skills-layer 0.1.0

package/public/skills-layer-public.mjs

@@ -0,0 +1,645 @@
+/* istanbul ignore file -- generated npm bundle is verified by boundary and tarball smoke tests. */
+import { createRequire as __skillsLayerCreateRequire } from "node:module"; const require = __skillsLayerCreateRequire(import.meta.url);
+import{spawn as ir}from"node:child_process";import{createHash as Nt}from"node:crypto";import{access as sr,appendFile as Ei,chmod as or,mkdir as Te,readdir as ar,readFile as Be,rm as Ot,stat as Ui,writeFile as et}from"node:fs/promises";import{basename as G,dirname as ie,join as I,posix as Ft,relative as Ie,resolve as lr,win32 as ve}from"node:path";import{createInterface as qt}from"node:readline/promises";import{spawn as pn}from"node:child_process";import{createHash as Yr}from"node:crypto";import{chmod as Qr,mkdir as Ge,readFile as mn,rm as ct,writeFile as me}from"node:fs/promises";import{dirname as Ce,posix as Zr,win32 as Xr}from"node:path";import{posix as Jr,win32 as zr}from"node:path";var at=["codex","claude-code","cursor","opencode","amp","kimi-cli","replit","universal","antigravity","augment","openclaw","cline","warp","codebuddy","command-code","continue","cortex","crush","deepagents","droid","gemini-cli","github-copilot","goose","junie","iflow-cli","kilo","kiro-cli","kode","mcpjam","mistral-vibe","mux","openhands","pi","qoder","qwen-code","roo","trae","trae-cn","windsurf","zencoder","neovate","pochi","adal"],on=[$("codex","Codex",".codex",{capabilities:U({allowedTools:!0})}),$("claude-code","Claude Code",".claude",{envVar:"CLAUDE_CODE_HOME",capabilities:U({allowedTools:!0,hooks:!0,forkedContext:!0})}),$("cursor","Cursor",".cursor",{capabilities:U({allowedTools:!0})}),$("opencode","OpenCode",".opencode",{globalRootRelativePath:".config/opencode",capabilities:U({allowedTools:!0})}),ne("amp","Amp",".config/agents",{capabilities:U({allowedTools:!0})}),ne("kimi-cli","Kimi Code CLI",".config/agents"),ne("replit","Replit",".config/agents"),ne("universal","Universal",".config/agents"),ne("antigravity","Antigravity",".gemini/antigravity",{capabilities:U({allowedTools:!0}),detectGlobal:!0}),$("augment","Augment",".augment"),{id:"openclaw",displayName:"OpenClaw",envVar:"OPENCLAW_HOME",capabilities:U({allowedTools:!0}),targets:{projectRootRelativePath:null,projectSkillsRelativePath:"skills",globalRootRelativePath:".openclaw",globalSkillsRelativePath:".openclaw/skills"},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:[".openclaw",".openclaw/skills"]}},ne("cline","Cline",".agents",{capabilities:U({allowedTools:!0,hooks:!0})}),ne("warp","Warp",".agents"),$("codebuddy","CodeBuddy",".codebuddy",{capabilities:U({allowedTools:!0})}),$("command-code","Command Code",".commandcode",{capabilities:U({allowedTools:!0})}),$("continue","Continue",".continue"),$("cortex","Cortex Code",".cortex",{globalRootRelativePath:".snowflake/cortex"}),$("crush","Crush",".crush",{globalRootRelativePath:".config/crush"}),ne("deepagents","Deep Agents",".deepagents/agent",{detectGlobal:!0}),$("droid","Droid",".factory"),ne("gemini-cli","Gemini CLI",".gemini",{detectGlobal:!0}),ne("github-copilot","GitHub Copilot",".copilot",{capabilities:U({allowedTools:!0}),detectGlobal:!0}),$("goose","Goose",".goose",{globalRootRelativePath:".config/goose"}),$("junie","Junie",".junie"),$("iflow-cli","iFlow CLI",".iflow"),$("kilo","Kilo Code",".kilocode"),$("kiro-cli","Kiro CLI",".kiro"),$("kode","Kode",".kode"),$("mcpjam","MCPJam",".mcpjam"),$("mistral-vibe","Mistral Vibe",".vibe"),$("mux","Mux",".mux"),$("openhands","OpenHands",".openhands",{capabilities:U({allowedTools:!0})}),$("pi","Pi",".pi",{globalRootRelativePath:".pi/agent",capabilities:U({allowedTools:!0})}),$("qoder","Qoder",".qoder",{capabilities:U({allowedTools:!0})}),$("qwen-code","Qwen Code",".qwen"),$("roo","Roo Code",".roo",{capabilities:U({allowedTools:!0})}),$("trae","Trae",".trae",{detectProject:!1}),$("trae-cn","Trae CN",".trae",{globalRootRelativePath:".trae-cn",detectProject:!1}),$("windsurf","Windsurf",".windsurf",{globalRootRelativePath:".codeium/windsurf"}),$("zencoder","Zencoder",".zencoder",{capabilities:U({allowedTools:!0})}),$("neovate","Neovate",".neovate",{capabilities:U({allowedTools:!0})}),$("pochi","Pochi",".pochi"),$("adal","AdaL",".adal")];function ae(e=process.env,t=process.platform,n=process.cwd()){let r=cn(t),i=ln(e,t);return on.map(s=>{let o=qe(e[s.envVar]),l=i&&s.targets.globalRootRelativePath?Pe(r,i,s.targets.globalRootRelativePath):null,c=i&&s.targets.globalSkillsRelativePath?Pe(r,i,s.targets.globalSkillsRelativePath):null,u=s.targets.projectRootRelativePath?Pe(r,n,s.targets.projectRootRelativePath):null,d=o??l;return{id:s.id,displayName:s.displayName,envVar:s.envVar,capabilities:s.capabilities,detectionSources:[],targets:{projectRoot:u,projectSkillsPath:Pe(r,n,s.targets.projectSkillsRelativePath),globalRoot:d,globalSkillsPath:o?r.join(o,"skills"):c}}})}async function an(e={}){let t=e.env??process.env,n=e.platform??process.platform,r=e.cwd??process.cwd(),i=cn(n),s=ln(t,n),o=ae(t,n,r),l=e.pathExists??(async()=>!1);return(await Promise.all(o.map(async c=>{let u=Wr(c.id),d=[],m=qe(t[c.envVar]);return(m&&await l(m)||m&&await l(i.join(m,"skills")))&&d.push("override"),u.detection.projectProbeRelativePaths.length>0&&await sn({basePath:r,relativePaths:u.detection.projectProbeRelativePaths,pathApi:i,pathExists:l})&&d.push("project"),s&&u.detection.globalProbeRelativePaths.length>0&&await sn({basePath:s,relativePaths:u.detection.globalProbeRelativePaths,pathApi:i,pathExists:l})&&d.push("global"),d.length===0?null:{...c,detectionSources:Vr(d)}}))).flatMap(c=>c?[c]:[])}function ln(e,t){return t==="win32"?qe(e.USERPROFILE,e.HOME):qe(e.HOME)}function cn(e){return e==="win32"?zr:Jr}function qe(...e){return e.find(t=>typeof t=="string"&&t.trim().length>0)?.trim()}function Vr(e){return[...new Set(e)]}async function sn(e){for(let t of e.relativePaths)if(await e.pathExists(Pe(e.pathApi,e.basePath,t)))return!0;return!1}function Pe(e,t,n){return e.join(t,...n.split("/"))}function $(e,t,n,r={}){let i=r.globalRootRelativePath??n,s=r.detectProject??!0;return{id:e,displayName:t,envVar:r.envVar??un(e),capabilities:r.capabilities??U(),targets:{projectRootRelativePath:n,projectSkillsRelativePath:`${n}/skills`,globalRootRelativePath:i,globalSkillsRelativePath:`${i}/skills`},detection:{projectProbeRelativePaths:s?[n,`${n}/skills`]:[],globalProbeRelativePaths:[i,`${i}/skills`]}}}function ne(e,t,n,r={}){let i=r.detectGlobal??!1;return{id:e,displayName:t,envVar:r.envVar??un(e),capabilities:r.capabilities??U(),targets:{projectRootRelativePath:".agents",projectSkillsRelativePath:".agents/skills",globalRootRelativePath:n,globalSkillsRelativePath:`${n}/skills`},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:i?[n,`${n}/skills`]:[]}}}function U(e={}){let t=["basic_skills"];return e.allowedTools&&t.push("allowed_tools"),e.hooks&&t.push("hooks"),e.forkedContext&&t.push("forked_context"),t.push("local_install"),t}function un(e){return`${e.replaceAll("-","_").toUpperCase()}_HOME`}function Wr(e){return on.find(t=>t.id===e)}var de="skills-layer",ei="2025-06-18",ti=["mcp","skills-layer-mcp-proxy.mjs"],ni=["mcp","skills-layer-mcp-broker.mjs"],ri=["mcp","skills-layer-mcp-broker.sock"],ii={codex:{tier:"tier_1",configKind:"codex_toml",resolveConfigPath(e,t,n){let r=ut(n);return r.join(e.targets.globalRoot??r.join(hi({},n)??t,".codex"),"config.toml")}},cursor:be(".cursor/mcp.json"),"claude-code":be(".mcp.json"),cline:be(".cline/mcp.json"),"gemini-cli":be(".gemini/settings.json"),windsurf:be(".windsurf/mcp.json")},si=new Set(["universal"]);function xe(e){let t=ae(e.env,e.platform,e.cwd),n=new Map(t.map(b=>[b.id,b])),r=e.platform??process.platform,i=e.cwd??process.cwd(),s=e.stateDir??fi(e.env,r),o=e.mcpConfigPath??Se(r,s,"mcp.json"),l=Se(r,s,...ti),c=Se(r,s,...ni),u=Se(r,s,...ri),d=e.nodePath??process.execPath,m=hn({mcpConfigPath:o}),k=yn({mcpConfigPath:o,socketPath:u}),p=fe(m),h=fe(k),v=at.map(b=>{let x=n.get(b),L=ii[b];if(L){let Fe=L.resolveConfigPath(x,i,r);return oi({agentId:b,displayName:x.displayName,configPath:Fe,configKind:L.configKind,bridgePath:l,brokerPath:c,brokerSocketPath:u,mcpConfigPath:o,nodePath:d,bridgeChecksum:p,brokerChecksum:h})}return si.has(b)?gn({agentId:b,displayName:x.displayName,tier:"tier_3",status:"skills_only",verification:"skills_only",reason:"This agent is currently supported through Skills Layer skill files, not MCP auto-install.",instructions:[`Install skills for ${x.displayName} with \`skills-layer install <skill> --agent ${b}\`.`,"MCP auto-install is not claimed for this agent yet."]}):gn({agentId:b,displayName:x.displayName,tier:"tier_2",status:"manual_handoff",verification:"manual",reason:"MCP support or the safe writable config shape has not been verified yet.",instructions:[`Add a local stdio MCP server named ${de}.`,`Command: ${d}`,`Args: ${l}`,"Restart or reload the agent if it does not reconnect automatically."]})});return{status:"mcp_registration_plan",serverName:de,mcpUrl:e.mcpUrl,bearerTokenEnvVar:e.bearerTokenEnvVar,clientId:e.clientId,environment:e.environment,generatedAt:e.now,bridgePath:l,brokerPath:c,brokerSocketPath:u,nodePath:d,mcpConfigPath:o,bridgeChecksum:p,brokerChecksum:h,automaticCount:v.filter(b=>b.status==="automatic").length,manualCount:v.filter(b=>b.status==="manual_handoff").length,skillsOnlyCount:v.filter(b=>b.status==="skills_only").length,unsupportedCount:v.filter(b=>b.status==="unsupported").length,targets:v}}async function fn(e){let t=xe(e),n=yi(e.clientId),r=t.targets.find(v=>v.agentId===n),i=e.mcpConfig??await De(t.mcpConfigPath,{allowMissing:!0});if(!i)return dn({plan:t,target:r,mcpConfig:null,tokenConfig:null,tokenPresent:!1,tokenRefPresent:!1,bridgeExists:!1,checksumMatches:!1,brokerExists:!1,brokerChecksumMatches:!1,targetConfigured:!1,rawTokenLeaked:!1});let s=await Re(t.bridgePath),o=s!==null,l=s!==null&&fe(s)===t.bridgeChecksum,c=await Re(t.brokerPath),u=c!==null,d=c!==null&&fe(c)===t.brokerChecksum,m=ki(i,r.agentId),k=Z(m,"token"),p=Z(m,"tokenRef"),h=r.status==="automatic"?await di(r,k):{configured:!1,rawTokenLeaked:!1};return dn({plan:t,target:r,mcpConfig:i,tokenConfig:m,tokenPresent:!!k,tokenRefPresent:!!p,bridgeExists:o,checksumMatches:l,brokerExists:u,brokerChecksumMatches:d,targetConfigured:h.configured,rawTokenLeaked:h.rawTokenLeaked})}function hn(e){return`#!/usr/bin/env node
+import { createConnection } from "node:net";
+import { createInterface } from "node:readline";
+import { readFile } from "node:fs/promises";
+
+const CONFIG_PATH = ${JSON.stringify(e.mcpConfigPath)};
+const MCP_PROTOCOL_VERSION = ${JSON.stringify(ei)};
+
+function writeMessage(message) {
+  process.stdout.write(JSON.stringify(message) + "\\n");
+}
+
+function errorResponse(id, code, message, data = {}) {
+  return { jsonrpc: "2.0", id: id ?? null, error: { code, message, data } };
+}
+
+async function readConfig() {
+  const parsed = JSON.parse(await readFile(CONFIG_PATH, "utf8"));
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error("Skills Layer MCP config is not an object.");
+  }
+  if (!parsed.mcpUrl || typeof parsed.mcpUrl !== "string") {
+    throw new Error("Skills Layer MCP URL is missing. Run skills-layer mcp repair.");
+  }
+  return parsed;
+}
+
+function requestedClientId(config) {
+  const index = process.argv.indexOf("--client");
+  if (index >= 0 && typeof process.argv[index + 1] === "string" && process.argv[index + 1].trim()) {
+    return process.argv[index + 1].trim();
+  }
+  return typeof config.clientId === "string" && config.clientId.trim() ? config.clientId.trim() : "codex";
+}
+
+function selectClientConfig(config) {
+  const clientId = requestedClientId(config);
+  const tokenConfig = config.tokens && typeof config.tokens === "object" && config.tokens[clientId] && typeof config.tokens[clientId] === "object"
+    ? config.tokens[clientId]
+    : config;
+  const selected = { ...config, ...tokenConfig, clientId };
+  if (!selected.token && !selected.tokenRef) {
+    throw new Error(\`Skills Layer MCP token reference is missing for \${clientId}. Run skills-layer mcp repair.\`);
+  }
+  return selected;
+}
+
+function requestBrokerToken(config) {
+  if (!config.brokerSocketPath || typeof config.brokerSocketPath !== "string") {
+    throw new Error("Skills Layer MCP broker is missing. Run skills-layer mcp repair.");
+  }
+  return new Promise((resolve, reject) => {
+    const socket = createConnection(config.brokerSocketPath);
+    let buffer = "";
+    socket.setEncoding("utf8");
+    socket.on("connect", () => {
+      socket.write(JSON.stringify({ type: "mcp_token", clientId: config.clientId, baseUrl: config.baseUrl }) + "\\n");
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk;
+      const newlineIndex = buffer.indexOf("\\n");
+      if (newlineIndex < 0) {
+        return;
+      }
+      const line = buffer.slice(0, newlineIndex);
+      socket.end();
+      try {
+        const parsed = JSON.parse(line);
+        if (parsed && parsed.ok && typeof parsed.token === "string" && parsed.token.length > 0) {
+          resolve(parsed.token);
+          return;
+        }
+        reject(new Error(parsed && typeof parsed.error === "string" ? parsed.error : "Skills Layer MCP broker did not return a token."));
+      } catch (error) {
+        reject(error);
+      }
+    });
+    socket.on("error", () => {
+      reject(new Error("Skills Layer MCP broker is not running. Run skills-layer mcp repair."));
+    });
+    socket.on("end", () => {
+      if (!buffer.trim()) {
+        reject(new Error("Skills Layer MCP broker closed before returning a token. Run skills-layer mcp repair."));
+      }
+    });
+  });
+}
+
+async function resolveMcpToken(config) {
+  if (config.token && typeof config.token === "string") {
+    return config.token;
+  }
+  return await requestBrokerToken(config);
+}
+
+function parseMcpHttpResponse(text) {
+  if (!text.trim()) {
+    return null;
+  }
+  if (!text.trimStart().startsWith("data:")) {
+    return JSON.parse(text);
+  }
+  const dataLine = text.split(/\\r?\\n/u).find((line) => line.startsWith("data:"));
+  if (!dataLine) {
+    return null;
+  }
+  const data = dataLine.slice("data:".length).trim();
+  return data ? JSON.parse(data) : null;
+}
+
+async function forward(payload) {
+  const config = selectClientConfig(await readConfig());
+  const token = await resolveMcpToken(config);
+  const response = await fetch(config.mcpUrl, {
+    method: "POST",
+    headers: {
+      accept: "application/json, text/event-stream",
+      "content-type": "application/json",
+      "mcp-protocol-version": MCP_PROTOCOL_VERSION,
+      authorization: \`Bearer \${token}\`
+    },
+    body: JSON.stringify(payload)
+  });
+  const text = await response.text();
+  if (!response.ok) {
+    return errorResponse(payload.id, -32000, \`Skills Layer MCP request failed with HTTP \${response.status}.\`, {
+      status: response.status
+    });
+  }
+  return parseMcpHttpResponse(text);
+}
+
+const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
+for await (const line of rl) {
+  const trimmed = line.trim();
+  if (!trimmed) {
+    continue;
+  }
+  try {
+    const payload = JSON.parse(trimmed);
+    const result = await forward(payload);
+    if (result) {
+      writeMessage(result);
+    }
+  } catch (error) {
+    writeMessage(errorResponse(null, -32603, error instanceof Error ? error.message : "Skills Layer MCP bridge failed."));
+  }
+}
+`}function yn(e){return`#!/usr/bin/env node
+import { execFile } from "node:child_process";
+import { createServer } from "node:net";
+import { chmod, readFile, rm } from "node:fs/promises";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+const CONFIG_PATH = ${JSON.stringify(e.mcpConfigPath)};
+const SOCKET_PATH = ${JSON.stringify(e.socketPath)};
+
+async function readConfig() {
+  const parsed = JSON.parse(await readFile(CONFIG_PATH, "utf8"));
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error("Skills Layer MCP config is not an object.");
+  }
+  return parsed;
+}
+
+function selectClientConfig(config, requestedClientId) {
+  const clientId = typeof requestedClientId === "string" && requestedClientId.trim()
+    ? requestedClientId.trim()
+    : typeof config.clientId === "string" && config.clientId.trim()
+      ? config.clientId.trim()
+      : "codex";
+  const tokenConfig = config.tokens && typeof config.tokens === "object" && config.tokens[clientId] && typeof config.tokens[clientId] === "object"
+    ? config.tokens[clientId]
+    : config;
+  return { ...config, ...tokenConfig, clientId };
+}
+
+async function readKeychainSecret(service, account) {
+  try {
+    const { stdout } = await execFileAsync("/usr/bin/security", ["find-generic-password", "-a", account, "-s", service, "-w"]);
+    const secret = stdout.trim();
+    return secret.length > 0 ? secret : null;
+  } catch {
+    return null;
+  }
+}
+
+async function resolveToken(config) {
+  if (typeof config.token === "string" && config.token.length > 0) {
+    return config.token;
+  }
+  if (config.credentialStorage === "macos_keychain" && typeof config.tokenRef === "string" && config.tokenRef.length > 0) {
+    const secret = await readKeychainSecret(config.credentialService || "Skills Layer CLI", config.tokenRef);
+    if (secret) {
+      return secret;
+    }
+  }
+  throw new Error("Skills Layer MCP token is unavailable. Run skills-layer mcp repair from Terminal.");
+}
+
+function writeJsonLine(socket, payload) {
+  socket.write(JSON.stringify(payload) + "\\n");
+}
+
+await rm(SOCKET_PATH, { force: true });
+
+const server = createServer((socket) => {
+  let buffer = "";
+  socket.setEncoding("utf8");
+  socket.on("data", async (chunk) => {
+    buffer += chunk;
+    const newlineIndex = buffer.indexOf("\\n");
+    if (newlineIndex < 0) {
+      return;
+    }
+    try {
+      const request = JSON.parse(buffer.slice(0, newlineIndex) || "{}");
+      const config = selectClientConfig(await readConfig(), request.clientId);
+      const token = await resolveToken(config);
+      writeJsonLine(socket, {
+        ok: true,
+        token,
+        mcpUrl: config.mcpUrl,
+        tokenPrefix: config.tokenPrefix || null
+      });
+    } catch (error) {
+      writeJsonLine(socket, {
+        ok: false,
+        error: error instanceof Error ? error.message : "Skills Layer MCP broker failed."
+      });
+    } finally {
+      socket.end();
+    }
+  });
+});
+
+server.listen(SOCKET_PATH, async () => {
+  try {
+    await chmod(SOCKET_PATH, 0o600);
+  } catch {
+    // Some platforms do not support chmod on sockets.
+  }
+});
+`}async function kn(e){let t=e.requestId??1,n=e.timeoutMs??5e3,r=pn(e.nodePath,[e.bridgePath],{stdio:["pipe","pipe","pipe"]}),i="",s=mi(r.stdout);r.stderr.on("data",u=>{i+=String(u)});let o,l=new Promise(u=>{o=setTimeout(()=>u("timeout"),n)});r.stdin.write(`${JSON.stringify({jsonrpc:"2.0",id:t,method:"tools/list",params:{}})}
+`);let c=await Promise.race([s,l]);if(clearTimeout(o),r.kill(),c==="timeout")return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!1,toolCount:null,reasonCode:"probe_timeout",message:"MCP bridge did not respond before the verification timeout."};if(!c.ok)return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!1,toolCount:null,reasonCode:"probe_failed",message:i.trim()?"MCP bridge failed before returning a response.":c.message};try{let u=JSON.parse(c.line);if(W(u)&&W(u.error))return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:null,reasonCode:"remote_mcp_error",message:Z(u.error,"message")??"Skills Layer MCP returned an error."};let d=W(u)&&W(u.result)&&Array.isArray(u.result.tools)?u.result.tools:null;return{status:"ok",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:d?d.length:null,reasonCode:null,message:d?`MCP bridge responded with ${d.length} tool${d.length===1?"":"s"}.`:"MCP bridge responded."}}catch{return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:null,reasonCode:"invalid_probe_response",message:"MCP bridge returned a response that was not valid JSON."}}}function dn(e){let t=e.target.status==="automatic",n=e.tokenRefPresent&&!e.tokenPresent,r=!n||e.brokerExists&&e.brokerChecksumMatches,i=(e.tokenPresent||e.tokenRefPresent)&&e.bridgeExists&&e.checksumMatches&&r&&t&&e.targetConfigured&&!e.rawTokenLeaked,s=i?"mcp_configured":e.mcpConfig?"mcp_needs_repair":"mcp_not_configured",o=`skills-layer mcp verify --client ${e.target.agentId}`;return{status:s,configured:i,clientId:e.target.agentId,environment:Z(e.tokenConfig,"environment")??Z(e.mcpConfig,"environment")??e.plan.environment,baseUrl:Z(e.mcpConfig,"baseUrl"),mcpUrl:Z(e.mcpConfig,"mcpUrl"),tokenPrefix:Z(e.tokenConfig,"tokenPrefix")??Z(e.mcpConfig,"tokenPrefix"),scopes:Array.isArray(e.tokenConfig?.scopes)?e.tokenConfig.scopes:Array.isArray(e.mcpConfig?.scopes)?e.mcpConfig.scopes:[],configuredClients:wi(e.mcpConfig),tokenPresent:e.tokenPresent||e.tokenRefPresent,tokenStorage:Z(e.tokenConfig,"credentialStorage")==="macos_keychain"?"macos_keychain":e.tokenPresent?"local_file_locked":"unknown",bridge:{path:e.plan.bridgePath,exists:e.bridgeExists,checksumMatches:e.checksumMatches},broker:{path:e.plan.brokerPath,socketPath:e.plan.brokerSocketPath,required:n,exists:e.brokerExists,checksumMatches:e.brokerChecksumMatches},target:{agentId:e.target.agentId,displayName:e.target.displayName,tier:e.target.tier,status:e.target.status,configPath:e.target.configPath,configured:e.targetConfigured,rawTokenLeaked:e.rawTokenLeaked,reason:e.target.reason,restartRequired:e.target.restartRequired,instructions:e.target.instructions},liveProbe:{status:"not_run",method:"tools/list",reasonCode:"use_mcp_verify",message:`Live MCP tools/list was not run by status. Run \`${o}\` to verify remote MCP reachability through the local bridge.`,nextCommand:o},nextCommand:i?null:`skills-layer mcp repair --client ${e.target.agentId}`}}function oi(e){return{agentId:e.agentId,displayName:e.displayName,tier:"tier_1",status:"automatic",serverName:de,configPath:e.configPath,restartRequired:!0,verification:"bridge_config_written",transport:"stdio_bridge",bridgePath:e.bridgePath,nodePath:e.nodePath,configKind:e.configKind,reason:"MCP support and a safe local config shape are known.",instructions:[`Skills Layer will install the local MCP bridge at ${e.bridgePath}.`,`Skills Layer will update ${e.configPath} to launch the bridge with ${e.nodePath}.`,"The raw MCP token stays in Skills Layer local storage and is not written to the agent config.","Open a fresh agent session or restart the agent to load the MCP server."],apply:async()=>{let t=await ai({bridgePath:e.bridgePath,brokerPath:e.brokerPath,brokerSocketPath:e.brokerSocketPath,mcpConfigPath:e.mcpConfigPath,nodePath:e.nodePath});return await ci({configPath:e.configPath,configKind:e.configKind,bridgePath:e.bridgePath,nodePath:e.nodePath,agentId:e.agentId}),t},disconnect:async()=>{await ui({configPath:e.configPath,configKind:e.configKind})}}}function gn(e){return{agentId:e.agentId,displayName:e.displayName,tier:e.tier,status:e.status,serverName:de,configPath:null,restartRequired:!0,verification:e.verification,transport:"manual",bridgePath:null,nodePath:null,configKind:null,reason:e.reason,instructions:e.instructions}}async function ai(e){let t=hn({mcpConfigPath:e.mcpConfigPath}),n=yn({mcpConfigPath:e.mcpConfigPath,socketPath:e.brokerSocketPath});return await Ge(Ce(e.bridgePath),{recursive:!0}),await me(e.bridgePath,t,"utf8"),await me(e.brokerPath,n,"utf8"),await lt(Ce(e.bridgePath),448),await lt(e.bridgePath,448),await lt(e.brokerPath,448),li({nodePath:e.nodePath,brokerPath:e.brokerPath}),{bridgePath:e.bridgePath,brokerPath:e.brokerPath,brokerSocketPath:e.brokerSocketPath,mcpConfigPath:e.mcpConfigPath,checksum:fe(t),brokerChecksum:fe(n),nodePath:e.nodePath}}function li(e){if(!(process.env.VITEST==="true"||process.env.SKILLS_LAYER_MCP_BROKER_AUTOSTART==="disabled"))try{pn(e.nodePath,[e.brokerPath],{detached:!0,stdio:"ignore"}).unref()}catch{}}async function ci(e){if(e.configKind==="codex_toml"){await pi(e);return}await gi(e)}async function ui(e){if(e.configKind==="codex_toml"){let r=await Re(e.configPath);if(r===null)return;await me(e.configPath,wn(r),"utf8");return}let t=await De(e.configPath,{allowMissing:!0});if(!t||!W(t.mcpServers))return;let n={...t.mcpServers};delete n[de],await Ge(Ce(e.configPath),{recursive:!0}),await me(e.configPath,`${JSON.stringify({...t,mcpServers:n},null,2)}
+`,"utf8")}async function di(e,t){if(!e.configPath||!e.configKind||!e.bridgePath||!e.nodePath)return{configured:!1,rawTokenLeaked:!1};if(e.configKind==="codex_toml"){let s=await Re(e.configPath);return s===null?{configured:!1,rawTokenLeaked:!1}:{configured:s.includes("[mcp_servers.skills-layer]")&&s.includes(`command = ${JSON.stringify(e.nodePath)}`)&&(s.includes(`args = [${JSON.stringify(e.bridgePath)}, "--client", ${JSON.stringify(e.agentId)}]`)||s.includes(`args = [${JSON.stringify(e.bridgePath)}]`)),rawTokenLeaked:!!(t&&s.includes(t))}}let n=await De(e.configPath,{allowMissing:!0}),r=W(n?.mcpServers)?n.mcpServers[de]:void 0;return{configured:W(r)&&r.command===e.nodePath&&Array.isArray(r.args)&&r.args[0]===e.bridgePath&&(r.args.length===1||r.args[1]==="--client"&&r.args[2]===e.agentId),rawTokenLeaked:!!(t&&JSON.stringify(n??{}).includes(t))}}async function gi(e){let t=await De(e.configPath,{allowMissing:!0})??{},n=W(t.mcpServers)?{...t.mcpServers}:{};n[de]={command:e.nodePath,args:[e.bridgePath,"--client",e.agentId]},await Ge(Ce(e.configPath),{recursive:!0}),await me(e.configPath,`${JSON.stringify({...t,mcpServers:n},null,2)}
+`,"utf8")}async function pi(e){let t=await Re(e.configPath)??"",n=["[mcp_servers.skills-layer]",`command = ${JSON.stringify(e.nodePath)}`,`args = [${JSON.stringify(e.bridgePath)}, "--client", ${JSON.stringify(e.agentId)}]`,""].join(`
+`),r=`${wn(t).trimEnd()}${t.trim().length>0?`
+
+`:""}${n}`;await Ge(Ce(e.configPath),{recursive:!0}),await me(e.configPath,r,"utf8")}function wn(e){let t=e.split(/\r?\n/u),n=[],r=!1;for(let i of t){if(i.trim()==="[mcp_servers.skills-layer]"){r=!0;continue}r&&/^\s*\[.+\]\s*$/u.test(i)&&(r=!1),r||n.push(i)}return n.join(`
+`).trimEnd()}function be(e){return{tier:"tier_1",configKind:"json_mcp_servers",resolveConfigPath(t,n,r){return Se(r,n,...e.split("/"))}}}async function De(e,t){try{let n=JSON.parse(await mn(e,"utf8"));return W(n)?n:{}}catch(n){if(t.allowMissing&&n.code==="ENOENT")return null;throw n}}async function Re(e){try{return await mn(e,"utf8")}catch(t){if(t.code==="ENOENT")return null;throw t}}async function lt(e,t){try{await Qr(e,t)}catch{}}async function vn(e){await ct(e,{force:!0})}async function Pn(e,t){await Promise.all([ct(e,{force:!0}),ct(t,{force:!0})])}function mi(e){return e?new Promise(t=>{let n="";e.on("data",r=>{n+=String(r);let i=n.indexOf(`
+`);i>=0&&t({ok:!0,line:n.slice(0,i)})}),e.on("error",r=>{t({ok:!1,message:r instanceof Error?r.message:"MCP bridge stdout failed."})}),e.on("end",()=>{t({ok:!1,message:"MCP bridge exited before returning a response."})})}):Promise.resolve({ok:!1,message:"MCP bridge stdout was not available."})}function fi(e,t){let n=ut(t),r=e??process.env,i=t==="win32"?Ke(r.APPDATA,r.USERPROFILE,r.HOME):Ke(r.XDG_CONFIG_HOME,r.HOME?n.join(r.HOME,".skills-layer"):void 0);return i?t==="win32"||r.XDG_CONFIG_HOME?.trim()?n.join(i,"skills-layer"):i:n.join(process.cwd(),".skills-layer")}function hi(e,t){return t==="win32"?Ke(e.USERPROFILE,e.HOME):Ke(e.HOME)}function yi(e){return at.includes(e)?e:"codex"}function ki(e,t){let n=e.tokens;return W(n)&&W(n[t])?n[t]:e}function wi(e){if(!e)return[];let t=e.clientIds;if(Array.isArray(t))return t.filter(i=>typeof i=="string"&&i.trim().length>0);let n=e.tokens;if(W(n))return Object.keys(n);let r=Z(e,"clientId");return r?[r]:[]}function Se(e,...t){return ut(e).join(...t)}function ut(e){return e==="win32"?Xr:Zr}function Ke(...e){return e.find(t=>typeof t=="string"&&t.trim().length>0)?.trim()}function Z(e,t){let n=e?.[t];return typeof n=="string"&&n.trim().length>0?n:null}function fe(e){return Yr("sha256").update(e).digest("hex")}function W(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function vi(e){let t=Pi(e);if(t)return t;let n=bi(e);if(n)return n;throw new Error("Unsupported bundle archive format")}function bn(e){try{return vi(e)}catch{return null}}function Pi(e){if(e.byteLength<4)return null;let t=new TextDecoder,n=new DataView(e.buffer,e.byteOffset,e.byteLength),r=[],i=0,s=!1;for(;i+4<=e.byteLength;){let o=n.getUint32(i,!0);if(o===67324752){if(s=!0,i+30>e.byteLength)throw new Error("ZIP local header is truncated");let l=n.getUint16(i+8,!0),c=n.getUint32(i+18,!0),u=n.getUint16(i+26,!0),d=n.getUint16(i+28,!0),m=i+30,k=m+u+d,p=k+c;if(l!==0)throw new Error("Only stored ZIP entries are supported");if(p>e.byteLength)throw new Error("ZIP entry data is truncated");r.push({path:t.decode(e.slice(m,m+u)),content:t.decode(e.slice(k,p))}),i=p;continue}return o===33639248||o===101010256?s?r:null:s?(()=>{throw new Error("Unexpected ZIP signature")})():null}return r}function bi(e){try{let t=JSON.parse(new TextDecoder().decode(e));return t.format!=="skills-layer-external-bundle-v1"||!Array.isArray(t.files)?null:t.files.filter(n=>typeof n.path=="string").map(n=>({path:n.path,...typeof n.content=="string"?{content:n.content}:{}}))}catch{return null}}import{createHash as Si}from"node:crypto";function Sn(e){let t=Si("sha256");for(let n of e)t.update(n.path),t.update("\0"),t.update(n.content??""),t.update("\0");return t.digest("hex")}import{execFile as Ci}from"node:child_process";import{createHash as Ri}from"node:crypto";import{promisify as xi}from"node:util";var dt=xi(Ci),$e="apiKey",he="apiKeyRef",_e="Skills Layer CLI";function gt(e=process.platform,t=process.env){let n=t.SKILLS_LAYER_CREDENTIAL_STORE?.trim().toLowerCase();return n==="local-file"||n==="local_file"||n==="disabled"||e!=="darwin"||process.env.VITEST==="true"&&n!=="macos-keychain"&&n!=="macos_keychain"?null:Ai()}async function Cn(e,t){if(!(typeof e[$e]=="string"&&e[$e].length>0))return e;let r=pt(t);if(!r)return e;try{let i={...e,credentialStorage:"macos_keychain"},s=$i(e);return await r.set(mt(t),s,e[$e]),i[he]=s,delete i[$e],i}catch{return _i(e)}}async function Rn(e,t){if(e.credentialStorage!=="macos_keychain"||e[$e]||!e[he])return e;let n=pt(t);if(!n)return e;let r=await n.get(mt(t),e[he]);return r?{...e,apiKey:r}:e}async function xn(e,t){if(!e||e.credentialStorage!=="macos_keychain"||!e[he])return;let n=pt(t);n&&await n.delete(mt(t),e[he])}function $i(e){let t=[e.baseUrl??"unknown-base-url",e.userId??e.email??e.role??"unknown-user","apiKey"].join(`
+`);return`skills-layer-cli:api-key:${Ri("sha256").update(t).digest("base64url").slice(0,32)}`}function pt(e){return e.store!==void 0?e.store:gt(e.platform,e.env??process.env)}function mt(e){return e.service??_e}function _i(e){let t={...e,credentialStorage:"local_file_locked"};return delete t[he],t}function Ai(){return{kind:"macos_keychain",async set(e,t,n){await dt("/usr/bin/security",["add-generic-password","-a",t,"-s",e,"-w",n,"-U"])},async get(e,t){try{let{stdout:n}=await dt("/usr/bin/security",["find-generic-password","-a",t,"-s",e,"-w"]);return n.trim()||null}catch{return null}},async delete(e,t){try{await dt("/usr/bin/security",["delete-generic-password","-a",t,"-s",e])}catch{}}}}function ft(e){let t=e.skillSlug??"<skill-slug>";return{localWork:{purpose:e.purpose,command:e.command,jsonCommand:e.jsonCommand},guardian:{checkCommand:`skills-layer guardian check --skill ${t} --json`,execCommand:`skills-layer guardian exec ${t} --json -- <command>`,mcpTools:["guardian.check","guardian.enforce","guardian.status","guardian.incident"],guidance:"Before risky shell, network, file, secret, browser, API, generated-code, or model-context actions, call MCP guardian.check/guardian.enforce or run skills-layer guardian check. Route shell actions through skills-layer guardian exec when strict local blocking is needed."},setup:{setupCommand:"skills-layer setup",hookStatusCommand:"skills-layer guardian hook status",hookInstallProjectCommand:"skills-layer guardian hook install --agent codex --scope project",hookInstallGlobalCommand:"skills-layer guardian hook install --agent codex --scope global"}}}var $n=`  ____  _    _ _ _       _
+ / ___|| | _(_) | |___  | |    __ _ _   _  ___ _ __
+ \\___ \\| |/ / | | / __| | |   / _\` | | | |/ _ \\ '__|
+  ___) |   <| | | \\__ \\ | |__| (_| | |_| |  __/ |
+ |____/|_|\\_\\_|_|_|___/ |_____\\__,_|\\__, |\\___|_|
+                                     |___/
+Skills-Layer
+AI Agent first platform for Skills`;var _n=`Skills Layer MCP
+Configure Skills Layer for AI agents through a local stdio bridge.
