skills-layer 0.1.5 → 0.1.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +171 -6
- package/README.md +6 -3
- package/package.json +10 -3
- package/public/skills-layer-public.mjs +318 -116
- package/tests/public-cli-package.test.mjs +40 -2
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
/* istanbul ignore file -- generated npm bundle is verified by boundary and tarball smoke tests. */
|
|
2
2
|
import { createRequire as __skillsLayerCreateRequire } from "node:module"; const require = __skillsLayerCreateRequire(import.meta.url);
|
|
3
|
-
import{spawn as qi}from"node:child_process";import{createHash as on}from"node:crypto";import{access as Ki,appendFile as zs,chmod as Gi,mkdir as Ke,readdir as Vi,readFile as Ge,rm as an,stat as Ws,writeFile as ln}from"node:fs/promises";import{basename as G,dirname as ee,join as L,posix as cn,relative as Me,resolve as Di,win32 as xe}from"node:path";import{createInterface as un}from"node:readline/promises";import{spawn as Bn}from"node:child_process";import{createHash as qr}from"node:crypto";import{chmod as Kr,mkdir as Ye,readFile as Nn,rm as kt,writeFile as ve}from"node:fs/promises";import{dirname as je,posix as Gr,win32 as Vr}from"node:path";import{posix as Nr,win32 as Mr}from"node:path";var we=["codex","claude-code","cursor","opencode","amp","kimi-cli","replit","universal","antigravity","augment","openclaw","cline","warp","codebuddy","command-code","continue","cortex","crush","deepagents","droid","gemini-cli","github-copilot","goose","junie","iflow-cli","kilo","kiro-cli","kode","mcpjam","mistral-vibe","mux","openhands","pi","qoder","qwen-code","roo","trae","trae-cn","windsurf","zencoder","neovate","pochi","adal"],In=[I("codex","Codex",".codex",{capabilities:U({allowedTools:!0})}),I("claude-code","Claude Code",".claude",{envVar:"CLAUDE_CODE_HOME",capabilities:U({allowedTools:!0,hooks:!0,forkedContext:!0})}),I("cursor","Cursor",".cursor",{capabilities:U({allowedTools:!0})}),I("opencode","OpenCode",".opencode",{globalRootRelativePath:".config/opencode",capabilities:U({allowedTools:!0})}),le("amp","Amp",".config/agents",{capabilities:U({allowedTools:!0})}),le("kimi-cli","Kimi Code CLI",".config/agents"),le("replit","Replit",".config/agents"),le("universal","Universal",".config/agents"),le("antigravity","Antigravity",".gemini/antigravity",{capabilities:U({allowedTools:!0}),detectGlobal:!0}),I("augment","Augment",".augment"),{id:"openclaw",displayName:"OpenClaw",envVar:"OPENCLAW_HOME",capabilities:U({allowedTools:!0}),targets:{projectRootRelativePath:null,projectSkillsRelativePath:"skills",globalRootRelativePath:".openclaw",globalSkillsRelativePath:".openclaw/skills"},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:[".openclaw",".openclaw/skills"]}},le("cline","Cline",".agents",{capabilities:U({allowedTools:!0,hooks:!0})}),le("warp","Warp",".agents"),I("codebuddy","CodeBuddy",".codebuddy",{capabilities:U({allowedTools:!0})}),I("command-code","Command Code",".commandcode",{capabilities:U({allowedTools:!0})}),I("continue","Continue",".continue"),I("cortex","Cortex Code",".cortex",{globalRootRelativePath:".snowflake/cortex"}),I("crush","Crush",".crush",{globalRootRelativePath:".config/crush"}),le("deepagents","Deep Agents",".deepagents/agent",{detectGlobal:!0}),I("droid","Droid",".factory"),le("gemini-cli","Gemini CLI",".gemini",{detectGlobal:!0}),le("github-copilot","GitHub Copilot",".copilot",{capabilities:U({allowedTools:!0}),detectGlobal:!0}),I("goose","Goose",".goose",{globalRootRelativePath:".config/goose"}),I("junie","Junie",".junie"),I("iflow-cli","iFlow CLI",".iflow"),I("kilo","Kilo Code",".kilocode"),I("kiro-cli","Kiro CLI",".kiro"),I("kode","Kode",".kode"),I("mcpjam","MCPJam",".mcpjam"),I("mistral-vibe","Mistral Vibe",".vibe"),I("mux","Mux",".mux"),I("openhands","OpenHands",".openhands",{capabilities:U({allowedTools:!0})}),I("pi","Pi",".pi",{globalRootRelativePath:".pi/agent",capabilities:U({allowedTools:!0})}),I("qoder","Qoder",".qoder",{capabilities:U({allowedTools:!0})}),I("qwen-code","Qwen Code",".qwen"),I("roo","Roo Code",".roo",{capabilities:U({allowedTools:!0})}),I("trae","Trae",".trae",{detectProject:!1}),I("trae-cn","Trae CN",".trae",{globalRootRelativePath:".trae-cn",detectProject:!1}),I("windsurf","Windsurf",".windsurf",{globalRootRelativePath:".codeium/windsurf"}),I("zencoder","Zencoder",".zencoder",{capabilities:U({allowedTools:!0})}),I("neovate","Neovate",".neovate",{capabilities:U({allowedTools:!0})}),I("pochi","Pochi",".pochi"),I("adal","AdaL",".adal")];function ge(e=process.env,t=process.platform,n=process.cwd()){let i=Ln(t),r=An(e,t);return In.map(s=>{let o=We(e[s.envVar]),l=r&&s.targets.globalRootRelativePath?$e(i,r,s.targets.globalRootRelativePath):null,c=r&&s.targets.globalSkillsRelativePath?$e(i,r,s.targets.globalSkillsRelativePath):null,u=s.targets.projectRootRelativePath?$e(i,n,s.targets.projectRootRelativePath):null,d=o??l;return{id:s.id,displayName:s.displayName,envVar:s.envVar,capabilities:s.capabilities,detectionSources:[],targets:{projectRoot:u,projectSkillsPath:$e(i,n,s.targets.projectSkillsRelativePath),globalRoot:d,globalSkillsPath:o?i.join(o,"skills"):c}}})}async function jn(e={}){let t=e.env??process.env,n=e.platform??process.platform,i=e.cwd??process.cwd(),r=Ln(n),s=An(t,n),o=ge(t,n,i),l=e.pathExists??(async()=>!1);return(await Promise.all(o.map(async c=>{let u=Fr(c.id),d=[],g=We(t[c.envVar]);return(g&&await l(g)||g&&await l(r.join(g,"skills")))&&d.push("override"),u.detection.projectProbeRelativePaths.length>0&&await _n({basePath:i,relativePaths:u.detection.projectProbeRelativePaths,pathApi:r,pathExists:l})&&d.push("project"),s&&u.detection.globalProbeRelativePaths.length>0&&await _n({basePath:s,relativePaths:u.detection.globalProbeRelativePaths,pathApi:r,pathExists:l})&&d.push("global"),d.length===0?null:{...c,detectionSources:Or(d)}}))).flatMap(c=>c?[c]:[])}function An(e,t){return t==="win32"?We(e.USERPROFILE,e.HOME):We(e.HOME)}function Ln(e){return e==="win32"?Mr:Nr}function We(...e){return e.find(t=>typeof t=="string"&&t.trim().length>0)?.trim()}function Or(e){return[...new Set(e)]}async function _n(e){for(let t of e.relativePaths)if(await e.pathExists($e(e.pathApi,e.basePath,t)))return!0;return!1}function $e(e,t,n){return e.join(t,...n.split("/"))}function I(e,t,n,i={}){let r=i.globalRootRelativePath??n,s=i.detectProject??!0;return{id:e,displayName:t,envVar:i.envVar??En(e),capabilities:i.capabilities??U(),targets:{projectRootRelativePath:n,projectSkillsRelativePath:`${n}/skills`,globalRootRelativePath:r,globalSkillsRelativePath:`${r}/skills`},detection:{projectProbeRelativePaths:s?[n,`${n}/skills`]:[],globalProbeRelativePaths:[r,`${r}/skills`]}}}function le(e,t,n,i={}){let r=i.detectGlobal??!1;return{id:e,displayName:t,envVar:i.envVar??En(e),capabilities:i.capabilities??U(),targets:{projectRootRelativePath:".agents",projectSkillsRelativePath:".agents/skills",globalRootRelativePath:n,globalSkillsRelativePath:`${n}/skills`},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:r?[n,`${n}/skills`]:[]}}}function U(e={}){let t=["basic_skills"];return e.allowedTools&&t.push("allowed_tools"),e.hooks&&t.push("hooks"),e.forkedContext&&t.push("forked_context"),t.push("local_install"),t}function En(e){return`${e.replaceAll("-","_").toUpperCase()}_HOME`}function Fr(e){return In.find(t=>t.id===e)}var fe="skills-layer",Dr="2025-06-18",Hr=["mcp","skills-layer-mcp-proxy.mjs"],zr=["mcp","skills-layer-mcp-broker.mjs"],Wr=["mcp","skills-layer-mcp-broker.sock"],Jr={codex:{tier:"tier_1",configKind:"codex_toml",resolveConfigPath(e,t,n){let i=vt(n);return i.join(e.targets.globalRoot??i.join(as({},n)??t,".codex"),"config.toml")}},cursor:_e(".cursor/mcp.json"),"claude-code":_e(".mcp.json"),cline:_e(".cline/mcp.json"),"gemini-cli":_e(".gemini/settings.json"),windsurf:_e(".windsurf/mcp.json")},Yr=new Set(["universal"]);function Le(e){let t=ge(e.env,e.platform,e.cwd),n=new Map(t.map(P=>[P.id,P])),i=e.platform??process.platform,r=e.cwd??process.cwd(),s=e.stateDir??os(e.env,i),o=e.mcpConfigPath??Ie(i,s,"mcp.json"),l=Ie(i,s,...Hr),c=Ie(i,s,...zr),u=Ie(i,s,...Wr),d=e.nodePath??process.execPath,g=Mn({mcpConfigPath:o}),f=On({mcpConfigPath:o,socketPath:u}),m=be(g),y=be(f),w=we.map(P=>{let _=n.get(P),N=Jr[P];if(N){let ze=N.resolveConfigPath(_,r,i);return Zr({agentId:P,displayName:_.displayName,configPath:ze,configKind:N.configKind,bridgePath:l,brokerPath:c,brokerSocketPath:u,mcpConfigPath:o,nodePath:d,bridgeChecksum:m,brokerChecksum:y})}return Yr.has(P)?Tn({agentId:P,displayName:_.displayName,tier:"tier_3",status:"skills_only",verification:"skills_only",reason:"This agent is currently supported through Skills Layer skill files, not MCP auto-install.",instructions:[`Install skills for ${_.displayName} with \`skills-layer install <skill> --agent ${P}\`.`,"MCP auto-install is not claimed for this agent yet."]}):Tn({agentId:P,displayName:_.displayName,tier:"tier_2",status:"manual_handoff",verification:"manual",reason:"MCP support or the safe writable config shape has not been verified yet.",instructions:[`Add a local stdio MCP server named ${fe}.`,`Command: ${d}`,`Args: ${l}`,"Restart or reload the agent if it does not reconnect automatically."]})});return{status:"mcp_registration_plan",serverName:fe,mcpUrl:e.mcpUrl,bearerTokenEnvVar:e.bearerTokenEnvVar,clientId:e.clientId,environment:e.environment,generatedAt:e.now,bridgePath:l,brokerPath:c,brokerSocketPath:u,nodePath:d,mcpConfigPath:o,bridgeChecksum:m,brokerChecksum:y,automaticCount:w.filter(P=>P.status==="automatic").length,manualCount:w.filter(P=>P.status==="manual_handoff").length,skillsOnlyCount:w.filter(P=>P.status==="skills_only").length,unsupportedCount:w.filter(P=>P.status==="unsupported").length,targets:w}}async function wt(e){let t=Le(e),n=ls(e.clientId),i=t.targets.find(w=>w.agentId===n),r=e.mcpConfig??await Ze(t.mcpConfigPath,{allowMissing:!0});if(!r)return Un({plan:t,target:i,mcpConfig:null,tokenConfig:null,tokenPresent:!1,tokenRefPresent:!1,bridgeExists:!1,checksumMatches:!1,brokerExists:!1,brokerChecksumMatches:!1,targetConfigured:!1,rawTokenLeaked:!1});let s=await Ae(t.bridgePath),o=s!==null,l=s!==null&&be(s)===t.bridgeChecksum,c=await Ae(t.brokerPath),u=c!==null,d=c!==null&&be(c)===t.brokerChecksum,g=cs(r,i.agentId),f=ne(g,"token"),m=ne(g,"tokenRef"),y=i.status==="automatic"?await ns(i,f):{configured:!1,rawTokenLeaked:!1};return Un({plan:t,target:i,mcpConfig:r,tokenConfig:g,tokenPresent:!!f,tokenRefPresent:!!m,bridgeExists:o,checksumMatches:l,brokerExists:u,brokerChecksumMatches:d,targetConfigured:y.configured,rawTokenLeaked:y.rawTokenLeaked})}function Mn(e){return`#!/usr/bin/env node
|
|
3
|
+
import{spawn as Ir}from"node:child_process";import{createHash as $n}from"node:crypto";import{access as jr,appendFile as Wo,chmod as Er,mkdir as nt,readdir as Lr,readFile as it,rm as An,stat as Jo,writeFile as In}from"node:fs/promises";import{basename as V,dirname as ne,join as E,posix as jn,relative as Xe,resolve as Ur,win32 as Ue}from"node:path";import{createInterface as En}from"node:readline/promises";import{spawn as ai}from"node:child_process";import{createHash as Bs}from"node:crypto";import{chmod as Ms,mkdir as at,readFile as li,rm as Mt,writeFile as _e}from"node:fs/promises";import{dirname as qe,posix as qs,win32 as Os}from"node:path";import{posix as Us,win32 as Ts}from"node:path";var ve=["codex","claude-code","cursor","opencode","amp","kimi-cli","replit","universal","antigravity","augment","openclaw","cline","warp","codebuddy","command-code","continue","cortex","crush","deepagents","droid","gemini-cli","github-copilot","goose","junie","iflow-cli","kilo","kiro-cli","kode","mcpjam","mistral-vibe","mux","openhands","pi","qoder","qwen-code","roo","trae","trae-cn","windsurf","zencoder","neovate","pochi","adal"],ei=[I("codex","Codex",".codex",{capabilities:F({allowedTools:!0})}),I("claude-code","Claude Code",".claude",{envVar:"CLAUDE_CODE_HOME",capabilities:F({allowedTools:!0,hooks:!0,forkedContext:!0})}),I("cursor","Cursor",".cursor",{capabilities:F({allowedTools:!0})}),I("opencode","OpenCode",".opencode",{globalRootRelativePath:".config/opencode",capabilities:F({allowedTools:!0})}),pe("amp","Amp",".config/agents",{capabilities:F({allowedTools:!0})}),pe("kimi-cli","Kimi Code CLI",".config/agents"),pe("replit","Replit",".config/agents"),pe("universal","Universal",".config/agents"),pe("antigravity","Antigravity",".gemini/antigravity",{capabilities:F({allowedTools:!0}),detectGlobal:!0}),I("augment","Augment",".augment"),{id:"openclaw",displayName:"OpenClaw",envVar:"OPENCLAW_HOME",capabilities:F({allowedTools:!0}),targets:{projectRootRelativePath:null,projectSkillsRelativePath:"skills",globalRootRelativePath:".openclaw",globalSkillsRelativePath:".openclaw/skills"},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:[".openclaw",".openclaw/skills"]}},pe("cline","Cline",".agents",{capabilities:F({allowedTools:!0,hooks:!0})}),pe("warp","Warp",".agents"),I("codebuddy","CodeBuddy",".codebuddy",{capabilities:F({allowedTools:!0})}),I("command-code","Command Code",".commandcode",{capabilities:F({allowedTools:!0})}),I("continue","Continue",".continue"),I("cortex","Cortex Code",".cortex",{globalRootRelativePath:".snowflake/cortex"}),I("crush","Crush",".crush",{globalRootRelativePath:".config/crush"}),pe("deepagents","Deep Agents",".deepagents/agent",{detectGlobal:!0}),I("droid","Droid",".factory"),pe("gemini-cli","Gemini CLI",".gemini",{detectGlobal:!0}),pe("github-copilot","GitHub Copilot",".copilot",{capabilities:F({allowedTools:!0}),detectGlobal:!0}),I("goose","Goose",".goose",{globalRootRelativePath:".config/goose"}),I("junie","Junie",".junie"),I("iflow-cli","iFlow CLI",".iflow"),I("kilo","Kilo Code",".kilocode"),I("kiro-cli","Kiro CLI",".kiro"),I("kode","Kode",".kode"),I("mcpjam","MCPJam",".mcpjam"),I("mistral-vibe","Mistral Vibe",".vibe"),I("mux","Mux",".mux"),I("openhands","OpenHands",".openhands",{capabilities:F({allowedTools:!0})}),I("pi","Pi",".pi",{globalRootRelativePath:".pi/agent",capabilities:F({allowedTools:!0})}),I("qoder","Qoder",".qoder",{capabilities:F({allowedTools:!0})}),I("qwen-code","Qwen Code",".qwen"),I("roo","Roo Code",".roo",{capabilities:F({allowedTools:!0})}),I("trae","Trae",".trae",{detectProject:!1}),I("trae-cn","Trae CN",".trae",{globalRootRelativePath:".trae-cn",detectProject:!1}),I("windsurf","Windsurf",".windsurf",{globalRootRelativePath:".codeium/windsurf"}),I("zencoder","Zencoder",".zencoder",{capabilities:F({allowedTools:!0})}),I("neovate","Neovate",".neovate",{capabilities:F({allowedTools:!0})}),I("pochi","Pochi",".pochi"),I("adal","AdaL",".adal")];function ke(e=process.env,t=process.platform,n=process.cwd()){let i=ii(t),r=ni(e,t);return ei.map(s=>{let o=st(e[s.envVar]),a=r&&s.targets.globalRootRelativePath?Fe(i,r,s.targets.globalRootRelativePath):null,c=r&&s.targets.globalSkillsRelativePath?Fe(i,r,s.targets.globalSkillsRelativePath):null,u=s.targets.projectRootRelativePath?Fe(i,n,s.targets.projectRootRelativePath):null,d=o??a;return{id:s.id,displayName:s.displayName,envVar:s.envVar,capabilities:s.capabilities,detectionSources:[],targets:{projectRoot:u,projectSkillsPath:Fe(i,n,s.targets.projectSkillsRelativePath),globalRoot:d,globalSkillsPath:o?i.join(o,"skills"):c}}})}async function ti(e={}){let t=e.env??process.env,n=e.platform??process.platform,i=e.cwd??process.cwd(),r=ii(n),s=ni(t,n),o=ke(t,n,i),a=e.pathExists??(async()=>!1);return(await Promise.all(o.map(async c=>{let u=Fs(c.id),d=[],g=st(t[c.envVar]);return(g&&await a(g)||g&&await a(r.join(g,"skills")))&&d.push("override"),u.detection.projectProbeRelativePaths.length>0&&await Xn({basePath:i,relativePaths:u.detection.projectProbeRelativePaths,pathApi:r,pathExists:a})&&d.push("project"),s&&u.detection.globalProbeRelativePaths.length>0&&await Xn({basePath:s,relativePaths:u.detection.globalProbeRelativePaths,pathApi:r,pathExists:a})&&d.push("global"),d.length===0?null:{...c,detectionSources:Ns(d)}}))).flatMap(c=>c?[c]:[])}function ni(e,t){return t==="win32"?st(e.USERPROFILE,e.HOME):st(e.HOME)}function ii(e){return e==="win32"?Ts:Us}function st(...e){return e.find(t=>typeof t=="string"&&t.trim().length>0)?.trim()}function Ns(e){return[...new Set(e)]}async function Xn(e){for(let t of e.relativePaths)if(await e.pathExists(Fe(e.pathApi,e.basePath,t)))return!0;return!1}function Fe(e,t,n){return e.join(t,...n.split("/"))}function I(e,t,n,i={}){let r=i.globalRootRelativePath??n,s=i.detectProject??!0;return{id:e,displayName:t,envVar:i.envVar??ri(e),capabilities:i.capabilities??F(),targets:{projectRootRelativePath:n,projectSkillsRelativePath:`${n}/skills`,globalRootRelativePath:r,globalSkillsRelativePath:`${r}/skills`},detection:{projectProbeRelativePaths:s?[n,`${n}/skills`]:[],globalProbeRelativePaths:[r,`${r}/skills`]}}}function pe(e,t,n,i={}){let r=i.detectGlobal??!1;return{id:e,displayName:t,envVar:i.envVar??ri(e),capabilities:i.capabilities??F(),targets:{projectRootRelativePath:".agents",projectSkillsRelativePath:".agents/skills",globalRootRelativePath:n,globalSkillsRelativePath:`${n}/skills`},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:r?[n,`${n}/skills`]:[]}}}function F(e={}){let t=["basic_skills"];return e.allowedTools&&t.push("allowed_tools"),e.hooks&&t.push("hooks"),e.forkedContext&&t.push("forked_context"),t.push("local_install"),t}function ri(e){return`${e.replaceAll("-","_").toUpperCase()}_HOME`}function Fs(e){return ei.find(t=>t.id===e)}var be="skills-layer",Ks="2025-06-18",Ds=["mcp","skills-layer-mcp-proxy.mjs"],Gs=["mcp","skills-layer-mcp-broker.mjs"],Vs=["mcp","skills-layer-mcp-broker.sock"],Hs={codex:{tier:"tier_1",configKind:"codex_toml",resolveConfigPath(e,t,n){let i=qt(n);return i.join(e.targets.globalRoot??i.join(ro({},n)??t,".codex"),"config.toml")}},cursor:Be(".cursor/mcp.json"),"claude-code":Be(".mcp.json"),cline:Be(".cline/mcp.json"),"gemini-cli":Be(".gemini/settings.json"),windsurf:Be(".windsurf/mcp.json")},zs=new Set(["universal"]);function Ke(e){let t=ke(e.env,e.platform,e.cwd),n=new Map(t.map(C=>[C.id,C])),i=e.platform??process.platform,r=e.cwd??process.cwd(),s=e.stateDir??io(e.env,i),o=e.mcpConfigPath??Me(i,s,"mcp.json"),a=Me(i,s,...Ds),c=Me(i,s,...Gs),u=Me(i,s,...Vs),d=e.nodePath??process.execPath,g=ci({mcpConfigPath:o}),f=ui({mcpConfigPath:o,socketPath:u}),m=xe(g),y=xe(f),v=ve.map(C=>{let _=n.get(C),L=Hs[C];if(L){let de=L.resolveConfigPath(_,r,i);return Ws({agentId:C,displayName:_.displayName,configPath:de,configKind:L.configKind,bridgePath:a,brokerPath:c,brokerSocketPath:u,mcpConfigPath:o,nodePath:d,bridgeChecksum:m,brokerChecksum:y})}return zs.has(C)?oi({agentId:C,displayName:_.displayName,tier:"tier_3",status:"skills_only",verification:"skills_only",reason:"This agent is currently supported through Skills Layer skill files, not MCP auto-install.",instructions:[`Install skills for ${_.displayName} with \`skills-layer install <skill> --agent ${C}\`.`,"MCP auto-install is not claimed for this agent yet."]}):oi({agentId:C,displayName:_.displayName,tier:"tier_2",status:"manual_handoff",verification:"manual",reason:"MCP support or the safe writable config shape has not been verified yet.",instructions:[`Add a local stdio MCP server named ${be}.`,`Command: ${d}`,`Args: ${a}`,"Restart or reload the agent if it does not reconnect automatically."]})});return{status:"mcp_registration_plan",serverName:be,mcpUrl:e.mcpUrl,bearerTokenEnvVar:e.bearerTokenEnvVar,clientId:e.clientId,environment:e.environment,generatedAt:e.now,bridgePath:a,brokerPath:c,brokerSocketPath:u,nodePath:d,mcpConfigPath:o,bridgeChecksum:m,brokerChecksum:y,automaticCount:v.filter(C=>C.status==="automatic").length,manualCount:v.filter(C=>C.status==="manual_handoff").length,skillsOnlyCount:v.filter(C=>C.status==="skills_only").length,unsupportedCount:v.filter(C=>C.status==="unsupported").length,targets:v}}async function De(e){let t=Ke(e),n=so(e.clientId),i=t.targets.find(v=>v.agentId===n),r=e.mcpConfig??await lt(t.mcpConfigPath,{allowMissing:!0});if(!r)return si({plan:t,target:i,mcpConfig:null,tokenConfig:null,tokenPresent:!1,tokenRefPresent:!1,bridgeExists:!1,checksumMatches:!1,brokerExists:!1,brokerChecksumMatches:!1,targetConfigured:!1,rawTokenLeaked:!1});let s=await Oe(t.bridgePath),o=s!==null,a=s!==null&&xe(s)===t.bridgeChecksum,c=await Oe(t.brokerPath),u=c!==null,d=c!==null&&xe(c)===t.brokerChecksum,g=oo(r,i.agentId),f=oe(g,"token"),m=oe(g,"tokenRef"),y=i.status==="automatic"?await Xs(i,f):{configured:!1,rawTokenLeaked:!1};return si({plan:t,target:i,mcpConfig:r,tokenConfig:g,tokenPresent:!!f,tokenRefPresent:!!m,bridgeExists:o,checksumMatches:a,brokerExists:u,brokerChecksumMatches:d,targetConfigured:y.configured,rawTokenLeaked:y.rawTokenLeaked})}function ci(e){return`#!/usr/bin/env node
|
|
4
4
|
import { createConnection } from "node:net";
|
|
5
5
|
import { createInterface } from "node:readline";
|
|
6
6
|
import { readFile } from "node:fs/promises";
|
|
7
7
|
|
|
8
8
|
const CONFIG_PATH = ${JSON.stringify(e.mcpConfigPath)};
|
|
9
|
-
const MCP_PROTOCOL_VERSION = ${JSON.stringify(
|
|
9
|
+
const MCP_PROTOCOL_VERSION = ${JSON.stringify(Ks)};
|
|
10
10
|
|
|
11
11
|
function writeMessage(message) {
|
|
12
12
|
process.stdout.write(JSON.stringify(message) + "\\n");
|
|
@@ -148,7 +148,7 @@ for await (const line of rl) {
|
|
|
148
148
|
writeMessage(errorResponse(null, -32603, error instanceof Error ? error.message : "Skills Layer MCP bridge failed."));
|
|
149
149
|
}
|
|
150
150
|
}
|
|
151
|
-
`}function
|
|
151
|
+
`}function ui(e){return`#!/usr/bin/env node
|
|
152
152
|
import { execFile } from "node:child_process";
|
|
153
153
|
import { createServer } from "node:net";
|
|
154
154
|
import { chmod, readFile, rm } from "node:fs/promises";
|
|
@@ -244,15 +244,15 @@ server.listen(SOCKET_PATH, async () => {
|
|
|
244
244
|
// Some platforms do not support chmod on sockets.
|
|
245
245
|
}
|
|
246
246
|
});
|
|
247
|
-
`}async function
|
|
248
|
-
`);let c=await Promise.race([s,
|
|
249
|
-
`,"utf8")}async function
|
|
250
|
-
`,"utf8")}async function
|
|
251
|
-
`),i=`${
|
|
252
|
-
|
|
253
|
-
`:""}${n}`;await
|
|
254
|
-
`).trimEnd()}function
|
|
255
|
-
`);r>=0&&t({ok:!0,line:n.slice(0,r)})}),e.on("error",i=>{t({ok:!1,message:i instanceof Error?i.message:"MCP bridge stdout failed."})}),e.on("end",()=>{t({ok:!1,message:"MCP bridge exited before returning a response."})})}):Promise.resolve({ok:!1,message:"MCP bridge stdout was not available."})}function
|
|
247
|
+
`}async function di(e){let t=e.requestId??1,n=e.timeoutMs??5e3,i=ai(e.nodePath,[e.bridgePath],{stdio:["pipe","pipe","pipe"]}),r="",s=no(i.stdout);i.stderr.on("data",u=>{r+=String(u)});let o,a=new Promise(u=>{o=setTimeout(()=>u("timeout"),n)});i.stdin.write(`${JSON.stringify({jsonrpc:"2.0",id:t,method:"tools/list",params:{}})}
|
|
248
|
+
`);let c=await Promise.race([s,a]);if(clearTimeout(o),i.kill(),c==="timeout")return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!1,toolCount:null,reasonCode:"probe_timeout",message:"MCP bridge did not respond before the verification timeout."};if(!c.ok)return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!1,toolCount:null,reasonCode:"probe_failed",message:r.trim()?"MCP bridge failed before returning a response.":c.message};try{let u=JSON.parse(c.line);if(X(u)&&X(u.error))return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:null,reasonCode:"remote_mcp_error",message:oe(u.error,"message")??"Skills Layer MCP returned an error."};let d=X(u)&&X(u.result)&&Array.isArray(u.result.tools)?u.result.tools:null;return{status:"ok",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:d?d.length:null,reasonCode:null,message:d?`MCP bridge responded with ${d.length} tool${d.length===1?"":"s"}.`:"MCP bridge responded."}}catch{return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:null,reasonCode:"invalid_probe_response",message:"MCP bridge returned a response that was not valid JSON."}}}function si(e){let t=e.target.status==="automatic",n=e.tokenRefPresent&&!e.tokenPresent,i=!n||e.brokerExists&&e.brokerChecksumMatches,r=(e.tokenPresent||e.tokenRefPresent)&&e.bridgeExists&&e.checksumMatches&&i&&t&&e.targetConfigured&&!e.rawTokenLeaked,s=r?"mcp_configured":e.mcpConfig?"mcp_needs_repair":"mcp_not_configured",o=`skills-layer mcp verify --client ${e.target.agentId}`;return{status:s,configured:r,clientId:e.target.agentId,environment:oe(e.tokenConfig,"environment")??oe(e.mcpConfig,"environment")??e.plan.environment,baseUrl:oe(e.mcpConfig,"baseUrl"),mcpUrl:oe(e.mcpConfig,"mcpUrl"),tokenPrefix:oe(e.tokenConfig,"tokenPrefix")??oe(e.mcpConfig,"tokenPrefix"),scopes:Array.isArray(e.tokenConfig?.scopes)?e.tokenConfig.scopes:Array.isArray(e.mcpConfig?.scopes)?e.mcpConfig.scopes:[],configuredClients:ao(e.mcpConfig),tokenPresent:e.tokenPresent||e.tokenRefPresent,tokenStorage:oe(e.tokenConfig,"credentialStorage")==="macos_keychain"?"macos_keychain":e.tokenPresent?"local_file_locked":"unknown",bridge:{path:e.plan.bridgePath,exists:e.bridgeExists,checksumMatches:e.checksumMatches},broker:{path:e.plan.brokerPath,socketPath:e.plan.brokerSocketPath,required:n,exists:e.brokerExists,checksumMatches:e.brokerChecksumMatches},target:{agentId:e.target.agentId,displayName:e.target.displayName,tier:e.target.tier,status:e.target.status,configPath:e.target.configPath,configured:e.targetConfigured,rawTokenLeaked:e.rawTokenLeaked,reason:e.target.reason,restartRequired:e.target.restartRequired,instructions:e.target.instructions},liveProbe:{status:"not_run",method:"tools/list",reasonCode:"use_mcp_verify",message:`Live MCP tools/list was not run by status. Run \`${o}\` to verify remote MCP reachability through the local bridge.`,nextCommand:o},nextCommand:r?null:`skills-layer mcp repair --client ${e.target.agentId}`}}function Ws(e){return{agentId:e.agentId,displayName:e.displayName,tier:"tier_1",status:"automatic",serverName:be,configPath:e.configPath,restartRequired:!0,verification:"bridge_config_written",transport:"stdio_bridge",bridgePath:e.bridgePath,nodePath:e.nodePath,configKind:e.configKind,reason:"MCP support and a safe local config shape are known.",instructions:[`Skills Layer will install the local MCP bridge at ${e.bridgePath}.`,`Skills Layer will update ${e.configPath} to launch the bridge with ${e.nodePath}.`,"The raw MCP token stays in Skills Layer local storage and is not written to the agent config.","Open a fresh agent session or restart the agent to load the MCP server."],apply:async()=>{let t=await Js({bridgePath:e.bridgePath,brokerPath:e.brokerPath,brokerSocketPath:e.brokerSocketPath,mcpConfigPath:e.mcpConfigPath,nodePath:e.nodePath});return await Zs({configPath:e.configPath,configKind:e.configKind,bridgePath:e.bridgePath,nodePath:e.nodePath,agentId:e.agentId}),t},disconnect:async()=>{await Qs({configPath:e.configPath,configKind:e.configKind})}}}function oi(e){return{agentId:e.agentId,displayName:e.displayName,tier:e.tier,status:e.status,serverName:be,configPath:null,restartRequired:!0,verification:e.verification,transport:"manual",bridgePath:null,nodePath:null,configKind:null,reason:e.reason,instructions:e.instructions}}async function Js(e){let t=ci({mcpConfigPath:e.mcpConfigPath}),n=ui({mcpConfigPath:e.mcpConfigPath,socketPath:e.brokerSocketPath});return await at(qe(e.bridgePath),{recursive:!0}),await _e(e.bridgePath,t,"utf8"),await _e(e.brokerPath,n,"utf8"),await Bt(qe(e.bridgePath),448),await Bt(e.bridgePath,448),await Bt(e.brokerPath,448),Ys({nodePath:e.nodePath,brokerPath:e.brokerPath}),{bridgePath:e.bridgePath,brokerPath:e.brokerPath,brokerSocketPath:e.brokerSocketPath,mcpConfigPath:e.mcpConfigPath,checksum:xe(t),brokerChecksum:xe(n),nodePath:e.nodePath}}function Ys(e){if(!(process.env.VITEST==="true"||process.env.SKILLS_LAYER_MCP_BROKER_AUTOSTART==="disabled"))try{ai(e.nodePath,[e.brokerPath],{detached:!0,stdio:"ignore"}).unref()}catch{}}async function Zs(e){if(e.configKind==="codex_toml"){await to(e);return}await eo(e)}async function Qs(e){if(e.configKind==="codex_toml"){let i=await Oe(e.configPath);if(i===null)return;await _e(e.configPath,pi(i),"utf8");return}let t=await lt(e.configPath,{allowMissing:!0});if(!t||!X(t.mcpServers))return;let n={...t.mcpServers};delete n[be],await at(qe(e.configPath),{recursive:!0}),await _e(e.configPath,`${JSON.stringify({...t,mcpServers:n},null,2)}
|
|
249
|
+
`,"utf8")}async function Xs(e,t){if(!e.configPath||!e.configKind||!e.bridgePath||!e.nodePath)return{configured:!1,rawTokenLeaked:!1};if(e.configKind==="codex_toml"){let s=await Oe(e.configPath);return s===null?{configured:!1,rawTokenLeaked:!1}:{configured:s.includes("[mcp_servers.skills-layer]")&&s.includes(`command = ${JSON.stringify(e.nodePath)}`)&&(s.includes(`args = [${JSON.stringify(e.bridgePath)}, "--client", ${JSON.stringify(e.agentId)}]`)||s.includes(`args = [${JSON.stringify(e.bridgePath)}]`)),rawTokenLeaked:!!(t&&s.includes(t))}}let n=await lt(e.configPath,{allowMissing:!0}),i=X(n?.mcpServers)?n.mcpServers[be]:void 0;return{configured:X(i)&&i.command===e.nodePath&&Array.isArray(i.args)&&i.args[0]===e.bridgePath&&(i.args.length===1||i.args[1]==="--client"&&i.args[2]===e.agentId),rawTokenLeaked:!!(t&&JSON.stringify(n??{}).includes(t))}}async function eo(e){let t=await lt(e.configPath,{allowMissing:!0})??{},n=X(t.mcpServers)?{...t.mcpServers}:{};n[be]={command:e.nodePath,args:[e.bridgePath,"--client",e.agentId]},await at(qe(e.configPath),{recursive:!0}),await _e(e.configPath,`${JSON.stringify({...t,mcpServers:n},null,2)}
|
|
250
|
+
`,"utf8")}async function to(e){let t=await Oe(e.configPath)??"",n=["[mcp_servers.skills-layer]",`command = ${JSON.stringify(e.nodePath)}`,`args = [${JSON.stringify(e.bridgePath)}, "--client", ${JSON.stringify(e.agentId)}]`,""].join(`
|
|
251
|
+
`),i=`${pi(t).trimEnd()}${t.trim().length>0?`
|
|
252
|
+
|
|
253
|
+
`:""}${n}`;await at(qe(e.configPath),{recursive:!0}),await _e(e.configPath,i,"utf8")}function pi(e){let t=e.split(/\r?\n/u),n=[],i=!1;for(let r of t){if(r.trim()==="[mcp_servers.skills-layer]"){i=!0;continue}i&&/^\s*\[.+\]\s*$/u.test(r)&&(i=!1),i||n.push(r)}return n.join(`
|
|
254
|
+
`).trimEnd()}function Be(e){return{tier:"tier_1",configKind:"json_mcp_servers",resolveConfigPath(t,n,i){return Me(i,n,...e.split("/"))}}}async function lt(e,t){try{let n=JSON.parse(await li(e,"utf8"));return X(n)?n:{}}catch(n){if(t.allowMissing&&n.code==="ENOENT")return null;throw n}}async function Oe(e){try{return await li(e,"utf8")}catch(t){if(t.code==="ENOENT")return null;throw t}}async function Bt(e,t){try{await Ms(e,t)}catch{}}async function gi(e){await Mt(e,{force:!0})}async function mi(e,t){await Promise.all([Mt(e,{force:!0}),Mt(t,{force:!0})])}function no(e){return e?new Promise(t=>{let n="";e.on("data",i=>{n+=String(i);let r=n.indexOf(`
|
|
255
|
+
`);r>=0&&t({ok:!0,line:n.slice(0,r)})}),e.on("error",i=>{t({ok:!1,message:i instanceof Error?i.message:"MCP bridge stdout failed."})}),e.on("end",()=>{t({ok:!1,message:"MCP bridge exited before returning a response."})})}):Promise.resolve({ok:!1,message:"MCP bridge stdout was not available."})}function io(e,t){let n=qt(t),i=e??process.env,r=t==="win32"?ot(i.APPDATA,i.USERPROFILE,i.HOME):ot(i.XDG_CONFIG_HOME,i.HOME?n.join(i.HOME,".skills-layer"):void 0);return r?t==="win32"||i.XDG_CONFIG_HOME?.trim()?n.join(r,"skills-layer"):r:n.join(process.cwd(),".skills-layer")}function ro(e,t){return t==="win32"?ot(e.USERPROFILE,e.HOME):ot(e.HOME)}function so(e){return ve.includes(e)?e:"codex"}function oo(e,t){let n=e.tokens;return X(n)&&X(n[t])?n[t]:e}function ao(e){if(!e)return[];let t=e.clientIds;if(Array.isArray(t))return t.filter(r=>typeof r=="string"&&r.trim().length>0);let n=e.tokens;if(X(n))return Object.keys(n);let i=oe(e,"clientId");return i?[i]:[]}function Me(e,...t){return qt(e).join(...t)}function qt(e){return e==="win32"?Os:qs}function ot(...e){return e.find(t=>typeof t=="string"&&t.trim().length>0)?.trim()}function oe(e,t){let n=e?.[t];return typeof n=="string"&&n.trim().length>0?n:null}function xe(e){return Bs("sha256").update(e).digest("hex")}function X(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function lo(e){let t=co(e);if(t)return t;let n=uo(e);if(n)return n;throw new Error("Unsupported bundle archive format")}function fi(e){try{return lo(e)}catch{return null}}function co(e){if(e.byteLength<4)return null;let t=new TextDecoder,n=new DataView(e.buffer,e.byteOffset,e.byteLength),i=[],r=0,s=!1;for(;r+4<=e.byteLength;){let o=n.getUint32(r,!0);if(o===67324752){if(s=!0,r+30>e.byteLength)throw new Error("ZIP local header is truncated");let a=n.getUint16(r+8,!0),c=n.getUint32(r+18,!0),u=n.getUint16(r+26,!0),d=n.getUint16(r+28,!0),g=r+30,f=g+u+d,m=f+c;if(a!==0)throw new Error("Only stored ZIP entries are supported");if(m>e.byteLength)throw new Error("ZIP entry data is truncated");i.push({path:t.decode(e.slice(g,g+u)),content:t.decode(e.slice(f,m))}),r=m;continue}return o===33639248||o===101010256?s?i:null:s?(()=>{throw new Error("Unexpected ZIP signature")})():null}return i}function uo(e){try{let t=JSON.parse(new TextDecoder().decode(e));return t.format!=="skills-layer-external-bundle-v1"||!Array.isArray(t.files)?null:t.files.filter(n=>typeof n.path=="string").map(n=>({path:n.path,...typeof n.content=="string"?{content:n.content}:{}}))}catch{return null}}import{createHash as po}from"node:crypto";function hi(e){let t=po("sha256");for(let n of e)t.update(n.path),t.update("\0"),t.update(n.content??""),t.update("\0");return t.digest("hex")}var Ot=["productivity","coding","review","testing","devops","data","documents","media","research","planning","design","security","business","education","automation","communication","email","customer-support","sales","marketing","finance","legal","operations","project-management","writing","translation","knowledge-management","hr","ai","ecommerce"],go="productivity",mo=new Set(Ot),fo={ci:"devops","ci-cd":"devops",compliance:"security",content:"documents",crm:"customer-support",docs:"documents",frontend:"coding","customer-service":"customer-support","customer-success":"customer-support","e-commerce":"ecommerce",genai:"ai",legal:"legal",llm:"ai",ops:"operations",pm:"project-management",reporting:"business",reports:"business","team-ops":"operations",ui:"design",ux:"design","web-development":"coding"},ho={productivity:["productivity","todo","task","tasks","calendar","meeting","notes","workflow","focus"],coding:["code","coding","developer","frontend","backend","repository","typescript","javascript","react","vite","html","css","component","bundle","artifact"],review:["review","reviews","critique","audit","feedback","pr","pull","quality"],testing:["test","tests","testing","qa","coverage","regression","playwright","vitest"],devops:["deploy","deployment","ci","cd","pipeline","infra","infrastructure","docker","cloudflare","wrangler"],data:["data","dataset","sql","database","analytics","metrics","spreadsheet","csv","json"],documents:["document","documents","doc","docs","pdf","report","reports","contract","proposal","writing"],media:["media","image","video","audio","transcript","youtube","asset","thumbnail"],research:["research","search","sources","citation","citations","summarize","summaries","literature"],planning:["plan","planning","project","roadmap","milestone","sprint","delivery","schedule"],design:["design","ui","ux","layout","wireframe","prototype","figma","tailwind","shadcn"],security:["security","threat","secret","secrets","vulnerability","vulnerabilities","risk","policy"],business:["business","strategy","customer","market","stakeholder","commercial","pricing"],education:["education","teach","teaching","learn","learning","lesson","course","tutorial"],automation:["automation","automate","workflow","script","scripts","bot","trigger","orchestration"],communication:["communication","slack","message","messages","chat","reply","announcement","conversation"],email:["email","emails","gmail","googleemail","googlemail","outlook","inbox","mail","newsletter"],"customer-support":["support","ticket","tickets","helpdesk","customer","service","csat","escalation"],sales:["sales","lead","leads","prospect","pipeline","deal","deals","crm","account"],marketing:["marketing","campaign","brand","seo","content","social","audience","copy"],finance:["finance","financial","invoice","invoices","budget","forecast","accounting","revenue","tax"],legal:["legal","contract","contracts","clause","clauses","compliance","policy","terms","privacy"],operations:["operations","ops","runbook","process","sop","incident","queue","handoff"],"project-management":["project","projects","backlog","dependency","dependencies","kanban","scrum","pm"],writing:["writing","write","draft","edit","editing","blog","article","copywriting"],translation:["translation","translate","localization","locale","language","languages","i18n"],"knowledge-management":["knowledge","wiki","kb","retrieval","archive","taxonomy","knowledgebase"],hr:["hr","hiring","recruiting","interview","onboarding","employee","people","performance"],ai:["ai","llm","prompt","prompts","model","models","agent","agents","rag","embedding"],ecommerce:["ecommerce","commerce","shop","store","checkout","cart","order","orders","product"]};function yi(e){if(typeof e!="string")return null;let t=vi(e);return mo.has(t)?t:fo[t]??null}function ki(e){let t=e.trim().toLowerCase().replace(/[_\s]+/gu,"-"),n={ai:"AI",hr:"HR",ecommerce:"E-commerce","e-commerce":"E-commerce"};return n[t]?n[t]:e.split(/[-_\s]+/u).filter(Boolean).map(i=>`${i.slice(0,1).toUpperCase()}${i.slice(1)}`).join(" ")}function wi(e){let t=[{value:e.slug??"",weight:3,signal:"slug"},{value:e.name??"",weight:3,signal:"name"},{value:e.description??"",weight:2,signal:"description"},{value:e.skillType??"",weight:1,signal:"skill_type"},{value:e.compatibility??"",weight:1,signal:"compatibility"},{value:(e.tags??[]).join(" "),weight:4,signal:"tags"},{value:e.body??"",weight:1,signal:"body"}].filter(s=>s.value.trim().length>0),n=new Map;for(let s of t){let o=ko(s.value);for(let[a,c]of Object.entries(ho)){if(!c.some(g=>o.has(g)))continue;let d=n.get(a)??{score:0,signals:new Set};d.score+=s.weight,d.signals.add(s.signal),n.set(a,d)}}let r=[...n.entries()].sort((s,o)=>o[1].score-s[1].score||Ot.indexOf(s[0])-Ot.indexOf(o[0]))[0];return!r||r[1].score<2?{category:yo(e),confidence:"fallback",matchedSignals:[]}:{category:r[0],confidence:r[1].score>=5?"high":r[1].score>=3?"medium":"low",matchedSignals:[...r[1].signals].sort()}}function yo(e){let t=vi(e.skillType??"");return t.includes("automation")?"automation":t.includes("mcp")?"ai":go}function vi(e){return e.trim().toLowerCase().replace(/[_\s]+/gu,"-")}function ko(e){return new Set(e.toLowerCase().split(/[^a-z0-9]+/u).map(t=>t.trim()).filter(t=>t.length>=2).flatMap(wo))}function wo(e){let t=[e];return e.endsWith("ing")&&e.length>5&&t.push(e.slice(0,-3)),e.endsWith("s")&&e.length>4&&t.push(e.slice(0,-1)),t}var vo=["standalone","workflow_automation","mcp_enhanced"];function bi(e){let t=e?.trim();if(!t)return"standalone";if(t==="workflow")return"workflow_automation";if(!vo.includes(t))throw new Error(`Unsupported skill type "${t}". Supported types: standalone, workflow, workflow_automation, mcp_enhanced.`);return t}function Si(e){return[{path:"SKILL.md",content:bo(e)},{path:"README.md",content:So(e)},{path:"references/guide.md",content:Co(e)},{path:"scripts/README.md",content:Po(e)}]}function bo(e){let t=_o(e);return`---
|
|
256
256
|
name: ${e.skillSlug}
|
|
257
257
|
description: ${e.description}
|
|
258
258
|
compatibility: Codex, Claude Code
|
|
@@ -267,7 +267,7 @@ metadata:
|
|
|
267
267
|
- model_context
|
|
268
268
|
- filesystem_read
|
|
269
269
|
---
|
|
270
|
-
# ${
|
|
270
|
+
# ${Kt(e.skillSlug)}
|
|
271
271
|
|
|
272
272
|
Use this skill when the user needs ${e.description.toLowerCase()}
|
|
273
273
|
|
|
@@ -280,7 +280,7 @@ Use this skill when the user needs ${e.description.toLowerCase()}
|
|
|
280
280
|
|
|
281
281
|
- If the skill does not trigger, make the user request more explicit and mention the task directly.
|
|
282
282
|
- Move deeper procedures into [references/guide.md](references/guide.md) to keep this file concise.
|
|
283
|
-
`}function
|
|
283
|
+
`}function So(e){return`# ${Kt(e.skillSlug)}
|
|
284
284
|
|
|
285
285
|
This scaffold was created for a ${e.skillType.replaceAll("_"," ")} skill.
|
|
286
286
|
|
|
@@ -303,12 +303,12 @@ Current summary:
|
|
|
303
303
|
- Slug: \`${e.skillSlug}\`
|
|
304
304
|
- Description: ${e.description}
|
|
305
305
|
- Default price: free (\`price_cents: 0\`)
|
|
306
|
-
`}function
|
|
306
|
+
`}function Po(e){return`# Scripts
|
|
307
307
|
|
|
308
308
|
Place optional helper scripts for \`${e.skillSlug}\` here.
|
|
309
309
|
|
|
310
310
|
Only include files that are required by the skill workflow. Keep the runtime surface small so bundle packaging stays predictable.
|
|
311
|
-
`}function
|
|
311
|
+
`}function Co(e){return`# ${Kt(e.skillSlug)} Guide
|
|
312
312
|
|
|
313
313
|
## Intent
|
|
314
314
|
|
|
@@ -320,15 +320,15 @@ Document the decision rules, expected inputs, and success criteria for this ${e.
