drop them.`
+        );
+      }
+      const drift = refreshLockDigests(catalog, lock);
+      if (drift.length) {
+        await warn(`Catalog drift detected:
+  - ${drift.join("\n  - ")}`);
+      }
+      const ignored = ignoredSourcePaths(options.targetRoot);
+      if (ignored.length) {
+        await warn(
+          `Source of truth is gitignored: ${ignored.join(", ")}. Remove those .gitignore entries - a fresh clone would miss them.`
+        );
+      }
+      writeLockfile(options.targetRoot, lock);
+      const result = writeProviders(options.targetRoot, catalog, lock);
+      await success(
+        `Synced: ${result.generated.length} generated, ${result.linked.length} linked, ${result.removed.length} removed`
+      );
+    };
+  }
+});
+
+// src/commands/update.ts
+var update_exports = {};
+__export(update_exports, {
+  update: () => update
+});
+import { cpSync as cpSync2, mkdirSync as mkdirSync6, readFileSync as readFileSync9, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname5, resolve as resolve17 } from "path";
+var update, applyUpdate, report;
+var init_update = __esm({
+  "src/commands/update.ts"() {
+    "use strict";
+    init_discover();
+    init_repo();
+    init_resolve();
+    init_io();
+    init_schema();
+    init_write();
+    init_prompts();
+    update = async (options) => {
+      const lock = readLockfile(options.targetRoot);
+      if (!lock) {
+        await error("No quiver.lock found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      if (!repoCatalogExists(options.targetRoot)) {
+        await error("No .agents/ directory found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      const onlyId = options.positionals[0];
+      if (onlyId && !lock.entries[onlyId]) {
+        await error(`${onlyId} is not installed (not found in quiver.lock).`);
+        process.exitCode = 1;
+        return;
+      }
+      const source = await resolveCatalog(lock.catalog.source);
+      const sourceCatalog = loadCatalog(source);
+      const catalogMoved = source.resolved != null && source.resolved !== lock.catalog.resolved;
+      if (catalogMoved) {
+        lock.catalog.ref = source.ref ?? lock.catalog.ref;
+        lock.catalog.resolved = source.resolved ?? null;
+        lock.catalog.fetchedAt = source.fetchedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+      }
+      const { catalog: repoCatalog } = loadRepoCatalog(
+        options.targetRoot,
+        lock.catalog.source
+      );
+      const ids = onlyId ? [onlyId] : Object.keys(lock.entries).sort();
+      const reports = [];
+      let changed = false;
+      for (const id of ids) {
+        const parsed = parseEntryId(id);
+        const entry = lock.entries[id];
+        if (!parsed || !entry) continue;
+        const report4 = applyUpdate(
+          options.targetRoot,
+          parsed,
+          entry,
+          sourceCatalog,
+          repoCatalog,
+          lock,
+          options.force
+        );
+        if (report4.status === "updated") changed = true;
+        reports.push(report4);
+      }
+      if (changed || catalogMoved) {
+        writeLockfile(options.targetRoot, lock);
+      }
+      if (changed) {
+        const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
+        writeProviders(options.targetRoot, catalog, lock);
+      }
+      report(reports, options);
+    };
+    applyUpdate = (targetRoot, parsed, entry, sourceCatalog, repoCatalog, lock, force) => {
+      const id = `${parsed.type}:${parsed.name}`;
+      if (entry.type === "skill") {
+        const src2 = sourceCatalog.skills.find((s) => s.name === parsed.name);
+        if (!src2) return { id, status: "not-in-catalog" };
+        if (src2.digest === entry.digest) return { id, status: "up-to-date" };
+        const repo2 = repoCatalog.skills.find((s) => s.name === parsed.name);
+        if (repo2 && repo2.digest !== entry.digest && !force) {
+          return { id, status: "local-changes" };
+        }
+        const dest = resolve17(targetRoot, ".agents", src2.sourcePath);
+        rmSync6(dest, { recursive: true, force: true });
+        mkdirSync6(dirname5(dest), { recursive: true });
+        cpSync2(src2.absDir, dest, { recursive: true });
+        entry.digest = src2.digest;
+        entry.frontmatter = src2.frontmatter;
+        entry.sourcePath = src2.sourcePath;
+        return { id, status: "updated" };
+      }
+      if (entry.type === "command") {
+        const src2 = sourceCatalog.commands.find((c) => c.name === parsed.name);
+        if (!src2) return { id, status: "not-in-catalog" };
+        if (src2.digest === entry.digest) return { id, status: "up-to-date" };
+        const repo2 = repoCatalog.commands.find((c) => c.name === parsed.name);
+        if (repo2 && repo2.digest !== entry.digest && !force) {
+          return { id, status: "local-changes" };
+        }
+        const dest = resolve17(targetRoot, ".agents", src2.sourcePath);
+        mkdirSync6(dirname5(dest), { recursive: true });
+        cpSync2(src2.absPath, dest, { force: true });
+        entry.digest = src2.digest;
+        entry.sourcePath = src2.sourcePath;
+        return { id, status: "updated" };
+      }
+      const src = sourceCatalog.mcp.find((m) => m.name === parsed.name);
+      if (!src) return { id, status: "not-in-catalog" };
+      if (src.configDigest === entry.configDigest) return { id, status: "up-to-date" };
+      const repo = repoCatalog.mcp.find((m) => m.name === parsed.name);