+
+Usage:
+  skills-layer mcp setup [--client <client-id>] [--all] [--environment <label>] [--json]
+  skills-layer mcp status [--client <client-id>] [--json]
+  skills-layer mcp verify [--client <client-id>] [--json]
+  skills-layer mcp repair [--client <client-id>] [--json]
+  skills-layer mcp disconnect [--client <client-id>] [--json]
+
+What setup does:
+  - mints a scoped MCP token from your logged-in session
+  - stores the token in Skills Layer local state
+  - installs ~/.skills-layer/mcp/skills-layer-mcp-proxy.mjs
+  - writes supported agent configs with command/args pointing to that bridge
+  - does not write raw MCP tokens into third-party agent config files
+  - with no --client, detects installed Tier 1 MCP agents and configures all detected agents
+  - with --client, configures only that agent
+  - with --all, configures every verified Tier 1 adapter
+
+Client ids:
+  Tier 1 automatic: codex, claude-code, cursor, cline, gemini-cli, windsurf
+  Skills-only: universal
+  Other registered agents return manual handoff guidance until their MCP config shape is verified.
+
+Checks:
+  status  inspects saved token, bridge file, checksum, target-agent config, and token leakage.
+  verify  runs status checks and launches the bridge for a live tools/list MCP handshake.
+  repair  rewrites the local bridge and supported target config.
+  disconnect removes Skills Layer MCP local state and the selected target config entry.
+
+After setup or repair, open a fresh agent session or restart the agent if tools are not visible.`;var Ii=`Skills Layer CLI
+Agent-first skill marketplace for developers. CLI, MCP, and API share one journey model.
+
+Usage:
+  skills-layer <command> [options]
+  skills-layer <command> --help
+  skills-layer <namespace> --help
+  skills-layer help topic [topic] [--base-url <url>] [--json]
+
+Fast paths:
+  Set up an account:
+    skills-layer register --method email --email you@example.com
+    skills-layer login --method github
+    skills-layer login --method microsoft
+    skills-layer setup
+    skills-layer whoami
+
+  Discover and decide:
+    skills-layer search "project planning"
+    skills-layer featured --search planning --sort relevance --limit 5
+    skills-layer show project-planner
+    skills-layer trust project-planner
+    skills-layer recommend "summarize YouTube videos" --limit 3
+    skills-layer categories
+    skills-layer compare <skill-slug-1> <skill-slug-2> [<skill-slug-3> ... up to 5]
+
+  Use a skill on this machine:
+    skills-layer install project-planner --dry-run
+    skills-layer install project-planner
+    skills-layer installed
+
+  Approve a skill for a workspace:
+    skills-layer workspace deploy <workspace-id> project-planner --dry-run
+    skills-layer workspace guide <workspace-id> project-planner
+
+  Create and submit a skill:
+    skills-layer creator init <skill-slug>
+    skills-layer validate <path>
+    skills-layer creator submit <path> --version 1.0.0 --dry-run
+    skills-layer source connection start --provider github --source <repo-url> --skill <skill-slug> --provenance-intent private_source_import
+    skills-layer creator source prepare <source-connection-id> --version 1.0.0
+
+Primary commands:
+  Account and environment:
+    skills-layer register --method <email|google|github|gitlab|microsoft> [--email <email>] [--base-url <url>] [--json]
+    skills-layer login [--method <email|google|github|gitlab|microsoft>] [--email <email>] [--base-url <url>] [--json]
+    skills-layer login --api-key <key> [--base-url <url>] [--with-mcp|--no-mcp] [--json]
+    skills-layer logout [--json]
+    skills-layer auth status [--json]
+    skills-layer auth repair [--json]
+    skills-layer whoami [--json]
+    skills-layer profile [--json]
+    skills-layer profile update [--display-name <text>] [--bio <text>] [--company <text>] [--json]
+    skills-layer api-key create --name <name> --scope <scope>[,<scope>...] [--expires <duration>] [--json]
+    skills-layer api-key list [--json]
+    skills-layer api-key revoke --key-id <key-id> [--json]
+    skills-layer setup [--json]
+    skills-layer mcp setup [--client <client-id>] [--all] [--environment <label>] [--json]
+    skills-layer mcp status [--client <client-id>] [--json]
+    skills-layer mcp verify [--client <client-id>] [--json]
+    skills-layer mcp repair [--client <client-id>] [--json]
+    skills-layer mcp disconnect [--client <client-id>] [--json]
+    skills-layer backend --base-url <url> [--json]
+    skills-layer backend [status|cloud|local] [--base-url <url>] [--json]
+    skills-layer status [--base-url <url>] [--json]
+    skills-layer doctor [--base-url <url>] [--json]
+
+  Discovery and trust:
+    skills-layer search [query] [--base-url <url>] [--agent <agent>] [--capability <capability>] [--trust <label>] [--runtime-risk <low|elevated|high>] [--security-capability <capability>] [--install [<skill-slug>]] [--json]
+    skills-layer featured [--limit <n>] [--search <text>] [--sort <featured|trending|newest|name|relevance>] [--base-url <url>] [--json]
+    skills-layer trending [--limit <n>] [--search <text>] [--sort <featured|trending|newest|name|relevance>] [--base-url <url>] [--json]
+    skills-layer show <skill-slug> [--base-url <url>] [--json]
+    skills-layer trust <skill-slug> [--base-url <url>] [--format <json|sarif>] [--json]
+    skills-layer recommend <task> [--limit <n>] [--base-url <url>] [--json]
+    skills-layer categories [--base-url <url>] [--json]
+    skills-layer compare <skill-slug-1> <skill-slug-2> [<skill-slug-3> ... up to 5] [--base-url <url>] [--json]
+    skills-layer install <skill-slug> [--version <semver>] [--scope <scope>] [--agent <agent>] [--workspace <workspace-id>] [--dry-run] [--json]
+    skills-layer install <source-url-or-path> [--skill <skill-slug>] [--all] [--scope <scope>] [--agent <agent>] [--quarantine] [--list] [--dry-run] [--json]
+    skills-layer install --source <source> [--skill <skill-slug>] [--all] [--scope <scope>] [--agent <agent>] [--quarantine] [--list] [--dry-run] [--json]
+    skills-layer source connection start --provider <github|gitlab|local|generic_git|domain> --source <source> [--skill <skill-slug>] [--visibility <private|public|unlisted>] [--price-cents <n>] [--license <text>] [--provenance-intent <intent>] [--disclose-source] [--json]
+    skills-layer source connection status <source-connection-id> [--json]
+    skills-layer source connection complete <source-connection-id> [--provider-owner-id <id>] [--provider-repo-id <id>] [--provider-project-id <id>] [--provider-installation-id <id>] [--commit-sha <sha>] [--json]
+    skills-layer source connection cancel <source-connection-id> [--json]
+    skills-layer source reference resolve <qualified-ref-or-alias> [--json]
+    skills-layer approval request status <approval-request-id> [--json]
+    skills-layer approval request complete <approval-request-id> --decision <approved|denied> [--decision-evidence-json <json>] [--json]
+    skills-layer buy <skill-slug> [--payment-method <method>] [--json]
+    skills-layer owned [--json]
+    skills-layer export <skill-slug> [--version <semver>] [--output <path>] [--show-url] [--json]
+    skills-layer add-review <skill-slug> --rating <1-5> [--feedback <text>] [--json]
+    skills-layer show-reviews [skill-slug] [--json]
+    skills-layer add-issue <skill-slug> --issue-type <bug|quality|safety|other> --message <text> [--json]
+    skills-layer show-issues <skill-slug> [--json]
+    skills-layer purchases [list|invoice|refund-quote|refund|spending] ...
+
+  Creator:
+    skills-layer validate <path> [--json]
+    skills-layer preview-trigger <path> [--should-trigger <prompt>] [--should-not-trigger <prompt>] [--paraphrase <prompt>] [--json]
+    skills-layer creator init <skill-slug> [--type <type>] [--dir <target-dir>] [--description <text>] [--category <category>] [--json]
+    skills-layer creator rules [--base-url <url>] [--json]
+    skills-layer creator submissions [--json]
+    skills-layer creator status <skill-slug> [--json]
+    skills-layer creator source prepare <source-connection-id> [<path-or-source>] [--source <source>] [--version <semver>] [--display-name <text>] [--skill-type <type>] [--category <category>] [--price-cents <n>] [--visibility <private|public|unlisted>] [--json]
+    skills-layer creator source publish-request <source-connection-id> <skill-slug> [--version <semver>] [--visibility <private|public|unlisted>] [--price-cents <n>] [--license <text>] [--disclose-source] [--approval-request-id <id>] [--json]
+    skills-layer creator source release-status <source-connection-id> [skill-slug] [--json]
+    skills-layer creator submit [<path-or-source>] [--source <source>] [--skill <skill-slug>] [--list] [--version <semver>] [--display-name <text>] [--skill-type <type>] [--category <category>] [--price-cents <n>] [--visibility <private|public|unlisted>] [--dry-run] [--json]
+    skills-layer creator submit-version <skill-slug> [<path-or-source>] [--source <source>] [--list] [--version <semver>] [--category <category>] [--price-cents <n>] [--visibility <private|public|unlisted>] [--json]
+    skills-layer creator check-slug <requested-slug> [--json]
+    skills-layer creator rename <skill-slug> <next-skill-slug> [--json]
+    skills-layer creator pricing <skill-slug> [--version <semver>] [--price-cents <n>] [--json]
+    skills-layer creator update-listing <skill-slug> [--display-name <text>] [--skill-type <type>] [--listing-status <status>] [--json]
+    skills-layer creator visibility <skill-slug> [--version <semver>] --visibility <private|public|unlisted> [--dry-run] [--json]
+    skills-layer creator security-report <skill-slug> [--version <semver>] [--version-id <id>] [--format <json|sarif>] [--json]
+    skills-layer creator rescan-security <skill-slug> [--version <semver>] [--version-id <id>] [--json]
+    skills-layer creator provenance <skill-slug> [--json]
+    skills-layer creator claim <skill-slug> [--requested-role <role>] [--json]
+    skills-layer creator verify <skill-slug> --claim-id <id> [--json]
+    skills-layer creator dispute <skill-slug> --message <text> [--json]
+    skills-layer creator issues <skill-slug> [--json]
+    skills-layer creator update-issue <skill-slug> --issue-id <id> --status <status> [--note <text>] [--fixed-version <semver>] [--json]
+    skills-layer creator reviews <skill-slug> [--json]
+    skills-layer creator moderate-review <skill-slug> --review-id <id> --status <status> [--reason <text>] [--json]
+    skills-layer creator analytics <skill-slug> [--json]
+    skills-layer creator earnings [--json]
+    skills-layer creator payouts [--json]
+    skills-layer creator withdraw [--amount-cents <n>] [--reason <text>] [--json]
+
+  Workspace:
+    skills-layer workspace list [--json]
+    skills-layer workspace create [<name>] [--kind <kind>] [--json]
+    skills-layer workspace skills <workspace-id> [--json]
+    skills-layer workspace deploy <workspace-id> <skill-slug> [--dry-run] [--json]
+    skills-layer workspace remove <workspace-id> <skill-slug> [--json]
+    skills-layer workspace guide <workspace-id> <skill-slug> [--json]
+
+  Additional tools:
+    skills-layer help ...
+    skills-layer guardian check --skill <skill-slug> --action-json <json> [--scope <local|project|global|workspace>] [--grant-json <json>] [--path <unmanaged-skill-path>] [--unmanaged-policy <allow|warn|block>] [--allow-unmanaged-once] [--cloud-trust-ledger <auto|required|optional|off>] [--telemetry-mode <cloud_managed|local_only>] [--json]
+    skills-layer guardian incident --skill <skill-slug> --version <semver> --path <installed-skill-path> [--reason <text>] [--telemetry-mode <cloud_managed|local_only>] [--json]
+    skills-layer guardian enable <skill-slug> [--json]
+    skills-layer guardian disable <skill-slug> [--json]
+    skills-layer guardian enable-warnings-only <skill-slug> [--json]
+    skills-layer guardian status [skill-slug] [--json]
+    skills-layer guardian hook install --agent <codex|claude-code|cline> [--scope <project|global>] [--json]
+    skills-layer guardian hook status [--scope <project|global>] [--json]
+    skills-layer guardian exec <skill-slug> [--action-json <json>] [--path <installed-skill-path>] [--dry-run] [--json] -- <command>
+    skills-layer setup [--json]
+    skills-layer agents list [--json]
+    skills-layer import ...
+    skills-layer sync [--scope <scope>] [--agent <agent>] [--json]
+    skills-layer restore [skill-slug] [--scope <scope>] [--workspace <workspace-id>] [--json]
+    skills-layer check [<skill-slug>] [--json]
+    skills-layer update [<skill-slug>] [--dry-run] [--pin <version>] [--json]
+    skills-layer installed [--scope <scope>] [--agent <agent>] [--verbose] [--json]
+    skills-layer remove [skill-slug] [--scope <scope>] [--agent <agent>] [--workspace <workspace-id>] [--json]
+
+Concepts:
+  - whoami = session identity. profile = editable account profile.
+  - install = machine/project/global materialization for an agent runtime.
+  - workspace deploy = governed workspace availability. It does not install on every member machine.
+  - workspace guide explains how an approved workspace skill becomes usable locally.
+  - featured and trending are browse views; search scopes them and sort controls ranking.
+  - buy is an explicit SaaS checkout handoff. Money movement stays human-in-the-loop.
+
+Safety:
+  - Do not pass API keys as visible positional values.
+  - Login uses masked prompts, saved sessions, secure headers, or environment-provided secrets.
+  - MCP setup mints a separate MCP-scoped token and keeps it behind the local stdio bridge instead of writing raw tokens into agent configs.
+  - Normal output, JSON, logs, and docs should avoid leaking secret-shaped values.
+  - Signed export URLs are actor-bound temporary bearer credentials revalidated before bytes are served; prefer export --output for human workflows.
+  - Install may require --accept-capability <capability> for declared risky runtime access.
+  - Use guardian check as a runtime gate before shell, network, file, secret, browser, device, API, generated-code, or model-context actions.
+  - Cloud-issued lockfile attestations verify against Cloud Trust Ledger by default before guardian check allows runtime actions.
+  - Use guardian check --grant-json with scoped Guardian authorization grants issued for the exact action.
+  - MCP agents can call guardian.check or guardian.enforce; local host hooks and shell agents can call skills-layer guardian check or route shell actions through skills-layer guardian exec.
+  - Use guardian incident --telemetry-mode local_only for private/local evidence that should stay on your machine.
+  - Use guardian enable/disable/enable-warnings-only to request per-skill mode changes; Cloud policy returns the effective mode.
+  - Use guardian status [skill-slug] to see Cloud policy, stored user preference, effective mode, local hook posture, and the next Guardian action.
+  - Use guardian hook install to add native host hooks where supported; status reports the actual enforcement layer instead of overclaiming strict blocking.
+  - Use guardian exec when you need a stronger wrapper that refuses blocked shell actions before spawning the command.
+  - Use --dry-run before mutating catalog/source installs, workspace deployments, submissions, visibility, or ownership state.`,He=`${$n}
+
+${Ii}`;var ji=new Set(["add-issue","add-review","agents","api-key","approval","auth","backend","buy","categories","check","compare","creator","doctor","export","featured","find","guardian","help","identity","import","install","installed","library","login","logout","mcp","owned","preview-trigger","profile","purchases","recommend","register","remove","restore","search","show","show-issues","show-reviews","source","status","sync","trending","trust","update","validate","whoami","workspace","workspaces"]);function Je(e,t){let n=e?.trim().toLowerCase(),r=t?.trim().toLowerCase();if(!n||!ji.has(n))return null;if(n==="install")return`Skills Layer install help
+
+Usage:
+  skills-layer install <skill-slug> [--version <semver>] [--scope <local|project|global|workspace>] [--agent <agent>] [--dry-run] [--json]
+  skills-layer install <source-url-or-path> [--skill <skill-slug>] [--all] [--scope <local|project|global>] [--agent <agent>] [--visibility <private|public>] [--list] [--dry-run] [--json]
+  skills-layer install --source <source> [--skill <skill-slug>] [--all] [--scope <local|project|global>] [--agent <agent>] [--visibility <private|public>] [--list] [--dry-run] [--json]
+
+What it does:
+  - Catalog install checks Skills Layer Cloud, then materializes approved files for your selected local agent/runtime.
+  - Source install defaults to a private Cloud skill for your account, then materializes it locally.
+  - Local paths upload the bundle to your private Cloud library by default so the skill can travel across machines.
+  - GitHub/GitLab sources also default private; use provider/source connection when Cloud needs private repository access.
+  - Add --visibility public only when you intentionally want Skills Layer to create or reuse a public catalog record.
+
+Good defaults:
+  skills-layer install <skill-slug> --dry-run
+  skills-layer install <skill-slug>
+  skills-layer install --source <source> --list
+  skills-layer install --source <source> --skill <skill-slug> --dry-run
+  skills-layer install ./my-skill --agent codex
+  skills-layer install https://github.com/OWNER/REPO --skill <skill-slug>
+  skills-layer install https://github.com/OWNER/PUBLIC_REPO --skill <skill-slug> --visibility public
+
+After install:
+  skills-layer installed
+  skills-layer sync
+  skills-layer update <skill-slug>`;if(n==="guardian")return`Skills Layer Guardian help
+
+Usage:
+  skills-layer guardian check --skill <skill-slug> --action-json <json> [--version <semver>] [--path <installed-skill-path>] [--grant-json <json>] [--cloud-trust-ledger <auto|required|optional|off>] [--telemetry-mode <cloud_managed|local_only>] [--json]
+  skills-layer guardian incident --skill <skill-slug> --version <semver> --path <installed-skill-path> [--reason <text>] [--telemetry-mode <cloud_managed|local_only>] [--json]
+  skills-layer guardian enable <skill-slug> [--json]
+  skills-layer guardian disable <skill-slug> [--json]
+  skills-layer guardian enable-warnings-only <skill-slug> [--json]
+  skills-layer guardian status [skill-slug] [--json]
+  skills-layer guardian hook install --agent <codex|claude-code|cline> [--scope <project|global>] [--json]
+  skills-layer guardian hook status [--scope <project|global>] [--json]
+  skills-layer guardian exec <skill-slug> [--action-json <json>] [--path <installed-skill-path>] [--dry-run] [--json] -- <command>
+
+What it does:
+  - check performs public-safe local preflight, then asks Skills Layer Cloud for the security decision while keeping the sensitive Guardian brain server-side.
+  - incident can write local disable/quarantine/report artifacts; local_only avoids uploading incident evidence.
+  - enable, disable, and enable-warnings-only request one-skill Guardian mode changes; Cloud policy still decides the effective mode.
+  - status shows the Cloud policy, the local per-skill preference if one is stored, the effective mode, hook posture, and next action.
+  - hook install writes host hook config for Codex, Claude Code, or a Cline integration candidate.
+  - hook status reports whether configured hooks exist and names the enforcement layer honestly.
+  - MCP agents can call guardian.check or guardian.enforce before risky tool use; local hooks call skills-layer guardian check, and shell agents can use guardian exec.
+  - doctor includes local Guardian hook posture alongside backend diagnostics.
+  - exec is a guarded shell wrapper: local preflight and Cloud Guardian must allow the action before the command is spawned.
+
+Enforcement:
+  - native_hook means the selected host has a concrete pre-action hook configuration installed.
+  - native_hook_candidate means Skills Layer wrote integration metadata but does not yet claim strict host blocking.
+  - strict pre-action blocking still requires a host agent or wrapper that calls Guardian before tool execution.
+  - Cloud-managed decisions should receive only minimal action metadata, not raw files, secrets, or terminal output.`;if(n==="mcp")return _n;let i=r?` ${r}`:"";return`Skills Layer ${n}${i} help
+
+Run \`skills-layer --help\` for public CLI usage.`}var E=class extends Error{status;details;constructor(t,n,r){super(n),this.name="ApiError",this.status=t,this.details=r}},cr=1,Kt=1,An=1,Gt="https://api.skills-layer.com",Li="http://127.0.0.1:8787",Ti=new Set(["json","dry-run","help","list","all","verbose","show-url","quarantine","confirm","confirmed","with-mcp","no-mcp","allow-unmanaged-once","disclose-source","allow-findings-featured"]),In=new Set(["accept-capability","approval-request-id","grant-json","paraphrase","should-not-trigger","should-trigger"]),Bi=new Set(["bio","company","description","display-name","feedback","message","note","reason","search","summary"]),Mi=new Set(["action","action-json","agent","amount-cents","api-key","base-url","capability","category","claim-id","client","cloud-trust-ledger","code","commit-sha","decision","decision-evidence-json","dependency-audit-status","dir","email","environment","evidence-json","expires","fixed-version","format","install","issue-id","issue-type","key-id","kind","license","limit","listing-status","max-characters","method","mode","name","output","path","payment-method","pin","price-cents","provider","provider-installation-id","provider-owner-id","provider-project-id","provider-repo-id","provenance-intent","publication-status","rating","requested-role","review-id","runtime-risk","scope","security-capability","skill","skill-type","sort","source","source-intake-context","state","status","text","telemetry-mode","trust","type","unmanaged-policy","version","version-id","visibility","workspace"]);async function Nl(e,t={}){let n={env:t.env??process.env,platform:t.platform??process.platform,cwd:t.cwd??process.cwd(),now:t.now??(()=>new Date().toISOString()),fetchFn:t.fetch??globalThis.fetch,openUrl:t.openUrl??Va(t.platform??process.platform),stdoutIsTty:t.stdoutIsTty??!!process.stdout.isTTY,promptText:t.promptText??Da(),promptSecret:t.promptSecret??Ha(),promptSelect:t.promptSelect??Ja(t.selectInput??process.stdin,t.selectOutput??process.stdout),sleep:t.sleep??(l=>new Promise(c=>setTimeout(c,l))),emitInfo:t.emitInfo??(l=>process.stdout.write(`${l}
+`)),credentialStore:t.credentialStore!==void 0?t.credentialStore:gt(t.platform??process.platform,t.env??process.env)},r=e[0];if(!r){let l=En([]),c=await Un(l.flags,n);return await $o(l.flags,c)}if(r==="--help"||r==="-h")return{exitCode:0,stdout:He,stderr:""};let i=En(e.slice(1));if(i.error)return y(i.error,i.flags.json);let{flags:s,positionals:o}=i;if(r==="admin")return y("The public skills-layer package does not include internal commands.",s.json);if(s.help){let l=Je(r,o[0]);return l?{exitCode:0,stdout:l,stderr:""}:y(jn(r),s.json)}try{let l=await Un(s,n);switch(r){case"agents":return await Fi(o,s,l);case"backend":return await qi(o,s,l);case"register":return await ur(s,l);case"login":return await dr(s,l);case"logout":return await gr(s,l);case"whoami":return await S("/api/v1/whoami",s,l,"Account loaded.",{authenticated:!0});case"profile":return await Di(o,s,l);case"auth":return await Ji(o,s,l);case"identity":return await Yi(o,s,l);case"api-key":return await Qi(o,s,l);case"mcp":return await Zi(o,s,l);case"search":case"find":return await is(o,s,l);case"featured":case"trending":return await ss(r,s,l);case"categories":return await S("/api/v1/categories",s,l,"Categories loaded.");case"recommend":return await os(o,s,l);case"compare":return await as(o,s,l);case"show":return await ls(o,s,l);case"trust":return await cs(o,s,l);case"help":return await us(o,s,l);case"status":return await S("/api/v1/status",s,l,"Status loaded.");case"doctor":return await ta(s,l);case"setup":return await vr(s,l);case"validate":return await ds(o,s,l);case"preview-trigger":return await gs(o,s,l);case"creator":return await ps(o,s,l);case"install":return await Jt(o,s,l);case"installed":return await Qs(s,l);case"remove":return await Zs(o,s,l);case"update":return await Xs(o,s,l);case"sync":return await eo(s,l);case"restore":return await uo(o,s,l);case"check":return await go(o,s,l);case"import":return await po(o,s,l);case"source":return await mo(o,s,l);case"approval":return await ho(o,s,l);case"workspace":case"workspaces":return await yo(o,s,l);case"buy":return await ko(o,s,l);case"purchases":return await wo(o,s,l);case"owned":return await S("/api/v1/me/library",s,l,"Owned skills loaded.",{authenticated:!0});case"export":return await Po(o,s,l);case"library":return await vo(o,s,l);case"add-review":return await Gn("add",o,s,l);case"show-reviews":return await Gn("show",o,s,l);case"add-issue":return await Dn("add",o,s,l);case"show-issues":return await Dn("show",o,s,l);case"guardian":return await bo(o,s,l);default:return y(jn(r),s.json)}}catch(l){return l instanceof E?it(l,s.json):y(ue(l),s.json)}}function jn(e){let t=e.trim().toLowerCase();return t==="purchase"?`Unknown command "${e}".