|
|
|
320
320
|
- Example prompts that should trigger the skill
|
|
321
321
|
- Failure cases and recovery guidance
|
|
322
322
|
- Tooling or policy constraints
|
|
323
|
-
`}function
|
|
324
|
-
`);return`skills-layer-cli:api-key:${
|
|
323
|
+
`}function Kt(e){return e.split("-").map(t=>t.charAt(0).toUpperCase()+t.slice(1)).join(" ")}function _o(e){let t=yi(e.category);return t||wi({name:e.skillSlug,slug:e.skillSlug,description:e.description,skillType:e.skillType}).category}var xo=/^github:([^/]+)\/([^/#]+)(?:\/([^#]+))?(?:#(.+))?$/,Ro=/^gitlab:([^/#]+(?:\/[^/#]+)*?)\/([^/#]+)(?:\/([^/#]+))?(?:#(.+))?$/,$o=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)(?:\/(.+?))?(?:#([^@]+))?$/,Ao=/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/.+)?(?:#[^@]+)?$/,Io=/^(?:\.{1,2}(?:[\\/]|$)|[\\/]|[A-Za-z]:[\\/])/,jo=/^(?:ssh:\/\/)?git@github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/,Eo=/^(?:ssh:\/\/)?git@gitlab\.com[:/]([^/]+(?:\/[^/]+)*)\/([^/]+?)(?:\.git)?$/;function ut(e){let t=e.trim();if(t.length===0)throw new Error("import requires a non-empty source.");let{sourceInput:n,skillFilter:i}=Lo(t),r=n.match(xo);if(r){let[,g,f,m,y]=r;return ct({input:t,owner:g,repo:f,ref:y?.trim()||"main",subpath:m,skillFilter:i})}let s=n.match(Ro);if(s){let[,g,f,m,y]=s;return Dt({input:t,host:"gitlab.com",namespace:g,repo:f,ref:y?.trim()||"main",subpath:m,skillFilter:i})}let o=Uo(t);if(o)return o;let a=To(t);if(a)return a;let c=n.match(jo);if(c){let[,g,f]=c;return ct({input:t,owner:g,repo:ge(f),ref:"main",subpath:"SKILL.md"})}let u=n.match(Eo);if(u){let[,g,f]=u;return Dt({input:t,host:"gitlab.com",namespace:g,repo:ge(f),ref:"main",subpath:"SKILL.md"})}if(/^(?:git\+)?https?:\/\//u.test(n)){if(/[?&]skill=/u.test(n)){let g=new URL(n.replace(/^git\+/u,"")),f=g.searchParams.get("skill")?.trim();return g.searchParams.delete("skill"),{kind:"url",input:t,url:g.toString(),canonicalSource:g.toString(),...f?{skillFilter:f}:{}}}return{kind:"url",input:t,url:n.replace(/^git\+/u,""),canonicalSource:n.replace(/^git\+/u,"")}}let d=n.match($o);if(d&&!Io.test(n)){let[,g,f,m,y]=d;return ct({input:t,owner:g,repo:ge(f),ref:y?.trim()||"main",subpath:m,skillFilter:i})}return/^(?:ssh:\/\/)?git@/u.test(n)||/^(?:git\+)?ssh:\/\//u.test(n)?{kind:"git",input:t,url:n.replace(/^git\+/u,""),canonicalSource:n.replace(/^git\+/u,""),...i?{skillFilter:i}:{}}:{kind:"local",input:t,location:n,canonicalSource:n,...i?{skillFilter:i}:{}}}function dt(e){let t=e?.trim();return t&&t.length>0?t:"SKILL.md"}function Lo(e){if(e.startsWith("http://")||e.startsWith("https://")||e.startsWith("git@")||e.startsWith("ssh://"))return{sourceInput:e};let t=e.lastIndexOf("@");if(t<=0||t===e.length-1)return{sourceInput:e};let n=e.slice(0,t),i=e.slice(t+1).trim();return i.match(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u)?n.includes("#")?{sourceInput:n,skillFilter:i}:n.startsWith("github:")||n.startsWith("gitlab:")||Ao.test(n)?{sourceInput:n,skillFilter:i}:{sourceInput:n,skillFilter:i}:{sourceInput:e}}function Pi(e,t,n,i,r){return e==="gitlab"&&r&&r!=="gitlab.com"?`${e}://${r}/${t}@${n}/${i}`:`${e}://${t}@${n}/${i}`}function ge(e){return e.replace(/\.git$/u,"")}function Uo(e){if(!e.startsWith("http://")&&!e.startsWith("https://"))return null;let t=new URL(e);if(t.hostname!=="github.com")return null;let n=t.pathname.split("/").filter(Boolean);if(n.length<2)throw new Error("GitHub URLs must include an owner and repository.");let i=n[0],r=ge(n[1]),s="main",o="SKILL.md";(n[2]==="tree"||n[2]==="blob")&&(s=n[3]?.trim()||"main",o=dt(n.slice(4).join("/")));let a=t.searchParams.get("skill")?.trim()||void 0;return t.searchParams.delete("skill"),ct({input:e,owner:i,repo:r,ref:s,subpath:o,skillFilter:a})}function To(e){if(!e.startsWith("http://")&&!e.startsWith("https://"))return null;let t=new URL(e);if(t.hostname==="github.com")return null;let n=t.pathname.split("/").filter(Boolean),i=n.indexOf("-");if(t.hostname!=="gitlab.com"&&i===-1)return null;let r=i===-1?n:n.slice(0,i);if(r.length<2)throw new Error("GitLab URLs must include a namespace and repository.");let s=ge(r[r.length-1]),o=r.slice(0,-1).join("/"),a=i===-1?void 0:n[i+1],c=i===-1?[]:n.slice(i+2),u=(a==="tree"||a==="blob")&&c[0]?.trim()||"main",d=a==="tree"||a==="blob"?dt(c.slice(1).join("/")):"SKILL.md",g=t.searchParams.get("skill")?.trim()||void 0;return t.searchParams.delete("skill"),Dt({input:e,host:t.hostname,namespace:o,repo:s,ref:u,subpath:d,skillFilter:g})}function ct(e){let t=dt(e.subpath);return{kind:"github",input:e.input,owner:e.owner,repo:ge(e.repo),ref:e.ref,subpath:t,repoUrl:`https://github.com/${e.owner}/${ge(e.repo)}`,rawUrl:`https://raw.githubusercontent.com/${e.owner}/${ge(e.repo)}/${e.ref}/${t}`,canonicalSource:Pi("github",`${e.owner}/${ge(e.repo)}`,e.ref,t),...e.skillFilter?{skillFilter:e.skillFilter}:{}}}function Dt(e){let t=ge(e.repo),n=dt(e.subpath);return{kind:"gitlab",input:e.input,host:e.host,namespace:e.namespace,repo:t,ref:e.ref,subpath:n,repoUrl:`https://${e.host}/${e.namespace}/${t}`,rawUrl:`https://${e.host}/${e.namespace}/${t}/-/raw/${e.ref}/${n}`,canonicalSource:Pi("gitlab",`${e.namespace}/${t}`,e.ref,n,e.host),...e.skillFilter?{skillFilter:e.skillFilter}:{}}}var No="private",Ci="public",_i="unlisted",xi="delisted";function pt(e){if(typeof e!="string"||e.trim().length===0)return null;let t=e.trim().toLowerCase();return t==="private"?No:t===Ci?Ci:t===_i?_i:t===xi?xi:null}import{execFile as Fo}from"node:child_process";import{createHash as Bo}from"node:crypto";import{promisify as Mo}from"node:util";var Gt=Mo(Fo),Ge="apiKey",Re="apiKeyRef",Ve="Skills Layer CLI";function Vt(e=process.platform,t=process.env){let n=t.SKILLS_LAYER_CREDENTIAL_STORE?.trim().toLowerCase();return n==="local-file"||n==="local_file"||n==="disabled"||e!=="darwin"||process.env.VITEST==="true"&&n!=="macos-keychain"&&n!=="macos_keychain"?null:Ko()}async function Ri(e,t){if(!(typeof e[Ge]=="string"&&e[Ge].length>0))return e;let i=Ht(t);if(!i)return e;try{let r={...e,credentialStorage:"macos_keychain"},s=qo(e);return await i.set(zt(t),s,e[Ge]),r[Re]=s,delete r[Ge],r}catch{return Oo(e)}}async function $i(e,t){if(e.credentialStorage!=="macos_keychain"||e[Ge]||!e[Re])return e;let n=Ht(t);if(!n)return e;let i=await n.get(zt(t),e[Re]);return i?{...e,apiKey:i}:e}async function Ai(e,t){if(!e||e.credentialStorage!=="macos_keychain"||!e[Re])return;let n=Ht(t);n&&await n.delete(zt(t),e[Re])}function qo(e){let t=[e.baseUrl??"unknown-base-url",e.userId??e.email??e.role??"unknown-user","apiKey"].join(`
|
|
324
|
+
`);return`skills-layer-cli:api-key:${Bo("sha256").update(t).digest("base64url").slice(0,32)}`}function Ht(e){return e.store!==void 0?e.store:Vt(e.platform,e.env??process.env)}function zt(e){return e.service??Ve}function Oo(e){let t={...e,credentialStorage:"local_file_locked"};return delete t[Re],t}function Ko(){return{kind:"macos_keychain",async set(e,t,n){await Gt("/usr/bin/security",["add-generic-password","-a",t,"-s",e,"-w",n,"-U"])},async get(e,t){try{let{stdout:n}=await Gt("/usr/bin/security",["find-generic-password","-a",t,"-s",e,"-w"]);return n.trim()||null}catch{return null}},async delete(e,t){try{await Gt("/usr/bin/security",["delete-generic-password","-a",t,"-s",e])}catch{}}}}function Wt(e){let t=e.skillSlug??"<skill-slug>";return{localWork:{purpose:e.purpose,command:e.command,jsonCommand:e.jsonCommand},guardian:{checkCommand:`skills-layer guardian check --skill ${t} --json`,execCommand:`skills-layer guardian exec ${t} --json -- <command>`,mcpTools:["guardian.check","guardian.enforce","guardian.status","guardian.incident"],guidance:"Before risky shell, network, file, secret, browser, API, generated-code, or model-context actions, call MCP guardian.check/guardian.enforce or run skills-layer guardian check. Route shell actions through skills-layer guardian exec when strict local blocking is needed."},setup:{setupCommand:"skills-layer setup",hookStatusCommand:"skills-layer guardian hook status",hookInstallProjectCommand:"skills-layer guardian hook install --agent codex --scope project",hookInstallGlobalCommand:"skills-layer guardian hook install --agent codex --scope global"}}}var Ii=` ____ _ _ _ _ _
|
|
325
325
|
/ ___|| | _(_) | |___ | | __ _ _ _ ___ _ __
|
|
326
326
|
\\___ \\| |/ / | | / __| | | / _\` | | | |/ _ \\ '__|
|
|
327
327
|
___) | <| | | \\__ \\ | |__| (_| | |_| | __/ |
|
|
328
328
|
|____/|_|\\_\\_|_|_|___/ |_____\\__,_|\\__, |\\___|_|
|
|
329
329
|
|___/
|
|
330
330
|
Skills-Layer
|
|
331
|
-
AI Agent first platform for Skills`;var
|
|
331
|
+
AI Agent first platform for Skills`;var ji=`Skills Layer MCP
|
|
332
332
|
Configure Skills Layer for AI agents through a local stdio bridge.
|
|
333
333
|
|
|
334
334
|
Usage:
|
|
@@ -359,7 +359,7 @@ Checks:
|
|
|
359
359
|
repair rewrites the local bridge and supported target config.
|
|
360
360
|
disconnect removes Skills Layer MCP local state and the selected target config entry.
|
|
361
361
|
|
|
362
|
-
After setup or repair, open a fresh agent session or restart the agent if tools are not visible.`;var
|
|
362
|
+
After setup or repair, open a fresh agent session or restart the agent if tools are not visible.`;var Ui=`Skills Layer CLI
|
|
363
363
|
Agent-first skill marketplace for developers. CLI, MCP, and API share one journey model.
|
|
364
364
|
|
|
365
365
|
Usage:
|
|
@@ -415,7 +415,7 @@ Fast paths:
|
|
|
415
415
|
Primary commands:
|
|
416
416
|
Account and environment:
|
|
417
417
|
skills-layer register --method <email|google|github|gitlab|microsoft> [--email <email>] [--base-url <url>] [--json]
|
|
418
|
-
skills-layer login [--method <email|google|github|gitlab|microsoft>] [--email <email>] [--base-url <url>] [--json]
|
|
418
|
+
skills-layer login [--method <email|google|github|gitlab|microsoft>] [--email <email>] [--base-url <url>] [--no-open] [--json]
|
|
419
419
|
skills-layer login --api-key <key> [--base-url <url>] [--with-mcp|--no-mcp] [--json]
|
|
420
420
|
skills-layer logout [--json]
|
|
421
421
|
skills-layer auth status [--json]
|
|
@@ -423,9 +423,9 @@ Primary commands:
|
|
|
423
423
|
skills-layer whoami [--json]
|
|
424
424
|
skills-layer profile [--json]
|
|
425
425
|
skills-layer profile update [--display-name <text>] [--bio <text>] [--company <text>] [--json]
|
|
426
|
-
skills-layer api-key create --name <name> --scope <scope>[,<scope>...] [--expires <duration>] [--json]
|
|
427
|
-
skills-layer api-key list [--json]
|
|
428
|
-
skills-layer api-key revoke --key-id <key-id> [--json]
|
|
426
|
+
skills-layer api-key create --name <name> --scope <scope>[,<scope>...] [--expires <duration>] [--dry-run] [--json]
|
|
427
|
+
skills-layer api-key list [--type <automation|mcp|agent>] [--status <active|expired|revoked|all>] [--name <text>] [--sort <sort>] [--json]
|
|
428
|
+
skills-layer api-key revoke --key-id <key-id> [--dry-run] [--yes] [--json]
|
|
429
429
|
skills-layer setup [--json]
|
|
430
430
|
skills-layer mcp setup [--client <client-id>] [--all] [--environment <label>] [--json]
|
|
431
431
|
skills-layer mcp status [--client <client-id>] [--json]
|
|
@@ -435,7 +435,7 @@ Primary commands:
|
|
|
435
435
|
skills-layer backend --base-url <url> [--json]
|
|
436
436
|
skills-layer backend [status|cloud|local] [--base-url <url>] [--json]
|
|
437
437
|
skills-layer status [--base-url <url>] [--json]
|
|
438
|
-
skills-layer doctor [--base-url <url>] [--json]
|
|
438
|
+
skills-layer doctor [--deep] [--base-url <url>] [--json]
|
|
439
439
|
|
|
440
440
|
Discovery and trust:
|
|
441
441
|
skills-layer search [query] [--base-url <url>] [--agent <agent>] [--capability <capability>] [--trust <label>] [--runtime-risk <low|elevated|high>] [--security-capability <capability>] [--limit <n>] [--install [<skill-slug>]] [--json]
|
|
@@ -456,7 +456,7 @@ Primary commands:
|
|
|
456
456
|
skills-layer source reference resolve <qualified-ref-or-alias> [--json]
|
|
457
457
|
skills-layer approval request status <approval-request-id> [--json]
|
|
458
458
|
skills-layer approval request complete <approval-request-id> --decision <approved|denied> [--decision-evidence-json <json>] [--json]
|
|
459
|
-
skills-layer buy <skill-slug> [--payment-method <method>] [--json]
|
|
459
|
+
skills-layer buy <skill-slug> [--payment-method <method>] [--no-open] [--json]
|
|
460
460
|
skills-layer owned [--json]
|
|
461
461
|
skills-layer export <skill-slug> [--version <semver>] [--output <path>] [--show-url] [--json]
|
|
462
462
|
skills-layer add-review <skill-slug> --rating <1-5> [--feedback <text>] [--json]
|
|
@@ -550,9 +550,9 @@ Safety:
|
|
|
550
550
|
- Use guardian status [skill-slug] to see Cloud policy, stored user preference, effective mode, local hook posture, and the next Guardian action.
|
|
551
551
|
- Use guardian hook install to add native host hooks where supported; status reports the actual enforcement layer instead of overclaiming strict blocking.
|
|
552
552
|
- Use guardian exec when you need a stronger wrapper that refuses blocked shell actions before spawning the command.
|
|
553
|
-
- Use --dry-run before mutating catalog/source installs, workspace deployments, submissions, visibility, or ownership state.`,
|
|
553
|
+
- Use --dry-run before mutating catalog/source installs, workspace deployments, submissions, visibility, or ownership state.`,He=`${Ii}
|
|
554
554
|
|
|
555
|
-
${
|
|
555
|
+
${Ui}`;var Jt=new Set(["add-issue","add-review","agents","api-key","approval","auth","backend","buy","categories","check","compare","creator","doctor","export","featured","find","guardian","help","identity","import","install","installed","library","login","logout","mcp","owned","preview-trigger","profile","purchases","recommend","register","remove","restore","search","show","show-issues","show-reviews","source","status","sync","trending","trust","update","validate","whoami","workspace","workspaces"]),Yt=[...Jt].sort(),Ti={description:"Run this Skills Layer command.",mutates:!1,supportsDryRun:!1,requiresLogin:!1,requiresNetwork:!0,writesPaths:[],sideEffects:["cloud_read"],dryRun:void 0},Ei={root:{description:"Show public CLI guidance and command discovery.",requiresNetwork:!1,sideEffects:["read_only"]},"add-issue":{description:"Report a public skill issue.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_write"]},"add-review":{description:"Add a public skill review.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_write"]},agents:{description:"Inspect supported local agent targets.",requiresNetwork:!1,sideEffects:["local_read"]},"api-key":{description:"Create, list, and revoke scoped automation API keys.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","credential_mutation","human_handoff"]},"api-key create":{description:"Create a named scoped automation API key, or validate it with --dry-run.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","credential_mutation","human_handoff"],dryRun:{flag:"--dry-run",mutates:!1,validates:["name","scopes","expiry","active-key-limit"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},"api-key list":{description:"List scoped automation, MCP, and session keys without exposing raw secrets.",mutates:!1,requiresLogin:!0,sideEffects:["cloud_read"]},"api-key revoke":{description:"Revoke a scoped API key after dry-run or confirmation.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","credential_mutation","destructive_cloud"],dryRun:{flag:"--dry-run",mutates:!1,validates:["key-id","key-exists","revocation-preview"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},approval:{description:"Inspect and complete human approval requests.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},auth:{description:"Inspect, verify, repair, and recover account authentication.",mutates:!0,requiresNetwork:!0,sideEffects:["cloud_read","credential_mutation","human_handoff"]},backend:{description:"Inspect or select the backend used by this CLI.",mutates:!0,requiresNetwork:!1,writesPaths:["~/.skills-layer/backend.json"],sideEffects:["local_read","local_write"]},buy:{description:"Start a human-in-the-loop purchase flow for a skill.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","payment_mutation","human_handoff"]},check:{description:"Check one installed skill against local install state.",requiresNetwork:!1,sideEffects:["local_read"]},creator:{description:"Create, validate, submit, and manage creator-owned skills.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["local_read","local_write","cloud_read","cloud_write","human_handoff"]},"creator source prepare":{description:"Prepare a source connection for creator publication review.",mutates:!0,requiresLogin:!0,sideEffects:["local_read","cloud_read","cloud_write","human_handoff"]},"creator source publish-request":{description:"Request publication from a prepared source connection.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},"creator source release-status":{description:"Read source-connection release status.",requiresLogin:!0,sideEffects:["cloud_read"]},doctor:{description:"Run backend, auth, workspace, and Guardian readiness checks.",sideEffects:["local_read","cloud_read"]},export:{description:"Export an owned skill bundle or signed download URL.",mutates:!0,requiresLogin:!0,writesPaths:["<output path>"],sideEffects:["cloud_read","local_write"]},guardian:{description:"Run Guardian checks, incidents, modes, hooks, and guarded exec.",mutates:!0,supportsDryRun:!0,requiresLogin:!1,sideEffects:["local_read","local_write","cloud_read","cloud_write","human_handoff"]},help:{description:"Show local or Cloud-backed help.",requiresNetwork:!1,sideEffects:["read_only"]},identity:{description:"Manage social identity providers and linked identities.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},import:{description:"Inspect or import supported skill sources.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["local_read","cloud_read","cloud_write"]},install:{description:"Install a catalog skill or private source skill onto this machine.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,writesPaths:[".codex/skills/<skill-slug>","~/.skills-layer/installs.json"],sideEffects:["local_read","local_write","cloud_read","cloud_write"],dryRun:{flag:"--dry-run",mutates:!1,validates:["slug-or-source","scope","agent","trust","materialization-plan"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},installed:{description:"List locally installed skill records.",requiresNetwork:!1,sideEffects:["local_read"]},library:{description:"Manage owned library records and buyer feedback.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"]},login:{description:"Sign in and optionally set up MCP and Security Guardian.",mutates:!0,supportsDryRun:!1,writesPaths:["~/.skills-layer/config.json","~/.skills-layer/mcp.json"],sideEffects:["local_write","cloud_read","credential_mutation","human_handoff"]},logout:{description:"Remove the local CLI session.",mutates:!0,requiresNetwork:!1,writesPaths:["~/.skills-layer/config.json"],sideEffects:["credential_mutation","destructive_local"]},mcp:{description:"Set up, verify, repair, and disconnect MCP clients.",mutates:!0,requiresLogin:!0,writesPaths:["~/.skills-layer/mcp.json","agent MCP config files"],sideEffects:["local_read","local_write","cloud_read","credential_mutation"]},owned:{description:"List skills owned by the signed-in user.",requiresLogin:!0,sideEffects:["cloud_read"]},"preview-trigger":{description:"Preview skill trigger behavior from local source.",requiresNetwork:!0,sideEffects:["local_read","cloud_read"]},profile:{description:"View or update the signed-in account profile.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"]},purchases:{description:"Inspect purchases, invoices, refunds, and spending.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","payment_mutation"]},register:{description:"Create or verify an account through email or social auth.",mutates:!0,sideEffects:["cloud_write","human_handoff"]},remove:{description:"Remove a local skill install record and materialized files.",mutates:!0,requiresLogin:!1,writesPaths:[".codex/skills/<skill-slug>","~/.skills-layer/installs.json"],sideEffects:["local_read","destructive_local"]},restore:{description:"Inspect and restore a previously removed local install where possible.",mutates:!0,writesPaths:[".codex/skills/<skill-slug>","~/.skills-layer/installs.json"],sideEffects:["local_read","local_write","cloud_read"]},setup:{description:"Set up MCP and Security Guardian for detected AI tools.",mutates:!0,requiresLogin:!0,writesPaths:["~/.skills-layer/mcp.json","agent MCP and hook config files"],sideEffects:["local_read","local_write","cloud_read","credential_mutation","human_handoff"]},source:{description:"Manage source connections, approvals, and source references.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},sync:{description:"Reconcile local install records against the selected backend catalog.",mutates:!1,sideEffects:["local_read","cloud_read"]},update:{description:"Check whether an installed skill has updates.",supportsDryRun:!0,sideEffects:["local_read","cloud_read"]},validate:{description:"Validate a local skill bundle.",requiresNetwork:!0,sideEffects:["local_read","cloud_read"]},workspace:{description:"Manage workspace skill availability.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"],dryRun:{flag:"--dry-run",mutates:!1,validates:["workspace","skill","trust","entitlement","policy"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},workspaces:{description:"Alias for workspace commands.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"],dryRun:{flag:"--dry-run",mutates:!1,validates:["workspace","skill","trust","entitlement","policy"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}}},Do=new Set([...Yt,"api-key create","api-key list","api-key revoke","approval request","approval request complete","approval request status","auth recover","auth verify","creator init","creator source prepare","creator source publish-request","creator source release-status","creator submit","featured sort","find examples","guardian check","guardian exec","guardian hook","guardian hook install","guardian hook status","mcp disconnect","mcp repair","mcp setup","mcp status","mcp verify","profile update","source connection","source connection cancel","source connection complete","source connection start","source connection status","status details","validate examples","workspace create","workspace deploy","workspace guide","workspace list","workspace remove","workspace skills"]);function ze(e,t){let n=Ni(e,t),i=n[0],r=n.slice(1).join(" ")||void 0;if(!i||!Jt.has(i)||!Do.has(n.join(" ")))return null;if(i==="install")return`Skills Layer install help
|
|
556
556
|
|
|
557
557
|
Usage:
|
|
558
558
|
skills-layer install <skill-slug> [--version <semver>] [--scope <local|project|global|workspace>] [--agent <agent>] [--dry-run] [--json]
|
|
@@ -578,10 +578,68 @@ Good defaults:
|
|
|
578
578
|
After install:
|
|
579
579
|
skills-layer installed
|
|
580
580
|
skills-layer sync
|
|
581
|
-
skills-layer update <skill-slug>`;if(
|
|
581
|
+
skills-layer update <skill-slug>`;if(i==="api-key")return r==="create"?`Skills Layer api-key create help
|
|
582
582
|
|
|
583
583
|
Usage:
|
|
584
|
-
skills-layer
|
|
584
|
+
skills-layer api-key create --name <name> --scope <scope>[,<scope>...] [--expires <duration>] [--dry-run] [--json]
|
|
585
|
+
|
|
586
|
+
What it does:
|
|
587
|
+
- Creates a named scoped automation key for CI or scripts.
|
|
588
|
+
- The raw key is sent to your verified email and is not printed in CLI or MCP output.
|
|
589
|
+
- Use --dry-run to validate name, scopes, expiry, and active-key limits without creating a key or sending email.
|
|
590
|
+
- --expires supports day durations such as 7d, 30d, or 90d; unsupported duration formats are rejected before creation.
|
|
591
|
+
|
|
592
|
+
Examples:
|
|
593
|
+
skills-layer api-key create --name "GitHub Actions" --scope catalog:read,creator:submit --expires 30d --dry-run --json
|
|
594
|
+
skills-layer api-key create --name "GitHub Actions" --scope catalog:read,creator:submit --expires 30d
|
|
595
|
+
skills-layer api-key create --name "Read-only smoke" --scope catalog:read --expires 7d --json
|
|
596
|
+
|
|
597
|
+
Next:
|
|
598
|
+
skills-layer api-key list
|
|
599
|
+
skills-layer api-key revoke --key-id <key-id> --dry-run`:r==="list"?`Skills Layer api-key list help
|
|
600
|
+
|
|
601
|
+
Usage:
|
|
602
|
+
skills-layer api-key list [--type <automation|mcp|agent>] [--status <active|expired|revoked|all>] [--name <text>] [--created-after <date>] [--created-before <date>] [--expires-after <date>] [--expires-before <date>] [--sort <created-desc|created-asc|expires-desc|expires-asc|name-asc|name-desc|last-used-desc|last-used-asc>] [--json]
|
|
603
|
+
|
|
604
|
+
What it does:
|
|
605
|
+
- Lists scoped keys and managed CLI/MCP/session credentials without exposing raw secret values.
|
|
606
|
+
- Defaults to active keys sorted newest first.
|
|
607
|
+
|
|
608
|
+
Examples:
|
|
609
|
+
skills-layer api-key list
|
|
610
|
+
skills-layer api-key list --type automation --status active --sort name-asc --json
|
|
611
|
+
skills-layer api-key list --name deploy --created-after 2026-07-01 --json`:r==="revoke"?`Skills Layer api-key revoke help
|
|
612
|
+
|
|
613
|
+
Usage:
|
|
614
|
+
skills-layer api-key revoke --key-id <key-id> [--dry-run] [--yes] [--json]
|
|
615
|
+
|
|
616
|
+
What it does:
|
|
617
|
+
- Revokes one API key or managed credential by id.
|
|
618
|
+
- Use --dry-run first to preview the exact key id, type, prefix, and name.
|
|
619
|
+
- Human mode asks for confirmation; JSON/non-interactive mode requires --yes for real revocation.
|
|
620
|
+
|
|
621
|
+
Examples:
|
|
622
|
+
skills-layer api-key revoke --key-id key_123 --dry-run --json
|
|
623
|
+
skills-layer api-key revoke --key-id key_123 --yes --json`:`Skills Layer api-key help
|
|
624
|
+
|
|
625
|
+
Usage:
|
|
626
|
+
skills-layer api-key create --name <name> --scope <scope>[,<scope>...] [--expires <duration>] [--dry-run] [--json]
|
|
627
|
+
skills-layer api-key list [--type <automation|mcp|agent>] [--status <active|expired|revoked|all>] [--name <text>] [--sort <sort>] [--json]
|
|
628
|
+
skills-layer api-key revoke --key-id <key-id> [--dry-run] [--yes] [--json]
|
|
629
|
+
|
|
630
|
+
What it does:
|
|
631
|
+
- Manages scoped automation credentials.
|
|
632
|
+
- Normal human CLI/MCP login uses skills-layer login; API keys are for named automation.
|
|
633
|
+
- Raw keys are shown or sent only through controlled delivery paths and should not be pasted into logs.
|
|
634
|
+
- Use --dry-run for create/revoke previews before mutation.
|
|
635
|
+
|
|
636
|
+
Examples:
|
|
637
|
+
skills-layer api-key create --name "GitHub Actions" --scope catalog:read --expires 7d --dry-run --json
|
|
638
|
+
skills-layer api-key list --type automation --status active
|
|
639
|
+
skills-layer api-key revoke --key-id key_123 --dry-run`;if(i==="buy")return`Skills Layer buy help
|
|
640
|
+
|
|
641
|
+
Usage:
|
|
642
|
+
skills-layer buy <skill-slug> [--payment-method <card|pm_id>] [--no-open] [--json]
|
|
585
643
|
|
|
586
644
|
What it does:
|
|
587
645
|
- Starts a buyer purchase or checkout flow for one catalog skill.
|
|
@@ -596,7 +654,147 @@ Examples:
|
|
|
596
654
|
|
|
597
655
|
Next:
|
|
598
656
|
skills-layer purchases list
|
|
599
|
-
skills-layer install <skill-slug>`;if(
|
|
657
|
+
skills-layer install <skill-slug>`;if(i==="backend")return`Skills Layer backend help
|
|
658
|
+
|
|
659
|
+
Usage:
|
|
660
|
+
skills-layer backend status [--json]
|
|
661
|
+
skills-layer backend cloud [--json]
|
|
662
|
+
skills-layer backend local [--json]
|
|
663
|
+
skills-layer backend --base-url <url> [--json]
|
|
664
|
+
|
|
665
|
+
What it does:
|
|
666
|
+
- Shows or changes the selected Skills Layer API endpoint for this machine.
|
|
667
|
+
- cloud selects the production API; local selects http://127.0.0.1:8787.
|
|
668
|
+
- --base-url selects a custom endpoint and is validated before config is written.
|
|
669
|
+
- Status output shows whether the saved login belongs to the selected backend.
|
|
670
|
+
|
|
671
|
+
Examples:
|
|
672
|
+
skills-layer backend status
|
|
673
|
+
skills-layer backend --base-url https://api.staging.findfigg.co.uk
|
|
674
|
+
skills-layer backend local --json
|
|
675
|
+
|
|
676
|
+
Next:
|
|
677
|
+
skills-layer auth status
|
|
678
|
+
skills-layer login`;if(i==="status")return r==="details"?`Skills Layer status details help
|
|
679
|
+
|
|
680
|
+
Usage:
|
|
681
|
+
skills-layer status [--base-url <url>] [--json]
|
|
682
|
+
|
|
683
|
+
Output model:
|
|
684
|
+
- Backend check: selected endpoint, connectivity, and capability count.
|
|
685
|
+
- Authentication check: logged-in account, role, and backend/session match.
|
|
686
|
+
- Workspace readiness: whether a default workspace is available.
|
|
687
|
+
- Guidance: nextAction, nextStep, recommended command/tool/route, and docs topic when available.
|
|
688
|
+
|
|
689
|
+
When to use it:
|
|
690
|
+
- Use status for quick readiness.
|
|
691
|
+
- Use doctor when you need check-by-check remediation.
|
|
692
|
+
- Use auth status when you only need local login/backend metadata.`:`Skills Layer status help
|
|
693
|
+
|
|
694
|
+
Usage:
|
|
695
|
+
skills-layer status [--base-url <url>] [--json]
|
|
696
|
+
|
|
697
|
+
What it does:
|
|
698
|
+
- Loads the current account/backend/workspace readiness summary.
|
|
699
|
+
- Use this for a quick human or agent readiness check.
|
|
700
|
+
- For deeper remediation, use skills-layer doctor.
|
|
701
|
+
|
|
702
|
+
Examples:
|
|
703
|
+
skills-layer status
|
|
704
|
+
skills-layer status --json
|
|
705
|
+
|
|
706
|
+
Next:
|
|
707
|
+
skills-layer search "project planning"
|
|
708
|
+
skills-layer doctor`;if(i==="doctor")return`Skills Layer doctor help
|
|
709
|
+
|
|
710
|
+
Usage:
|
|
711
|
+
skills-layer doctor [--deep] [--base-url <url>] [--json]
|
|
712
|
+
|
|
713
|
+
What it does:
|
|
714
|
+
- Runs a fuller readiness check for backend, login, workspace, and edition capabilities.
|
|
715
|
+
- Returns check-by-check remediation guidance.
|
|
716
|
+
- --deep adds local credential storage, MCP, Guardian hook, local path, and agent target diagnostics.
|
|
717
|
+
- Use when status is unclear or an agent needs a structured recovery path.
|
|
718
|
+
|
|
719
|
+
Examples:
|
|
720
|
+
skills-layer doctor
|
|
721
|
+
skills-layer doctor --json
|
|
722
|
+
|
|
723
|
+
Next:
|
|
724
|
+
skills-layer auth status
|
|
725
|
+
skills-layer mcp status
|
|
726
|
+
skills-layer guardian status`;if(i==="add-review")return`Skills Layer add-review help
|
|
727
|
+
|
|
728
|
+
Usage:
|
|
729
|
+
skills-layer add-review <skill-slug> --rating <1-5> [--feedback <text>] [--json]
|
|
730
|
+
|
|
731
|
+
What it does:
|
|
732
|
+
- Adds or updates your review for a skill you can access.
|
|
733
|
+
- Rating is validated before submission.
|
|
734
|
+
- Use --json for agent-safe status output.
|
|
735
|
+
|
|
736
|
+
Examples:
|
|
737
|
+
skills-layer add-review project-planner --rating 5 --feedback "Useful planning workflow"
|
|
738
|
+
skills-layer show-reviews project-planner`;if(i==="add-issue")return`Skills Layer add-issue help
|
|
739
|
+
|
|
740
|
+
Usage:
|
|
741
|
+
skills-layer add-issue <skill-slug> --issue-type <bug|quality|safety|other> --message <text> [--json]
|
|
742
|
+
|
|
743
|
+
What it does:
|
|
744
|
+
- Reports a buyer-visible issue against a skill you can access.
|
|
745
|
+
- Issue type is validated before submission.
|
|
746
|
+
- Safety-related reports feed Guardian/security review signals.
|
|
747
|
+
|
|
748
|
+
Examples:
|
|
749
|
+
skills-layer add-issue project-planner --issue-type quality --message "Missing examples"
|
|
750
|
+
skills-layer show-issues project-planner`;if(i==="profile"&&r==="update")return`Skills Layer profile update help
|
|
751
|
+
|
|
752
|
+
Usage:
|
|
753
|
+
skills-layer profile update [--display-name <text>] [--bio <text>] [--company <text>] [--json]
|
|
754
|
+
|
|
755
|
+
What it does:
|
|
756
|
+
- Updates editable profile fields for the signed-in account.
|
|
757
|
+
- Email and role are identity properties and are not changed here.
|
|
758
|
+
- Use --json for machine-readable update results.
|
|
759
|
+
|
|
760
|
+
Examples:
|
|
761
|
+
skills-layer profile update --display-name "Manual Tester"
|
|
762
|
+
skills-layer profile update --company "Skills Layer" --json`;if(i==="recommend")return`Skills Layer recommend help
|
|
763
|
+
|
|
764
|
+
Usage:
|
|
765
|
+
skills-layer recommend <task> [--limit <n>] [--json]
|
|
766
|
+
|
|
767
|
+
What it does:
|
|
768
|
+
- Recommends skills for a natural-language task.
|
|
769
|
+
- --limit must be a whole number in the accepted range.
|
|
770
|
+
- Results include slugs you can inspect with show/trust/install.
|
|
771
|
+
|
|
772
|
+
Examples:
|
|
773
|
+
skills-layer recommend "choose a research plan" --limit 3
|
|
774
|
+
skills-layer recommend "summarize meeting notes" --json`;if(i==="compare")return`Skills Layer compare help
|
|
775
|
+
|
|
776
|
+
Usage:
|
|
777
|
+
skills-layer compare <skill-slug-1> <skill-slug-2> [<skill-slug-3> ... up to 5] [--json]
|
|
778
|
+
|
|
779
|
+
What it does:
|
|
780
|
+
- Compares up to 5 catalog skills side by side.
|
|
781
|
+
- Returns missing slugs separately so agents can recover cleanly.
|
|
782
|
+
- Review price, trust, compatibility, and risk before install.
|
|
783
|
+
|
|
784
|
+
Examples:
|
|
785
|
+
skills-layer compare project-planner gtm-strategy
|
|
786
|
+
skills-layer compare skill-a skill-b skill-c --json`;if(i==="categories")return`Skills Layer categories help
|
|
787
|
+
|
|
788
|
+
Usage:
|
|
789
|
+
skills-layer categories [--json]
|
|
790
|
+
|
|
791
|
+
What it does:
|
|
792
|
+
- Lists catalog categories you can use to browse or filter discovery.
|
|
793
|
+
- Category names are formatted for humans while JSON keeps stable identifiers.
|
|
794
|
+
|
|
795
|
+
Examples:
|
|
796
|
+
skills-layer categories
|
|
797
|
+
skills-layer search planning --json`;if(i==="export")return`Skills Layer export help
|
|
600
798
|
|
|
601
799
|
Usage:
|
|
602
800
|
skills-layer export <skill-slug> [--version <semver|external-id>] [--output <path>] [--show-url] [--json]
|
|
@@ -614,7 +812,7 @@ Examples:
|
|
|
614
812
|
|
|
615
813
|
Next:
|
|
616
814
|
skills-layer owned
|
|
617
|
-
skills-layer trust <skill-slug>`;if(
|
|
815
|
+
skills-layer trust <skill-slug>`;if(i==="import")return`Skills Layer import help
|
|
618
816
|
|
|
619
817
|
Usage:
|
|
620
818
|
skills-layer import <source> [--skill <skill-slug>] [--visibility <private|public|unlisted>] [--quarantine] [--json]
|
|
@@ -638,7 +836,7 @@ Examples:
|
|
|
638
836
|
|
|
639
837
|
Next:
|
|
640
838
|
skills-layer source connection start --provider github --source <url> --visibility private
|
|
641
|
-
skills-layer install <skill-slug>`;if(
|
|
839
|
+
skills-layer install <skill-slug>`;if(i==="sync")return`Skills Layer sync help
|
|
642
840
|
|
|
643
841
|
Usage:
|
|
644
842
|
skills-layer sync [--scope <local|project|global|workspace>] [--agent <agent>] [--json]
|
|
@@ -655,7 +853,7 @@ Examples:
|
|
|
655
853
|
|
|
656
854
|
Next:
|
|
657
855
|
skills-layer installed
|
|
658
|
-
skills-layer update <skill-slug>`;if(
|
|
856
|
+
skills-layer update <skill-slug>`;if(i==="restore")return`Skills Layer restore help
|
|
659
857
|
|
|
660
858
|
Usage:
|
|
661
859
|
skills-layer restore <skill-slug> [--json]
|
|
@@ -671,13 +869,14 @@ Examples:
|
|
|
671
869
|
|
|
672
870
|
Next:
|
|
673
871
|
skills-layer installed
|
|
674
|
-
skills-layer install <skill-slug>`;if(
|
|
872
|
+
skills-layer install <skill-slug>`;if(i==="remove")return`Skills Layer remove help
|
|
675
873
|
|
|
676
874
|
Usage:
|
|
677
|
-
skills-layer remove <skill-slug> [--json]
|
|
875
|
+
skills-layer remove <skill-slug> [--scope <local|project|global|workspace>] [--agent <agent>] [--json]
|
|
678
876
|
|
|
679
877
|
What it does:
|
|
680
878
|
- Removes the local install record for one skill.
|
|
879
|
+
- Validates scope/agent filters before changing local state.
|
|
681
880
|
- Leaves catalog ownership and purchase history unchanged.
|
|
682
881
|
- Use install again when you want to materialize the skill locally.
|
|
683
882
|
|
|
@@ -687,11 +886,11 @@ Examples:
|
|
|
687
886
|
|
|
688
887
|
Next:
|
|
689
888
|
skills-layer installed
|
|
690
|
-
skills-layer install <skill-slug>`;if(
|
|
889
|
+
skills-layer install <skill-slug>`;if(i==="login")return`Skills Layer login help
|
|
691
890
|
|
|
692
891
|
Usage:
|
|
693
892
|
skills-layer login
|
|
694
|
-
skills-layer login --method <google|github|gitlab|microsoft|email> [--email <email>] [--with-mcp|--no-mcp] [--json]
|
|
893
|
+
skills-layer login --method <google|github|gitlab|microsoft|email> [--email <email>] [--with-mcp|--no-mcp] [--no-open] [--json]
|
|
695
894
|
skills-layer login --api-key <key> [--with-mcp|--no-mcp] [--json]
|
|
696
895
|
|
|
697
896
|
What it does:
|
|
@@ -699,6 +898,7 @@ What it does:
|
|
|
699
898
|
- Email sign-in sends a one-time code and then waits for the code in interactive terminals.
|
|
700
899
|
- After sign-in, the CLI can set up Skills Layer MCP once for detected AI tools.
|
|
701
900
|
- --json is agent-safe: it returns structured status and never prints raw secrets.
|
|
901
|
+
- --no-open returns a browser handoff without launching a browser.
|
|
702
902
|
- API key login is an advanced fallback for staging, repair, or automation setup.
|
|
703
903
|
|
|
704
904
|
Examples:
|
|
@@ -712,7 +912,7 @@ Related:
|
|
|
712
912
|
skills-layer auth status
|
|
713
913
|
skills-layer auth repair
|
|
714
914
|
skills-layer mcp setup
|
|
715
|
-
skills-layer mcp status`;if(
|
|
915
|
+
skills-layer mcp status`;if(i==="register")return`Skills Layer register help
|
|
716
916
|
|
|
717
917
|
Usage:
|
|
718
918
|
skills-layer register
|
|
@@ -731,7 +931,7 @@ Email flow:
|
|
|
731
931
|
|
|
732
932
|
After verification:
|
|
733
933
|
skills-layer whoami
|
|
734
|
-
skills-layer setup`;if(
|
|
934
|
+
skills-layer setup`;if(i==="search"||i==="find"){if(i==="find"&&r==="examples")return`Skills Layer find examples help
|
|
735
935
|
|
|
736
936
|
Examples:
|
|
737
937
|
skills-layer find planning
|
|
@@ -742,11 +942,11 @@ Examples:
|
|
|
742
942
|
Related:
|
|
743
943
|
skills-layer search planning
|
|
744
944
|
skills-layer show <skill-slug>
|
|
745
|
-
skills-layer install <skill-slug>`;let
|
|
945
|
+
skills-layer install <skill-slug>`;let o=i==="find"?"find":"search";return`${i==="find"?"Skills Layer find help":"Skills Layer search help"}
|
|
746
946
|
|
|
747
947
|
Usage:
|
|
748
|
-
skills-layer ${
|
|
749
|
-
skills-layer ${
|
|
948
|
+
skills-layer ${o} [query] [--agent <agent>] [--capability <capability>] [--trust <label>] [--runtime-risk <low|elevated|high>] [--security-capability <capability>] [--limit <n>] [--json]
|
|
949
|
+
skills-layer ${o} [query] --install <skill-slug>
|
|
750
950
|
|
|
751
951
|
What it does:
|
|
752
952
|
- Searches the Skills Layer catalog and returns installable, trust-aware skill matches.
|
|
@@ -758,15 +958,15 @@ Accepted values:
|
|
|
758
958
|
--trust high|medium|low|published|published_with_findings|high_risk
|
|
759
959
|
|
|
760
960
|
Examples:
|
|
761
|
-
skills-layer ${
|
|
762
|
-
skills-layer ${
|
|
763
|
-
skills-layer ${
|
|
764
|
-
skills-layer ${
|
|
961
|
+
skills-layer ${o} planning
|
|
962
|
+
skills-layer ${o} planning --runtime-risk low --limit 3 --json
|
|
963
|
+
skills-layer ${o} "research plan" --agent codex --json
|
|
964
|
+
skills-layer ${o} planning --install project-planner
|
|
765
965
|
|
|
766
966
|
Next:
|
|
767
967
|
skills-layer show <skill-slug>
|
|
768
968
|
skills-layer trust <skill-slug>
|
|
769
|
-
skills-layer install <skill-slug>`}if(
|
|
969
|
+
skills-layer install <skill-slug>`}if(i==="check")return`Skills Layer check help
|
|
770
970
|
|
|
771
971
|
Usage:
|
|
772
972
|
skills-layer check <skill-slug> [--json]
|
|
@@ -783,7 +983,7 @@ Examples:
|
|
|
783
983
|
|
|
784
984
|
Next:
|
|
785
985
|
skills-layer update <skill-slug> --dry-run
|
|
786
|
-
skills-layer trust <skill-slug>`;if(
|
|
986
|
+
skills-layer trust <skill-slug>`;if(i==="creator")return r==="init"?`Skills Layer creator init help
|
|
787
987
|
|
|
788
988
|
Usage:
|
|
789
989
|
skills-layer creator init <skill-slug> [--type <standalone|workflow|workflow_automation|mcp_enhanced>] [--dir <target-dir>] [--description <text>] [--category <category>] [--json]
|
|
@@ -801,7 +1001,7 @@ Examples:
|
|
|
801
1001
|
Next:
|
|
802
1002
|
skills-layer validate <path>
|
|
803
1003
|
skills-layer preview-trigger <path>
|
|
804
|
-
skills-layer creator submit <path> --version 1.0.0 --dry-run`:
|
|
1004
|
+
skills-layer creator submit <path> --version 1.0.0 --dry-run`:r==="submit"?`Skills Layer creator submit help
|
|
805
1005
|
|
|
806
1006
|
Usage:
|
|
807
1007
|
skills-layer creator submit [<path-or-source>] [--source <source>] [--skill <skill-slug>] [--list] [--version <semver>] [--display-name <text>] [--skill-type <type>] [--category <category>] [--price-cents <n>] [--visibility <private|public|unlisted>] [--dry-run] [--json]
|
|
@@ -833,7 +1033,7 @@ Start here:
|
|
|
833
1033
|
Notes:
|
|
834
1034
|
- Creator commands are for authoring, submitting, pricing, visibility, trust, reviews, and earnings.
|
|
835
1035
|
- Use --dry-run before public submission, pricing, visibility, or source publication changes.
|
|
836
|
-
- Local and private-source authoring should stay private unless you explicitly choose public visibility.`;if(
|
|
1036
|
+
- Local and private-source authoring should stay private unless you explicitly choose public visibility.`;if(i==="show-reviews")return`Skills Layer show-reviews help
|
|
837
1037
|
|
|
838
1038
|
Usage:
|
|
839
1039
|
skills-layer show-reviews [skill-slug] [--json]
|
|
@@ -851,7 +1051,7 @@ Examples:
|
|
|
851
1051
|
Related:
|
|
852
1052
|
skills-layer add-review <skill-slug> --rating <1-5> --feedback <text>
|
|
853
1053
|
skills-layer show <skill-slug>
|
|
854
|
-
skills-layer trust <skill-slug>`;if(
|
|
1054
|
+
skills-layer trust <skill-slug>`;if(i==="auth")return r==="recover"?`Skills Layer auth recover help
|
|
855
1055
|
|
|
856
1056
|
Usage:
|
|
857
1057
|
skills-layer auth recover
|
|
@@ -866,7 +1066,7 @@ What it does:
|
|
|
866
1066
|
Examples:
|
|
867
1067
|
skills-layer auth recover
|
|
868
1068
|
skills-layer auth recover --email you@example.com
|
|
869
|
-
skills-layer auth recover complete --email you@example.com --code <code> --json`:
|
|
1069
|
+
skills-layer auth recover complete --email you@example.com --code <code> --json`:r==="verify"?`Skills Layer auth verify help
|
|
870
1070
|
|
|
871
1071
|
Usage:
|
|
872
1072
|
skills-layer auth verify --email <email> --code <code> [--json]
|
|
@@ -895,7 +1095,7 @@ Common flows:
|
|
|
895
1095
|
Notes:
|
|
896
1096
|
- Prefer skills-layer login for normal sign-in.
|
|
897
1097
|
- Use auth status to inspect the local session without printing secrets.
|
|
898
|
-
- Use auth repair when saved backend metadata and selected backend drift apart.`;if(
|
|
1098
|
+
- Use auth repair when saved backend metadata and selected backend drift apart.`;if(i==="guardian")return`Skills Layer Guardian help
|
|
899
1099
|
|
|
900
1100
|
Usage:
|
|
901
1101
|
skills-layer guardian check --skill <skill-slug> --action-json <json> [--version <semver>] [--path <installed-skill-path>] [--grant-json <json>] [--cloud-trust-ledger <auto|required|optional|off>] [--telemetry-mode <cloud_managed|local_only>] [--json]
|
|
@@ -909,7 +1109,7 @@ Usage:
|
|
|
909
1109
|
skills-layer guardian exec <skill-slug> [--action-json <json>] [--path <installed-skill-path>] [--dry-run] [--json] -- <command>
|
|
910
1110
|
|
|
911
1111
|
What it does:
|
|
912
|
-
- check performs public-safe local preflight, then asks Skills Layer Cloud for the security decision while keeping
|
|
1112
|
+
- check performs public-safe local preflight, then asks Skills Layer Cloud for the security decision while keeping sensitive policy evaluation server-side.
|
|
913
1113
|
- incident can write local disable/quarantine/report artifacts; local_only avoids uploading incident evidence.
|
|
914
1114
|
- enable, disable, and enable-warnings-only request one-skill Guardian mode changes; Cloud policy still decides the effective mode.
|
|
915
1115
|
- status shows the Cloud policy, the local per-skill preference if one is stored, the effective mode, hook posture, and next action.
|
|
@@ -929,7 +1129,7 @@ Enforcement:
|
|
|
929
1129
|
- native_hook means the selected host has a concrete pre-action hook configuration installed.
|
|
930
1130
|
- native_hook_candidate means Skills Layer wrote integration metadata but does not yet claim strict host blocking.
|
|
931
1131
|
- strict pre-action blocking still requires a host agent or wrapper that calls Guardian before tool execution.