+      if (repo && repo.configDigest !== entry.configDigest && !force) {
+        return { id, status: "local-changes" };
+      }
+      const configPath = resolve17(targetRoot, ".agents", "config.json");
+      const config = JSON.parse(readFileSync9(configPath, "utf8"));
+      config.mcpServers = { ...config.mcpServers, [parsed.name]: src.server };
+      writeFileSync7(configPath, JSON.stringify(config, null, 2) + "\n");
+      entry.configDigest = src.configDigest;
+      entry.transport = src.server.transport;
+      entry.tools = null;
+      entry.toolsFetchedAt = null;
+      return { id, status: "updated" };
+    };
+    report = (reports, options) => {
+      const by = (s) => reports.filter((r) => r.status === s);
+      if (options.json) {
+        console.log(
+          JSON.stringify(
+            {
+              ok: true,
+              updated: by("updated").map((r) => r.id),
+              upToDate: by("up-to-date").map((r) => r.id),
+              localChanges: by("local-changes").map((r) => r.id),
+              notInCatalog: by("not-in-catalog").map((r) => r.id)
+            },
+            null,
+            2
+          )
+        );
+        return;
+      }
+      const c = palette();
+      const lines = [""];
+      for (const r of by("updated")) lines.push(`  ${c.cyan("\u2191")} ${r.id}  updated`);
+      for (const r of by("local-changes"))
+        lines.push(
+          `  ${c.yellow("\u25B2")} ${r.id}  ${c.yellow("local changes - skipped (use --force)")}`
+        );
+      for (const r of by("not-in-catalog"))
+        lines.push(`  ${c.dim("\u2022")} ${r.id}  ${c.dim("not in catalog")}`);
+      for (const r of by("up-to-date"))
+        lines.push(`  ${c.green("\u2713")} ${r.id}  ${c.dim("up to date")}`);
+      const updated = by("updated").length;
+      lines.push(
+        "",
+        `  ${updated ? c.cyan(`\u2191 ${updated} updated - review and commit .agents/ + quiver.lock`) : c.green("\u2713 everything up to date with the catalog")}`,
+        ""
+      );
+      block(lines);
+    };
+  }
+});
+
+// src/commands/list.ts
+var list_exports = {};
+__export(list_exports, {
+  list: () => list
+});
+var truncate, list;
+var init_list = __esm({
+  "src/commands/list.ts"() {
+    "use strict";
+    init_repo();
+    init_io();
+    init_schema();
+    init_prompts();
+    truncate = (s, max = 60) => {
+      const flat = s.replace(/\s+/g, " ").trim();
+      return flat.length > max ? flat.slice(0, max - 1) + "\u2026" : flat;
+    };
+    list = async (options) => {
+      const lock = readLockfile(options.targetRoot);
+      if (!lock) {
+        if (options.json) console.log(JSON.stringify({ ok: false, error: "no-lockfile" }));
+        else await error("No quiver.lock found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      const serverDetail2 = /* @__PURE__ */ new Map();
+      if (repoCatalogExists(options.targetRoot)) {
+        const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
+        for (const mcp2 of catalog.mcp) {
+          serverDetail2.set(
+            mcp2.name,
+            mcp2.server.transport === "http" ? mcp2.server.url : [mcp2.server.command, ...mcp2.server.args ?? []].join(" ")
+          );
+        }
+      }
+      const skills = [];
+      const commands = [];
+      const mcp = [];
+      for (const [id, entry] of Object.entries(lock.entries)) {
+        const p = parseEntryId(id);
+        if (!p) continue;
+        if (entry.type === "skill") skills.push({ name: p.name, entry });
+        else if (entry.type === "command") commands.push({ name: p.name, entry });
+        else if (entry.type === "mcp") mcp.push({ name: p.name, entry });
+      }
+      for (const group of [skills, commands, mcp]) {
+        group.sort((a, b) => a.name.localeCompare(b.name));
+      }
+      if (options.json) {
+        console.log(
+          JSON.stringify(
+            {
+              ok: true,
+              skills: skills.map(({ name, entry }) => ({
+                name,
+                version: entry.frontmatter.version,
+                description: entry.frontmatter.description
+              })),
+              commands: commands.map(({ name }) => ({ name })),
+              mcp: mcp.map(({ name, entry }) => ({
+                name,
+                transport: entry.transport,
+                detail: serverDetail2.get(name) ?? null,
+                toolCount: entry.tools ? Object.keys(entry.tools).length : null
+              }))
+            },
+            null,
+            2
+          )
+        );
+        return;
+      }
+      const c = palette();
+      const lines = [""];
+      const width = Math.max(
+        0,
+        ...[...skills, ...commands, ...mcp].map((e) => e.name.length + 1)
+      );
+      if (skills.length) {
+        lines.push(`  ${c.bold("skills")}`);
+        for (const { name, entry } of skills) {
+          const version = entry.frontmatter.version ? c.cyan(`v${entry.frontmatter.version} `) : "";
+          const desc = entry.frontmatter.description ? c.dim(truncate(entry.frontmatter.description)) : "";
+          lines.push(`    ${name.padEnd(width)} ${version}${desc}`);
+        }
+      }
+      if (commands.length) {
+        lines.push("", `  ${c.bold("commands")}`);
+        for (const { name } of commands) {
+          lines.push(`    /${name}`);
+        }
+      }
+      if (mcp.length) {
+        lines.push("", `  ${c.bold("mcp servers")}`);
+        for (const { name, entry } of mcp) {