+
+Did you mean:
+  skills-layer buy <skill-slug>
+  skills-layer purchases list`:t==="validation"?`Unknown command "${e}".
+
+Did you mean:
+  skills-layer validate <path>`:t==="details"?`Unknown command "${e}".
+
+Did you mean:
+  skills-layer show <skill-slug>`:t==="security-report"?`Unknown command "${e}".
+
+Did you mean:
+  skills-layer trust <skill-slug>`:`Unknown command "${e}".`}function En(e){let t={json:!1,help:!1,dryRun:!1,list:!1,all:!1,verbose:!1,showUrl:!1,quarantine:!1,confirmed:!1,allowUnmanagedOnce:!1,discloseSource:!1,allowFindingsFeatured:!1,shouldTrigger:[],shouldNotTrigger:[],paraphrase:[],grantJson:[],findingCode:[],acceptCapability:[],approvalRequestId:[]},n=[];for(let r=0;r<e.length;r+=1){let i=e[r];if(!i)continue;if(i==="--"){n.push(...e.slice(r+1));break}if(i==="-h"){t.help=!0;continue}if(!i.startsWith("--")){n.push(i);continue}let s=i.slice(2);if(Ti.has(s)){let l=ht(s);s==="confirm"?t.confirmed=!0:t[l]=!0;continue}let o=e[r+1];if(!o||o.startsWith("--")){if(s==="install"){t.install="";continue}return{flags:t,positionals:n,error:`Flag --${s} requires a value.`}}if(Bi.has(s)){let l=Ni(e,r);if(!l.value)return{flags:t,positionals:n,error:`Flag --${s} requires a value.`};t[ht(s)]=l.value,r=l.nextIndex;continue}if(Mi.has(s)||In.has(s)){let l=ht(s);if(In.has(s)){let c=Array.isArray(t[l])?t[l]:[];c.push(o),t[l]=c}else t[l]=o;r+=1;continue}return{flags:t,positionals:n,error:`Unknown flag --${s}.`}}return{flags:t,positionals:n}}function Ni(e,t){let n=[],r=t;for(let i=t+1;i<e.length;i+=1){let s=e[i];if(!s||s.startsWith("--"))break;n.push(s),r=i}return{value:n.length>0?n.join(" "):null,nextIndex:r}}function ht(e){return e.replace(/-([a-z])/gu,(t,n)=>n.toUpperCase())}async function Un(e,t){let n=Oi(t.env,t.platform),[r,i]=await Promise.all([Ga(n.configPath,t),z(n.backendPreferencePath)]),s=X(g(e.baseUrl)??Q(t.env.SKILLS_LAYER_BASE_URL)??Q(i?.preferredBaseUrl)??Q(r?.baseUrl)??Gt),o=g(e.apiKey)??Q(t.env.SKILLS_LAYER_API_KEY),l=Q(r?.apiKey),c=Q(r?.baseUrl),u=!c||X(c)===s,d=o??(u?l:void 0),m=!o&&l&&c&&!u?`Your saved login belongs to ${X(c)}, but the selected backend is ${s}. Run \`skills-layer backend --base-url ${X(c)}\` to use that login, or run \`skills-layer login\` for ${s}.`:void 0;return{...t,paths:n,config:r,baseUrl:s,apiKey:d,authBlockedMessage:m}}function Oi(e,t){let n=t==="win32"?ve:Ft,r=t==="win32"?Q(e.USERPROFILE)??Q(e.HOME):Q(e.HOME),i=n.join(r??".",".skills-layer");return{stateDir:i,configPath:n.join(i,"config.json"),backendPreferencePath:n.join(i,"backend-preference.json"),installsPath:n.join(i,"installs.json"),importsPath:n.join(i,"imports.json"),mcpConfigPath:n.join(i,"mcp.json"),mcpPreferencePath:n.join(i,"mcp-preference.json"),bundlesDir:n.join(i,"bundles"),incidentsDir:n.join(i,"incidents")}}async function Fi(e,t,n){if(e[0]!=="list")return y(`Unknown agents command "${e[0]??""}".`,t.json);let r=ae(n.env,n.platform,n.cwd).map(i=>({id:i.id,displayName:i.displayName,capabilities:i.capabilities,projectSkillsPath:i.targets.projectSkillsPath,globalSkillsPath:i.targets.globalSkillsPath}));return f({status:"ok",results:r},`Found ${r.length} supported agent targets.`,t.json,n)}async function qi(e,t,n){let r=e[0],i=g(t.baseUrl);if(!r&&i||r==="cloud"||r==="local"){let o=X(i??(r==="local"?Li:Gt)),l=we(o);return await K(n.paths.backendPreferencePath,{version:Kt,preferredBaseUrl:o,savedAt:n.now()}),f({status:"updated",selectedBackend:l,selectedBaseUrl:o,savedLoginBaseUrl:n.config?.baseUrl??null,loginMatchesSelectedBackend:!n.config?.baseUrl||X(n.config.baseUrl)===o},`Backend set to ${l}.`,t.json,n)}if(r&&r!=="status")return y(`Unknown backend command "${r}".`,t.json);let s=we(n.baseUrl);return f({status:"ok",selectedBackend:s,selectedBaseUrl:n.baseUrl,savedLoginBaseUrl:n.config?.baseUrl??null,loginMatchesSelectedBackend:!n.config?.baseUrl||X(n.config.baseUrl)===n.baseUrl,loggedIn:!!n.apiKey,email:n.config?.email??null,role:n.config?.role??null},`Backend: ${n.baseUrl}`,t.json,n)}var Dt=[{value:"google",label:"Google",description:"Open browser sign-in and return here"},{value:"github",label:"GitHub",description:"Open browser sign-in and return here"},{value:"gitlab",label:"GitLab",description:"Open browser sign-in and return here"},{value:"microsoft",label:"Microsoft",description:"Open browser sign-in and return here"}],Ki=[...Dt,{value:"email",label:"Email code",description:"Use an emailed one-time code"},{value:"api_key",label:"API key (advanced)",description:"Paste an existing Skills Layer login key"}],Gi=[{value:"email",label:"Email",description:"Use an emailed verification code and API key"},...Dt];async function ur(e,t){let n=g(e.method);if(!n)if(e.json)n="email";else try{n=await t.promptSelect("Choose how to register:",Gi)}catch{return y("register requires --method when interactive selection is unavailable. Try `skills-layer register --method email --email you@example.com`, `skills-layer register --method google`, `skills-layer register --method github`, `skills-layer register --method gitlab`, or `skills-layer register --method microsoft`.",!1)}if(n==="email"){let i=g(e.email);if(!i&&!e.json)try{i=await t.promptText("Enter your email address: ")}catch{return y("register --method email requires --email when interactive prompts are unavailable.",!1)}i=w(i,"register requires --email.");let s=await P(t,"/api/v1/register",{method:"POST",headers:_(),body:JSON.stringify({method:n,email:i})});if(e.json)return f(s.status==="already_registered"?Mt(s):H(s),"Registration started.",e.json,t);if(s.status==="already_registered")return f(Mt(s),`${i} is already registered. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,!1,t);let o;try{o=await t.promptText(`Enter the verification code sent to ${i} (check spam/junk folder if missing): `)}catch{return f(H(s),`Registration started for ${i}. Check your email (including spam/junk folder) for the verification code, then run \`skills-layer auth verify --email ${i} --code <code>\`.`,!1,t)}return await Er(i,o,e,t,`Verified ${i}.`)}let r=await P(t,"/api/v1/identity/social/start",{method:"POST",headers:_(),body:JSON.stringify({provider:n,mode:"login"})});return e.json?f(r,"Social registration started.",e.json,t):await Xt(n,r,e,t,"login")}async function dr(e,t){if(e.withMcp&&e.noMcp)return y("login cannot combine --with-mcp and --no-mcp.",e.json);let n=g(e.apiKey);if(n){let o=await je(t,n,{notifyLogin:!0}),l=await Rt(e,{...t,config:o,apiKey:n});return D(l)?l:f(H({status:"verified",...o,...l.data?{mcp:l.data}:{}}),[`Logged in as ${o.email}.`,l.message??""].filter(Boolean).join(" "),e.json,t)}let r=g(e.method);if(!r&&!e.json)try{let o=await t.promptSelect("Choose how to sign in:",Ki);r=o==="api_key"?void 0:o}catch{return y("login requires --api-key or --method <email|google|github|gitlab|microsoft> when interactive selection is unavailable.",!1)}if(r){if(r==="email"){let l=g(e.email);!l&&!e.json&&(l=(await t.promptText("Enter your email address: ")).trim()),l=w(l,"login --method email requires --email.");let c=await P(t,"/api/v1/identity/recover/start",{method:"POST",headers:_(),body:JSON.stringify({email:l,method:"email",intent:"login"})});if(e.json)return f(c,`Passwordless email login started for ${l}.`,!0,t);let u;try{u=(await t.promptText(`Enter the sign-in code sent to ${l} (check spam/junk folder if missing): `)).trim()}catch{return f(c,`Passwordless email login started for ${l}. Check your email, then run \`skills-layer login --method email --email ${l}\` again when prompts are available.`,!1,t)}let d=await P(t,"/api/v1/identity/recover/complete",{method:"POST",headers:_(),body:JSON.stringify({email:l,code:u,intent:"login"})});return await tt(l,d,e,t,`Verified ${l}.`)}if(!["google","github","gitlab","microsoft"].includes(r))return y("login --method must be email, google, github, gitlab, or microsoft.",e.json);let o=await P(t,"/api/v1/identity/social/start",{method:"POST",headers:_(),body:JSON.stringify({provider:r,mode:"login"})});return e.json?f(o,"Social login started.",!0,t):await Xt(r,o,e,t,"login")}if(!e.json)try{n=(await t.promptSecret("Enter your Skills Layer API key: ")).trim()}catch{return y("login requires an API key.",e.json)}if(!n)return y("login requires --api-key or --method <email|google|github|gitlab|microsoft>.",e.json);let i=await je(t,n,{notifyLogin:!0}),s=await Rt(e,{...t,config:i,apiKey:n});return D(s)?s:f(H({status:"verified",...i,...s.data?{mcp:s.data}:{}}),[`Logged in as ${i.email}.`,s.message??""].filter(Boolean).join(" "),e.json,t)}async function gr(e,t){return await xn(t.config,{env:t.env,platform:t.platform,store:t.credentialStore}),await Ot(t.paths.configPath,{force:!0}),f({status:"logged_out"},"Logged out.",e.json,t)}async function Di(e,t,n){let r=e[0]??"show";if(r==="show")return await S("/api/v1/profile",t,n,"Profile loaded.",{authenticated:!0});if(r==="update"){let i=await Hi(t,n);if(D(i))return i;let s=await P(n,"/api/v1/profile",{method:"PATCH",headers:_(n.apiKey),body:JSON.stringify(i)});return f(s,"Profile updated.",t.json,n)}return y(`Unknown profile command "${r}".`,t.json)}async function Hi(e,t){let n=F(e,["displayName","bio","company"]);if(Object.keys(n).length>0)return n;if(e.json)return y("profile update requires at least one of --display-name, --bio, or --company.",!0);try{let r=await t.promptText("Display name (leave blank to keep unchanged): "),i=await t.promptText("Bio (leave blank to keep unchanged): "),s=await t.promptText("Company (leave blank to keep unchanged): "),o=A({displayName:r||void 0,bio:i||void 0,company:s||void 0});return Object.keys(o).length===0?y("No profile changes entered.",!1):o}catch{return y("profile update requires at least one of --display-name, --bio, or --company.",!1)}}async function Ji(e,t,n){let r=e[0];if(r==="register")return await ur({...t,method:"email"},n);if(r==="verify"){let i=w(t.email,"auth verify requires --email."),s=w(t.code,"auth verify requires --code.");return await Er(i,s,t,n,`Verified ${i}.`)}return r==="recover"?await Wi(e.slice(1),t,n):r==="login"?await dr(t,n):r==="logout"?await gr(t,n):r==="status"?zi(t,n):r==="repair"?await Vi(t,n):y(`Unknown auth command "${r??""}".`,t.json)}function zi(e,t){let n=t.config?.baseUrl?X(t.config.baseUrl):null,r=!!(t.apiKey&&n===t.baseUrl);return f({status:"auth_status",selectedBackend:we(t.baseUrl),selectedBaseUrl:t.baseUrl,loggedIn:r,requiresLogin:!r,...t.config?.email?{savedLogin:{baseUrl:n,email:t.config.email,role:t.config.role??null,roles:t.config.roles??[],savedAt:t.config.savedAt??null,...t.config.credentialStorage?{credentialStorage:t.config.credentialStorage}:{},matchesSelectedBackend:r}}:{}},r&&t.config?.email?`Logged in as ${t.config.email}.`:t.config?.baseUrl?`Saved login targets ${n}; selected backend is ${t.baseUrl}. Run \`skills-layer auth repair\` or \`skills-layer login\`.`:"Not logged in. Run `skills-layer login`.",e.json,t)}async function Vi(e,t){if(!t.config?.baseUrl||!t.config.apiKey||!t.config.email||!t.config.role||!t.config.savedAt)return y("No saved Skills Layer login was found to repair. Run `skills-layer login`.",e.json);let n=X(t.config.baseUrl);return await K(t.paths.backendPreferencePath,{version:Kt,preferredBaseUrl:n,savedAt:t.now()}),await tn(t.paths.configPath,{...t.config,baseUrl:n,savedAt:t.now()},t),f({status:"auth_repaired",baseUrl:n,loggedIn:!0,email:t.config.email,role:t.config.role,credentialStorage:t.config.credentialStorage??"local_file_locked"},`Auth repaired for ${t.config.email}. Backend preference now matches ${n}.`,e.json,t)}async function Wi(e,t,n){let r=e[0]??g(t.method)??"email",i=g(t.email);if(!i&&!t.json)try{i=await n.promptText("Enter your email address: ")}catch{return y("auth recover requires --email when interactive prompts are unavailable.",!1)}if(i=w(i,"auth recover requires --email."),r==="complete"){let c=g(t.code);if(!c&&!t.json)try{c=await n.promptText("Enter the recovery code: ")}catch{return y("auth recover complete requires --code when interactive prompts are unavailable.",!1)}return c=w(c,"auth recover complete requires --code."),await Ln(i,c,t,n)}let s=await P(n,"/api/v1/identity/recover/start",{method:"POST",headers:_(),body:JSON.stringify({email:i,method:r})}),o=Mt(s);if(t.json)return f(o,"Recovery started.",!0,n);let l="";try{l=(await n.promptText("Enter the recovery code if you received one, or press Enter to stop: ")).trim()}catch{return f(o,`If this email can continue, instructions have been sent. Check your inbox and spam folder. When you have a code, run \`skills-layer auth recover complete --email ${i} --code <code>\`.`,!1,n)}return l?await Ln(i,l,t,n):f(o,`If this email can continue, instructions have been sent. When you have a code, run \`skills-layer auth recover complete --email ${i} --code <code>\`.`,!1,n)}async function Ln(e,t,n,r){let i=await P(r,"/api/v1/identity/recover/complete",{method:"POST",headers:_(),body:JSON.stringify({email:e,code:t})});if(n.json){let s=a(i,"apiKey");return s?(await je(r,s,{expectedEmail:e,knownEmail:a(i,"email")??e,knownRole:a(i,"role")??"user",knownRoles:ee(i,"roles"),knownUserId:a(i,"userId")}),f(H({...i,loggedIn:!0}),"Recovery complete.",!0,r)):f(H({...i,email:e,loggedIn:!1}),"Recovery complete.",!0,r)}return await tt(e,i,n,r,`Recovered access for ${e}.`)}async function Yi(e,t,n){let r=e[0],i=1;if(r==="providers")return await S("/api/v1/identity/social/providers",t,n,"Identity providers loaded.");if(r==="start"){let s=g(t.provider);if(!s&&!t.json)try{s=await n.promptSelect("Choose identity provider:",Dt)}catch{return y("identity start requires --provider when interactive selection is unavailable.",!1)}s=w(s,"identity start requires --provider.");let o=await P(n,"/api/v1/identity/social/start",{method:"POST",headers:_(n.apiKey),body:JSON.stringify({provider:s,mode:g(t.mode)??"login"})});return t.json?f(o,"Social auth started.",!0,n):await Xt(s,o,t,n,"login")}if(r==="status"){let s=g(t.state)??e[i];return s?await S(`/api/v1/identity/social/status/${encodeURIComponent(s)}`,t,n,"Social auth status loaded."):y("identity status requires --state.",t.json)}if(r==="complete"){let s=w(t.provider,"identity complete requires --provider."),o=w(t.state,"identity complete requires --state."),l=w(t.code,"identity complete requires --code."),c=await P(n,"/api/v1/identity/social/complete",{method:"POST",headers:_(n.apiKey),body:JSON.stringify({provider:s,state:o,code:l})});return await oa(c,n),f(H(c),"Social auth complete.",t.json,n)}if(r==="list")return await S("/api/v1/me/linked-identities",t,n,"Linked identities loaded.",{authenticated:!0});if(r==="unlink"){let s=w(t.provider??e[i],"identity unlink requires a provider."),o=await P(n,`/api/v1/me/linked-identities/${encodeURIComponent(s)}`,{method:"DELETE",headers:T(n.apiKey,n.authBlockedMessage)});return f(o,"Identity unlinked.",t.json,n)}return y(`Unknown identity command "${r??""}".`,t.json)}async function Qi(e,t,n){let r=e[0];if(!r)return y("api-key requires create, list, or revoke.",t.json);if(r==="list")return await S("/api/v1/me/api-keys",t,n,"API keys loaded.",{authenticated:!0});if(r==="create"){let i=g(t.name),s=Qa(t.scope);if(!i)return y("api-key create requires --name.",t.json);if(s.length===0)return y("api-key create requires at least one --scope.",t.json);let o=await P(n,"/api/v1/me/api-keys",{method:"POST",headers:{"content-type":"application/json",...T(n.apiKey,n.authBlockedMessage)},body:JSON.stringify({name:i,scopes:s,...g(t.expires)?{expiresIn:g(t.expires)}:{}})});return f(H(o),"Automation API key created. The full key was sent to your verified email. Run `skills-layer api-key list` to manage keys.",t.json,n)}if(r==="rotate")return y(`api-key rotate is not part of normal login.
+
+For CLI access:
+  skills-layer login
+
+For automation:
+  skills-layer api-key create --name "<name>" --scope <scope> --expires <duration>
+
+To remove an old key:
+  skills-layer api-key list
+  skills-layer api-key revoke --key-id <key-id>`,t.json);if(r==="revoke"){let i=t.keyId??e[1];if(!i)return y(`api-key revoke needs a key id.
+
+Run:
+  skills-layer api-key list
+  skills-layer api-key revoke --key-id <key-id>`,t.json);let s=String(i),o=await P(n,`/api/v1/me/api-keys/${encodeURIComponent(s)}/revoke`,{method:"POST",headers:T(n.apiKey,n.authBlockedMessage)});return f(o,"API key revoked.",t.json,n)}return y(`Unknown api-key command "${r}".`,t.json)}async function Zi(e,t,n){let r=e[0]??"status";if(r==="setup"||r==="repair"){let i=await Ht(t,n);return D(i)?i:f({...i},`MCP configured for ${i.clientId}. Open a fresh agent session or restart the agent to load Skills Layer tools.`,t.json,n)}if(r==="status"||r==="verify"){let i=await z(n.paths.mcpConfigPath);if(!i)return f({status:"mcp_not_configured",configured:!1,nextCommand:"skills-layer mcp setup"},"MCP is not configured on this machine.",t.json,n);let s=g(t.client)??g(t.agent)??a(i,"clientId")??"codex",o=a(i,"baseUrl")??n.baseUrl,l=await fn({baseUrl:o,mcpUrl:a(i,"mcpUrl")??`${o}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:s,environment:a(i,"environment")??we(o),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:i});if(r==="verify"&&l.configured){let c=await kn({nodePath:process.execPath,bridgePath:l.bridge.path}),u={...l,verified:c.status==="ok",liveProbe:c};return c.status!=="ok"?j(u,`MCP config exists for ${l.clientId}, but live bridge verification failed: ${c.message}`,t.json,c.reasonCode??void 0):f(u,`MCP verified for ${l.clientId}. ${c.message} Open a fresh agent session or restart the agent if tools are not visible yet.`,t.json,n)}return f(l,l.configured?`MCP is configured for ${l.clientId}. Open a fresh agent session or restart the agent if tools are not visible yet.`:`MCP needs repair for ${l.clientId}. Run \`${l.nextCommand}\`.`,t.json,n)}if(r==="disconnect"||r==="logout"){let i=g(t.client)??g(t.agent)??"codex",s=await z(n.paths.mcpConfigPath),o=xe({baseUrl:n.baseUrl,mcpUrl:`${n.baseUrl}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:i,environment:we(n.baseUrl),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath}),l=o.targets.find(c=>c.agentId===i);return await ts(s,n),await l?.disconnect?.(),await vn(o.bridgePath),await Pn(o.brokerPath,o.brokerSocketPath),await Ot(n.paths.mcpConfigPath,{force:!0}),f({status:"mcp_disconnected",configured:!1,clientId:i},"MCP disconnected on this machine.",t.json,n)}return y(`Unknown mcp command "${r}". Use setup, status, verify, repair, or disconnect.`,t.json)}async function Ht(e,t){let n=g(e.environment)??we(t.baseUrl),r=["mcp:use","catalog:read","library:read","guardian:check","guardian:incident","creator:read"],i=`${t.baseUrl}/mcp`,s=xe({baseUrl:t.baseUrl,mcpUrl:i,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:"codex",environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),o=await Xi(e,t,s),l=o.clientIds[0]??"codex",c=xe({baseUrl:t.baseUrl,mcpUrl:i,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:l,environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),u={},d=null;for(let p of o.clientIds){let h=await P(t,"/api/v1/me/mcp-tokens",{method:"POST",headers:_(t.apiKey),body:JSON.stringify({clientId:p,environment:n,scopes:r})}),v=a(h,"apiKey");if(!v)return y("MCP setup did not receive a token from the backend.",e.json);let b=await es(t,{token:v,clientId:p,environment:n});u[p]={clientId:p,environment:n,...b,tokenPrefix:a(h,"keyPrefix")??null,scopes:Array.isArray(h.scopes)?h.scopes:[],savedAt:t.now()},d??=h}let m=u[l]??{};await K(t.paths.mcpConfigPath,{version:1,baseUrl:t.baseUrl,mcpUrl:i,clientId:l,clientIds:o.clientIds,environment:n,selectionSource:o.selectionSource,detectedClientIds:o.detectedClientIds,...m,tokens:u,brokerPath:c.brokerPath,brokerSocketPath:c.brokerSocketPath,savedAt:t.now()});let k=c.targets.filter(p=>p.status==="automatic"&&o.clientIds.includes(p.agentId));for(let p of k)await p.apply?.();return{...H(d??{}),status:"mcp_configured",clientId:l,clientIds:o.clientIds,selectionSource:o.selectionSource,detectedClientIds:o.detectedClientIds,environment:n,mcpUrl:i,bridgePath:c.bridgePath,brokerPath:c.brokerPath,brokerSocketPath:c.brokerSocketPath,nodePath:c.nodePath,bridgeChecksum:c.bridgeChecksum,brokerChecksum:c.brokerChecksum,saved:!0,registrations:{status:"mcp_registration_plan",automaticCount:c.automaticCount,manualCount:c.manualCount,skillsOnlyCount:c.skillsOnlyCount,unsupportedCount:c.unsupportedCount,appliedCount:k.length,appliedClients:k.map(p=>p.agentId),targets:c.targets.map(p=>({agentId:p.agentId,displayName:p.displayName,tier:p.tier,status:p.status,transport:p.transport,configPath:p.configPath,bridgePath:p.bridgePath,restartRequired:p.restartRequired,reason:p.reason,instructions:p.instructions}))}}}async function Xi(e,t,n){let r=g(e.client)??g(e.agent),i=n.targets.filter(c=>c.status==="automatic").map(c=>c.agentId);if(r)return{clientIds:[r],detectedClientIds:[],selectionSource:"explicit"};if(e.all)return{clientIds:i,detectedClientIds:i,selectionSource:"all"};let s=await an({env:t.env,platform:t.platform,cwd:t.cwd,pathExists:ce}),o=new Set(i),l=s.map(c=>c.id).filter(c=>o.has(c));return l.length>0?{clientIds:l,detectedClientIds:l,selectionSource:"detected"}:{clientIds:["codex"],detectedClientIds:[],selectionSource:"fallback"}}async function es(e,t){if(!e.credentialStore)return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"};let n=rs({baseUrl:e.baseUrl,userId:e.config?.userId,email:e.config?.email,clientId:t.clientId,environment:t.environment});try{return await e.credentialStore.set(_e,n,t.token),{tokenRef:n,credentialStorage:"macos_keychain",credentialService:_e,tokenStorage:"macos_keychain"}}catch{return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"}}}async function ts(e,t){if(!e||!t.credentialStore)return;let n=ns(e,_e);for(let r of n)await t.credentialStore.delete(r.service,r.tokenRef)}function ns(e,t){let n=new Map;Tn(e,t,n);let r=e.tokens;if(R(r))for(let i of Object.values(r))R(i)&&Tn(i,t,n);return[...n.values()]}function Tn(e,t,n){let r=a(e,"tokenRef");if(!r||a(e,"credentialStorage")!=="macos_keychain")return;let i=a(e,"credentialService")??t;n.set(`${i}:${r}`,{service:i,tokenRef:r})}function rs(e){let t=[e.baseUrl,e.userId??e.email??"unknown-user",e.clientId,e.environment,"mcpToken"].join(`