|
|
932
|
-
- Cloud-managed decisions should receive only minimal action metadata, not raw files, secrets, or terminal output.`;if(
|
|
1132
|
+
- Cloud-managed decisions should receive only minimal action metadata, not raw files, secrets, or terminal output.`;if(i==="workspace"||i==="workspaces")return`Skills Layer workspace help
|
|
933
1133
|
|
|
934
1134
|
Usage:
|
|
935
1135
|
skills-layer workspace list [--json]
|
|
@@ -947,7 +1147,7 @@ What it does:
|
|
|
947
1147
|
Examples:
|
|
948
1148
|
skills-layer workspace list
|
|
949
1149
|
skills-layer workspace deploy ws_123 project-planner --dry-run
|
|
950
|
-
skills-layer workspace guide ws_123 project-planner`;if(
|
|
1150
|
+
skills-layer workspace guide ws_123 project-planner`;if(i==="source")return`Skills Layer source help
|
|
951
1151
|
|
|
952
1152
|
Usage:
|
|
953
1153
|
skills-layer source connection start --provider <github|gitlab|local|generic_git|domain> --source <source> [--skill <skill-slug>] [--visibility <private|public|unlisted>] [--json]
|
|
@@ -963,7 +1163,7 @@ What it does:
|
|
|
963
1163
|
|
|
964
1164
|
Examples:
|
|
965
1165
|
skills-layer source connection start --provider github --source https://github.com/OWNER/REPO --skill my-skill --visibility private
|
|
966
|
-
skills-layer source connection status source_connection_123`;if(
|
|
1166
|
+
skills-layer source connection status source_connection_123`;if(i==="purchases")return`Skills Layer purchases help
|
|
967
1167
|
|
|
968
1168
|
Usage:
|
|
969
1169
|
skills-layer purchases list [--json]
|
|
@@ -980,7 +1180,7 @@ What it does:
|
|
|
980
1180
|
Examples:
|
|
981
1181
|
skills-layer purchases list
|
|
982
1182
|
skills-layer purchases invoice purchase_123
|
|
983
|
-
skills-layer purchases refund-quote purchase_123`;if(
|
|
1183
|
+
skills-layer purchases refund-quote purchase_123`;if(i==="approval")return`Skills Layer approval help
|
|
984
1184
|
|
|
985
1185
|
Usage:
|
|
986
1186
|
skills-layer approval request status <approval-request-id> [--json]
|
|
@@ -998,11 +1198,13 @@ Examples:
|
|
|
998
1198
|
|
|
999
1199
|
Next:
|
|
1000
1200
|
skills-layer source connection status <source-connection-id>
|
|
1001
|
-
skills-layer creator source prepare <source-connection-id> <path>`;if(
|
|
1201
|
+
skills-layer creator source prepare <source-connection-id> <path>`;if(i==="mcp")return ji;let s=r?` ${r}`:"";return`Skills Layer ${i}${s} help
|
|
1002
1202
|
|
|
1003
|
-
Run \`skills-layer --help\` for public CLI usage.`}
|
|
1004
|
-
`))
|
|
1005
|
-
|
|
1203
|
+
Run \`skills-layer --help\` for public CLI usage.`}function $e(e,t){let n=Ni(e,t),i=n[0],r=n.slice(1).join(" ")||void 0;if(!i)return Li("root",void 0,Ui);if(!Jt.has(i))return null;let s=ze(i,r?n.slice(1):void 0);return s?Li(i,r,s):null}function Ni(e,t){return[e,...Array.isArray(t)?t:t?[t]:[]].flatMap(n=>n?.split(/\s+/u)??[]).map(n=>n.trim().toLowerCase()).filter(Boolean)}function Li(e,t,n){let i=Ei[e]??{},r=t?Ei[`${e} ${t}`]??{}:{},s={...Ti,...i,...r},o=r.description??i.description,a=Go(o,n),c=`skills-layer ${e==="root"?"<command>":e} [options]`;return{command:e,...t?{subcommand:t}:{},usage:Ho(n,"Usage")||c,description:a,options:zo(n),examples:Zt(n,"Examples").filter(u=>u.startsWith("skills-layer ")),mutates:s.mutates,supportsJson:!0,supportsDryRun:s.supportsDryRun,requiresLogin:s.requiresLogin,requiresNetwork:s.requiresNetwork,writesPaths:s.writesPaths,sideEffects:s.sideEffects,...s.supportsDryRun?{dryRun:s.dryRun??{flag:"--dry-run",mutates:!1,validates:["arguments","policy"],mayContactCloud:s.requiresNetwork,createsRecords:!1,sendsEmail:!1}}:{}}}function Go(e,t){if(e)return e;let n=Vo(t);return n||Ti.description}function Vo(e){let n=Zt(e,"What it does").find(i=>i.startsWith("- "));return n?n.replace(/^-+\s*/u,"").trim():""}function Ho(e,t){return Zt(e,t).join(`
|
|
1204
|
+
`).trim()}function Zt(e,t){let n=e.split(/\r?\n/u),i=n.findIndex(s=>s.trim().toLowerCase()===`${t.toLowerCase()}:`);return i===-1?[]:n.slice(i+1).join(`
|
|
1205
|
+
`).trimStart().split(/\n\s*\n/u)[0].split(/\r?\n/u).map(s=>s.trim()).filter(Boolean)}function zo(e){return[...new Set([...e.matchAll(/--[a-z0-9][a-z0-9-]*/giu)].map(t=>t[0]).sort())]}var gt="0.1.7";var A=class extends Error{status;details;constructor(t,n,i){super(n),this.name="ApiError",this.status=t,this.details=i}},Tr=1,Ln=1,Fi=1,Un="skills-layer-public-cli-v1",ye="skills-layer-security-hook",ie="Skills Layer Security Hook",Tn="https://api.skills-layer.com",Yo="http://127.0.0.1:8787",Bi=new Set(["json","dry-run","help","list","all","deep","verbose","show-url","no-open","quarantine","confirm","confirmed","yes","with-mcp","no-mcp","allow-unmanaged-once","disclose-source","allow-findings-featured"]),Qt=new Set(["accept-capability","approval-request-id","grant-json","paraphrase","should-not-trigger","should-trigger"]),Mi=new Set(["bio","company","description","display-name","feedback","message","note","reason","search","summary"]),qi=new Set(["action","action-json","agent","amount-cents","api-key","base-url","capability","category","claim-id","client","cloud-trust-ledger","code","commit-sha","created-after","created-before","decision","decision-evidence-json","dependency-audit-status","dir","email","environment","evidence-json","expires","expires-after","expires-before","fixed-version","format","install","issue-id","issue-type","key-id","kind","license","limit","listing-status","max-characters","method","mode","name","output","path","payment-method","pin","price-cents","provider","provider-installation-id","provider-owner-id","provider-project-id","provider-repo-id","provenance-intent","publication-status","rating","requested-role","review-id","runtime-risk","scope","security-capability","skill","skill-type","sort","source","source-intake-context","state","status","text","telemetry-mode","trust","type","unmanaged-policy","version","version-id","visibility","workspace"]),Oi=new Set(Yt),Zo=new Set(["standards","marketplace-status","capabilities","schema-plan","optimize-tokens"]);async function np(e,t={}){let n={env:t.env??process.env,platform:t.platform??process.platform,cwd:t.cwd??process.cwd(),now:t.now??(()=>new Date().toISOString()),fetchFn:t.fetch??globalThis.fetch,openUrl:t.openUrl??td(t.platform??process.platform),stdoutIsTty:t.stdoutIsTty??!!process.stdout.isTTY,promptText:t.promptText??Zu(),promptSecret:t.promptSecret??Qu(),promptSelect:t.promptSelect??Xu(t.selectInput??process.stdin,t.selectOutput??process.stdout),sleep:t.sleep??(a=>new Promise(c=>setTimeout(c,a))),emitInfo:t.emitInfo??(a=>process.stdout.write(`${a}
|
|
1206
|
+
`)),credentialStore:t.credentialStore!==void 0?t.credentialStore:Vt(t.platform??process.platform,t.env??process.env)},i=e[0];if(!i){let a=en([]),c=await We(a.flags,n);return await Cc(a.flags,c)}if(i==="--help"||i==="-h"){let a=en(e.slice(1));if(a.flags.json){let c=await We(a.flags,n),u=$e();return h(u,"Help loaded.",!0,c)}return{exitCode:0,stdout:He,stderr:""}}if(i==="--version"||i==="-v")return{exitCode:0,stdout:`skills-layer ${gt}
|
|
1207
|
+
`,stderr:""};let r=en(e.slice(1));if(r.error)return k(r.error,r.flags.json);let{flags:s,positionals:o}=r;if(i==="admin")return k("The public skills-layer package does not include internal commands.",s.json);if(i==="version"){let a=await We(s,n);return h({status:"ok",name:"skills-layer",version:gt},`skills-layer ${gt}`,s.json,a)}if(s.help){if(s.json){let c=await We(s,n),u=$e(i,o);return u?h(u,"Help loaded.",!0,c):Oi.has(i)?kn([i,...o],!0):k(Xt(i),!0)}let a=ze(i,o);return a?{exitCode:0,stdout:a,stderr:""}:Oi.has(i)?kn([i,...o],s.json):k(Xt(i),s.json)}try{let a=await We(s,n);switch(i){case"agents":return await ea(o,s,a);case"backend":return await ta(o,s,a);case"register":return await Nr(s,a);case"login":return await Fr(s,a);case"logout":return await Br(s,a);case"whoami":return await $("/api/v1/whoami",s,a,"Account loaded.",{authenticated:!0});case"profile":return await ra(o,s,a);case"auth":return await oa(o,s,a);case"identity":return await ua(o,s,a);case"api-key":return await da(o,s,a);case"mcp":return await ha(o,s,a);case"search":case"find":return await Sa(o,s,a);case"featured":case"trending":return await Ha(i,s,a);case"categories":return o.length>0?nr("categories",o[0],s):await $("/api/v1/categories",s,a,"Categories loaded.");case"recommend":return await za(o,s,a);case"compare":return await Wa(o,s,a);case"show":return await Ja(o,s,a);case"trust":return await Ya(o,s,a);case"help":return await Za(o,s,a);case"status":return o.length>0?nr("status",o[0],s):await $("/api/v1/status",s,a,"Status loaded.");case"doctor":return await Qc(s,a);case"setup":return await os(s,a);case"validate":return await Qa(o,s,a);case"preview-trigger":return await Xa(o,s,a);case"creator":return await el(o,s,a);case"install":return await qn(o,s,a);case"installed":return await Hl(s,a);case"remove":return await zl(o,s,a);case"update":return await Wl(o,s,a);case"sync":return await Yl(s,a);case"restore":return await oc(o,s,a);case"check":return await ac(o,s,a);case"import":return await lc(o,s,a);case"source":return await uc(o,s,a);case"approval":return await gc(o,s,a);case"workspace":case"workspaces":return await mc(o,s,a);case"buy":return await fc(o,s,a);case"purchases":return await hc(o,s,a);case"owned":return await $("/api/v1/me/library",s,a,"Owned skills loaded.",{authenticated:!0});case"export":return await kc(o,s,a);case"library":return await yc(o,s,a);case"add-review":return await fr("add",o,s,a);case"show-reviews":return await fr("show",o,s,a);case"add-issue":return await hr("add",o,s,a);case"show-issues":return await hr("show",o,s,a);case"guardian":return await wc(o,s,a);default:return k(Xt(i),s.json)}}catch(a){return a instanceof A?Ut(a,s.json):k(Z(a),s.json)}}function Xt(e){let t=e.trim().toLowerCase();return t==="purchase"?`Unknown command "${e}".
|
|
1006
1208
|
|
|
1007
1209
|
Did you mean:
|
|
1008
1210
|
skills-layer buy <skill-slug>
|
|
@@ -1015,7 +1217,7 @@ Did you mean:
|
|
|
1015
1217
|
skills-layer show <skill-slug>`:t==="security-report"?`Unknown command "${e}".
|
|
1016
1218
|
|
|
1017
1219
|
Did you mean:
|
|
1018
|
-
skills-layer trust <skill-slug>`:`Unknown command "${e}".`}function ui(e){let t={json:!1,help:!1,dryRun:!1,list:!1,all:!1,verbose:!1,showUrl:!1,quarantine:!1,confirmed:!1,allowUnmanagedOnce:!1,discloseSource:!1,allowFindingsFeatured:!1,shouldTrigger:[],shouldNotTrigger:[],paraphrase:[],grantJson:[],findingCode:[],acceptCapability:[],approvalRequestId:[]},n=[];for(let i=0;i<e.length;i+=1){let r=e[i];if(!r)continue;if(r==="--"){n.push(...e.slice(i+1));break}if(r==="-h"){t.help=!0;continue}if(!r.startsWith("--")){n.push(r);continue}let s=r.slice(2);if(Ys.has(s)){let l=At(s);s==="confirm"?t.confirmed=!0:t[l]=!0;continue}let o=e[i+1];if(!o||o.startsWith("--")){if(s==="install"){t.install="";continue}return{flags:t,positionals:n,error:`Flag --${s} requires a value.`}}if(Zs.has(s)){let l=Xs(e,i);if(!l.value)return{flags:t,positionals:n,error:`Flag --${s} requires a value.`};t[At(s)]=l.value,i=l.nextIndex;continue}if(Qs.has(s)||li.has(s)){let l=At(s);if(li.has(s)){let c=Array.isArray(t[l])?t[l]:[];c.push(o),t[l]=c}else t[l]=o;i+=1;continue}return{flags:t,positionals:n,error:`Unknown flag --${s}.`}}return{flags:t,positionals:n}}function Xs(e,t){let n=[],i=t;for(let r=t+1;r<e.length;r+=1){let s=e[r];if(!s||s.startsWith("--"))break;n.push(s),i=r}return{value:n.length>0?n.join(" "):null,nextIndex:i}}function At(e){return e.replace(/-([a-z])/gu,(t,n)=>n.toUpperCase())}async function Lt(e,t){let n=eo(t.env,t.platform),[i,r]=await Promise.all([vc(n.configPath,t),Y(n.backendPreferencePath)]),s=ie(p(e.baseUrl)??X(t.env.SKILLS_LAYER_BASE_URL)??X(r?.preferredBaseUrl)??X(i?.baseUrl)??pn),o=p(e.apiKey)??X(t.env.SKILLS_LAYER_API_KEY),l=X(i?.apiKey),c=X(i?.baseUrl),u=!c||ie(c)===s,d=o??(u?l:void 0),g=!o&&l&&c&&!u?`Your saved login belongs to ${ie(c)}, but the selected backend is ${s}. Run \`skills-layer backend --base-url ${ie(c)}\` to use that login, or run \`skills-layer login\` for ${s}.`:void 0;return{...t,paths:n,config:i,baseUrl:s,apiKey:d,authBlockedMessage:g}}function eo(e,t){let n=t==="win32"?xe:cn,i=t==="win32"?X(e.USERPROFILE)??X(e.HOME):X(e.HOME),r=n.join(i??".",".skills-layer");return{stateDir:r,configPath:n.join(r,"config.json"),backendPreferencePath:n.join(r,"backend-preference.json"),installsPath:n.join(r,"installs.json"),importsPath:n.join(r,"imports.json"),mcpConfigPath:n.join(r,"mcp.json"),mcpPreferencePath:n.join(r,"mcp-preference.json"),bundlesDir:n.join(r,"bundles"),incidentsDir:n.join(r,"incidents")}}async function to(e,t,n){if(e[0]!=="list")return k(`Unknown agents command "${e[0]??""}".`,t.json);let i=ge(n.env,n.platform,n.cwd).map(r=>({id:r.id,displayName:r.displayName,capabilities:r.capabilities,projectSkillsPath:r.targets.projectSkillsPath,globalSkillsPath:r.targets.globalSkillsPath}));return h({status:"ok",results:i},`Found ${i.length} supported agent targets.`,t.json,n)}async function no(e,t,n){let i=e[0],r=p(t.baseUrl);if(!i&&r||i==="cloud"||i==="local"){let c=ie(r??(i==="local"?Js:pn)),u=ye(c),d=n.config?.baseUrl??null,g=!n.config?.baseUrl||ie(n.config.baseUrl)===c;return await D(n.paths.backendPreferencePath,{version:dn,preferredBaseUrl:c,savedAt:n.now()}),h({status:"updated",selectedBackend:u,selectedBaseUrl:c,savedLoginBaseUrl:d,loginMatchesSelectedBackend:g,loggedIn:!!n.apiKey&&g,...g?{}:{warning:`Saved login belongs to ${d}; selected backend is ${c}.`}},g?`Backend set to ${u}.`:`Backend set to ${u}. Saved login is for ${d}.`,t.json,n)}if(i&&i!=="status")return k(`Unknown backend command "${i}".`,t.json);let s=ye(n.baseUrl),o=!n.config?.baseUrl||ie(n.config.baseUrl)===n.baseUrl,l=!!n.apiKey&&o;return h({status:"ok",selectedBackend:s,selectedBaseUrl:n.baseUrl,savedLoginBaseUrl:n.config?.baseUrl??null,loginMatchesSelectedBackend:o,loggedIn:l,email:l?n.config?.email??null:null,role:l?n.config?.role??null:null},`Backend: ${n.baseUrl}`,t.json,n)}var gn=[{value:"google",label:"Google",description:"Open browser sign-in and return here"},{value:"github",label:"GitHub",description:"Open browser sign-in and return here"},{value:"gitlab",label:"GitLab",description:"Open browser sign-in and return here"},{value:"microsoft",label:"Microsoft",description:"Open browser sign-in and return here"}],io=[...gn,{value:"email",label:"Email code",description:"Use an emailed one-time code"},{value:"api_key",label:"API key (advanced)",description:"Paste an existing Skills Layer login key"}],ro=[{value:"email",label:"Email",description:"Use an emailed verification code and API key"},...gn];async function zi(e,t){let n=p(e.method);if(!n)if(e.json)n="email";else try{n=await t.promptSelect("Choose how to register:",ro)}catch{return k("register requires --method when interactive selection is unavailable. Try `skills-layer register --method email --email you@example.com`, `skills-layer register --method google`, `skills-layer register --method github`, `skills-layer register --method gitlab`, or `skills-layer register --method microsoft`.",!1)}if(n==="email"){let r=p(e.email);if(!r&&!e.json)try{r=await t.promptText("Enter your email address: ")}catch{return k("register --method email requires --email when interactive prompts are unavailable.",!1)}r=v(r,"register requires --email.");let s=await b(t,"/api/v1/register",{method:"POST",headers:j(),body:JSON.stringify({method:n,email:r})});if(e.json){let l=s.status==="already_registered"?sn(s):W({...s,nextCommand:`skills-layer auth verify --email ${r} --code <code> --json`,nextAction:"auth.verify"}),c=s.status==="already_registered"?`${r} is already registered.`:`Registration started for ${r}.`;return h(l,c,e.json,t)}if(s.status==="already_registered")return h(sn(s),`${r} is already registered. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,!1,t);let o;try{o=await t.promptText(`Enter the verification code sent to ${r} (check spam/junk folder if missing): `)}catch{return h(W(s),`Registration started for ${r}. Check your email (including spam/junk folder) for the verification code, then run \`skills-layer auth verify --email ${r} --code <code>\`.`,!1,t)}return await br(r,o,e,t,`Verified ${r}.`)}let i=await b(t,"/api/v1/identity/social/start",{method:"POST",headers:j(),body:JSON.stringify({provider:n,mode:"login"})});return e.json?h(i,"Social registration started.",e.json,t):await Pn(n,i,e,t,"login")}async function Wi(e,t){if(e.withMcp&&e.noMcp)return k("login cannot combine --with-mcp and --no-mcp.",e.json);let n=p(e.apiKey);if(n){let o=await Oe(t,n,{notifyLogin:!0}),l=await zt(e,{...t,config:o,apiKey:n});return H(l)?l:h(W({status:"verified",...o,...l.data?{mcp:l.data}:{}}),[`Logged in as ${o.email}.`,l.message??""].filter(Boolean).join(" "),e.json,t)}let i=p(e.method);if(!i&&!e.json)try{let o=await t.promptSelect("Choose how to sign in:",io);i=o==="api_key"?void 0:o}catch{return k("login requires --api-key or --method <email|google|github|gitlab|microsoft> when interactive selection is unavailable.",!1)}if(i){if(i==="email"){let l=p(e.email);!l&&!e.json&&(l=(await t.promptText("Enter your email address: ")).trim()),l=v(l,"login --method email requires --email.");let c=await b(t,"/api/v1/identity/recover/start",{method:"POST",headers:j(),body:JSON.stringify({email:l,method:"email",intent:"login"})});if(e.json)return h(c,`Passwordless email login started for ${l}.`,!0,t);let u;try{u=(await t.promptText(`Enter the sign-in code sent to ${l} (check spam/junk folder if missing): `)).trim()}catch{return h(c,`Passwordless email login started for ${l}. Check your email, then run \`skills-layer login --method email --email ${l}\` again when prompts are available.`,!1,t)}let d=await b(t,"/api/v1/identity/recover/complete",{method:"POST",headers:j(),body:JSON.stringify({email:l,code:u,intent:"login"})});return await dt(l,d,e,t,`Verified ${l}.`)}if(!["google","github","gitlab","microsoft"].includes(i))return k("login --method must be email, google, github, gitlab, or microsoft.",e.json);let o=await b(t,"/api/v1/identity/social/start",{method:"POST",headers:j(),body:JSON.stringify({provider:i,mode:"login"})});return e.json?h(o,"Social login started.",!0,t):await Pn(i,o,e,t,"login")}if(!e.json)try{n=(await t.promptSecret("Enter your Skills Layer API key: ")).trim()}catch{return k("login requires an API key.",e.json)}if(!n)return k("login requires --api-key or --method <email|google|github|gitlab|microsoft>.",e.json);let r=await Oe(t,n,{notifyLogin:!0}),s=await zt(e,{...t,config:r,apiKey:n});return H(s)?s:h(W({status:"verified",...r,...s.data?{mcp:s.data}:{}}),[`Logged in as ${r.email}.`,s.message??""].filter(Boolean).join(" "),e.json,t)}async function Ji(e,t){return await ri(t.config,{env:t.env,platform:t.platform,store:t.credentialStore}),await an(t.paths.configPath,{force:!0}),h({status:"logged_out"},"Logged out.",e.json,t)}async function so(e,t,n){let i=e[0]??"show";if(i==="show")return await R("/api/v1/profile",t,n,"Editable profile loaded.",{authenticated:!0});if(i==="update"){let r=await oo(t,n);if(H(r))return r;let s=await b(n,"/api/v1/profile",{method:"PATCH",headers:j(n.apiKey),body:JSON.stringify(r)});return h(s,"Profile updated.",t.json,n)}return k(`Unknown profile command "${i}".`,t.json)}async function oo(e,t){let n=q(e,["displayName","bio","company"]);if(Object.keys(n).length>0)return n;if(e.json)return k("profile update requires at least one of --display-name, --bio, or --company.",!0);try{let i=await t.promptText("Display name (leave blank to keep unchanged): "),r=await t.promptText("Bio (leave blank to keep unchanged): "),s=await t.promptText("Company (leave blank to keep unchanged): "),o=x({displayName:i||void 0,bio:r||void 0,company:s||void 0});return Object.keys(o).length===0?k("No profile changes entered.",!1):o}catch{return k("profile update requires at least one of --display-name, --bio, or --company.",!1)}}async function ao(e,t,n){let i=e[0];if(i==="register")return await zi({...t,method:"email"},n);if(i==="verify"){let r=v(t.email,"auth verify requires --email."),s=v(t.code,"auth verify requires --code.");return await br(r,s,t,n,`Verified ${r}.`)}return i==="recover"?await uo(e.slice(1),t,n):i==="login"?await Wi(t,n):i==="logout"?await Ji(t,n):i==="status"?lo(t,n):i==="repair"?await co(t,n):k(`Unknown auth command "${i??""}".`,t.json)}function lo(e,t){let n=t.config?.baseUrl?ie(t.config.baseUrl):null,i=!!(t.apiKey&&n===t.baseUrl);return h({status:"auth_status",selectedBackend:ye(t.baseUrl),selectedBaseUrl:t.baseUrl,loggedIn:i,requiresLogin:!i,...t.config?.email?{savedLogin:{baseUrl:n,email:t.config.email,role:t.config.role??null,roles:t.config.roles??[],savedAt:t.config.savedAt??null,...t.config.credentialStorage?{credentialStorage:t.config.credentialStorage}:{},matchesSelectedBackend:i}}:{}},i&&t.config?.email?`Logged in as ${t.config.email}.`:t.config?.baseUrl?`Saved login targets ${n}; selected backend is ${t.baseUrl}. Run \`skills-layer auth repair\` or \`skills-layer login\`.`:"Not logged in. Run `skills-layer login`.",e.json,t)}async function co(e,t){if(!t.config?.baseUrl||!t.config.apiKey||!t.config.email||!t.config.role||!t.config.savedAt)return k("No saved Skills Layer login was found to repair. Run `skills-layer login`.",e.json);let n=ie(t.config.baseUrl);return await D(t.paths.backendPreferencePath,{version:dn,preferredBaseUrl:n,savedAt:t.now()}),await Rn(t.paths.configPath,{...t.config,baseUrl:n,savedAt:t.now()},t),h({status:"auth_repaired",baseUrl:n,loggedIn:!0,email:t.config.email,role:t.config.role,credentialStorage:t.config.credentialStorage??"local_file_locked"},`Auth repaired for ${t.config.email}. Backend preference now matches ${n}.`,e.json,t)}async function uo(e,t,n){let i=e[0]??p(t.method)??"email",r=p(t.email);if(!r&&!t.json)try{r=await n.promptText("Enter your email address: ")}catch{return k("auth recover requires --email when interactive prompts are unavailable.",!1)}if(r=v(r,"auth recover requires --email."),i==="complete"){let c=p(t.code);if(!c&&!t.json)try{c=await n.promptText("Enter the recovery code: ")}catch{return k("auth recover complete requires --code when interactive prompts are unavailable.",!1)}return c=v(c,"auth recover complete requires --code."),await di(r,c,t,n)}let s=await b(n,"/api/v1/identity/recover/start",{method:"POST",headers:j(),body:JSON.stringify({email:r,method:i})}),o=sn(s);if(t.json)return h(o,"Recovery started.",!0,n);let l="";try{l=(await n.promptText("Enter the recovery code if you received one, or press Enter to stop: ")).trim()}catch{return h(o,`If this email can continue, instructions have been sent. Check your inbox and spam folder. When you have a code, run \`skills-layer auth recover complete --email ${r} --code <code>\`.`,!1,n)}return l?await di(r,l,t,n):h(o,`If this email can continue, instructions have been sent. When you have a code, run \`skills-layer auth recover complete --email ${r} --code <code>\`.`,!1,n)}async function di(e,t,n,i){let r=await b(i,"/api/v1/identity/recover/complete",{method:"POST",headers:j(),body:JSON.stringify({email:e,code:t})});if(n.json){let s=a(r,"apiKey");return s?(await Oe(i,s,{expectedEmail:e,knownEmail:a(r,"email")??e,knownRole:a(r,"role")??"user",knownRoles:se(r,"roles"),knownUserId:a(r,"userId")}),h(W({...r,loggedIn:!0}),"Recovery complete.",!0,i)):h(W({...r,email:e,loggedIn:!1}),"Recovery complete.",!0,i)}return await dt(e,r,n,i,`Recovered access for ${e}.`)}async function po(e,t,n){let i=e[0],r=1;if(i==="providers")return await R("/api/v1/identity/social/providers",t,n,"Identity providers loaded.");if(i==="start"){let s=p(t.provider);if(!s&&!t.json)try{s=await n.promptSelect("Choose identity provider:",gn)}catch{return k("identity start requires --provider when interactive selection is unavailable.",!1)}s=v(s,"identity start requires --provider.");let o=await b(n,"/api/v1/identity/social/start",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({provider:s,mode:p(t.mode)??"login"})});return t.json?h(o,"Social auth started.",!0,n):await Pn(s,o,t,n,"login")}if(i==="status"){let s=p(t.state)??e[r];return s?await R(`/api/v1/identity/social/status/${encodeURIComponent(s)}`,t,n,"Social auth status loaded."):k("identity status requires --state.",t.json)}if(i==="complete"){let s=v(t.provider,"identity complete requires --provider."),o=v(t.state,"identity complete requires --state."),l=v(t.code,"identity complete requires --code."),c=await b(n,"/api/v1/identity/social/complete",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({provider:s,state:o,code:l})});return await Ul(c,n),h(W(c),"Social auth complete.",t.json,n)}if(i==="list")return await R("/api/v1/me/linked-identities",t,n,"Linked identities loaded.",{authenticated:!0});if(i==="unlink"){let s=v(t.provider??e[r],"identity unlink requires a provider."),o=await b(n,`/api/v1/me/linked-identities/${encodeURIComponent(s)}`,{method:"DELETE",headers:B(n.apiKey,n.authBlockedMessage)});return h(o,"Identity unlinked.",t.json,n)}return k(`Unknown identity command "${i??""}".`,t.json)}async function go(e,t,n){let i=e[0];if(!i)return k("api-key requires create, list, or revoke.",t.json);if(i==="list")return await R("/api/v1/me/api-keys",t,n,"API keys loaded.",{authenticated:!0});if(i==="create"){let r=p(t.name),s=Ic(t.scope);if(!r)return k("api-key create requires --name.",t.json);if(s.length===0)return k("api-key create requires at least one --scope.",t.json);let o=await b(n,"/api/v1/me/api-keys",{method:"POST",headers:{"content-type":"application/json",...B(n.apiKey,n.authBlockedMessage)},body:JSON.stringify({name:r,scopes:s,...p(t.expires)?{expiresIn:p(t.expires)}:{}})});return h(W(o),"Automation API key created. The full key was sent to your verified email. Run `skills-layer api-key list` to manage keys.",t.json,n)}if(i==="rotate")return k(`api-key rotate is not part of normal login.
|
|
1220
|
+
skills-layer trust <skill-slug>`:`Unknown command "${e}".`}function en(e){let t={json:e.includes("--json"),help:!1,dryRun:!1,list:!1,all:!1,deep:!1,verbose:!1,showUrl:!1,noOpen:!1,quarantine:!1,confirmed:!1,allowUnmanagedOnce:!1,discloseSource:!1,allowFindingsFeatured:!1,shouldTrigger:[],shouldNotTrigger:[],paraphrase:[],grantJson:[],findingCode:[],acceptCapability:[],approvalRequestId:[]},n=[];for(let i=0;i<e.length;i+=1){let r=e[i];if(!r)continue;if(r==="--"){n.push(...e.slice(i+1));break}if(r==="-h"){t.help=!0;continue}if(!r.startsWith("--")){n.push(r);continue}let s=r.slice(2);if(s!=="install"&&!Bi.has(s)&&!Mi.has(s)&&!qi.has(s)&&!Qt.has(s))return{flags:t,positionals:n,error:`Unknown flag --${s}.`};if(Bi.has(s)){let a=tn(s);s==="confirm"||s==="yes"?t.confirmed=!0:t[a]=!0;continue}let o=e[i+1];if(!o||o.startsWith("--")){if(s==="install"){t.install="";continue}return{flags:t,positionals:n,error:`Flag --${s} requires a value.`}}if(Mi.has(s)){let a=Qo(e,i);if(!a.value)return{flags:t,positionals:n,error:`Flag --${s} requires a value.`};t[tn(s)]=a.value,i=a.nextIndex;continue}if(qi.has(s)||Qt.has(s)){let a=tn(s);if(Qt.has(s)){let c=Array.isArray(t[a])?t[a]:[];c.push(o),t[a]=c}else t[a]=o;i+=1;continue}return{flags:t,positionals:n,error:`Unknown flag --${s}.`}}return{flags:t,positionals:n}}function Qo(e,t){let n=[],i=t;for(let r=t+1;r<e.length;r+=1){let s=e[r];if(!s||s.startsWith("--"))break;n.push(s),i=r}return{value:n.length>0?n.join(" "):null,nextIndex:i}}function tn(e){return e.replace(/-([a-z])/gu,(t,n)=>n.toUpperCase())}async function We(e,t){let n=Xo(t.env,t.platform),[i,r]=await Promise.all([Yu(n.configPath,t),D(n.backendPreferencePath)]),s=te(p(e.baseUrl)??ee(t.env.SKILLS_LAYER_BASE_URL)??ee(r?.preferredBaseUrl)??ee(i?.baseUrl)??Tn),o=p(e.apiKey)??ee(t.env.SKILLS_LAYER_API_KEY),a=ee(i?.apiKey),c=ee(i?.baseUrl),u=!c||te(c)===s,d=o??(u?a:void 0),g=!o&&a&&c&&!u?`Your saved login belongs to ${te(c)}, but the selected backend is ${s}. Run \`skills-layer backend --base-url ${te(c)}\` to use that login, or run \`skills-layer login\` for ${s}.`:void 0;return{...t,paths:n,config:i,baseUrl:s,apiKey:d,authBlockedMessage:g}}function Xo(e,t){let n=t==="win32"?Ue:jn,i=t==="win32"?ee(e.USERPROFILE)??ee(e.HOME):ee(e.HOME),r=n.join(i??".",".skills-layer");return{stateDir:r,configPath:n.join(r,"config.json"),backendPreferencePath:n.join(r,"backend-preference.json"),installsPath:n.join(r,"installs.json"),importsPath:n.join(r,"imports.json"),mcpConfigPath:n.join(r,"mcp.json"),mcpPreferencePath:n.join(r,"mcp-preference.json"),bundlesDir:n.join(r,"bundles"),incidentsDir:n.join(r,"incidents")}}async function ea(e,t,n){if(e[0]!=="list")return k(`Unknown agents command "${e[0]??""}".`,t.json);let i=ke(n.env,n.platform,n.cwd).map(r=>({id:r.id,displayName:r.displayName,capabilities:r.capabilities,projectSkillsPath:r.targets.projectSkillsPath,globalSkillsPath:r.targets.globalSkillsPath}));return h({status:"ok",results:i},`Found ${i.length} supported agent targets.`,t.json,n)}async function ta(e,t,n){let i=e[0],r=p(t.baseUrl);if(!i&&r||i==="cloud"||i==="local"){let c=te(r??(i==="local"?Yo:Tn)),u=Ka(c,t);if(u)return u;let d=ae(c),g=n.config?.baseUrl??null,f=!n.config?.baseUrl||te(n.config.baseUrl)===c;return await W(n.paths.backendPreferencePath,{version:Ln,preferredBaseUrl:c,savedAt:n.now()}),h({status:"updated",selectedBackend:d,selectedBaseUrl:c,savedLoginBaseUrl:g,loginMatchesSelectedBackend:f,loggedIn:!!n.apiKey&&f,...f?{}:{warning:`Saved login belongs to ${g}; selected backend is ${c}.`}},f?`Backend set to ${d}.`:`Backend set to ${d}. Saved login is for ${g}.`,t.json,n)}if(i&&i!=="status")return k(`Unknown backend command "${i}".`,t.json);let s=ae(n.baseUrl),o=!n.config?.baseUrl||te(n.config.baseUrl)===n.baseUrl,a=!!n.apiKey&&o;return h({status:"ok",selectedBackend:s,selectedBaseUrl:n.baseUrl,savedLoginBaseUrl:n.config?.baseUrl??null,loginMatchesSelectedBackend:o,loggedIn:a,email:a?n.config?.email??null:null,role:a?n.config?.role??null:null},`Backend: ${n.baseUrl}`,t.json,n)}var Nn=[{value:"google",label:"Google",description:"Open browser sign-in and return here"},{value:"github",label:"GitHub",description:"Open browser sign-in and return here"},{value:"gitlab",label:"GitLab",description:"Open browser sign-in and return here"},{value:"microsoft",label:"Microsoft",description:"Open browser sign-in and return here"}],na=[...Nn,{value:"email",label:"Email code",description:"Use an emailed one-time code"},{value:"api_key",label:"API key (advanced)",description:"Paste an existing Skills Layer login key"}],ia=[{value:"email",label:"Email",description:"Use an emailed verification code and API key"},...Nn];async function Nr(e,t){let n=p(e.method);if(!n)if(e.json)n="email";else try{n=await t.promptSelect("Choose how to register:",ia)}catch{return k("register requires --method when interactive selection is unavailable. Try `skills-layer register --method email --email you@example.com`, `skills-layer register --method google`, `skills-layer register --method github`, `skills-layer register --method gitlab`, or `skills-layer register --method microsoft`.",!1)}let i=re("register","method",n,ja,e,"invalid_method");if(i)return i;if(n==="email"){let s=p(e.email);if(!s&&!e.json)try{s=await t.promptText("Enter your email address: ")}catch{return k("register --method email requires --email when interactive prompts are unavailable.",!1)}s=b(s,"register requires --email.");let o=await S(t,"/api/v1/register",{method:"POST",headers:j(),body:JSON.stringify({method:n,email:s})});if(e.json){let c=o.status==="already_registered"?Rn(o):G({...o,nextCommand:`skills-layer auth verify --email ${s} --code <code> --json`,nextAction:"auth.verify"}),u=o.status==="already_registered"?`${s} is already registered.`:`Registration started for ${s}.`;return h(c,u,e.json,t)}if(o.status==="already_registered")return h(Rn(o),`${s} is already registered. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,!1,t);let a;try{a=await t.promptText(`Enter the verification code sent to ${s} (check spam/junk folder if missing): `)}catch{return h(G(o),`Registration started for ${s}. Check your email (including spam/junk folder) for the verification code, then run \`skills-layer auth verify --email ${s} --code <code>\`.`,!1,t)}return await ks(s,a,e,t,`Verified ${s}.`)}let r=await S(t,"/api/v1/identity/social/start",{method:"POST",headers:j(),body:JSON.stringify({provider:n,mode:"login"})});return e.json?h(r,"Social registration started.",e.json,t):await Wn(n,r,e,t,"login")}async function Fr(e,t){if(e.withMcp&&e.noMcp)return k("login cannot combine --with-mcp and --no-mcp.",e.json);let n=p(e.apiKey);if(n){let a=await et(t,n,{notifyLogin:!0}),c=await yn(e,{...t,config:a,apiKey:n});return J(c)?c:h(G({status:"verified",...a,...c.data?{mcp:c.data}:{}}),[`Logged in as ${a.email}.`,c.message??""].filter(Boolean).join(" "),e.json,t)}let i=p(e.method);if(!i&&!e.json)try{let a=await t.promptSelect("Choose how to sign in:",na);i=a==="api_key"?void 0:a}catch{return k("login requires --api-key or --method <email|google|github|gitlab|microsoft> when interactive selection is unavailable.",!1)}let r=re("login","method",i,Ia,e,"invalid_method");if(r)return r;if(i){if(i==="email"){let c=p(e.email);!c&&!e.json&&(c=(await t.promptText("Enter your email address: ")).trim()),c=b(c,"login --method email requires --email.");let u=await S(t,"/api/v1/identity/recover/start",{method:"POST",headers:j(),body:JSON.stringify({email:c,method:"email",intent:"login"})});if(e.json)return h(u,`Passwordless email login started for ${c}.`,!0,t);let d;try{d=(await t.promptText(`Enter the sign-in code sent to ${c} (check spam/junk folder if missing): `)).trim()}catch{return h(u,`Passwordless email login started for ${c}. Check your email, then run \`skills-layer login --method email --email ${c}\` again when prompts are available.`,!1,t)}let g=await S(t,"/api/v1/identity/recover/complete",{method:"POST",headers:j(),body:JSON.stringify({email:c,code:d,intent:"login"})});return await It(c,g,e,t,`Verified ${c}.`)}if(!["google","github","gitlab","microsoft"].includes(i))return k("login --method must be email, google, github, gitlab, or microsoft.",e.json);let a=await S(t,"/api/v1/identity/social/start",{method:"POST",headers:j(),body:JSON.stringify({provider:i,mode:"login"})});return e.json?h(a,"Social login started.",!0,t):await Wn(i,a,e,t,"login")}if(!e.json)try{n=(await t.promptSecret("Enter your Skills Layer API key: ")).trim()}catch{return k("login requires an API key.",e.json)}if(!n)return k("login requires --api-key or --method <email|google|github|gitlab|microsoft>.",e.json);let s=await et(t,n,{notifyLogin:!0}),o=await yn(e,{...t,config:s,apiKey:n});return J(o)?o:h(G({status:"verified",...s,...o.data?{mcp:o.data}:{}}),[`Logged in as ${s.email}.`,o.message??""].filter(Boolean).join(" "),e.json,t)}async function Br(e,t){return await Ai(t.config,{env:t.env,platform:t.platform,store:t.credentialStore}),await An(t.paths.configPath,{force:!0}),h({status:"logged_out"},"Logged out.",e.json,t)}async function ra(e,t,n){let i=e[0]??"show";if(i==="show")return await $("/api/v1/profile",t,n,"Editable profile loaded.",{authenticated:!0});if(i==="update"){let r=await sa(t,n);if(J(r))return r;let s=await S(n,"/api/v1/profile",{method:"PATCH",headers:j(n.apiKey),body:JSON.stringify(r)});return h(s,"Profile updated.",t.json,n)}return k(`Unknown profile command "${i}".`,t.json)}async function sa(e,t){let n=H(e,["displayName","bio","company"]);if(Object.keys(n).length>0)return n;if(e.json)return k("profile update requires at least one of --display-name, --bio, or --company.",!0);try{let i=await t.promptText("Display name (leave blank to keep unchanged): "),r=await t.promptText("Bio (leave blank to keep unchanged): "),s=await t.promptText("Company (leave blank to keep unchanged): "),o=x({displayName:i||void 0,bio:r||void 0,company:s||void 0});return Object.keys(o).length===0?k("No profile changes entered.",!1):o}catch{return k("profile update requires at least one of --display-name, --bio, or --company.",!1)}}async function oa(e,t,n){let i=e[0];if(i==="register")return await Nr({...t,method:"email"},n);if(i==="verify"){let r=b(t.email,"auth verify requires --email."),s=b(t.code,"auth verify requires --code.");return await ks(r,s,t,n,`Verified ${r}.`)}return i==="recover"?await ca(e.slice(1),t,n):i==="login"?await Fr(t,n):i==="logout"?await Br(t,n):i==="status"?aa(t,n):i==="repair"?await la(t,n):k(`Unknown auth command "${i??""}".`,t.json)}function aa(e,t){let n=t.config?.baseUrl?te(t.config.baseUrl):null,i=!!(t.apiKey&&n===t.baseUrl);return h({status:"auth_status",selectedBackend:ae(t.baseUrl),selectedBaseUrl:t.baseUrl,loggedIn:i,requiresLogin:!i,...t.config?.email?{savedLogin:{baseUrl:n,email:t.config.email,role:t.config.role??null,roles:t.config.roles??[],savedAt:t.config.savedAt??null,...t.config.credentialStorage?{credentialStorage:t.config.credentialStorage}:{},matchesSelectedBackend:i}}:{}},i&&t.config?.email?`Logged in as ${t.config.email}.`:t.config?.baseUrl?`Saved login targets ${n}; selected backend is ${t.baseUrl}. Run \`skills-layer auth repair\` or \`skills-layer login\`.`:"Not logged in. Run `skills-layer login`.",e.json,t)}async function la(e,t){if(!t.config?.baseUrl||!t.config.apiKey||!t.config.email||!t.config.role||!t.config.savedAt)return w({status:"login_required",reasonCode:"login_required",nextAction:"login",nextStep:"Run `skills-layer login` to create a saved session, then use `skills-layer auth repair` only if backend/session metadata drifts."},"No saved Skills Layer login was found to repair. Run `skills-layer login`.",e.json,"login_required");let n=te(t.config.baseUrl);return await W(t.paths.backendPreferencePath,{version:Ln,preferredBaseUrl:n,savedAt:t.now()}),await Yn(t.paths.configPath,{...t.config,baseUrl:n,savedAt:t.now()},t),h({status:"auth_repaired",baseUrl:n,loggedIn:!0,email:t.config.email,role:t.config.role,credentialStorage:t.config.credentialStorage??"local_file_locked"},`Auth repaired for ${t.config.email}. Backend preference now matches ${n}.`,e.json,t)}async function ca(e,t,n){let i=e[0]??p(t.method)??"email",r=p(t.email);if(!r&&!t.json)try{r=await n.promptText("Enter your email address: ")}catch{return k("auth recover requires --email when interactive prompts are unavailable.",!1)}if(r=b(r,"auth recover requires --email."),i==="complete"){let c=p(t.code);if(!c&&!t.json)try{c=await n.promptText("Enter the recovery code: ")}catch{return k("auth recover complete requires --code when interactive prompts are unavailable.",!1)}return c=b(c,"auth recover complete requires --code."),await Ki(r,c,t,n)}let s=await S(n,"/api/v1/identity/recover/start",{method:"POST",headers:j(),body:JSON.stringify({email:r,method:i})}),o=Rn(s);if(t.json)return h(o,"Recovery started.",!0,n);let a="";try{a=(await n.promptText("Enter the recovery code if you received one, or press Enter to stop: ")).trim()}catch{return h(o,`If this email can continue, instructions have been sent. Check your inbox and spam folder. When you have a code, run \`skills-layer auth recover complete --email ${r} --code <code>\`.`,!1,n)}return a?await Ki(r,a,t,n):h(o,`If this email can continue, instructions have been sent. When you have a code, run \`skills-layer auth recover complete --email ${r} --code <code>\`.`,!1,n)}async function Ki(e,t,n,i){let r=await S(i,"/api/v1/identity/recover/complete",{method:"POST",headers:j(),body:JSON.stringify({email:e,code:t})});if(n.json){let s=l(r,"apiKey");return s?(await et(i,s,{expectedEmail:e,knownEmail:l(r,"email")??e,knownRole:l(r,"role")??"user",knownRoles:se(r,"roles"),knownUserId:l(r,"userId")}),h(G({...r,loggedIn:!0}),"Recovery complete.",!0,i)):h(G({...r,email:e,loggedIn:!1}),"Recovery complete.",!0,i)}return await It(e,r,n,i,`Recovered access for ${e}.`)}async function ua(e,t,n){let i=e[0],r=1;if(i==="providers")return await $("/api/v1/identity/social/providers",t,n,"Identity providers loaded.");if(i==="start"){let s=p(t.provider);if(!s&&!t.json)try{s=await n.promptSelect("Choose identity provider:",Nn)}catch{return k("identity start requires --provider when interactive selection is unavailable.",!1)}s=b(s,"identity start requires --provider.");let o=await S(n,"/api/v1/identity/social/start",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({provider:s,mode:p(t.mode)??"login"})});return t.json?h(o,"Social auth started.",!0,n):await Wn(s,o,t,n,"login")}if(i==="status"){let s=p(t.state)??e[r];return s?await $(`/api/v1/identity/social/status/${encodeURIComponent(s)}`,t,n,"Social auth status loaded."):k("identity status requires --state.",t.json)}if(i==="complete"){let s=b(t.provider,"identity complete requires --provider."),o=b(t.state,"identity complete requires --state."),a=b(t.code,"identity complete requires --code."),c=await S(n,"/api/v1/identity/social/complete",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({provider:s,state:o,code:a})});return await ru(c,n),h(G(c),"Social auth complete.",t.json,n)}if(i==="list")return await $("/api/v1/me/linked-identities",t,n,"Linked identities loaded.",{authenticated:!0});if(i==="unlink"){let s=b(t.provider??e[r],"identity unlink requires a provider."),o=await S(n,`/api/v1/me/linked-identities/${encodeURIComponent(s)}`,{method:"DELETE",headers:T(n.apiKey,n.authBlockedMessage)});return h(o,"Identity unlinked.",t.json,n)}return k(`Unknown identity command "${i??""}".`,t.json)}async function da(e,t,n){let i=e[0];if(!i)return k("api-key requires create, list, or revoke.",t.json);if(i==="list"){let r=pa(t);if(r.failure)return r.failure;let s=await S(n,"/api/v1/me/api-keys",{headers:T(n.apiKey,n.authBlockedMessage)}),o=ga(hn(s),r.filters);return h({...s,filters:x({...r.filters}),results:o},"API keys loaded.",t.json,n)}if(i==="create"){let r=p(t.name),s=sd(t.scope);if(!r)return k("api-key create requires --name.",t.json);if(s.length===0)return k("api-key create requires at least one --scope.",t.json);let o=s.find(u=>!Yi.includes(u));if(o)return Pe("api-key.create","scope",o,Yi,t,"invalid_scope");let a=Ga("api-key.create",t.expires,t);if(a)return a;if(t.dryRun){let u=await S(n,"/api/v1/me/api-keys",{headers:T(n.apiKey,n.authBlockedMessage)}),d=hn(u).filter(g=>Mr(g)==="active"&&l(g,"type")==="automation");return d.length>=er?w({status:"error",reasonCode:"api_key_active_limit_reached",maxActiveAutomationKeys:er,activeAutomationKeyCount:d.length,nextAction:"api-key.revoke",nextStep:"Revoke an unused automation key before creating another."},"Too many active automation keys. Revoke unused keys before creating another.",t.json,"api_key_active_limit_reached"):h(x({status:"pass",wouldCreate:!0,type:"automation",name:r,scopes:s,expiresAt:fa(p(t.expires),n.now()),secretReturned:!1,secretDelivery:"email",warnings:[]}),"API key create dry run passed.",t.json,n)}let c=await S(n,"/api/v1/me/api-keys",{method:"POST",headers:{"content-type":"application/json",...T(n.apiKey,n.authBlockedMessage)},body:JSON.stringify({name:r,scopes:s,...p(t.expires)?{expiresIn:p(t.expires)}:{}})});return h({...G(c),secretReturned:!1,secretDelivery:"email"},"Automation API key created. The full key was sent to your verified email. Run `skills-layer api-key list` to manage keys.",t.json,n)}if(i==="rotate")return k(`api-key rotate is not part of normal login.
|
|
1019
1221
|
|
|
1020
1222
|
For CLI access:
|
|
1021
1223
|
skills-layer login
|
|
@@ -1025,26 +1227,26 @@ For automation:
|
|
|
1025
1227
|
|
|
1026
1228
|
To remove an old key:
|
|
1027
1229
|
skills-layer api-key list
|
|
1028
|
-
skills-layer api-key revoke --key-id <key-id>`,t.json);if(i==="revoke"){let r=t.keyId??e[1];if(!r)return
|
|
1230
|
+
skills-layer api-key revoke --key-id <key-id>`,t.json);if(i==="revoke"){let r=t.keyId??e[1];if(!r)return w({status:"error",reasonCode:"missing_required_argument",command:"api-key revoke",argument:"key-id",nextAction:"api-key.list",nextStep:"Run `skills-layer api-key list`, then revoke a key with `skills-layer api-key revoke --key-id <key-id>`."},`api-key revoke needs a key id.