+          const tools = entry.tools ? c.green(`${Object.keys(entry.tools).length} tools`) : c.dim("tools: ? (run check)");
+          const detail = serverDetail2.get(name);
+          lines.push(
+            `    ${name.padEnd(width)} ${entry.transport.padEnd(5)} ${tools}` + (detail ? `  ${c.dim(detail)}` : "")
+          );
+        }
+      }
+      const providers = lock.providers?.length ? lock.providers.join(", ") : "claude, opencode, codex";
+      lines.push(
+        "",
+        `  ${c.bold(
+          `${skills.length} skills \xB7 ${commands.length} commands \xB7 ${mcp.length} MCP servers`
+        )}  ${c.dim(`providers: ${providers}`)}`,
+        ""
+      );
+      block(lines);
+    };
+  }
+});
+
+// src/commands/status.ts
+var status_exports = {};
+__export(status_exports, {
+  status: () => status
+});
+var status;
+var init_status = __esm({
+  "src/commands/status.ts"() {
+    "use strict";
+    init_repo();
+    init_io();
+    init_schema();
+    init_write();
+    init_prompts();
+    status = async (options) => {
+      const lock = readLockfile(options.targetRoot);
+      if (!lock) {
+        if (options.json) console.log(JSON.stringify({ ok: false, error: "no-lockfile" }));
+        else await error("No quiver.lock found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      if (!repoCatalogExists(options.targetRoot)) {
+        if (options.json) console.log(JSON.stringify({ ok: false, error: "no-agents" }));
+        else await error("No .agents/ directory found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
+      const haveSkills = new Set(catalog.skills.map((s) => s.name));
+      const haveCommands = new Set(catalog.commands.map((c) => c.name));
+      const haveMcp = new Set(catalog.mcp.map((m) => m.name));
+      const missing = [];
+      const changed = [];
+      const skillByName = new Map(catalog.skills.map((s) => [s.name, s]));
+      const commandByName = new Map(catalog.commands.map((c) => [c.name, c]));
+      const mcpByName = new Map(catalog.mcp.map((m) => [m.name, m]));
+      for (const [id, entry] of Object.entries(lock.entries)) {
+        const p = parseEntryId(id);
+        if (!p) continue;
+        if (p.type === "skill") {
+          if (!haveSkills.has(p.name)) missing.push(id);
+          else if (entry.type === "skill" && skillByName.get(p.name).digest !== entry.digest)
+            changed.push(id);
+        } else if (p.type === "command") {
+          if (!haveCommands.has(p.name)) missing.push(id);
+          else if (entry.type === "command" && commandByName.get(p.name).digest !== entry.digest)
+            changed.push(id);
+        } else if (p.type === "mcp") {
+          if (!haveMcp.has(p.name)) missing.push(id);
+          else if (entry.type === "mcp" && mcpByName.get(p.name).configDigest !== entry.configDigest)
+            changed.push(id);
+        }
+      }
+      const shimProblems = checkProviders(options.targetRoot, catalog, lock);
+      const ok = missing.length === 0 && changed.length === 0 && shimProblems.length === 0;
+      if (options.json) {
+        console.log(JSON.stringify({ ok, missing, changed, shims: shimProblems }, null, 2));
+        if (!ok) process.exitCode = 1;
+        return;
+      }
+      if (ok) {
+        await success("In sync: lockfile, .agents/ and provider shims agree.");
+        return;
+      }
+      if (missing.length)
+        await warn(`Missing in .agents/: ${missing.join(", ")}`);
+      if (changed.length)
+        await warn(`Content changed since lockfile: ${changed.join(", ")}`);
+      if (shimProblems.length)
+        await warn(`Provider shims out of date:
+  - ${shimProblems.join("\n  - ")}`);
+      await info("Run `quiver-cli sync` to regenerate provider shims and refresh digests.");
+      process.exitCode = 1;
+    };
+  }
+});
+
+// src/mcp/diff.ts
+var diffSnapshots, isEmptyDiff;
+var init_diff = __esm({
+  "src/mcp/diff.ts"() {
+    "use strict";
+    diffSnapshots = (before, after) => {
+      const diff = {
+        added: [],
+        removed: [],
+        schemaChanged: [],
+        descriptionChanged: []
+      };
+      for (const name of Object.keys(after)) {
+        if (!(name in before)) diff.added.push(name);
+      }
+      for (const name of Object.keys(before)) {
+        if (!(name in after)) {
+          diff.removed.push(name);
+          continue;
+        }
+        const b = before[name];
+        const a = after[name];
+        if (b.inputSchemaHash !== a.inputSchemaHash) diff.schemaChanged.push(name);
+        if (b.description !== a.description) {
+          diff.descriptionChanged.push({
+            name,
+            before: b.description,
+            after: a.description
+          });
+        }
+      }
+      diff.added.sort();
+      diff.removed.sort();
+      diff.schemaChanged.sort();
+      diff.descriptionChanged.sort((x2, y) => x2.name.localeCompare(y.name));
+      return diff;
+    };
+    isEmptyDiff = (d) => d.added.length === 0 && d.removed.length === 0 && d.schemaChanged.length === 0 && d.descriptionChanged.length === 0;
+  }
+});
+
+// src/mcp/introspect.ts
+var CONNECT_TIMEOUT_MS, withTimeout, introspect, errMsg;
+var init_introspect = __esm({
+  "src/mcp/introspect.ts"() {
+    "use strict";
+    CONNECT_TIMEOUT_MS = 15e3;
+    withTimeout = async (p, ms) => {
+      let timer;
+      const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timed out after ${ms}ms`)), ms);
+      });
+      try {
+        return await Promise.race([p, timeout]);
+      } finally {
+        clearTimeout(timer);