+`);return`skills-layer-cli:mcp-token:${Nt("sha256").update(t).digest("base64url").slice(0,32)}`}async function Rt(e,t){if(e.noMcp)return{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."};let n=await z(t.paths.mcpConfigPath),r=n?a(n,"baseUrl"):void 0,i=n?a(n,"clientId")??"codex":"codex";if(!e.withMcp&&r===t.baseUrl&&i)return{data:{status:"mcp_already_configured",configured:!0,clientId:i,mcpUrl:n?a(n,"mcpUrl")??`${t.baseUrl}/mcp`:`${t.baseUrl}/mcp`},message:"MCP is already configured for this machine."};if(!e.withMcp&&!e.json){let l=await z(t.paths.mcpPreferencePath),c=l?a(l,"baseUrl"):void 0,u=l?a(l,"clientId")??"codex":void 0;if((l?a(l,"choice"):void 0)==="not_now"&&c===t.baseUrl&&u==="codex")return{data:{status:"mcp_skipped_previously",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup was skipped previously. Run `skills-layer mcp setup` when you want AI-tool access."}}let s=e.withMcp===!0;if(!s&&!e.json)try{let l=await t.promptSelect("Set up Skills Layer MCP for your AI tools on this machine?",[{value:"yes",label:"Yes, set up MCP",description:"Mint a scoped token and write local MCP configuration"},{value:"no",label:"Not now",description:"You can run skills-layer mcp setup later"}]);if(s=l==="yes",l==="no")return await K(t.paths.mcpPreferencePath,{version:1,choice:"not_now",baseUrl:t.baseUrl,clientId:"codex",savedAt:t.now()}),{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."}}catch{return{}}if(!s)return{};let o=await Ht(e,t);return D(o)?o:{data:o,message:"MCP configured for this machine."}}async function is(e,t,n){let r=e.join(" ").trim()||g(t.search)||"",i=new URLSearchParams;r&&i.set("query",r),B(i,"agent",t.agent),B(i,"capability",t.capability),B(i,"trust",t.trust),B(i,"runtime-risk",t.runtimeRisk),B(i,"security-capability",t.securityCapability);let s=await P(n,`/api/v1/search${te(i)}`);if(t.install!==void 0){let o=g(t.install);if(!o){if(t.json)return y("search --install requires an explicit skill slug in the public CLI package.",!0);let c=Me(s);if(c.length===0)return y("Search results do not include any installable skills. Run search again with a broader query.",!1);if(c.length===1)o=c[0].value;else try{o=await n.promptSelect("Select a search result to install:",c)}catch{return y("No search result was selected for install.",!1)}}let l=Wa(s);return l.includes(o)?await Jt([o],t,n):y(l.length===0?`Search results do not include "${o}". Run search again with a matching query first.`:`Search results do not include "${o}". Run search again with a matching query or choose one of: ${l.join(", ")}.`,t.json)}return f(s,"Search complete.",t.json,n)}async function ss(e,t,n){let r=new URLSearchParams;return B(r,"limit",t.limit),B(r,"search",t.search),B(r,"sort",t.sort),await S(`/api/v1/${e}${te(r)}`,t,n,`${ot(e)} skills loaded.`)}async function os(e,t,n){let r=e.join(" ").trim();if(!r)return y("recommend requires a task.",t.json);let i=new URLSearchParams({task:r});return B(i,"limit",t.limit),await S(`/api/v1/recommend?${i.toString()}`,t,n,"Recommendations loaded.")}async function as(e,t,n){if(e.length<2)return y("compare requires two or more skill slugs.",t.json);let r=new URLSearchParams({slugs:e.join(",")}),i=await P(n,`/api/v1/skills/compare?${r.toString()}`);return t.json?f(i,"Comparison loaded.",!0,n):{exitCode:0,stdout:ga(i,"Comparison loaded.",V(n),t.verbose),stderr:""}}async function ls(e,t,n){let r=w(e[0],"show requires a skill slug.");return await S(`/api/v1/skills/${encodeURIComponent(r)}`,t,n,"Skill loaded.")}async function cs(e,t,n){let r=w(e[0],"trust requires a skill slug."),i=new URLSearchParams;B(i,"format",t.format),B(i,"version",t.version);let s=await P(n,`/api/v1/skills/${encodeURIComponent(r)}/trust${te(i)}`);return g(t.format)?.toLowerCase()==="sarif"&&!t.json?{exitCode:0,stdout:Ws(s,r,n),stderr:""}:f(s,"Trust report loaded.",t.json,n)}async function us(e,t,n){let r=Je(e[0],e[1]);if(r)return{exitCode:0,stdout:r,stderr:""};let i=e[0];if(!i)return{exitCode:0,stdout:He,stderr:""};if(i==="topic"){let s=Je(e[1]);if(s)return{exitCode:0,stdout:s,stderr:""};let o=new URLSearchParams;return e[1]&&o.set("topic",e[1]),await S(`/api/v1/help${te(o)}`,t,n,"Help topic loaded.")}if(i==="standards")return await S("/api/v1/standards",t,n,"Marketplace standards loaded.");if(i==="marketplace-status"){let s=await P(n,"/api/v1/marketplace/status");return t.json?f(s,"Marketplace status loaded.",!0,n):f(ka(s),"Marketplace status loaded.",!1,n)}if(i==="capabilities"){let s=await P(n,"/api/v1/capabilities");return f(va(s),"Edition capabilities loaded.",t.json,n)}if(i==="schema-plan")return y("help schema-plan is not included in the public npm CLI.",t.json);if(i==="optimize-tokens"){let s=w(t.text,"help optimize-tokens requires --text."),o=Pa(t.maxCharacters,t.json);if(D(o))return o;let l=await P(n,"/api/v1/optimize-tokens",{method:"POST",headers:_(n.apiKey),body:JSON.stringify({text:s,...o?{maxCharacters:o}:{}})});return f(l,"Token optimization complete.",t.json,n)}return y(`Unknown help command "${i}".`,t.json)}async function ds(e,t,n){let r=w(e[0]??t.path,"validate requires a file or directory."),s={files:await rt(se(n.cwd,r)),sourceIntakeContext:g(t.sourceIntakeContext),publicationStatus:g(t.publicationStatus),dependencyAuditStatus:g(t.dependencyAuditStatus),category:g(t.category),discloseSource:!!t.discloseSource,allowFindingsFeatured:!!t.allowFindingsFeatured},o=await P(n,"/api/v1/validation/preview",{method:"POST",headers:_(n.apiKey),body:JSON.stringify(A(s))});return t.json?f(o,"Validation complete.",!0,n):{exitCode:0,stdout:ba(o,r,n),stderr:""}}async function gs(e,t,n){let r=w(e[0]??t.path,"preview-trigger requires a file or directory."),i=await rt(se(n.cwd,r)),s=await P(n,"/api/v1/validation/trigger-preview",{method:"POST",headers:_(n.apiKey),body:JSON.stringify({files:i,shouldTriggerPrompts:t.shouldTrigger,shouldNotTriggerPrompts:t.shouldNotTrigger,paraphrasePrompts:t.paraphrase})});return t.json?f(s,"Trigger preview complete.",!0,n):{exitCode:0,stdout:Sa(s,r,n),stderr:""}}async function ps(e,t,n){let r=e[0];if(r==="init")return await ms(e.slice(1),t,n);if(r==="rules")return await S("/api/v1/creator/rules",t,n,"Creator rules loaded.");if(r==="submissions")return await S("/api/v1/me/submissions",t,n,"Submissions loaded.",{authenticated:!0});if(r==="status"){let i=w(e[1],"creator status requires a skill slug.");return await S(`/api/v1/me/submissions/${encodeURIComponent(i)}`,t,n,"Submission status loaded.",{authenticated:!0})}if(r==="charge-status"){let i=w(e[1],"creator charge-status requires a charge id.");return await S(`/api/v1/me/private-skill-charges/${encodeURIComponent(i)}`,t,n,"Charge status loaded.",{authenticated:!0})}if(r==="submit")return await Bn(e.slice(1),t,n,!1);if(r==="submit-version")return await Bn(e.slice(1),t,n,!0);if(r==="check-slug"){let i=w(e[1],"creator check-slug requires a slug.");return await ys(i,t,n)}if(r==="rename"){let i=w(e[1],"creator rename requires the current slug."),s=w(e[2],"creator rename requires the new slug.");return await Ee(`/api/v1/me/submissions/${encodeURIComponent(i)}/slug`,{nextSkillSlug:s},t,n,"Skill renamed.")}if(r==="pricing")return await vs(e,t,n);if(r==="update-listing"){let i=w(e[1],"creator update-listing requires a skill slug.");return await Ps(i,t,n)}if(r==="visibility"){let i=w(e[1],"creator visibility requires a skill slug."),s=await P(n,`/api/v1/me/submissions/${encodeURIComponent(i)}/visibility`,{method:"PATCH",headers:_(n.apiKey),body:JSON.stringify(A({visibility:g(t.visibility)??e[2],dryRun:t.dryRun}))});return lo(s)?j(s,co(s,i),t.json,a(s,"reasonCode")??a(s,"status")):f(s,t.dryRun?"Visibility preview loaded.":"Visibility updated.",t.json,n)}if(r==="security-report"){let i=w(e[1],"creator security-report requires a skill slug."),s=new URLSearchParams;B(s,"format",t.format),B(s,"version",t.version),B(s,"versionId",t.versionId);let o=await P(n,`/api/v1/me/submissions/${encodeURIComponent(i)}/trust${te(s)}`,{headers:T(n.apiKey,n.authBlockedMessage)});return t.json||t.verbose?f(o,"Creator security report loaded.",t.json,n):{exitCode:0,stdout:Na(o,i,n),stderr:""}}if(r==="rescan-security"){let i=w(e[1],"creator rescan-security requires a skill slug."),s=await P(n,`/api/v1/me/submissions/${encodeURIComponent(i)}/trust/rescan`,{method:"POST",headers:_(n.apiKey),body:JSON.stringify(A(F(t,["version","versionId"])))});return t.json?f(s,"Security rescan requested.",!0,n):{exitCode:0,stdout:Oa(s,i,n),stderr:""}}if(r==="provenance"){let i=w(e[1],"creator provenance requires a skill slug.");return await S(`/api/v1/me/submissions/${encodeURIComponent(i)}/provenance`,t,n,"Provenance loaded.",{authenticated:!0})}if(r==="claim"||r==="verify"||r==="dispute")return await bs(r,e,t,n);if(r==="issues"||r==="reviews"||r==="update-issue"||r==="moderate-review")return await _s(r,e,t,n);if(r==="analytics"){let i=w(e[1],"creator analytics requires a skill slug.");return await Ss(i,t,n)}return r==="earnings"?await S("/api/v1/me/earnings",t,n,"Creator earnings loaded.",{authenticated:!0}):r==="payout-profile"?await Cs(t,n):r==="payout-link"?await Rs(t,n):r==="payouts"?await S("/api/v1/me/payouts",t,n,"Creator payouts loaded.",{authenticated:!0}):r==="withdraw"?await N("/api/v1/me/payouts/withdrawals",F(t,["amountCents","reason"]),t,n,"Withdrawal requested."):r==="source"?await As(e.slice(1),t,n):y(`Unknown creator command "${r??""}".`,t.json)}async function ms(e,t,n){let r=g(t.skill)??e[0]??"my-skill",i=se(n.cwd,g(t.dir)??r),s=I(i,"SKILL.md"),o=g(t.type),l=g(t.category),c=await fs(i);if((await ce(s)||c)&&!t.confirmed)return y(`Creator init target already exists at ${i}. Re-run with --confirm only if you want to overwrite ${s}.`,t.json);await Te(i,{recursive:!0}),await et(s,["---",`name: ${r}`,`description: ${g(t.description)??"Describe what this skill helps an agent do."}`,...o?[`type: ${o}`]:[],...l?[`category: ${l}`]:[],"---","","# Overview","","Explain when this skill should be used.","","# Steps","","1. Add clear operating instructions.","2. Add examples and troubleshooting notes.",""].join(`
+`),"utf8");let d=A({status:"created",path:s,skillSlug:r,skillType:o,category:l});return t.json?f(d,`Created ${s}.`,!0,n):{exitCode:0,stdout:Ia(d,i,s,n),stderr:""}}async function ce(e){try{return await sr(e),!0}catch{return!1}}async function fs(e){try{return(await ar(e)).length>0}catch{return await ce(e)}}async function Bn(e,t,n,r){let i=w(e[0]??t.path,`creator ${r?"submit-version":"submit"} requires a path.`),s=await rt(se(n.cwd,i));if(!r&&!t.dryRun){let k=await hs(s,t,n);if(k)return k}let o=A({files:s,version:g(t.version),dryRun:t.dryRun,allowFindingsFeatured:t.allowFindingsFeatured,pricing:g(t.priceCents)?{priceCents:Number(g(t.priceCents))}:void 0,...F(t,["displayName","skillType","category","visibility","source","skill"])}),l=g(t.skill)??e[1],c=r&&l?`/api/v1/me/submissions/${encodeURIComponent(l)}/versions`:"/api/v1/me/submissions",u=await P(n,c,{method:"POST",headers:_(n.apiKey),body:JSON.stringify(o)});if(t.json||u.status!=="checkout_required"||typeof u.checkoutUrl!="string"||typeof u.chargeId!="string")return f(u,r?"Version submitted.":"Submission uploaded.",t.json,n);n.emitInfo("Opening payment setup for skill submission. Complete the payment in your browser, then come back here."),await n.openUrl(u.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${u.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let m=await Zo(u.chargeId,n);return D(m)?m:m.status!=="submitted"?f({...u,chargeStatus:m.status},`Payment is still ${m.status}. You can rerun \`skills-layer creator charge-status ${u.chargeId}\` to continue tracking it.`,t.json,n):f(m,r?"Version submitted.":"Submission uploaded.",t.json,n)}async function hs(e,t,n){let r=g(t.skill)??ks(e);if(!r)return null;let i;try{i=await P(n,`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(r)}`,{headers:T(n.apiKey,n.authBlockedMessage)})}catch(s){if(s instanceof E&&s.status===404)return pr(r,t);throw s}if(i.available===!1||a(i,"reasonCode")==="unavailable"||a(i,"reasonCode")==="reserved"){let s=a(i,"assignedSlug"),o=A({status:"duplicate_candidate",reasonCode:a(i,"reasonCode")??"slug_unavailable",requestedSlug:r,assignedSlug:s,nextAction:"creator.status",nextStep:`Run \`skills-layer creator status ${r}\`, \`skills-layer creator submissions\`, or submit a new version of the existing skill instead of creating a duplicate listing.`});return j(o,`A public skill slug "${r}" already exists or is not available. Run \`skills-layer creator status ${r}\`, check your creator submissions, or submit a new version instead of creating a duplicate listing.`,t.json,a(o,"reasonCode"))}return null}async function ys(e,t,n){try{return await S(`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(e)}`,t,n,"Slug status loaded.",{authenticated:!0})}catch(r){if(r instanceof E&&r.status===404)return pr(e,t);throw r}}function pr(e,t){let n={status:"slug_check_unavailable",reasonCode:"slug_check_route_unavailable",requestedSlug:e,nextAction:"creator.status",nextStep:`Slug availability could not be checked on the selected backend. Run \`skills-layer creator submissions\`, \`skills-layer creator status ${e}\`, or retry after selecting a compatible Skills Layer backend.`};return j(n,`Slug availability could not be checked for ${e} on the selected backend. Run \`skills-layer creator submissions\` or retry after selecting a compatible Skills Layer backend.`,t.json,"slug_check_route_unavailable")}function ks(e){let t=e.find(r=>r.path.split("/").pop()?.toLowerCase()==="skill.md");if(!t)return;let n=/^---\s*\n(?<body>[\s\S]*?)\n---/u.exec(t.content??"")?.groups?.body?.split(/\r?\n/u).map(r=>r.match(/^name\s*:\s*(?<name>.+?)\s*$/u)?.groups?.name?.trim().replace(/^["']|["']$/gu,"")).find(r=>!!r);return ws(n??G(ie(t.path)))}function ws(e){return e?.toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||void 0}async function vs(e,t,n){let r=w(e[1],"creator pricing requires a skill slug."),i=new URLSearchParams;if(B(i,"version",t.version),!t.priceCents)return await S(`/api/v1/me/submissions/${encodeURIComponent(r)}/pricing${te(i)}`,t,n,"Pricing loaded.",{authenticated:!0});let s=Number(g(t.priceCents)),o=await P(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/pricing${te(i)}`,{headers:T(n.apiKey,n.authBlockedMessage)}),l=oe(o,"priceCents")??0;if(s>l){let c=A({status:"pending_approval",reasonCode:l===0?"paid_activation_requires_approval":"price_increase_requires_approval",skillSlug:r,version:a(o,"version"),currentPriceCents:l,requestedPriceCents:s,currency:a(o,"currency")??"gbp",nextStep:"Pricing changes that increase buyer-facing cost require approval. Keep the current price for now, then retry after approval is available."});return f(c,"Pricing change requires approval before it can affect buyers.",t.json,n)}return await Ee(`/api/v1/me/submissions/${encodeURIComponent(r)}/pricing`,{priceCents:s,version:g(t.version)},t,n,"Pricing updated.")}async function Ps(e,t,n){try{return await Ee(`/api/v1/me/submissions/${encodeURIComponent(e)}`,F(t,["displayName","summary","description","category","skillType","license","listingStatus"]),t,n,"Listing updated.")}catch(r){if(r instanceof E&&r.status===404){let i={status:"listing_not_found_or_not_editable",reasonCode:"creator_listing_not_found_or_not_owned",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see editable listings, or \`skills-layer show ${e}\` to inspect the public catalog entry.`};return j(i,`No editable creator listing was found for ${e}. Run \`skills-layer creator submissions\` to see listings you can update.`,t.json,"creator_listing_not_found_or_not_owned")}throw r}}async function bs(e,t,n,r){let i=w(t[1],`creator ${e} requires a skill slug.`);try{if(e==="claim")return await N(`/api/v1/me/skills/${encodeURIComponent(i)}/ownership/claim`,F(n,["requestedRole","message"]),n,r,"Ownership claim submitted.");if(e==="verify"){let s=w(n.claimId,"creator verify requires --claim-id.");return await N(`/api/v1/me/skills/${encodeURIComponent(i)}/ownership/verify`,{claimId:s},n,r,"Ownership claim verified.")}return await N(`/api/v1/me/skills/${encodeURIComponent(i)}/ownership/dispute`,F(n,["message"]),n,r,"Ownership dispute submitted.")}catch(s){if(s instanceof E&&s.status===404){let o={status:"ownership_action_unavailable",reasonCode:e==="claim"?"skill_not_found_or_not_claimable":"ownership_claim_not_found",skillSlug:i,requestedRole:g(n.requestedRole),nextAction:e==="claim"?"search":"creator.claim",nextStep:e==="claim"?`Run \`skills-layer search ${i}\`, \`skills-layer show ${i}\`, or submit/source-install the skill before claiming it.`:`Run \`skills-layer creator claim ${i}\` to start a new claim if the skill is claimable.`};return j(o,e==="claim"?`No claimable skill was found for ${i}. Search or show the skill first, then claim it only when it exists and is claimable.`:`No matching ownership claim was found for ${i}. Start a new claim if the skill is claimable.`,n.json,a(o,"reasonCode")??"ownership_action_unavailable")}throw s}}async function Ss(e,t,n){try{return await S(`/api/v1/me/submissions/${encodeURIComponent(e)}/analytics`,t,n,"Analytics loaded.",{authenticated:!0})}catch(r){if(r instanceof E&&r.status===404){let i={status:"no_creator_submission",reasonCode:"creator_submission_not_found",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see skills you own, \`skills-layer show ${e}\` to inspect the catalog listing, or \`skills-layer creator claim ${e}\` if it is a claimable public-source skill.`};return j(i,`No creator-owned analytics submission was found for ${e}. Run \`skills-layer creator submissions\`, \`skills-layer show ${e}\`, or \`skills-layer creator claim ${e}\` if you should manage it.`,t.json,"creator_submission_not_found")}throw r}}async function Cs(e,t){let n=await P(t,"/api/v1/me/payout-profile",{headers:T(t.apiKey,t.authBlockedMessage)});return f(n,"Creator payout profile loaded.",e.json,t)}async function Rs(e,t){let n=xs(g(e.mode));if(e.mode&&n===null)return y("creator payout-link --mode must be account_onboarding|account_update|onboarding|update.",e.json);let r;try{r=await P(t,"/api/v1/me/payout-profile/link",{method:"POST",headers:_(t.apiKey),body:JSON.stringify(n?{mode:n}:{})})}catch(s){if(s instanceof E&&$s(s))return j({status:"payout_setup_already_submitted",reasonCode:"payout_update_link_unavailable",nextAction:"creator.payout-profile",nextStep:"Run `skills-layer creator payout-profile` to confirm readiness, then use `skills-layer creator earnings` or `skills-layer creator withdraw --amount-cents <amount>`."},"Payout setup is already submitted for this account. Run `skills-layer creator payout-profile` to confirm readiness before requesting a withdrawal.",e.json,"payout_update_link_unavailable");throw s}let i=Xo(r);return i&&!e.json&&e.showUrl!==!0&&(t.emitInfo("Opening payout setup in your browser. Finish the flow there, then come back here."),await t.openUrl(i)||t.emitInfo(`Open this payout setup URL manually to continue: ${i}`)),f(r,"Payout setup link created.",e.json,t)}function xs(e){if(!e)return null;let t=e.trim().toLowerCase();return t==="account_onboarding"||t==="onboarding"?"account_onboarding":t==="account_update"||t==="update"?"account_update":null}function $s(e){let t=`${e.message} ${a(e.details??{},"error")??""}`.toLowerCase();return t.includes("account_update")&&t.includes("account_onboarding")&&t.includes("account link")}async function _s(e,t,n,r){let i=w(t[1],`creator ${e} requires a skill slug.`);if(e==="issues")return await S(`/api/v1/me/library/${encodeURIComponent(i)}/issues`,n,r,"Issues loaded.",{authenticated:!0});if(e==="reviews")return await S(`/api/v1/me/library/${encodeURIComponent(i)}/reviews`,n,r,"Reviews loaded.",{authenticated:!0});if(e==="update-issue"){let o=w(n.issueId,"creator update-issue requires --issue-id.");return await Ee(`/api/v1/me/library/${encodeURIComponent(i)}/issues/${encodeURIComponent(o)}`,F(n,["status","fixedVersion","note"]),n,r,"Issue updated.")}let s=w(n.reviewId,"creator moderate-review requires --review-id.");return await Ee(`/api/v1/me/library/${encodeURIComponent(i)}/reviews/${encodeURIComponent(s)}`,F(n,["status","reason"]),n,r,"Review updated.")}async function As(e,t,n){let r=e[0],i=w(e[1],`creator source ${r??""} requires a source connection id.`),s=g(t.skill)??e[2];if(r==="prepare")return await N(`/api/v1/me/source-connections/${encodeURIComponent(i)}/prepare`,A({...F(t,["skill","source","version","displayName","skillType","category","priceCents","visibility"]),source:g(t.source)??e[2]}),t,n,"Source release prepared.");if(r==="publish-request"){let o=t.approvalRequestId.length>0?t.approvalRequestId:g(t.approvalRequestId)?[String(t.approvalRequestId)]:[];return await N(`/api/v1/me/source-connections/${encodeURIComponent(i)}/publish-request`,A({skillSlug:s,approvalRequestIds:o,version:g(t.version),...F(t,["visibility","priceCents","license","discloseSource"])}),t,n,"Source publish requested.")}if(r==="release-status"){let o=new URLSearchParams;return s&&o.set("skill",s),await S(`/api/v1/me/source-connections/${encodeURIComponent(i)}/release-status${te(o)}`,t,n,"Source release status loaded.",{authenticated:!0})}return y(`Unknown creator source command "${r??""}".`,t.json)}async function Jt(e,t,n){let r=g(t.source);if(r){let c=g(t.skill),u=await Et(r,n.cwd);if(u)return await Mn(r,u,c,t,n);let d=t.list||t.dryRun||!c&&!t.json&&!t.all,m=await ze(n,r,{source:r,skillSlug:c,listOnly:d},t);if(m.kind==="failure")return m.result;let k=m.inspection;if(t.list)return f(k,"Source skills loaded.",t.json,n);let p=_t(r,k,t);if(p)return p;let h=await xt({source:r,inspection:k,requestedSkillSlug:c,mode:"install",flags:t,backend:n});if(h.kind==="failure")return h.result;if(t.dryRun)return f($t(r,k,h.skillSlug,t),"Source install preview ready.",t.json,n);let v=Nn(t,n),b;try{b=await P(n,v,{method:"POST",headers:On(t,n),body:JSON.stringify(qn({source:r},h.skillSlug,t))})}catch(L){if(L instanceof E)return Kn(r,L,t);throw L}let x=await kt(n,b);return await Qe(n,x,h.skillSlug??a(x,"skillSlug")??r),Ye(x,Fn(t),t.json,n)}let i=w(e[0]??t.install,"install requires a skill slug or --source.");if(Za(i)){let c=await Et(i,n.cwd);if(c)return await Mn(i,c,g(t.skill),t,n);let u=g(t.skill),d;if(t.list){let h=await ze(n,i,{source:i,listOnly:!0},t);return h.kind==="failure"?h.result:f(h.inspection,"Source skills loaded.",t.json,n)}if(!u&&!t.json&&!t.all){let h=await ze(n,i,{source:i,listOnly:!0},t);if(h.kind==="failure")return h.result;let v=h.inspection;d=v;let b=_t(i,v,t);if(b)return b;let x=await xt({source:i,inspection:v,requestedSkillSlug:u,mode:"install",flags:t,backend:n});if(x.kind==="failure")return x.result;u=x.skillSlug}if(t.dryRun){if(!d){let h=await ze(n,i,{source:i,listOnly:!0},t);if(h.kind==="failure")return h.result;d=h.inspection}return f($t(i,d,u,t),"Source install preview ready.",t.json,n)}let m=Nn(t,n),k;try{k=await P(n,m,{method:"POST",headers:On(t,n),body:JSON.stringify(qn({source:i},u,t))})}catch(h){if(h instanceof E)return Kn(i,h,t);throw h}let p=await kt(n,k);return await Qe(n,p,u??a(p,"skillSlug")??G(i)),Ye(p,Fn(t),t.json,n)}if(g(t.scope)==="workspace"){let c=w(t.workspace,"workspace installs require --workspace <workspace-id>."),u=await P(n,`/api/v1/workspaces/${encodeURIComponent(c)}/skills`,{method:"POST",headers:_(n.apiKey),body:JSON.stringify(A({skillSlug:i,version:g(t.version),dryRun:t.dryRun}))});return f(u,t.dryRun?"Workspace install preview ready.":"Workspace deployment requested.",t.json,n)}let s=await P(n,"/api/v1/install",{method:"POST",headers:_(n.apiKey),body:JSON.stringify(A({skillSlug:i,version:g(t.version),scope:g(t.scope),agent:g(t.agent),dryRun:t.dryRun}))});if(t.dryRun)return zs(s,t,n);let o=await kt(n,s),l=await Is(n,o,i,t);return D(l)?l:(await Qe(n,l,i),Ye(l,"Skill installed.",t.json,n))}async function Is(e,t,n,r){if(Array.isArray(t.materializedWrites)&&t.materializedWrites.length>0)return t;let i=js(e,t,n,r);if(i.status==="skip")return t;if(i.status==="failure")return j({status:"materialization_target_invalid",reasonCode:"materialization_target_invalid",skillSlug:i.skillSlug,nextStep:i.nextStep},i.message,r.json,"materialization_target_invalid");let s=await Es(e,t,i.skillSlug,i.version),o=await mr({backend:e,exportResult:s,flags:r,skillSlug:i.skillSlug});if(D(o))return o;let l=await Bs({backend:e,skillSlug:i.skillSlug,version:i.version??a(s,"version")??"latest",scope:i.scope,agent:i.agent,skillsPath:i.skillsPath,bytes:o.bytes,files:o.files,archiveSha256:o.archiveSha256});return{...t,...Us(s),archiveSha256:o.archiveSha256,archiveHashFormat:o.archiveHashFormat,scope:i.scope,agent:i.agent.id,targetAgent:i.agent.id,materializationPlan:{scope:i.scope,agent:i.agent.id},...l}}function js(e,t,n,r){let i=C(t,"materializationPlan")??C(t,"installPlan"),s=g(r.scope)??a(t,"scope")??(i?a(i,"scope"):void 0);if(s!=="project"&&s!=="global")return{status:"skip"};let o=a(t,"skillSlug")??a(t,"slug")??n,l=g(r.agent)??a(t,"agent")??a(t,"targetAgent")??(i?a(i,"agent")??a(i,"targetAgent"):void 0)??Q(e.config?.lastSelectedAgent)??"codex",c=ae(e.env,e.platform,e.cwd).find(d=>d.id===l);if(!c)return{status:"failure",skillSlug:o,message:`Unsupported agent "${l}". Run \`skills-layer agents list\` to choose a supported local install target.`,nextStep:"Run `skills-layer agents list` and retry with a supported --agent value."};let u=s==="global"?c.targets.globalSkillsPath:c.targets.projectSkillsPath;return u?{status:"ok",scope:s,agent:c,skillsPath:u,skillSlug:o,version:a(t,"version")??a(t,"currentVersion")}:{status:"failure",skillSlug:o,message:`${c.displayName} does not expose a ${s} skills path on this machine.`,nextStep:"Retry with --scope project, or choose another agent from `skills-layer agents list`."}}async function Es(e,t,n,r){if(typeof t.downloadUrl=="string"&&typeof t.archiveSha256=="string")return t;let i=new URLSearchParams;return r&&i.set("version",r),await P(e,`/api/v1/me/library/${encodeURIComponent(n)}/export${te(i)}`,{headers:T(e.apiKey,e.authBlockedMessage)})}function Us(e){return A({version:a(e,"version"),storageKey:a(e,"storageKey"),expiresAt:a(e,"expiresAt")})}async function mr(e){let t=a(e.exportResult,"downloadUrl");if(!t)return j({status:"export_download_unavailable",reasonCode:"export_download_unavailable",skillSlug:e.skillSlug,nextStep:"Retry after the backend returns a signed bundle download URL."},`Export for ${e.skillSlug} did not include a signed download URL.`,e.flags.json,"export_download_unavailable");let n=await e.backend.fetchFn(Ls(e.backend.baseUrl,t));if(!n.ok)throw new E(n.status,`Unable to download exported bundle (${n.status}).`);let r=new Uint8Array(await n.arrayBuffer()),i=Ts(r),s=a(e.exportResult,"archiveSha256")??n.headers.get("x-skills-layer-archive-sha256")?.trim()??void 0;return s&&i.archiveSha256!==s?j({status:"download_integrity_failed",reasonCode:"download_hash_mismatch",skillSlug:e.skillSlug,version:a(e.exportResult,"version"),expectedArchiveSha256:s,observedArchiveSha256:i.archiveSha256,archiveHashFormat:i.format,nextStep:"Retry after the catalog artifact is refreshed, or contact Skills Layer support if this repeats."},`Downloaded ${e.skillSlug} did not match the catalog artifact hash.`,e.flags.json,"download_hash_mismatch"):i.files.length===0?j({status:"download_integrity_failed",reasonCode:"download_bundle_empty",skillSlug:e.skillSlug,archiveHashFormat:i.format,nextStep:"Retry after the catalog artifact is refreshed."},`Downloaded ${e.skillSlug} did not contain any skill files.`,e.flags.json,"download_bundle_empty"):{status:"ok",bytes:r,files:i.files,archiveSha256:i.archiveSha256,archiveHashFormat:i.format}}function Ls(e,t){return/^https?:\/\//iu.test(t)?t:`${X(e)}${t.startsWith("/")?"":"/"}${t}`}function Ts(e){let t=bn(e);return t?