|
|
1029
1231
|
|
|
1030
1232
|
Run:
|
|
1031
1233
|
skills-layer api-key list
|
|
1032
|
-
skills-layer api-key revoke --key-id <key-id>`,t.json);let s=String(r),o=await b(n,`/api/v1/me/api-keys/${encodeURIComponent(s)}/revoke`,{method:"POST",headers:B(n.apiKey,n.authBlockedMessage)});return h(o,"API key revoked.",t.json,n)}return k(`Unknown api-key command "${i}".`,t.json)}async function mo(e,t,n){let i=e[0]??"status";if(i==="setup"||i==="repair"){let r=p(t.client)??p(t.agent);if(r&&!st(r))return Et(r,t);let s=await mn(t,n);return H(s)?s:h({...s},`MCP configuration written for ${s.clientId}. Open a fresh agent session to load Skills Layer tools, then run \`skills-layer mcp verify --client ${s.clientId}\` if they are not visible.`,t.json,n)}if(i==="status"||i==="verify"){let r=p(t.client)??p(t.agent);if(r&&!st(r))return Et(r,t);let s=await Y(n.paths.mcpConfigPath);if(!s){if(r){let u=await wt({baseUrl:n.baseUrl,mcpUrl:`${n.baseUrl}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:ye(n.baseUrl),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:null});if(u.target.status==="skills_only"){let d=pi(u);return h(d,`${u.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}}return h({status:"mcp_not_configured",configured:!1,nextCommand:"skills-layer mcp setup"},"MCP is not configured on this machine.",t.json,n)}let o=r??a(s,"clientId")??"codex",l=a(s,"baseUrl")??n.baseUrl,c=await wt({baseUrl:l,mcpUrl:a(s,"mcpUrl")??`${l}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:o,environment:a(s,"environment")??ye(l),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:s});if(c.target.status==="skills_only"){let u=pi(c);return h(u,`${c.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}if(i==="verify"&&c.configured){let u=await Fn({nodePath:process.execPath,bridgePath:c.bridge.path}),d={...c,verified:u.status==="ok",liveProbe:u};return u.status!=="ok"?C(d,`MCP config exists for ${c.clientId}, but live bridge verification failed: ${u.message}`,t.json,u.reasonCode??void 0):h(d,`MCP verified for ${c.clientId}. ${u.message} Open a fresh agent session or restart the agent if tools are not visible yet.`,t.json,n)}return h(c,c.configured?`MCP configuration is present for ${c.clientId}. Open a fresh agent session if tools are not visible, or run \`skills-layer mcp verify --client ${c.clientId}\` for a live check.`:`MCP needs repair for ${c.clientId}. Run \`${c.nextCommand}\`.`,t.json,n)}if(i==="disconnect"||i==="logout"){let r=p(t.client)??p(t.agent)??"codex";if(!st(r))return Et(r,t);let s=await Y(n.paths.mcpConfigPath),o=Le({baseUrl:n.baseUrl,mcpUrl:`${n.baseUrl}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:ye(n.baseUrl),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath}),l=o.targets.find(c=>c.agentId===r);return await yo(s,n),await l?.disconnect?.(),await Kn(o.bridgePath),await Gn(o.brokerPath,o.brokerSocketPath),await an(n.paths.mcpConfigPath,{force:!0}),h({status:"mcp_disconnected",configured:!1,clientId:r},"MCP disconnected on this machine.",t.json,n)}return k(`Unknown mcp command "${i}". Use setup, status, verify, repair, or disconnect.`,t.json)}function st(e){return we.includes(e)}function Et(e,t){return C({status:"error",reasonCode:"unknown_mcp_client",requestedClient:e,nextAction:"mcp.status",nextStep:"Run `skills-layer agents list` to see supported client ids."},`Unknown MCP client "${e}". Run \`skills-layer agents list\` to see supported client ids.`,t.json,"unknown_mcp_client")}function pi(e){let t=e.target.instructions,n=Array.isArray(t)&&typeof t[0]=="string"?t[0]:`Install skills with \`skills-layer install <skill> --agent ${e.clientId}\`.`;return{...e,status:"skills_only",configured:!1,nextCommand:null,nextAction:"install.skills",nextStep:n}}async function mn(e,t){let n=p(e.environment)??ye(t.baseUrl),i=["mcp:use","catalog:read","library:read","guardian:check","guardian:incident","creator:read"],r=`${t.baseUrl}/mcp`,s=Le({baseUrl:t.baseUrl,mcpUrl:r,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:"codex",environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),o=await fo(e,t,s),l=o.clientIds[0]??"codex",c=Le({baseUrl:t.baseUrl,mcpUrl:r,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:l,environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),u={},d=null;for(let m of o.clientIds){let y=await b(t,"/api/v1/me/mcp-tokens",{method:"POST",headers:j(t.apiKey),body:JSON.stringify({clientId:m,environment:n,scopes:i})}),w=a(y,"apiKey");if(!w)return k("MCP setup did not receive a token from the backend.",e.json);let P=await ho(t,{token:w,clientId:m,environment:n});u[m]={clientId:m,environment:n,...P,tokenPrefix:a(y,"keyPrefix")??null,scopes:Array.isArray(y.scopes)?y.scopes:[],savedAt:t.now()},d??=y}let g=u[l]??{};await D(t.paths.mcpConfigPath,{version:1,baseUrl:t.baseUrl,mcpUrl:r,clientId:l,clientIds:o.clientIds,environment:n,selectionSource:o.selectionSource,detectedClientIds:o.detectedClientIds,...g,tokens:u,brokerPath:c.brokerPath,brokerSocketPath:c.brokerSocketPath,savedAt:t.now()});let f=c.targets.filter(m=>m.status==="automatic"&&o.clientIds.includes(m.agentId));for(let m of f)await m.apply?.();return{...W(d??{}),status:"mcp_configured",clientId:l,clientIds:o.clientIds,selectionSource:o.selectionSource,detectedClientIds:o.detectedClientIds,environment:n,mcpUrl:r,bridgePath:c.bridgePath,brokerPath:c.brokerPath,brokerSocketPath:c.brokerSocketPath,nodePath:c.nodePath,bridgeChecksum:c.bridgeChecksum,brokerChecksum:c.brokerChecksum,saved:!0,readiness:{status:"configured_needs_agent_reload",verifyCommand:`skills-layer mcp verify --client ${l}`,nextStep:"Open a fresh agent session so the host can load the updated MCP configuration. Run verify or repair if Skills Layer tools are still not visible."},registrations:{status:"mcp_registration_plan",automaticCount:c.automaticCount,manualCount:c.manualCount,skillsOnlyCount:c.skillsOnlyCount,unsupportedCount:c.unsupportedCount,appliedCount:f.length,appliedClients:f.map(m=>m.agentId),targets:c.targets.map(m=>({agentId:m.agentId,displayName:m.displayName,tier:m.tier,status:m.status,transport:m.transport,configPath:m.configPath,bridgePath:m.bridgePath,restartRequired:m.restartRequired,reason:m.reason,instructions:m.instructions}))}}}async function fo(e,t,n){let i=p(e.client)??p(e.agent),r=n.targets.filter(c=>c.status==="automatic").map(c=>c.agentId);if(i)return{clientIds:[i],detectedClientIds:[],selectionSource:"explicit"};if(e.all)return{clientIds:r,detectedClientIds:r,selectionSource:"all"};let s=await jn({env:t.env,platform:t.platform,cwd:t.cwd,pathExists:me}),o=new Set(r),l=s.map(c=>c.id).filter(c=>o.has(c));return l.length>0?{clientIds:l,detectedClientIds:l,selectionSource:"detected"}:{clientIds:["codex"],detectedClientIds:[],selectionSource:"fallback"}}async function ho(e,t){if(!e.credentialStore)return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"};let n=wo({baseUrl:e.baseUrl,userId:e.config?.userId,email:e.config?.email,clientId:t.clientId,environment:t.environment});try{return await e.credentialStore.set(Ue,n,t.token),{tokenRef:n,credentialStorage:"macos_keychain",credentialService:Ue,tokenStorage:"macos_keychain"}}catch{return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"}}}async function yo(e,t){if(!e||!t.credentialStore)return;let n=ko(e,Ue);for(let i of n)await t.credentialStore.delete(i.service,i.tokenRef)}function ko(e,t){let n=new Map;gi(e,t,n);let i=e.tokens;if($(i))for(let r of Object.values(i))$(r)&&gi(r,t,n);return[...n.values()]}function gi(e,t,n){let i=a(e,"tokenRef");if(!i||a(e,"credentialStorage")!=="macos_keychain")return;let r=a(e,"credentialService")??t;n.set(`${r}:${i}`,{service:r,tokenRef:i})}function wo(e){let t=[e.baseUrl,e.userId??e.email??"unknown-user",e.clientId,e.environment,"mcpToken"].join(`
|
|
1033
|
-
`);return`skills-layer-cli:mcp-token:${on("sha256").update(t).digest("base64url").slice(0,32)}`}async function zt(e,t){if(e.noMcp)return{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."};let n=await Y(t.paths.mcpConfigPath),i=n?a(n,"baseUrl"):void 0,r=n?a(n,"clientId")??"codex":"codex";if(!e.withMcp&&i===t.baseUrl&&r)return{data:{status:"mcp_already_configured",configured:!0,clientId:r,mcpUrl:n?a(n,"mcpUrl")??`${t.baseUrl}/mcp`:`${t.baseUrl}/mcp`},message:"MCP is already configured for this machine."};if(!e.withMcp&&!e.json){let l=await Y(t.paths.mcpPreferencePath),c=l?a(l,"baseUrl"):void 0,u=l?a(l,"clientId")??"codex":void 0;if((l?a(l,"choice"):void 0)==="not_now"&&c===t.baseUrl&&u==="codex")return{data:{status:"mcp_skipped_previously",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup was skipped previously. Run `skills-layer mcp setup` when you want AI-tool access."}}let s=e.withMcp===!0;if(!s&&!e.json)try{let l=await t.promptSelect("Set up Skills Layer MCP for your AI tools on this machine?",[{value:"yes",label:"Yes, set up MCP",description:"Mint a scoped token and write local MCP configuration"},{value:"no",label:"Not now",description:"You can run skills-layer mcp setup later"}]);if(s=l==="yes",l==="no")return await D(t.paths.mcpPreferencePath,{version:1,choice:"not_now",baseUrl:t.baseUrl,clientId:"codex",savedAt:t.now()}),{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."}}catch{return{}}if(!s)return{};let o=await mn(e,t);return H(o)?o:{data:o,message:"MCP configuration written for this machine. Open a fresh agent session so your AI tools can load it."}}async function vo(e,t,n){let i=e.join(" ").trim()||p(t.search)||"",r=new URLSearchParams;i&&r.set("query",i);let s=p(t.runtimeRisk);if(s&&!mi.includes(s))return fi("runtime-risk",s,mi,t);let o=p(t.limit);if(o){let c=Number(o);if(!Number.isInteger(c)||c<1||c>100)return fi("limit",o,["1-100"],t);r.set("limit",String(c))}M(r,"agent",t.agent),M(r,"capability",t.capability),M(r,"trust",t.trust),M(r,"runtime-risk",s),M(r,"security-capability",t.securityCapability);let l=await b(n,`/api/v1/search${oe(r)}`);if(t.install!==void 0){let c=p(t.install);if(!c){if(t.json)return k("search --install requires an explicit skill slug in the public CLI package.",!0);let d=Ve(l);if(d.length===0)return k("Search results do not include any installable skills. Run search again with a broader query.",!1);if(d.length===1)c=d[0].value;else try{c=await n.promptSelect("Select a search result to install:",d)}catch{return k("No search result was selected for install.",!1)}}let u=xc(l);return u.includes(c)?await fn([c],t,n):k(u.length===0?`Search results do not include "${c}". Run search again with a matching query first.`:`Search results do not include "${c}". Run search again with a matching query or choose one of: ${u.join(", ")}.`,t.json)}return h(l,"Search complete.",t.json,n)}var mi=["low","elevated","high"],Ut=["local","project","global","workspace"],Tt=["private","public","unlisted"],Bt=["private","public","unlisted"],bo=/^(?:card(?:_[A-Za-z0-9]+)*|pm_[A-Za-z0-9_]+)$/u;function Yi(e,t,n,i){let r=p(t);if(!r)return{};if(!/^\d+$/u.test(r))return{failure:C({status:"error",reasonCode:"invalid_limit",command:e,value:r,acceptedRange:`1-${n}`,nextAction:e,nextStep:`Use --limit with a whole number from 1 to ${n}.`},`${e} --limit must be a whole number from 1 to ${n}.`,i.json,"invalid_limit")};let s=Number.parseInt(r,10);return!Number.isInteger(s)||s<1||s>n?{failure:C({status:"error",reasonCode:"invalid_limit",command:e,value:r,acceptedRange:`1-${n}`,nextAction:e,nextStep:`Use --limit with a whole number from 1 to ${n}.`},`${e} --limit must be between 1 and ${n}.`,i.json,"invalid_limit")}:{value:String(s)}}function fi(e,t,n,i){return C({status:"error",reasonCode:"invalid_search_filter",filter:e,value:t,acceptedValues:n,nextAction:"search",nextStep:e==="runtime-risk"?"Use --runtime-risk low, elevated, or high.":"Use --limit with a whole number from 1 to 100."},e==="runtime-risk"?`Invalid runtime risk "${t}". Use one of: ${n.join(", ")}.`:`Invalid search limit "${t}". Use a whole number from 1 to 100.`,i.json,"invalid_search_filter")}function Zi(e,t){let n=p(t.scope);if(n&&!Ut.includes(n))return{failure:C({status:"error",reasonCode:"invalid_install_filter",filter:"scope",value:n,acceptedValues:Ut,nextAction:e,nextStep:"Use --scope local, project, global, or workspace."},`Invalid ${e} --scope "${n}". Use one of: ${Ut.join(", ")}.`,t.json,"invalid_install_filter")};let i=p(t.agent);return i&&!st(i)?{failure:C({status:"error",reasonCode:"unknown_agent",filter:"agent",value:i,acceptedValues:we,nextAction:e,nextStep:"Use --agent with a supported Skills Layer agent id."},`Unknown ${e} --agent "${i}". Run \`skills-layer agents\` to inspect supported agents.`,t.json,"unknown_agent")}:{scope:n,agent:i}}function So(e,t,n){return C({status:"error",reasonCode:"invalid_version",command:e,version:t,nextAction:e,nextStep:"Use a semver version such as 1.2.3 or an external-<digest> Skills Layer version."},`Invalid --version "${t}". Use a semver version or an external-<digest> version.`,n.json,"invalid_version")}function Po(e){let t=p(e.paymentMethod)??"card";return bo.test(t)?{value:t}:{failure:C({status:"error",reasonCode:"invalid_payment_method",paymentMethod:t,acceptedValues:["card","card_<test-card>","pm_<provider-method-id>"],nextAction:"buy",nextStep:"Use --payment-method card or a provider token such as pm_<id>."},`Invalid payment method "${t}". Use card or a provider token such as pm_<id>.`,e.json,"invalid_payment_method")}}async function Co(e,t,n){let i=new URLSearchParams,r=Yi(e,t.limit,20,t);return r.failure?r.failure:(M(i,"limit",r.value),M(i,"search",t.search),M(i,"sort",t.sort),await R(`/api/v1/${e}${oe(i)}`,t,n,`${ht(e)} skills loaded.`))}async function Ro(e,t,n){let i=e.join(" ").trim();if(!i)return k("recommend requires a task.",t.json);let r=Yi("recommend",t.limit,20,t);if(r.failure)return r.failure;let s=new URLSearchParams({task:i});return M(s,"limit",r.value),await R(`/api/v1/recommend?${s.toString()}`,t,n,"Recommendations loaded.")}async function xo(e,t,n){if(e.length<2)return k("compare requires two or more skill slugs.",t.json);let i=new URLSearchParams({slugs:e.join(",")}),r=await b(n,`/api/v1/skills/compare?${i.toString()}`);return t.json?h(r,"Comparison loaded.",!0,n):{exitCode:0,stdout:Kl(r,"Comparison loaded.",Z(n),t.verbose),stderr:""}}async function $o(e,t,n){let i=v(e[0],"show requires a skill slug."),r=await b(n,`/api/v1/skills/${encodeURIComponent(i)}`);return h(wa(r),"Skill loaded.",t.json,n)}async function _o(e,t,n){let i=v(e[0],"trust requires a skill slug."),r=new URLSearchParams;M(r,"format",t.format),M(r,"version",t.version);let s=await b(n,`/api/v1/skills/${encodeURIComponent(i)}/trust${oe(r)}`);return p(t.format)?.toLowerCase()==="sarif"&&!t.json?{exitCode:0,stdout:va(s,i,n),stderr:""}:h(s,"Trust report loaded.",t.json,n)}async function Io(e,t,n){let i=et(e[0],e[1]);if(i)return Nt(i,[e[0],e[1]].filter(Boolean).join(" "),t,n);let r=e[0];if(!r)return{exitCode:0,stdout:Te,stderr:""};if(r==="full")return Nt(Te,"full",t,n);if(r==="topic"){let s=et(e[1]);if(s)return Nt(s,e[1]??"overview",t,n);let o=new URLSearchParams;return e[1]&&o.set("topic",e[1]),await R(`/api/v1/help${oe(o)}`,t,n,"Help topic loaded.")}if(r==="standards")return await R("/api/v1/standards",t,n,"Marketplace standards loaded.");if(r==="marketplace-status"){let s=await b(n,"/api/v1/marketplace/status");return t.json?h(s,"Marketplace status loaded.",!0,n):h(Wl(s),"Marketplace status loaded.",!1,n)}if(r==="capabilities"){let s=await b(n,"/api/v1/capabilities");return h(Yl(s),"Edition capabilities loaded.",t.json,n)}if(r==="schema-plan")return k("help schema-plan is not included in the public npm CLI.",t.json);if(r==="optimize-tokens"){let s=v(t.text,"help optimize-tokens requires --text."),o=Zl(t.maxCharacters,t.json);if(H(o))return o;let l=await b(n,"/api/v1/optimize-tokens",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({text:s,...o?{maxCharacters:o}:{}})});return h(l,"Token optimization complete.",t.json,n)}return k(`Unknown help command "${r}".`,t.json)}function Nt(e,t,n,i){return n.json?h({status:"ok",topic:t,content:e},"Help topic loaded.",!0,i):{exitCode:0,stdout:e,stderr:""}}async function jo(e,t,n){let i=v(e[0]??t.path,"validate requires a file or directory."),s={files:await gt(J(n.cwd,i)),sourceIntakeContext:p(t.sourceIntakeContext),publicationStatus:p(t.publicationStatus),dependencyAuditStatus:p(t.dependencyAuditStatus),category:p(t.category),discloseSource:!!t.discloseSource,allowFindingsFeatured:!!t.allowFindingsFeatured},o;try{o=await b(n,"/api/v1/validation/preview",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x(s))})}catch(l){if(l instanceof A&&l.status===422&&l.details)o=_c(l.details);else throw l}return t.json?h(o,"Validation complete.",!0,n):{exitCode:0,stdout:Ql(o,i,n),stderr:""}}async function Ao(e,t,n){let i=v(e[0]??t.path,"preview-trigger requires a file or directory."),r=await gt(J(n.cwd,i)),s=await b(n,"/api/v1/validation/trigger-preview",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({files:r,shouldTriggerPrompts:t.shouldTrigger,shouldNotTriggerPrompts:t.shouldNotTrigger,paraphrasePrompts:t.paraphrase})});return t.json?h(s,"Trigger preview complete.",!0,n):{exitCode:0,stdout:Xl(s,i,n),stderr:""}}async function Lo(e,t,n){let i=e[0];if(i==="init")return await Eo(e.slice(1),t,n);if(i==="rules")return await R("/api/v1/creator/rules",t,n,"Creator rules loaded.");if(i==="submissions")return await R("/api/v1/me/submissions",t,n,"Submissions loaded.",{authenticated:!0});if(i==="status"){let r=v(e[1],"creator status requires a skill slug.");try{return await R(`/api/v1/me/submissions/${encodeURIComponent(r)}/status`,t,n,"Submission status loaded.",{authenticated:!0})}catch(s){if(s instanceof A&&s.status===404)return Fo(r,t);throw s}}if(i==="charge-status"){let r=v(e[1],"creator charge-status requires a charge id.");return await R(`/api/v1/me/private-skill-charges/${encodeURIComponent(r)}`,t,n,"Charge status loaded.",{authenticated:!0})}if(i==="submit")return await hi(e.slice(1),t,n,!1);if(i==="submit-version")return await hi(e.slice(1),t,n,!0);if(i==="check-slug"){let r=v(e[1],"creator check-slug requires a slug.");return await Mo(r,t,n)}if(i==="rename"){let r=v(e[1],"creator rename requires the current slug."),s=v(e[2],"creator rename requires the new slug.");return await Fe(`/api/v1/me/submissions/${encodeURIComponent(r)}/slug`,{nextSkillSlug:s},t,n,"Skill renamed.")}if(i==="pricing")return await Go(e,t,n);if(i==="update-listing"){let r=v(e[1],"creator update-listing requires a skill slug.");return await Vo(r,t,n)}if(i==="visibility"){let r=v(e[1],"creator visibility requires a skill slug."),s=p(t.visibility)??e[2],o=Rt(s);if(!o||!Tt.includes(o))return C({status:"error",reasonCode:"invalid_visibility",skillSlug:r,visibility:s??null,acceptedValues:Tt,nextAction:"creator.visibility",nextStep:"Use --visibility private, public, or unlisted."},`Invalid creator visibility "${s??""}". Use one of: ${Tt.join(", ")}.`,t.json,"invalid_visibility");let l=await b(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/visibility`,{method:"PATCH",headers:j(n.apiKey),body:JSON.stringify(x({visibility:o,dryRun:t.dryRun}))});return Ua(l)?C(l,Ta(l,r),t.json,a(l,"reasonCode")??a(l,"status")):h(l,t.dryRun?"Visibility preview loaded.":"Visibility updated.",t.json,n)}if(i==="security-report"){let r=v(e[1],"creator security-report requires a skill slug."),s=new URLSearchParams;M(s,"format",t.format),M(s,"version",t.version),M(s,"versionId",t.versionId);let o=await b(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/trust${oe(s)}`,{headers:B(n.apiKey,n.authBlockedMessage)});return t.json||t.verbose?h(o,"Creator security report loaded.",t.json,n):{exitCode:0,stdout:mc(o,r,n),stderr:""}}if(i==="rescan-security"){let r=v(e[1],"creator rescan-security requires a skill slug."),s=await b(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/trust/rescan`,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x(q(t,["version","versionId"])))});return t.json?h(s,"Security rescan requested.",!0,n):{exitCode:0,stdout:fc(s,r,n),stderr:""}}if(i==="provenance"){let r=v(e[1],"creator provenance requires a skill slug.");return await R(`/api/v1/me/submissions/${encodeURIComponent(r)}/provenance`,t,n,"Provenance loaded.",{authenticated:!0})}if(i==="claim"||i==="verify"||i==="dispute")return await Do(i,e,t,n);if(i==="issues"||i==="reviews"||i==="update-issue"||i==="moderate-review")return await Zo(i,e,t,n);if(i==="analytics"){let r=v(e[1],"creator analytics requires a skill slug.");return await Ho(r,t,n)}return i==="earnings"?await R("/api/v1/me/earnings",t,n,"Creator earnings loaded.",{authenticated:!0}):i==="payout-profile"?await zo(t,n):i==="payout-link"?await Wo(t,n):i==="payouts"?await R("/api/v1/me/payouts",t,n,"Creator payouts loaded.",{authenticated:!0}):i==="withdraw"?await K("/api/v1/me/payouts/withdrawals",q(t,["amountCents","reason"]),t,n,"Withdrawal requested."):i==="source"?await Qo(e.slice(1),t,n):k(`Unknown creator command "${i??""}".`,t.json)}async function Eo(e,t,n){let i=p(t.skill)??e[0]??"my-skill",r=J(n.cwd,p(t.dir)??i),s=L(r,"SKILL.md"),o;try{o=Yn(p(t.type))}catch(f){return k(ae(f),t.json)}let l=p(t.category),c=await Uo(r);if((await me(s)||c)&&!t.confirmed)return k(`Creator init target already exists at ${r}. Re-run with --confirm only if you want to overwrite ${s}.`,t.json);await Ke(r,{recursive:!0});let d=Zn({skillSlug:i,description:p(t.description)??"Describe what this skill helps an agent do.",skillType:o,category:l});for(let f of d)await re(L(r,f.path),f.content);let g=x({status:"created",path:s,skillSlug:i,skillType:o,category:l,fileCount:d.length});return t.json?h(g,`Created ${s}.`,!0,n):{exitCode:0,stdout:oc(g,r,s,n),stderr:""}}async function me(e){try{return await Ki(e),!0}catch{return!1}}async function Uo(e){try{return(await Vi(e)).length>0}catch{return await me(e)}}async function hi(e,t,n,i){let r=i?v(p(t.skill)??e[0],"creator submit-version requires a skill slug."):p(t.skill),s=v(p(t.source)??(i?e[1]:e[0])??t.path,`creator ${i?"submit-version":"submit"} requires a <path-or-source> or --source <source>.`),o=await ut(s,n.cwd);if(t.list)return await To(s,o,r,t,n);if(p(t.source)&&!o&&Br(s))return Bo(s,t);let l=o?.files??await gt(J(n.cwd,s));if(!i&&!t.dryRun){let m=await No(l,t,n);if(m)return m}let c=x({files:l,version:p(t.version),dryRun:t.dryRun,allowFindingsFeatured:t.allowFindingsFeatured,pricing:p(t.priceCents)?{priceCents:Number(p(t.priceCents))}:void 0,...o?{sourceMetadata:o.sourceMetadata}:{},...q(t,["displayName","skillType","category","visibility","source","skill"])}),u=i&&r?`/api/v1/me/submissions/${encodeURIComponent(r)}/versions`:"/api/v1/me/submissions",d=await b(n,u,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(c)});if(t.json||d.status!=="checkout_required"||typeof d.checkoutUrl!="string"||typeof d.chargeId!="string")return h(d,i?"Version submitted.":"Submission uploaded.",t.json,n);n.emitInfo("Opening payment setup for skill submission. Complete the payment in your browser, then come back here."),await n.openUrl(d.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${d.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let f=await xl(d.chargeId,n);return H(f)?f:f.status!=="submitted"?h({...d,chargeStatus:f.status},`Payment is still ${f.status}. You can rerun \`skills-layer creator charge-status ${d.chargeId}\` to continue tracking it.`,t.json,n):h(f,i?"Version submitted.":"Submission uploaded.",t.json,n)}async function To(e,t,n,i,r){if(t)return h(yi(er(e,t,n)),"Source skills loaded.",i.json,r);let s=await Be(r,e,{source:e,skillSlug:n,listOnly:!0,operation:"creator.submit"},i);return s.kind==="failure"?s.result:h(yi(s.inspection),"Source skills loaded.",i.json,r)}function yi(e){return{...e,sourceSubmissionSupported:!0}}function Bo(e,t){let i=`skills-layer source connection start --provider ${sr(e)} --source ${e} --visibility private --provenance-intent private_source_import`;return C({status:"source_connection_required",reasonCode:"source_connection_required",source:e,nextAction:"source.connection.start",nextStep:i},`Creator submit can list ${e} safely, but publishing from a remote source requires a source connection. Run \`${i}\`.`,t.json,"source_connection_required")}async function No(e,t,n){let i=p(t.skill)??qo(e);if(!i)return null;let r;try{r=await b(n,`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(i)}`,{headers:B(n.apiKey,n.authBlockedMessage)})}catch(s){if(s instanceof A&&s.status===404)return Qi(i,t);throw s}if(r.available===!1||a(r,"reasonCode")==="unavailable"||a(r,"reasonCode")==="reserved"){let s=a(r,"assignedSlug"),o=x({status:"duplicate_candidate",reasonCode:a(r,"reasonCode")??"slug_unavailable",requestedSlug:i,assignedSlug:s,nextAction:"creator.status",nextStep:`Run \`skills-layer creator status ${i}\`, \`skills-layer creator submissions\`, or submit a new version of the existing skill instead of creating a duplicate listing.`});return C(o,`A public skill slug "${i}" already exists or is not available. Run \`skills-layer creator status ${i}\`, check your creator submissions, or submit a new version instead of creating a duplicate listing.`,t.json,a(o,"reasonCode"))}return null}async function Mo(e,t,n){try{let i=await b(n,`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(e)}`,{headers:B(n.apiKey,n.authBlockedMessage)});return h(Oo(i),"Slug status loaded.",t.json,n)}catch(i){if(i instanceof A&&i.status===404)return Qi(e,t);throw i}}function Qi(e,t){let n={status:"slug_check_unavailable",reasonCode:"slug_check_route_unavailable",requestedSlug:e,nextAction:"creator.status",nextStep:`Slug availability could not be checked on the selected backend. Run \`skills-layer creator submissions\`, \`skills-layer creator status ${e}\`, or retry after selecting a compatible Skills Layer backend.`};return C(n,`Slug availability could not be checked for ${e} on the selected backend. Run \`skills-layer creator submissions\` or retry after selecting a compatible Skills Layer backend.`,t.json,"slug_check_route_unavailable")}function Oo(e){let t=e.available===!0,n=a(e,"assignedSlug");if(t)return x({requestedSlug:a(e,"requestedSlug"),available:!0,reasonCode:a(e,"reasonCode")??"available",assignedSlug:n});let i=S(e,"slugAssignment"),r=Array.isArray(i?.candidateSlugs)?i.candidateSlugs.filter(s=>typeof s=="string").slice(0,5):void 0;return x({...e,...i?{slugAssignment:{...i,...r?{candidateSlugs:r}:{}}}:{},...r?{candidateSlugs:r}:{}})}function Fo(e,t){return C({status:"not_submitted",reasonCode:"creator_submission_not_found",skillSlug:e,nextAction:"creator.submit",nextStep:"Run `skills-layer creator submit <path> --dry-run` to validate a local skill before submitting it, or run `skills-layer creator submissions` to see your existing submissions."},`No creator submission was found for ${e}. Run \`skills-layer creator submit <path> --dry-run\` before checking status.`,t.json,"creator_submission_not_found")}function qo(e){let t=e.find(i=>i.path.split("/").pop()?.toLowerCase()==="skill.md");if(!t)return;let n=/^---\s*\n(?<body>[\s\S]*?)\n---/u.exec(t.content??"")?.groups?.body?.split(/\r?\n/u).map(i=>i.match(/^name\s*:\s*(?<name>.+?)\s*$/u)?.groups?.name?.trim().replace(/^["']|["']$/gu,"")).find(i=>!!i);return Ko(n??G(ee(t.path)))}function Ko(e){return e?.toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||void 0}async function Go(e,t,n){let i=v(e[1],"creator pricing requires a skill slug."),r=new URLSearchParams;if(M(r,"version",t.version),!t.priceCents)return await R(`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing${oe(r)}`,t,n,"Pricing loaded.",{authenticated:!0});let s=Number(p(t.priceCents)),o=await b(n,`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing${oe(r)}`,{headers:B(n.apiKey,n.authBlockedMessage)}),l=F(o,"priceCents")??0;if(s>l){let c=x({status:"pending_approval",reasonCode:l===0?"paid_activation_requires_approval":"price_increase_requires_approval",skillSlug:i,version:a(o,"version"),currentPriceCents:l,requestedPriceCents:s,currency:a(o,"currency")??"gbp",nextStep:"Pricing changes that increase buyer-facing cost require approval. Keep the current price for now, then retry after approval is available."});return h(c,"Pricing change requires approval before it can affect buyers.",t.json,n)}return await Fe(`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing`,{priceCents:s,version:p(t.version)},t,n,"Pricing updated.")}async function Vo(e,t,n){try{return await Fe(`/api/v1/me/submissions/${encodeURIComponent(e)}`,q(t,["displayName","summary","description","category","skillType","license","listingStatus"]),t,n,"Listing updated.")}catch(i){if(i instanceof A&&i.status===404){let r={status:"listing_not_found_or_not_editable",reasonCode:"creator_listing_not_found_or_not_owned",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see editable listings, or \`skills-layer show ${e}\` to inspect the public catalog entry.`};return C(r,`No editable creator listing was found for ${e}. Run \`skills-layer creator submissions\` to see listings you can update.`,t.json,"creator_listing_not_found_or_not_owned")}throw i}}async function Do(e,t,n,i){let r=v(t[1],`creator ${e} requires a skill slug.`);try{if(e==="claim")return await K(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/claim`,q(n,["requestedRole","message"]),n,i,"Ownership claim submitted.");if(e==="verify"){let s=v(n.claimId,"creator verify requires --claim-id.");return await K(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/verify`,{claimId:s},n,i,"Ownership claim verified.")}return await K(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/dispute`,q(n,["message"]),n,i,"Ownership dispute submitted.")}catch(s){if(s instanceof A&&s.status===404){let o={status:"ownership_action_unavailable",reasonCode:e==="claim"?"skill_not_found_or_not_claimable":"ownership_claim_not_found",skillSlug:r,requestedRole:p(n.requestedRole),nextAction:e==="claim"?"search":"creator.claim",nextStep:e==="claim"?`Run \`skills-layer search ${r}\`, \`skills-layer show ${r}\`, or submit/source-install the skill before claiming it.`:`Run \`skills-layer creator claim ${r}\` to start a new claim if the skill is claimable.`};return C(o,e==="claim"?`No claimable skill was found for ${r}. Search or show the skill first, then claim it only when it exists and is claimable.`:`No matching ownership claim was found for ${r}. Start a new claim if the skill is claimable.`,n.json,a(o,"reasonCode")??"ownership_action_unavailable")}throw s}}async function Ho(e,t,n){try{return await R(`/api/v1/me/submissions/${encodeURIComponent(e)}/analytics`,t,n,"Analytics loaded.",{authenticated:!0})}catch(i){if(i instanceof A&&i.status===404){let r={status:"no_creator_submission",reasonCode:"creator_submission_not_found",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see skills you own, \`skills-layer show ${e}\` to inspect the catalog listing, or \`skills-layer creator claim ${e}\` if it is a claimable public-source skill.`};return C(r,`No creator-owned analytics submission was found for ${e}. Run \`skills-layer creator submissions\`, \`skills-layer show ${e}\`, or \`skills-layer creator claim ${e}\` if you should manage it.`,t.json,"creator_submission_not_found")}throw i}}async function zo(e,t){let n=await b(t,"/api/v1/me/payout-profile",{headers:B(t.apiKey,t.authBlockedMessage)});return h(n,"Creator payout profile loaded.",e.json,t)}async function Wo(e,t){let n=Jo(p(e.mode));if(e.mode&&n===null)return k("creator payout-link --mode must be account_onboarding|account_update|onboarding|update.",e.json);let i;try{i=await b(t,"/api/v1/me/payout-profile/link",{method:"POST",headers:j(t.apiKey),body:JSON.stringify(n?{mode:n}:{})})}catch(s){if(s instanceof A&&Yo(s))return C({status:"payout_setup_already_submitted",reasonCode:"payout_update_link_unavailable",nextAction:"creator.payout-profile",nextStep:"Run `skills-layer creator payout-profile` to confirm readiness, then use `skills-layer creator earnings` or `skills-layer creator withdraw --amount-cents <amount>`."},"Payout setup is already submitted for this account. Run `skills-layer creator payout-profile` to confirm readiness before requesting a withdrawal.",e.json,"payout_update_link_unavailable");throw s}let r=$l(i);return r&&!e.json&&e.showUrl!==!0&&(t.emitInfo("Opening payout setup in your browser. Finish the flow there, then come back here."),await t.openUrl(r)||t.emitInfo(`Open this payout setup URL manually to continue: ${r}`)),h(i,"Payout setup link created.",e.json,t)}function Jo(e){if(!e)return null;let t=e.trim().toLowerCase();return t==="account_onboarding"||t==="onboarding"?"account_onboarding":t==="account_update"||t==="update"?"account_update":null}function Yo(e){let t=`${e.message} ${a(e.details??{},"error")??""}`.toLowerCase();return t.includes("account_update")&&t.includes("account_onboarding")&&t.includes("account link")}async function Zo(e,t,n,i){let r=v(t[1],`creator ${e} requires a skill slug.`);if(e==="issues")return await R(`/api/v1/me/library/${encodeURIComponent(r)}/issues`,n,i,"Issues loaded.",{authenticated:!0});if(e==="reviews")return await R(`/api/v1/me/library/${encodeURIComponent(r)}/reviews`,n,i,"Reviews loaded.",{authenticated:!0});if(e==="update-issue"){let o=v(n.issueId,"creator update-issue requires --issue-id.");return await Fe(`/api/v1/me/library/${encodeURIComponent(r)}/issues/${encodeURIComponent(o)}`,q(n,["status","fixedVersion","note"]),n,i,"Issue updated.")}let s=v(n.reviewId,"creator moderate-review requires --review-id.");return await Fe(`/api/v1/me/library/${encodeURIComponent(r)}/reviews/${encodeURIComponent(s)}`,q(n,["status","reason"]),n,i,"Review updated.")}async function Qo(e,t,n){let i=e[0],r=v(e[1],`creator source ${i??""} requires a source connection id.`),s=p(t.skill)??e[2];if(i==="prepare")return await K(`/api/v1/me/source-connections/${encodeURIComponent(r)}/prepare`,x({...q(t,["skill","source","version","displayName","skillType","category","priceCents","visibility"]),source:p(t.source)??e[2]}),t,n,"Source release prepared.");if(i==="publish-request"){let o=t.approvalRequestId.length>0?t.approvalRequestId:p(t.approvalRequestId)?[String(t.approvalRequestId)]:[];return await K(`/api/v1/me/source-connections/${encodeURIComponent(r)}/publish-request`,x({skillSlug:s,approvalRequestIds:o,version:p(t.version),...q(t,["visibility","priceCents","license","discloseSource"])}),t,n,"Source publish requested.")}if(i==="release-status"){let o=new URLSearchParams;return s&&o.set("skill",s),await R(`/api/v1/me/source-connections/${encodeURIComponent(r)}/release-status${oe(o)}`,t,n,"Source release status loaded.",{authenticated:!0})}return k(`Unknown creator source command "${i??""}".`,t.json)}async function fn(e,t,n){let i=p(t.source);if(i){let c=p(t.skill),u=await ut(i,n.cwd);if(u)return await ki(i,u,c,t,n);let d=t.list||t.dryRun||!c&&!t.json&&!t.all,g=await Be(n,i,{source:i,skillSlug:c,listOnly:d},t);if(g.kind==="failure")return g.result;let f=g.inspection;if(t.list)return h(f,"Source skills loaded.",t.json,n);let m=Yt(i,f,t);if(m)return m;let y=await Wt({source:i,inspection:f,requestedSkillSlug:c,mode:"install",flags:t,backend:n});if(y.kind==="failure")return y.result;if(t.dryRun)return h(Jt(i,f,y.skillSlug,t),"Source install preview ready.",t.json,n);let w=wi(t,n),P;try{P=await b(n,w,{method:"POST",headers:vi(t,n),body:JSON.stringify(Si({source:i},y.skillSlug,t))})}catch(N){if(N instanceof A)return Pi(i,N,t);throw N}let _=await Ft(n,P);return await at(n,_,y.skillSlug??a(_,"skillSlug")??i),ot(_,bi(t),t.json,n)}let r=v(e[0]??t.install,"install requires a skill slug or --source.");if(Br(r)){let c=await ut(r,n.cwd);if(c)return await ki(r,c,p(t.skill),t,n);let u=p(t.skill),d;if(t.list){let y=await Be(n,r,{source:r,listOnly:!0},t);return y.kind==="failure"?y.result:h(y.inspection,"Source skills loaded.",t.json,n)}if(!u&&!t.json&&!t.all){let y=await Be(n,r,{source:r,listOnly:!0},t);if(y.kind==="failure")return y.result;let w=y.inspection;d=w;let P=Yt(r,w,t);if(P)return P;let _=await Wt({source:r,inspection:w,requestedSkillSlug:u,mode:"install",flags:t,backend:n});if(_.kind==="failure")return _.result;u=_.skillSlug}if(t.dryRun){if(!d){let y=await Be(n,r,{source:r,listOnly:!0},t);if(y.kind==="failure")return y.result;d=y.inspection}return h(Jt(r,d,u,t),"Source install preview ready.",t.json,n)}let g=wi(t,n),f;try{f=await b(n,g,{method:"POST",headers:vi(t,n),body:JSON.stringify(Si({source:r},u,t))})}catch(y){if(y instanceof A)return Pi(r,y,t);throw y}let m=await Ft(n,f);return await at(n,m,u??a(m,"skillSlug")??G(r)),ot(m,bi(t),t.json,n)}if(p(t.scope)==="workspace"){let c=v(t.workspace,"workspace installs require --workspace <workspace-id>."),u=await b(n,`/api/v1/workspaces/${encodeURIComponent(c)}/skills`,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x({skillSlug:r,version:p(t.version),dryRun:t.dryRun}))});return t.dryRun?or(u,"Workspace install preview ready.",t,n):h(u,"Workspace deployment requested.",t.json,n)}let s=await b(n,"/api/v1/install",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x({skillSlug:r,version:p(t.version),scope:p(t.scope),agent:p(t.agent),dryRun:t.dryRun}))});if(t.dryRun)return await fa(s,t,n);let o=await Ft(n,s),l=await Xo(n,o,r,t);return H(l)?l:(await at(n,l,r),ot(l,"Skill installed.",t.json,n))}async function Xo(e,t,n,i){if(Array.isArray(t.materializedWrites)&&t.materializedWrites.length>0)return t;let r=ea(e,t,n,i);if(r.status==="skip")return t;if(r.status==="failure")return C({status:"materialization_target_invalid",reasonCode:"materialization_target_invalid",skillSlug:r.skillSlug,nextStep:r.nextStep},r.message,i.json,"materialization_target_invalid");let s=await ta(e,t,r.skillSlug,r.version),o=await Xi({backend:e,exportResult:s,flags:i,skillSlug:r.skillSlug});if(H(o))return o;let l=await sa({backend:e,skillSlug:r.skillSlug,version:r.version??a(s,"version")??"latest",scope:r.scope,agent:r.agent,skillsPath:r.skillsPath,bytes:o.bytes,files:o.files,archiveSha256:o.archiveSha256});return{...t,...na(s),archiveSha256:o.archiveSha256,archiveHashFormat:o.archiveHashFormat,scope:r.scope,agent:r.agent.id,targetAgent:r.agent.id,materializationPlan:{scope:r.scope,agent:r.agent.id},...l}}function ea(e,t,n,i){let r=S(t,"materializationPlan")??S(t,"installPlan"),s=p(i.scope)??a(t,"scope")??(r?a(r,"scope"):void 0);if(s!=="project"&&s!=="global")return{status:"skip"};let o=a(t,"skillSlug")??a(t,"slug")??n,l=p(i.agent)??a(t,"agent")??a(t,"targetAgent")??(r?a(r,"agent")??a(r,"targetAgent"):void 0)??X(e.config?.lastSelectedAgent)??"codex",c=ge(e.env,e.platform,e.cwd).find(d=>d.id===l);if(!c)return{status:"failure",skillSlug:o,message:`Unsupported agent "${l}". Run \`skills-layer agents list\` to choose a supported local install target.`,nextStep:"Run `skills-layer agents list` and retry with a supported --agent value."};let u=s==="global"?c.targets.globalSkillsPath:c.targets.projectSkillsPath;return u?{status:"ok",scope:s,agent:c,skillsPath:u,skillSlug:o,version:a(t,"version")??a(t,"currentVersion")}:{status:"failure",skillSlug:o,message:`${c.displayName} does not expose a ${s} skills path on this machine.`,nextStep:"Retry with --scope project, or choose another agent from `skills-layer agents list`."}}async function ta(e,t,n,i){if(typeof t.downloadUrl=="string"&&typeof t.archiveSha256=="string")return t;let r=new URLSearchParams;return i&&r.set("version",i),await b(e,`/api/v1/me/library/${encodeURIComponent(n)}/export${oe(r)}`,{headers:B(e.apiKey,e.authBlockedMessage)})}function na(e){return x({version:a(e,"version"),storageKey:a(e,"storageKey"),expiresAt:a(e,"expiresAt")})}async function Xi(e){let t=a(e.exportResult,"downloadUrl");if(!t)return C({status:"export_download_unavailable",reasonCode:"export_download_unavailable",skillSlug:e.skillSlug,nextStep:"Retry after the backend returns a signed bundle download URL."},`Export for ${e.skillSlug} did not include a signed download URL.`,e.flags.json,"export_download_unavailable");let n=await e.backend.fetchFn(ia(e.backend.baseUrl,t));if(!n.ok)throw new A(n.status,`Unable to download exported bundle (${n.status}).`);let i=new Uint8Array(await n.arrayBuffer()),r=ra(i),s=a(e.exportResult,"archiveSha256")??n.headers.get("x-skills-layer-archive-sha256")?.trim()??void 0;return s&&r.archiveSha256!==s?C({status:"download_integrity_failed",reasonCode:"download_hash_mismatch",skillSlug:e.skillSlug,version:a(e.exportResult,"version"),expectedArchiveSha256:s,observedArchiveSha256:r.archiveSha256,archiveHashFormat:r.format,nextStep:"Retry after the catalog artifact is refreshed, or contact Skills Layer support if this repeats."},`Downloaded ${e.skillSlug} did not match the catalog artifact hash.`,e.flags.json,"download_hash_mismatch"):r.files.length===0?C({status:"download_integrity_failed",reasonCode:"download_bundle_empty",skillSlug:e.skillSlug,archiveHashFormat:r.format,nextStep:"Retry after the catalog artifact is refreshed."},`Downloaded ${e.skillSlug} did not contain any skill files.`,e.flags.json,"download_bundle_empty"):{status:"ok",bytes:i,files:r.files,archiveSha256:r.archiveSha256,archiveBytesSha256:r.archiveBytesSha256,archiveHashFormat:r.format}}function ia(e,t){return/^https?:\/\//iu.test(t)?t:`${ie(e)}${t.startsWith("/")?"":"/"}${t}`}function ra(e){let t=on("sha256").update(e).digest("hex"),n=Vn(e);return n?{archiveSha256:Dn(n),archiveBytesSha256:t,format:"bundle_archive",files:n}:{archiveSha256:t,archiveBytesSha256:t,format:"raw",files:[]}}async function sa(e){let t=e.backend.platform==="win32"?xe:cn,n=t.join(e.backend.paths.bundlesDir,e.skillSlug,e.version,"bundle.zip"),i=t.join(e.skillsPath,e.skillSlug),r=t.join(i,e.version,"bundle.zip"),s=[];await rn(n,e.bytes),await an(i,{recursive:!0,force:!0}),await rn(r,e.bytes),s.push({path:lt(e.backend.cwd,r),bytes:e.bytes.byteLength});for(let o of e.files){let l=t.join(i,...oa(o.path)),c=o.content??"";if(await re(l,c),s.push({path:lt(e.backend.cwd,l),bytes:new TextEncoder().encode(c).length}),G(o.path).toLowerCase()==="skill.md"){let u=await Sn({backend:e.backend,skillSlug:e.skillSlug,version:e.version,skillDocumentPath:l,skillDocumentContent:c});s.push(u)}}return{bundlePath:n,materializedPath:r,materializedSkillRoot:i,archiveSha256:e.archiveSha256,materializedWrites:s}}function oa(e){let n=e.replaceAll("\\","/").replace(/^\/+/u,"").trim().split("/").filter(i=>i.length>0);if(n.length===0||n.some(i=>i==="."||i===".."))throw new Error(`Unsafe bundle path "${e}".`);return n}async function ki(e,t,n,i,r){let s=p(i.visibility)??"private";if(s!=="private")return C({status:"local_install_visibility_not_allowed",reasonCode:"local_install_visibility_not_allowed",source:e,requestedVisibility:s,nextStep:`Use \`skills-layer creator submit ${e} --visibility ${s} --dry-run\` when you want to submit a local skill with non-private visibility.`},`Local path install creates a private Cloud skill by default. Use creator submit when you want ${s} visibility.`,i.json,"local_install_visibility_not_allowed");let o=er(e,t,n);if(i.list)return h(o,"Local source skills loaded.",i.json,r);let l=Yt(e,o,i);if(l)return l;let c=await Wt({source:e,inspection:o,requestedSkillSlug:n,mode:"install",flags:i,backend:r});if(c.kind==="failure")return c.result;let u=c.skillSlug??Ve(o)[0]?.value??nr(e);if(i.dryRun)return h({...Jt(e,o,u,i),installKind:"local_private",publicationStatus:"none",catalogRecord:"not_created",nextStep:`Re-run without --dry-run to install ${u} locally. Use \`skills-layer creator submit ${e} --visibility private --dry-run\` when you want a private creator submission.`},"Local private install preview ready.",i.json,r);let d=await b(r,"/api/v1/me/submissions",{method:"POST",headers:{"content-type":"application/json",...B(r.apiKey,r.authBlockedMessage)},body:JSON.stringify(x({files:t.files,version:p(i.version),visibility:"private",category:p(i.category),displayName:p(i.displayName),skillType:p(i.skillType),sourceMetadata:t.sourceMetadata}))}),g=await ca({backend:r,source:e,upload:t,skillSlug:a(d,"skillSlug")??u,flags:i,submitted:d});return await at(r,g,u),ot(g,"Private Cloud skill installed.",i.json,r)}function er(e,t,n){let i=aa(t.files),r=n?i.find(s=>s.skillSlug===n)??null:i.length===1?i[0]??null:null;return{status:"ok",source:t.sourceMetadata,selectedSkill:r,results:i,issues:[],sourceInstallSupported:!0,sourceInstallMode:"local_private",publicationStatus:"none",originalSource:e}}function aa(e){return e.filter(t=>t.path.split("/").at(-1)?.toLowerCase()==="skill.md").map(t=>{let n=ee(t.path).replaceAll("\\","/"),i=n==="."?".":n,r=tr(t.content??"")??nr(i==="."?t.path:i),s=la(t.content??"");return{skillSlug:r,name:r,...s?{description:s}:{},relativeSkillRoot:i,relativeSkillFile:t.path,sourceKind:"local",discoveryRoute:"local_bundle",validation:{valid:!0,issueCount:0}}})}function tr(e){return/^---\s*[\s\S]*?\nname:\s*["']?([^"'\n]+)["']?\s*(?:\n|$)/u.exec(e)?.[1]?.trim()}function la(e){return/^---\s*[\s\S]*?\ndescription:\s*["']?([^"'\n]+)["']?\s*(?:\n|$)/u.exec(e)?.[1]?.trim()}function nr(e){return(e.replaceAll("\\","/").replace(/\/+$/u,"").split("/").filter(Boolean).at(-1)??"local-skill").toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||"local-skill"}async function ca(e){let t=ua(e.backend,e.flags);if(t.status==="failure")throw new Error(t.message);let n=e.upload.files.map(r=>({path:L(t.skillsPath,e.skillSlug,Pr(r.path)),content:r.content??""})),i=[];for(let r of n)if(await re(r.path,r.content),i.push({path:lt(e.backend.cwd,r.path),bytes:new TextEncoder().encode(r.content).length}),G(r.path).toLowerCase()==="skill.md"){let s=await Sn({backend:e.backend,skillSlug:e.skillSlug,version:a(e.submitted,"version")??p(e.flags.version)??"private",skillDocumentPath:r.path,skillDocumentContent:r.content});i.push(s)}return{...e.submitted,status:"installed",cloudStatus:a(e.submitted,"status")??"submitted",installKind:"cloud_private",source:e.source,sourceKind:"local",skillSlug:e.skillSlug,version:a(e.submitted,"version")??p(e.flags.version)??"private",scope:t.scope,agent:t.agent,visibility:"private",publicationStatus:"private",catalogRecord:"private",privacy:{publication:"private",catalogRecord:"private",message:"This local install was saved as a private Cloud skill and did not create a public catalog record."},materializationPlan:{scope:t.scope,agent:t.agent},materializedWrites:i}}function ua(e,t){let n=p(t.scope)??"project";if(!["local","project","global"].includes(n))return{status:"failure",message:"Local private installs support --scope local, project, or global. Use `skills-layer creator submit <path> --visibility private` for private creator workflows."};let i=p(t.agent)??X(e.config?.lastSelectedAgent)??"codex",r=ge(e.env,e.platform,e.cwd).find(o=>o.id===i);if(!r)return{status:"failure",message:`Unsupported agent "${i}". Run \`skills-layer agents list\` to choose a supported local install target.`};let s=n==="global"?r.targets.globalSkillsPath:r.targets.projectSkillsPath;return s?{status:"ok",scope:n,agent:r.id,skillsPath:s}:{status:"failure",message:`${r.displayName} does not expose a ${n} skills path on this machine.`}}function lt(e,t){let n=Me(e,t);return n&&!n.startsWith("..")&&!xe.isAbsolute(n)?n.split("\\").join("/"):t}function hn(e){return p(e.visibility)==="public"?"public":"private"}function wi(e,t){return hn(e)==="public"&&!t.apiKey?"/api/v1/source-imports":"/api/v1/me/source-installs"}function vi(e,t){return{"content-type":"application/json",...hn(e)==="private"?B(t.apiKey,t.authBlockedMessage):He(t.apiKey)}}function bi(e){return hn(e)==="public"?"Public source install planned.":"Private source skill installed."}async function Wt(e){if(e.requestedSkillSlug||e.flags.json||e.flags.all)return{kind:"selected",skillSlug:e.requestedSkillSlug};let t=Ve(e.inspection);if(t.length<=1)return{kind:"selected",skillSlug:t[0]?.value};try{return{kind:"selected",skillSlug:await e.backend.promptSelect(`${e.source} exposes multiple skills. Select one to ${e.mode}:`,t)}}catch{return{kind:"failure",result:k(`Source "${e.source}" exposes multiple skills. Re-run with --list or --skill <skill-slug>. Available skills: ${t.map(n=>n.value).join(", ")}.`,e.flags.json)}}}function Ve(e){let t=[e.results,e.skills,e.discoveredSkills,S(e,"source")?.results,S(e,"inspection")?.results],n=new Set,i=[];for(let r of t)if(Array.isArray(r))for(let s of r){let o=da(s);!o||n.has(o.value)||(n.add(o.value),i.push(o))}return i}function da(e){if(!$(e))return;let t=a(e,"skillSlug")??a(e,"slug")??a(e,"name");if(!t)return;let n=a(e,"displayName")??a(e,"title")??a(e,"name"),i=n&&n!==t?`${t} - ${n}`:t,r=S(e,"parsedSkill"),s=S(e,"frontmatter")??(r?S(r,"frontmatter"):void 0),o=a(e,"shortDescription")??a(e,"summary")??a(e,"description")??(s?a(s,"description"):void 0)??a(e,"relativeSkillRoot")??a(e,"path")??a(e,"discoveryRoute")??a(e,"sourceKind");return o?{value:t,label:i,description:o}:{value:t,label:i}}function Si(e,t,n){return x({...e,skillSlug:t,scope:p(n.scope),agent:p(n.agent),workspace:p(n.workspace),version:p(n.version),visibility:p(n.visibility)??"private",category:p(n.category),displayName:p(n.displayName),skillType:p(n.skillType),all:n.all,quarantine:n.quarantine,acceptCapability:n.acceptCapability})}function Jt(e,t,n,i){return x({status:"dry_run",source:e,selectedSkillSlug:n,all:i.all,scope:p(i.scope)??"local",agent:p(i.agent),workspace:p(i.workspace),quarantine:i.quarantine,acceptCapability:i.acceptCapability,candidates:Ve(t).map(r=>({skillSlug:r.value,name:r.label,description:r.description})),nextStep:i.all?`Re-run without --dry-run to install every discovered skill from ${e}.`:`Re-run without --dry-run${n?"":" and add --skill <skill-slug> if needed"} to install from ${e}.`})}async function Be(e,t,n,i){try{return{kind:"ok",inspection:await b(e,"/api/v1/source-inspect",{method:"POST",headers:j(e.apiKey),body:JSON.stringify(x(n))})}}catch(r){if(r instanceof A)return{kind:"failure",result:ga(t,r,i)};throw r}}function Yt(e,t,n){if(Ve(t).length>0)return null;let r=pa(t);return C({status:"unsupported_source_layout",source:e,reasonCode:"source_no_discoverable_skills",issues:r,nextStep:"Run with --list to inspect the source, use a subfolder containing SKILL.md, or install from a Skills Layer-compatible source layout."},ma(e,r),n.json)}function pa(e){return(Array.isArray(e.issues)?e.issues:[]).filter($).map(n=>({...a(n,"code")?{code:a(n,"code")}:{},...a(n,"message")?{message:a(n,"message")}:{},...a(n,"path")?{path:a(n,"path")}:{}}))}function ga(e,t,n){let i=t.details??{},r=a(i,"error")??t.message;if(ir(t.status,r))return rr(e,t,n,"inspect");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(r)))return mt(t,n.json);let o={status:"unsupported_source_layout",source:e,reasonCode:"source_not_inspectable",backendStatus:t.status,backendMessage:r,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return C(o,`Source ${e} could not be inspected as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function Pi(e,t,n){let i=t.details??{},r=a(i,"error")??t.message;if(ir(t.status,r))return rr(e,t,n,"install");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(r)))return mt(t,n.json);let o={status:"unsupported_source_layout",source:e,reasonCode:"source_not_installable",backendStatus:t.status,backendMessage:r,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return C(o,`Source ${e} could not be installed as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function ir(e,t){return e===401||e===403||/private source|provider authorization|unauthorized|forbidden|access denied/iu.test(t)}function rr(e,t,n,i){let r=t.details??{},s=a(r,"error")??t.message,l=`skills-layer source connection start --provider ${sr(e)} --source ${e} --visibility private --provenance-intent private_source_import`,c={status:"private_source_access_required",source:e,reasonCode:"private_source_access_required",backendStatus:t.status,backendMessage:s,nextStep:l};return C(c,`Cloud could not ${i} ${e} directly. If this is a private source, start a private source connection first:
|
|
1034
|
-
${
|
|
1035
|
-
`)}async function
|
|
1036
|
-
`)}function
|
|
1037
|
-
`)}function
|
|
1038
|
-
`)}function
|
|
1039
|
-
`)):(e.results.slice(0,
|
|
1040
|
-
`))}function
|
|
1041
|
-
`)}function
|
|
1042
|
-
`)}function
|
|
1043
|
-
Next step: ${o}`}async function Ba(e,t,n){let i=await ke(n),r=e[0];if(!r){let l=Object.values(i.installs);return h({status:l.length>0?"restored":"no_op",results:l},`Restore checked ${l.length} local install record${l.length===1?"":"s"}.`,t.json,n)}let s=i.installs[r];if(!s)return C({status:"missing_record",reasonCode:"restore_record_not_found",skillSlug:r,record:null,nextAction:"installed",nextStep:`Run \`skills-layer installed\` to see local records, \`skills-layer sync\` to refresh status, or \`skills-layer search ${r}\` if you want to find a catalog/source replacement.`},`No restorable local install record was found for ${r}. Run \`skills-layer installed\`, \`skills-layer sync\`, or \`skills-layer search ${r}\` next.`,t.json,"restore_record_not_found");let o={status:"restored",skillSlug:r,record:s};return t.json?h(o,`Restore checked for ${r}.`,!0,n):{exitCode:0,stdout:Ea(r,s,n),stderr:""}}async function Na(e,t,n){let i=v(e[0],"check requires a skill slug.");return await R(`/api/v1/skills/${encodeURIComponent(i)}/trust`,t,n,"Install trust checked.",{authenticated:!!n.apiKey})}async function Ma(e,t,n){let i=v(e[0]??t.source,"import requires a source."),r=await ut(i,n.cwd);if(!r){let o=Oa(i,t);if(o)return o}let s=await b(n,"/api/v1/source-imports",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x({...r??{source:i},quarantine:t.quarantine,skillSlug:p(t.skill),visibility:p(t.visibility)}))});return await D(n.paths.importsPath,{version:1,lastImport:s,savedAt:n.now()}),h(s,"Source import submitted.",t.json,n)}function Oa(e,t){try{return Ct(e).kind!=="local"?null:C({status:"error",reasonCode:"invalid_source",source:e,nextAction:"import",nextStep:Ri(e)?"Check that the local path exists and contains SKILL.md, or pass a supported GitHub/GitLab/source URL.":"Use an existing local path such as ./my-skill, a GitHub/GitLab source, or --help for import examples."},Ri(e)?`Import source ${e} was not found or is not readable.`:`Import source "${e}" is not a supported source. Use a local path, GitHub/GitLab source, or URL.`,t.json,"invalid_source")}catch(n){return C({status:"error",reasonCode:"invalid_source",source:e,error:ae(n),nextAction:"import",nextStep:"Use an existing local path such as ./my-skill, a GitHub/GitLab source, or URL."},`Import source "${e}" is invalid. ${ae(n)}`,t.json,"invalid_source")}}function Ri(e){return/^(?:\.{1,2}(?:[\\/]|$)|[\\/]|[A-Za-z]:[\\/])/u.test(e)}async function Fa(e,t,n){let i=e[0];if(i==="reference"&&e[1]==="resolve"){let r=v(e[2],"source reference resolve requires a reference."),s=await b(n,`/api/v1/source-references/resolve?reference=${encodeURIComponent(r)}`);return s.status==="not_found"?C({...s,status:"not_found",reasonCode:"source_reference_not_found",reference:r,nextAction:"source.connection.start",nextStep:"Start or complete the source connection before resolving this reference."},`Source reference ${r} was not found.`,t.json,"source_reference_not_found"):h(s,"Source reference resolved.",t.json,n)}return i==="connection"?await qa(e.slice(1),t,n):k(`Unknown source command "${e.join(" ")}".`,t.json)}async function qa(e,t,n){let i=e[0];if(i==="start"){let s=p(t.provider),o=p(t.source),l=p(t.visibility),c=Ka(s,o,l,t);return c||await K("/api/v1/me/source-connections",q(t,["provider","source","skill","mode","visibility","priceCents","license","provenanceIntent","discloseSource"]),t,n,"Source connection started.")}let r=v(e[1],`source connection ${i??""} requires a connection id.`);return i==="status"?await R(`/api/v1/me/source-connections/${encodeURIComponent(r)}`,t,n,"Source connection loaded.",{authenticated:!0}):i==="complete"?await K(`/api/v1/me/source-connections/${encodeURIComponent(r)}/complete`,q(t,["providerOwnerId","providerRepoId","providerProjectId","providerInstallationId","commitSha"]),t,n,"Source connection completed."):i==="cancel"?await K(`/api/v1/me/source-connections/${encodeURIComponent(r)}/cancel`,{},t,n,"Source connection cancelled."):k(`Unknown source connection command "${i??""}".`,t.json)}function Ka(e,t,n,i){if(n){let r=Rt(n);if(!r||!Bt.includes(r))return C({status:"error",reasonCode:"invalid_visibility",visibility:n,acceptedValues:Bt,nextAction:"source.connection.start",nextStep:"Use --visibility private, public, or unlisted."},`Invalid source connection visibility "${n}". Use one of: ${Bt.join(", ")}.`,i.json,"invalid_visibility")}if(!e||!t)return null;try{let r=Ct(t);if((e==="github"||e==="gitlab")&&r.kind!==e)return Mt(e,t,i);if(e==="domain"){let s=new URL(t);if(s.protocol!=="https:"||!s.hostname)return Mt(e,t,i)}}catch{return Mt(e,t,i)}return null}function Mt(e,t,n){return C({status:"error",reasonCode:"invalid_source",provider:e,source:t,nextAction:"source.connection.start",nextStep:e==="github"?"Use a GitHub source such as https://github.com/OWNER/REPO or github:OWNER/REPO.":e==="gitlab"?"Use a GitLab source such as https://gitlab.com/GROUP/REPO or gitlab:GROUP/REPO.":"Use a valid source URL or provider-specific source."},`Invalid ${e} source "${t}".`,n.json,"invalid_source")}async function Ga(e,t,n){if(e[0]!=="request")return k(`Unknown approval command "${e[0]??""}".`,t.json);let i=e[1],r=v(e[2],`approval request ${i??""} requires an approval id.`);return i==="status"?await R(`/api/v1/me/approvals/${encodeURIComponent(r)}`,t,n,"Approval status loaded.",{authenticated:!0}):i==="complete"?await K(`/api/v1/me/approvals/${encodeURIComponent(r)}/complete`,x({decision:p(t.decision),evidence:ft(t.decisionEvidenceJson,"decision-evidence-json")}),t,n,"Approval completed."):k(`Unknown approval request command "${i??""}".`,t.json)}async function Va(e,t,n){let i=e[0]??"list";if(i==="list")return await R("/api/v1/me/workspaces",t,n,"Workspaces loaded.",{authenticated:!0});if(i==="create")return await K("/api/v1/workspaces",{name:e.slice(1).join(" "),kind:p(t.kind)},t,n,"Workspace created.");let r=v(e[1],`workspace ${i} requires a workspace id.`);if(i==="skills")return await R(`/api/v1/workspaces/${encodeURIComponent(r)}/skills`,t,n,"Workspace skills loaded.",{authenticated:!0});if(i==="deploy"){let s=v(e[2],"workspace deploy requires a skill slug."),o=await b(n,`/api/v1/workspaces/${encodeURIComponent(r)}/skills`,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x({skillSlug:s,dryRun:t.dryRun}))});return t.dryRun?or(o,"Workspace deployment preview ready.",t,n):h(o,"Workspace deployment requested.",t.json,n)}if(i==="remove"){let s=v(e[2],"workspace remove requires a skill slug.");return await pt(`/api/v1/workspaces/${encodeURIComponent(r)}/skills/${encodeURIComponent(s)}`,{method:"DELETE",headers:B(n.apiKey,n.authBlockedMessage)},t,n,"Workspace skill removed.")}if(i==="guide"){let s=v(e[2],"workspace guide requires a skill slug.");try{return await R(`/api/v1/workspaces/${encodeURIComponent(r)}/skills/${encodeURIComponent(s)}/install-guide`,t,n,"Workspace install guide loaded.",{authenticated:!0})}catch(o){if(o instanceof A&&o.status===404)return Da(r,s,t);throw o}}return k(`Unknown workspace command "${i}".`,t.json)}function Da(e,t,n){let i={status:"deployment_not_found",reasonCode:"workspace_deployment_not_found",workspaceId:e,skillSlug:t,nextAction:"workspace.deploy",nextStep:`Run \`skills-layer workspace deploy ${e} ${t}\` first, then run \`skills-layer workspace guide ${e} ${t}\` after the deployment exists.`};return C(i,`Workspace deployment not found for ${t}. Run \`skills-layer workspace deploy ${e} ${t}\` first.`,n.json,"workspace_deployment_not_found")}async function Ha(e,t,n){let i=v(e[0],"buy requires a skill slug."),r=Po(t);if(r.failure)return r.failure;let s=await b(n,"/api/v1/buy",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({skillSlug:i,paymentMethod:r.value})});if(s.status==="already_owned")return h(s,`You already own ${i}. Run \`skills-layer install ${i}\` to install or update it.`,t.json,n);if(t.json||s.status!=="checkout_required"||typeof s.checkoutUrl!="string"||typeof s.purchaseId!="string")return h(s,`Purchase flow started for ${i}.`,t.json,n);n.emitInfo(`Opening checkout for ${i}. Complete the payment in your browser, then come back here.`),await n.openUrl(s.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${s.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let l=await Rl(s.purchaseId,n);return H(l)?l:l.status!=="succeeded"&&l.status!=="refund_requested"?h({...s,purchaseStatus:l.status},`Checkout is still ${l.status} for ${i}. You can rerun install after payment reconciliation completes.`,t.json,n):(n.emitInfo("Payment confirmed. Continuing with install."),await fn([i],t,n))}async function za(e,t,n){let i=e[0]??"list";if(i==="list")return await R("/api/v1/purchases",t,n,"Purchases loaded.",{authenticated:!0});if(i==="spending")return await R("/api/v1/spending",t,n,"Spending loaded.",{authenticated:!0});let r=v(e[1],`purchases ${i} requires a purchase id.`);return i==="invoice"?await R(`/api/v1/purchases/${encodeURIComponent(r)}/invoice`,t,n,"Invoice loaded.",{authenticated:!0}):i==="refund-quote"?await R(`/api/v1/purchases/${encodeURIComponent(r)}/refund-quote`,t,n,"Refund quote loaded.",{authenticated:!0}):i==="refund"?await K(`/api/v1/purchases/${encodeURIComponent(r)}/refund`,q(t,["reason"]),t,n,"Refund requested."):k(`Unknown purchases command "${i}".`,t.json)}async function Wa(e,t,n){let i=e[0];if(i==="add"){let r=v(e[1],"library add requires a skill slug.");return await K("/api/v1/install",{skillSlug:r},t,n,"Skill added to library.")}return k(`Unknown library command "${i}".`,t.json)}async function Ja(e,t,n){let i=v(e[0],"export requires a skill slug."),r=new URLSearchParams,s=p(t.version);if(s&&!ar(s))return So("export",s,t);M(r,"version",s);let o=await b(n,`/api/v1/me/library/${encodeURIComponent(i)}/export${oe(r)}`,{headers:B(n.apiKey,n.authBlockedMessage)}),l=p(t.output);if(l){let c=await Xi({backend:n,exportResult:o,flags:t,skillSlug:i});if(H(c))return c;let u=J(n.cwd,l);await rn(u,c.bytes);let d={...o};return delete d.downloadUrl,h({...d,archiveSha256:c.archiveSha256,archiveSha256Meaning:"canonical_bundle_sha256",canonicalBundleSha256:c.archiveSha256,downloadedArchiveSha256:c.archiveBytesSha256,archiveHashFormat:c.archiveHashFormat,outputPath:u,downloaded:!0},`Exported ${i} to ${u}.`,t.json,n)}return h(o,l?`Exported ${i} to ${l}.`:"Export prepared.",t.json,n)}async function xi(e,t,n,i){let r=v(t[0],`${e==="add"?"add-review":"show-reviews"} requires a skill slug.`);return e==="show"?await R(`/api/v1/me/library/reviews?skillSlug=${encodeURIComponent(r)}`,n,i,"Reviews loaded.",{authenticated:!0}):await K(`/api/v1/me/library/${encodeURIComponent(r)}/review`,q(n,["rating","feedback"]),n,i,"Review added.")}async function $i(e,t,n,i){let r=v(t[0],`${e==="add"?"add-issue":"show-issues"} requires a skill slug.`);return e==="show"?await R(`/api/v1/me/library/${encodeURIComponent(r)}/issues`,n,i,"Issues loaded.",{authenticated:!0}):await K(`/api/v1/me/library/${encodeURIComponent(r)}/report-issue`,q(n,["issueType","message"]),n,i,"Issue reported.")}async function Ya(e,t,n){let i=e[0];if(i==="hook"){let r=e[1];return r==="install"?await Zt(t,n):r==="status"?await el(t,n):k(`Unknown guardian hook command "${r??""}".`,t.json)}if(i==="enable")return e[1]||t.skill?await Ot("enforce",e,t,n):await Zt(t,n);if(i==="disable")return await Ot("disabled",e,t,n);if(i==="enable-warnings-only")return await Ot("warning_only",e,t,n);if(i==="status")return await Qa(e,t,n);if(i==="exec")return await Za(e,t,n);if(i==="check"){let r=v(e[1]??t.skill,"guardian check requires a skill slug."),s=Ti(t,"check"),o=t.grantJson.map(y=>$n(y,"grant-json")),l=$c(t.cloudTrustLedger);if(l.status==="invalid")return k(l.message,t.json);let c=Qt(t.telemetryMode,l.policy==="off"?"local_only":"cloud_managed");if(c.status==="invalid")return k(c.message,t.json);let u=await ur({skillSlug:r,version:p(t.version),action:s,flags:t,backend:n,telemetryMode:c.mode});if(u.status!=="ok")return u.result;let d=u.context.installedPath,g=p(t.version)??u.context.version,f=x({skillSlug:r,version:g,action:s,authorizationGrants:o,path:d,guardianPreference:await wn(n,r),unmanagedPolicy:u.context.unmanagedPolicy,allowUnmanagedOnce:t.allowUnmanagedOnce,telemetryMode:c.mode,localPreflight:he(u.context)}),m=await b(n,"/api/v1/guardian/enforce",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(f)});return await Ne(n,{skillSlug:r,version:g,action:s,decisionStatus:ct(m),reasonCode:Xt(m),telemetryMode:c.mode,path:d}),h({...m,localPreflight:he(u.context)},"Guardian check complete.",t.json,n)}if(i==="incident"){let r=v(e[1]??t.skill,"guardian incident requires a skill slug."),s=v(t.version,"guardian incident requires --version."),o=Qt(t.telemetryMode,"cloud_managed");if(o.status==="invalid")return k(o.message,t.json);let l=p(t.path)??(await dr({skillSlug:r,flags:t,backend:n})).installedPath,c=Ti(t,"incident"),u=ft(t.evidenceJson,"evidence-json"),d=o.mode==="cloud_managed"&&!n.apiKey?"local_only":o.mode,g=x({skillSlug:r,version:s,action:c,evidence:u,path:l,telemetryMode:d,incident:!0,reason:p(t.reason)});if(d==="local_only"){if(!l)return k("guardian incident --telemetry-mode local_only requires --path <installed-skill-path>.",t.json);let w=await Li({backend:n,skillSlug:r,version:s,installedPath:l,action:c,reason:p(t.reason)??"Guardian local-only incident"});await Ne(n,{skillSlug:r,version:s,action:c,decisionStatus:"blocked",reasonCode:"incident_recorded",telemetryMode:d,path:l});let P=Ei(n,r);return await re(P,JSON.stringify({request:g,response:null,localResponse:w,savedAt:n.now()},null,2)),h({status:"written",skillSlug:r,version:s,telemetryMode:d,cloudTelemetry:n.apiKey?"not_requested":"login_required",localResponse:w,incidentStatePath:P,incidentPath:w.incidentPath},n.apiKey?"Guardian incident recorded locally.":"Guardian incident recorded locally. Log in to submit Cloud incident evidence.",t.json,n)}let f=await b(n,"/api/v1/guardian/enforce",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(g)}),m=l?await Li({backend:n,skillSlug:r,version:s,installedPath:l,action:c,reason:p(t.reason)??"Guardian Cloud-managed incident"}):null;await Ke(n.paths.incidentsDir,{recursive:!0});let y=Ei(n,r);return await re(y,JSON.stringify({request:g,response:f,localResponse:m,savedAt:n.now()},null,2)),await Ne(n,{skillSlug:r,version:s,action:c,decisionStatus:ct(f),reasonCode:Xt(f),telemetryMode:o.mode,path:l}),h({...f,telemetryMode:o.mode,localResponse:m,incidentPath:y},"Guardian incident recorded.",t.json,n)}return k(`Unknown guardian command "${i??""}".`,t.json)}async function Za(e,t,n){let i=p(t.skill),r=v(i??e[1],"guardian exec requires a skill slug."),s=i?e.slice(1):e.slice(2);if(s.length===0)return k("guardian exec requires a command after --.",t.json);let o=Qt(t.telemetryMode,"cloud_managed");if(o.status==="invalid")return k(o.message,t.json);let l=ll(t,s),c=await ur({skillSlug:r,version:p(t.version),action:l,flags:t,backend:n,telemetryMode:o.mode});if(c.status!=="ok")return c.result;let u=c.context.installedPath,d=p(t.version)??c.context.version,g=x({skillSlug:r,version:d,action:l,authorizationGrants:t.grantJson.map(P=>$n(P,"grant-json")),path:u,guardianPreference:await wn(n,r),telemetryMode:o.mode,localPreflight:he(c.context)}),f=await b(n,"/api/v1/guardian/enforce",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(g)}),m=ct(f),y=Xt(f);if(await Ne(n,{skillSlug:r,version:d,action:l,decisionStatus:m,reasonCode:y,telemetryMode:o.mode,path:u}),!cl(f))return C({status:"blocked",reasonCode:y,skillSlug:r,guardian:f,localPreflight:he(c.context),command:{executable:G(s[0]??""),executed:!1}},"Guardian blocked guarded execution.",t.json,y);if(t.dryRun)return h({status:"allowed",skillSlug:r,guardian:f,localPreflight:he(c.context),command:{executable:G(s[0]??""),executed:!1,dryRun:!0}},"Guardian guarded execution allowed.",t.json,n);let w=await ul(s,n);return{exitCode:w.exitCode,stdout:t.json?JSON.stringify({status:w.exitCode===0?"executed":"command_failed",summary:"Guardian guarded execution complete.",why:null,nextAction:null,nextStep:null,data:{skillSlug:r,guardian:f,localPreflight:he(c.context),command:w},warnings:[],links:[],reasonCode:w.exitCode===0?null:"command_failed",handoff:null},null,2):dl(w),stderr:w.stderr}}async function Ot(e,t,n,i){let r=v(t[1]??n.skill,`guardian ${t[0]??"mode"} requires a skill slug.`),s=await b(i,"/api/v1/guardian/mode",{method:"POST",headers:j(i.apiKey),body:JSON.stringify({skillSlug:r,requestedPreference:e,source:"public-cli"})});return s.preferenceAccepted===!0&&await pl(i,r,s),h(s,s.preferenceAccepted===!0?"Guardian mode updated.":"Guardian mode resolved by policy.",n.json,i)}async function Qa(e,t,n){let i=p(t.skill)??p(e[1]),r=await lr(n,i),s=await De(n),o=i?await gl(n,i):void 0,c=a(s,"enforcementLayer")!=="not_installed"&&!!s.strictPreActionBlocking?{status:"installed",reasonCode:"guardian_hook_installed",strictPreActionBlocking:!0,nextAction:"guardian.check",nextStep:"Cloud Guardian policy is enforced when checked, and the local host hook can block supported risky actions before execution."}:{status:"not_installed",reasonCode:"guardian_hook_not_installed",strictPreActionBlocking:!1,nextAction:"guardian.hook.install",nextStep:"Cloud Guardian policy is enforced when checked, but local pre-action blocking is not installed for this host. Run `skills-layer guardian hook install --agent codex --scope global` or `skills-layer setup`."};return h(x({status:"ok",skillSlug:a(r,"skillSlug")??i,policy:r,localPreference:o,hook:s,cloudPolicy:{status:a(r,"effectiveMode")??a(r,"status")??"unknown",reasonCode:a(r,"reasonCode"),enforcementBoundary:"cloud_policy_when_checked",nextAction:a(r,"nextAction"),nextStep:a(r,"nextStep")},localEnforcement:c,nextAction:a(c,"nextAction"),nextStep:a(c,"nextStep")}),"Guardian status loaded.",t.json,n)}async function lr(e,t){let n=t?await wn(e,t):void 0;return await b(e,"/api/v1/guardian/status",{method:"POST",headers:j(e.apiKey),body:JSON.stringify(x({skillSlug:t,requestedPreference:n,source:"public-cli"}))})}async function Xa(e){if(!e.apiKey)return{status:"unknown",policySource:"cloud",reasonCode:"login_required",nextAction:"skills-layer login",nextStep:"Sign in to read the Cloud Guardian policy that applies to your account."};try{return await lr(e)}catch(t){return{status:"unavailable",policySource:"cloud",reasonCode:"guardian_policy_status_unavailable",message:ae(t),nextAction:"skills-layer guardian status",nextStep:"Retry Guardian status after backend connectivity or authentication is healthy."}}}async function Zt(e,t){let n=p(e.agent)??"codex",i=gr(e.scope);if(i.status==="invalid")return k(i.message,e.json);let r=ge(t.env,t.platform,t.cwd).find(g=>g.id===n);if(!r)return k(`Unsupported Guardian agent "${n}". Run skills-layer agents list to see supported agents.`,e.json);let s=ml(r,i.scope,t);if(!s)return k(`Guardian ${i.scope} hooks are not available for ${r.displayName}.`,e.json);await fl(s,t);let o=hr(t,i.scope),l=Ui(Me(t.cwd,s.hookPath)),c=Ui(Me(t.cwd,s.configPath)),d=[...(await yr(o)).hooks.filter(g=>a(g,"agent")!==r.id||a(g,"scope")!==i.scope),{hookId:de,hookName:te,agent:r.id,agentName:r.displayName,scope:i.scope,hookPath:l.startsWith("..")?s.hookPath:l,configPath:c.startsWith("..")?s.configPath:c,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,enabledAt:t.now()}];return await D(o,{version:1,hooks:d}),h({status:"enabled",hookId:de,hookName:te,agent:r.id,agentName:r.displayName,scope:i.scope,hookPath:s.hookPath,configPath:s.configPath,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,agentCommandMatrix:jt({purpose:"materialize_skill",command:"skills-layer install <skill-slug>",jsonCommand:"skills-layer install <skill-slug> --json"}),nextStep:"Guardian is installed into the selected host configuration. Local hooks call `skills-layer guardian check`; shell agents can route risky commands through `skills-layer guardian exec`; MCP-capable agents can call `guardian.check` or `guardian.enforce` before risky tool use.",warnings:s.enforcementLayer==="native_hook_candidate"?["This host does not expose the same stable native hook contract as Codex or Claude Code yet; Skills Layer records the guardrail config for host integration."]:[]},"Guardian hook enabled.",e.json,t)}async function el(e,t){let n=p(e.scope),i=n?gr(n):null;if(i?.status==="invalid")return k(i.message,e.json);let r=await De(t,i?.status==="valid"?i.scope:void 0);return h(r,"Guardian status loaded.",e.json,t)}async function De(e,t){let n=t?[t]:["project","global"],i=[];for(let l of n){let c=hr(e,l),u=await yr(c);for(let d of u.hooks){let g=a(d,"hookPath"),f=g?Ai(e,l,g):null,m=a(d,"configPath"),y=m?Ai(e,l,m):null,w=f?await me(f):!1,P=y?await me(y):null,_=w?P===!1?"active_missing_config":"active":"stale_missing_hook";i.push({hookId:a(d,"hookId")??de,hookName:a(d,"hookName")??te,...d,scope:a(d,"scope")??l,hookPath:f??g??null,configPath:y??m??null,active:w,configActive:P,hookState:_})}}let r=i.filter(l=>l.active===!0).length,s=i.filter(l=>l.active===!1).length,o=r>0?0:s;return{status:"ok",enforcementLayer:r>0?"native_hook":"not_installed",strictPreActionBlocking:i.some(l=>l.active===!0&&l.strictPreActionBlocking===!0),activeHookCount:r,missingHookCount:o,staleHookCount:s,hooks:i,setup:await vn(e),warnings:s>0?r>0?["One or more stale Guardian hook records were found, but an active Skills Layer Security Hook is installed."]:["One or more configured Guardian hooks are missing from disk. Run skills-layer guardian hook install --agent <agent> again to repair them."]:[]}}async function cr(e,t){if(e.json){let u=await Y(t.paths.mcpConfigPath);return h({setup:await vn(t),mcp:{status:u?"mcp_configured":"mcp_not_configured",configured:!!u,clientId:u?a(u,"clientId")??"codex":void 0,clientIds:u&&Array.isArray(u.clientIds)?u.clientIds:void 0,mcpUrl:u?a(u,"mcpUrl"):void 0,readiness:u?{status:"configured_needs_agent_reload",verifyCommand:`skills-layer mcp verify --client ${a(u,"clientId")??"codex"}`,nextStep:"Open a fresh agent session if Skills Layer tools are not visible yet."}:void 0,nextCommand:u?"skills-layer mcp verify":"skills-layer mcp setup"},guardian:await De(t)},"Setup status loaded.",!0,t)}if(!t.stdoutIsTty)return h({status:"setup_needs_terminal",mcp:{nextCommand:"skills-layer mcp setup"},security:{nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Setup needs an interactive terminal. Run `skills-layer setup`, or use `skills-layer mcp setup` and `skills-layer guardian hook install --agent codex --scope project`.",!1,t);let n=await t.promptSelect("Set up Skills Layer on this machine?",[{value:"mcp",label:"Setup Skills-Layer MCP",description:"Configure Skills Layer MCP for AI tools"},{value:"security",label:"Setup Skills-Layer Security Guardian",description:"Install Guardian hooks for this workspace"},{value:"both",label:"Setup both - MCP & Security Guardian",description:"Connect supported AI tools and install Guardian hooks"},{value:"not_now",label:"Remind me Later",description:"Skip setup for now; you can run skills-layer setup later"}]);if(n==="not_now"){let u={version:1,setupChoice:"not_now",mcpChoice:"not_now",mcpPromptedAt:t.now(),guardianHookChoice:"not_now",guardianHookPromptedAt:t.now(),remindAfter:il(t.now(),7)};return await ji(t,u),h({status:"setup_skipped",mcp:{status:"not_configured",nextCommand:"skills-layer mcp setup"},security:{status:"not_configured",nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Skills Layer setup skipped for now. Run `skills-layer setup` when you want MCP and Security hooks on this machine.",!1,t)}if(n!=="both"&&n!=="mcp"&&n!=="security")return k(`Unknown setup option "${n}".`,e.json);let i=n==="both"||n==="mcp",r=n==="both"||n==="security",s={status:"setup_complete",setupChoice:n},o={version:1,setupChoice:n,mcpChoice:i?"configured":"not_requested",mcpPromptedAt:t.now(),guardianHookChoice:r?p(e.scope)??"project":"not_requested",guardianHookPromptedAt:t.now()};if(i)if(!t.apiKey)s.mcp={status:"login_required",configured:!1,nextCommand:"skills-layer login"},o.mcpChoice="login_required";else{let u=await mn(e,t);if(H(u))return u;s.mcp=u}if(r){let u={...e,json:!0,scope:p(e.scope)??"project",agent:p(e.agent)??"codex"},d=await Zt(u,t);if(d.exitCode!==0)return d;s.security=Sl(d.stdout)??{status:"enabled",agent:p(u.agent),scope:p(u.scope)}}await ji(t,o);let c=($(s.mcp)?a(s.mcp,"status"):void 0)==="login_required"?"Skills Layer Security setup complete. MCP setup needs login; run `skills-layer login`, then `skills-layer setup`.":"Skills Layer setup complete. Open a fresh agent session if MCP tools are not visible yet.";return h(s,c,e.json,t)}async function tl(e,t){let n=await De(t),i=await vn(t),r=F(n,"activeHookCount")??0;if(t.stdoutIsTty&&r===0&&!i)return await cr(e,t);let s=r>0?"Guardian host hooks are already configured. Run `skills-layer guardian hook status` to inspect them.":"Guardian is enabled for Skills Layer runtime checks. Run `skills-layer setup` when you want MCP and Security hooks on this machine.";return{exitCode:0,stdout:`${Te}
|
|
1044
|
-
|
|
1045
|
-
${s}`,stderr:""}}function
|
|
1046
|
-
[output truncated]`:e}function
|
|
1047
|
-
`)}function
|
|
1234
|
+
skills-layer api-key revoke --key-id <key-id>`,t.json,"missing_required_argument");let s=String(r);if(t.dryRun){let a=await Gi(s,n);return a?h(x({status:"pass",wouldRevoke:!0,keyId:s,keyPrefix:l(a,"keyPrefix"),type:l(a,"type"),name:l(a,"name"),scopes:se(a,"scopes")??[],revokedAt:a.revokedAt??null,nextAction:"api-key.revoke",nextStep:`Run \`skills-layer api-key revoke --key-id ${s} --yes\` to revoke this key.`}),"API key revoke dry run passed.",t.json,n):Vi(s,t)}if(!t.confirmed){let a=await Gi(s,n);if(!a)return Vi(s,t);let c=x({status:"confirmation_required",reasonCode:"confirmation_required",keyId:s,keyPrefix:l(a,"keyPrefix"),type:l(a,"type"),name:l(a,"name"),nextAction:"api-key.revoke",nextStep:`Re-run with \`skills-layer api-key revoke --key-id ${s} --yes\` after confirming this is the key to revoke.`});if(t.json||!n.stdoutIsTty)return w(c,"API key revoke needs confirmation. Re-run with --yes after checking the key id.",t.json,"confirmation_required");if(await n.promptSelect(`Revoke API key ${s}?`,[{value:"cancel",label:"Cancel",description:"Leave this API key active"},{value:"confirm",label:"Revoke",description:"Permanently revoke this API key"}])!=="confirm")return h({status:"canceled",keyId:s},"API key revoke canceled.",t.json,n)}let o=await S(n,`/api/v1/me/api-keys/${encodeURIComponent(s)}/revoke`,{method:"POST",headers:T(n.apiKey,n.authBlockedMessage)});return h(o,"API key revoked.",t.json,n)}return k(`Unknown api-key command "${i}".`,t.json)}function pa(e){let t=p(e.type);if(t&&!Zi.includes(t))return{failure:Pe("api-key.list","type",t,Zi,e,"invalid_api_key_filter","type")};let n=p(e.status)??"active";if(!Qi.includes(n))return{failure:Pe("api-key.list","status",n,Qi,e,"invalid_api_key_filter","status")};let i=p(e.sort)??"created-desc";if(!Xi.includes(i))return{failure:Pe("api-key.list","sort",i,Xi,e,"invalid_api_key_filter","sort")};let r=[["createdAfter","created-after",e.createdAfter],["createdBefore","created-before",e.createdBefore],["expiresAfter","expires-after",e.expiresAfter],["expiresBefore","expires-before",e.expiresBefore]],s={status:n,sort:i};for(let[o,a,c]of r){let u=p(c);if(u){if(Number.isNaN(Date.parse(u)))return{failure:w({status:"error",reasonCode:"invalid_api_key_filter",field:a,value:u,nextAction:"api-key.list",nextStep:`Use --${a} with an ISO date or timestamp.`},`Invalid api-key list --${a} "${u}". Use an ISO date or timestamp.`,e.json,"invalid_api_key_filter")};s[o]=u}}return{filters:x({...s,...t?{type:t}:{},...p(e.name)?{name:p(e.name)}:{}})}}function hn(e){return(fe(e,"results")??[]).filter(t=>R(t))}function ga(e,t){let n=t.name?.toLowerCase();return e.filter(i=>!t.type||l(i,"type")===t.type).filter(i=>t.status==="all"||Mr(i)===t.status).filter(i=>!n||(l(i,"name")??l(i,"id")??"").toLowerCase().includes(n)).filter(i=>mt(i,"createdAt",t.createdAfter,"after")).filter(i=>mt(i,"createdAt",t.createdBefore,"before")).filter(i=>mt(i,"expiresAt",t.expiresAfter,"after")).filter(i=>mt(i,"expiresAt",t.expiresBefore,"before")).sort((i,r)=>ma(i,r,t.sort))}function Mr(e,t=Date.now()){if(e.revokedAt!==null&&e.revokedAt!==void 0)return"revoked";let n=l(e,"expiresAt");if(!n)return"active";let i=Date.parse(n);return Number.isNaN(i)||i>t?"active":"expired"}function mt(e,t,n,i){if(!n)return!0;let r=l(e,t);if(!r)return!1;let s=Date.parse(r),o=Date.parse(n);return Number.isNaN(s)||Number.isNaN(o)?!1:i==="after"?s>=o:s<=o}function ma(e,t,n){if(n==="name-asc"||n==="name-desc")return(n==="name-asc"?1:-1)*(l(e,"name")??l(e,"id")??"").localeCompare(l(t,"name")??l(t,"id")??"");let i=n.endsWith("-asc")?1:-1,r=n.startsWith("expires-")?"expiresAt":n.startsWith("last-used-")?"lastUsedAt":"createdAt";return i*(Di(e,r)-Di(t,r))}function Di(e,t){let n=l(e,t);if(!n)return 0;let i=Date.parse(n);return Number.isNaN(i)?0:i}function fa(e,t){if(!e)return;let n=/^(\d+)d$/iu.exec(e.trim());if(!n)return;let i=Date.parse(t),r=Number.isNaN(i)?Date.now():i;return new Date(r+Number.parseInt(n[1],10)*24*60*60*1e3).toISOString()}async function Gi(e,t){let n=await S(t,"/api/v1/me/api-keys",{headers:T(t.apiKey,t.authBlockedMessage)});return hn(n).find(i=>l(i,"id")===e)}function Vi(e,t){return w({status:"not_found",reasonCode:"api_key_not_found",keyId:e,nextAction:"api-key.list",nextStep:"Run `skills-layer api-key list` to find an active key id, then retry revoke."},`API key ${e} was not found.`,t.json,"api_key_not_found")}async function ha(e,t,n){let i=e[0]??"status";if(i==="setup"||i==="repair"){let r=p(t.client)??p(t.agent);if(r&&t.all)return w({status:"error",reasonCode:"conflicting_mcp_client_selection",client:r,all:!0,nextAction:`mcp.${i}`,nextStep:"Use either --client <agent-id> for one agent or --all for every detected MCP-capable agent."},`mcp ${i} cannot use --client and --all together.`,t.json,"conflicting_mcp_client_selection");if(r&&!Ye(r))return nn(r,t);if(r){let o=await D(n.paths.mcpConfigPath),a=o?l(o,"baseUrl")??n.baseUrl:n.baseUrl,c=await De({baseUrl:a,mcpUrl:o?l(o,"mcpUrl")??`${a}/mcp`:`${a}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:o?l(o,"environment")??ae(a):ae(a),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:o});if(c.target.status==="skills_only"){let u=ft(c);return h(u,`${c.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}}let s=await Fn(t,n);return J(s)?s:h({...s},`MCP configuration written for ${s.clientId}. Open a fresh agent session to load Skills Layer tools, then run \`skills-layer mcp verify --client ${s.clientId}\` if they are not visible.`,t.json,n)}if(i==="status"||i==="verify"){let r=p(t.client)??p(t.agent);if(r&&!Ye(r))return nn(r,t);let s=await D(n.paths.mcpConfigPath);if(!s){if(r){let u=await De({baseUrl:n.baseUrl,mcpUrl:`${n.baseUrl}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:ae(n.baseUrl),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:null});if(u.target.status==="skills_only"){let d=ft(u);return h(d,`${u.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}}return h({status:"mcp_not_configured",configured:!1,nextCommand:"skills-layer mcp setup"},"MCP is not configured on this machine.",t.json,n)}let o=r??l(s,"clientId")??"codex",a=l(s,"baseUrl")??n.baseUrl,c=await De({baseUrl:a,mcpUrl:l(s,"mcpUrl")??`${a}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:o,environment:l(s,"environment")??ae(a),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:s});if(c.target.status==="skills_only"){let u=ft(c);return h(u,`${c.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}if(i==="verify"&&c.configured){let u=await di({nodePath:process.execPath,bridgePath:c.bridge.path}),d={...c,verified:u.status==="ok",liveProbe:u};return u.status!=="ok"?w(d,`MCP config exists for ${c.clientId}, but live bridge verification failed: ${u.message}`,t.json,u.reasonCode??void 0):h(d,`MCP verified for ${c.clientId}. ${u.message} Open a fresh agent session or restart the agent if tools are not visible yet.`,t.json,n)}return h(c,c.configured?`MCP configuration is present for ${c.clientId}. Open a fresh agent session if tools are not visible, or run \`skills-layer mcp verify --client ${c.clientId}\` for a live check.`:`MCP needs repair for ${c.clientId}. Run \`${c.nextCommand}\`.`,t.json,n)}if(i==="disconnect"||i==="logout"){let r=p(t.client)??p(t.agent)??"codex";if(!Ye(r))return nn(r,t);let s=await D(n.paths.mcpConfigPath),o=s?l(s,"baseUrl")??n.baseUrl:n.baseUrl,a=await De({baseUrl:o,mcpUrl:s?l(s,"mcpUrl")??`${o}/mcp`:`${o}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:s?l(s,"environment")??ae(o):ae(o),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:s});if(a.target.status==="skills_only"){let d=ft(a);return h(d,`${a.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}let c=Ke({baseUrl:n.baseUrl,mcpUrl:`${n.baseUrl}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:ae(n.baseUrl),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath}),u=c.targets.find(d=>d.agentId===r);return await wa(s,n),await u?.disconnect?.(),await gi(c.bridgePath),await mi(c.brokerPath,c.brokerSocketPath),await An(n.paths.mcpConfigPath,{force:!0}),h({status:"mcp_disconnected",configured:!1,clientId:r},"MCP disconnected on this machine.",t.json,n)}return k(`Unknown mcp command "${i}". Use setup, status, verify, repair, or disconnect.`,t.json)}function Ye(e){return ve.includes(e)}function nn(e,t){return w({status:"error",reasonCode:"unknown_mcp_client",requestedClient:e,nextAction:"mcp.status",nextStep:"Run `skills-layer agents list` to see supported client ids."},`Unknown MCP client "${e}". Run \`skills-layer agents list\` to see supported client ids.`,t.json,"unknown_mcp_client")}function ft(e){let t=e.target.instructions,n=Array.isArray(t)&&typeof t[0]=="string"?t[0]:`Install skills with \`skills-layer install <skill> --agent ${e.clientId}\`.`;return{...e,status:"skills_only",configured:!1,nextCommand:null,nextAction:"install.skills",nextStep:n}}async function Fn(e,t){let n=p(e.environment)??ae(t.baseUrl),i=["mcp:use","catalog:read","library:read","guardian:check","guardian:incident","creator:read"],r=`${t.baseUrl}/mcp`,s=Ke({baseUrl:t.baseUrl,mcpUrl:r,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:"codex",environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),o=await ya(e,t,s),a=o.clientIds[0]??"codex",c=Ke({baseUrl:t.baseUrl,mcpUrl:r,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:a,environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),u={},d=null;for(let m of o.clientIds){let y=await S(t,"/api/v1/me/mcp-tokens",{method:"POST",headers:j(t.apiKey),body:JSON.stringify({clientId:m,environment:n,scopes:i})}),v=l(y,"apiKey");if(!v)return k("MCP setup did not receive a token from the backend.",e.json);let C=await ka(t,{token:v,clientId:m,environment:n});u[m]={clientId:m,environment:n,...C,tokenPrefix:l(y,"keyPrefix")??null,scopes:Array.isArray(y.scopes)?y.scopes:[],savedAt:t.now()},d??=y}let g=u[a]??{};await W(t.paths.mcpConfigPath,{version:1,baseUrl:t.baseUrl,mcpUrl:r,clientId:a,clientIds:o.clientIds,environment:n,selectionSource:o.selectionSource,detectedClientIds:o.detectedClientIds,...g,tokens:u,brokerPath:c.brokerPath,brokerSocketPath:c.brokerSocketPath,savedAt:t.now()});let f=c.targets.filter(m=>m.status==="automatic"&&o.clientIds.includes(m.agentId));for(let m of f)await m.apply?.();return{...G(d??{}),status:"mcp_configured",clientId:a,clientIds:o.clientIds,selectionSource:o.selectionSource,detectedClientIds:o.detectedClientIds,environment:n,mcpUrl:r,bridgePath:c.bridgePath,brokerPath:c.brokerPath,brokerSocketPath:c.brokerSocketPath,nodePath:c.nodePath,bridgeChecksum:c.bridgeChecksum,brokerChecksum:c.brokerChecksum,saved:!0,readiness:{status:"configured_needs_agent_reload",verifyCommand:`skills-layer mcp verify --client ${a}`,nextStep:"Open a fresh agent session so the host can load the updated MCP configuration. Run verify or repair if Skills Layer tools are still not visible."},registrations:{status:"mcp_registration_plan",automaticCount:c.automaticCount,manualCount:c.manualCount,skillsOnlyCount:c.skillsOnlyCount,unsupportedCount:c.unsupportedCount,appliedCount:f.length,appliedClients:f.map(m=>m.agentId),targets:c.targets.map(m=>({agentId:m.agentId,displayName:m.displayName,tier:m.tier,status:m.status,transport:m.transport,configPath:m.configPath,bridgePath:m.bridgePath,restartRequired:m.restartRequired,reason:m.reason,instructions:m.instructions}))}}}async function ya(e,t,n){let i=p(e.client)??p(e.agent),r=n.targets.filter(c=>c.status==="automatic").map(c=>c.agentId);if(i)return{clientIds:[i],detectedClientIds:[],selectionSource:"explicit"};if(e.all)return{clientIds:r,detectedClientIds:r,selectionSource:"all"};let s=await ti({env:t.env,platform:t.platform,cwd:t.cwd,pathExists:ce}),o=new Set(r),a=s.map(c=>c.id).filter(c=>o.has(c));return a.length>0?{clientIds:a,detectedClientIds:a,selectionSource:"detected"}:{clientIds:["codex"],detectedClientIds:[],selectionSource:"fallback"}}async function ka(e,t){if(!e.credentialStore)return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"};let n=ba({baseUrl:e.baseUrl,userId:e.config?.userId,email:e.config?.email,clientId:t.clientId,environment:t.environment});try{return await e.credentialStore.set(Ve,n,t.token),{tokenRef:n,credentialStorage:"macos_keychain",credentialService:Ve,tokenStorage:"macos_keychain"}}catch{return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"}}}async function wa(e,t){if(!e||!t.credentialStore)return;let n=va(e,Ve);for(let i of n)await t.credentialStore.delete(i.service,i.tokenRef)}function va(e,t){let n=new Map;Hi(e,t,n);let i=e.tokens;if(R(i))for(let r of Object.values(i))R(r)&&Hi(r,t,n);return[...n.values()]}function Hi(e,t,n){let i=l(e,"tokenRef");if(!i||l(e,"credentialStorage")!=="macos_keychain")return;let r=l(e,"credentialService")??t;n.set(`${r}:${i}`,{service:r,tokenRef:i})}function ba(e){let t=[e.baseUrl,e.userId??e.email??"unknown-user",e.clientId,e.environment,"mcpToken"].join(`
|
|
1235
|
+