+      }
+    };
+    introspect = async (server, { allowStdio }) => {
+      const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
+      let transport;
+      try {
+        if (server.transport === "http") {
+          const { StreamableHTTPClientTransport } = await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
+          const requestInit = server.headers ? { headers: server.headers } : {};
+          transport = new StreamableHTTPClientTransport(new URL(server.url), {
+            requestInit
+          });
+        } else {
+          if (!allowStdio) {
+            return {
+              ok: false,
+              reason: "stdio server skipped (pass --introspect-stdio to run it)"
+            };
+          }
+          const { StdioClientTransport } = await import("@modelcontextprotocol/sdk/client/stdio.js");
+          transport = new StdioClientTransport({
+            command: server.command,
+            args: server.args ?? [],
+            env: { ...process.env, ...server.env ?? {} }
+          });
+        }
+      } catch (e) {
+        return { ok: false, reason: `transport error: ${errMsg(e)}` };
+      }
+      const client = new Client(
+        { name: "quiver", version: "1.0.0" },
+        { capabilities: {} }
+      );
+      try {
+        await withTimeout(client.connect(transport), CONNECT_TIMEOUT_MS);
+        const res = await withTimeout(client.listTools(), CONNECT_TIMEOUT_MS);
+        const tools = (res.tools ?? []).map((t) => ({
+          name: t.name,
+          description: t.description ?? "",
+          inputSchema: t.inputSchema
+        }));
+        return { ok: true, tools };
+      } catch (e) {
+        return { ok: false, reason: errMsg(e) };
+      } finally {
+        try {
+          await client.close();
+        } catch {
+        }
+      }
+    };
+    errMsg = (e) => e instanceof Error ? e.message : String(e);
+  }
+});
+
+// src/mcp/snapshot.ts
+var toSnapshot;
+var init_snapshot = __esm({
+  "src/mcp/snapshot.ts"() {
+    "use strict";
+    init_digest();
+    toSnapshot = (tools) => {
+      const snapshot = {};
+      for (const tool of tools) {
+        snapshot[tool.name] = {
+          description: tool.description,
+          inputSchemaHash: jsonDigest(tool.inputSchema)
+        };
+      }
+      return snapshot;
+    };
+  }
+});
+
+// src/commands/check.ts
+var check_exports = {};
+__export(check_exports, {
+  check: () => check
+});
+var check, report2, truncate2, fail;
+var init_check = __esm({
+  "src/commands/check.ts"() {
+    "use strict";
+    init_repo();
+    init_io();
+    init_schema();
+    init_diff();
+    init_introspect();
+    init_snapshot();
+    init_interpolate();
+    init_prompts();
+    check = async (options) => {
+      const lock = readLockfile(options.targetRoot);
+      if (!lock) {
+        return fail(options, "no-lockfile", "No quiver.lock found. Run `quiver-cli init` first.");
+      }
+      if (!repoCatalogExists(options.targetRoot)) {
+        return fail(options, "no-agents", "No .agents/ directory found. Run `quiver-cli init` first.");
+      }
+      loadEnvLocal(options.targetRoot);
+      const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
+      const skillByName = new Map(catalog.skills.map((s) => [s.name, s]));
+      const commandByName = new Map(catalog.commands.map((c) => [c.name, c]));
+      const skillDrift = [];
+      for (const [id, entry] of Object.entries(lock.entries)) {
+        const p = parseEntryId(id);
+        if (!p) continue;
+        if (entry.type === "skill") {
+          const cat = skillByName.get(p.name);
+          if (cat && cat.digest !== entry.digest) skillDrift.push({ id, kind: "content" });
+        } else if (entry.type === "command") {
+          const cat = commandByName.get(p.name);
+          if (cat && cat.digest !== entry.digest) skillDrift.push({ id, kind: "content" });
+        }
+      }
+      const mcpReports = [];
+      let lockChanged = false;
+      for (const [id, entry] of Object.entries(lock.entries)) {
+        if (entry.type !== "mcp") continue;
+        const p = parseEntryId(id);
+        const catMcp = catalog.mcp.find((m) => m.name === p.name);
+        if (!catMcp) continue;
+        const server = interpolateEnvVars(catMcp.server);
+        const res = await introspect(server, { allowStdio: options.introspectStdio });
+        if (!res.ok) {
+          mcpReports.push({ id, status: "skipped", reason: res.reason });
+          continue;
+        }
+        const current = toSnapshot(res.tools);
+        const mcpEntry = entry;
+        if (!mcpEntry.tools) {
+          mcpEntry.tools = current;
+          mcpEntry.toolsFetchedAt = (/* @__PURE__ */ new Date()).toISOString();
+          lockChanged = true;
+          mcpReports.push({ id, status: "baseline" });
+          continue;
+        }
+        const diff = diffSnapshots(mcpEntry.tools, current);
+        if (isEmptyDiff(diff)) {
+          mcpReports.push({ id, status: "ok" });
+        } else {
+          mcpReports.push({ id, status: "drift", diff });
+        }
+      }
+      if (lockChanged) writeLockfile(options.targetRoot, lock);
+      const hasDrift = skillDrift.length > 0 || mcpReports.some((r) => r.status === "drift");
+      if (options.json) {
+        console.log(
+          JSON.stringify(
+            { ok: !hasDrift, skillDrift, mcp: mcpReports },
+            null,
+            2
+          )
+        );
+        if (hasDrift) process.exitCode = 1;
+        return;