{archiveSha256:Sn(t),format:"bundle_archive",files:t}:{archiveSha256:Nt("sha256").update(e).digest("hex"),format:"raw",files:[]}}async function Bs(e){let t=e.backend.platform==="win32"?ve:Ft,n=t.join(e.backend.paths.bundlesDir,e.skillSlug,e.version,"bundle.zip"),r=t.join(e.skillsPath,e.skillSlug),i=t.join(r,e.version,"bundle.zip"),s=[];await Bt(n,e.bytes),await Ot(r,{recursive:!0,force:!0}),await Bt(i,e.bytes),s.push({path:Ze(e.backend.cwd,i),bytes:e.bytes.byteLength});for(let o of e.files){let l=t.join(r,...Ms(o.path)),c=o.content??"";if(await re(l,c),s.push({path:Ze(e.backend.cwd,l),bytes:new TextEncoder().encode(c).length}),G(o.path).toLowerCase()==="skill.md"){let u=await Zt({backend:e.backend,skillSlug:e.skillSlug,version:e.version,skillDocumentPath:l,skillDocumentContent:c});s.push(u)}}return{bundlePath:n,materializedPath:i,materializedSkillRoot:r,archiveSha256:e.archiveSha256,materializedWrites:s}}function Ms(e){let n=e.replaceAll("\\","/").replace(/^\/+/u,"").trim().split("/").filter(r=>r.length>0);if(n.length===0||n.some(r=>r==="."||r===".."))throw new Error(`Unsafe bundle path "${e}".`);return n}async function Mn(e,t,n,r,i){let s=g(r.visibility)??"private";if(s!=="private")return j({status:"local_install_visibility_not_allowed",reasonCode:"local_install_visibility_not_allowed",source:e,requestedVisibility:s,nextStep:`Use \`skills-layer creator submit ${e} --visibility ${s} --dry-run\` when you want to submit a local skill with non-private visibility.`},`Local path install creates a private Cloud skill by default. Use creator submit when you want ${s} visibility.`,r.json,"local_install_visibility_not_allowed");let o=Ns(e,t,n);if(r.list)return f(o,"Local source skills loaded.",r.json,i);let l=_t(e,o,r);if(l)return l;let c=await xt({source:e,inspection:o,requestedSkillSlug:n,mode:"install",flags:r,backend:i});if(c.kind==="failure")return c.result;let u=c.skillSlug??Me(o)[0]?.value??hr(e);if(r.dryRun)return f({...$t(e,o,u,r),installKind:"local_private",publicationStatus:"none",catalogRecord:"not_created",nextStep:`Re-run without --dry-run to install ${u} locally. Use \`skills-layer creator submit ${e} --visibility private --dry-run\` when you want a private creator submission.`},"Local private install preview ready.",r.json,i);let d=await P(i,"/api/v1/me/submissions",{method:"POST",headers:{"content-type":"application/json",...T(i.apiKey,i.authBlockedMessage)},body:JSON.stringify(A({files:t.files,version:g(r.version),visibility:"private",category:g(r.category),displayName:g(r.displayName),skillType:g(r.skillType),sourceMetadata:t.sourceMetadata}))}),m=await Fs({backend:i,source:e,upload:t,skillSlug:a(d,"skillSlug")??u,flags:r,submitted:d});return await Qe(i,m,u),Ye(m,"Private Cloud skill installed.",r.json,i)}function Ns(e,t,n){let r=Os(t.files),i=n?r.find(s=>s.skillSlug===n)??null:r.length===1?r[0]??null:null;return{status:"ok",source:t.sourceMetadata,selectedSkill:i,results:r,issues:[],sourceInstallSupported:!0,sourceInstallMode:"local_private",publicationStatus:"none",originalSource:e}}function Os(e){return e.filter(t=>t.path.split("/").at(-1)?.toLowerCase()==="skill.md").map(t=>{let n=ie(t.path).replaceAll("\\","/"),r=n==="."?".":n,i=fr(t.content??"")??hr(r==="."?t.path:r);return{skillSlug:i,name:i,relativeSkillRoot:r,relativeSkillFile:t.path,sourceKind:"local",discoveryRoute:"local_bundle",validation:{valid:!0,issueCount:0}}})}function fr(e){return/^---\s*[\s\S]*?\nname:\s*["']?([^"'\n]+)["']?\s*(?:\n|$)/u.exec(e)?.[1]?.trim()}function hr(e){return(e.replaceAll("\\","/").replace(/\/+$/u,"").split("/").filter(Boolean).at(-1)??"local-skill").toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||"local-skill"}async function Fs(e){let t=qs(e.backend,e.flags);if(t.status==="failure")throw new Error(t.message);let n=e.upload.files.map(i=>({path:I(t.skillsPath,e.skillSlug,Lr(i.path)),content:i.content??""})),r=[];for(let i of n)if(await re(i.path,i.content),r.push({path:Ze(e.backend.cwd,i.path),bytes:new TextEncoder().encode(i.content).length}),G(i.path).toLowerCase()==="skill.md"){let s=await Zt({backend:e.backend,skillSlug:e.skillSlug,version:a(e.submitted,"version")??g(e.flags.version)??"private",skillDocumentPath:i.path,skillDocumentContent:i.content});r.push(s)}return{...e.submitted,status:"installed",cloudStatus:a(e.submitted,"status")??"submitted",installKind:"cloud_private",source:e.source,sourceKind:"local",skillSlug:e.skillSlug,version:a(e.submitted,"version")??g(e.flags.version)??"private",scope:t.scope,agent:t.agent,visibility:"private",publicationStatus:"private",catalogRecord:"private",privacy:{publication:"private",catalogRecord:"private",message:"This local install was saved as a private Cloud skill and did not create a public catalog record."},materializationPlan:{scope:t.scope,agent:t.agent},materializedWrites:r}}function qs(e,t){let n=g(t.scope)??"project";if(!["local","project","global"].includes(n))return{status:"failure",message:"Local private installs support --scope local, project, or global. Use `skills-layer creator submit <path> --visibility private` for private creator workflows."};let r=g(t.agent)??Q(e.config?.lastSelectedAgent)??"codex",i=ae(e.env,e.platform,e.cwd).find(o=>o.id===r);if(!i)return{status:"failure",message:`Unsupported agent "${r}". Run \`skills-layer agents list\` to choose a supported local install target.`};let s=n==="global"?i.targets.globalSkillsPath:i.targets.projectSkillsPath;return s?{status:"ok",scope:n,agent:i.id,skillsPath:s}:{status:"failure",message:`${i.displayName} does not expose a ${n} skills path on this machine.`}}function Ze(e,t){let n=Ie(e,t);return n&&!n.startsWith("..")&&!ve.isAbsolute(n)?n.split("\\").join("/"):t}function zt(e){return g(e.visibility)==="public"?"public":"private"}function Nn(e,t){return zt(e)==="public"&&!t.apiKey?"/api/v1/source-imports":"/api/v1/me/source-installs"}function On(e,t){return{"content-type":"application/json",...zt(e)==="private"?T(t.apiKey,t.authBlockedMessage):Oe(t.apiKey)}}function Fn(e){return zt(e)==="public"?"Public source install planned.":"Private source skill installed."}async function xt(e){if(e.requestedSkillSlug||e.flags.json||e.flags.all)return{kind:"selected",skillSlug:e.requestedSkillSlug};let t=Me(e.inspection);if(t.length<=1)return{kind:"selected",skillSlug:t[0]?.value};try{return{kind:"selected",skillSlug:await e.backend.promptSelect(`${e.source} exposes multiple skills. Select one to ${e.mode}:`,t)}}catch{return{kind:"failure",result:y(`Source "${e.source}" exposes multiple skills. Re-run with --list or --skill <skill-slug>. Available skills: ${t.map(n=>n.value).join(", ")}.`,e.flags.json)}}}function Me(e){let t=[e.results,e.skills,e.discoveredSkills,C(e,"source")?.results,C(e,"inspection")?.results],n=new Set,r=[];for(let i of t)if(Array.isArray(i))for(let s of i){let o=Ks(s);!o||n.has(o.value)||(n.add(o.value),r.push(o))}return r}function Ks(e){if(!R(e))return;let t=a(e,"skillSlug")??a(e,"slug")??a(e,"name");if(!t)return;let n=a(e,"displayName")??a(e,"title")??a(e,"name"),r=n&&n!==t?`${t} - ${n}`:t,i=a(e,"shortDescription")??a(e,"summary")??a(e,"description")??a(e,"relativeSkillRoot")??a(e,"path")??a(e,"discoveryRoute")??a(e,"sourceKind");return i?{value:t,label:r,description:i}:{value:t,label:r}}function qn(e,t,n){return A({...e,skillSlug:t,scope:g(n.scope),agent:g(n.agent),workspace:g(n.workspace),version:g(n.version),visibility:g(n.visibility)??"private",category:g(n.category),displayName:g(n.displayName),skillType:g(n.skillType),all:n.all,quarantine:n.quarantine,acceptCapability:n.acceptCapability})}function $t(e,t,n,r){return A({status:"dry_run",source:e,selectedSkillSlug:n,all:r.all,scope:g(r.scope)??"local",agent:g(r.agent),workspace:g(r.workspace),quarantine:r.quarantine,acceptCapability:r.acceptCapability,candidates:Me(t).map(i=>({skillSlug:i.value,name:i.label,description:i.description})),nextStep:r.all?`Re-run without --dry-run to install every discovered skill from ${e}.`:`Re-run without --dry-run${n?"":" and add --skill <skill-slug> if needed"} to install from ${e}.`})}async function ze(e,t,n,r){try{return{kind:"ok",inspection:await P(e,"/api/v1/source-inspect",{method:"POST",headers:_(e.apiKey),body:JSON.stringify(A(n))})}}catch(i){if(i instanceof E)return{kind:"failure",result:Ds(t,i,r)};throw i}}function _t(e,t,n){if(Me(t).length>0)return null;let i=Gs(t);return j({status:"unsupported_source_layout",source:e,reasonCode:"source_no_discoverable_skills",issues:i,nextStep:"Run with --list to inspect the source, use a subfolder containing SKILL.md, or install from a Skills Layer-compatible source layout."},Js(e,i),n.json)}function Gs(e){return(Array.isArray(e.issues)?e.issues:[]).filter(R).map(n=>({...a(n,"code")?{code:a(n,"code")}:{},...a(n,"message")?{message:a(n,"message")}:{},...a(n,"path")?{path:a(n,"path")}:{}}))}function Ds(e,t,n){let r=t.details??{},i=a(r,"error")??t.message;if(yr(t.status,i))return kr(e,t,n,"inspect");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(i)))return it(t,n.json);let o={status:"unsupported_source_layout",source:e,reasonCode:"source_not_inspectable",backendStatus:t.status,backendMessage:i,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return j(o,`Source ${e} could not be inspected as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function Kn(e,t,n){let r=t.details??{},i=a(r,"error")??t.message;if(yr(t.status,i))return kr(e,t,n,"install");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(i)))return it(t,n.json);let o={status:"unsupported_source_layout",source:e,reasonCode:"source_not_installable",backendStatus:t.status,backendMessage:i,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return j(o,`Source ${e} could not be installed as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function yr(e,t){return e===401||e===403||/private source|provider authorization|unauthorized|forbidden|access denied/iu.test(t)}function kr(e,t,n,r){let i=t.details??{},s=a(i,"error")??t.message,l=`skills-layer source connection start --provider ${Hs(e)} --source ${e} --visibility private --provenance-intent private_source_import`,c={status:"private_source_access_required",source:e,reasonCode:"private_source_access_required",backendStatus:t.status,backendMessage:s,nextStep:l};return j(c,`Cloud could not ${r} ${e} directly. If this is a private source, start a private source connection first:
+${l}`,n.json,"private_source_access_required")}function Hs(e){return/gitlab\./iu.test(e)?"gitlab":/github\./iu.test(e)||/^gh:/iu.test(e)?"github":"generic_git"}function Js(e,t){let n=[`No Skills Layer-compatible skills were found in ${e}.`];if(t.length>0){n.push("Detected issues:");for(let r of t.slice(0,5)){let i=r.code??"source-inspection";n.push(`- ${i}: ${r.message??"No details returned."}${r.path?` (${r.path})`:""}`)}}return n.push("Try --list, a subfolder containing SKILL.md, or a Skills Layer-compatible source layout."),n.join(`
+`)}function zs(e,t,n){if(Vs(e)){let i=a(e,"reasonCode")??a(e,"reason")??"install_not_ready",s=a(e,"why")??a(e,"summary")??"The requested skill is not ready to install from this backend.";return j(e,`Install preview is not ready: ${s}`,t.json,i)}let r=Array.isArray(e.warnings)&&e.warnings.length>0;return f(e,r?"Install preview ready with warnings.":"Install preview ready.",t.json,n)}function Vs(e){let t=a(e,"status")?.toLowerCase(),n=a(e,"reasonCode")?.toLowerCase();return t==="not_found"||t==="missing"||t==="blocked"||t==="not_ready"||n==="skill_not_found"||n==="not_found"}function Ye(e,t,n,r){return n?f(e,t,!0,r):{exitCode:0,stdout:Ys(e,t,r),stderr:""}}function Ws(e,t,n){let r=V(n),i=Array.isArray(e.runs)?e.runs.filter(R):[],s=i.flatMap(c=>Array.isArray(c.results)?c.results.filter(R):[]),o=i.flatMap(c=>{let u=C(c,"tool"),d=u?C(u,"driver"):void 0;return d&&Array.isArray(d.rules)?d.rules.filter(R):[]}),l=[`${r.ok("OK")} Trust report loaded.`,"",r.section("SARIF")];if(l.push(`  ${r.label("Skill")}: ${t}`),l.push(`  ${r.label("Runs")}: ${i.length}`),l.push(`  ${r.label("Rules")}: ${o.length}`),l.push(`  ${r.label("Results")}: ${s.length}`),s.length===0)l.push(`  ${r.muted("No SARIF findings found.")}`);else{l.push("",r.section("Findings"));for(let[c,u]of s.slice(0,O).entries()){let d=a(u,"ruleId")??"unknown-rule",m=C(u,"message");l.push(`${c+1}. ${d}${m?` - ${a(m,"text")??""}`:""}`)}}return l.push("",r.section("Next")),l.push(`  ${r.arrow} skills-layer trust ${t} --format sarif --json`),l.join(`
+`)}function Ys(e,t,n){let r=V(n),i=[`${r.ok("OK")} ${t}`],s=a(e,"skillSlug")??a(e,"slug"),o=a(e,"version")??a(e,"currentVersion");(s||o)&&(i.push("",r.section("Skill")),s&&i.push(`  ${r.label("Slug")}: ${s}`),o&&i.push(`  ${r.label("Version")}: ${o}`));let l=a(e,"visibility")??a(e,"versionVisibility"),c=a(e,"publicationStatus"),u=a(e,"catalogRecord");(l||c||u)&&(i.push("",r.section("Privacy")),l&&i.push(`  ${r.label("Visibility")}: ${l}`),c&&i.push(`  ${r.label("Publication")}: ${c}`),u&&i.push(`  ${r.label("Catalog record")}: ${u}`));let d=C(e,"materializationPlan")??C(e,"installPlan"),m=a(e,"scope")??(d?a(d,"scope"):void 0),k=a(e,"agent")??a(e,"targetAgent")??(d?a(d,"agent")??a(d,"targetAgent"):void 0),p=Array.isArray(e.materializedWrites)?e.materializedWrites.filter(R):[];if(m||k||p.length>0)if(i.push("",r.section("Local Materialization")),m&&i.push(`  ${r.label("Scope")}: ${m}`),k&&i.push(`  ${r.label("Agent")}: ${k}`),p.length===0)i.push(`  ${r.muted("No local files were written by this command.")}`);else for(let b of p.slice(0,O)){let x=a(b,"path");x&&i.push(`  ${r.arrow} ${x}`)}let h=Fr(e,r).filter(b=>!b.includes("materialized writes:"));h.length>0&&i.push("",...h);let v=Dr(e);return v.length>0&&i.push("",r.section("Next"),...v.map(b=>`  ${r.arrow} ${b}`)),i.join(`
+`)}async function Qs(e,t){let n=await pe(t),r=Object.values(n.installs);return f({status:"ok",results:r},`Found ${r.length} local install records.`,e.json,t)}async function Zs(e,t,n){let r=w(e[0],"remove requires a skill slug."),i=await pe(n),s=i.installs[r];if(!s)return j({status:"not_installed",reasonCode:"local_install_not_found",skillSlug:r},`${r} is not installed locally. Run \`skills-layer installed\` or \`skills-layer sync\` to inspect local records.`,t.json,"local_install_not_found");delete i.installs[r],await Tr(n,i);let o={status:"removed",skillSlug:r,removedRecord:s};return t.json?f(o,`Removed ${r}.`,!0,n):{exitCode:0,stdout:oo(r,n),stderr:""}}async function Xs(e,t,n){let r=w(e[0],"update requires a skill slug."),i=new URLSearchParams;B(i,"pin",t.pin),t.dryRun&&i.set("dryRun","true");let o=(await pe(n)).installs[r],l;try{l=await P(n,`/api/v1/skills/${encodeURIComponent(r)}${te(i)}`,{headers:T(n.apiKey,n.authBlockedMessage)})}catch(u){if(u instanceof E&&u.status===404&&o){let d={status:"backend_missing",reasonCode:"local_install_backend_missing",skillSlug:r,localInstall:o,installedVersion:a(o,"version")??a(o,"currentVersion"),selectedBackend:n.baseUrl,nextStep:`This skill is installed locally, but no catalog update source was found on ${n.baseUrl}. Reinstall from its source, run \`skills-layer search ${r}\`, or run \`skills-layer remove ${r}\` if you no longer need it.`};return j(d,`${r} is installed locally, but no catalog update source was found on this backend. Reinstall from its source, search for a replacement, or remove the local install.`,t.json,"local_install_backend_missing")}if(u instanceof E)return it(u,t.json);throw u}let c=to(r,l,o,n);return t.json?f(c,"Update check complete.",!0,n):{exitCode:0,stdout:io(c,n),stderr:""}}async function eo(e,t){let n=await pe(t),i={status:"synced",results:await Promise.all(Object.values(n.installs).map(async s=>no(s,t)))};return e.json?f(i,"Local install records synced.",!0,t):{exitCode:0,stdout:so(i,t),stderr:""}}function to(e,t,n,r){let i=n?a(n,"version")??a(n,"currentVersion"):void 0,s=a(t,"currentVersion")??a(t,"version"),o=n?i&&s&&i!==s?"update_available":"up_to_date":"not_installed";return A({...t,skillSlug:a(t,"skillSlug")??a(t,"slug")??e,updateStatus:o,installedVersion:i,latestAvailableVersion:s,selectedBackend:r.baseUrl,localInstall:n,nextStep:o==="not_installed"?`Run \`skills-layer install ${e}\` to install this skill locally.`:o==="update_available"?`Run \`skills-layer install ${e}\` to apply the latest available version.`:`No update is needed for ${e}.`})}async function no(e,t){let n=a(e,"skillSlug")??a(e,"slug");if(!n)return{...e,syncStatus:"local_only",backendStatus:"unchecked"};try{let r=await P(t,`/api/v1/skills/${encodeURIComponent(n)}`,{headers:Oe(t.apiKey)}),s=(a(r,"claimedOrigin")??a(r,"sourceKind")??a(e,"sourceKind"))==="public_source"||a(e,"sourceKind")==="external";return{...e,syncStatus:s?"source_backed":"catalog_backed",backendStatus:"found",latestAvailableVersion:a(r,"currentVersion")??a(r,"version"),catalog:ro(r)}}catch(r){return r instanceof E&&r.status===404?{...e,syncStatus:"backend_missing",backendStatus:"not_found",selectedBackend:t.baseUrl}:{...e,syncStatus:"unchecked",backendStatus:"error",backendError:ue(r)}}}function ro(e){return A({slug:a(e,"slug")??a(e,"skillSlug"),currentVersion:a(e,"currentVersion")??a(e,"version"),claimedOrigin:a(e,"claimedOrigin"),trust:a(e,"trust")??a(e,"publicationStatus")})}function io(e,t){let n=V(t),r=a(e,"skillSlug")??a(e,"slug")??"skill",i=a(e,"updateStatus")??"checked",s=[`${n.ok("OK")} Update check complete.`,"",n.section("Update")];s.push(`  ${n.label("Skill")}: ${r}`),s.push(`  ${n.label("Status")}: ${i.replaceAll("_"," ")}`);let o=a(e,"installedVersion"),l=a(e,"latestAvailableVersion");o&&s.push(`  ${n.label("Installed version")}: ${o}`),l&&s.push(`  ${n.label("Latest available version")}: ${l}`);let c=C(e,"localInstall"),u=c?a(c,"materializedPath")??a(c,"path"):void 0,d=c?a(c,"scope"):void 0,m=c?a(c,"targetAgent")??a(c,"agent"):void 0;c&&(s.push("",n.section("Local Install")),d&&s.push(`  ${n.label("Scope")}: ${d}`),m&&s.push(`  ${n.label("Agent")}: ${m}`),u&&s.push(`  ${n.label("Path")}: ${u}`));let k=a(e,"nextStep");return k&&s.push("",n.section("Next"),`  ${n.arrow} ${k}`),s.join(`
+`)}function so(e,t){let n=V(t),r=[`${n.ok("OK")} Local install records synced.`,"",n.section(`Results (${e.results.length})`)];return e.results.length===0?(r.push(`  ${n.muted("No local install records found.")}`),r.join(`
+`)):(e.results.slice(0,O).forEach((i,s)=>{let o=a(i,"skillSlug")??a(i,"slug")??`item-${s+1}`,l=a(i,"syncStatus")??"unchecked",c=a(i,"version")??a(i,"currentVersion");r.push(`${s+1}. ${o}`),r.push(`   status: ${l.replaceAll("_"," ")}${c?`; version: ${c}`:""}`),l==="backend_missing"&&r.push(`   ${n.muted("Installed locally, but missing from the selected backend catalog.")}`)}),e.results.length>O&&r.push(`  ${n.muted(`... ${e.results.length-O} more`)}`),r.push("",n.section("Next")),r.push(`  ${n.arrow} skills-layer installed`),r.push(`  ${n.arrow} skills-layer update <skill-slug>`),r.join(`
+`))}function oo(e,t){let n=V(t);return[`${n.ok("OK")} Removed ${e}.`,"",n.section("Local Install"),`  ${n.label("Skill")}: ${e}`,`  ${n.label("Status")}: removed locally`,"",n.section("Next"),`  ${n.arrow} skills-layer installed`,`  ${n.arrow} skills-layer sync`].join(`
+`)}function ao(e,t,n){let r=V(n),i=a(t,"version")??a(t,"currentVersion"),s=a(t,"scope");return[`${r.ok("OK")} Restore record found for ${e}.`,"",r.section("Local Install"),`  ${r.label("Skill")}: ${e}`,...i?[`  ${r.label("Version")}: ${i}`]:[],...s?[`  ${r.label("Scope")}: ${s}`]:[],"",r.section("Next"),`  ${r.arrow} skills-layer installed`,`  ${r.arrow} skills-layer sync`,`  ${r.arrow} skills-layer update ${e}`].join(`
+`)}function lo(e){let t=a(e,"status"),n=a(e,"reasonCode");return t==="invalid_transition"||t==="forbidden"||t==="not_found"||n==="invalid_transition"}function co(e,t){let n=a(e,"why")??a(e,"reason")??a(e,"error"),r=a(e,"currentVisibility"),i=a(e,"nextVisibility")??a(e,"visibility"),s=r||i?` Current visibility: ${r??"unknown"}; requested visibility: ${i??"unknown"}.`:"",o=a(e,"nextStep")??`Run \`skills-layer creator status ${t}\` and choose a valid visibility transition.`;return`Visibility was not changed for ${t}.${s}${n?` ${n}`:""}
+Next step: ${o}`}async function uo(e,t,n){let r=await pe(n),i=e[0];if(!i){let l=Object.values(r.installs);return f({status:l.length>0?"restored":"no_op",results:l},`Restore checked ${l.length} local install record${l.length===1?"":"s"}.`,t.json,n)}let s=r.installs[i];if(!s)return j({status:"missing_record",reasonCode:"restore_record_not_found",skillSlug:i,record:null,nextAction:"installed",nextStep:`Run \`skills-layer installed\` to see local records, \`skills-layer sync\` to refresh status, or \`skills-layer search ${i}\` if you want to find a catalog/source replacement.`},`No restorable local install record was found for ${i}. Run \`skills-layer installed\`, \`skills-layer sync\`, or \`skills-layer search ${i}\` next.`,t.json,"restore_record_not_found");let o={status:"restored",skillSlug:i,record:s};return t.json?f(o,`Restore checked for ${i}.`,!0,n):{exitCode:0,stdout:ao(i,s,n),stderr:""}}async function go(e,t,n){let r=w(e[0],"check requires a skill slug.");return await S(`/api/v1/skills/${encodeURIComponent(r)}/trust`,t,n,"Install trust checked.",{authenticated:!!n.apiKey})}async function po(e,t,n){let r=w(e[0]??t.source,"import requires a source."),i=await Et(r,n.cwd),s=await P(n,"/api/v1/source-imports",{method:"POST",headers:_(n.apiKey),body:JSON.stringify(A({...i??{source:r},quarantine:t.quarantine,skillSlug:g(t.skill),visibility:g(t.visibility)}))});return await K(n.paths.importsPath,{version:1,lastImport:s,savedAt:n.now()}),f(s,"Source import submitted.",t.json,n)}async function mo(e,t,n){let r=e[0];if(r==="reference"&&e[1]==="resolve"){let i=w(e[2],"source reference resolve requires a reference.");return await S(`/api/v1/source-references/resolve?reference=${encodeURIComponent(i)}`,t,n,"Source reference resolved.")}return r==="connection"?await fo(e.slice(1),t,n):y(`Unknown source command "${e.join(" ")}".`,t.json)}async function fo(e,t,n){let r=e[0];if(r==="start")return await N("/api/v1/me/source-connections",F(t,["provider","source","skill","mode","visibility","priceCents","license","provenanceIntent","discloseSource"]),t,n,"Source connection started.");let i=w(e[1],`source connection ${r??""} requires a connection id.`);return r==="status"?await S(`/api/v1/me/source-connections/${encodeURIComponent(i)}`,t,n,"Source connection loaded.",{authenticated:!0}):r==="complete"?await N(`/api/v1/me/source-connections/${encodeURIComponent(i)}/complete`,F(t,["providerOwnerId","providerRepoId","providerProjectId","providerInstallationId","commitSha"]),t,n,"Source connection completed."):r==="cancel"?await N(`/api/v1/me/source-connections/${encodeURIComponent(i)}/cancel`,{},t,n,"Source connection cancelled."):y(`Unknown source connection command "${r??""}".`,t.json)}async function ho(e,t,n){if(e[0]!=="request")return y(`Unknown approval command "${e[0]??""}".`,t.json);let r=e[1],i=w(e[2],`approval request ${r??""} requires an approval id.`);return r==="status"?await S(`/api/v1/me/approvals/${encodeURIComponent(i)}`,t,n,"Approval status loaded.",{authenticated:!0}):r==="complete"?await N(`/api/v1/me/approvals/${encodeURIComponent(i)}/complete`,A({decision:g(t.decision),evidence:st(t.decisionEvidenceJson,"decision-evidence-json")}),t,n,"Approval completed."):y(`Unknown approval request command "${r??""}".`,t.json)}async function yo(e,t,n){let r=e[0]??"list";if(r==="list")return await S("/api/v1/me/workspaces",t,n,"Workspaces loaded.",{authenticated:!0});if(r==="create")return await N("/api/v1/workspaces",{name:e.slice(1).join(" "),kind:g(t.kind)},t,n,"Workspace created.");let i=w(e[1],`workspace ${r} requires a workspace id.`);if(r==="skills")return await S(`/api/v1/workspaces/${encodeURIComponent(i)}/skills`,t,n,"Workspace skills loaded.",{authenticated:!0});if(r==="deploy"){let s=w(e[2],"workspace deploy requires a skill slug.");return await N(`/api/v1/workspaces/${encodeURIComponent(i)}/skills`,{skillSlug:s,dryRun:t.dryRun},t,n,"Workspace deployment requested.")}if(r==="remove"){let s=w(e[2],"workspace remove requires a skill slug.");return await nt(`/api/v1/workspaces/${encodeURIComponent(i)}/skills/${encodeURIComponent(s)}`,{method:"DELETE",headers:T(n.apiKey,n.authBlockedMessage)},t,n,"Workspace skill removed.")}if(r==="guide"){let s=w(e[2],"workspace guide requires a skill slug.");return await S(`/api/v1/workspaces/${encodeURIComponent(i)}/skills/${encodeURIComponent(s)}/install-guide`,t,n,"Workspace install guide loaded.",{authenticated:!0})}return y(`Unknown workspace command "${r}".`,t.json)}async function ko(e,t,n){let r=w(e[0],"buy requires a skill slug."),i=await P(n,"/api/v1/buy",{method:"POST",headers:_(n.apiKey),body:JSON.stringify({skillSlug:r,paymentMethod:g(t.paymentMethod)??"card"})});if(i.status==="already_owned")return f(i,`You already own ${r}. Run \`skills-layer install ${r}\` to install or update it.`,t.json,n);if(t.json||i.status!=="checkout_required"||typeof i.checkoutUrl!="string"||typeof i.purchaseId!="string")return f(i,`Purchase flow started for ${r}.`,t.json,n);n.emitInfo(`Opening checkout for ${r}. Complete the payment in your browser, then come back here.`),await n.openUrl(i.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${i.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let o=await Qo(i.purchaseId,n);return D(o)?o:o.status!=="succeeded"&&o.status!