`);return`skills-layer-cli:mcp-token:${$n("sha256").update(t).digest("base64url").slice(0,32)}`}async function yn(e,t){if(e.noMcp)return{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."};let n=await D(t.paths.mcpConfigPath),i=n?l(n,"baseUrl"):void 0,r=n?l(n,"clientId")??"codex":"codex";if(!e.withMcp&&i===t.baseUrl&&r)return{data:{status:"mcp_already_configured",configured:!0,clientId:r,mcpUrl:n?l(n,"mcpUrl")??`${t.baseUrl}/mcp`:`${t.baseUrl}/mcp`},message:"MCP is already configured for this machine."};if(!e.withMcp&&!e.json){let a=await D(t.paths.mcpPreferencePath),c=a?l(a,"baseUrl"):void 0,u=a?l(a,"clientId")??"codex":void 0;if((a?l(a,"choice"):void 0)==="not_now"&&c===t.baseUrl&&u==="codex")return{data:{status:"mcp_skipped_previously",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup was skipped previously. Run `skills-layer mcp setup` when you want AI-tool access."}}let s=e.withMcp===!0;if(!s&&!e.json)try{let a=await t.promptSelect("Set up Skills Layer MCP for your AI tools on this machine?",[{value:"yes",label:"Yes, set up MCP",description:"Mint a scoped token and write local MCP configuration"},{value:"no",label:"Not now",description:"You can run skills-layer mcp setup later"}]);if(s=a==="yes",a==="no")return await W(t.paths.mcpPreferencePath,{version:1,choice:"not_now",baseUrl:t.baseUrl,clientId:"codex",savedAt:t.now()}),{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."}}catch{return{}}if(!s)return{};let o=await Fn(e,t);return J(o)?o:{data:o,message:"MCP configuration written for this machine. Open a fresh agent session so your AI tools can load it."}}async function Sa(e,t,n){let i=e.join(" ").trim()||p(t.search)||"",r=new URLSearchParams;i&&r.set("query",i);let s=p(t.runtimeRisk);if(s&&!zi.includes(s))return yt("runtime-risk",s,zi,t);let o=p(t.agent);if(o&&!Ye(o))return w({status:"error",reasonCode:"unknown_agent",filter:"agent",value:o,acceptedValues:ve,nextAction:"search",nextStep:"Use --agent with a supported Skills Layer agent id."},`Unknown search --agent "${o}". Run \`skills-layer agents list\` to inspect supported agents.`,t.json,"unknown_agent");let a=p(t.trust);if(a&&!Wi.includes(a))return yt("trust",a,Wi,t);let c=p(t.securityCapability),u=Fa(c);if(c&&!u)return yt("security-capability",c,qr,t);let d=p(t.limit);if(d){let f=Number(d);if(!Number.isInteger(f)||f<1||f>100)return yt("limit",d,["1-100"],t);r.set("limit",String(f))}M(r,"agent",t.agent),M(r,"capability",t.capability),M(r,"trust",a),M(r,"runtime-risk",s),M(r,"security-capability",u);let g=await S(n,`/api/v1/search${ue(r)}`);if(t.install!==void 0){let f=p(t.install);if(!f){if(t.json)return k("search --install requires an explicit skill slug in the public CLI package.",!0);let y=rt(g);if(y.length===0)return k("Search results do not include any installable skills. Run search again with a broader query.",!1);if(y.length===1)f=y[0].value;else try{f=await n.promptSelect("Select a search result to install:",y)}catch{return k("No search result was selected for install.",!1)}}let m=nd(g);return m.includes(f)?await qn([f],t,n):k(m.length===0?`Search results do not include "${f}". Run search again with a matching query first.`:`Search results do not include "${f}". Run search again with a matching query or choose one of: ${m.join(", ")}.`,t.json)}return h(g,"Search complete.",t.json,n)}var zi=["low","elevated","high"],Wi=["high","medium","low","published","published_with_findings","publishable","publishable_with_findings","blocked","unknown"],qr=["filesystem_read","filesystem_write","network_access","api_access","browser_access","device_control","generated_code_execution","secret_handling","model_context","shell_access"],Pa={network:"network_access",filesystem:"filesystem_read",files:"filesystem_read",file_read:"filesystem_read",file_write:"filesystem_write",shell:"shell_access",browser:"browser_access",device:"device_control",api:"api_access",secrets:"secret_handling",model:"model_context"},rn=["local","project","global","workspace"],Ze=["private","public","unlisted"],Ie=["private","public","unlisted"],Ji=["github","gitlab","local","generic_git","domain"],Ca=["owner","maintainer"],_a=["submitted","published","draft","pending_review","suspended","blocked","archived","unlisted"],xa=["open","acknowledged","fixed","closed","rejected","abusive","reopened","resolved"],Ra=["visible","flagged","hidden"],$a=["bug","quality","safety","other"],Aa=["approved","denied"],Ia=["email","google","github","gitlab","microsoft"],ja=["email","google","github","gitlab","microsoft"],Yi=["catalog:read","library:read","creator:read","creator:submit","guardian:check","guardian:incident","workspace:read","workspace:write","workspace:deploy","mcp:use"],Zi=["automation","mcp","agent"],Qi=["active","expired","revoked","all"],Xi=["created-desc","created-asc","expires-desc","expires-asc","name-asc","name-desc","last-used-desc","last-used-asc"],er=10,Ea=["personal","shared","team"],Or=["json","sarif"],ht=["featured","trending","newest","name","relevance"],La=/^(?:card(?:_[A-Za-z0-9]+)*|pm_[A-Za-z0-9_]+)$/u,Ua=/^[a-z0-9]+(?:-[a-z0-9]+)*$/u,Ta=/^[a-f0-9]{6,64}$/iu,Na=new Set(["http:","https:"]);function Kr(e,t,n,i){let r=p(t);if(!r)return{};if(!/^\d+$/u.test(r))return{failure:w({status:"error",reasonCode:"invalid_limit",command:e,value:r,acceptedRange:`1-${n}`,nextAction:e,nextStep:`Use --limit with a whole number from 1 to ${n}.`},`${e} --limit must be a whole number from 1 to ${n}.`,i.json,"invalid_limit")};let s=Number.parseInt(r,10);return!Number.isInteger(s)||s<1||s>n?{failure:w({status:"error",reasonCode:"invalid_limit",command:e,value:r,acceptedRange:`1-${n}`,nextAction:e,nextStep:`Use --limit with a whole number from 1 to ${n}.`},`${e} --limit must be between 1 and ${n}.`,i.json,"invalid_limit")}:{value:String(s)}}function yt(e,t,n,i){return w({status:"error",reasonCode:"invalid_search_filter",filter:e,value:t,acceptedValues:n,nextAction:"search",nextStep:e==="runtime-risk"?"Use --runtime-risk low, elevated, or high.":e==="limit"?"Use --limit with a whole number from 1 to 100.":`Use --${e} with one of: ${n.join(", ")}.`},e==="runtime-risk"?`Invalid runtime risk "${t}". Use one of: ${n.join(", ")}.`:e==="limit"?`Invalid search limit "${t}". Use a whole number from 1 to 100.`:`Invalid search --${e} "${t}". Use one of: ${n.join(", ")}.`,i.json,"invalid_search_filter")}function Fa(e){if(e)return qr.includes(e)?e:Pa[e]}function Pe(e,t,n,i,r,s,o=t){return w({status:"error",reasonCode:s,[t]:n,acceptedValues:i,nextAction:e,nextStep:`Use --${o} with one of: ${i.join(", ")}.`},`Invalid ${e} --${o} "${n}". Use one of: ${i.join(", ")}.`,r.json,s)}function re(e,t,n,i,r,s,o=t){let a=p(n);if(!(!a||i.includes(a)))return Pe(e,t,a,i,r,s,o)}function we(e,t){let n=p(t.version);return n&&!At(n)?Mn(e,n,t):void 0}function Ba(e,t,n){return w({status:"error",reasonCode:"invalid_slug",value:t,acceptedFormat:"lowercase words separated by hyphens",nextAction:e,nextStep:"Use a lowercase skill slug such as project-planner or year9-history-study-guide."},`Invalid skill slug "${t}". Use lowercase letters, numbers, and single hyphens.`,n.json,"invalid_slug")}function Dr(e,t,n){return t&&!Ua.test(t)?Ba(e,t,n):void 0}function Ma(e,t,n){return w({status:"error",reasonCode:"invalid_format",format:t,acceptedValues:Or,nextAction:e,nextStep:"Use --format json or --format sarif."},`Invalid ${e} --format "${t}". Use json or sarif.`,n.json,"invalid_format")}function Gr(e,t){let n=p(t.format);return n&&!Or.includes(n.toLowerCase())?Ma(e,n,t):void 0}function qa(e,t,n){return w({status:"error",reasonCode:"invalid_commit_sha",commitSha:t,nextAction:e,nextStep:"Use --commit-sha with a 6 to 64 character hexadecimal commit SHA."},`Invalid --commit-sha "${t}". Use a hexadecimal commit SHA.`,n.json,"invalid_commit_sha")}function Oa(e,t){let n=p(t.commitSha);return n&&!Ta.test(n)?qa(e,n,t):void 0}function tr(e,t){return w({status:"error",reasonCode:"invalid_base_url",baseUrl:e,nextAction:"backend",nextStep:"Use --base-url with an http or https URL, for example https://api.skills-layer.com."},`Invalid backend base URL "${e}". Use an http or https URL.`,t.json,"invalid_base_url")}function Ka(e,t){try{let n=new URL(e);return!Na.has(n.protocol)||!n.hostname?tr(e,t):void 0}catch{return tr(e,t)}}function nr(e,t,n){return w({status:"error",reasonCode:"unexpected_argument",command:e,argument:t,nextAction:e,nextStep:`Run \`skills-layer ${e} --help\` to see supported arguments for this command.`},`Unexpected argument "${t}" for ${e}.`,n.json,"unexpected_argument")}function Bn(e,t){let n=p(t.scope);if(n&&!rn.includes(n))return{failure:w({status:"error",reasonCode:"invalid_install_filter",filter:"scope",value:n,acceptedValues:rn,nextAction:e,nextStep:"Use --scope local, project, global, or workspace."},`Invalid ${e} --scope "${n}". Use one of: ${rn.join(", ")}.`,t.json,"invalid_install_filter")};let i=p(t.agent);return i&&!Ye(i)?{failure:w({status:"error",reasonCode:"unknown_agent",filter:"agent",value:i,acceptedValues:ve,nextAction:e,nextStep:"Use --agent with a supported Skills Layer agent id."},`Unknown ${e} --agent "${i}". Run \`skills-layer agents\` to inspect supported agents.`,t.json,"unknown_agent")}:{scope:n,agent:i}}function Vr(e,t){let n=Bn(e,t);if(n.failure)return n.failure;let i=p(t.version);if(e==="install"&&i&&!At(i))return Mn("install",i,t)}function Mn(e,t,n){return w({status:"error",reasonCode:"invalid_version",command:e,version:t,nextAction:e,nextStep:"Use a semver version such as 1.2.3 or an external-<digest> Skills Layer version."},`Invalid --version "${t}". Use a semver version or an external-<digest> version.`,n.json,"invalid_version")}function Da(e,t,n){return w({status:"error",reasonCode:"invalid_expiry",command:e,expiresIn:t,acceptedFormat:"<positive whole number>d",nextAction:e,nextStep:"Use --expires with a day duration such as 7d, 30d, or 90d."},`Invalid --expires "${t}". Use a day duration such as 7d, 30d, or 90d.`,n.json,"invalid_expiry")}function Ga(e,t,n){let i=p(t);if(i&&!/^[1-9]\d*d$/iu.test(i))return Da(e,i,n)}function Ee(e,t,n,i,r,s){let o=p(e);if(!o)return{};if(!/^\d+$/u.test(o))return{failure:w({status:"error",reasonCode:i,[n]:o,nextAction:t.includes("price")?"creator.pricing":"creator.withdraw",nextStep:`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`},`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`,r.json,i)};let a=Number(o);return!Number.isSafeInteger(a)||a<s.minimum?{failure:w({status:"error",reasonCode:i,[n]:o,nextAction:t.includes("price")?"creator.pricing":"creator.withdraw",nextStep:`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`},`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`,r.json,i)}:{value:a}}function Va(e){let t=p(e.paymentMethod)??"card";return La.test(t)?{value:t}:{failure:w({status:"error",reasonCode:"invalid_payment_method",paymentMethod:t,acceptedValues:["card","card_<test-card>","pm_<provider-method-id>"],nextAction:"buy",nextStep:"Use --payment-method card or a provider token such as pm_<id>."},`Invalid payment method "${t}". Use card or a provider token such as pm_<id>.`,e.json,"invalid_payment_method")}}async function Ha(e,t,n){let i=new URLSearchParams,r=Kr(e,t.limit,20,t);if(r.failure)return r.failure;let s=p(t.sort);return s&&!ht.includes(s)?w({status:"error",reasonCode:"invalid_sort",sort:s,acceptedValues:ht,nextAction:e,nextStep:`Use --sort with one of: ${ht.join(", ")}.`},`${e} --sort must be one of: ${ht.join(", ")}.`,t.json,"invalid_sort"):(M(i,"limit",r.value),M(i,"search",t.search),M(i,"sort",s),await $(`/api/v1/${e}${ue(i)}`,t,n,`${Nt(e)} skills loaded.`))}async function za(e,t,n){let i=e.join(" ").trim();if(!i)return k("recommend requires a task.",t.json);let r=Kr("recommend",t.limit,20,t);if(r.failure)return r.failure;let s=new URLSearchParams({task:i});return M(s,"limit",r.value),await $(`/api/v1/recommend?${s.toString()}`,t,n,"Recommendations loaded.")}async function Wa(e,t,n){if(e.length<2)return k("compare requires two or more skill slugs.",t.json);if(e.length>5)return w({status:"error",reasonCode:"too_many_compare_slugs",requestedCount:e.length,maxItems:5,nextAction:"compare",nextStep:"Compare up to 5 skills at a time."},"compare supports up to 5 skill slugs at a time.",t.json,"too_many_compare_slugs");let i=new URLSearchParams({slugs:e.join(",")}),r=await S(n,`/api/v1/skills/compare?${i.toString()}`),s=Array.isArray(r.missing)?r.missing.filter(o=>typeof o=="string"):[];return s.length>0?w({...r,status:"not_found",reasonCode:"compare_missing_skills",missing:s,nextAction:"search",nextStep:`Run \`skills-layer search ${s[0]}\` to find the correct slug, then retry compare.`},`Comparison could not find: ${s.join(", ")}.`,t.json,"compare_missing_skills"):t.json?h(r,"Comparison loaded.",!0,n):{exitCode:0,stdout:hu(r,"Comparison loaded.",Q(n),t.verbose),stderr:""}}async function Ja(e,t,n){let i=b(e[0],"show requires a skill slug."),r=await S(n,`/api/v1/skills/${encodeURIComponent(i)}`);return h(Dl(r),"Skill loaded.",t.json,n)}async function Ya(e,t,n){let i=b(e[0],"trust requires a skill slug."),r=Gr("trust",t);if(r)return r;let s=new URLSearchParams;M(s,"format",t.format),M(s,"version",t.version);let o=await S(n,`/api/v1/skills/${encodeURIComponent(i)}/trust${ue(s)}`);return p(t.format)?.toLowerCase()==="sarif"&&!t.json?{exitCode:0,stdout:Gl(o,i,n),stderr:""}:h(o,"Trust report loaded.",t.json,n)}async function Za(e,t,n){if(t.json){let s=e[0]==="full"?$e():e[0]==="topic"?$e(e[1]):$e(e[0],e.slice(1));if(s)return h(s,"Help loaded.",!0,n);if(e[0]!=="topic"&&!Zo.has(e[0]??""))return kn(e,!0)}let i=ze(e[0],e.slice(1));if(i)return sn(i,e.filter(Boolean).join(" "),t,n);let r=e[0];if(!r)return{exitCode:0,stdout:He,stderr:""};if(r==="full")return sn(He,"full",t,n);if(r==="topic"){let s=ze(e[1]);if(s)return sn(s,e[1]??"overview",t,n);let o=new URLSearchParams;return e[1]&&o.set("topic",e[1]),await $(`/api/v1/help${ue(o)}`,t,n,"Help topic loaded.")}if(r==="standards")return await $("/api/v1/standards",t,n,"Marketplace standards loaded.");if(r==="marketplace-status"){let s=await S(n,"/api/v1/marketplace/status");return t.json?h(s,"Marketplace status loaded.",!0,n):h(Su(s),"Marketplace status loaded.",!1,n)}if(r==="capabilities"){let s=await S(n,"/api/v1/capabilities");return h(Cu(s),"Edition capabilities loaded.",t.json,n)}if(r==="schema-plan")return k("help schema-plan is not included in the public npm CLI.",t.json);if(r==="optimize-tokens"){let s=b(t.text,"help optimize-tokens requires --text."),o=_u(t.maxCharacters,t.json);if(J(o))return o;let a=await S(n,"/api/v1/optimize-tokens",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({text:s,...o?{maxCharacters:o}:{}})});return h(a,"Token optimization complete.",t.json,n)}return k(`Unknown help command "${r}".`,t.json)}function sn(e,t,n,i){return n.json?h({status:"ok",topic:t,content:e},"Help topic loaded.",!0,i):{exitCode:0,stdout:e,stderr:""}}function kn(e,t){let n=e.filter(Boolean).join(" ").trim()||"help";return w({status:"not_found",reasonCode:"help_topic_not_found",topic:n,nextAction:"help",nextStep:"Run `skills-layer --help`, `skills-layer help full`, or `skills-layer <command> --help` for a supported command."},`Help topic not found: ${n}.`,t,"help_topic_not_found")}async function Qa(e,t,n){let i=b(e[0]??t.path,"validate requires a file or directory."),r=K(n.cwd,i);if(!await ce(r))return is("validate",i,t,n);let o={files:await Lt(r),sourceIntakeContext:p(t.sourceIntakeContext),publicationStatus:p(t.publicationStatus),dependencyAuditStatus:p(t.dependencyAuditStatus),category:p(t.category),discloseSource:!!t.discloseSource,allowFindingsFeatured:!!t.allowFindingsFeatured},a;try{a=await S(n,"/api/v1/validation/preview",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x(o))})}catch(c){if(c instanceof A&&c.status===422&&c.details)a=rd(c.details);else throw c}return t.json?h(a,"Validation complete.",!0,n):{exitCode:0,stdout:xu(a,i,n),stderr:""}}async function Xa(e,t,n){let i=b(e[0]??t.path,"preview-trigger requires a file or directory."),r=K(n.cwd,i);if(!await ce(r))return is("preview-trigger",i,t,n);let s=await Lt(r),o=await S(n,"/api/v1/validation/trigger-preview",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({files:s,shouldTriggerPrompts:t.shouldTrigger,shouldNotTriggerPrompts:t.shouldNotTrigger,paraphrasePrompts:t.paraphrase})});return t.json?h(o,"Trigger preview complete.",!0,n):{exitCode:0,stdout:Ru(o,i,n),stderr:""}}async function el(e,t,n){let i=e[0];if(i==="init")return await tl(e.slice(1),t,n);if(i==="rules")return await $("/api/v1/creator/rules",t,n,"Creator rules loaded.");if(i==="submissions")return await $("/api/v1/me/submissions",t,n,"Submissions loaded.",{authenticated:!0});if(i==="status"){let r=b(e[1],"creator status requires a skill slug.");try{return await $(`/api/v1/me/submissions/${encodeURIComponent(r)}/status`,t,n,"Submission status loaded.",{authenticated:!0})}catch(s){if(s instanceof A&&s.status===404)return ll(r,t);throw s}}if(i==="charge-status"){let r=b(e[1],"creator charge-status requires a charge id.");return await $(`/api/v1/me/private-skill-charges/${encodeURIComponent(r)}`,t,n,"Charge status loaded.",{authenticated:!0})}if(i==="submit")return await ir(e.slice(1),t,n,!1);if(i==="submit-version")return await ir(e.slice(1),t,n,!0);if(i==="check-slug"){let r=b(e[1],"creator check-slug requires a slug.");return await ol(r,t,n)}if(i==="rename"){let r=b(e[1],"creator rename requires the current slug."),s=b(e[2],"creator rename requires the new slug."),o=Dr("creator.rename",s,t);return o||await jt(`/api/v1/me/submissions/${encodeURIComponent(r)}/slug`,{nextSkillSlug:s},t,n,"Skill renamed.")}if(i==="pricing")return await dl(e,t,n);if(i==="update-listing"){let r=b(e[1],"creator update-listing requires a skill slug.");return await pl(r,t,n)}if(i==="visibility"){let r=b(e[1],"creator visibility requires a skill slug."),s=we("creator.visibility",t);if(s)return s;let o=p(t.visibility)??e[2],a=pt(o);if(!a||!Ze.includes(a))return w({status:"error",reasonCode:"invalid_visibility",skillSlug:r,visibility:o??null,acceptedValues:Ze,nextAction:"creator.visibility",nextStep:"Use --visibility private, public, or unlisted."},`Invalid creator visibility "${o??""}". Use one of: ${Ze.join(", ")}.`,t.json,"invalid_visibility");let c=await S(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/visibility`,{method:"PATCH",headers:j(n.apiKey),body:JSON.stringify(x({visibility:a,dryRun:t.dryRun}))});return rc(c)?w(c,sc(c,r),t.json,l(c,"reasonCode")??l(c,"status")):h(c,t.dryRun?"Visibility preview loaded.":"Visibility updated.",t.json,n)}if(i==="security-report"){let r=b(e[1],"creator security-report requires a skill slug."),s=Gr("creator.security-report",t);if(s)return s;let o=we("creator.security-report",t);if(o)return o;let a=new URLSearchParams;M(a,"format",t.format),M(a,"version",t.version),M(a,"versionId",t.versionId);let c=await S(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/trust${ue(a)}`,{headers:T(n.apiKey,n.authBlockedMessage)});return t.json||t.verbose?h(c,"Creator security report loaded.",t.json,n):{exitCode:0,stdout:Ku(c,r,n),stderr:""}}if(i==="rescan-security"){let r=b(e[1],"creator rescan-security requires a skill slug."),s=we("creator.rescan-security",t);if(s)return s;let o=await S(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/trust/rescan`,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x(H(t,["version","versionId"])))});return t.json?h(o,"Security rescan requested.",!0,n):{exitCode:0,stdout:Du(o,r,n),stderr:""}}if(i==="provenance"){let r=b(e[1],"creator provenance requires a skill slug.");return await $(`/api/v1/me/submissions/${encodeURIComponent(r)}/provenance`,t,n,"Provenance loaded.",{authenticated:!0})}if(i==="claim"||i==="verify"||i==="dispute")return await gl(i,e,t,n);if(i==="issues"||i==="reviews"||i==="update-issue"||i==="moderate-review")return await vl(i,e,t,n);if(i==="analytics"){let r=b(e[1],"creator analytics requires a skill slug.");return await ml(r,t,n)}if(i==="earnings")return await $("/api/v1/me/earnings",t,n,"Creator earnings loaded.",{authenticated:!0});if(i==="payout-profile")return await fl(t,n);if(i==="payout-link")return await hl(t,n);if(i==="payouts")return await $("/api/v1/me/payouts",t,n,"Creator payouts loaded.",{authenticated:!0});if(i==="withdraw"){if(!p(t.amountCents))return k("creator withdraw requires --amount-cents.",t.json);let r=Ee(t.amountCents,"--amount-cents","amountCents","invalid_amount_cents",t,{minimum:1});return r.failure?r.failure:await O("/api/v1/me/payouts/withdrawals",x({amountCents:r.value,reason:p(t.reason)}),t,n,"Withdrawal requested.")}return i==="source"?await Pl(e.slice(1),t,n):k(`Unknown creator command "${i??""}".`,t.json)}async function tl(e,t,n){let i=p(t.skill)??e[0]??"my-skill",r=Dr("creator.init",i,t);if(r)return r;let s=K(n.cwd,p(t.dir)??i),o=E(s,"SKILL.md"),a;try{a=bi(p(t.type))}catch(m){return k(Z(m),t.json)}let c=p(t.category),u=await nl(s);if((await ce(o)||u)&&!t.confirmed)return k(`Creator init target already exists at ${s}. Re-run with --confirm only if you want to overwrite ${o}.`,t.json);await nt(s,{recursive:!0});let g=Si({skillSlug:i,description:p(t.description)??"Describe what this skill helps an agent do.",skillType:a,category:c});for(let m of g)await le(E(s,m.path),m.content);let f=x({status:"created",path:o,skillSlug:i,skillType:a,category:c,fileCount:g.length});return t.json?h(f,`Created ${o}.`,!0,n):{exitCode:0,stdout:Uu(f,s,o,n),stderr:""}}async function ce(e){try{return await jr(e),!0}catch{return!1}}async function nl(e){try{return(await Lr(e)).length>0}catch{return await ce(e)}}async function ir(e,t,n,i){let r=p(t.visibility);if(r){let C=pt(r);if(!C||!Ze.includes(C))return Pe(i?"creator.submit-version":"creator.submit","visibility",r,Ze,t,"invalid_visibility")}let s=Ee(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(s.failure)return s.failure;let o=i?b(p(t.skill)??e[0],"creator submit-version requires a skill slug."):p(t.skill),a=b(p(t.source)??(i?e[1]:e[0])??t.path,`creator ${i?"submit-version":"submit"} requires a <path-or-source> or --source <source>.`),c=await Rt(a,n.cwd);if(t.list)return await il(a,c,o,t,n);let u=we(i?"creator.submit-version":"creator.submit",t);if(u)return u;if(p(t.source)&&!c&&Ls(a))return rl(a,t);let d=c?.files??await Lt(K(n.cwd,a));if(!i&&!t.dryRun){let C=await sl(d,t,n);if(C)return C}let g=x({files:d,version:p(t.version),dryRun:t.dryRun,allowFindingsFeatured:t.allowFindingsFeatured,pricing:s.value!==void 0?{priceCents:s.value}:void 0,...c?{sourceMetadata:c.sourceMetadata}:{},...H(t,["displayName","skillType","category","visibility","source","skill"])}),f=i&&o?`/api/v1/me/submissions/${encodeURIComponent(o)}/versions`:"/api/v1/me/submissions",m=await S(n,f,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(g)});if(t.json||t.noOpen||m.status!=="checkout_required"||typeof m.checkoutUrl!="string"||typeof m.chargeId!="string")return h(m,i?"Version submitted.":"Submission uploaded.",t.json,n);n.emitInfo("Opening payment setup for skill submission. Complete the payment in your browser, then come back here."),await n.openUrl(m.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${m.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let v=await Jc(m.chargeId,n);return J(v)?v:v.status!=="submitted"?h({...m,chargeStatus:v.status},`Payment is still ${v.status}. You can rerun \`skills-layer creator charge-status ${m.chargeId}\` to continue tracking it.`,t.json,n):h(v,i?"Version submitted.":"Submission uploaded.",t.json,n)}async function il(e,t,n,i,r){if(t)return h(rr(Wr(e,t,n)),"Source skills loaded.",i.json,r);let s=await Je(r,e,{source:e,skillSlug:n,listOnly:!0,operation:"creator.submit"},i);return s.kind==="failure"?s.result:h(rr(s.inspection),"Source skills loaded.",i.json,r)}function rr(e){return{...e,sourceSubmissionSupported:!0}}function rl(e,t){let i=`skills-layer source connection start --provider ${Xr(e)} --source ${e} --visibility private --provenance-intent private_source_import`;return w({status:"source_connection_required",reasonCode:"source_connection_required",source:e,nextAction:"source.connection.start",nextStep:i},`Creator submit can list ${e} safely, but publishing from a remote source requires a source connection. Run \`${i}\`.`,t.json,"source_connection_required")}async function sl(e,t,n){let i=p(t.skill)??cl(e);if(!i)return null;let r;try{r=await S(n,`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(i)}`,{headers:T(n.apiKey,n.authBlockedMessage)})}catch(s){if(s instanceof A&&s.status===404)return Hr(i,t);throw s}if(r.available===!1||l(r,"reasonCode")==="unavailable"||l(r,"reasonCode")==="reserved"){let s=l(r,"assignedSlug"),o=x({status:"duplicate_candidate",reasonCode:l(r,"reasonCode")??"slug_unavailable",requestedSlug:i,assignedSlug:s,nextAction:"creator.status",nextStep:`Run \`skills-layer creator status ${i}\`, \`skills-layer creator submissions\`, or submit a new version of the existing skill instead of creating a duplicate listing.`});return w(o,`A public skill slug "${i}" already exists or is not available. Run \`skills-layer creator status ${i}\`, check your creator submissions, or submit a new version instead of creating a duplicate listing.`,t.json,l(o,"reasonCode"))}return null}async function ol(e,t,n){try{let i=await S(n,`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(e)}`,{headers:T(n.apiKey,n.authBlockedMessage)});return h(al(i),"Slug status loaded.",t.json,n)}catch(i){if(i instanceof A&&i.status===404)return Hr(e,t);throw i}}function Hr(e,t){let n={status:"slug_check_unavailable",reasonCode:"slug_check_route_unavailable",requestedSlug:e,nextAction:"creator.status",nextStep:`Slug availability could not be checked on the selected backend. Run \`skills-layer creator submissions\`, \`skills-layer creator status ${e}\`, or retry after selecting a compatible Skills Layer backend.`};return w(n,`Slug availability could not be checked for ${e} on the selected backend. Run \`skills-layer creator submissions\` or retry after selecting a compatible Skills Layer backend.`,t.json,"slug_check_route_unavailable")}function al(e){let t=e.available===!0,n=l(e,"assignedSlug");if(t)return x({requestedSlug:l(e,"requestedSlug"),available:!0,reasonCode:l(e,"reasonCode")??"available",assignedSlug:n});let i=P(e,"slugAssignment"),r=Array.isArray(i?.candidateSlugs)?i.candidateSlugs.filter(s=>typeof s=="string").slice(0,5):void 0;return x({...e,...i?{slugAssignment:{...i,...r?{candidateSlugs:r}:{}}}:{},...r?{candidateSlugs:r}:{}})}function ll(e,t){return w({status:"not_submitted",reasonCode:"creator_submission_not_found",skillSlug:e,nextAction:"creator.submit",nextStep:"Run `skills-layer creator submit <path> --dry-run` to validate a local skill before submitting it, or run `skills-layer creator submissions` to see your existing submissions."},`No creator submission was found for ${e}. Run \`skills-layer creator submit <path> --dry-run\` before checking status.`,t.json,"creator_submission_not_found")}function cl(e){let t=e.find(i=>i.path.split("/").pop()?.toLowerCase()==="skill.md");if(!t)return;let n=/^---\s*\n(?<body>[\s\S]*?)\n---/u.exec(t.content??"")?.groups?.body?.split(/\r?\n/u).map(i=>i.match(/^name\s*:\s*(?<name>.+?)\s*$/u)?.groups?.name?.trim().replace(/^["']|["']$/gu,"")).find(i=>!!i);return ul(n??V(ne(t.path)))}function ul(e){return e?.toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||void 0}async function dl(e,t,n){let i=b(e[1],"creator pricing requires a skill slug."),r=we("creator.pricing",t);if(r)return r;let s=new URLSearchParams;if(M(s,"version",t.version),!t.priceCents)return await $(`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing${ue(s)}`,t,n,"Pricing loaded.",{authenticated:!0});let o=Ee(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(o.failure)return o.failure;let a=o.value??0,c=await S(n,`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing${ue(s)}`,{headers:T(n.apiKey,n.authBlockedMessage)}),u=q(c,"priceCents")??0;if(a>u){let d=x({status:"pending_approval",reasonCode:u===0?"paid_activation_requires_approval":"price_increase_requires_approval",skillSlug:i,version:l(c,"version"),currentPriceCents:u,requestedPriceCents:a,currency:l(c,"currency")??"gbp",nextStep:"Pricing changes that increase buyer-facing cost require approval. Keep the current price for now, then retry after approval is available."});return h(d,"Pricing change requires approval before it can affect buyers.",t.json,n)}return await jt(`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing`,{priceCents:a,version:p(t.version)},t,n,"Pricing updated.")}async function pl(e,t,n){let i=re("creator.update-listing","listingStatus",t.listingStatus,_a,t,"invalid_listing_status","listing-status");if(i)return i;try{return await jt(`/api/v1/me/submissions/${encodeURIComponent(e)}`,H(t,["displayName","summary","description","category","skillType","license","listingStatus"]),t,n,"Listing updated.")}catch(r){if(r instanceof A&&r.status===404){let s={status:"listing_not_found_or_not_editable",reasonCode:"creator_listing_not_found_or_not_owned",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see editable listings, or \`skills-layer show ${e}\` to inspect the public catalog entry.`};return w(s,`No editable creator listing was found for ${e}. Run \`skills-layer creator submissions\` to see listings you can update.`,t.json,"creator_listing_not_found_or_not_owned")}throw r}}async function gl(e,t,n,i){let r=b(t[1],`creator ${e} requires a skill slug.`);if(e==="claim"){let s=re("creator.claim","requestedRole",n.requestedRole,Ca,n,"invalid_requested_role","requested-role");if(s)return s}try{if(e==="claim")return await O(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/claim`,H(n,["requestedRole","message"]),n,i,"Ownership claim submitted.");if(e==="verify"){let s=b(n.claimId,"creator verify requires --claim-id.");return await O(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/verify`,{claimId:s},n,i,"Ownership claim verified.")}return b(n.message,"creator dispute requires --message."),await O(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/dispute`,H(n,["message"]),n,i,"Ownership dispute submitted.")}catch(s){if(s instanceof A&&s.status===404){let o={status:"ownership_action_unavailable",reasonCode:e==="claim"?"skill_not_found_or_not_claimable":"ownership_claim_not_found",skillSlug:r,requestedRole:p(n.requestedRole),nextAction:e==="claim"?"search":"creator.claim",nextStep:e==="claim"?`Run \`skills-layer search ${r}\`, \`skills-layer show ${r}\`, or submit/source-install the skill before claiming it.`:`Run \`skills-layer creator claim ${r}\` to start a new claim if the skill is claimable.`};return w(o,e==="claim"?`No claimable skill was found for ${r}. Search or show the skill first, then claim it only when it exists and is claimable.`:`No matching ownership claim was found for ${r}. Start a new claim if the skill is claimable.`,n.json,l(o,"reasonCode")??"ownership_action_unavailable")}throw s}}async function ml(e,t,n){try{return await $(`/api/v1/me/submissions/${encodeURIComponent(e)}/analytics`,t,n,"Analytics loaded.",{authenticated:!0})}catch(i){if(i instanceof A&&i.status===404){let r={status:"no_creator_submission",reasonCode:"creator_submission_not_found",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see skills you own, \`skills-layer show ${e}\` to inspect the catalog listing, or \`skills-layer creator claim ${e}\` if it is a claimable public-source skill.`};return w(r,`No creator-owned analytics submission was found for ${e}. Run \`skills-layer creator submissions\`, \`skills-layer show ${e}\`, or \`skills-layer creator claim ${e}\` if you should manage it.`,t.json,"creator_submission_not_found")}throw i}}async function fl(e,t){let n=await S(t,"/api/v1/me/payout-profile",{headers:T(t.apiKey,t.authBlockedMessage)});return h(n,"Creator payout profile loaded.",e.json,t)}async function hl(e,t){let n=yl(p(e.mode));if(e.mode&&n===null)return k("creator payout-link --mode must be account_onboarding|account_update|onboarding|update.",e.json);let i;try{i=await S(t,"/api/v1/me/payout-profile/link",{method:"POST",headers:j(t.apiKey),body:JSON.stringify(n?{mode:n}:{})})}catch(s){if(s instanceof A&&wl(s))return w({status:"payout_setup_already_submitted",reasonCode:"payout_update_link_unavailable",nextAction:"creator.payout-profile",nextStep:"Run `skills-layer creator payout-profile` to confirm readiness, then use `skills-layer creator earnings` or `skills-layer creator withdraw --amount-cents <amount>`."},"Payout setup is already submitted for this account. Run `skills-layer creator payout-profile` to confirm readiness before requesting a withdrawal.",e.json,"payout_update_link_unavailable");throw s}let r=Yc(i);return r&&kl(e)&&e.showUrl!==!0&&(t.emitInfo("Opening payout setup in your browser. Finish the flow there, then come back here."),await t.openUrl(r)||t.emitInfo(`Open this payout setup URL manually to continue: ${r}`)),h(i,"Payout setup link created.",e.json,t)}function yl(e){if(!e)return null;let t=e.trim().toLowerCase();return t==="account_onboarding"||t==="onboarding"?"account_onboarding":t==="account_update"||t==="update"?"account_update":null}function kl(e){return!e.json&&!e.noOpen}function wl(e){let t=`${e.message} ${l(e.details??{},"error")??""}`.toLowerCase();return t.includes("account_update")&&t.includes("account_onboarding")&&t.includes("account link")}async function vl(e,t,n,i){let r=b(t[1],`creator ${e} requires a skill slug.`);if(e==="issues")return await $(`/api/v1/me/library/${encodeURIComponent(r)}/issues`,n,i,"Issues loaded.",{authenticated:!0});if(e==="reviews")return await $(`/api/v1/me/submissions/${encodeURIComponent(r)}/reviews`,n,i,"Reviews loaded.",{authenticated:!0});if(e==="update-issue"){let c=b(n.issueId,"creator update-issue requires --issue-id."),u=b(n.status,"creator update-issue requires --status."),d=re("creator.update-issue","status",u,xa,n,"invalid_issue_status");if(d)return d;let g=we("creator.update-issue",{...n,version:n.fixedVersion});if(g)return g;try{return await jt(`/api/v1/me/skills/${encodeURIComponent(r)}/issues/${encodeURIComponent(c)}`,H(n,["status","fixedVersion","note"]),n,i,"Issue updated.")}catch(f){if(f instanceof A&&f.status===404)return bl(r,c,n);throw f}}let s=b(n.reviewId,"creator moderate-review requires --review-id."),o=b(n.status,"creator moderate-review requires --status."),a=re("creator.moderate-review","status",o,Ra,n,"invalid_review_status");if(a)return a;try{return await O(`/api/v1/me/submissions/${encodeURIComponent(r)}/reviews/${encodeURIComponent(s)}/moderate`,H(n,["status","reason"]),n,i,"Review updated.")}catch(c){if(c instanceof A&&c.status===404)return Sl(r,s,n);throw c}}function bl(e,t,n){return w({status:"not_found",reasonCode:"issue_not_found",skillSlug:e,issueId:t,nextAction:"creator.issues",nextStep:`Run \`skills-layer creator issues ${e}\` to inspect open issues before updating one.`},`Issue ${t} was not found for ${e}. Run \`skills-layer creator issues ${e}\` first.`,n.json,"issue_not_found")}function Sl(e,t,n){return w({status:"not_found",reasonCode:"review_not_found",skillSlug:e,reviewId:t,nextAction:"creator.reviews",nextStep:`Run \`skills-layer creator reviews ${e}\` to inspect review ids before moderating one.`},`Review ${t} was not found for ${e}. Run \`skills-layer creator reviews ${e}\` first.`,n.json,"review_not_found")}async function Pl(e,t,n){let i=e[0],r=b(e[1],`creator source ${i??""} requires a source connection id.`),s=p(t.skill)??e[2];if(i==="prepare"){let o=we("creator.source.prepare",t);if(o)return o;let a=re("creator.source.prepare","visibility",t.visibility,Ie,t,"invalid_visibility");if(a)return a;let c=Ee(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});return c.failure?c.failure:await O(`/api/v1/me/source-connections/${encodeURIComponent(r)}/prepare`,x({...H(t,["skill","source","version","displayName","skillType","category","visibility"]),...c.value!==void 0?{priceCents:c.value}:{},source:p(t.source)??e[2]}),t,n,"Source release prepared.")}if(i==="publish-request"){let o=we("creator.source.publish-request",t);if(o)return o;let a=re("creator.source.publish-request","visibility",t.visibility,Ie,t,"invalid_visibility");if(a)return a;let c=Ee(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(c.failure)return c.failure;let u=t.approvalRequestId.length>0?t.approvalRequestId:p(t.approvalRequestId)?[String(t.approvalRequestId)]:[];return await O(`/api/v1/me/source-connections/${encodeURIComponent(r)}/publish-request`,x({skillSlug:s,approvalRequestIds:u,version:p(t.version),...H(t,["visibility","license","discloseSource"]),...c.value!==void 0?{priceCents:c.value}:{}}),t,n,"Source publish requested.")}if(i==="release-status"){let o=new URLSearchParams;return s&&o.set("skill",s),await $(`/api/v1/me/source-connections/${encodeURIComponent(r)}/release-status${ue(o)}`,t,n,"Source release status loaded.",{authenticated:!0})}return k(`Unknown creator source command "${i??""}".`,t.json)}async function qn(e,t,n){let i=Vr("install",t);if(i)return i;let r=p(t.source);if(r){let u=p(t.skill),d=cr(r,u,t);if(d)return d;let g=await Rt(r,n.cwd);if(g)return await sr(r,g,u,t,n);let f=ur(r,t);if(f)return f;let m=t.list||t.dryRun||!u&&!t.json&&!t.all,y=await Je(n,r,{source:r,skillSlug:u,listOnly:m},t);if(y.kind==="failure")return y.result;let v=y.inspection;if(t.list)return h(v,"Source skills loaded.",t.json,n);let C=vn(r,v,t);if(C)return C;let _=await bt({source:r,inspection:v,requestedSkillSlug:u,mode:"install",flags:t,backend:n});if(_.kind==="failure")return _.result;if(t.dryRun)return h(wn(r,v,_.skillSlug,t),"Source install preview ready.",t.json,n);let L=or(t,n),de;try{de=await S(n,L,{method:"POST",headers:ar(t,n),body:JSON.stringify(dr({source:r},_.skillSlug,t))})}catch(Ft){if(Ft instanceof A)return pr(r,Ft,t);throw Ft}let U=await cn(n,de);return await Pt(n,U,_.skillSlug??l(U,"skillSlug")??r),St(U,lr(t),t.json,n)}let s=b(e[0]??t.install,"install requires a skill slug or --source.");if(Ls(s)){let u=cr(s,p(t.skill),t);if(u)return u;let d=await Rt(s,n.cwd);if(d)return await sr(s,d,p(t.skill),t,n);let g=ur(s,t);if(g)return g;let f=p(t.skill),m;if(t.list){let _=await Je(n,s,{source:s,listOnly:!0},t);return _.kind==="failure"?_.result:h(_.inspection,"Source skills loaded.",t.json,n)}if(!f&&!t.json&&!t.all){let _=await Je(n,s,{source:s,listOnly:!0},t);if(_.kind==="failure")return _.result;let L=_.inspection;m=L;let de=vn(s,L,t);if(de)return de;let U=await bt({source:s,inspection:L,requestedSkillSlug:f,mode:"install",flags:t,backend:n});if(U.kind==="failure")return U.result;f=U.skillSlug}if(t.dryRun){if(!m){let L=await Je(n,s,{source:s,listOnly:!0},t);if(L.kind==="failure")return L.result;m=L.inspection}let _=await bt({source:s,inspection:m,requestedSkillSlug:f,mode:"install",flags:t,backend:n});return _.kind==="failure"?_.result:(f=_.skillSlug,h(wn(s,m,f,t),"Source install preview ready.",t.json,n))}let y=or(t,n),v;try{v=await S(n,y,{method:"POST",headers:ar(t,n),body:JSON.stringify(dr({source:s},f,t))})}catch(_){if(_ instanceof A)return pr(s,_,t);throw _}let C=await cn(n,v);return await Pt(n,C,f??l(C,"skillSlug")??V(s)),St(C,lr(t),t.json,n)}if(p(t.scope)==="workspace"){let u=b(t.workspace,"workspace installs require --workspace <workspace-id>."),d=await S(n,`/api/v1/workspaces/${encodeURIComponent(u)}/skills`,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x({skillSlug:s,version:p(t.version),dryRun:t.dryRun}))});return t.dryRun?await es(d,"Workspace install preview ready.",t,n):h(d,"Workspace deployment requested.",t.json,n)}let o=await S(n,"/api/v1/install",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x({skillSlug:s,version:p(t.version),scope:p(t.scope),agent:p(t.agent),dryRun:t.dryRun}))});if(t.dryRun)return await Ol(o,t,n);let a=await cn(n,o),c=await Cl(n,a,s,t);return J(c)?c:(await Pt(n,c,s),St(c,"Skill installed.",t.json,n))}async function Cl(e,t,n,i){if(Array.isArray(t.materializedWrites)&&t.materializedWrites.length>0)return t;let r=_l(e,t,n,i);if(r.status==="skip")return t;if(r.status==="failure")return w({status:"materialization_target_invalid",reasonCode:"materialization_target_invalid",skillSlug:r.skillSlug,nextStep:r.nextStep},r.message,i.json,"materialization_target_invalid");let s=await xl(e,t,r.skillSlug,r.version),o=await zr({backend:e,exportResult:s,flags:i,skillSlug:r.skillSlug});if(J(o))return o;let a=await Il({backend:e,skillSlug:r.skillSlug,version:r.version??l(s,"version")??"latest",scope:r.scope,agent:r.agent,skillsPath:r.skillsPath,bytes:o.bytes,files:o.files,archiveSha256:o.archiveSha256});return{...t,...Rl(s),archiveSha256:o.archiveSha256,archiveHashFormat:o.archiveHashFormat,scope:r.scope,agent:r.agent.id,targetAgent:r.agent.id,materializationPlan:{scope:r.scope,agent:r.agent.id},...a}}function _l(e,t,n,i){let r=P(t,"materializationPlan")??P(t,"installPlan"),s=p(i.scope)??l(t,"scope")??(r?l(r,"scope"):void 0);if(s!=="project"&&s!=="global")return{status:"skip"};let o=l(t,"skillSlug")??l(t,"slug")??n,a=p(i.agent)??l(t,"agent")??l(t,"targetAgent")??(r?l(r,"agent")??l(r,"targetAgent"):void 0)??ee(e.config?.lastSelectedAgent)??"codex",c=ke(e.env,e.platform,e.cwd).find(d=>d.id===a);if(!c)return{status:"failure",skillSlug:o,message:`Unsupported agent "${a}". Run \`skills-layer agents list\` to choose a supported local install target.`,nextStep:"Run `skills-layer agents list` and retry with a supported --agent value."};let u=s==="global"?c.targets.globalSkillsPath:c.targets.projectSkillsPath;return u?{status:"ok",scope:s,agent:c,skillsPath:u,skillSlug:o,version:l(t,"version")??l(t,"currentVersion")}:{status:"failure",skillSlug:o,message:`${c.displayName} does not expose a ${s} skills path on this machine.`,nextStep:"Retry with --scope project, or choose another agent from `skills-layer agents list`."}}async function xl(e,t,n,i){if(typeof t.downloadUrl=="string"&&typeof t.archiveSha256=="string")return t;let r=new URLSearchParams;return i&&r.set("version",i),await S(e,`/api/v1/me/library/${encodeURIComponent(n)}/export${ue(r)}`,{headers:T(e.apiKey,e.authBlockedMessage)})}function Rl(e){return x({version:l(e,"version"),storageKey:l(e,"storageKey"),expiresAt:l(e,"expiresAt")})}async function zr(e){let t=l(e.exportResult,"downloadUrl");if(!t)return w({status:"export_download_unavailable",reasonCode:"export_download_unavailable",skillSlug:e.skillSlug,nextStep:"Retry after the backend returns a signed bundle download URL."},`Export for ${e.skillSlug} did not include a signed download URL.`,e.flags.json,"export_download_unavailable");let n=await e.backend.fetchFn($l(e.backend.baseUrl,t));if(!n.ok)throw new A(n.status,`Unable to download exported bundle (${n.status}).`);let i=new Uint8Array(await n.arrayBuffer()),r=Al(i),s=l(e.exportResult,"archiveSha256")??n.headers.get("x-skills-layer-archive-sha256")?.trim()??void 0;return s&&r.archiveSha256!==s?w({status:"download_integrity_failed",reasonCode:"download_hash_mismatch",skillSlug:e.skillSlug,version:l(e.exportResult,"version"),expectedArchiveSha256:s,observedArchiveSha256:r.archiveSha256,archiveHashFormat:r.format,nextStep:"Retry after the catalog artifact is refreshed, or contact Skills Layer support if this repeats."},`Downloaded ${e.skillSlug} did not match the catalog artifact hash.`,e.flags.json,"download_hash_mismatch"):r.files.length===0?w({status:"download_integrity_failed",reasonCode:"download_bundle_empty",skillSlug:e.skillSlug,archiveHashFormat:r.format,nextStep:"Retry after the catalog artifact is refreshed."},`Downloaded ${e.skillSlug} did not contain any skill files.`,e.flags.json,"download_bundle_empty"):{status:"ok",bytes:i,files:r.files,archiveSha256:r.archiveSha256,archiveBytesSha256:r.archiveBytesSha256,archiveHashFormat:r.format}}function $l(e,t){return/^https?:\/\//iu.test(t)?t:`${te(e)}${t.startsWith("/")?"":"/"}${t}`}function Al(e){let t=$n("sha256").update(e).digest("hex"),n=fi(e);return n?{archiveSha256:hi(n),archiveBytesSha256:t,format:"bundle_archive",files:n}:{archiveSha256:t,archiveBytesSha256:t,format:"raw",files:[]}}async function Il(e){let t=e.backend.platform==="win32"?Ue:jn,n=t.join(e.backend.paths.bundlesDir,e.skillSlug,e.version,"bundle.zip"),i=t.join(e.skillsPath,e.skillSlug),r=t.join(i,e.version,"bundle.zip"),s=[];await xn(n,e.bytes),await An(i,{recursive:!0,force:!0}),await xn(r,e.bytes),s.push({path:Ct(e.backend.cwd,r),bytes:e.bytes.byteLength});for(let o of e.files){let a=t.join(i,...jl(o.path)),c=o.content??"";if(await le(a,c),s.push({path:Ct(e.backend.cwd,a),bytes:new TextEncoder().encode(c).length}),V(o.path).toLowerCase()==="skill.md"){let u=await zn({backend:e.backend,skillSlug:e.skillSlug,version:e.version,skillDocumentPath:a,skillDocumentContent:c});s.push(u)}}return{bundlePath:n,materializedPath:r,materializedSkillRoot:i,archiveSha256:e.archiveSha256,materializedWrites:s}}function jl(e){let n=e.replaceAll("\\","/").replace(/^\/+/u,"").trim().split("/").filter(i=>i.length>0);if(n.length===0||n.some(i=>i==="."||i===".."))throw new Error(`Unsafe bundle path "${e}".`);return n}async function sr(e,t,n,i,r){let s=p(i.visibility)??"private";if(s!=="private")return w({status:"local_install_visibility_not_allowed",reasonCode:"local_install_visibility_not_allowed",source:e,requestedVisibility:s,nextStep:`Use \`skills-layer creator submit ${e} --visibility ${s} --dry-run\` when you want to submit a local skill with non-private visibility.`},`Local path install creates a private Cloud skill by default. Use creator submit when you want ${s} visibility.`,i.json,"local_install_visibility_not_allowed");let o=Wr(e,t,n);if(i.list)return h(o,"Local source skills loaded.",i.json,r);let a=vn(e,o,i);if(a)return a;let c=await bt({source:e,inspection:o,requestedSkillSlug:n,mode:"install",flags:i,backend:r});if(c.kind==="failure")return c.result;let u=c.skillSlug??rt(o)[0]?.value??Yr(e);if(i.dryRun)return h({...wn(e,o,u,i),installKind:"local_private",publicationStatus:"none",catalogRecord:"not_created",nextStep:`Re-run without --dry-run to install ${u} locally. Use \`skills-layer creator submit ${e} --visibility private --dry-run\` when you want a private creator submission.`},"Local private install preview ready.",i.json,r);let d=await S(r,"/api/v1/me/submissions",{method:"POST",headers:{"content-type":"application/json",...T(r.apiKey,r.authBlockedMessage)},body:JSON.stringify(x({files:t.files,version:p(i.version),visibility:"private",category:p(i.category),displayName:p(i.displayName),skillType:p(i.skillType),sourceMetadata:t.sourceMetadata}))}),g=await Ul({backend:r,source:e,upload:t,skillSlug:l(d,"skillSlug")??u,flags:i,submitted:d});return await Pt(r,g,u),St(g,"Private Cloud skill installed.",i.json,r)}function Wr(e,t,n){let i=El(t.files),r=n?i.find(s=>s.skillSlug===n)??null:i.length===1?i[0]??null:null;return{status:"ok",source:t.sourceMetadata,selectedSkill:r,results:i,issues:[],sourceInstallSupported:!0,sourceInstallMode:"local_private",publicationStatus:"none",originalSource:e}}function El(e){return e.filter(t=>t.path.split("/").at(-1)?.toLowerCase()==="skill.md").map(t=>{let n=ne(t.path).replaceAll("\\","/"),i=n==="."?".":n,r=Jr(t.content??"")??Yr(i==="."?t.path:i),s=Ll(t.content??"");return{skillSlug:r,name:r,...s?{description:s}:{},relativeSkillRoot:i,relativeSkillFile:t.path,sourceKind:"local",discoveryRoute:"local_bundle",validation:{valid:!0,issueCount:0}}})}function Jr(e){return/^---\s*[\s\S]*?\nname:\s*["']?([^"'\n]+)["']?\s*(?:\n|$)/u.exec(e)?.[1]?.trim()}function Ll(e){return/^---\s*[\s\S]*?\ndescription:\s*["']?([^"'\n]+)["']?\s*(?:\n|$)/u.exec(e)?.[1]?.trim()}function Yr(e){return(e.replaceAll("\\","/").replace(/\/+$/u,"").split("/").filter(Boolean).at(-1)??"local-skill").toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||"local-skill"}async function Ul(e){let t=Tl(e.backend,e.flags);if(t.status==="failure")throw new Error(t.message);let n=e.upload.files.map(r=>({path:E(t.skillsPath,e.skillSlug,vs(r.path)),content:r.content??""})),i=[];for(let r of n)if(await le(r.path,r.content),i.push({path:Ct(e.backend.cwd,r.path),bytes:new TextEncoder().encode(r.content).length}),V(r.path).toLowerCase()==="skill.md"){let s=await zn({backend:e.backend,skillSlug:e.skillSlug,version:l(e.submitted,"version")??p(e.flags.version)??"private",skillDocumentPath:r.path,skillDocumentContent:r.content});i.push(s)}return{...e.submitted,status:"installed",cloudStatus:l(e.submitted,"status")??"submitted",installKind:"cloud_private",source:e.source,sourceKind:"local",skillSlug:e.skillSlug,version:l(e.submitted,"version")??p(e.flags.version)??"private",scope:t.scope,agent:t.agent,visibility:"private",publicationStatus:"private",catalogRecord:"private",privacy:{publication:"private",catalogRecord:"private",message:"This local install was saved as a private Cloud skill and did not create a public catalog record."},materializationPlan:{scope:t.scope,agent:t.agent},materializedWrites:i}}function Tl(e,t){let n=p(t.scope)??"project";if(!["local","project","global"].includes(n))return{status:"failure",message:"Local private installs support --scope local, project, or global. Use `skills-layer creator submit <path> --visibility private` for private creator workflows."};let i=p(t.agent)??ee(e.config?.lastSelectedAgent)??"codex",r=ke(e.env,e.platform,e.cwd).find(o=>o.id===i);if(!r)return{status:"failure",message:`Unsupported agent "${i}". Run \`skills-layer agents list\` to choose a supported local install target.`};let s=n==="global"?r.targets.globalSkillsPath:r.targets.projectSkillsPath;return s?{status:"ok",scope:n,agent:r.id,skillsPath:s}:{status:"failure",message:`${r.displayName} does not expose a ${n} skills path on this machine.`}}function Ct(e,t){let n=Xe(e,t);return n&&!n.startsWith("..")&&!Ue.isAbsolute(n)?n.split("\\").join("/"):t}function On(e){return p(e.visibility)==="public"?"public":"private"}function or(e,t){return On(e)==="public"&&!t.apiKey?"/api/v1/source-imports":"/api/v1/me/source-installs"}function ar(e,t){return{"content-type":"application/json",...On(e)==="private"?T(t.apiKey,t.authBlockedMessage):Ne(t.apiKey)}}function lr(e){return On(e)==="public"?"Public source install planned.":"Private source skill installed."}async function bt(e){let t=rt(e.inspection);if(e.requestedSkillSlug)return t.length>0&&!t.some(n=>n.value===e.requestedSkillSlug)?{kind:"failure",result:Nl(e.source,e.requestedSkillSlug,t.map(n=>n.value),e.flags)}:{kind:"selected",skillSlug:e.requestedSkillSlug};if(e.flags.json||e.flags.all)return{kind:"selected",skillSlug:e.requestedSkillSlug};if(t.length<=1)return{kind:"selected",skillSlug:t[0]?.value};try{return{kind:"selected",skillSlug:await e.backend.promptSelect(`${e.source} exposes multiple skills. Select one to ${e.mode}:`,t)}}catch{return{kind:"failure",result:k(`Source "${e.source}" exposes multiple skills. Re-run with --list or --skill <skill-slug>. Available skills: ${t.map(n=>n.value).join(", ")}.`,e.flags.json)}}}function cr(e,t,n){if(n.all&&t)return w({status:"error",reasonCode:"conflicting_source_selection",source:e,selectedSkillSlug:t,all:!0,nextAction:"install",nextStep:"Use either --all to install every discovered skill or --skill <skill-slug> to install one skill, not both."},"Source install cannot combine --all with --skill. Choose one selection mode before retrying.",n.json,"conflicting_source_selection")}function ur(e,t){try{if(ut(e).kind!=="local")return}catch{return}return w({status:"error",reasonCode:"invalid_source",source:e,nextAction:"install",nextStep:_t(e)?"Check that the local path exists and contains SKILL.md, or pass a supported GitHub/GitLab/source URL.":"Use an existing local path such as ./my-skill, a GitHub/GitLab source URL, or run `skills-layer install --source <source> --list` with a supported source."},_t(e)?`Install source ${e} was not found or is not readable.`:`Install source "${e}" is not a supported remote source and no local path was found.`,t.json,"invalid_source")}function Nl(e,t,n,i){return w({status:"not_found",reasonCode:"source_skill_not_found",source:e,requestedSkillSlug:t,availableSkills:n,nextAction:"install.source.list",nextStep:`Run \`skills-layer install --source ${e} --list\` to inspect discovered skills, then retry with one of the listed slugs.`},`Source ${e} does not contain a discovered skill named ${t}. Run with --list to inspect available skills.`,i.json,"source_skill_not_found")}function rt(e){let t=[e.results,e.skills,e.discoveredSkills,P(e,"source")?.results,P(e,"inspection")?.results],n=new Set,i=[];for(let r of t)if(Array.isArray(r))for(let s of r){let o=Fl(s);!o||n.has(o.value)||(n.add(o.value),i.push(o))}return i}function Fl(e){if(!R(e))return;let t=l(e,"skillSlug")??l(e,"slug")??l(e,"name");if(!t)return;let n=l(e,"displayName")??l(e,"title")??l(e,"name"),i=n&&n!==t?`${t} - ${n}`:t,r=P(e,"parsedSkill"),s=P(e,"frontmatter")??(r?P(r,"frontmatter"):void 0),o=l(e,"shortDescription")??l(e,"summary")??l(e,"description")??(s?l(s,"description"):void 0)??l(e,"relativeSkillRoot")??l(e,"path")??l(e,"discoveryRoute")??l(e,"sourceKind");return o?{value:t,label:i,description:o}:{value:t,label:i}}function dr(e,t,n){return x({...e,skillSlug:t,scope:p(n.scope),agent:p(n.agent),workspace:p(n.workspace),version:p(n.version),visibility:p(n.visibility)??"private",category:p(n.category),displayName:p(n.displayName),skillType:p(n.skillType),all:n.all,quarantine:n.quarantine,acceptCapability:n.acceptCapability})}function wn(e,t,n,i){return x({status:"dry_run",source:e,selectedSkillSlug:n,all:i.all,scope:p(i.scope)??"local",agent:p(i.agent),workspace:p(i.workspace),quarantine:i.quarantine,acceptCapability:i.acceptCapability,candidates:rt(t).map(r=>({skillSlug:r.value,name:r.label,description:r.description})),nextStep:i.all?`Re-run without --dry-run to install every discovered skill from ${e}.`:`Re-run without --dry-run${n?"":" and add --skill <skill-slug> if needed"} to install from ${e}.`})}async function Je(e,t,n,i){try{return{kind:"ok",inspection:await S(e,"/api/v1/source-inspect",{method:"POST",headers:j(e.apiKey),body:JSON.stringify(x(n))})}}catch(r){if(r instanceof A)return{kind:"failure",result:Ml(t,r,i)};throw r}}function vn(e,t,n){if(rt(t).length>0)return null;let r=Bl(t);return w({status:"unsupported_source_layout",source:e,reasonCode:"source_no_discoverable_skills",issues:r,nextStep:"Run with --list to inspect the source, use a subfolder containing SKILL.md, or install from a Skills Layer-compatible source layout."},ql(e,r),n.json)}function Bl(e){return(Array.isArray(e.issues)?e.issues:[]).filter(R).map(n=>({...l(n,"code")?{code:l(n,"code")}:{},...l(n,"message")?{message:l(n,"message")}:{},...l(n,"path")?{path:l(n,"path")}:{}}))}function Ml(e,t,n){let i=t.details??{},r=l(i,"error")??t.message;if(Zr(t.status,r))return Qr(e,t,n,"inspect");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(r)))return Ut(t,n.json);let o={status:"unsupported_source_layout",source:e,reasonCode:"source_not_inspectable",backendStatus:t.status,backendMessage:r,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return w(o,`Source ${e} could not be inspected as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function pr(e,t,n){let i=t.details??{},r=l(i,"error")??t.message;if(Zr(t.status,r))return Qr(e,t,n,"install");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(r)))return Ut(t,n.json);let o={status:"unsupported_source_layout",source:e,reasonCode:"source_not_installable",backendStatus:t.status,backendMessage:r,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return w(o,`Source ${e} could not be installed as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function Zr(e,t){return e===401||e===403||/private source|provider authorization|unauthorized|forbidden|access denied/iu.test(t)}function Qr(e,t,n,i){let r=t.details??{},s=l(r,"error")??t.message,a=`skills-layer source connection start --provider ${Xr(e)} --source ${e} --visibility private --provenance-intent private_source_import`,c={status:"private_source_access_required",source:e,reasonCode:"private_source_access_required",backendStatus:t.status,backendMessage:s,nextStep:a};return w(c,`Cloud could not ${i} ${e} directly. If this is a private source, start a private source connection first:
|
|
1236
|
+
${a}`,n.json,"private_source_access_required")}function Xr(e){return/gitlab\./iu.test(e)?"gitlab":/github\./iu.test(e)||/^gh:/iu.test(e)?"github":"generic_git"}function ql(e,t){let n=[`No Skills Layer-compatible skills were found in ${e}.`];if(t.length>0){n.push("Detected issues:");for(let i of t.slice(0,5)){let r=i.code??"source-inspection";n.push(`- ${r}: ${i.message??"No details returned."}${i.path?` (${i.path})`:""}`)}}return n.push("Try --list, a subfolder containing SKILL.md, or a Skills Layer-compatible source layout."),n.join(`
|
|
1237
|
+
`)}async function Ol(e,t,n){if(ts(e)){let s=l(e,"reasonCode")??l(e,"reason")??"install_not_ready",o=l(e,"why")??l(e,"summary")??"The requested skill is not ready to install from this backend.";return w(e,`Install preview is not ready: ${o}`,t.json,s)}let i=await ns(e,n),r=Array.isArray(i.warnings)&&i.warnings.length>0;return Kl(i,r?"Install preview ready with warnings.":"Install preview ready.",t,n)}function Kl(e,t,n,i){return n.json?h(e,t,!0,i):{exitCode:0,stdout:Kn(e,t,i),stderr:""}}async function es(e,t,n,i){if(ts(e)){let s=l(e,"reasonCode")??l(e,"reason")??"workspace_deploy_not_ready",o=l(e,"why")??l(e,"summary")??l(e,"nextStep")??"The requested workspace deployment is not ready.";return w(e,`Workspace deployment preview is not ready: ${o}`,n.json,s)}let r=await ns(e,i);return n.json?h(r,t,!0,i):{exitCode:0,stdout:Kn(r,t,i),stderr:""}}function ts(e){let t=l(e,"status")?.toLowerCase(),n=l(e,"reasonCode")?.toLowerCase();return t==="not_found"||t==="missing"||t==="blocked"||t==="not_ready"||n==="skill_not_found"||n==="not_found"}async function ns(e,t){let n=gr(e);if(n)return{...e,...n};let i=l(e,"skillSlug")??l(e,"slug");if(!i)return e;try{let r=await S(t,`/api/v1/skills/${encodeURIComponent(i)}/trust`),s=gr(r);return s?{...e,...s}:e}catch{return e}}function gr(e){let t=P(e,"securityReport")??P(e,"report")??e,n=P(e,"trust")??P(t,"trust")??t,i=P(e,"securityPosture")??P(t,"securityPosture"),r=P(e,"capabilityProfile")??P(t,"capabilityProfile"),s=x({securityScore:q(n,"securityScore")??q(n,"score")??q(e,"securityScore")??(i?q(i,"securityScore"):void 0),runtimeRisk:l(n,"runtimeRisk")??l(e,"runtimeRisk")??(i?l(i,"runtimeRisk"):void 0)??(r?l(r,"runtimeRisk"):void 0),recommendation:l(n,"recommendation")??l(e,"recommendation")??(i?l(i,"recommendation"):void 0),detectedCapabilities:fe(n,"detectedCapabilities")??fe(e,"detectedCapabilities")??(r?fe(r,"detectedCapabilities"):void 0),capabilityMismatches:fe(n,"capabilityMismatches")??fe(e,"capabilityMismatches")??(r?fe(r,"capabilityMismatches"):void 0),organizationPolicyDecision:l(n,"organizationPolicyDecision")??l(n,"policyDecision")??l(e,"organizationPolicyDecision")??l(e,"policyDecision")??(i?l(i,"organizationPolicyDecision"):void 0)});if(Object.keys(s).length!==0)return x({trust:s,runtimeRisk:l(s,"runtimeRisk"),detectedCapabilities:Array.isArray(s.detectedCapabilities)?s.detectedCapabilities:void 0,capabilityMismatches:Array.isArray(s.capabilityMismatches)?s.capabilityMismatches:void 0,organizationPolicyDecision:l(s,"organizationPolicyDecision"),warnings:fe(e,"warnings")??fe(t,"warnings")??fe(n,"warnings")})}function Dl(e){let t=P(e,"securityPosture"),n=P(e,"trust"),i=t?q(t,"securityScore"):void 0,r=n?q(n,"securityScore")??q(n,"score"):void 0;return i===void 0&&r===void 0?e:x({...e,...t?{securityPosture:{...t,scoreLabel:"published_ledger_score"}}:{},...n?{trust:{...n,scoreLabel:"effective_buyer_trust_score"}}:{},publishedLedgerScore:i,effectiveBuyerTrustScore:r})}function St(e,t,n,i){return n?h(e,t,!0,i):{exitCode:0,stdout:Kn(e,t,i),stderr:""}}function Gl(e,t,n){let i=Q(n),r=Array.isArray(e.runs)?e.runs.filter(R):[],s=r.flatMap(c=>Array.isArray(c.results)?c.results.filter(R):[]),o=r.flatMap(c=>{let u=P(c,"tool"),d=u?P(u,"driver"):void 0;return d&&Array.isArray(d.rules)?d.rules.filter(R):[]}),a=[`${i.ok("OK")} Trust report loaded.`,"",i.section("SARIF")];if(a.push(` ${i.label("Skill")}: ${t}`),a.push(` ${i.label("Runs")}: ${r.length}`),a.push(` ${i.label("Rules")}: ${o.length}`),a.push(` ${i.label("Results")}: ${s.length}`),s.length===0)a.push(` ${i.muted("No SARIF findings found.")}`);else{a.push("",i.section("Findings"));for(let[c,u]of s.slice(0,B).entries()){let d=l(u,"ruleId")??"unknown-rule",g=P(u,"message");a.push(`${c+1}. ${d}${g?` - ${l(g,"text")??""}`:""}`)}}return a.push("",i.section("Next")),a.push(` ${i.arrow} skills-layer trust ${t} --format sarif --json`),a.join(`
|
|
1238
|
+
`)}function Kn(e,t,n){let i=Q(n),r=[`${i.ok("OK")} ${t}`],s=l(e,"skillSlug")??l(e,"slug"),o=l(e,"version")??l(e,"currentVersion");(s||o)&&(r.push("",i.section("Skill")),s&&r.push(` ${i.label("Slug")}: ${s}`),o&&r.push(` ${i.label("Version")}: ${o}`));let a=l(e,"visibility")??l(e,"versionVisibility"),c=l(e,"publicationStatus"),u=l(e,"catalogRecord");(a||c||u)&&(r.push("",i.section("Privacy")),a&&r.push(` ${i.label("Visibility")}: ${a}`),c&&r.push(` ${i.label("Publication")}: ${c}`),u&&r.push(` ${i.label("Catalog record")}: ${u}`));let d=P(e,"materializationPlan")??P(e,"installPlan"),g=l(e,"scope")??(d?l(d,"scope"):void 0),f=l(e,"agent")??l(e,"targetAgent")??(d?l(d,"agent")??l(d,"targetAgent"):void 0),m=Array.isArray(e.materializedWrites)?e.materializedWrites.filter(R):[];if(g||f||m.length>0)if(r.push("",i.section("Local Materialization")),g&&r.push(` ${i.label("Scope")}: ${g}`),f&&r.push(` ${i.label("Agent")}: ${f}`),m.length===0)r.push(` ${i.muted("No local files were written by this command.")}`);else for(let C of m.slice(0,B)){let _=l(C,"path");_&&r.push(` ${i.arrow} ${_}`)}let y=xs(e,i).filter(C=>!C.includes("materialized writes:"));y.length>0&&r.push("",...y);let v=js(e);return v.length>0&&r.push("",i.section("Next"),...v.map(C=>` ${i.arrow} ${C}`)),r.join(`
|
|
1239
|
+
`)}function Vl(e,t){let n=P(e,"trust"),i=P(e,"securityPosture"),r=P(e,"capabilityProfile"),s=n?.securityScore??n?.score??e.securityScore??i?.securityScore,o=N(n,"runtimeRisk")??l(e,"runtimeRisk")??N(i,"runtimeRisk")??N(r,"runtimeRisk"),a=N(n,"recommendation")??l(e,"recommendation")??N(i,"recommendation"),c=N(n,"label")??N(n,"trust")??l(e,"trustStatus")??l(e,"trust")??N(i,"label");if(s===void 0&&!o&&!a&&!c)return[];let u=[t.section("Trust")];return s!==void 0&&u.push(` ${t.label("Security score")}: ${Y("securityScore",s)}`),o&&u.push(` ${t.label("Runtime risk")}: ${o}`),a&&u.push(` ${t.label("Recommendation")}: ${a}`),c&&u.push(` ${t.label("Status")}: ${c}`),u.push(` ${t.label("Source")}: skills-layer trust`),u}async function Hl(e,t){let n=Bn("installed",e);if(n.failure)return n.failure;let i=await Ce(t),r=Object.values(i.installs).filter(s=>{let o=l(s,"scope"),a=l(s,"agent");return(!n.scope||o===n.scope)&&(!n.agent||a===n.agent)});return h({status:"ok",results:r},`Found ${r.length} local install records.`,e.json,t)}async function zl(e,t,n){let i=b(e[0],"remove requires a skill slug."),r=Vr("remove",t);if(r)return r;let s=await Ce(n),o=s.installs[i];if(!o)return w({status:"not_installed",reasonCode:"local_install_not_found",skillSlug:i},`${i} is not installed locally. Run \`skills-layer installed\` or \`skills-layer sync\` to inspect local records.`,t.json,"local_install_not_found");delete s.installs[i],await bs(n,s);let a={status:"removed",skillSlug:i,removedRecord:o};return t.json?h(a,`Removed ${i}.`,!0,n):{exitCode:0,stdout:nc(i,n),stderr:""}}async function Wl(e,t,n){let i=b(e[0],"update requires a skill slug."),r=new URLSearchParams,s=p(t.pin);if(s&&!At(s))return w({status:"error",reasonCode:"invalid_pin",skillSlug:i,requestedPin:s,nextAction:"update",nextStep:"Use --pin with a semver version such as 1.2.3 or an external-<digest> Skills Layer version."},`Invalid --pin "${s}". Use a semver version or an external-<digest> version.`,t.json,"invalid_pin");M(r,"pin",s),t.dryRun&&r.set("dryRun","true");let a=(await Ce(n)).installs[i],c;try{c=await S(n,`/api/v1/skills/${encodeURIComponent(i)}${ue(r)}`,{headers:T(n.apiKey,n.authBlockedMessage)})}catch(d){if(d instanceof A&&d.status===404&&a){let g={status:"backend_missing",reasonCode:"local_install_backend_missing",skillSlug:i,localInstall:a,installedVersion:l(a,"version")??l(a,"currentVersion"),selectedBackend:n.baseUrl,nextStep:`This skill is installed locally, but no catalog update source was found on ${n.baseUrl}. Reinstall from its source, run \`skills-layer search ${i}\`, or run \`skills-layer remove ${i}\` if you no longer need it.`};return w(g,`${i} is installed locally, but no catalog update source was found on this backend. Reinstall from its source, search for a replacement, or remove the local install.`,t.json,"local_install_backend_missing")}if(d instanceof A)return Ut(d,t.json);throw d}let u=Zl(i,c,a,n);return s&&t.dryRun&&!Jl(u,s)?w({status:"not_found",reasonCode:"pin_not_resolved",skillSlug:i,requestedPin:s,installedVersion:l(a,"version")??l(a,"currentVersion"),currentVersion:l(u,"currentVersion"),nextAction:"update",nextStep:`Choose a version returned by \`skills-layer show ${i} --json\` or omit --pin to check the latest available version.`},`${i} does not have a resolvable version for --pin ${s}.`,t.json,"pin_not_resolved"):t.json?h(u,"Update check complete.",!0,n):{exitCode:0,stdout:ec(u,n),stderr:""}}function At(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(e)||/^external-[0-9A-Za-z][0-9A-Za-z._-]*$/u.test(e)}function Jl(e,t){let n=[l(e,"version"),l(e,"currentVersion"),l(e,"latestVersion"),l(e,"targetVersion"),l(e,"availableVersion")].filter(Boolean),i=P(e,"update");return i&&n.push(l(i,"version"),l(i,"currentVersion"),l(i,"latestVersion"),l(i,"targetVersion"),l(i,"availableVersion")),n.some(r=>r===t)}async function Yl(e,t){let n=Bn("sync",e);if(n.failure)return n.failure;let i=await Ce(t),r=Object.values(i.installs).filter(a=>{let c=l(a,"scope"),u=l(a,"agent");return(!n.scope||c===n.scope)&&(!n.agent||u===n.agent)}),o={status:"synced",results:await Promise.all(r.map(async a=>Ql(a,t)))};return e.json?h(o,"Local install records synced.",!0,t):{exitCode:0,stdout:tc(o,t),stderr:""}}function Zl(e,t,n,i){let r=n?l(n,"version")??l(n,"currentVersion"):void 0,s=l(t,"currentVersion")??l(t,"version"),o=n?r&&s&&r!==s?"update_available":"up_to_date":"not_installed";return x({...t,skillSlug:l(t,"skillSlug")??l(t,"slug")??e,updateStatus:o,installedVersion:r,latestAvailableVersion:s,selectedBackend:i.baseUrl,localInstall:n,nextStep:o==="not_installed"?`Run \`skills-layer install ${e}\` to install this skill locally.`:o==="update_available"?`Run \`skills-layer install ${e}\` to apply the latest available version.`:`No update is needed for ${e}.`})}async function Ql(e,t){let n=l(e,"skillSlug")??l(e,"slug");if(!n)return{...e,syncStatus:"local_only",backendStatus:"unchecked"};try{let i=await S(t,`/api/v1/skills/${encodeURIComponent(n)}`,{headers:Ne(t.apiKey)}),s=(l(i,"claimedOrigin")??l(i,"sourceKind")??l(e,"sourceKind"))==="public_source"||l(e,"sourceKind")==="external";return{...e,syncStatus:s?"source_backed":"catalog_backed",backendStatus:"found",latestAvailableVersion:l(i,"currentVersion")??l(i,"version"),catalog:Xl(i)}}catch(i){return i instanceof A&&i.status===404?{...e,syncStatus:"backend_missing",backendStatus:"not_found",selectedBackend:t.baseUrl}:{...e,syncStatus:"unchecked",backendStatus:"error",backendError:Z(i)}}}function Xl(e){return x({slug:l(e,"slug")??l(e,"skillSlug"),currentVersion:l(e,"currentVersion")??l(e,"version"),claimedOrigin:l(e,"claimedOrigin"),trust:l(e,"trust")??l(e,"publicationStatus")})}function ec(e,t){let n=Q(t),i=l(e,"skillSlug")??l(e,"slug")??"skill",r=l(e,"updateStatus")??"checked",s=[`${n.ok("OK")} Update check complete.`,"",n.section("Update")];s.push(` ${n.label("Skill")}: ${i}`),s.push(` ${n.label("Status")}: ${r.replaceAll("_"," ")}`);let o=l(e,"installedVersion"),a=l(e,"latestAvailableVersion");o&&s.push(` ${n.label("Installed version")}: ${o}`),a&&s.push(` ${n.label("Latest available version")}: ${a}`);let c=P(e,"localInstall"),u=c?l(c,"materializedPath")??l(c,"path"):void 0,d=c?l(c,"scope"):void 0,g=c?l(c,"targetAgent")??l(c,"agent"):void 0;c&&(s.push("",n.section("Local Install")),d&&s.push(` ${n.label("Scope")}: ${d}`),g&&s.push(` ${n.label("Agent")}: ${g}`),u&&s.push(` ${n.label("Path")}: ${u}`));let f=l(e,"nextStep");return f&&s.push("",n.section("Next"),` ${n.arrow} ${f}`),s.join(`
|
|
1240
|
+
`)}function tc(e,t){let n=Q(t),i=[`${n.ok("OK")} Local install records synced.`,"",n.section(`Results (${e.results.length})`)];return e.results.length===0?(i.push(` ${n.muted("No local install records found.")}`),i.join(`
|
|
1241
|
+
`)):(e.results.slice(0,B).forEach((r,s)=>{let o=l(r,"skillSlug")??l(r,"slug")??`item-${s+1}`,a=l(r,"syncStatus")??"unchecked",c=l(r,"version")??l(r,"currentVersion");i.push(`${s+1}. ${o}`),i.push(` status: ${a.replaceAll("_"," ")}${c?`; version: ${c}`:""}`),a==="backend_missing"&&i.push(` ${n.muted("Installed locally, but missing from the selected backend catalog.")}`)}),e.results.length>B&&i.push(` ${n.muted(`... ${e.results.length-B} more`)}`),i.push("",n.section("Next")),i.push(` ${n.arrow} skills-layer installed`),i.push(` ${n.arrow} skills-layer update <skill-slug>`),i.join(`
|
|
1242
|
+
`))}function nc(e,t){let n=Q(t);return[`${n.ok("OK")} Removed ${e}.`,"",n.section("Local Install"),` ${n.label("Skill")}: ${e}`,` ${n.label("Status")}: removed locally`,"",n.section("Next"),` ${n.arrow} skills-layer installed`,` ${n.arrow} skills-layer sync`].join(`
|
|
1243
|
+
`)}function ic(e,t,n){let i=Q(n),r=l(t,"version")??l(t,"currentVersion"),s=l(t,"scope");return[`${i.ok("OK")} Restore record found for ${e}.`,"",i.section("Local Install"),` ${i.label("Skill")}: ${e}`,...r?[` ${i.label("Version")}: ${r}`]:[],...s?[` ${i.label("Scope")}: ${s}`]:[],"",i.section("Next"),` ${i.arrow} skills-layer installed`,` ${i.arrow} skills-layer sync`,` ${i.arrow} skills-layer update ${e}`].join(`
|
|
1244
|
+
`)}function rc(e){let t=l(e,"status"),n=l(e,"reasonCode");return t==="invalid_transition"||t==="forbidden"||t==="not_found"||n==="invalid_transition"}function sc(e,t){let n=l(e,"why")??l(e,"reason")??l(e,"error"),i=l(e,"currentVisibility"),r=l(e,"nextVisibility")??l(e,"visibility"),s=i||r?` Current visibility: ${i??"unknown"}; requested visibility: ${r??"unknown"}.`:"",o=l(e,"nextStep")??`Run \`skills-layer creator status ${t}\` and choose a valid visibility transition.`;return`Visibility was not changed for ${t}.${s}${n?` ${n}`:""}
|
|
1245
|
+
Next step: ${o}`}async function oc(e,t,n){let i=await Ce(n),r=b(e[0],"restore requires a skill slug."),s=i.installs[r];if(!s)return w({status:"missing_record",reasonCode:"restore_record_not_found",skillSlug:r,record:null,nextAction:"installed",nextStep:`Run \`skills-layer installed\` to see local records, \`skills-layer sync\` to refresh status, or \`skills-layer search ${r}\` if you want to find a catalog/source replacement.`},`No restorable local install record was found for ${r}. Run \`skills-layer installed\`, \`skills-layer sync\`, or \`skills-layer search ${r}\` next.`,t.json,"restore_record_not_found");let o={status:"restored",skillSlug:r,record:s};return t.json?h(o,`Restore checked for ${r}.`,!0,n):{exitCode:0,stdout:ic(r,s,n),stderr:""}}async function ac(e,t,n){let i=b(e[0],"check requires a skill slug.");return await $(`/api/v1/skills/${encodeURIComponent(i)}/trust`,t,n,"Install trust checked.",{authenticated:!!n.apiKey})}async function lc(e,t,n){let i=b(e[0]??t.source,"import requires a source."),r=re("import","visibility",t.visibility,Ie,t,"invalid_visibility");if(r)return r;let s=await Rt(i,n.cwd);if(!s){let a=cc(i,t);if(a)return a}let o=await S(n,"/api/v1/source-imports",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x({...s??{source:i},quarantine:t.quarantine,skillSlug:p(t.skill),visibility:p(t.visibility)}))});return await W(n.paths.importsPath,{version:1,lastImport:o,savedAt:n.now()}),h(o,"Source import submitted.",t.json,n)}function cc(e,t){try{return ut(e).kind!=="local"?null:w({status:"error",reasonCode:"invalid_source",source:e,nextAction:"import",nextStep:_t(e)?"Check that the local path exists and contains SKILL.md, or pass a supported GitHub/GitLab/source URL.":"Use an existing local path such as ./my-skill, a GitHub/GitLab source, or --help for import examples."},_t(e)?`Import source ${e} was not found or is not readable.`:`Import source "${e}" is not a supported source. Use a local path, GitHub/GitLab source, or URL.`,t.json,"invalid_source")}catch(n){return w({status:"error",reasonCode:"invalid_source",source:e,error:Z(n),nextAction:"import",nextStep:"Use an existing local path such as ./my-skill, a GitHub/GitLab source, or URL."},`Import source "${e}" is invalid. ${Z(n)}`,t.json,"invalid_source")}}function _t(e){return/^(?:\.{1,2}(?:[\\/]|$)|[\\/]|[A-Za-z]:[\\/])/u.test(e)}function is(e,t,n,i){let r=K(i.cwd,t);return w({status:"error",reasonCode:"source_path_not_found",path:r,nextAction:e,nextStep:`Check that ${t} exists and contains a readable SKILL.md, then retry.`},`${e} source path does not exist: ${r}`,n.json,"source_path_not_found")}async function uc(e,t,n){let i=e[0];if(i==="reference"&&e[1]==="resolve"){let r=b(e[2],"source reference resolve requires a reference."),s=await S(n,`/api/v1/source-references/resolve?reference=${encodeURIComponent(r)}`);return s.status==="not_found"?w({...s,status:"not_found",reasonCode:"source_reference_not_found",reference:r,nextAction:"source.connection.start",nextStep:"Start or complete the source connection before resolving this reference."},`Source reference ${r} was not found.`,t.json,"source_reference_not_found"):h(s,"Source reference resolved.",t.json,n)}return i==="connection"?await dc(e.slice(1),t,n):k(`Unknown source command "${e.join(" ")}".`,t.json)}async function dc(e,t,n){let i=e[0];if(i==="start"){let s=p(t.provider),o=p(t.source),a=p(t.visibility),c=s?.replace(/-/gu,"_");if(c&&!Ji.includes(c))return Pe("source.connection.start","provider",s??"",Ji,t,"invalid_source_provider");let u=Ee(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(u.failure)return u.failure;let d=pc(s,o,a,t);return d||await O("/api/v1/me/source-connections",H(t,["provider","source","skill","mode","visibility","priceCents","license","provenanceIntent","discloseSource"]),t,n,"Source connection started.")}let r=b(e[1],`source connection ${i??""} requires a connection id.`);if(i==="status")return await $(`/api/v1/me/source-connections/${encodeURIComponent(r)}`,t,n,"Source connection loaded.",{authenticated:!0});if(i==="complete"){let s=Oa("source.connection.complete",t);return s||await O(`/api/v1/me/source-connections/${encodeURIComponent(r)}/complete`,H(t,["providerOwnerId","providerRepoId","providerProjectId","providerInstallationId","commitSha"]),t,n,"Source connection completed.")}return i==="cancel"?await O(`/api/v1/me/source-connections/${encodeURIComponent(r)}/cancel`,{},t,n,"Source connection cancelled."):k(`Unknown source connection command "${i??""}".`,t.json)}function pc(e,t,n,i){if(n){let r=pt(n);if(!r||!Ie.includes(r))return w({status:"error",reasonCode:"invalid_visibility",visibility:n,acceptedValues:Ie,nextAction:"source.connection.start",nextStep:"Use --visibility private, public, or unlisted."},`Invalid source connection visibility "${n}". Use one of: ${Ie.join(", ")}.`,i.json,"invalid_visibility")}if(!e||!t)return null;try{let r=ut(t);if((e==="github"||e==="gitlab")&&r.kind!==e)return on(e,t,i);if(e==="domain"){let s=new URL(t);if(s.protocol!=="https:"||!s.hostname)return on(e,t,i)}}catch{return on(e,t,i)}return null}function on(e,t,n){return w({status:"error",reasonCode:"invalid_source",provider:e,source:t,nextAction:"source.connection.start",nextStep:e==="github"?"Use a GitHub source such as https://github.com/OWNER/REPO or github:OWNER/REPO.":e==="gitlab"?"Use a GitLab source such as https://gitlab.com/GROUP/REPO or gitlab:GROUP/REPO.":"Use a valid source URL or provider-specific source."},`Invalid ${e} source "${t}".`,n.json,"invalid_source")}async function gc(e,t,n){if(e[0]!=="request")return k(`Unknown approval command "${e[0]??""}".`,t.json);let i=e[1];if(i!=="status"&&i!=="complete")return k("approval request requires `status <approval-request-id>` or `complete <approval-request-id> --decision <approved|denied>`.",t.json);let r=b(e[2],`approval request ${i??""} requires an approval id.`);if(i==="status")return await $(`/api/v1/me/approvals/${encodeURIComponent(r)}`,t,n,"Approval status loaded.",{authenticated:!0});let s=b(t.decision,"approval request complete requires --decision."),o=re("approval.request.complete","decision",s,Aa,t,"invalid_decision");return o||await O(`/api/v1/me/approvals/${encodeURIComponent(r)}/complete`,x({decision:s,evidence:Tt(t.decisionEvidenceJson,"decision-evidence-json")}),t,n,"Approval completed.")}async function mc(e,t,n){let i=e[0]??"list";if(i==="list")return await $("/api/v1/me/workspaces",t,n,"Workspaces loaded.",{authenticated:!0});if(i==="create"){let s=e.slice(1).join(" ").trim();if(!s)return k("workspace create requires a workspace name.",t.json);let o=re("workspace.create","kind",t.kind,Ea,t,"invalid_workspace_kind");if(o)return o;let a=p(t.kind);return await O("/api/v1/workspaces",{name:s,kind:a==="team"?"shared":a},t,n,"Workspace created.")}let r=b(e[1],`workspace ${i} requires a workspace id.`);if(i==="skills")try{return await $(`/api/v1/workspaces/${encodeURIComponent(r)}/skills`,t,n,"Workspace skills loaded.",{authenticated:!0})}catch(s){if(s instanceof A&&(s.status===403||s.status===404))return an(r,t);throw s}if(i==="deploy"){let s=b(e[2],"workspace deploy requires a skill slug."),o;try{o=await S(n,`/api/v1/workspaces/${encodeURIComponent(r)}/skills`,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(x({skillSlug:s,dryRun:t.dryRun}))})}catch(a){if(a instanceof A&&(a.status===403||a.status===404))return an(r,t);throw a}return t.dryRun?await es(o,"Workspace deployment preview ready.",t,n):h(o,"Workspace deployment requested.",t.json,n)}if(i==="remove"){let s=b(e[2],"workspace remove requires a skill slug.");try{return await Et(`/api/v1/workspaces/${encodeURIComponent(r)}/skills/${encodeURIComponent(s)}`,{method:"DELETE",headers:T(n.apiKey,n.authBlockedMessage)},t,n,"Workspace skill removed.")}catch(o){if(o instanceof A&&o.status===404)return mr(r,s,t);if(o instanceof A&&o.status===403)return an(r,t);throw o}}if(i==="guide"){let s=b(e[2],"workspace guide requires a skill slug.");try{return await $(`/api/v1/workspaces/${encodeURIComponent(r)}/skills/${encodeURIComponent(s)}/install-guide`,t,n,"Workspace install guide loaded.",{authenticated:!0})}catch(o){if(o instanceof A&&o.status===404)return mr(r,s,t);throw o}}return k(`Unknown workspace command "${i}".`,t.json)}function an(e,t){return w({status:"not_found_or_forbidden",reasonCode:"workspace_not_found_or_forbidden",workspaceId:e,nextAction:"workspace.list",nextStep:"Run `skills-layer workspace list` to find a workspace you can access, then retry with that workspace id."},`Workspace ${e} was not found or you do not have access. Run \`skills-layer workspace list\` to inspect accessible workspaces.`,t.json,"workspace_not_found_or_forbidden")}function mr(e,t,n){let i={status:"deployment_not_found",reasonCode:"workspace_deployment_not_found",workspaceId:e,skillSlug:t,nextAction:"workspace.deploy",nextStep:`Run \`skills-layer workspace deploy ${e} ${t}\` first, then run \`skills-layer workspace guide ${e} ${t}\` after the deployment exists.`};return w(i,`Workspace deployment not found for ${t}. Run \`skills-layer workspace deploy ${e} ${t}\` first.`,n.json,"workspace_deployment_not_found")}async function fc(e,t,n){let i=b(e[0],"buy requires a skill slug."),r=Va(t);if(r.failure)return r.failure;let s=await S(n,"/api/v1/buy",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({skillSlug:i,paymentMethod:r.value})});if(s.status==="already_owned")return h(s,`You already own ${i}. Run \`skills-layer install ${i}\` to install or update it.`,t.json,n);if(t.json||t.noOpen||s.status!=="checkout_required"||typeof s.checkoutUrl!="string"||typeof s.purchaseId!="string")return h(s,`Purchase flow started for ${i}.`,t.json,n);n.emitInfo(`Opening checkout for ${i}. Complete the payment in your browser, then come back here.`),await n.openUrl(s.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${s.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let a=await Wc(s.purchaseId,n);return J(a)?a:a.status!=="succeeded"&&a.status!=="refund_requested"?h({...s,purchaseStatus:a.status},`Checkout is still ${a.status} for ${i}. You can rerun install after payment reconciliation completes.`,t.json,n):(n.emitInfo("Payment confirmed. Continuing with install."),await qn([i],t,n))}async function hc(e,t,n){let i=e[0]??"list";if(i==="list")return await $("/api/v1/purchases",t,n,"Purchases loaded.",{authenticated:!0});if(i==="spending")return await $("/api/v1/spending",t,n,"Spending loaded.",{authenticated:!0});let r=b(e[1],`purchases ${i} requires a purchase id.`);return i==="invoice"?await $(`/api/v1/purchases/${encodeURIComponent(r)}/invoice`,t,n,"Invoice loaded.",{authenticated:!0}):i==="refund-quote"?await $(`/api/v1/purchases/${encodeURIComponent(r)}/refund-quote`,t,n,"Refund quote loaded.",{authenticated:!0}):i==="refund"?await O(`/api/v1/purchases/${encodeURIComponent(r)}/refund`,H(t,["reason"]),t,n,"Refund requested."):k(`Unknown purchases command "${i}".`,t.json)}async function yc(e,t,n){let i=e[0];if(i==="add"){let r=b(e[1],"library add requires a skill slug.");return await O("/api/v1/install",{skillSlug:r},t,n,"Skill added to library.")}return k(`Unknown library command "${i}".`,t.json)}async function kc(e,t,n){let i=b(e[0],"export requires a skill slug.");if(t.showUrl&&p(t.output))return w({status:"error",reasonCode:"conflicting_export_output",nextAction:"export",nextStep:"Use either --show-url to inspect the signed URL or --output <file> to download the bundle, not both."},"export cannot use --show-url and --output together.",t.json,"conflicting_export_output");let r=new URLSearchParams,s=p(t.version);if(s&&!At(s))return Mn("export",s,t);M(r,"version",s);let o=await S(n,`/api/v1/me/library/${encodeURIComponent(i)}/export${ue(r)}`,{headers:T(n.apiKey,n.authBlockedMessage)}),a=p(t.output);if(a){let c=await zr({backend:n,exportResult:o,flags:t,skillSlug:i});if(J(c))return c;let u=K(n.cwd,a);await xn(u,c.bytes);let d={...o};return delete d.downloadUrl,h({...d,archiveSha256:c.archiveSha256,archiveSha256Meaning:"canonical_bundle_sha256",canonicalBundleSha256:c.archiveSha256,downloadedArchiveSha256:c.archiveBytesSha256,downloadedFileSha256:c.archiveBytesSha256,archiveHashFormat:c.archiveHashFormat,outputPath:u,downloaded:!0},`Exported ${i} to ${u}. Downloaded file SHA-256: ${c.archiveBytesSha256}.`,t.json,n)}return h(o,a?`Exported ${i} to ${a}.`:"Export prepared.",t.json,n)}async function fr(e,t,n,i){let r=b(t[0],`${e==="add"?"add-review":"show-reviews"} requires a skill slug.`);if(e==="show")return await $(`/api/v1/me/library/reviews?skillSlug=${encodeURIComponent(r)}`,n,i,"Reviews loaded.",{authenticated:!0});let s=b(n.rating,"add-review requires --rating.");return/^[1-5]$/u.test(s)?await O(`/api/v1/me/library/${encodeURIComponent(r)}/review`,H(n,["rating","feedback"]),n,i,"Review added."):w({status:"error",reasonCode:"invalid_rating",rating:s,acceptedValues:["1","2","3","4","5"],nextAction:"add-review",nextStep:"Use --rating with a whole number from 1 to 5."},`Invalid review rating "${s}". Use a whole number from 1 to 5.`,n.json,"invalid_rating")}async function hr(e,t,n,i){let r=b(t[0],`${e==="add"?"add-issue":"show-issues"} requires a skill slug.`);if(e==="show")return await $(`/api/v1/me/library/${encodeURIComponent(r)}/issues`,n,i,"Issues loaded.",{authenticated:!0});b(n.message,"add-issue requires --message.");let s=re("add-issue","issueType",n.issueType,$a,n,"invalid_issue_type","issue-type");return s||await O(`/api/v1/me/library/${encodeURIComponent(r)}/report-issue`,H(n,["issueType","message"]),n,i,"Issue reported.")}async function wc(e,t,n){let i=e[0];if(i==="hook"){let r=e[1];return r==="install"?await ss(t,n):r==="status"?await Pc(t,n):k(`Unknown guardian hook command "${r??""}".`,t.json)}if(i==="enable")return e[1]||t.skill?await ln("enforce",e,t,n):k("guardian enable requires a skill slug.",t.json);if(i==="disable")return await ln("disabled",e,t,n);if(i==="enable-warnings-only")return await ln("warning_only",e,t,n);if(i==="status")return await bc(e,t,n);if(i==="exec")return await vc(e,t,n);if(i==="check"){let r=b(e[1]??t.skill,"guardian check requires a skill slug."),s=Cr(t,"check"),o=t.grantJson.map(y=>Qn(y,"grant-json")),a=id(t.cloudTrustLedger);if(a.status==="invalid")return k(a.message,t.json);let c=bn(t.telemetryMode,a.policy==="off"?"local_only":"cloud_managed");if(c.status==="invalid")return k(c.message,t.json);let u=await as({skillSlug:r,version:p(t.version),action:s,flags:t,backend:n,telemetryMode:c.mode});if(u.status!=="ok")return u.result;let d=u.context.installedPath,g=p(t.version)??u.context.version,f=x({skillSlug:r,version:g,action:s,authorizationGrants:o,path:d,guardianPreference:await Gn(n,r),unmanagedPolicy:u.context.unmanagedPolicy,allowUnmanagedOnce:t.allowUnmanagedOnce,telemetryMode:c.mode,localPreflight:Se(u.context)}),m=await S(n,"/api/v1/guardian/enforce",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(f)});return await Qe(n,{skillSlug:r,version:g,action:s,decisionStatus:xt(m),reasonCode:Sn(m),telemetryMode:c.mode,path:d}),h({...m,localPreflight:Se(u.context)},"Guardian check complete.",t.json,n)}if(i==="incident"){let r=b(e[1]??t.skill,"guardian incident requires a skill slug."),s=b(t.version,"guardian incident requires --version."),o=bn(t.telemetryMode,"cloud_managed");if(o.status==="invalid")return k(o.message,t.json);let a=p(t.path);if(a&&!await ce(K(n.cwd,a)))return w({status:"error",reasonCode:"invalid_incident_path",path:a,nextAction:"guardian.incident",nextStep:"Use --path with an installed skill directory, or omit --path so Skills Layer resolves the local install record."},`Guardian incident path does not exist: ${a}`,t.json,"invalid_incident_path");let c=a??(await ls({skillSlug:r,flags:t,backend:n})).installedPath,u=Cr(t,"incident"),d=Tt(t.evidenceJson,"evidence-json"),g=o.mode==="cloud_managed"&&!n.apiKey?"local_only":o.mode,f=x({skillSlug:r,version:s,action:u,evidence:d,path:c,telemetryMode:g,incident:!0,reason:p(t.reason)});if(g==="local_only"){if(!c)return k("guardian incident --telemetry-mode local_only requires --path <installed-skill-path>.",t.json);let C=await br({backend:n,skillSlug:r,version:s,installedPath:c,action:u,reason:p(t.reason)??"Guardian local-only incident"});await Qe(n,{skillSlug:r,version:s,action:u,decisionStatus:"blocked",reasonCode:"incident_recorded",telemetryMode:g,path:c});let _=Sr(n,r);return await le(_,JSON.stringify({request:f,response:null,localResponse:C,savedAt:n.now()},null,2)),h({status:"written",skillSlug:r,version:s,telemetryMode:g,cloudTelemetry:n.apiKey?"not_requested":"login_required",localResponse:C,incidentStatePath:_,incidentPath:C.incidentPath},n.apiKey?"Guardian incident recorded locally.":"Guardian incident recorded locally. Log in to submit Cloud incident evidence.",t.json,n)}let m=await S(n,"/api/v1/guardian/enforce",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(f)}),y=c?await br({backend:n,skillSlug:r,version:s,installedPath:c,action:u,reason:p(t.reason)??"Guardian Cloud-managed incident"}):null;await nt(n.paths.incidentsDir,{recursive:!0});let v=Sr(n,r);return await le(v,JSON.stringify({request:f,response:m,localResponse:y,savedAt:n.now()},null,2)),await Qe(n,{skillSlug:r,version:s,action:u,decisionStatus:xt(m),reasonCode:Sn(m),telemetryMode:o.mode,path:c}),h({...m,telemetryMode:o.mode,localResponse:y,incidentPath:v},"Guardian incident recorded.",t.json,n)}return k(`Unknown guardian command "${i??""}".`,t.json)}async function vc(e,t,n){let i=p(t.skill),r=b(i??e[1],"guardian exec requires a skill slug."),s=i?e.slice(1):e.slice(2);if(s.length===0)return k("guardian exec requires a command after --.",t.json);let o=bn(t.telemetryMode,"cloud_managed");if(o.status==="invalid")return k(o.message,t.json);let a=jc(t,s),c=await as({skillSlug:r,version:p(t.version),action:a,flags:t,backend:n,telemetryMode:o.mode});if(c.status!=="ok")return c.result;let u=c.context.installedPath,d=p(t.version)??c.context.version,g=x({skillSlug:r,version:d,action:a,authorizationGrants:t.grantJson.map(C=>Qn(C,"grant-json")),path:u,guardianPreference:await Gn(n,r),telemetryMode:o.mode,localPreflight:Se(c.context)}),f=await S(n,"/api/v1/guardian/enforce",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(g)}),m=xt(f),y=Sn(f);if(await Qe(n,{skillSlug:r,version:d,action:a,decisionStatus:m,reasonCode:y,telemetryMode:o.mode,path:u}),!Ec(f))return w({status:"blocked",reasonCode:y,skillSlug:r,guardian:f,localPreflight:Se(c.context),command:{executable:V(s[0]??""),executed:!1}},"Guardian blocked guarded execution.",t.json,y);if(t.dryRun)return h({status:"allowed",skillSlug:r,guardian:f,localPreflight:Se(c.context),command:{executable:V(s[0]??""),executed:!1,dryRun:!0}},"Guardian guarded execution allowed.",t.json,n);let v=await Lc(s,n);return{exitCode:v.exitCode,stdout:t.json?JSON.stringify({status:v.exitCode===0?"executed":"command_failed",summary:"Guardian guarded execution complete.",why:null,nextAction:null,nextStep:null,data:{skillSlug:r,guardian:f,localPreflight:Se(c.context),command:v},warnings:[],links:[],reasonCode:v.exitCode===0?null:"command_failed",handoff:null},null,2):Uc(v),stderr:v.stderr}}async function ln(e,t,n,i){let r=b(t[1]??n.skill,`guardian ${t[0]??"mode"} requires a skill slug.`),s=await S(i,"/api/v1/guardian/mode",{method:"POST",headers:j(i.apiKey),body:JSON.stringify({skillSlug:r,requestedPreference:e,source:"public-cli"})});return s.preferenceAccepted===!0&&await Tc(i,r,s),h(s,s.preferenceAccepted===!0?"Guardian mode updated.":"Guardian mode resolved by policy.",n.json,i)}async function bc(e,t,n){let i=p(t.skill)??p(e[1]),r;try{r=await rs(n,i)}catch(d){r={status:"unavailable",skillSlug:i,policySource:"cloud",reasonCode:"guardian_policy_status_unavailable",message:Z(d),nextAction:"guardian.status",nextStep:"Cloud Guardian policy could not be loaded. Local hook and preference posture are still shown below."}}let s=await Te(n),o=i?await Nc(n,i):void 0,a=l(r,"status")==="unavailable",u=l(s,"enforcementLayer")!=="not_installed"&&!!s.strictPreActionBlocking?{status:"installed",reasonCode:"guardian_hook_installed",strictPreActionBlocking:!0,nextAction:"guardian.check",nextStep:"Cloud Guardian policy is enforced when checked, and the local host hook can block supported risky actions before execution."}:{status:"not_installed",reasonCode:"guardian_hook_not_installed",strictPreActionBlocking:!1,nextAction:"guardian.hook.install",nextStep:"Cloud Guardian policy is enforced when checked, but local pre-action blocking is not installed for this host. Run `skills-layer guardian hook install --agent codex --scope global` or `skills-layer setup`."};return h(x({status:a?"degraded":"ok",skillSlug:l(r,"skillSlug")??i,policy:r,localPreference:o,hook:s,cloudPolicy:{status:l(r,"effectiveMode")??l(r,"status")??"unknown",reasonCode:l(r,"reasonCode"),enforcementBoundary:"cloud_policy_when_checked",nextAction:l(r,"nextAction"),nextStep:l(r,"nextStep")},localEnforcement:u,nextAction:l(u,"nextAction"),nextStep:l(u,"nextStep")}),a?"Guardian status loaded with limited Cloud policy data.":"Guardian status loaded.",t.json,n)}async function rs(e,t){let n=t?await Gn(e,t):void 0;return await S(e,"/api/v1/guardian/status",{method:"POST",headers:j(e.apiKey),body:JSON.stringify(x({skillSlug:t,requestedPreference:n,source:"public-cli"}))})}async function Sc(e){if(!e.apiKey)return{status:"unknown",policySource:"cloud",reasonCode:"login_required",nextAction:"skills-layer login",nextStep:"Sign in to read the Cloud Guardian policy that applies to your account."};try{return await rs(e)}catch(t){return{status:"unavailable",policySource:"cloud",reasonCode:"guardian_policy_status_unavailable",message:Z(t),nextAction:"skills-layer guardian status",nextStep:"Retry Guardian status after backend connectivity or authentication is healthy."}}}async function ss(e,t){let n=p(e.agent)??"codex",i=us(e.scope);if(i.status==="invalid")return k(i.message,e.json);let r=ke(t.env,t.platform,t.cwd).find(g=>g.id===n);if(!r)return w({status:"error",reasonCode:"unknown_agent",agent:n,nextAction:"agents.list",nextStep:"Run `skills-layer agents list` to see supported agents, then retry Guardian hook install with a supported --agent value."},`Unsupported Guardian agent "${n}". Run skills-layer agents list to see supported agents.`,e.json,"unknown_agent");let s=Fc(r,i.scope,t);if(!s)return k(`Guardian ${i.scope} hooks are not available for ${r.displayName}.`,e.json);await Bc(s,t);let o=gs(t,i.scope),a=Pr(Xe(t.cwd,s.hookPath)),c=Pr(Xe(t.cwd,s.configPath)),d=[...(await ms(o)).hooks.filter(g=>l(g,"agent")!==r.id||l(g,"scope")!==i.scope),{hookId:ye,hookName:ie,agent:r.id,agentName:r.displayName,scope:i.scope,hookPath:a.startsWith("..")?s.hookPath:a,configPath:c.startsWith("..")?s.configPath:c,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,enabledAt:t.now()}];return await W(o,{version:1,hooks:d}),h({status:"enabled",hookId:ye,hookName:ie,agent:r.id,agentName:r.displayName,scope:i.scope,hookPath:s.hookPath,configPath:s.configPath,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,agentCommandMatrix:Wt({purpose:"materialize_skill",command:"skills-layer install <skill-slug>",jsonCommand:"skills-layer install <skill-slug> --json"}),nextStep:"Guardian is installed into the selected host configuration. Local hooks call `skills-layer guardian check`; shell agents can route risky commands through `skills-layer guardian exec`; MCP-capable agents can call `guardian.check` or `guardian.enforce` before risky tool use.",warnings:s.enforcementLayer==="native_hook_candidate"?["This host does not expose the same stable native hook contract as Codex or Claude Code yet; Skills Layer records the guardrail config for host integration."]:[]},"Guardian hook enabled.",e.json,t)}async function Pc(e,t){let n=p(e.scope),i=n?us(n):null;if(i?.status==="invalid")return k(i.message,e.json);let r=await Te(t,i?.status==="valid"?i.scope:void 0);return h(r,"Guardian status loaded.",e.json,t)}async function Te(e,t){let n=t?[t]:["project","global"],i=[];for(let a of n){let c=gs(e,a),u=await ms(c);for(let d of u.hooks){let g=l(d,"hookPath"),f=g?vr(e,a,g):null,m=l(d,"configPath"),y=m?vr(e,a,m):null,v=f?await ce(f):!1,C=y?await ce(y):null,_=v?C===!1?"active_missing_config":"active":"stale_missing_hook";i.push({hookId:l(d,"hookId")??ye,hookName:l(d,"hookName")??ie,...d,scope:l(d,"scope")??a,hookPath:f??g??null,configPath:y??m??null,active:v,configActive:C,hookState:_})}}let r=i.filter(a=>a.active===!0).length,s=i.filter(a=>a.active===!1).length,o=r>0?0:s;return{status:"ok",enforcementLayer:r>0?"native_hook":"not_installed",strictPreActionBlocking:i.some(a=>a.active===!0&&a.strictPreActionBlocking===!0),activeHookCount:r,missingHookCount:o,staleHookCount:s,hooks:i,setup:await Vn(e),warnings:s>0?r>0?["One or more stale Guardian hook records were found, but an active Skills Layer Security Hook is installed."]:["One or more configured Guardian hooks are missing from disk. Run skills-layer guardian hook install --agent <agent> again to repair them."]:[]}}async function os(e,t){if(e.json){let u=await D(t.paths.mcpConfigPath);return h({setup:await Vn(t),mcp:{status:u?"mcp_configured":"mcp_not_configured",configured:!!u,clientId:u?l(u,"clientId")??"codex":void 0,clientIds:u&&Array.isArray(u.clientIds)?u.clientIds:void 0,mcpUrl:u?l(u,"mcpUrl"):void 0,readiness:u?{status:"configured_needs_agent_reload",verifyCommand:`skills-layer mcp verify --client ${l(u,"clientId")??"codex"}`,nextStep:"Open a fresh agent session if Skills Layer tools are not visible yet."}:void 0,nextCommand:u?"skills-layer mcp verify":"skills-layer mcp setup"},guardian:await Te(t)},"Setup status loaded.",!0,t)}if(!t.stdoutIsTty)return h({status:"setup_needs_terminal",mcp:{nextCommand:"skills-layer mcp setup"},security:{nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Setup needs an interactive terminal. Run `skills-layer setup`, or use `skills-layer mcp setup` and `skills-layer guardian hook install --agent codex --scope project`.",!1,t);let n=await t.promptSelect("Set up Skills Layer on this machine?",[{value:"mcp",label:"Setup Skills-Layer MCP",description:"Configure Skills Layer MCP for AI tools"},{value:"security",label:"Setup Skills-Layer Security Guardian",description:"Install Guardian hooks for this workspace"},{value:"both",label:"Setup both - MCP & Security Guardian",description:"Connect supported AI tools and install Guardian hooks"},{value:"not_now",label:"Remind me Later",description:"Skip setup for now; you can run skills-layer setup later"}]);if(n==="not_now"){let u={version:1,setupChoice:"not_now",mcpChoice:"not_now",mcpPromptedAt:t.now(),guardianHookChoice:"not_now",guardianHookPromptedAt:t.now(),remindAfter:xc(t.now(),7)};return await wr(t,u),h({status:"setup_skipped",mcp:{status:"not_configured",nextCommand:"skills-layer mcp setup"},security:{status:"not_configured",nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Skills Layer setup skipped for now. Run `skills-layer setup` when you want MCP and Security hooks on this machine.",!1,t)}if(n!=="both"&&n!=="mcp"&&n!=="security")return k(`Unknown setup option "${n}".`,e.json);let i=n==="both"||n==="mcp",r=n==="both"||n==="security",s={status:"setup_complete",setupChoice:n},o={version:1,setupChoice:n,mcpChoice:i?"configured":"not_requested",mcpPromptedAt:t.now(),guardianHookChoice:r?p(e.scope)??"project":"not_requested",guardianHookPromptedAt:t.now()};if(i)if(!t.apiKey)s.mcp={status:"login_required",configured:!1,nextCommand:"skills-layer login"},o.mcpChoice="login_required";else{let u=await Fn(e,t);if(J(u))return u;s.mcp=u}if(r){let u={...e,json:!0,scope:p(e.scope)??"project",agent:p(e.agent)??"codex"},d=await ss(u,t);if(d.exitCode!==0)return d;s.security=Vc(d.stdout)??{status:"enabled",agent:p(u.agent),scope:p(u.scope)}}await wr(t,o);let c=(R(s.mcp)?l(s.mcp,"status"):void 0)==="login_required"?"Skills Layer Security setup complete. MCP setup needs login; run `skills-layer login`, then `skills-layer setup`.":"Skills Layer setup complete. Open a fresh agent session if MCP tools are not visible yet.";return h(s,c,e.json,t)}async function Cc(e,t){let n=await Te(t),i=await Vn(t),r=q(n,"activeHookCount")??0;if(t.stdoutIsTty&&r===0&&!i)return await os(e,t);let s=r>0?"Guardian host hooks are already configured. Run `skills-layer guardian hook status` to inspect them.":"Guardian is enabled for Skills Layer runtime checks. Run `skills-layer setup` when you want MCP and Security hooks on this machine.";return{exitCode:0,stdout:`${He}
|
|
1246
|
+
|
|
1247
|
+