+      }
+      await report2(skillDrift, mcpReports);
+      if (hasDrift) process.exitCode = 1;
+    };
+    report2 = async (skillDrift, mcpReports) => {
+      if (skillDrift.length) {
+        await warn(
+          `Skill/command content changed since lockfile:
+  - ${skillDrift.map((s) => s.id).join("\n  - ")}`
+        );
+      }
+      for (const r of mcpReports) {
+        if (r.status === "ok") {
+          await success(`${r.id}: no tool changes`);
+        } else if (r.status === "baseline") {
+          await info(`${r.id}: recorded tool baseline`);
+        } else if (r.status === "skipped") {
+          await info(`${r.id}: skipped (${r.reason})`);
+        } else if (r.status === "drift" && r.diff) {
+          const lines = [];
+          if (r.diff.added.length) lines.push(`new tools: ${r.diff.added.join(", ")}`);
+          if (r.diff.removed.length)
+            lines.push(`removed tools: ${r.diff.removed.join(", ")}`);
+          if (r.diff.schemaChanged.length)
+            lines.push(`schema changed: ${r.diff.schemaChanged.join(", ")}`);
+          for (const dc of r.diff.descriptionChanged) {
+            lines.push(
+              `DESCRIPTION CHANGED (possible poisoning) "${dc.name}":
+      before: ${truncate2(dc.before)}
+      after:  ${truncate2(dc.after)}`
+            );
+          }
+          await warn(`${r.id}: tool drift
+  - ${lines.join("\n  - ")}`);
+        }
+      }
+      if (!skillDrift.length && !mcpReports.some((r) => r.status === "drift")) {
+        await success("check passed: no upstream drift detected.");
+      }
+    };
+    truncate2 = (s, max = 120) => s.length > max ? s.slice(0, max) + "\u2026" : s;
+    fail = async (options, code, message) => {
+      if (options.json) console.log(JSON.stringify({ ok: false, error: code }));
+      else await error(message);
+      process.exitCode = 1;
+    };
+  }
+});
+
+// src/catalog/upstreams.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import {
+  existsSync as existsSync13,
+  mkdtempSync as mkdtempSync2,
+  readFileSync as readFileSync10,
+  rmSync as rmSync7,
+  writeFileSync as writeFileSync8
+} from "fs";
+import { tmpdir } from "os";
+import { join, resolve as resolve18 } from "path";
+var UPSTREAMS_FILE, upstreamsPath, loadUpstreams, writeUpstreams, fetchLatestCommit, fetchUpstreamDir, short, evaluateOrigin;
+var init_upstreams = __esm({
+  "src/catalog/upstreams.ts"() {
+    "use strict";
+    init_auth();
+    init_auth();
+    UPSTREAMS_FILE = "upstreams.json";
+    upstreamsPath = (catalog) => resolve18(catalog.root, UPSTREAMS_FILE);
+    loadUpstreams = (catalog) => {
+      const path = upstreamsPath(catalog);
+      if (!existsSync13(path)) return {};
+      return JSON.parse(readFileSync10(path, "utf8"));
+    };
+    writeUpstreams = (catalog, map) => {
+      writeFileSync8(upstreamsPath(catalog), JSON.stringify(map, null, 2) + "\n");
+    };
+    fetchLatestCommit = async (origin) => {
+      const url = `https://api.github.com/repos/${origin.repo}/commits?path=${encodeURIComponent(origin.path)}&sha=${encodeURIComponent(origin.ref)}&per_page=1`;
+      const headers2 = {
+        Accept: "application/vnd.github+json",
+        "User-Agent": "quiver-cli"
+      };
+      const token = resolveGithubToken();
+      if (token) headers2["Authorization"] = `Bearer ${token}`;
+      let res;
+      try {
+        res = await fetch(url, { headers: headers2 });
+      } catch (err) {
+        return { ok: false, reason: err instanceof Error ? err.message : "fetch failed" };
+      }
+      if (res.status === 403 || res.status === 429) {
+        return {
+          ok: false,
+          reason: "rate-limited (set GITHUB_TOKEN or log in with the gh CLI)"
+        };
+      }
+      if (res.status === 404) {
+        return { ok: false, reason: "repo or path not found" };
+      }
+      if (!res.ok) {
+        return { ok: false, reason: `HTTP ${res.status}` };
+      }
+      const body = await res.json();
+      const head = Array.isArray(body) ? body[0] : void 0;
+      if (!head?.sha) return { ok: false, reason: "no commits for path" };
+      return {
+        ok: true,
+        sha: head.sha,
+        date: head.commit?.committer?.date ?? ""
+      };
+    };
+    fetchUpstreamDir = (origin) => {
+      const tmp = mkdtempSync2(join(tmpdir(), "quiver-pull-"));
+      const cleanup = () => rmSync7(tmp, { recursive: true, force: true });
+      const git = (args, cwd) => {
+        execFileSync3("git", args, {
+          cwd,
+          stdio: ["ignore", "ignore", "pipe"],
+          timeout: 12e4
+        });
+      };
+      try {
+        git([
+          "clone",
+          "--depth",
+          "1",
+          "--filter=blob:none",
+          "--sparse",
+          "--branch",
+          origin.ref,
+          `https://github.com/${origin.repo}.git`,
+          tmp
+        ]);
+        git(["sparse-checkout", "set", origin.path], tmp);
+      } catch (err) {
+        cleanup();
+        const msg = err instanceof Error && "stderr" in err ? String(err.stderr).trim().split("\n").pop() : err instanceof Error ? err.message : "git clone failed";
+        return { ok: false, reason: msg || "git clone failed" };
+      }
+      const dir = resolve18(tmp, origin.path);
+      if (!existsSync13(resolve18(dir, "SKILL.md"))) {
+        cleanup();
+        return { ok: false, reason: `no SKILL.md at ${origin.path} in ${origin.repo}` };
+      }
+      return { ok: true, dir, cleanup };
+    };