=="refund_requested"?f({...i,purchaseStatus:o.status},`Checkout is still ${o.status} for ${r}. You can rerun install after payment reconciliation completes.`,t.json,n):(n.emitInfo("Payment confirmed. Continuing with install."),await Jt([r],t,n))}async function wo(e,t,n){let r=e[0]??"list";if(r==="list")return await S("/api/v1/purchases",t,n,"Purchases loaded.",{authenticated:!0});if(r==="spending")return await S("/api/v1/spending",t,n,"Spending loaded.",{authenticated:!0});let i=w(e[1],`purchases ${r} requires a purchase id.`);return r==="invoice"?await S(`/api/v1/purchases/${encodeURIComponent(i)}/invoice`,t,n,"Invoice loaded.",{authenticated:!0}):r==="refund-quote"?await S(`/api/v1/purchases/${encodeURIComponent(i)}/refund-quote`,t,n,"Refund quote loaded.",{authenticated:!0}):r==="refund"?await N(`/api/v1/purchases/${encodeURIComponent(i)}/refund`,F(t,["reason"]),t,n,"Refund requested."):y(`Unknown purchases command "${r}".`,t.json)}async function vo(e,t,n){let r=e[0];if(r==="add"){let i=w(e[1],"library add requires a skill slug.");return await N("/api/v1/install",{skillSlug:i},t,n,"Skill added to library.")}return y(`Unknown library command "${r}".`,t.json)}async function Po(e,t,n){let r=w(e[0],"export requires a skill slug."),i=new URLSearchParams;B(i,"version",t.version);let s=await P(n,`/api/v1/me/library/${encodeURIComponent(r)}/export${te(i)}`,{headers:T(n.apiKey,n.authBlockedMessage)}),o=g(t.output);if(o){let l=await mr({backend:n,exportResult:s,flags:t,skillSlug:r});if(D(l))return l;let c=se(n.cwd,o);await Bt(c,l.bytes);let u={...s};return delete u.downloadUrl,f({...u,archiveSha256:l.archiveSha256,archiveHashFormat:l.archiveHashFormat,outputPath:c,downloaded:!0},`Exported ${r} to ${c}.`,t.json,n)}return f(s,o?`Exported ${r} to ${o}.`:"Export prepared.",t.json,n)}async function Gn(e,t,n,r){let i=w(t[0],`${e==="add"?"add-review":"show-reviews"} requires a skill slug.`);return e==="show"?await S(`/api/v1/me/library/${encodeURIComponent(i)}/reviews`,n,r,"Reviews loaded.",{authenticated:!0}):await N(`/api/v1/me/library/${encodeURIComponent(i)}/review`,F(n,["rating","feedback"]),n,r,"Review added.")}async function Dn(e,t,n,r){let i=w(t[0],`${e==="add"?"add-issue":"show-issues"} requires a skill slug.`);return e==="show"?await S(`/api/v1/me/library/${encodeURIComponent(i)}/issues`,n,r,"Issues loaded.",{authenticated:!0}):await N(`/api/v1/me/library/${encodeURIComponent(i)}/report-issue`,F(n,["issueType","message"]),n,r,"Issue reported.")}async function bo(e,t,n){let r=e[0];if(r==="hook"){let i=e[1];return i==="install"?await At(t,n):i==="status"?await xo(t,n):y(`Unknown guardian hook command "${i??""}".`,t.json)}if(r==="enable")return e[1]||t.skill?await yt("enforce",e,t,n):await At(t,n);if(r==="disable")return await yt("disabled",e,t,n);if(r==="enable-warnings-only")return await yt("warning_only",e,t,n);if(r==="status")return await Co(e,t,n);if(r==="exec")return await So(e,t,n);if(r==="check"){let i=w(e[1]??t.skill,"guardian check requires a skill slug."),s=Zn(t,"check"),o=t.grantJson.map(h=>rn(h,"grant-json")),l=Ya(t.cloudTrustLedger);if(l.status==="invalid")return y(l.message,t.json);let c=It(t.telemetryMode,l.policy==="off"?"local_only":"cloud_managed");if(c.status==="invalid")return y(c.message,t.json);let u=await Pr({skillSlug:i,version:g(t.version),action:s,flags:t,backend:n,telemetryMode:c.mode});if(u.status!=="ok")return u.result;let d=u.context.installedPath,m=g(t.version)??u.context.version,k=A({skillSlug:i,version:m,action:s,authorizationGrants:o,path:d,guardianPreference:await Wt(n,i),unmanagedPolicy:u.context.unmanagedPolicy,allowUnmanagedOnce:t.allowUnmanagedOnce,telemetryMode:c.mode,localPreflight:ge(u.context)}),p=await P(n,"/api/v1/guardian/enforce",{method:"POST",headers:_(n.apiKey),body:JSON.stringify(k)});return await Ae(n,{skillSlug:i,version:m,action:s,decisionStatus:Xe(p),reasonCode:jt(p),telemetryMode:c.mode,path:d}),f({...p,localPreflight:ge(u.context)},"Guardian check complete.",t.json,n)}if(r==="incident"){let i=w(e[1]??t.skill,"guardian incident requires a skill slug."),s=w(t.version,"guardian incident requires --version."),o=It(t.telemetryMode,"cloud_managed");if(o.status==="invalid")return y(o.message,t.json);let l=g(t.path)??(await br({skillSlug:i,flags:t,backend:n})).installedPath,c=Zn(t,"incident"),u=st(t.evidenceJson,"evidence-json"),d=o.mode==="cloud_managed"&&!n.apiKey?"local_only":o.mode,m=A({skillSlug:i,version:s,action:c,evidence:u,path:l,telemetryMode:d,incident:!0,reason:g(t.reason)});if(d==="local_only"){if(!l)return y("guardian incident --telemetry-mode local_only requires --path <installed-skill-path>.",t.json);let v=await Wn({backend:n,skillSlug:i,version:s,installedPath:l,action:c,reason:g(t.reason)??"Guardian local-only incident"});await Ae(n,{skillSlug:i,version:s,action:c,decisionStatus:"blocked",reasonCode:"incident_recorded",telemetryMode:d,path:l});let b=Yn(n,i);return await re(b,JSON.stringify({request:m,response:null,localResponse:v,savedAt:n.now()},null,2)),f({status:"written",skillSlug:i,version:s,telemetryMode:d,cloudTelemetry:n.apiKey?"not_requested":"login_required",localResponse:v,incidentStatePath:b,incidentPath:v.incidentPath},n.apiKey?"Guardian incident recorded locally.":"Guardian incident recorded locally. Log in to submit Cloud incident evidence.",t.json,n)}let k=await P(n,"/api/v1/guardian/enforce",{method:"POST",headers:_(n.apiKey),body:JSON.stringify(m)}),p=l?await Wn({backend:n,skillSlug:i,version:s,installedPath:l,action:c,reason:g(t.reason)??"Guardian Cloud-managed incident"}):null;await Te(n.paths.incidentsDir,{recursive:!0});let h=Yn(n,i);return await re(h,JSON.stringify({request:m,response:k,localResponse:p,savedAt:n.now()},null,2)),await Ae(n,{skillSlug:i,version:s,action:c,decisionStatus:Xe(k),reasonCode:jt(k),telemetryMode:o.mode,path:l}),f({...k,telemetryMode:o.mode,localResponse:p,incidentPath:h},"Guardian incident recorded.",t.json,n)}return y(`Unknown guardian command "${r??""}".`,t.json)}async function So(e,t,n){let r=g(t.skill),i=w(r??e[1],"guardian exec requires a skill slug."),s=r?e.slice(1):e.slice(2);if(s.length===0)return y("guardian exec requires a command after --.",t.json);let o=It(t.telemetryMode,"cloud_managed");if(o.status==="invalid")return y(o.message,t.json);let l=Lo(t,s),c=await Pr({skillSlug:i,version:g(t.version),action:l,flags:t,backend:n,telemetryMode:o.mode});if(c.status!=="ok")return c.result;let u=c.context.installedPath,d=g(t.version)??c.context.version,m=A({skillSlug:i,version:d,action:l,authorizationGrants:t.grantJson.map(b=>rn(b,"grant-json")),path:u,guardianPreference:await Wt(n,i),telemetryMode:o.mode,localPreflight:ge(c.context)}),k=await P(n,"/api/v1/guardian/enforce",{method:"POST",headers:_(n.apiKey),body:JSON.stringify(m)}),p=Xe(k),h=jt(k);if(await Ae(n,{skillSlug:i,version:d,action:l,decisionStatus:p,reasonCode:h,telemetryMode:o.mode,path:u}),!To(k))return j({status:"blocked",reasonCode:h,skillSlug:i,guardian:k,localPreflight:ge(c.context),command:{executable:G(s[0]??""),executed:!1}},"Guardian blocked guarded execution.",t.json,h);if(t.dryRun)return f({status:"allowed",skillSlug:i,guardian:k,localPreflight:ge(c.context),command:{executable:G(s[0]??""),executed:!1,dryRun:!0}},"Guardian guarded execution allowed.",t.json,n);let v=await Bo(s,n);return{exitCode:v.exitCode,stdout:t.json?JSON.stringify({status:v.exitCode===0?"executed":"command_failed",summary:"Guardian guarded execution complete.",why:null,nextAction:null,nextStep:null,data:{skillSlug:i,guardian:k,localPreflight:ge(c.context),command:v},warnings:[],links:[],reasonCode:v.exitCode===0?null:"command_failed",handoff:null},null,2):Mo(v),stderr:v.stderr}}async function yt(e,t,n,r){let i=w(t[1]??n.skill,`guardian ${t[0]??"mode"} requires a skill slug.`),s=await P(r,"/api/v1/guardian/mode",{method:"POST",headers:_(r.apiKey),body:JSON.stringify({skillSlug:i,requestedPreference:e,source:"public-cli"})});return s.preferenceAccepted===!0&&await No(r,i,s),f(s,s.preferenceAccepted===!0?"Guardian mode updated.":"Guardian mode resolved by policy.",n.json,r)}async function Co(e,t,n){let r=g(t.skill)??g(e[1]),i=await wr(n,r),s=await Ne(n),o=r?await Oo(n,r):void 0;return f(A({status:"ok",skillSlug:a(i,"skillSlug")??r,policy:i,localPreference:o,hook:s,nextAction:a(i,"nextAction"),nextStep:a(i,"nextStep")}),"Guardian status loaded.",t.json,n)}async function wr(e,t){let n=t?await Wt(e,t):void 0;return await P(e,"/api/v1/guardian/status",{method:"POST",headers:_(e.apiKey),body:JSON.stringify(A({skillSlug:t,requestedPreference:n,source:"public-cli"}))})}async function Ro(e){if(!e.apiKey)return{status:"unknown",policySource:"cloud",reasonCode:"login_required",nextAction:"skills-layer login",nextStep:"Sign in to read the Cloud Guardian policy that applies to your account."};try{return await wr(e)}catch(t){return{status:"unavailable",policySource:"cloud",reasonCode:"guardian_policy_status_unavailable",message:ue(t),nextAction:"skills-layer guardian status",nextStep:"Retry Guardian status after backend connectivity or authentication is healthy."}}}async function At(e,t){let n=g(e.agent)??"codex",r=Cr(e.scope);if(r.status==="invalid")return y(r.message,e.json);let i=ae(t.env,t.platform,t.cwd).find(m=>m.id===n);if(!i)return y(`Unsupported Guardian agent "${n}". Run skills-layer agents list to see supported agents.`,e.json);let s=Fo(i,r.scope,t);if(!s)return y(`Guardian ${r.scope} hooks are not available for ${i.displayName}.`,e.json);await qo(s,t);let o=$r(t,r.scope),l=Qn(Ie(t.cwd,s.hookPath)),c=Qn(Ie(t.cwd,s.configPath)),d=[...(await _r(o)).hooks.filter(m=>a(m,"agent")!==i.id||a(m,"scope")!==r.scope),{agent:i.id,agentName:i.displayName,scope:r.scope,hookPath:l.startsWith("..")?s.hookPath:l,configPath:c.startsWith("..")?s.configPath:c,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,enabledAt:t.now()}];return await K(o,{version:1,hooks:d}),f({status:"enabled",agent:i.id,agentName:i.displayName,scope:r.scope,hookPath:s.hookPath,configPath:s.configPath,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,agentCommandMatrix:ft({purpose:"materialize_skill",command:"skills-layer install <skill-slug>",jsonCommand:"skills-layer install <skill-slug> --json"}),nextStep:"Guardian is installed into the selected host configuration. Local hooks call `skills-layer guardian check`; shell agents can route risky commands through `skills-layer guardian exec`; MCP-capable agents can call `guardian.check` or `guardian.enforce` before risky tool use.",warnings:s.enforcementLayer==="native_hook_candidate"?["This host does not expose the same stable native hook contract as Codex or Claude Code yet; Skills Layer records the guardrail config for host integration."]:[]},"Guardian hook enabled.",e.json,t)}async function xo(e,t){let n=g(e.scope),r=n?Cr(n):null;if(r?.status==="invalid")return y(r.message,e.json);let i=await Ne(t,r?.status==="valid"?r.scope:void 0);return f(i,"Guardian status loaded.",e.json,t)}async function Ne(e,t){let n=t?[t]:["project","global"],r=[];for(let o of n){let l=$r(e,o),c=await _r(l);for(let u of c.hooks){let d=a(u,"hookPath"),m=d?Vn(e,o,d):null,k=a(u,"configPath"),p=k?Vn(e,o,k):null;r.push({...u,scope:a(u,"scope")??o,hookPath:m??d??null,configPath:p??k??null,active:m?await ce(m):!1,configActive:p?await ce(p):!1})}}let i=r.filter(o=>o.active===!0).length,s=r.filter(o=>o.active===!1).length;return{status:"ok",enforcementLayer:i>0?"native_hook":"not_installed",strictPreActionBlocking:r.some(o=>o.strictPreActionBlocking===!0),activeHookCount:i,missingHookCount:s,hooks:r,setup:await Yt(e),warnings:r.some(o=>o.active===!1)?["One or more configured Guardian hooks are missing from disk. Run skills-layer guardian hook install --agent <agent> again to repair them."]:[]}}async function vr(e,t){if(e.json){let u=await z(t.paths.mcpConfigPath);return f({setup:await Yt(t),mcp:{status:u?"mcp_configured":"mcp_not_configured",configured:!!u,clientId:u?a(u,"clientId")??"codex":void 0,clientIds:u&&Array.isArray(u.clientIds)?u.clientIds:void 0,mcpUrl:u?a(u,"mcpUrl"):void 0,nextCommand:u?"skills-layer mcp status":"skills-layer mcp setup"},guardian:await Ne(t)},"Setup status loaded.",!0,t)}if(!t.stdoutIsTty)return f({status:"setup_needs_terminal",mcp:{nextCommand:"skills-layer mcp setup"},security:{nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Setup needs an interactive terminal. Run `skills-layer setup`, or use `skills-layer mcp setup` and `skills-layer guardian hook install --agent codex --scope project`.",!1,t);let n=await t.promptSelect("Set up Skills Layer on this machine?",[{value:"mcp",label:"Setup Skills-Layer MCP",description:"Configure Skills Layer MCP for AI tools"},{value:"security",label:"Setup Skills-Layer Security Guardian",description:"Install Guardian hooks for this workspace"},{value:"both",label:"Setup both - MCP & Security Guardian",description:"Connect supported AI tools and install Guardian hooks"},{value:"not_now",label:"Remind me Later",description:"Skip setup for now; you can run skills-layer setup later"}]);if(n==="not_now"){let u={version:1,setupChoice:"not_now",mcpChoice:"not_now",mcpPromptedAt:t.now(),guardianHookChoice:"not_now",guardianHookPromptedAt:t.now(),remindAfter:Ao(t.now(),7)};return await zn(t,u),f({status:"setup_skipped",mcp:{status:"not_configured",nextCommand:"skills-layer mcp setup"},security:{status:"not_configured",nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Skills Layer setup skipped for now. Run `skills-layer setup` when you want MCP and Security hooks on this machine.",!1,t)}if(n!=="both"&&n!=="mcp"&&n!=="security")return y(`Unknown setup option "${n}".`,e.json);let r=n==="both"||n==="mcp",i=n==="both"||n==="security",s={status:"setup_complete",setupChoice:n},o={version:1,setupChoice:n,mcpChoice:r?"configured":"not_requested",mcpPromptedAt:t.now(),guardianHookChoice:i?g(e.scope)??"project":"not_requested",guardianHookPromptedAt:t.now()};if(r)if(!t.apiKey)s.mcp={status:"login_required",configured:!1,nextCommand:"skills-layer login"},o.mcpChoice="login_required";else{let u=await Ht(e,t);if(D(u))return u;s.mcp=u}if(i){let u={...e,json:!0,scope:g(e.scope)??"project",agent:g(e.agent)??"codex"},d=await At(u,t);if(d.exitCode!==0)return d;s.security=Vo(d.stdout)??{status:"enabled",agent:g(u.agent),scope:g(u.scope)}}await zn(t,o);let c=(R(s.mcp)?a(s.mcp,"status"):void 0)==="login_required"?"Skills Layer Security setup complete. MCP setup needs login; run `skills-layer login`, then `skills-layer setup`.":"Skills Layer setup complete.";return f(s,c,e.json,t)}async function $o(e,t){let n=await Ne(t),r=await Yt(t),i=oe(n,"activeHookCount")??0;if(t.stdoutIsTty&&i===0&&!r)return await vr(e,t);let s=i>0?"Guardian host hooks are already configured. Run `skills-layer guardian hook status` to inspect them.":"Guardian is enabled for Skills Layer runtime checks. Run `skills-layer setup` when you want MCP and Security hooks on this machine.";return{exitCode:0,stdout:`${He}
+
+${s}`,stderr:""}}function _o(e,t){let n=oe(e,"activeHookCount")??0,r=oe(e,"missingHookCount")??0,i=a(t,"status")??"unknown",s=a(t,"effectiveMode"),o=a(t,"adminPolicy"),l=a(t,"nextAction"),c=a(t,"nextStep");return n>0&&r===0?{id:"guardian-local-hook",title:"Guardian local hook",status:"pass",summary:`Guardian native hook active count: ${n}.`,enforcementLayer:a(e,"enforcementLayer")??"native_hook",strictPreActionBlocking:e.strictPreActionBlocking===!0,policyStatus:i,adminPolicy:o,effectiveMode:s,policyNextAction:l,policyNextStep:c,recommendedCommand:"skills-layer guardian hook status"}:{id:"guardian-local-hook",title:"Guardian local hook",status:"warn",summary:`Guardian native hook setup needs attention. Active hooks: ${n}; missing hooks: ${r}.`,enforcementLayer:a(e,"enforcementLayer")??"not_installed",strictPreActionBlocking:e.strictPreActionBlocking===!0,policyStatus:i,adminPolicy:o,effectiveMode:s,policyNextAction:l,policyNextStep:c,recommendedCommand:"skills-layer guardian hook install --agent codex --scope project",nextStep:"Install a Guardian host hook for automatic checks, or route risky shell actions through `skills-layer guardian exec` for strict pre-execution blocking."}}function Ao(e,t){let n=new Date(e);return Number.isNaN(n.getTime())?e:(n.setUTCDate(n.getUTCDate()+t),n.toISOString())}async function Pr(e){let t=Sr(g(e.flags.unmanagedPolicy)??e.backend.env.SKILLS_LAYER_UNMANAGED_SKILL_POLICY);if(t.status==="invalid")return{status:"invalid",result:y(t.message,e.flags.json)};let n=await br({skillSlug:e.skillSlug,flags:e.flags,backend:e.backend,unmanagedPolicy:t.policy});if(n.unmanaged&&n.unmanagedPolicy==="block")return Ve({...e,context:n,reasonCode:"unmanaged_skill_blocked",message:"Guardian blocked unmanaged local skill execution.",why:"The skill path is not backed by a public install index or lockfile entry and unmanaged policy is block.",nextStep:"Install the skill with `skills-layer install <path>` or choose --unmanaged-policy warn/allow for a one-off diagnostic check."});if(!n.installedPath)return{status:"ok",context:n};if(await Jo(n.installedPath))return Ve({...e,context:n,reasonCode:"skill_disabled",message:"Guardian blocked the action because this local skill is disabled.",why:"A local Guardian incident marker is present for this skill.",nextAction:"guardian.incident.review",nextStep:"Review the local incident report before running this skill again."});if(n.unmanaged)return{status:"ok",context:n};let r=await Eo(e.skillSlug,n.installedPath);if(n.identityAssessment=r,r.reattestationRequired===!0)return Ve({...e,context:n,reasonCode:a(r,"reasonCode")??"skill_identity_mismatch",message:"Guardian blocked the action because the installed skill identity changed.",why:"The visible SKILL.md identity no longer matches the installed skill record.",nextStep:"Reinstall or re-attest the skill before running it again."});let i=await Uo(e.skillSlug,n.installedPath);return n.driftAssessment=i,i.reattestationRequired===!0?Ve({...e,context:n,reasonCode:a(i,"reasonCode")??"installed_artifact_changed",message:"Guardian blocked the action because local runtime metadata detected installed artifact drift.",why:"The installed SKILL.md hash no longer matches the materialized runtime metadata.",nextStep:"Reinstall or re-attest the skill before running it again."}):{status:"ok",context:n}}async function Ve(e){return await Ae(e.backend,{skillSlug:e.skillSlug,version:e.version??e.context.version,action:e.action,decisionStatus:"blocked",reasonCode:e.reasonCode,telemetryMode:e.telemetryMode,path:e.context.installedPath}),{status:"blocked",result:j({status:"blocked",skillSlug:e.skillSlug,version:e.version??e.context.version,reasonCode:e.reasonCode,localPreflight:ge(e.context),unmanaged:e.context.unmanaged,unmanagedPolicy:e.context.unmanagedPolicy,allowUnmanagedOnce:e.context.allowUnmanagedOnce,why:e.why,nextAction:e.nextAction,nextStep:e.nextStep},e.message,e.flags.json,e.reasonCode)}}async function br(e){let t=Sr(g(e.flags.unmanagedPolicy)),n=e.unmanagedPolicy??(t.status==="valid"?t.policy:"warn"),r=g(e.flags.path),i=await Io(e.skillSlug,e.backend),s=r?se(e.backend.cwd,r):i?.installedPath;return{source:r?"explicit_path":i?.source??"install_index",installedPath:s,version:g(e.flags.version)??i?.version,record:i?.record,unmanaged:!!(r&&!i),unmanagedPolicy:n,allowUnmanagedOnce:e.flags.allowUnmanagedOnce}}async function Io(e,t){let r=(await pe(t)).installs[e];if(r)return{source:"install_index",installedPath:Hn(r,t),version:a(r,"version"),record:r};for(let i of jo(t)){let s=await z(i);if(!R(s)||!R(s.installs))continue;let o=s.installs[e];if(R(o))return{source:"lockfile",installedPath:Hn(o,t),version:a(o,"version"),record:o}}return null}function jo(e){return Array.from(new Set([I(e.cwd,"skills-layer-lock.json"),I(e.paths.stateDir,"skills-layer-lock.json")]))}function Hn(e,t){let n=a(e,"canonicalPath")??a(e,"materializedPath")??a(e,"bundlePath")??a(e,"path");if(n){let o=se(t.cwd,n);return G(o).toLowerCase()==="skill.md"?ie(o):o}let i=(Array.isArray(e.materializedWrites)?e.materializedWrites.filter(R):[]).find(o=>{let l=a(o,"path");return l?.toLowerCase().endsWith("/skill.md")||l?.toLowerCase()==="skill.md"}),s=i?a(i,"path"):void 0;return s?ie(se(t.cwd,s)):void 0}async function Eo(e,t){let n=I(t,"SKILL.md");if(!await ce(n))return{status:"not_checked",reasonCode:"skill_document_unavailable",expectedSkillSlug:e,reattestationRequired:!1};try{let r=fr(await Be(n,"utf8"));return r?r!==e?{status:"mismatch",reasonCode:"skill_identity_mismatch",expectedSkillSlug:e,observedSkillName:r,skillDocumentPath:n,reattestationRequired:!0}:{status:"matched",expectedSkillSlug:e,observedSkillName:r,skillDocumentPath:n,reattestationRequired:!1}:{status:"not_checked",reasonCode:"skill_identity_metadata_unavailable",expectedSkillSlug:e,skillDocumentPath:n,reattestationRequired:!1}}catch(r){return{status:"invalid",reasonCode:"skill_identity_unreadable",expectedSkillSlug:e,skillDocumentPath:n,message:ue(r),reattestationRequired:!0}}}async function Uo(e,t){let n=I(t,".skills-layer-runtime.json"),r=await z(n),i=r?C(r,"materialization"):void 0,s=i?a(i,"skillDocumentSha256"):void 0;if(!r||!s)return{status:"not_checked",reasonCode:"runtime_metadata_unavailable",skillSlug:e,reattestationRequired:!1};let o=I(t,"SKILL.md");if(!await ce(o))return{status:"changed",reasonCode:"installed_artifact_changed",skillSlug:e,expectedSkillDocumentSha256:s,reattestationRequired:!0};let l=jr(await Be(o,"utf8")),c=l===s;return{status:c?"unchanged":"changed",reasonCode:c?"installed_artifact_matches":"installed_artifact_changed",skillSlug:e,expectedSkillDocumentSha256:s,observedSkillDocumentSha256:l,reattestationRequired:!c}}function ge(e){return A({source:e.source,installedPath:e.installedPath,version:e.version,unmanaged:e.unmanaged,unmanagedPolicy:e.unmanagedPolicy,allowUnmanagedOnce:e.allowUnmanagedOnce,identityAssessment:e.identityAssessment,driftAssessment:e.driftAssessment})}function Sr(e){if(e===void 0||e.trim()==="")return{status:"valid",policy:"warn"};let t=e.trim().toLowerCase();return t==="allow"||t==="warn"||t==="block"?{status:"valid",policy:t}:{status:"invalid",message:"guardian check --unmanaged-policy must be one of: allow, warn, block."}}function It(e,t){let n=g(e)??t;return n==="cloud_managed"||n==="local_only"?{status:"valid",mode:n}:{status:"invalid",message:"guardian --telemetry-mode must be one of: cloud_managed, local_only."}}function Lo(e,t){let n=st(e.actionJson,"action-json");return n&&typeof n=="object"&&!Array.isArray(n)?n:{type:"shell_command",command:G(t[0]??"command")}}function To(e){let t=C(e,"enforcement");return typeof t?.canExecute=="boolean"?t.canExecute:Xe(e)!=="blocked"}async function Bo(e,t){let[n,...r]=e;return await new Promise((i,s)=>{let o=ir(n,r,{cwd:t.cwd,env:{...process.env,...t.env},stdio:["ignore","pipe","pipe"]}),l="",c="";o.stdout?.setEncoding("utf8"),o.stderr?.setEncoding("utf8"),o.stdout?.on("data",u=>{l=Jn(`${l}${u}`)}),o.stderr?.on("data",u=>{c=Jn(`${c}${u}`)}),o.on("error",s),o.on("close",u=>{i({executable:G(n),argsCount:r.length,exitCode:typeof u=="number"?u:1,stdout:l,stderr:c})})})}function Jn(e){return e.length>2e4?`${e.slice(0,2e4)}
+[output truncated]`:e}function Mo(e){let t=[e.exitCode===0?"OK Guardian guarded execution complete.":"Guardian guarded execution finished with a command error.","","Command",`  executable: ${e.executable}`,`  args count: ${e.argsCount}`,`  exit code: ${e.exitCode}`];return e.stdout&&t.push("","Stdout",e.stdout),e.stderr&&t.push("","Stderr",e.stderr),t.join(`
+`)}function Cr(e){let t=g(e)??"project";return t==="project"||t==="global"?{status:"valid",scope:t}:{status:"invalid",message:"guardian hooks --scope must be one of: project, global."}}function Rr(e){return I(e.paths.stateDir,"guardian-modes.json")}function xr(e){return I(e.paths.stateDir,"setup-state.json")}async function Vt(e){let t=await z(Rr(e));return{version:1,skills:R(t?.skills)?t.skills:{}}}async function No(e,t,n){let r=await Vt(e);await K(Rr(e),{version:1,skills:{...r.skills,[t]:{requestedPreference:a(n,"requestedPreference")??"enforce",effectiveMode:a(n,"effectiveMode")??"enforce",reasonCode:a(n,"reasonCode"),auditId:a(n,"auditId"),updatedAt:e.now()}}})}async function Wt(e,t){let r=(await Vt(e)).skills[t];return r?a(r,"requestedPreference"):void 0}async function Oo(e,t){return(await Vt(e)).skills[t]}async function Yt(e){let t=await z(xr(e));return R(t)?{version:1,setupChoice:a(t,"setupChoice"),mcpChoice:a(t,"mcpChoice"),mcpPromptedAt:a(t,"mcpPromptedAt"),guardianHookChoice:a(t,"guardianHookChoice"),guardianHookPromptedAt:a(t,"guardianHookPromptedAt"),remindAfter:a(t,"remindAfter")}:null}async function zn(e,t){await K(xr(e),t)}function Fo(e,t,n){let r=t==="global"?e.targets.globalRoot:e.targets.projectRoot;return r?e.id==="codex"?{agent:e.id,agentName:e.displayName,scope:t,configPath:I(r,"hooks.json"),hookPath:I(r,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook",strictPreActionBlocking:!0}:e.id==="claude-code"?{agent:e.id,agentName:e.displayName,scope:t,configPath:I(r,"settings.json"),hookPath:I(r,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook",strictPreActionBlocking:!0}:e.id==="cline"?{agent:e.id,agentName:e.displayName,scope:t,configPath:I(r,"guardian-hooks.json"),hookPath:I(r,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook_candidate",strictPreActionBlocking:!1}:null:null}async function qo(e,t){if(await re(e.hookPath,Ho(e.agentName)),await or(e.hookPath,448).catch(()=>{}),e.agent==="codex"){await K(e.configPath,Ko(e.hookPath));return}if(e.agent==="claude-code"){await K(e.configPath,Go(e.hookPath));return}e.agent==="cline"&&await K(e.configPath,Do(e,t))}function $r(e,t){return t==="global"?I(e.paths.stateDir,"guardian-hooks.json"):I(e.cwd,".skills-layer","guardian-hooks.json")}async function _r(e){let t=await z(e);return{version:1,hooks:Array.isArray(t?.hooks)?t.hooks.filter(R):[]}}function Vn(e,t,n){return ve.isAbsolute(n)||n.startsWith("/")?n:lr(t==="global"?e.paths.stateDir:e.cwd,n)}function Ko(e){return{hooks:{PreToolUse:[{matcher:"Bash|Shell|Read|Write|Edit|apply_patch|mcp__.*",hooks:[{type:"command",command:`node ${Qt(e)}`}]}]}}}function Go(e){return{hooks:{PreToolUse:[{matcher:"Bash|Read|Write|Edit|MultiEdit|NotebookEdit|WebFetch|WebSearch",hooks:[{type:"command",command:`node ${Qt(e)}`}]}]}}}function Do(e,t){return{version:1,agent:e.agent,agentName:e.agentName,scope:e.scope,enforcementLayer:e.enforcementLayer,strictPreActionBlocking:e.strictPreActionBlocking,installedAt:t.now(),hooks:[{event:"PreToolUse",command:`node ${Qt(e.hookPath)}`,status:"candidate"}]}}function Ho(e){return`#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+let payload = {};