+    short = (sha) => sha.slice(0, 10);
+    evaluateOrigin = (name, origin, result) => {
+      const base = { name, repo: origin.repo, path: origin.path };
+      if (!result.ok) {
+        return {
+          report: { ...base, status: "skipped", reason: result.reason },
+          changed: false
+        };
+      }
+      if (!origin.commit) {
+        origin.commit = result.sha;
+        origin.fetchedAt = (/* @__PURE__ */ new Date()).toISOString();
+        return {
+          report: { ...base, status: "baseline", to: short(result.sha), date: result.date },
+          changed: true
+        };
+      }
+      if (origin.commit === result.sha) {
+        return {
+          report: { ...base, status: "ok", from: short(origin.commit) },
+          changed: false
+        };
+      }
+      return {
+        report: {
+          ...base,
+          status: origin.curated ? "drift-curated" : "drift",
+          from: short(origin.commit),
+          to: short(result.sha),
+          date: result.date
+        },
+        changed: false
+      };
+    };
+  }
+});
+
+// src/commands/upstream.ts
+var upstream_exports = {};
+__export(upstream_exports, {
+  upstream: () => upstream
+});
+import { cpSync as cpSync3, rmSync as rmSync8 } from "fs";
+var upstream, STATUS_ORDER, pull, report3, countByStatus;
+var init_upstream = __esm({
+  "src/commands/upstream.ts"() {
+    "use strict";
+    init_discover();
+    init_resolve();
+    init_upstreams();
+    init_interpolate();
+    init_prompts();
+    upstream = async (options) => {
+      loadEnvLocal(options.targetRoot);
+      if (options.positionals[0] === "pull") {
+        await pull(options);
+        return;
+      }
+      const resolved = await resolveCatalog();
+      const catalog = loadCatalog(resolved);
+      const upstreams = loadUpstreams(resolved);
+      const trackedNames = Object.keys(upstreams);
+      const catalogSkillNames = new Set(catalog.skills.map((s) => s.name));
+      const untracked = catalog.skills.map((s) => s.name).filter((n) => !trackedNames.includes(n)).sort((a, b) => a.localeCompare(b));
+      const reports = [];
+      let mapChanged = false;
+      for (const name of trackedNames.sort((a, b) => a.localeCompare(b))) {
+        const origin = upstreams[name];
+        const result = await fetchLatestCommit(origin);
+        const { report: report4, changed } = evaluateOrigin(name, origin, result);
+        if (changed) mapChanged = true;
+        reports.push(report4);
+      }
+      if (mapChanged) writeUpstreams(resolved, upstreams);
+      const hasDrift = reports.some(
+        (r) => r.status === "drift" || r.status === "drift-curated"
+      );
+      const stale = trackedNames.filter((n) => !catalogSkillNames.has(n));
+      if (options.json) {
+        console.log(
+          JSON.stringify({ ok: !hasDrift, skills: reports, untracked, stale }, null, 2)
+        );
+        if (hasDrift) process.exitCode = 1;
+        return;
+      }
+      await report3(reports, untracked, stale);
+      if (hasDrift) process.exitCode = 1;
+    };
+    STATUS_ORDER = {
+      drift: 0,
+      "drift-curated": 1,
+      skipped: 2,
+      baseline: 3,
+      ok: 4
+    };
+    pull = async (options) => {
+      const resolved = await resolveCatalog();
+      const catalog = loadCatalog(resolved);
+      const upstreams = loadUpstreams(resolved);
+      const only = options.positionals[1];
+      if (only && !upstreams[only]) {
+        await error(`${only} is not tracked in upstreams.json.`);
+        process.exitCode = 1;
+        return;
+      }
+      const names = only ? [only] : Object.keys(upstreams).sort((a, b) => a.localeCompare(b));
+      const reports = [];
+      let mapChanged = false;
+      for (const name of names) {
+        const origin = upstreams[name];
+        const skill = catalog.skills.find((s) => s.name === name);
+        if (!skill) {
+          reports.push({ name, status: "not-in-catalog" });
+          continue;
+        }
+        if (origin.curated && !options.force) {
+          reports.push({
+            name,
+            status: "curated-skipped",
+            detail: "modified after import - use --force to overwrite"
+          });
+          continue;
+        }
+        const latest = await fetchLatestCommit(origin);
+        if (!latest.ok) {
+          reports.push({ name, status: "error", detail: latest.reason });
+          continue;
+        }
+        if (origin.commit === latest.sha && !options.force) {
+          reports.push({ name, status: "up-to-date" });
+          continue;
+        }
+        const fetched = fetchUpstreamDir(origin);
+        if (!fetched.ok) {
+          reports.push({ name, status: "error", detail: fetched.reason });
+          continue;
+        }
+        try {
+          rmSync8(skill.absDir, { recursive: true, force: true });
+          cpSync3(fetched.dir, skill.absDir, { recursive: true, dereference: true });
+        } finally {
+          fetched.cleanup();
+        }
+        origin.commit = latest.sha;
+        origin.fetchedAt = (/* @__PURE__ */ new Date()).toISOString();
+        mapChanged = true;
+        reports.push({ name, status: "pulled", detail: latest.sha.slice(0, 10) });
+      }
+      if (mapChanged) writeUpstreams(resolved, upstreams);
+      if (options.json) {
+        console.log(JSON.stringify({ ok: true, skills: reports }, null, 2));
+        return;
+      }
+      const c = palette();
+      const lines = [""];
+      for (const r of reports) {
+        if (r.status === "pulled")
+          lines.push(`  ${c.cyan("\u2193")} ${r.name}  pulled @ ${r.detail}`);
+        else if (r.status === "up-to-date")
+          lines.push(`  ${c.green("\u2713")} ${r.name}  ${c.dim("up to date")}`);
+        else if (r.status === "curated-skipped")
+          lines.push(`  ${c.yellow("\u25B2")} ${r.name}  ${c.yellow(r.detail ?? "curated")}`);
+        else if (r.status === "not-in-catalog")
+          lines.push(`  ${c.dim("\u2022")} ${r.name}  ${c.dim("not in catalog")}`);
+        else lines.push(`  ${c.red("\u2717")} ${r.name}  ${c.red(r.detail ?? "error")}`);
+      }
+      const pulled = reports.filter((r) => r.status === "pulled").length;
+      lines.push(
+        "",
+        `  ${pulled ? c.cyan(`\u2193 ${pulled} pulled - review, rebuild and commit the catalog`) : c.green("\u2713 nothing to pull")}`,
+        ""
+      );
+      block(lines);
+    };
+    report3 = async (reports, untracked, stale) => {
+      const c = palette();
+      const sorted = [...reports].sort(
+        (a, b) => STATUS_ORDER[a.status] - STATUS_ORDER[b.status] || a.name.localeCompare(b.name)
+      );
+      const mark = {
+        drift: c.yellow("\u25B2"),
+        "drift-curated": c.yellow("\u25B2"),
+        skipped: c.dim("\u2022"),
+        baseline: c.cyan("+"),
+        ok: c.green("\u2713")
+      };
+      const nameWidth = Math.max(0, ...reports.map((r) => r.name.length));
+      const lines = [""];
+      for (const r of sorted) {
+        const name = r.name.padEnd(nameWidth);
+        const where = c.dim(`${r.repo}/${r.path}`);
+        let detail;
+        switch (r.status) {
+          case "ok":
+            detail = `up to date  ${c.dim(r.from ?? "")}`;
+            break;
+          case "baseline":
+            detail = `baseline    ${c.dim(r.to ?? "")}`;
+            break;
+          case "skipped":
+            detail = c.dim(`skipped     ${r.reason ?? ""}`);
+            break;
+          case "drift":
+            detail = c.yellow(`UPDATED     ${r.from} \u2192 ${r.to}`);
+            break;
+          case "drift-curated":
+            detail = c.yellow(`UPDATED     ${r.from} \u2192 ${r.to}  (curated)`);
+            break;
+        }
+        lines.push(`  ${mark[r.status]} ${c.bold(name)}  ${detail}  ${where}`);
+      }
+      block(lines);
+      const drifted = sorted.filter(
+        (r) => r.status === "drift" || r.status === "drift-curated"
+      );
+      if (drifted.length) {
+        const hint = [""];
+        for (const r of drifted) {
+          const note = r.status === "drift-curated" ? "curated \u2014 reconcile changes by hand" : "re-fetch with the skills CLI, then copy into the catalog";
+          hint.push(`  ${c.yellow(r.name)}: ${c.dim(note)}`);
+        }
+        block(hint);
+      }
+      const counts = countByStatus(reports);
+      const summaryParts = [];
+      if (counts.drift) summaryParts.push(c.yellow(`${counts.drift} updated`));
+      if (counts.baseline) summaryParts.push(c.cyan(`${counts.baseline} new`));
+      if (counts.skipped) summaryParts.push(c.dim(`${counts.skipped} skipped`));
+      if (counts.ok) summaryParts.push(c.green(`${counts.ok} up to date`));
+      const lead = counts.drift === 0 ? c.green("\u2713") : c.yellow("\u25B2");
+      const footer = [""];
+      footer.push(
+        `  ${lead} ${c.bold(`${reports.length} tracked`)}` + (summaryParts.length ? `  ${summaryParts.join(c.dim(" \xB7 "))}` : "")
+      );
+      if (untracked.length) {
+        footer.push(`  ${c.dim(`untracked: ${untracked.join(", ")}`)}`);
+      }
+      if (stale.length) {
+        footer.push(`  ${c.yellow(`stale origins: ${stale.join(", ")}`)}`);
+      }
+      block([...footer, ""]);
+    };
+    countByStatus = (reports) => {
+      const counts = { drift: 0, baseline: 0, skipped: 0, ok: 0 };
+      for (const r of reports) {
+        if (r.status === "drift" || r.status === "drift-curated") counts.drift += 1;
+        else if (r.status === "baseline") counts.baseline += 1;
+        else if (r.status === "skipped") counts.skipped += 1;
+        else if (r.status === "ok") counts.ok += 1;
+      }
+      return counts;
+    };
+  }
+});
+
+// src/commands/login.ts
+var login_exports = {};
+__export(login_exports, {
+  login: () => login
+});
+import process3 from "process";
+var login, promptToken, readStdin;
+var init_login = __esm({
+  "src/commands/login.ts"() {
+    "use strict";
+    init_auth();
+    init_prompts();
+    login = async (options) => {
+      const token = process3.stdin.isTTY ? await promptToken() : await readStdin();
+      if (!token) {
+        await error(
+          "No token provided. Create a GitHub personal access token with `repo` read access and try again."
+        );
+        process3.exitCode = 1;
+        return;
+      }
+      const validation = await validateToken(token);
+      if (!validation.ok) {
+        await error(`Token validation failed: ${validation.reason}`);
+        process3.exitCode = 1;
+        return;
+      }
+      writeStoredToken(token, validation.login);
+      if (options.json) {
+        console.log(JSON.stringify({ ok: true, login: validation.login }, null, 2));
+        return;
+      }
+      await success(
+        `Logged in as ${validation.login}. Token stored in ${authFilePath()}.`
+      );
+    };
+    promptToken = async () => {
+      await info(
+        "Paste a GitHub personal access token (used for github: catalogs; needs read access to the catalog repo)."