+try {
+  const raw = readFileSync(0, "utf8").trim();
+  payload = raw ? JSON.parse(raw) : {};
+} catch {
+  payload = {};
+}
+
+const skillSlug = payload.skillSlug || payload.skill || payload.skill_slug || process.env.SKILLS_LAYER_GUARDIAN_SKILL;
+if (!skillSlug) {
+  process.exit(0);
+}
+
+const toolName = payload.tool_name || payload.toolName || payload.name || "unknown";
+const action = {
+  type: "host_tool_use",
+  host: ${JSON.stringify(e)},
+  tool: String(toolName),
+  rawEventKeys: Object.keys(payload).sort()
+};
+
+const result = spawnSync("skills-layer", [
+  "guardian",
+  "check",
+  String(skillSlug),
+  "--action-json",
+  JSON.stringify(action),
+  "--json"
+], { stdio: ["ignore", "inherit", "inherit"] });
+
+process.exit(result.status ?? 1);
+`}function Qt(e){return JSON.stringify(e)}async function Zt(e){let t=I(ie(e.skillDocumentPath),".skills-layer-runtime.json"),n={version:1,generatedAt:e.backend.now(),skillSlug:e.skillSlug,...e.version?{skillVersion:e.version}:{},guardian:{required:!0,enforcementLayer:"cloud_guardian_with_local_preflight",strictPreActionBlocking:!1,checkCommand:`skills-layer guardian check --skill ${e.skillSlug} --json`,incidentCommand:`skills-layer guardian incident ${e.skillSlug} --path <installed-skill-path> --telemetry-mode local_only --json`,guardedExecutorCommand:`skills-layer guardian exec ${e.skillSlug} --json -- <command>`,mcpCheckTool:"guardian.check",mcpEnforceTool:"guardian.enforce",agentCommandMatrix:ft({purpose:"materialize_skill",command:`skills-layer install ${e.skillSlug}`,jsonCommand:`skills-layer install ${e.skillSlug} --json`,skillSlug:e.skillSlug}),agentGuidance:"MCP-capable agents should call guardian.check or guardian.enforce before risky tool use. Local host hooks should call skills-layer guardian check, and shell actions that need strict wrapping should use skills-layer guardian exec.",sensitiveActionFamilies:["shell_command","network_request","file_read","file_write","secret_read","browser_action","device_action","api_call","generated_code_execution","model_context_promotion"]},materialization:{skillDocumentPath:"SKILL.md",skillDocumentSha256:jr(e.skillDocumentContent)}},r=`${JSON.stringify(n,null,2)}
+`;return await re(t,r),{path:Ze(e.backend.cwd,t),bytes:new TextEncoder().encode(r).length}}async function Jo(e){return await ce(I(e,".skills-layer-disabled.json"))}async function Wn(e){let t=e.backend.now(),n=I(e.installedPath,".skills-layer-disabled.json"),r=I(e.installedPath,".skills-layer-quarantine.json"),i=I(e.installedPath,"incident.md"),s=a(e.action,"type")??"unknown";return await re(n,`${JSON.stringify({disabled:!0,generatedAt:t,skillSlug:e.skillSlug,version:e.version,reason:"Skills Layer Guardian incident response"},null,2)}
+`),await re(r,`${JSON.stringify({generatedAt:t,skillSlug:e.skillSlug,version:e.version,actions:["disable_skill","quarantine_files","preserve_evidence","generate_incident_report","rescan_before_reenable"],quarantineTargets:[e.installedPath]},null,2)}
+`),await re(i,["# Skills Layer Guardian Incident Report","",`Generated: ${t}`,`Skill: ${e.skillSlug}`,`Version: ${e.version}`,"","## Summary","",Ir(e.reason),"","## Evidence","",`- ${t}: ${s} -> blocked (incident_recorded)`].join(`
+`)),{status:"written",generatedAt:t,incidentPath:i,writtenFiles:[n,r,i]}}function Yn(e,t){let n=e.now().replace(/[:.]/gu,"-");return I(e.paths.incidentsDir,`${t}-${n}.json`)}async function Ae(e,t){let n=I(e.paths.stateDir,"guardian-audit.jsonl");await Hr(ie(n));let r={version:1,generatedAt:e.now(),skillSlug:t.skillSlug,...t.version?{skillVersion:t.version}:{},actionType:a(t.action,"type")??"unknown",actionTarget:zo(t.action),decisionStatus:t.decisionStatus,reasonCode:t.reasonCode,telemetryMode:t.telemetryMode,...t.path?{localPath:Ar(t.path)}:{}};await Ei(n,`${JSON.stringify(r)}
+`,{encoding:"utf8",mode:384}),await nn(n,384)}function Xe(e){let t=C(e,"decision"),n=C(e,"enforcement"),r=a(t??{},"status")??a(n??{},"status")??a(e,"status");return r==="allowed"||r==="advisory"?r:"blocked"}function jt(e){let t=C(e,"decision");return a(t??{},"reasonCode")??a(e,"reasonCode")??a(e,"status")??"cloud_guardian_decision"}function zo(e){let t=a(e,"type");if(t==="secret_read")return"redacted_secret";if(t==="shell_command")return"redacted_command";let n=a(e,"url");if(n)try{return new URL(n).origin}catch{return"redacted_url"}let r=a(e,"target");if(r)return Ir(r);let i=a(e,"path");return i?Ar(i):null}function Ar(e){let t=G(e.trim());return t?`<local-path>/${t}`:"<local-path>"}function Ir(e){return e.replace(/sk-[A-Za-z0-9_-]+/gu,"[redacted-secret]").replace(/[A-Z0-9_]*SECRET[A-Z0-9_]*/gu,"[redacted-secret]").replace(/[A-Z0-9_]*TOKEN[A-Z0-9_]*/gu,"[redacted-token]").replace(/[A-Z0-9_]*KEY[A-Z0-9_]*/gu,"[redacted-key]")}function Qn(e){return e.split(/[\\/]+/u).join("/")}function jr(e){return Nt("sha256").update(e).digest("hex")}async function Er(e,t,n,r,i){let s=await P(r,"/api/v1/verify",{method:"POST",headers:_(),body:JSON.stringify({email:e,code:t})});if(n.json){let o=a(s,"apiKey");return o?(await je(r,o,{expectedEmail:e,knownEmail:a(s,"email")??e,knownRole:a(s,"role")??"user",knownRoles:ee(s,"roles"),knownUserId:a(s,"userId")}),f(H({...s,loggedIn:!0}),"Email verified.",!0,r)):f(H({...s,email:e,loggedIn:!1}),"Email verified.",!0,r)}return await tt(e,s,n,r,i)}async function tt(e,t,n,r,i){let s=a(t,"apiKey"),o=a(t,"role")??"user",l=ee(t,"roles"),c=a(t,"userId"),u=s;if(!u)try{u=(await r.promptSecret(`Enter the API key emailed to ${e} (check spam/junk folder if missing): `)).trim()}catch{return f(H({...t,email:e,role:o,...l?{roles:l}:{},loggedIn:!1}),`${i} Check your email (including spam/junk folder) for the API key, then run \`skills-layer login\` to finish signing in.`,n.json,r)}if(!u)return y("No API key was entered. Run `skills-layer login` once you have the emailed key.",n.json);let d=await je(r,u,{expectedEmail:e,knownEmail:e,knownRole:o,knownRoles:l,knownUserId:c,forceProfileValidation:!s}),m=await Rt(n,{...r,config:d,apiKey:u});return D(m)?m:f(H({...t,status:a(t,"status")??"verified",email:d.email,role:d.role,...d.roles?{roles:d.roles}:{},loggedIn:!0,...m.data?{mcp:m.data}:{}}),[`${i} Logged in as ${d.email}.`,m.message??""].filter(Boolean).join(" "),n.json,r)}async function Xt(e,t,n,r,i){let s=a(t,"authorizationUrl"),o=w(a(t,"state"),"Social auth did not return a state."),l=el(e);if(s){let u=await r.openUrl(s);r.emitInfo(u?`${l} sign-in started. Finish the login in your browser, then come back here. Waiting for browser sign-in to finish...`:`${l} sign-in started. Open this URL in your browser, then come back here once it is done:
+${s}
+Waiting for browser sign-in to finish...`)}else r.emitInfo(`${l} sign-in started. Finish the login in your browser, then come back here. Waiting for browser sign-in to finish...`);let c=await Yo(o,r);return D(c)?c:c.status==="verified"||c.status==="recovered"?await tt(c.email,{...c},n,r,i==="recovery"?`Recovered access for ${c.email} through ${l}.`:`Verified ${c.email} through ${l}.`):c.status==="already_registered"?f(c,c.linkedAccount===!0?`${l} is now linked to ${c.email}. Run \`skills-layer login\` to sign in.`:`${c.email} is already registered. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,n.json,r):c.status==="linked"?f(c,`${l} sign-in is now connected.`,n.json,r):Wo(c)?y(ea(c),n.json):y("Social auth completed with an unexpected response.",n.json)}function D(e){return R(e)&&typeof e.exitCode=="number"&&typeof e.stdout=="string"&&typeof e.stderr=="string"}function Vo(e){try{let t=JSON.parse(e);return R(t)?t.data:void 0}catch{return}}function Wo(e){return e.status==="registration_required"||e.status==="state_expired"||e.status==="provider_mismatch"||e.status==="identity_conflict"||e.status==="email_required"||e.status==="failed"}async function Yo(e,t){for(let n=0;n<120;n+=1)try{let r=await P(t,`/api/v1/identity/social/status/${encodeURIComponent(e)}`),i=a(r,"status")??"failed";if(i==="pending"){await t.sleep(1500);continue}return(i==="verified"||i==="recovered")&&a(r,"email")&&a(r,"role")?{status:i,email:a(r,"email"),role:a(r,"role"),roles:ee(r,"roles"),userId:a(r,"userId"),apiKey:a(r,"apiKey"),keyPrefix:a(r,"keyPrefix"),emailDelivery:a(r,"emailDelivery")}:i==="already_registered"&&a(r,"email")&&a(r,"role")?{status:i,email:a(r,"email"),role:a(r,"role"),roles:ee(r,"roles"),linkedAccount:typeof r.linkedAccount=="boolean"?r.linkedAccount:void 0}:i==="linked"?{status:i}:i==="registration_required"||i==="state_expired"||i==="provider_mismatch"||i==="identity_conflict"||i==="email_required"||i==="failed"?{status:i,error:a(r,"error")}:y("Social auth completed with an unexpected response.",!1)}catch(r){if(r instanceof E&&(r.status===404||r.status===429)){await t.sleep(1500);continue}return y(ue(r),!1)}return y("Timed out while waiting for social auth to complete.",!1)}async function Qo(e,t){for(let n=0;n<120;n+=1)try{let i=(await P(t,"/api/v1/purchases",{headers:T(t.apiKey,t.authBlockedMessage)})).results?.find(s=>s.purchaseId===e);if(!i?.status||i.status==="pending"||i.status==="requires_action"){await t.sleep(1500);continue}return{status:i.status,purchaseId:e}}catch(r){if(r instanceof E&&r.status===429){await t.sleep(1500);continue}return y(ue(r),!1)}return y("Timed out while waiting for purchase confirmation.",!1)}async function Zo(e,t){for(let n=0;n<120;n+=1)try{let r=await P(t,`/api/v1/me/private-skill-charges/${encodeURIComponent(e)}`,{headers:T(t.apiKey,t.authBlockedMessage)}),i=a(r,"status");if(!i||i==="checkout_required"||i==="pending"||i==="requires_action"){await t.sleep(1500);continue}return{...r,status:i}}catch(r){if(r instanceof E&&r.status===429){await t.sleep(1500);continue}return y(ue(r),!1)}return y("Timed out while waiting for payment confirmation.",!1)}function Xo(e){let t=C(e,"accountLink");return(t?a(t,"url"):void 0)??a(e,"url")??a(e,"setupUrl")}function ea(e){return e.status==="registration_required"?e.error??"No verified account exists for this social identity. Use `skills-layer register` first.":e.status==="state_expired"?"Social auth expired before completion. Start the flow again.":e.status==="provider_mismatch"?"The browser completed a different social provider than the one the CLI started.":e.status==="identity_conflict"?e.error??"This social identity is already linked to another account.":e.status==="email_required"?e.error??"This social profile did not provide an email address.":e.error??"Social auth could not be completed."}async function je(e,t,n={}){let i=n.forceProfileValidation===!0||!n.knownEmail||!n.knownRole?await P({...e,apiKey:t},"/api/v1/me",{headers:{...T(t),...n.notifyLogin?{"x-skills-layer-session-intent":"login"}:{}}}):{userId:n.knownUserId,email:n.knownEmail,role:n.knownRole,roles:n.knownRoles},s=a(i,"email")??n.knownEmail??"unknown";if(n.expectedEmail&&s.toLowerCase()!==n.expectedEmail.toLowerCase())throw new Error(`The entered API key belongs to ${s}, not ${n.expectedEmail}. Use the API key emailed to ${n.expectedEmail}.`);let o=await P({...e,apiKey:t},"/api/v1/capabilities",{headers:T(t)}),l={version:cr,baseUrl:e.baseUrl,apiKey:t,edition:a(o,"edition")??a(i,"edition")??"saas",userId:a(i,"userId")??n.knownUserId,email:s,role:a(i,"role")??n.knownRole??"user",roles:ee(i,"roles")??n.knownRoles,lastSelectedAgent:e.config?.lastSelectedAgent,savedAt:e.now()};return await tn(e.paths.configPath,l,e),await K(e.paths.backendPreferencePath,{version:Kt,preferredBaseUrl:e.baseUrl,savedAt:e.now()}),l}function Zn(e,t){let n=st(e.actionJson,"action-json");if(n&&typeof n=="object"&&!Array.isArray(n))return n;let r=g(e.action);return t==="incident"?{type:"file_write",path:g(e.path)??".skills-layer/incidents/guardian-incident.json"}:r==="file_read"||r==="file_write"?{type:r,path:g(e.path)??"."}:r==="shell_command"?{type:"shell_command",command:"unspecified"}:{type:"api_call",...r?{target:r}:{}}}async function S(e,t,n,r,i={}){let s=i.authenticated?T(n.apiKey,n.authBlockedMessage):Oe(n.apiKey);return await nt(e,{headers:s},t,n,r)}async function ta(e,t){let n=await P(t,"/api/v1/doctor",{headers:Oe(t.apiKey)}),r=await Ne(t),i=await Ro(t),s=[...Mr(n),_o(r,i)];return f({...n,guardian:{...r,policy:i},checks:s},"Doctor checks loaded.",e.json,t)}async function N(e,t,n,r,i){return await nt(e,{method:"POST",headers:_(r.apiKey),body:JSON.stringify(A(t))},n,r,i)}async function Ee(e,t,n,r,i){return await nt(e,{method:"PATCH",headers:_(r.apiKey),body:JSON.stringify(A(t))},n,r,i)}async function nt(e,t,n,r,i){let s=await P(r,e,t);return f(s,i,n.json,r)}async function P(e,t,n={}){let r=await e.fetchFn(`${e.baseUrl}${t}`,n).catch(o=>{throw new Error(`Unable to reach ${e.baseUrl}. ${ue(o)}`)});if(!r.ok)throw await na(r);let i=await r.text();if(!i)return{};let s=JSON.parse(i);return s&&typeof s=="object"&&!Array.isArray(s)&&"data"in s?s.data:s}async function na(e){let t=await e.text();if(t)try{let n=JSON.parse(t);return new E(e.status,a(n,"error")??(e.statusText||"Request failed"),n)}catch{return new E(e.status,t)}return new E(e.status,e.statusText||"Request failed")}function T(e,t){if(t)throw new Error(t);if(!e)throw new Error("This command requires login. Run `skills-layer login` first.");return{authorization:`Bearer ${e}`}}function Oe(e){return e?{authorization:`Bearer ${e}`}:{}}function _(e){return{"content-type":"application/json",...Oe(e)}}async function rt(e){let t=await Ui(e);if(t.isFile())return[{path:G(e),content:await Be(e,"utf8")}];if(!t.isDirectory())throw new Error(`Unsupported path: ${e}`);let n=[];if(await Ur(e,e,n),n.length===0)throw new Error(`No readable files found in ${e}.`);return n.sort((r,i)=>r.path.localeCompare(i.path))}async function Ur(e,t,n){for(let r of await ar(t,{withFileTypes:!0})){if(ra(r.name))continue;let i=I(t,r.name);if(r.isDirectory()){await Ur(e,i,n);continue}if(!r.isFile())continue;let s=Ie(e,i).split("\\").join("/");try{n.push({path:s,content:await Be(i,"utf8")})}catch{continue}}}function ra(e){return e===".git"||e==="node_modules"||e==="coverage"||e===ia()||e==="dist"}function ia(){return[46,68,83,95,83,116,111,114,101].map(e=>String.fromCharCode(e)).join("")}async function Et(e,t){if(/^https?:\/\//u.test(e)||/^[a-z]+:/iu.test(e))return;let n=se(t,e);try{return await sr(n),{sourceMetadata:{kind:"local",input:e,canonicalSource:`local:${e}`},files:await rt(n)}}catch{return}}async function kt(e,t){let n=sa(t);if(n.length===0)return t;let r=[];for(let i of n){let s=Lr(i.path),o=se(e.cwd,s),l=Ie(e.cwd,o);if(!l||l.startsWith("..")||ve.isAbsolute(l))throw new Error(`Cloud install plan attempted to write outside the current workspace: ${i.path}`);if(await re(o,i.content),r.push({path:s,bytes:new TextEncoder().encode(i.content).length}),G(s).toLowerCase()==="skill.md"){let c=a(t,"skillSlug")??a(t,"slug")??G(ie(s)),u=await Zt({backend:e,skillSlug:c,version:a(t,"version"),skillDocumentPath:o,skillDocumentContent:i.content});r.push(u)}}return{...t,materializedWrites:r}}function sa(e){return[...wt(e.localWrites),...wt(C(e,"installPlan")?.localWrites),...wt(C(e,"materializationPlan")?.localWrites)]}function wt(e){return Array.isArray(e)?e.flatMap(t=>{if(!t||typeof t!="object"||Array.isArray(t))return[];let n=t,r=g(n.path),i=typeof n.content=="string"?n.content:void 0;return r&&i!==void 0?[{path:r,content:i}]:[]}):[]}function Lr(e){let t=e.replaceAll("\\","/").replace(/^\.\/+/u,"");if(!t||t.includes("\0")||Ft.isAbsolute(t)||ve.isAbsolute(e)||t.split("/").includes(".."))throw new Error(`Cloud install plan returned an unsafe local write path: ${e}`);return t}async function oa(e,t){let n=a(e,"apiKey");if(!n)return;let r={version:cr,baseUrl:t.baseUrl,apiKey:n,edition:a(e,"edition")??t.config?.edition??"saas",userId:a(e,"userId")??t.config?.userId,email:a(e,"email")??t.config?.email??"unknown",role:a(e,"role")??t.config?.role??"user",roles:ee(e,"roles")??t.config?.roles,lastSelectedAgent:t.config?.lastSelectedAgent,savedAt:t.now()};await tn(t.paths.configPath,r,t)}async function pe(e){let t=await z(e.paths.installsPath);if(!R(t))return{version:An,installs:{}};let n=R(t.installs)?Xn(t.installs):R(t.skills)?Xn(t.skills):{};return{version:typeof t.version=="number"?t.version:An,installs:n}}async function Tr(e,t){await K(e.paths.installsPath,t)}async function Qe(e,t,n){let r=a(t,"skillSlug")??a(t,"slug")??n,i=await pe(e);i.installs[r]={skillSlug:r,...t,savedAt:e.now()},await Tr(e,i)}function Xn(e){let t={};for(let[n,r]of Object.entries(e))t[n]=R(r)?r:{skillSlug:n,value:r};return t}var O=5;function f(e,t,n,r){let s={status:e&&typeof e=="object"&&!Array.isArray(e)&&typeof e.status=="string"?String(e.status):"ok",summary:t,why:null,nextAction:null,nextStep:null,data:e,warnings:[],links:[],reasonCode:null,handoff:null};return{exitCode:0,stdout:n?JSON.stringify(s,null,2):aa(e,t,r),stderr:""}}function aa(e,t,n){let r=V(n);if(R(e)){if(t==="Status loaded."&&er(e))return ua(e,t,r);if(t==="Doctor checks loaded."&&er(e))return da(e,t,r);if(t==="Creator payout profile loaded.")return ja(e,t,r);if(t==="Creator earnings loaded."||t==="Earnings loaded.")return Ea(e,"Creator earnings loaded.",r);if(t==="Creator payouts loaded."||t==="Payouts loaded.")return Ua(e,"Creator payouts loaded.",r);if(t==="Guardian check complete.")return la(e,t,r)}let i=[`${r.ok("OK")} ${t}`];if(R(e)){let s=Fr(e,r);s.length>0&&i.push("",...s);let o=Dr(e);o.length>0&&i.push("",r.section("Next"),...o.map(l=>`  ${r.arrow} ${l}`))}return i.join(`
+`)}function la(e,t,n){let r=C(e,"decision"),i=C(e,"enforcement"),s=C(e,"auditEvent"),o=Y(r,"status")??Y(i,"status")??"unknown",l=Y(i,"actionType")??Y(s,"actionType")??"action",c=Y(r,"capability")??Y(i,"capability")??"not specified",u=Y(r,"reasonCode")??Y(i,"reasonCode")??"not specified",d=Y(r,"message")??Y(i,"message")??"Guardian policy resolved this action.",m=Y(s,"skillSlug")??"unknown",k=Y(s,"version")??"unknown",p=vt(i,"canExecute"),h=vt(i,"auditRequired"),v=vt(i,"telemetryRequired"),b=o==="blocked"?"BLOCKED":o==="allowed"?"ALLOWED":"WARNING",x=[`${n.ok("OK")} ${t}`,"",n.section(`${b} ${ca(l)}`),`  ${n.label("Skill")}: ${m}`,`  ${n.label("Version")}: ${k}`,`  ${n.label("Capability")}: ${c}`,`  ${n.label("Reason")}: ${d}`,`  ${n.label("Reason code")}: ${u}`,`  ${n.label("Can execute")}: ${p===!0?"yes":"no"}`,`  ${n.label("Audit required")}: ${h===!1?"no":"yes"}`,`  ${n.label("Cloud telemetry")}: ${v===!0?"yes":"no"}`,"",n.section("Next")];return o==="blocked"?x.push(`  ${n.arrow} Do not run this action.`,`  ${n.arrow} Review \`skills-layer trust ${m}\`.`,`  ${n.arrow} Run \`skills-layer guardian incident --skill ${m} --version ${k} --path <installed-skill-path> --reason "<reason>"\` if this was unexpected.`):x.push(`  ${n.arrow} Continue only with the action Guardian evaluated.`,`  ${n.arrow} Re-run guardian check if the action changes.`),x.join(`
+`)}function vt(e,t){if(R(e))return typeof e[t]=="boolean"?e[t]:void 0}function Y(e,t){return R(e)?a(e,t):void 0}function ca(e){return e.split(/[_-]+/u).filter(Boolean).map(t=>`${t[0]?.toUpperCase()??""}${t.slice(1)}`).join(" ")}function er(e){return!!(C(e,"backend")&&C(e,"auth")&&Array.isArray(e.checks))}function ua(e,t,n){let r=[`${n.ok("OK")} ${t}`,"",n.section("Readiness")],i=a(e,"summary");i&&r.push(`  ${i}`);let s=C(e,"backend"),o=s?fa(s):void 0;o&&r.push(`  ${n.label("Backend")}: ${o}`);let l=C(e,"auth"),c=l?ha(l):void 0;c&&r.push(`  ${n.label("Account")}: ${c}`);let u=l?oe(l,"workspaceCount"):void 0;u!==void 0&&r.push(`  ${n.label("Workspaces")}: ${u}`);let d=l?oe(l,"libraryCount"):void 0;d!==void 0&&r.push(`  ${n.label("Owned skills")}: ${d}`);let m=Br(e);return m.length>0&&r.push("",n.section("Next"),...m.map(k=>`  ${n.arrow} ${k}`)),r.push(`  ${n.arrow} Run \`skills-layer doctor\` for diagnostics.`),r.join(`
+`)}function da(e,t,n){let r=[`${n.ok("OK")} ${t}`,"",n.section("Diagnostics")],i=a(e,"summary");i&&r.push(`  ${i}`);let s=a(e,"status");s&&r.push(`  ${n.label("Status")}: ${s}`);let o=Mr(e),l=o.filter(d=>ya(a(d,"status"))),c=o.filter(d=>a(d,"status")!=="pass");r.push(l.length===0?"  No blocking issues found.":`  ${l.length} check${l.length===1?"":"s"} need attention.`),l.length===0&&c.length>0&&r.push(`  Advisory checks needing attention: ${c.length}.`),r.push("",n.section(`Checks (${o.length})`)),o.length===0&&r.push(`  ${n.muted("No checks returned by the backend.")}`),o.forEach((d,m)=>{let k=a(d,"status")??"unknown",p=a(d,"title")??a(d,"id")??`Check ${m+1}`;r.push(`${m+1}. ${n.label(`[${k}] ${p}`)}`);let h=a(d,"summary");h&&r.push(`   ${h}`);let v=a(d,"why");if(v&&r.push(`   ${n.label("Why")}: ${v}`),k!=="pass"){let b=a(d,"nextStep");b&&r.push(`   ${n.label("Fix")}: ${b}`);let x=a(d,"recommendedCommand");x&&r.push(`   ${n.label("Try")}: ${x}`)}});let u=Br(e);return u.length>0&&r.push("",n.section(l.length>0?"Recommended Fix":"Next"),...u.map(d=>`  ${n.arrow} ${d}`)),r.join(`
+`)}function ga(e,t,n,r){let i=[`${n.ok("OK")} ${t}`],s=ee(e,"requestedSlugs");s&&s.length>0&&i.push("",n.section("Requested"),`  ${s.join(", ")}`);let o=le(e.results);i.push("",n.section(`Comparison (${o.length})`)),o.length===0&&i.push(`  ${n.muted("No comparable skills returned.")}`),o.forEach((d,m)=>{let k=Lt(d)??`Skill ${m+1}`;i.push(`${m+1}. ${k}`);let p=pa(d);p&&i.push(`   ${p}`);let h=Gr(d);h&&i.push(`   ${n.label("summary")}: ${r?h.replace(/\s+/gu," ").trim():Le(h)}`)});let l=le(e.missing);l.length>0&&(i.push("",n.section(`Missing (${l.length})`)),l.forEach((d,m)=>{let k=a(d,"slug")??a(d,"skillSlug")??Lt(d)??`Entry ${m+1}`,p=a(d,"reason")??a(d,"status");i.push(`${m+1}. ${p?`${k} - ${p}`:k}`)}));let c=ee(e,"guidance")??ke(e.guidance);c.length>0&&i.push("",n.section("Guidance"),...c.slice(0,3).map(d=>`  ${n.arrow} ${Le(d)}`));let u=ma(o);return u.length>0&&i.push("",n.section("Next"),...u.map(d=>`  ${n.arrow} ${d}`)),i.join(`
+`)}function pa(e){let t=C(e,"securityPosture"),n=a(e,"trust")??a(e,"trustStatus")??a(e,"trustLabel")??(t?a(t,"label"):void 0),r=e.score??e.securityScore??(t?t.securityScore:void 0),i=a(e,"risk")??a(e,"runtimeRisk")??(t?a(t,"runtimeRisk"):void 0);return[["slug",a(e,"slug")??a(e,"skillSlug")],["version",a(e,"version")??a(e,"currentVersion")],["category",a(e,"category")],["type",a(e,"type")??a(e,"skillType")],["trust",n],["score",r],["risk",i]].flatMap(([o,l])=>l==null||l===""?[]:[`${o}: ${J(String(o),l)}`]).join("; ")}function ma(e){let t=[];for(let n of e.slice(0,5)){let r=a(n,"slug")??a(n,"skillSlug");r&&t.push(`skills-layer show ${r}`,`skills-layer trust ${r}`,`skills-layer install ${r}`)}return t}function fa(e){let t=a(e,"edition"),n=a(e,"baseUrl");return t&&n?`${t} at ${n}`:t??n}function ha(e){let t=a(e,"state");if(t&&t!=="authenticated")return t==="anonymous"?"not signed in":t;let n=a(e,"email"),r=ee(e,"roles");return n&&r&&r.length>0?`${n} (${r.join(", ")})`:n??a(e,"role")}function Br(e){let t=[],n=a(e,"recommendedCommand");n&&t.push(n);let r=a(e,"nextStep");return r&&t.push(r),t}function Mr(e){return Array.isArray(e.checks)?e.checks.filter(R):[]}function ya(e){return e!==void 0&&e!=="pass"&&e!=="warn"&&e!=="advisory"}function le(e){return Array.isArray(e)?e.filter(R):[]}function ke(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}function ka(e){let t=e.commerce===!0;return{status:t?"available":"unavailable",summary:t?"Marketplace purchases, invoices, refunds, and creator commerce flows are available.":"Marketplace commerce is not available on this backend.",availableWorkflows:t?["Browse skills with `skills-layer featured` or `skills-layer search <query>`.","Start purchase handoff with `skills-layer buy <skill-slug>`.","Review account purchases with `skills-layer purchases list`."]:["Browse and install available free skills.","Use `skills-layer help topic install` for install guidance."]}}var wa={"core.identity":"Account and sign-in","core.catalog":"Catalog discovery","core.validation":"Creator validation","core.creator":"Creator submissions","core.library":"Owned skills","core.workspace":"Workspace rollout","core.guardian":"Runtime trust checks","core.source":"Source installs","core.discovery":"Catalog discovery","marketplace.commerce":"Marketplace commerce","marketplace.reviews":"Reviews and issues","marketplace.payouts":"Creator earnings"};function va(e){let t=ke(e.capabilities);return{status:"ok",edition:a(e,"edition")??"unknown",summary:"Public product capabilities available on the selected backend.",capabilities:t.map(n=>({name:wa[n]??ot(n.replace(/^[^.]+\./u,"").replace(/[._-]+/gu," ")),available:!0})),count:t.length}}function Pa(e,t){let n=g(e);if(!n)return;let r=Number(n);return!Number.isInteger(r)||r<=0?y("help optimize-tokens --max-characters must be a positive integer.",t):r<120||r>4e3?y("help optimize-tokens --max-characters must be between 120 and 4000.",t):r}function ba(e,t,n){let r=V(n),i=C(e,"validation")??e,s=C(i,"parsedSkill")??C(e,"parsedSkill"),o=s?C(s,"frontmatter"):void 0,l=a(e,"skillSlug")??(o?a(o,"name"):void 0),c=i.valid===!0||e.valid===!0,u=Pt(i,e,"issues"),d=Pt(i,e,"warnings"),m=Pt(i,e,"advice"),k=C(i,"stats")??C(e,"stats"),p=[`${r.ok("OK")} Validation complete.`,"",r.section("Bundle")];if(p.push(`  ${r.label("Path")}: ${t}`),l&&p.push(`  ${r.label("Skill")}: ${l}`),p.push(`  ${r.label("Readiness")}: ${c?"ready for dry-run submission":"needs changes before submission"}`),p.push("",r.section("Checks")),p.push(`  ${r.arrow} SKILL.md structure and frontmatter`),p.push(`  ${r.arrow} Required bundle files and supported directories`),p.push(`  ${r.arrow} Secret hygiene, unsafe script signals, and trust-review readiness`),p.push(`  ${r.arrow} Trigger quality inputs for should-trigger / should-not-trigger testing`),k){let h=k.fileCount??k.files??e.fileCount,v=k.bodyWordCount??k.bodyWords??e.bodyWordCount;p.push("",r.section("File Summary")),h!==void 0&&p.push(`  ${r.label("File count")}: ${J("fileCount",h)}`),v!==void 0&&p.push(`  ${r.label("Body words")}: ${J("bodyWordCount",v)}`)}return p.push("",...bt("Issues",u,r,"No blocking issues found.")),p.push("",...bt("Warnings",d,r,"No warnings returned.")),p.push("",...bt("Advice",m,r,"No extra advice returned.")),p.push("",r.section("Next")),p.push(`  ${r.arrow} skills-layer preview-trigger ${t} --should-trigger "<prompt>" --should-not-trigger "<prompt>"`),p.push(`  ${r.arrow} skills-layer creator submit ${t} --dry-run`),p.join(`
+`)}function Pt(e,t,n){let r=Array.isArray(e[n])?e[n]:[],i=Array.isArray(t[n])?t[n]:[];return r.length>0?r:i}function bt(e,t,n,r){let i=[n.section(`${e} (${t.length})`)];return t.length===0?(i.push(`  ${n.muted(r)}`),i):(t.slice(0,O).forEach((s,o)=>{i.push(`${o+1}. ${Nr(s)}`)}),i)}function Nr(e){return R(e)?(a(e,"message")??a(e,"title")??a(e,"code")??a(e,"path")??Ue(e))||"Details available with --json":J("",e)}function Sa(e,t,n){let r=V(n),i=Ca(e),s=Ra(e),o=[`${r.ok("OK")} Trigger preview complete.`,"",r.section("Bundle"),`  ${r.label("Path")}: ${t}`],l=a(e,"skillSlug")??a(e,"slug");return l&&o.push(`  ${r.label("Skill")}: ${l}`),o.push("",r.section(`Prompt Results (${i.length})`)),i.length===0&&o.push(`  ${r.muted("No prompt results returned. Use --json to inspect the raw backend response.")}`),i.slice(0,O).forEach((c,u)=>{o.push(`${u+1}. ${xa(c,u)}`)}),o.push("",r.section(`Guidance (${s.length})`)),s.length===0&&o.push(`  ${r.muted("No extra trigger guidance returned.")}`),s.slice(0,O).forEach((c,u)=>{o.push(`${u+1}. ${c}`)}),o.push("",r.section("Next")),o.push(`  ${r.arrow} skills-layer validate ${t}`),o.push(`  ${r.arrow} skills-layer creator submit ${t} --dry-run`),o.join(`
+`)}function Ca(e){return[...le(e.promptResults),...le(e.results),...le(e.shouldTriggerResults),...le(e.shouldNotTriggerResults),...le(e.paraphraseResults)]}function Ra(e){let t=ke(e.guidance),n=le(e.guidance).map(r=>Nr(r));return[...t,...n]}function xa(e,t){let n=a(e,"prompt")??a(e,"text")??a(e,"input")??`Prompt ${t+1}`,r=$a(e),i=_a(e),s=Aa(e),o=e.score??e.confidence,l=a(e,"reason")??a(e,"explanation")??a(e,"message");return[`"${Le(n)}"`,r?`expected: ${r}`:void 0,i?`actual: ${i}`:void 0,s,o!==void 0?`score: ${J("score",o)}`:void 0,l?`reason: ${Le(l)}`:void 0].filter(c=>!!c).join("; ")}function $a(e){return typeof e.shouldTrigger=="boolean"?e.shouldTrigger?"should trigger":"should not trigger":typeof e.expectedTrigger=="boolean"?e.expectedTrigger?"should trigger":"should not trigger":a(e,"expected")??a(e,"kind")??a(e,"type")}function _a(e){return typeof e.triggered=="boolean"?e.triggered?"triggered":"did not trigger":typeof e.actualTrigger=="boolean"?e.actualTrigger?"triggered":"did not trigger":a(e,"actual")??a(e,"classification")??a(e,"decision")}function Aa(e){return typeof e.passed=="boolean"?e.passed?"pass":"fail":typeof e.pass=="boolean"?e.pass?"pass":"fail":a(e,"status")}function Ia(e,t,n,r){let i=V(r),s=a(e,"skillSlug")??G(t),o=[`${i.ok("OK")} Created ${n}.`,"",i.section("Local Skill")];o.push(`  ${i.label("Path")}: ${n}`),o.push(`  ${i.label("Skill")}: ${s}`);let l=a(e,"skillType"),c=a(e,"category");return l&&o.push(`  ${i.label("Type")}: ${l}`),c&&o.push(`  ${i.label("Category")}: ${c}`),o.push("",i.section("Next")),o.push(`  ${i.arrow} Edit ${n}`),o.push(`  ${i.arrow} skills-layer validate ${t}`),o.push(`  ${i.arrow} skills-layer preview-trigger ${t} --should-trigger "<prompt>" --should-not-trigger "<prompt>"`),o.push(`  ${i.arrow} skills-layer creator submit ${t} --dry-run`),o.join(`
+`)}function ja(e,t,n){let r=C(e,"profile")??e,i=St(r,"requirementsCurrentlyDue"),s=St(r,"requirementsPastDue"),o=St(r,"requirementsPendingVerification"),l=["payouts","Enabled"].join(""),c=r.readyForPayouts??r[l],u=c===!0,d=[`${n.ok("OK")} ${t}`,"",n.section("Payout Profile")];return d.push(`  ${n.label("Status")}: ${We(a(r,"status"))}`),d.push(`  ${n.label("Ready for payouts")}: ${nr(c)}`),d.push(`  ${n.label("Account details submitted")}: ${nr(r.detailsSubmitted)}`),d.push(`  ${n.label("Currency")}: ${We(a(r,"currency")?.toUpperCase())}`),d.push(`  ${n.label("Country")}: ${We(a(r,"country")?.toUpperCase())}`),d.push(`  ${n.label("Minimum withdrawal")}: ${La(r)}`),d.push(`  ${n.label("Updated at")}: ${We(a(r,"updatedAt"))}`),d.push("",n.section("Requirements")),d.push(`  ${n.label("Currently due")}: ${Ct(i)}`),d.push(`  ${n.label("Past due")}: ${Ct(s)}`),d.push(`  ${n.label("Pending verification")}: ${Ct(o)}`),d.push("",n.section("Next")),u?(d.push(`  ${n.arrow} skills-layer creator earnings`),d.push(`  ${n.arrow} skills-layer creator withdraw --amount-cents <amount>`),d.push(`  ${n.arrow} skills-layer creator payouts`)):(d.push(`  ${n.arrow} skills-layer creator payout-link`),d.push(`  ${n.arrow} skills-layer creator earnings`)),d.join(`
+`)}function Ea(e,t,n){let r=Ut(e),i=en(e,"withdrawableBalanceCents"),s=[`${n.ok("OK")} ${t}`,"",n.section("Earnings Summary")];return s.push(`  ${n.label("Gross sales")}: ${q(e,"successfulSalesCents",r)}`),s.push(`  ${n.label("Platform fees")}: ${q(e,"platformFeeCents",r)}`),s.push(`  ${n.label("Refunds requested")}: ${q(e,"refundRequestedCents",r)}`),s.push(`  ${n.label("Refunded")}: ${q(e,"refundedCents",r)}`),s.push(`  ${n.label("Estimated available")}: ${q(e,"estimatedAvailableCents",r)}`),s.push(`  ${n.label("Withdrawable now")}: ${q(e,"withdrawableBalanceCents",r)}`),s.push(`  ${n.label("Held balance")}: ${q(e,"heldBalanceCents",r)}`),s.push(`  ${n.label("Refund exposure")}: ${q(e,"refundExposureCents",r)}`),s.push("",n.section("Activity")),s.push(`  ${n.label("Successful purchases")}: ${tr(e,"successfulPurchaseCount")}`),s.push(`  ${n.label("Refund requests")}: ${tr(e,"refundRequestedCount")}`),s.push(`  ${n.label("Pending payouts")}: ${q(e,"pendingPayoutCents",r)}`),s.push(`  ${n.label("Completed payouts")}: ${q(e,"completedPayoutCents",r)}`),s.push("",n.section("Guidance")),i>0?(s.push("1. You have a withdrawable balance available."),s.push("2. Confirm payout setup is ready before requesting withdrawal.")):(s.push("1. No withdrawable balance yet."),s.push("2. Sales will appear here after paid purchases settle.")),s.push("",n.section("Next")),i>0&&s.push(`  ${n.arrow} skills-layer creator withdraw --amount-cents ${i}`),s.push(`  ${n.arrow} skills-layer creator payout-profile`),s.push(`  ${n.arrow} skills-layer creator payouts`),s.join(`
+`)}function Ua(e,t,n){let r=Array.isArray(e.results)?e.results:[],i=Ut(e,r),s=en(e,"withdrawableBalanceCents"),o=[`${n.ok("OK")} ${t}`,"",n.section("Payout History")];return o.push(`  ${n.label("Withdrawable now")}: ${q(e,"withdrawableBalanceCents",i)}`),o.push(`  ${n.label("Pending payouts")}: ${q(e,"pendingPayoutCents",i)}`),o.push(`  ${n.label("Completed payouts")}: ${q(e,"completedPayoutCents",i)}`),o.push("",n.section(`Requests (${r.length})`)),r.length===0?o.push(`  ${n.muted("No payout requests yet.")}`):(r.slice(0,O).forEach((l,c)=>{if(!R(l)){o.push(`${c+1}. ${J("",l)}`);return}let u=Ut(l,void 0,i),d=a(l,"payoutId")??a(l,"id")??`Payout ${c+1}`,m=a(l,"status")??"unknown",k=q(l,"amountCents",u),p=a(l,"requestedAt"),h=a(l,"completedAt"),v=a(l,"reason");o.push(`${c+1}. ${d}`),o.push(`   ${n.label("Amount")}: ${k}; ${n.label("Status")}: ${m}`),p&&o.push(`   ${n.label("Requested")}: ${p}`),h&&o.push(`   ${n.label("Completed")}: ${h}`),v&&o.push(`   ${n.label("Reason")}: ${v}`)}),r.length>O&&o.push(`  ${n.muted(`... ${r.length-O} more`)}`)),o.push("",n.section("Guidance")),r.length===0?o.push("1. Payouts appear here after you request a withdrawal."):o.push("1. Use this history to track requested, processing, paid, or failed payouts."),o.push("2. Check payout profile if setup or verification looks incomplete."),o.push("",n.section("Next")),s>0&&o.push(`  ${n.arrow} skills-layer creator withdraw --amount-cents ${s}`),o.push(`  ${n.arrow} skills-layer creator earnings`),o.push(`  ${n.arrow} skills-layer creator payout-profile`),o.join(`
+`)}function Ut(e,t,n="GBP"){let r=a(e,"currency");if(r)return r.toUpperCase();let i=t?.find(R);if(i){let s=a(i,"currency");if(s)return s.toUpperCase()}return n}function en(e,t){return oe(e,t)??0}function tr(e,t){return oe(e,t)??0}function q(e,t,n){return`${Or(en(e,t))} ${n}`}function St(e,t){return(ee(e,t)??[]).map(n=>n.replace(/[._-]+/gu," "))}function Ct(e){return e.length>0?e.join(", "):"none"}function nr(e){return e===!0?"yes":e===!1?"no":"unknown"}function We(e){return e??"none"}function La(e){let t=oe(e,"minimumWithdrawalAmountCents"),n=a(e,"currency")?.toUpperCase()??"minor units";return t===void 0?"none":`${Or(t)} ${n}`}function Or(e){return(e/100).toFixed(2).replace(/\.00$/u,"").replace(/(\.\d)0$/u,"$1")}function V(e){let t=Ta(e);return{ok:n=>t?ye(32,n):n,section:n=>t?ye(1,ye(36,n)):n,label:n=>t?ye(1,n):n,muted:n=>t?ye(2,n):n,arrow:t?ye(36,"->"):"->"}}function Ta(e){let t=e?.env??{};if(t.NO_COLOR)return!1;let n=t.FORCE_COLOR;return n&&n!=="0"?!0:!!e?.stdoutIsTty&&t.TERM!=="dumb"&&n!=="0"}function ye(e,t){return`\x1B[${e}m${t}\x1B[0m`}function Fr(e,t){let n=[],r=Ma(e,t);r.length>0&&n.push(...r);for(let[i,s]of Fa(e))if(Array.isArray(s))n.push(...Ba(i,s,t));else if(R(s)){let o=Ue(s);o&&n.push(`  ${t.label(Tt(i))}: ${o}`)}else n.push(`  ${t.label(Tt(i))}: ${J(i,s)}`);return n}function Ba(e,t,n){let r=qa(e),i=[n.section(`${r} (${t.length})`)];return t.length===0?(i.push(`  ${n.muted("No entries.")}`),i):(t.slice(0,O).forEach((s,o)=>{i.push(...qr(s,o,n))}),t.length>O&&i.push(`  ${n.muted(`... ${t.length-O} more`)}`),i)}function qr(e,t,n){if(!R(e))return[`${t+1}. ${J("",e)}`];let r=Lt(e)??Q(Ue(e))??`Item ${t+1}`,i=[`${t+1}. ${r}`],s=Gr(e);s&&i.push(`   ${s}`);let o=Ue(e);return o&&i.push(`   ${o}`),i}function Ma(e,t){let n=[],r=e.securityScore,i=a(e,"recommendation"),s=C(e,"capabilityProfile"),o=s?a(s,"runtimeRisk"):void 0;return(r!==void 0||i||o)&&(n.push(t.section("Trust")),r!==void 0&&n.push(`  ${t.label("Security score")}: ${J("securityScore",r)}`),o&&n.push(`  ${t.label("Runtime risk")}: ${o}`),i&&n.push(`  ${t.label("Recommendation")}: ${i}`)),n}function Na(e,t,n){let r=V(n),i=a(e,"skillSlug")??t,s=a(e,"runtimeRisk")??(C(e,"capabilityProfile")?a(C(e,"capabilityProfile"),"runtimeRisk"):void 0),o=[`${r.ok("OK")} Creator security report loaded.`,"",r.section("Creator Security")];e.securityScore!==void 0&&o.push(`  ${r.label("Security score")}: ${J("securityScore",e.securityScore)}`),s&&o.push(`  ${r.label("Runtime risk")}: ${s}`);let l=a(e,"recommendation");l&&o.push(`  ${r.label("Recommendation")}: ${l}`),o.push(`  ${r.label("Skill")}: ${i}`);let c=a(e,"version");c&&o.push(`  ${r.label("Version")}: ${c}`);let u=["semantic","review","no","reviewable","findings"].join("_"),d=ke(e.reviewDegradedReasons).includes(u),m=ke(e.trustBadges).filter(h=>h==="capability-mismatch"),k=ke(e.trustBadges).filter(h=>h!=="capability-mismatch");(d||m.length>0)&&(o.push("",r.section("Creator Notes")),d&&o.push("1. Semantic review was not needed because there were no reviewable findings."),m.forEach((h,v)=>{o.push(`${d?v+2:v+1}. ${h==="capability-mismatch"?"Capability declaration needs review.":h}`)})),k.length>0&&(o.push("",r.section(`Trust badges (${k.length})`)),k.slice(0,O).forEach((h,v)=>o.push(`${v+1}. ${h}`)));let p=Array.isArray(e.findings)?e.findings:[];return o.push("",r.section(`Findings (${p.length})`)),p.length===0?o.push(`  ${r.muted("No entries.")}`):p.slice(0,O).forEach((h,v)=>{o.push(...qr(h,v,r))}),o.push("",r.section("Next")),o.push(`  ${r.arrow} skills-layer creator rescan-security ${i}`),o.push(`  ${r.arrow} skills-layer creator status ${i}`),o.push(`  ${r.arrow} skills-layer trust ${i}`),o.join(`
+`)}function Oa(e,t,n){let i=C(e,"report")??e,s=V(n),o=i.securityScore,l=a(i,"generatedAt")??a(i,"reportGeneratedAt"),c=Array.isArray(i.findings)?i.findings:void 0,u=[`${s.ok("OK")} Security rescan requested.`,"",s.section("Creator Security")];return u.push(`  ${s.label("Skill")}: ${a(i,"skillSlug")??t}`),o!==void 0&&u.push(`  ${s.label("Security score")}: ${J("securityScore",o)}`),c&&u.push(`  ${s.label("Findings")}: ${c.length}`),l&&u.push(`  ${s.label("Generated at")}: ${l}`),u.push("",s.section("Next")),u.push(`  ${s.arrow} skills-layer creator security-report ${t}`),u.push(`  ${s.arrow} skills-layer creator status ${t}`),u.join(`
+`)}function Fa(e){return Object.entries(e).filter(([t,n])=>Kr(t,n))}function Kr(e,t){let n=e.toLowerCase();return n==="status"||n==="securityscore"||n==="recommendation"||n==="capabilityprofile"||n.includes("apikey")||n.includes("secret")||n.includes("token")||n==="content"?!1:t!==void 0}function Ue(e){let n=[["id","id"],["name","name"],["keyPrefix","prefix"],["slug","slug"],["skillSlug","skill"],["currentVersion","version"],["version","version"],["category","category"],["skillType","type"],["type","type"],["visibility","visibility"],["status","status"],["count","count"],["email","email"],["role","role"],["selectedBackend","backend"],["selectedBaseUrl","base url"],["path","path"],["downloadUrl","download url"],["authorizationUrl","authorization url"],["checkoutUrl","checkout url"],["url","url"],["issueId","issue"],["reviewId","review"],["purchaseId","purchase"],["workspaceId","workspace"],["clientId","client"],["environment","environment"],["expiresAt","expires"],["lastUsedAt","last used"],["revocable","revocable"],["revokeCommand","revoke"],["deploymentId","deployment"],["source","source"],["scope","scope"],["agent","agent"],["bytes","bytes"],["fileCount","file count"],["bodyWordCount","body words"]].flatMap(([i,s])=>{if(!Kr(i,e[i]))return[];let o=e[i];return o===void 0?[]:[`${s}: ${J(i,o)}`]}),r=C(e,"securityPosture");if(r){let i=a(r,"label"),s=r.securityScore,o=a(r,"runtimeRisk");i&&n.push(`trust: ${i}`),s!==void 0&&n.push(`score: ${J("securityScore",s)}`),o&&n.push(`risk: ${o}`)}return n.join("; ")}function Gr(e){return a(e,"shortDescription")??a(e,"summary")??a(e,"description")??a(e,"message")}function Lt(e){return a(e,"displayName")??a(e,"name")??a(e,"title")??a(e,"slug")??a(e,"skillSlug")??a(e,"code")??a(e,"id")}function J(e,t){return e==="downloadUrl"?"<hidden; use --json or --output>":typeof t=="string"?Le(t):typeof t=="number"||typeof t=="boolean"?String(t):t===null?"none":Array.isArray(t)?`${t.length} item${t.length===1?"":"s"}`:R(t)?Ue(t)||"details available with --json":String(t)}function Le(e){let t=e.replace(/\s+/gu," ").trim();return t.length>160?`${t.slice(0,157)}...`:t}function qa(e){return ot(Tt(e))}function Tt(e){return e.replace(/([a-z0-9])([A-Z])/gu,"$1 $2").replace(/[_-]+/gu," ").toLowerCase()}function Dr(e){let t=Ka(e),n=t?[`skills-layer show ${t}`,`skills-layer trust ${t}`,`skills-layer install ${t}`]:[],r=typeof e.downloadUrl=="string",i=Array.isArray(e.materializedWrites)&&e.materializedWrites.length>0;return r&&n.push("Use --output <path> to write exports without printing temporary download URLs"),i&&n.push("Review the materialized files in this workspace"),e.valid===!0&&n.push("skills-layer creator submit <path> --dry-run"),n}function Ka(e){let t=a(e,"skillSlug")??a(e,"slug");if(t)return t;let n=e.results;if(Array.isArray(n)){for(let r of n)if(R(r)){let i=a(r,"skillSlug")??a(r,"slug");if(i)return i}}}function R(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function y(e,t){return{exitCode:1,stdout:"",stderr:t?JSON.stringify({status:"error",summary:e,why:null,nextAction:null,nextStep:null,data:{error:e},warnings:[],links:[],reasonCode:null,handoff:null},null,2):e}}function j(e,t,n,r){let i={status:a(e,"status")??"error",summary:t,why:a(e,"why")??null,nextAction:a(e,"nextAction")??null,nextStep:a(e,"nextStep")??null,data:e,warnings:Array.isArray(e.warnings)?e.warnings:[],links:Array.isArray(e.links)?e.links:[],reasonCode:r??a(e,"reasonCode")??null,handoff:e.handoff??null};return{exitCode:1,stdout:"",stderr:n?JSON.stringify(i,null,2):t}}function it(e,t){let n=e.details??{};return y(a(n,"error")??e.message,t)}async function z(e){try{return JSON.parse(await Be(e,"utf8"))}catch{return null}}async function Ga(e,t){let n=await z(e);return n?Rn(n,{env:t.env,platform:t.platform,store:t.credentialStore}):null}async function tn(e,t,n){let r=await Cn(t,{env:n.env,platform:n.platform,store:n.credentialStore});await K(e,r)}async function K(e,t){await Hr(ie(e)),await et(e,`${JSON.stringify(t,null,2)}
+`,{encoding:"utf8",mode:384}),await nn(e,384)}async function Hr(e){await Te(e,{recursive:!0,mode:448}),await nn(e,448)}async function nn(e,t){if(process.platform!=="win32")try{await or(e,t)}catch{}}async function re(e,t){await Te(ie(e),{recursive:!0}),await et(e,t,"utf8")}async function Bt(e,t){await Te(ie(e),{recursive:!0}),await et(e,t)}function Da(e=process.stdin,t=process.stdout,n=qt){return async r=>{if(!e.isTTY||!t.isTTY)throw new Error("Interactive prompt is not available in this environment.");let i=n({input:e,output:t});try{return(await i.question(r)).trim()}finally{i.close()}}}function Ha(e=process.stdin,t=process.stdout,n=qt){return async r=>{if(!e.isTTY||!t.isTTY)throw new Error("Interactive secret prompt is not available in this environment.");if(typeof e.setRawMode=="function"&&typeof e.on=="function"&&typeof e.off=="function")return new Promise((s,o)=>{let l=e,c=l.isRaw===!0,u="",d=!1,m=p=>{d||(d=!0,l.off("data",k),l.setRawMode(c),l.pause?.(),t.write(`
+`),p())},k=p=>{let h=typeof p=="string"?p:p.toString("utf8");for(let v of h){if(v==="\r"||v===`
+`){m(()=>s(u.trim()));return}if(v===""){m(()=>o(new Error("Interactive secret prompt cancelled.")));return}if(v==="\b"||v==="\x7F"){u.length>0&&(u=u.slice(0,-1),t.write("\b \b"));continue}u+=v,t.write("*")}};t.write(r),l.resume?.(),l.on("data",k),l.setRawMode(!0)});let i=n({input:e,output:t,terminal:!0});i.stdoutMuted=!0,i._writeToOutput=function(o){if(!this.stdoutMuted){t.write(o);return}if(o==="\b"||o==="\x7F"){t.write("\b \b");return}if(o!=="\r"&&o!==`
+`){let l=[...o].filter(c=>c!=="\r"&&c!==`
+`).length;l>0&&t.write("*".repeat(l))}};try{t.write(r);let s=await i.question("");return t.write(`
+`),s.trim()}finally{i.close()}}}function Ja(e=process.stdin,t=process.stdout,n=qt){return async(r,i)=>{if(i.length===0)throw new Error("Interactive selection has no available options.");if(!e.isTTY||!t.isTTY)throw new Error("Interactive selection is not available in this environment.");let s=e;if(typeof s.setRawMode=="function"&&typeof s.on=="function"&&typeof s.off=="function")return new Promise((l,c)=>{let u=0,d="",m=0,k=!1,p=s.isRaw===!0,h=()=>{m>0&&t.write(`\x1B[${m}F\x1B[J`),t.write(`${r}
+`);for(let[x,L]of i.entries())t.write(`${za(x===u)} ${x+1}. ${rr(L)}
+`);t.write(`Choice: ${d}
+`),t.write(`Use up/down arrows, type a number, then press Enter.
+`),m=i.length+3},v=x=>{k||(k=!0,s.off?.("data",b),s.setRawMode?.(p),s.pause?.(),t.write(`
+`),x())},b=x=>{let L=typeof x=="string"?x:x.toString("utf8");if(L.includes("")){v(()=>c(new Error("Interactive selection cancelled.")));return}if(L.includes("\x1B[A")){d="",u=(u-1+i.length)%i.length,h();return}if(L.includes("\x1B[B")){d="",u=(u+1)%i.length,h();return}if(L.includes("\r")||L.includes(`
+`)){if(d){let M=Number.parseInt(d,10)-1;if(Number.isNaN(M)||M<0||M>=i.length){d="",t.write("\x07"),h();return}u=M}v(()=>l(i[u]?.value??i[0].value));return}if(L.includes("\b")||L.includes("\x7F")){d=d.slice(0,-1);let M=Number.parseInt(d,10)-1;!Number.isNaN(M)&&M>=0&&M<i.length&&(u=M),h();return}let Fe=[...L].filter(M=>/[0-9]/u.test(M));if(Fe.length>0){d=`${d}${Fe.join("")}`;let M=Number.parseInt(d,10)-1;!Number.isNaN(M)&&M>=0&&M<i.length&&(u=M),h()}};h(),s.resume?.(),s.on("data",b),s.setRawMode(!0)});let o=n({input:e,output:t});try{t.write(`${r}
+`);for(let[u,d]of i.entries())t.write(`${u+1}. ${rr(d)}
+`);let l=(await o.question("Choose a number and press enter: ")).trim(),c=Number.parseInt(l,10)-1;if(Number.isNaN(c)||c<0||c>=i.length)throw new Error("No valid option selected.");return i[c].value}finally{o.close()}}}function za(e){return e?"\x1B[36m>\x1B[0m":" "}function rr(e){return e.description?`${e.label} (${e.description})`:e.label}function Va(e){return async t=>{let n=e==="win32"?{file:"rundll32.exe",args:["url.dll,FileProtocolHandler",t]}:e==="darwin"?{file:"open",args:[t]}:{file:"xdg-open",args:[t]};return new Promise(r=>{try{let i=ir(n.file,n.args,{detached:!0,stdio:"ignore"});i.on("error",()=>r(!1)),i.unref(),r(!0)}catch{r(!1)}})}}function F(e,t){let n={};for(let r of t){let i=e[r];i!==void 0&&i!==!1&&(r.endsWith("Cents")||r==="rating"?n[r]=Number(i):n[r]=i)}return A(n)}function Wa(e){let t=e.results;return Array.isArray(t)?t.flatMap(n=>{if(!n||typeof n!="object"||Array.isArray(n))return[];let r=a(n,"slug")??a(n,"skillSlug");return r?[r]:[]}):[]}function Ya(e){let t=g(e)??"auto";return t==="auto"||t==="required"||t==="optional"||t==="off"?{status:"ok",policy:t}:{status:"invalid",message:"guardian check --cloud-trust-ledger must be one of: auto, required, optional, off."}}function A(e){let t={};for(let[n,r]of Object.entries(e))r!==void 0&&(t[n]=r);return t}function st(e,t){let n=g(e);return n?rn(n,t):void 0}function rn(e,t){try{return JSON.parse(e)}catch{throw new Error(`--${t} must be valid JSON.`)}}function H(e){if(!e||typeof e!="object"||Array.isArray(e))return e;let t={...e};return delete t.apiKey,delete t[["ad","min","Api","Key"].join("")],t}function Mt(e){let t=H(e);for(let n of["role","roles","verifiedAt","expiresAt","userId","tenantId","linkedAccount","linkedIdentity","createdUser"])delete t[n];return t}function w(e,t){let n=g(e);if(!n)throw new Error(t);return n}function g(e){return typeof e=="string"&&e.trim().length>0?e.trim():void 0}function Q(e){return typeof e=="string"&&e.trim().length>0?e.trim():void 0}function a(e,t){let n=e[t];return typeof n=="string"&&n.trim().length>0?n.trim():void 0}function oe(e,t){let n=e[t];if(typeof n=="number"&&Number.isFinite(n))return n;if(typeof n=="string"&&n.trim().length>0){let r=Number(n);return Number.isFinite(r)?r:void 0}}function C(e,t){let n=e[t];return n&&typeof n=="object"&&!Array.isArray(n)?n:void 0}function ee(e,t){let n=e[t];return Array.isArray(n)?n.filter(r=>typeof r=="string"):void 0}function Qa(e){let t=Array.isArray(e)?e:typeof e=="string"?[e]:[];return[...new Set(t.flatMap(n=>n.split(",")).map(n=>n.trim()).filter(Boolean))]}function B(e,t,n){let r=g(n);r&&e.set(t,r)}function te(e){let t=e.toString();return t?`?${t}`:""}function X(e){return e.replace(/\/+$/u,"")}function we(e){if(X(e)===Gt)return"cloud";try{let t=new URL(e);return t.hostname==="127.0.0.1"||t.hostname==="localhost"||t.hostname==="::1"||t.hostname==="[::1]"?"local":"custom"}catch{return"custom"}}function Za(e){return e.includes("/")||e.startsWith(".")||/^https?:\/\//u.test(e)||/^[a-z]+:/iu.test(e)}function se(e,t){return lr(e,t)}function ot(e){return`${e[0]?.toUpperCase()??""}${e.slice(1)}`}var Xa={github:"GitHub",gitlab:"GitLab",google:"Google",microsoft:"Microsoft"};function el(e){return Xa[e.toLowerCase()]??ot(e)}function ue(e){return e instanceof Error?e.message:String(e)}export{Nl as executePublicCli};