+      );
+      const value = await password("GitHub token");
+      return value?.trim() || null;
+    };
+    readStdin = async () => {
+      let data = "";
+      for await (const chunk of process3.stdin) data += chunk;
+      return data.trim() || null;
+    };
+  }
+});
+
+// src/commands/logout.ts
+var logout_exports = {};
+__export(logout_exports, {
+  logout: () => logout
+});
+var logout;
+var init_logout = __esm({
+  "src/commands/logout.ts"() {
+    "use strict";
+    init_auth();
+    init_prompts();
+    logout = async (options) => {
+      const removed = deleteStoredToken();
+      if (options.json) {
+        console.log(JSON.stringify({ ok: true, removed }, null, 2));
+        return;
+      }
+      if (removed) {
+        await success(`Logged out. Removed ${authFilePath()}.`);
+      } else {
+        await info("Not logged in - nothing to remove.");
+      }
+    };
+  }
+});
+
+// src/cli.ts
+init_prompts();
+import process4 from "process";
+var HELP = `quiver-cli - compose agent skills, commands & MCP servers into any repo
+
+Usage:
+  quiver-cli <command> [options]
+
+Commands:
+  init             Interactive picker over the catalog; write native configs + quiver.lock
+  add <id>         Add a single catalog entry (skill:<name>, command:<name>, mcp:<name>)
+  remove <id>      Remove a single entry; keep lockfile + configs consistent
+  sync             Regenerate provider configs from .agents/ (warns on drift)
+  update [id]      Pull newer catalog content into .agents/ (all or one entry)
+  list             Show installed entries (skills, commands, MCP tool counts)
+  status           Diff the lockfile against what is actually in the repo
+  check            Detect upstream drift (skill digests, MCP tool snapshots)
+  upstream         Check source repos for skill updates (catalog maintenance)
+  upstream pull    Pull latest upstream content into the catalog [skill]
+  login            Store a GitHub token for remote (github:) catalogs
+  logout           Remove the stored GitHub token
+  help             Show this help
+  version          Show the quiver-cli version
+
+Options:
+  -f, --force          Overwrite existing files
+  --all, -y            Keep everything without prompting (non-interactive)
+  --json               Machine-readable output (status/check/upstream/list)
+  --providers=a,b      Generate configs only for these tools (claude, opencode, codex)
+  --catalog=<source>   Catalog source for init (e.g. github:owner/repo[/path][#ref])
+  --introspect-stdio   Allow introspecting stdio MCP servers (runs foreign code)
+  -v, --version        Show the quiver-cli version
+`;
+var parse = (argv) => {
+  const [command = "init", ...rest] = argv;
+  const flags = new Set(rest.filter((a) => a.startsWith("-")));
+  const positionals = rest.filter((a) => !a.startsWith("-"));
+  const providersFlag = rest.find((a) => a.startsWith("--providers="));
+  const providers = providersFlag ? providersFlag.slice("--providers=".length).split(",").map((p) => p.trim()).filter(Boolean) : null;
+  const catalogFlag = rest.find((a) => a.startsWith("--catalog="));
+  const catalog = catalogFlag ? catalogFlag.slice("--catalog=".length).trim() || null : null;
+  return {
+    command,
+    options: {
+      targetRoot: process4.cwd(),
+      force: flags.has("--force") || flags.has("-f"),
+      all: flags.has("--all") || flags.has("--yes") || flags.has("-y"),
+      json: flags.has("--json"),
+      introspectStdio: flags.has("--introspect-stdio"),
+      providers,
+      catalog,
+      positionals
+    }
+  };
+};
+var run = async () => {
+  const { command, options } = parse(process4.argv.slice(2));
+  switch (command) {
+    case "init": {
+      const { init: init2 } = await Promise.resolve().then(() => (init_init(), init_exports));
+      await init2(options);
+      break;
+    }
+    case "add": {
+      const { add: add2 } = await Promise.resolve().then(() => (init_add(), add_exports));
+      await add2(options);
+      break;
+    }
+    case "remove":
+    case "rm": {
+      const { remove: remove2 } = await Promise.resolve().then(() => (init_remove(), remove_exports));
+      await remove2(options);
+      break;
+    }
+    case "sync": {
+      const { sync: sync2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
+      await sync2(options);
+      break;
+    }
+    case "update": {
+      const { update: update2 } = await Promise.resolve().then(() => (init_update(), update_exports));
+      await update2(options);
+      break;
+    }
+    case "list":
+    case "ls": {
+      const { list: list2 } = await Promise.resolve().then(() => (init_list(), list_exports));
+      await list2(options);
+      break;
+    }
+    case "status": {
+      const { status: status2 } = await Promise.resolve().then(() => (init_status(), status_exports));
+      await status2(options);
+      break;
+    }
+    case "check": {
+      const { check: check2 } = await Promise.resolve().then(() => (init_check(), check_exports));
+      await check2(options);
+      break;
+    }
+    case "upstream": {
+      const { upstream: upstream2 } = await Promise.resolve().then(() => (init_upstream(), upstream_exports));
+      await upstream2(options);
+      break;
+    }
+    case "login": {
+      const { login: login2 } = await Promise.resolve().then(() => (init_login(), login_exports));
+      await login2(options);
+      break;
+    }
+    case "logout": {
+      const { logout: logout2 } = await Promise.resolve().then(() => (init_logout(), logout_exports));
+      await logout2(options);
+      break;
+    }
+    case "help":
+    case "--help":
+    case "-h":
+      console.log(HELP);
+      break;
+    case "version":
+    case "--version":
+    case "-v": {
+      const { readFileSync: readFileSync11 } = await import("fs");
+      const { resolve: resolve19 } = await import("path");
+      const { packageRoot: packageRoot2 } = await Promise.resolve().then(() => (init_resolve(), resolve_exports));
+      const pkg = JSON.parse(
+        readFileSync11(resolve19(packageRoot2, "package.json"), "utf8")
+      );
+      console.log(pkg.version);
+      break;
+    }
+    default:
+      console.error(`Unknown command: ${command}
+`);
+      console.log(HELP);
+      process4.exitCode = 1;
+  }
+};
+run().catch(async (err) => {
+  await error(err instanceof Error ? err.message : String(err));
+  process4.exitCode = 1;
+});