${s}`,stderr:""}}function _c(e,t){let n=q(e,"activeHookCount")??0,i=q(e,"missingHookCount")??0,r=l(t,"status")??"unknown",s=l(t,"effectiveMode"),o=l(t,"adminPolicy"),a=l(t,"nextAction"),c=l(t,"nextStep");return n>0&&i===0?{id:"guardian-local-hook",title:"Guardian local hook",status:"pass",summary:`Guardian native hook active count: ${n}.`,enforcementLayer:l(e,"enforcementLayer")??"native_hook",strictPreActionBlocking:e.strictPreActionBlocking===!0,policyStatus:r,adminPolicy:o,effectiveMode:s,policyNextAction:a,policyNextStep:c,recommendedCommand:"skills-layer guardian hook status"}:{id:"guardian-local-hook",title:"Guardian local hook",status:"warn",summary:`Guardian native hook setup needs attention. Active hooks: ${n}; missing hooks: ${i}.`,enforcementLayer:l(e,"enforcementLayer")??"not_installed",strictPreActionBlocking:e.strictPreActionBlocking===!0,policyStatus:r,adminPolicy:o,effectiveMode:s,policyNextAction:a,policyNextStep:c,recommendedCommand:"skills-layer guardian hook install --agent codex --scope project",nextStep:"Install a Guardian host hook for automatic checks, or route risky shell actions through `skills-layer guardian exec` for strict pre-execution blocking."}}function xc(e,t){let n=new Date(e);return Number.isNaN(n.getTime())?e:(n.setUTCDate(n.getUTCDate()+t),n.toISOString())}async function as(e){let t=cs(p(e.flags.unmanagedPolicy)??e.backend.env.SKILLS_LAYER_UNMANAGED_SKILL_POLICY);if(t.status==="invalid")return{status:"invalid",result:k(t.message,e.flags.json)};let n=await ls({skillSlug:e.skillSlug,flags:e.flags,backend:e.backend,unmanagedPolicy:t.policy});if(n.unmanaged&&n.unmanagedPolicy==="block")return kt({...e,context:n,reasonCode:"unmanaged_skill_blocked",message:"Guardian blocked unmanaged local skill execution.",why:"The skill path is not backed by a public install index or lockfile entry and unmanaged policy is block.",nextStep:"Install the skill with `skills-layer install <path>` or choose --unmanaged-policy warn/allow for a one-off diagnostic check."});if(!n.installedPath)return{status:"ok",context:n};if(await Dc(n.installedPath))return kt({...e,context:n,reasonCode:"skill_disabled",message:"Guardian blocked the action because this local skill is disabled.",why:"A local Guardian incident marker is present for this skill.",nextAction:"guardian.incident.review",nextStep:"Review the local incident report before running this skill again."});if(n.unmanaged)return{status:"ok",context:n};let i=await Ac(e.skillSlug,n.installedPath);if(n.identityAssessment=i,i.reattestationRequired===!0)return kt({...e,context:n,reasonCode:l(i,"reasonCode")??"skill_identity_mismatch",message:"Guardian blocked the action because the installed skill identity changed.",why:"The visible SKILL.md identity no longer matches the installed skill record.",nextStep:"Reinstall or re-attest the skill before running it again."});let r=await Ic(e.skillSlug,n.installedPath);return n.driftAssessment=r,r.reattestationRequired===!0?kt({...e,context:n,reasonCode:l(r,"reasonCode")??"installed_artifact_changed",message:"Guardian blocked the action because local runtime metadata detected installed artifact drift.",why:"The installed SKILL.md hash no longer matches the materialized runtime metadata.",nextStep:"Reinstall or re-attest the skill before running it again."}):{status:"ok",context:n}}async function kt(e){return await Qe(e.backend,{skillSlug:e.skillSlug,version:e.version??e.context.version,action:e.action,decisionStatus:"blocked",reasonCode:e.reasonCode,telemetryMode:e.telemetryMode,path:e.context.installedPath}),{status:"blocked",result:w({status:"blocked",skillSlug:e.skillSlug,version:e.version??e.context.version,reasonCode:e.reasonCode,localPreflight:Se(e.context),unmanaged:e.context.unmanaged,unmanagedPolicy:e.context.unmanagedPolicy,allowUnmanagedOnce:e.context.allowUnmanagedOnce,why:e.why,nextAction:e.nextAction,nextStep:e.nextStep},e.message,e.flags.json,e.reasonCode)}}async function ls(e){let t=cs(p(e.flags.unmanagedPolicy)),n=e.unmanagedPolicy??(t.status==="valid"?t.policy:"warn"),i=p(e.flags.path),r=await Rc(e.skillSlug,e.backend),s=i?K(e.backend.cwd,i):r?.installedPath;return{source:i?"explicit_path":r?.source??"install_index",status:i?"ok":r?.status,reasonCode:i?void 0:r?.reasonCode,installedPath:s,archivePath:i?void 0:r?.archivePath,installedPathSource:i?"explicit_path":r?.installedPathSource,version:p(e.flags.version)??r?.version,record:r?.record,unmanaged:!!(i&&!r),unmanagedPolicy:n,allowUnmanagedOnce:e.flags.allowUnmanagedOnce}}async function Rc(e,t){let i=(await Ce(t)).installs[e];if(i){let r=yr(i,t);return{source:"install_index",installedPath:r.installedPath,archivePath:r.archivePath,installedPathSource:r.installedPathSource,status:r.status,reasonCode:r.reasonCode,version:l(i,"version"),record:i}}for(let r of $c(t)){let s=await D(r);if(!R(s)||!R(s.installs))continue;let o=s.installs[e];if(R(o)){let a=yr(o,t);return{source:"lockfile",installedPath:a.installedPath,archivePath:a.archivePath,installedPathSource:a.installedPathSource,status:a.status,reasonCode:a.reasonCode,version:l(o,"version"),record:o}}}return null}function $c(e){return Array.from(new Set([E(e.cwd,"skills-layer-lock.json"),E(e.paths.stateDir,"skills-layer-lock.json")]))}function yr(e,t){let n=l(e,"materializedSkillRoot");if(n)return{installedPath:wt(K(t.cwd,n)),installedPathSource:"materializedSkillRoot",status:"ok"};let i=l(e,"canonicalPath");if(i)return{installedPath:wt(K(t.cwd,i)),installedPathSource:"canonicalPath",status:"ok"};let r=l(e,"path");if(r)return{installedPath:wt(K(t.cwd,r)),installedPathSource:"path",status:"ok"};let s=l(e,"materializedPath")??l(e,"bundlePath");if(s){let u=K(t.cwd,s),d=V(u).toLowerCase()==="bundle.zip"||u.toLowerCase().endsWith(".zip");return{installedPath:d?ne(ne(u)):wt(u),archivePath:d?u:void 0,installedPathSource:l(e,"materializedPath")?"materializedPath":"bundlePath",status:d?"degraded":"ok",reasonCode:d?"installed_skill_root_missing":void 0}}let a=(Array.isArray(e.materializedWrites)?e.materializedWrites.filter(R):[]).find(u=>{let d=l(u,"path");return d?.toLowerCase().endsWith("/skill.md")||d?.toLowerCase()==="skill.md"}),c=a?l(a,"path"):void 0;return{installedPath:c?ne(K(t.cwd,c)):void 0,installedPathSource:c?"materializedWrites":void 0,status:c?"ok":void 0}}function wt(e){return V(e).toLowerCase()==="skill.md"?ne(e):e}async function Ac(e,t){let n=E(t,"SKILL.md");if(!await ce(n))return{status:"not_checked",reasonCode:"skill_document_unavailable",expectedSkillSlug:e,reattestationRequired:!1};try{let i=Jr(await it(n,"utf8"));return i?i!==e?{status:"mismatch",reasonCode:"skill_identity_mismatch",expectedSkillSlug:e,observedSkillName:i,skillDocumentPath:n,reattestationRequired:!0}:{status:"matched",expectedSkillSlug:e,observedSkillName:i,skillDocumentPath:n,reattestationRequired:!1}:{status:"not_checked",reasonCode:"skill_identity_metadata_unavailable",expectedSkillSlug:e,skillDocumentPath:n,reattestationRequired:!1}}catch(i){return{status:"invalid",reasonCode:"skill_identity_unreadable",expectedSkillSlug:e,skillDocumentPath:n,message:Z(i),reattestationRequired:!0}}}async function Ic(e,t){let n=E(t,".skills-layer-runtime.json"),i=await D(n),r=i?P(i,"materialization"):void 0,s=r?l(r,"skillDocumentSha256"):void 0;if(!i||!s)return{status:"not_checked",reasonCode:"runtime_metadata_unavailable",skillSlug:e,reattestationRequired:!1};let o=E(t,"SKILL.md");if(!await ce(o))return{status:"changed",reasonCode:"installed_artifact_changed",skillSlug:e,expectedSkillDocumentSha256:s,reattestationRequired:!0};let a=ys(await it(o,"utf8")),c=a===s;return{status:c?"unchanged":"changed",reasonCode:c?"installed_artifact_matches":"installed_artifact_changed",skillSlug:e,expectedSkillDocumentSha256:s,observedSkillDocumentSha256:a,reattestationRequired:!c}}function Se(e){return x({source:e.source,status:e.status,reasonCode:e.reasonCode,installedPath:e.installedPath,archivePath:e.archivePath,installedPathSource:e.installedPathSource,version:e.version,unmanaged:e.unmanaged,unmanagedPolicy:e.unmanagedPolicy,allowUnmanagedOnce:e.allowUnmanagedOnce,identityAssessment:e.identityAssessment,driftAssessment:e.driftAssessment})}function cs(e){if(e===void 0||e.trim()==="")return{status:"valid",policy:"warn"};let t=e.trim().toLowerCase();return t==="allow"||t==="warn"||t==="block"?{status:"valid",policy:t}:{status:"invalid",message:"guardian check --unmanaged-policy must be one of: allow, warn, block."}}function bn(e,t){let n=p(e)??t;return n==="cloud_managed"||n==="local_only"?{status:"valid",mode:n}:{status:"invalid",message:"guardian --telemetry-mode must be one of: cloud_managed, local_only."}}function jc(e,t){let n=Tt(e.actionJson,"action-json");return n&&typeof n=="object"&&!Array.isArray(n)?n:{type:"shell_command",command:V(t[0]??"command")}}function Ec(e){let t=P(e,"enforcement");return typeof t?.canExecute=="boolean"?t.canExecute:xt(e)!=="blocked"}async function Lc(e,t){let[n,...i]=e;return await new Promise((r,s)=>{let o=Ir(n,i,{cwd:t.cwd,env:{...process.env,...t.env},stdio:["ignore","pipe","pipe"]}),a="",c="";o.stdout?.setEncoding("utf8"),o.stderr?.setEncoding("utf8"),o.stdout?.on("data",u=>{a=kr(`${a}${u}`)}),o.stderr?.on("data",u=>{c=kr(`${c}${u}`)}),o.on("error",s),o.on("close",u=>{r({executable:V(n),argsCount:i.length,exitCode:typeof u=="number"?u:1,stdout:a,stderr:c})})})}function kr(e){return e.length>2e4?`${e.slice(0,2e4)}
|
|
1248
|
+
[output truncated]`:e}function Uc(e){let t=[e.exitCode===0?"OK Guardian guarded execution complete.":"Guardian guarded execution finished with a command error.","","Command",` executable: ${e.executable}`,` args count: ${e.argsCount}`,` exit code: ${e.exitCode}`];return e.stdout&&t.push("","Stdout",e.stdout),e.stderr&&t.push("","Stderr",e.stderr),t.join(`
|
|
1249
|
+
`)}function us(e){let t=p(e)??"project";return t==="project"||t==="global"?{status:"valid",scope:t}:{status:"invalid",message:"guardian hooks --scope must be one of: project, global."}}function ds(e){return E(e.paths.stateDir,"guardian-modes.json")}function ps(e){return E(e.paths.stateDir,"setup-state.json")}async function Dn(e){let t=await D(ds(e));return{version:1,skills:R(t?.skills)?t.skills:{}}}async function Tc(e,t,n){let i=await Dn(e);await W(ds(e),{version:1,skills:{...i.skills,[t]:{requestedPreference:l(n,"requestedPreference")??"enforce",effectiveMode:l(n,"effectiveMode")??"enforce",reasonCode:l(n,"reasonCode"),auditId:l(n,"auditId"),updatedAt:e.now()}}})}async function Gn(e,t){let i=(await Dn(e)).skills[t];return i?l(i,"requestedPreference"):void 0}async function Nc(e,t){return(await Dn(e)).skills[t]}async function Vn(e){let t=await D(ps(e));return R(t)?{version:1,setupChoice:l(t,"setupChoice"),mcpChoice:l(t,"mcpChoice"),mcpPromptedAt:l(t,"mcpPromptedAt"),guardianHookChoice:l(t,"guardianHookChoice"),guardianHookPromptedAt:l(t,"guardianHookPromptedAt"),remindAfter:l(t,"remindAfter")}:null}async function wr(e,t){await W(ps(e),t)}function Fc(e,t,n){let i=t==="global"?e.targets.globalRoot:e.targets.projectRoot;return i?e.id==="codex"?{agent:e.id,agentName:e.displayName,scope:t,hookId:ye,hookName:ie,configPath:E(i,"hooks.json"),hookPath:E(i,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook",strictPreActionBlocking:!0}:e.id==="claude-code"?{agent:e.id,agentName:e.displayName,scope:t,hookId:ye,hookName:ie,configPath:E(i,"settings.json"),hookPath:E(i,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook",strictPreActionBlocking:!0}:e.id==="cline"?{agent:e.id,agentName:e.displayName,scope:t,hookId:ye,hookName:ie,configPath:E(i,"guardian-hooks.json"),hookPath:E(i,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook_candidate",strictPreActionBlocking:!1}:null:null}async function Bc(e,t){if(await le(e.hookPath,Kc(e.agentName)),await Er(e.hookPath,448).catch(()=>{}),e.agent==="codex"){await W(e.configPath,Mc(e.hookPath));return}if(e.agent==="claude-code"){await W(e.configPath,qc(e.hookPath));return}e.agent==="cline"&&await W(e.configPath,Oc(e,t))}function gs(e,t){return t==="global"?E(e.paths.stateDir,"guardian-hooks.json"):E(e.cwd,".skills-layer","guardian-hooks.json")}async function ms(e){let t=await D(e);return{version:1,hooks:Array.isArray(t?.hooks)?t.hooks.filter(R):[]}}function vr(e,t,n){return Ue.isAbsolute(n)||n.startsWith("/")?n:Ur(t==="global"?e.paths.stateDir:e.cwd,n)}function Mc(e){return{hooks:{PreToolUse:[{name:ie,id:ye,matcher:"Bash|Shell|Read|Write|Edit|apply_patch|mcp__.*",hooks:[{name:ie,type:"command",command:`node ${Hn(e)}`}]}]}}}function qc(e){return{hooks:{PreToolUse:[{name:ie,id:ye,matcher:"Bash|Read|Write|Edit|MultiEdit|NotebookEdit|WebFetch|WebSearch",hooks:[{name:ie,type:"command",command:`node ${Hn(e)}`}]}]}}}function Oc(e,t){return{version:1,hookId:ye,hookName:ie,agent:e.agent,agentName:e.agentName,scope:e.scope,enforcementLayer:e.enforcementLayer,strictPreActionBlocking:e.strictPreActionBlocking,installedAt:t.now(),hooks:[{name:ie,id:ye,event:"PreToolUse",command:`node ${Hn(e.hookPath)}`,status:"candidate"}]}}function Kc(e){return`#!/usr/bin/env node
|
|
1048
1250
|
import { spawnSync } from "node:child_process";
|
|
1049
1251
|
import { readFileSync } from "node:fs";
|
|
1050
1252
|
|
|
@@ -1079,41 +1281,41 @@ const result = spawnSync("skills-layer", [
|
|
|
1079
1281
|
], { stdio: ["ignore", "inherit", "inherit"] });
|
|
1080
1282
|
|
|
1081
1283
|
process.exit(result.status ?? 1);
|
|
1082
|
-
`}function
|
|
1083
|
-
`;return await
|
|
1084
|
-
`),await
|
|
1085
|
-
`),await
|
|
1086
|
-
`)),{status:"written",generatedAt:t,incidentPath:r,writtenFiles:[n,i,r]}}function
|
|
1087
|
-
`,{encoding:"utf8",mode:384}),await
|
|
1284
|
+
`}function Hn(e){return JSON.stringify(e)}async function zn(e){let t=E(ne(e.skillDocumentPath),".skills-layer-runtime.json"),n={version:1,generatedAt:e.backend.now(),skillSlug:e.skillSlug,sourceProvider:{id:"skills-layer",name:"Skills Layer",managedBy:"skills-layer-cli"},...e.version?{skillVersion:e.version}:{},guardian:{required:!0,enforcementLayer:"cloud_guardian_with_local_preflight",strictPreActionBlocking:!1,checkCommand:`skills-layer guardian check --skill ${e.skillSlug} --json`,incidentCommand:`skills-layer guardian incident ${e.skillSlug} --path <installed-skill-path> --telemetry-mode local_only --json`,guardedExecutorCommand:`skills-layer guardian exec ${e.skillSlug} --json -- <command>`,mcpCheckTool:"guardian.check",mcpEnforceTool:"guardian.enforce",agentCommandMatrix:Wt({purpose:"materialize_skill",command:`skills-layer install ${e.skillSlug}`,jsonCommand:`skills-layer install ${e.skillSlug} --json`,skillSlug:e.skillSlug}),agentGuidance:"MCP-capable agents should call guardian.check or guardian.enforce before risky tool use. Local host hooks should call skills-layer guardian check, and shell actions that need strict wrapping should use skills-layer guardian exec.",sensitiveActionFamilies:["shell_command","network_request","file_read","file_write","secret_read","browser_action","device_action","api_call","generated_code_execution","model_context_promotion"]},materialization:{skillDocumentPath:"SKILL.md",skillDocumentSha256:ys(e.skillDocumentContent)}},i=`${JSON.stringify(n,null,2)}
|
|
1285
|
+
`;return await le(t,i),{path:Ct(e.backend.cwd,t),bytes:new TextEncoder().encode(i).length}}async function Dc(e){return await ce(E(e,".skills-layer-disabled.json"))}async function br(e){let t=e.backend.now(),n=E(e.installedPath,".skills-layer-disabled.json"),i=E(e.installedPath,".skills-layer-quarantine.json"),r=E(e.installedPath,"incident.md"),s=l(e.action,"type")??"unknown";return await le(n,`${JSON.stringify({disabled:!0,generatedAt:t,skillSlug:e.skillSlug,version:e.version,reason:"Skills Layer Guardian incident response"},null,2)}
|
|
1286
|
+
`),await le(i,`${JSON.stringify({generatedAt:t,skillSlug:e.skillSlug,version:e.version,actions:["disable_skill","quarantine_files","preserve_evidence","generate_incident_report","rescan_before_reenable"],quarantineTargets:[e.installedPath]},null,2)}
|
|
1287
|
+
`),await le(r,["# Skills Layer Guardian Incident Report","",`Generated: ${t}`,`Skill: ${e.skillSlug}`,`Version: ${e.version}`,"","## Summary","",hs(e.reason),"","## Evidence","",`- ${t}: ${s} -> blocked (incident_recorded)`].join(`
|
|
1288
|
+
`)),{status:"written",generatedAt:t,incidentPath:r,writtenFiles:[n,i,r]}}function Sr(e,t){let n=e.now().replace(/[:.]/gu,"-");return E(e.paths.incidentsDir,`${t}-${n}.json`)}async function Qe(e,t){let n=E(e.paths.stateDir,"guardian-audit.jsonl");await Es(ne(n));let i={version:1,generatedAt:e.now(),skillSlug:t.skillSlug,...t.version?{skillVersion:t.version}:{},actionType:l(t.action,"type")??"unknown",actionTarget:Gc(t.action),decisionStatus:t.decisionStatus,reasonCode:t.reasonCode,telemetryMode:t.telemetryMode,...t.path?{localPath:fs(t.path)}:{}};await Wo(n,`${JSON.stringify(i)}
|
|
1289
|
+
`,{encoding:"utf8",mode:384}),await Zn(n,384)}function xt(e){let t=P(e,"decision"),n=P(e,"enforcement"),i=l(t??{},"status")??l(n??{},"status")??l(e,"status");return i==="allowed"||i==="advisory"?i:"blocked"}function Sn(e){let t=P(e,"decision");return l(t??{},"reasonCode")??l(e,"reasonCode")??l(e,"status")??"cloud_guardian_decision"}function Gc(e){let t=l(e,"type");if(t==="secret_read")return"redacted_secret";if(t==="shell_command")return"redacted_command";let n=l(e,"url");if(n)try{return new URL(n).origin}catch{return"redacted_url"}let i=l(e,"target");if(i)return hs(i);let r=l(e,"path");return r?fs(r):null}function fs(e){let t=V(e.trim());return t?`<local-path>/${t}`:"<local-path>"}function hs(e){return e.replace(/sk-[A-Za-z0-9_-]+/gu,"[redacted-secret]").replace(/[A-Z0-9_]*SECRET[A-Z0-9_]*/gu,"[redacted-secret]").replace(/[A-Z0-9_]*TOKEN[A-Z0-9_]*/gu,"[redacted-token]").replace(/[A-Z0-9_]*KEY[A-Z0-9_]*/gu,"[redacted-key]")}function Pr(e){return e.split(/[\\/]+/u).join("/")}function ys(e){return $n("sha256").update(e).digest("hex")}async function ks(e,t,n,i,r){let s=await S(i,"/api/v1/verify",{method:"POST",headers:j(),body:JSON.stringify({email:e,code:t,clientDelivery:"cli_secure_storage"})});if(n.json){let o=l(s,"apiKey");return o?(await et(i,o,{expectedEmail:e,knownEmail:l(s,"email")??e,knownRole:l(s,"role")??"user",knownRoles:se(s,"roles"),knownUserId:l(s,"userId")}),h(G({...s,loggedIn:!0}),"Email verified and login completed.",!0,i)):h(G({...s,email:e,loggedIn:!1,nextCommand:`skills-layer login --method email --email ${e}`,nextAction:"login"}),"Email verified. Login still needs to be completed.",!0,i)}return await It(e,s,n,i,r)}async function It(e,t,n,i,r){let s=l(t,"apiKey"),o=l(t,"role")??"user",a=se(t,"roles"),c=l(t,"userId"),u=s;if(!u&&n.json)return h(G({...t,email:e,role:o,...a?{roles:a}:{},loggedIn:!1}),`${r} Login still needs to be completed through a human handoff.`,!0,i);if(!u)try{u=(await i.promptSecret(`Enter the API key emailed to ${e} (check spam/junk folder if missing): `)).trim()}catch{return h(G({...t,email:e,role:o,...a?{roles:a}:{},loggedIn:!1}),`${r} Check your email (including spam/junk folder) for the API key, then run \`skills-layer login\` to finish signing in.`,n.json,i)}if(!u)return k("No API key was entered. Run `skills-layer login` once you have the emailed key.",n.json);let d=await et(i,u,{expectedEmail:e,knownEmail:e,knownRole:o,knownRoles:a,knownUserId:c,forceProfileValidation:!s}),g=await yn(n,{...i,config:d,apiKey:u});return J(g)?g:h(G({...t,status:l(t,"status")??"verified",email:d.email,role:d.role,...d.roles?{roles:d.roles}:{},loggedIn:!0,...g.data?{mcp:g.data}:{}}),[`${r} Logged in as ${d.email}.`,g.message??""].filter(Boolean).join(" "),n.json,i)}async function Wn(e,t,n,i,r){let s=l(t,"authorizationUrl"),o=b(l(t,"state"),"Social auth did not return a state."),a=ad(e);if(n.noOpen)return h({...t,status:"human_handoff",handoff:{kind:"browser_auth",provider:e,authorizationUrl:s,state:o,nextAction:"open_browser",nextStep:`Open the ${a} sign-in URL, finish authentication, then run \`skills-layer login\` again if needed.`}},`${a} sign-in started. Open the browser handoff URL to continue.`,n.json,i);if(s){let u=await i.openUrl(s);i.emitInfo(u?`${a} sign-in started. Finish the login in your browser, then come back here. Waiting for browser sign-in to finish...`:`${a} sign-in started. Open this URL in your browser, then come back here once it is done:
|
|
1088
1290
|
${s}
|
|
1089
|
-
Waiting for browser sign-in to finish...`)}else i.emitInfo(`${l} sign-in started. Finish the login in your browser, then come back here. Waiting for browser sign-in to finish...`);let c=await Cl(o,i);return H(c)?c:c.status==="verified"||c.status==="recovered"?await dt(c.email,{...c},n,i,r==="recovery"?`Recovered access for ${c.email} through ${l}.`:`Verified ${c.email} through ${l}.`):c.status==="already_registered"?h(c,c.linkedAccount===!0?`${l} is now linked to ${c.email}. Run \`skills-layer login\` to sign in.`:`${c.email} is already registered. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,n.json,i):c.status==="linked"?h(c,`${l} sign-in is now connected.`,n.json,i):Pl(c)?k(_l(c),n.json):k("Social auth completed with an unexpected response.",n.json)}function H(e){return $(e)&&typeof e.exitCode=="number"&&typeof e.stdout=="string"&&typeof e.stderr=="string"}function Sl(e){try{let t=JSON.parse(e);return $(t)?t.data:void 0}catch{return}}function Pl(e){return e.status==="registration_required"||e.status==="state_expired"||e.status==="provider_mismatch"||e.status==="identity_conflict"||e.status==="email_required"||e.status==="failed"}async function Cl(e,t){for(let n=0;n<120;n+=1)try{let i=await b(t,`/api/v1/identity/social/status/${encodeURIComponent(e)}`),r=a(i,"status")??"failed";if(r==="pending"){await t.sleep(1500);continue}return(r==="verified"||r==="recovered")&&a(i,"email")&&a(i,"role")?{status:r,email:a(i,"email"),role:a(i,"role"),roles:se(i,"roles"),userId:a(i,"userId"),apiKey:a(i,"apiKey"),keyPrefix:a(i,"keyPrefix"),emailDelivery:a(i,"emailDelivery")}:r==="already_registered"&&a(i,"email")&&a(i,"role")?{status:r,email:a(i,"email"),role:a(i,"role"),roles:se(i,"roles"),linkedAccount:typeof i.linkedAccount=="boolean"?i.linkedAccount:void 0}:r==="linked"?{status:r}:r==="registration_required"||r==="state_expired"||r==="provider_mismatch"||r==="identity_conflict"||r==="email_required"||r==="failed"?{status:r,error:a(i,"error")}:k("Social auth completed with an unexpected response.",!1)}catch(i){if(i instanceof A&&(i.status===404||i.status===429)){await t.sleep(1500);continue}return k(ae(i),!1)}return k("Timed out while waiting for social auth to complete.",!1)}async function Rl(e,t){for(let n=0;n<120;n+=1)try{let r=(await b(t,"/api/v1/purchases",{headers:B(t.apiKey,t.authBlockedMessage)})).results?.find(s=>s.purchaseId===e);if(!r?.status||r.status==="pending"||r.status==="requires_action"){await t.sleep(1500);continue}return{status:r.status,purchaseId:e}}catch(i){if(i instanceof A&&i.status===429){await t.sleep(1500);continue}return k(ae(i),!1)}return k("Timed out while waiting for purchase confirmation.",!1)}async function xl(e,t){for(let n=0;n<120;n+=1)try{let i=await b(t,`/api/v1/me/private-skill-charges/${encodeURIComponent(e)}`,{headers:B(t.apiKey,t.authBlockedMessage)}),r=a(i,"status");if(!r||r==="checkout_required"||r==="pending"||r==="requires_action"){await t.sleep(1500);continue}return{...i,status:r}}catch(i){if(i instanceof A&&i.status===429){await t.sleep(1500);continue}return k(ae(i),!1)}return k("Timed out while waiting for payment confirmation.",!1)}function $l(e){let t=S(e,"accountLink");return(t?a(t,"url"):void 0)??a(e,"url")??a(e,"setupUrl")}function _l(e){return e.status==="registration_required"?e.error??"No verified account exists for this social identity. Use `skills-layer register` first.":e.status==="state_expired"?"Social auth expired before completion. Start the flow again.":e.status==="provider_mismatch"?"The browser completed a different social provider than the one the CLI started.":e.status==="identity_conflict"?e.error??"This social identity is already linked to another account.":e.status==="email_required"?e.error??"This social profile did not provide an email address.":e.error??"Social auth could not be completed."}async function Oe(e,t,n={}){let r=n.forceProfileValidation===!0||!n.knownEmail||!n.knownRole?await b({...e,apiKey:t},"/api/v1/me",{headers:{...B(t),...n.notifyLogin?{"x-skills-layer-session-intent":"login"}:{}}}):{userId:n.knownUserId,email:n.knownEmail,role:n.knownRole,roles:n.knownRoles},s=a(r,"email")??n.knownEmail??"unknown";if(n.expectedEmail&&s.toLowerCase()!==n.expectedEmail.toLowerCase())throw new Error(`The entered API key belongs to ${s}, not ${n.expectedEmail}. Use the API key emailed to ${n.expectedEmail}.`);let o=await b({...e,apiKey:t},"/api/v1/capabilities",{headers:B(t)}),l={version:Hi,baseUrl:e.baseUrl,apiKey:t,edition:a(o,"edition")??a(r,"edition")??"saas",userId:a(r,"userId")??n.knownUserId,email:s,role:a(r,"role")??n.knownRole??"user",roles:se(r,"roles")??n.knownRoles,lastSelectedAgent:e.config?.lastSelectedAgent,savedAt:e.now()};return await Rn(e.paths.configPath,l,e),await D(e.paths.backendPreferencePath,{version:dn,preferredBaseUrl:e.baseUrl,savedAt:e.now()}),l}function Ti(e,t){let n=ft(e.actionJson,"action-json");if(n&&typeof n=="object"&&!Array.isArray(n))return n;let i=p(e.action);return t==="incident"?{type:"file_write",path:p(e.path)??".skills-layer/incidents/guardian-incident.json"}:i==="file_read"||i==="file_write"?{type:i,path:p(e.path)??"."}:i==="shell_command"?{type:"shell_command",command:"unspecified"}:{type:"api_call",...i?{target:i}:{}}}async function R(e,t,n,i,r={}){let s=r.authenticated?B(n.apiKey,n.authBlockedMessage):He(n.apiKey);return await pt(e,{headers:s},t,n,i)}async function Il(e,t){let n=await b(t,"/api/v1/doctor",{headers:He(t.apiKey)}),i=await De(t),r=await Xa(t),s=[...xr(n),nl(i,r)];return h({...n,guardian:{...i,policy:r},checks:s},"Doctor checks loaded.",e.json,t)}async function K(e,t,n,i,r){return await pt(e,{method:"POST",headers:j(i.apiKey),body:JSON.stringify(x(t))},n,i,r)}async function Fe(e,t,n,i,r){return await pt(e,{method:"PATCH",headers:j(i.apiKey),body:JSON.stringify(x(t))},n,i,r)}async function pt(e,t,n,i,r){let s=await b(i,e,t);return h(s,r,n.json,i)}async function b(e,t,n={}){let i=await e.fetchFn(`${e.baseUrl}${t}`,n).catch(o=>{throw new Error(`Unable to reach ${e.baseUrl}. ${ae(o)}`)});if(!i.ok)throw await jl(i);let r=await i.text();if(!r)return{};let s=JSON.parse(r);return s&&typeof s=="object"&&!Array.isArray(s)&&"data"in s?s.data:s}async function jl(e){let t=await e.text();if(t)try{let n=JSON.parse(t);return new A(e.status,a(n,"error")??(e.statusText||"Request failed"),n)}catch{return new A(e.status,t)}return new A(e.status,e.statusText||"Request failed")}function B(e,t){if(t)throw new A(401,t,{error:t,nextAction:"backend.status",nextStep:t});if(!e)throw new A(401,"Login required.",{error:"Login required.",nextAction:"login",nextStep:"Run `skills-layer login` to sign in, then retry this command."});return{authorization:`Bearer ${e}`}}function He(e){return e?{authorization:`Bearer ${e}`}:{}}function j(e){return{"content-type":"application/json",...He(e)}}async function gt(e){let t=await Ws(e);if(t.isFile())return[{path:G(e),content:await Ge(e,"utf8")}];if(!t.isDirectory())throw new Error(`Unsupported path: ${e}`);let n=[];if(await Sr(e,e,n),n.length===0)throw new Error(`No readable files found in ${e}.`);return n.sort((i,r)=>i.path.localeCompare(r.path))}async function Sr(e,t,n){for(let i of await Vi(t,{withFileTypes:!0})){if(Al(i.name))continue;let r=L(t,i.name);if(i.isDirectory()){await Sr(e,r,n);continue}if(!i.isFile())continue;let s=Me(e,r).split("\\").join("/");try{n.push({path:s,content:await Ge(r,"utf8")})}catch{continue}}}function Al(e){return e===".git"||e==="node_modules"||e==="coverage"||e===Ll()||e==="dist"}function Ll(){return[46,68,83,95,83,116,111,114,101].map(e=>String.fromCharCode(e)).join("")}async function ut(e,t){if(/^https?:\/\//u.test(e)||/^[a-z]+:/iu.test(e))return;let n=J(t,e);try{return await Ki(n),{sourceMetadata:{kind:"local",input:e,canonicalSource:`local:${e}`},files:await gt(n)}}catch{return}}async function Ft(e,t){let n=El(t);if(n.length===0)return t;let i=[];for(let r of n){let s=Pr(r.path),o=J(e.cwd,s),l=Me(e.cwd,o);if(!l||l.startsWith("..")||xe.isAbsolute(l))throw new Error(`Cloud install plan attempted to write outside the current workspace: ${r.path}`);if(await re(o,r.content),i.push({path:s,bytes:new TextEncoder().encode(r.content).length}),G(s).toLowerCase()==="skill.md"){let c=a(t,"skillSlug")??a(t,"slug")??G(ee(s)),u=await Sn({backend:e,skillSlug:c,version:a(t,"version"),skillDocumentPath:o,skillDocumentContent:r.content});i.push(u)}}return{...t,materializedWrites:i}}function El(e){return[...qt(e.localWrites),...qt(S(e,"installPlan")?.localWrites),...qt(S(e,"materializationPlan")?.localWrites)]}function qt(e){return Array.isArray(e)?e.flatMap(t=>{if(!t||typeof t!="object"||Array.isArray(t))return[];let n=t,i=p(n.path),r=typeof n.content=="string"?n.content:void 0;return i&&r!==void 0?[{path:i,content:r}]:[]}):[]}function Pr(e){let t=e.replaceAll("\\","/").replace(/^\.\/+/u,"");if(!t||t.includes("\0")||cn.isAbsolute(t)||xe.isAbsolute(e)||t.split("/").includes(".."))throw new Error(`Cloud install plan returned an unsafe local write path: ${e}`);return t}async function Ul(e,t){let n=a(e,"apiKey");if(!n)return;let i={version:Hi,baseUrl:t.baseUrl,apiKey:n,edition:a(e,"edition")??t.config?.edition??"saas",userId:a(e,"userId")??t.config?.userId,email:a(e,"email")??t.config?.email??"unknown",role:a(e,"role")??t.config?.role??"user",roles:se(e,"roles")??t.config?.roles,lastSelectedAgent:t.config?.lastSelectedAgent,savedAt:t.now()};await Rn(t.paths.configPath,i,t)}async function ke(e){let t=await Y(e.paths.installsPath);if(!$(t))return{version:ai,installs:{}};let n=$(t.installs)?Bi(t.installs):$(t.skills)?Bi(t.skills):{};return{version:typeof t.version=="number"?t.version:ai,installs:n}}async function Cr(e,t){await D(e.paths.installsPath,t)}async function at(e,t,n){let i=a(t,"skillSlug")??a(t,"slug")??n,r=await ke(e);r.installs[i]={skillSlug:i,...t,savedAt:e.now()},await Cr(e,r)}function Bi(e){let t={};for(let[n,i]of Object.entries(e))t[n]=$(i)?i:{skillSlug:n,value:i};return t}var T=5;function h(e,t,n,i){let s={status:e&&typeof e=="object"&&!Array.isArray(e)&&typeof e.status=="string"?String(e.status):"ok",summary:t,why:null,nextAction:null,nextStep:null,data:e,warnings:[],links:[],reasonCode:null,handoff:null};return{exitCode:0,stdout:n?JSON.stringify(s,null,2):Tl(e,t,i),stderr:""}}function Tl(e,t,n){let i=Z(n);if($(e)){if(t==="Status loaded."&&Ni(e))return Fl(e,t,i);if(t==="Doctor checks loaded."&&Ni(e))return ql(e,t,i);if(t==="Creator payout profile loaded.")return ac(e,t,i);if(t==="Creator earnings loaded."||t==="Earnings loaded.")return lc(e,"Creator earnings loaded.",i);if(t==="Creator payouts loaded."||t==="Payouts loaded.")return cc(e,"Creator payouts loaded.",i);if(t==="Guardian check complete.")return Ml(e,t,i);if(t==="Reviews loaded.")return Nl(e,t,i);if(t==="Categories loaded.")return Bl(e,t,i)}let r=[`${i.ok("OK")} ${t}`];if($(e)){let s=Ir(e,i);s.length>0&&r.push("",...s);let o=Ur(e);o.length>0&&r.push("",i.section("Next"),...o.map(l=>` ${i.arrow} ${l}`))}return r.join(`
|
|
1090
|
-
`)}function
|
|
1091
|
-
`)):(i.slice(0,
|
|
1092
|
-
`))}function
|
|
1093
|
-
`)}function
|
|
1094
|
-
`)}function
|
|
1095
|
-
`)}function
|
|
1096
|
-
`)}function
|
|
1097
|
-
`)}function
|
|
1098
|
-
`)}function
|
|
1099
|
-
`)}function
|
|
1100
|
-
`)}function
|
|
1101
|
-
`)}function
|
|
1102
|
-
`)}function
|
|
1103
|
-
`)}function
|
|
1104
|
-
`)}function
|
|
1105
|
-
`)}function
|
|
1106
|
-
`,{encoding:"utf8",mode:384}),await
|
|
1107
|
-
`),m())},f=m=>{let y=typeof m=="string"?m:m.toString("utf8");for(let
|
|
1108
|
-
`){g(()=>s(u.trim()));return}if(
|
|
1109
|
-
`){let
|
|
1110
|
-
`).length;
|
|
1111
|
-
`),s.trim()}finally{r.close()}}}function
|
|
1112
|
-
`);for(let[_,
|
|
1291
|
+
Waiting for browser sign-in to finish...`)}else i.emitInfo(`${a} sign-in started. Finish the login in your browser, then come back here. Waiting for browser sign-in to finish...`);let c=await zc(o,i);return J(c)?c:c.status==="verified"||c.status==="recovered"?await It(c.email,{...c},n,i,r==="recovery"?`Recovered access for ${c.email} through ${a}.`:`Verified ${c.email} through ${a}.`):c.status==="already_registered"?h(c,c.linkedAccount===!0?`${a} is now linked to ${c.email}. Run \`skills-layer login\` to sign in.`:`${c.email} is already registered. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,n.json,i):c.status==="linked"?h(c,`${a} sign-in is now connected.`,n.json,i):Hc(c)?k(Zc(c),n.json):k("Social auth completed with an unexpected response.",n.json)}function J(e){return R(e)&&typeof e.exitCode=="number"&&typeof e.stdout=="string"&&typeof e.stderr=="string"}function Vc(e){try{let t=JSON.parse(e);return R(t)?t.data:void 0}catch{return}}function Hc(e){return e.status==="registration_required"||e.status==="state_expired"||e.status==="provider_mismatch"||e.status==="identity_conflict"||e.status==="email_required"||e.status==="failed"}async function zc(e,t){for(let n=0;n<120;n+=1)try{let i=await S(t,`/api/v1/identity/social/status/${encodeURIComponent(e)}`),r=l(i,"status")??"failed";if(r==="pending"){await t.sleep(1500);continue}return(r==="verified"||r==="recovered")&&l(i,"email")&&l(i,"role")?{status:r,email:l(i,"email"),role:l(i,"role"),roles:se(i,"roles"),userId:l(i,"userId"),apiKey:l(i,"apiKey"),keyPrefix:l(i,"keyPrefix"),emailDelivery:l(i,"emailDelivery")}:r==="already_registered"&&l(i,"email")&&l(i,"role")?{status:r,email:l(i,"email"),role:l(i,"role"),roles:se(i,"roles"),linkedAccount:typeof i.linkedAccount=="boolean"?i.linkedAccount:void 0}:r==="linked"?{status:r}:r==="registration_required"||r==="state_expired"||r==="provider_mismatch"||r==="identity_conflict"||r==="email_required"||r==="failed"?{status:r,error:l(i,"error")}:k("Social auth completed with an unexpected response.",!1)}catch(i){if(i instanceof A&&(i.status===404||i.status===429)){await t.sleep(1500);continue}return k(Z(i),!1)}return k("Timed out while waiting for social auth to complete.",!1)}async function Wc(e,t){for(let n=0;n<120;n+=1)try{let r=(await S(t,"/api/v1/purchases",{headers:T(t.apiKey,t.authBlockedMessage)})).results?.find(s=>s.purchaseId===e);if(!r?.status||r.status==="pending"||r.status==="requires_action"){await t.sleep(1500);continue}return{status:r.status,purchaseId:e}}catch(i){if(i instanceof A&&i.status===429){await t.sleep(1500);continue}return k(Z(i),!1)}return k("Timed out while waiting for purchase confirmation.",!1)}async function Jc(e,t){for(let n=0;n<120;n+=1)try{let i=await S(t,`/api/v1/me/private-skill-charges/${encodeURIComponent(e)}`,{headers:T(t.apiKey,t.authBlockedMessage)}),r=l(i,"status");if(!r||r==="checkout_required"||r==="pending"||r==="requires_action"){await t.sleep(1500);continue}return{...i,status:r}}catch(i){if(i instanceof A&&i.status===429){await t.sleep(1500);continue}return k(Z(i),!1)}return k("Timed out while waiting for payment confirmation.",!1)}function Yc(e){let t=P(e,"accountLink");return(t?l(t,"url"):void 0)??l(e,"url")??l(e,"setupUrl")}function Zc(e){return e.status==="registration_required"?e.error??"No verified account exists for this social identity. Use `skills-layer register` first.":e.status==="state_expired"?"Social auth expired before completion. Start the flow again.":e.status==="provider_mismatch"?"The browser completed a different social provider than the one the CLI started.":e.status==="identity_conflict"?e.error??"This social identity is already linked to another account.":e.status==="email_required"?e.error??"This social profile did not provide an email address.":e.error??"Social auth could not be completed."}async function et(e,t,n={}){let r=n.forceProfileValidation===!0||!n.knownEmail||!n.knownRole?await S({...e,apiKey:t},"/api/v1/me",{headers:{...T(t),...n.notifyLogin?{"x-skills-layer-session-intent":"login"}:{}}}):{userId:n.knownUserId,email:n.knownEmail,role:n.knownRole,roles:n.knownRoles},s=l(r,"email")??n.knownEmail??"unknown";if(n.expectedEmail&&s.toLowerCase()!==n.expectedEmail.toLowerCase())throw new Error(`The entered API key belongs to ${s}, not ${n.expectedEmail}. Use the API key emailed to ${n.expectedEmail}.`);let o=await S({...e,apiKey:t},"/api/v1/capabilities",{headers:T(t)}),a={version:Tr,baseUrl:e.baseUrl,apiKey:t,edition:l(o,"edition")??l(r,"edition")??"saas",userId:l(r,"userId")??n.knownUserId,email:s,role:l(r,"role")??n.knownRole??"user",roles:se(r,"roles")??n.knownRoles,lastSelectedAgent:e.config?.lastSelectedAgent,savedAt:e.now()};return await Yn(e.paths.configPath,a,e),await W(e.paths.backendPreferencePath,{version:Ln,preferredBaseUrl:e.baseUrl,savedAt:e.now()}),a}function Cr(e,t){let n=Tt(e.actionJson,"action-json");if(n&&typeof n=="object"&&!Array.isArray(n))return n;let i=p(e.action);return t==="incident"?{type:"file_write",path:p(e.path)??".skills-layer/incidents/guardian-incident.json"}:i==="file_read"||i==="file_write"?{type:i,path:p(e.path)??"."}:i==="shell_command"?{type:"shell_command",command:"unspecified"}:{type:"api_call",...i?{target:i}:{}}}async function $(e,t,n,i,r={}){let s=r.authenticated?T(n.apiKey,n.authBlockedMessage):Ne(n.apiKey);return await Et(e,{headers:s},t,n,i)}async function Qc(e,t){if(e.deep)return await Xc(e,t);let n=await S(t,"/api/v1/doctor",{headers:Ne(t.apiKey)}),i=await Te(t),r=await Sc(t),s=[...Ps(n),_c(i,r)];return h({...n,guardian:{...i,policy:r},checks:s},"Doctor checks loaded.",e.json,t)}async function Xc(e,t){let n;try{let c=await S(t,"/api/v1/status",{headers:Ne(t.apiKey)});n=me("ok","backend_reachable","status","Backend status loaded.",{baseUrl:t.baseUrl,edition:l(c,"edition"),capabilityCount:Array.isArray(c.capabilities)?c.capabilities.length:void 0})}catch(c){n=me("error","backend_unreachable","backend.status","Selected backend could not be reached.",{baseUrl:t.baseUrl,error:Z(c)})}let i=t.config?.credentialStorage??(t.apiKey?"local_file_locked":"none"),r=await D(t.paths.mcpConfigPath),s=await Te(t),o=ke(t.env,t.platform,t.cwd).map(c=>({id:c.id,displayName:c.displayName,capabilities:c.capabilities})),a={backend:n,auth:t.apiKey?me("ok","authenticated","whoami","A local session is available for the selected backend.",{email:t.config?.email,role:t.config?.role,savedLoginMatchesSelectedBackend:!0}):me("login_required","login_required","login","No usable local session is available for the selected backend.",{savedLoginMatchesSelectedBackend:t.config?.baseUrl?te(t.config.baseUrl)===t.baseUrl:!0}),credentialStorage:me(i==="none"?"not_configured":"ok",i==="none"?"credential_storage_not_configured":"credential_storage_ready",i==="none"?"login":"auth.status",i==="none"?"Run `skills-layer login` to create a secure local session.":"Credential storage metadata is present.",{credentialStorage:i,configPath:t.paths.configPath}),mcp:r?me("configured","mcp_configured","mcp.verify","MCP is configured locally; verify from a fresh agent session if tools are not visible.",{clientId:l(r,"clientId"),clientIds:Array.isArray(r.clientIds)?r.clientIds:void 0,mcpUrl:l(r,"mcpUrl")}):me("not_configured","mcp_not_configured","mcp.setup","Run `skills-layer mcp setup` or `skills-layer setup` to configure MCP."),guardianHooks:me(l(s,"enforcementLayer")==="not_installed"?"not_installed":"ok",l(s,"enforcementLayer")==="not_installed"?"guardian_hook_not_installed":"guardian_hook_installed","guardian.hook.status",l(s,"enforcementLayer")==="not_installed"?"Cloud Guardian checks work when called, but local pre-action hooks are not installed.":"At least one Skills Layer Security Hook is installed.",s),localPaths:me("ok","local_paths_resolved","doctor.deep","Local Skills Layer paths resolved.",{stateDir:t.paths.stateDir,configPath:t.paths.configPath,installsPath:t.paths.installsPath,mcpConfigPath:t.paths.mcpConfigPath}),agentTargets:me("ok","agent_targets_loaded","agents.list","Supported local agent targets loaded.",{count:o.length,results:o})};return h({status:"ok",deep:!0,sections:a,nextAction:t.apiKey?"status":"login",nextStep:t.apiKey?"Run `skills-layer status --json` for Cloud journey readiness.":"Run `skills-layer login` to sign in, then rerun `skills-layer doctor --deep --json`."},"Deep doctor diagnostics loaded.",e.json,t)}function me(e,t,n,i,r={}){return x({status:e,reasonCode:t,nextAction:n,nextStep:i,...r})}async function O(e,t,n,i,r){return await Et(e,{method:"POST",headers:j(i.apiKey),body:JSON.stringify(x(t))},n,i,r)}async function jt(e,t,n,i,r){return await Et(e,{method:"PATCH",headers:j(i.apiKey),body:JSON.stringify(x(t))},n,i,r)}async function Et(e,t,n,i,r){let s=await S(i,e,t);return h(s,r,n.json,i)}async function S(e,t,n={}){let i=await e.fetchFn(`${e.baseUrl}${t}`,n).catch(o=>{throw new Error(`Unable to reach ${e.baseUrl}. ${Z(o)}`)});if(!i.ok)throw await eu(i);let r=await i.text();if(!r)return{};let s=JSON.parse(r);return s&&typeof s=="object"&&!Array.isArray(s)&&"data"in s?s.data:s}async function eu(e){let t=await e.text();if(t)try{let n=JSON.parse(t);return new A(e.status,l(n,"error")??(e.statusText||"Request failed"),n)}catch{return new A(e.status,t)}return new A(e.status,e.statusText||"Request failed")}function T(e,t){if(t)throw new A(401,t,{error:t,nextAction:"backend.status",nextStep:t});if(!e)throw new A(401,"Login required.",{error:"Login required.",nextAction:"login",nextStep:"Run `skills-layer login` to sign in, then retry this command."});return{authorization:`Bearer ${e}`}}function Ne(e){return e?{authorization:`Bearer ${e}`}:{}}function j(e){return{"content-type":"application/json",...Ne(e)}}async function Lt(e){let t=await Jo(e);if(t.isFile())return[{path:V(e),content:await it(e,"utf8")}];if(!t.isDirectory())throw new Error(`Unsupported path: ${e}`);let n=[];if(await ws(e,e,n),n.length===0)throw new Error(`No readable files found in ${e}.`);return n.sort((i,r)=>i.path.localeCompare(r.path))}async function ws(e,t,n){for(let i of await Lr(t,{withFileTypes:!0})){if(tu(i.name))continue;let r=E(t,i.name);if(i.isDirectory()){await ws(e,r,n);continue}if(!i.isFile())continue;let s=Xe(e,r).split("\\").join("/");try{n.push({path:s,content:await it(r,"utf8")})}catch{continue}}}function tu(e){return e===".git"||e==="node_modules"||e==="coverage"||e===nu()||e==="dist"}function nu(){return[46,68,83,95,83,116,111,114,101].map(e=>String.fromCharCode(e)).join("")}async function Rt(e,t){if(/^https?:\/\//u.test(e)||/^[a-z]+:/iu.test(e))return;let n=K(t,e);try{return await jr(n),{sourceMetadata:{kind:"local",input:e,canonicalSource:`local:${e}`},files:await Lt(n)}}catch{return}}async function cn(e,t){let n=iu(t);if(n.length===0)return t;let i=[];for(let r of n){let s=vs(r.path),o=K(e.cwd,s),a=Xe(e.cwd,o);if(!a||a.startsWith("..")||Ue.isAbsolute(a))throw new Error(`Cloud install plan attempted to write outside the current workspace: ${r.path}`);if(await le(o,r.content),i.push({path:s,bytes:new TextEncoder().encode(r.content).length}),V(s).toLowerCase()==="skill.md"){let c=l(t,"skillSlug")??l(t,"slug")??V(ne(s)),u=await zn({backend:e,skillSlug:c,version:l(t,"version"),skillDocumentPath:o,skillDocumentContent:r.content});i.push(u)}}return{...t,materializedWrites:i}}function iu(e){return[...un(e.localWrites),...un(P(e,"installPlan")?.localWrites),...un(P(e,"materializationPlan")?.localWrites)]}function un(e){return Array.isArray(e)?e.flatMap(t=>{if(!t||typeof t!="object"||Array.isArray(t))return[];let n=t,i=p(n.path),r=typeof n.content=="string"?n.content:void 0;return i&&r!==void 0?[{path:i,content:r}]:[]}):[]}function vs(e){let t=e.replaceAll("\\","/").replace(/^\.\/+/u,"");if(!t||t.includes("\0")||jn.isAbsolute(t)||Ue.isAbsolute(e)||t.split("/").includes(".."))throw new Error(`Cloud install plan returned an unsafe local write path: ${e}`);return t}async function ru(e,t){let n=l(e,"apiKey");if(!n)return;let i={version:Tr,baseUrl:t.baseUrl,apiKey:n,edition:l(e,"edition")??t.config?.edition??"saas",userId:l(e,"userId")??t.config?.userId,email:l(e,"email")??t.config?.email??"unknown",role:l(e,"role")??t.config?.role??"user",roles:se(e,"roles")??t.config?.roles,lastSelectedAgent:t.config?.lastSelectedAgent,savedAt:t.now()};await Yn(t.paths.configPath,i,t)}async function Ce(e){let t=await D(e.paths.installsPath);if(!R(t))return{version:Fi,installs:{}};let n=R(t.installs)?_r(t.installs):R(t.skills)?_r(t.skills):{};return{version:typeof t.version=="number"?t.version:Fi,installs:n}}async function bs(e,t){await W(e.paths.installsPath,t)}async function Pt(e,t,n){let i=l(t,"skillSlug")??l(t,"slug")??n,r=await Ce(e);r.installs[i]={skillSlug:i,...t,savedAt:e.now()},await bs(e,r)}function _r(e){let t={};for(let[n,i]of Object.entries(e))t[n]=R(i)?i:{skillSlug:n,value:i};return t}var B=5;function h(e,t,n,i){let r=e&&typeof e=="object"&&!Array.isArray(e)&&typeof e.status=="string"?String(e.status):"ok",s=$t(e),o={schemaVersion:Un,status:r,statusFamily:su(r,s),summary:t,why:null,nextAction:null,nextStep:null,data:s,warnings:[],links:[],reasonCode:null,handoff:null};return{exitCode:0,stdout:n?JSON.stringify(o,null,2):cu(s,t,i),stderr:""}}function su(e,t){let n=e.toLowerCase();return n==="pass"||n.includes("dry")?"dry_run_passed":n.includes("created")?"created":n.includes("updated")||n.includes("configured")||n.includes("synced")?"updated":n.includes("revoked")||n.includes("removed")||n.includes("disconnected")?"removed":n.includes("approval")||n.includes("handoff")||R(t)&&t.handoff?"human_handoff":"ok"}function ou(e){return e?e==="login_required"||e==="unauthorized"?"login_required":e==="confirmation_required"?"confirmation_required":e.includes("not_found")||e==="missing_record"?"not_found":e.includes("payment")||e.includes("checkout")||e.includes("purchase")?"payment_required":e.includes("source")?"source_required":e.includes("backend")||e.includes("unreachable")||e.includes("network")?"backend_unreachable":e.includes("agent")||e.includes("client")||e.includes("unsupported")?"unsupported_client":e.includes("blocked")||e.includes("policy")||e.includes("guardian")?"policy_blocked":e.includes("not_allowed")||e.includes("permission_denied")||e.includes("invalid_transition")?"operation_not_allowed":"invalid_input":null}var au="<redacted>";function $t(e){if(Array.isArray(e))return e.map(n=>$t(n));if(!R(e))return e;let t={};for(let[n,i]of Object.entries(e))t[n]=lu(n)?au:$t(i);return t}function lu(e){let t=e.replace(/[^a-z0-9]/giu,"").toLowerCase();return t==="devicecode"||t==="usercode"||t==="verificationcode"||t==="recoverycode"||t==="onetimecode"||t==="password"||t==="clientsecret"||t==="privatekey"||t==="apikey"||t==="rawapikey"||t==="accesstoken"||t==="refreshtoken"||t==="bearertoken"||t==="mcptoken"||t.endsWith("secret")?!0:t.endsWith("token")&&t!=="tokenprefix"}function cu(e,t,n){let i=Q(n);if(R(e)){if(t==="Status loaded."&&xr(e))return mu(e,t,i);if(t==="Doctor checks loaded."&&xr(e))return fu(e,t,i);if(t==="Creator payout profile loaded.")return Tu(e,t,i);if(t==="Creator earnings loaded."||t==="Earnings loaded.")return Nu(e,"Creator earnings loaded.",i);if(t==="Creator payouts loaded."||t==="Payouts loaded.")return Fu(e,"Creator payouts loaded.",i);if(t==="Guardian check complete.")return pu(e,t,i);if(t==="Reviews loaded.")return du(e,t,i);if(t==="Categories loaded.")return uu(e,t,i)}let r=[`${i.ok("OK")} ${t}`];if(R(e)){let s=xs(e,i);s.length>0&&r.push("",...s);let o=js(e);o.length>0&&r.push("",i.section("Next"),...o.map(a=>` ${i.arrow} ${a}`))}return r.join(`
|
|
1292
|
+
`)}function uu(e,t,n){let i=he(e.results??e.categories??e.data),r=[`${n.ok("OK")} ${t}`,"",n.section(`Categories (${i.length})`)];return i.length===0?(r.push(` ${n.muted("No categories returned.")}`),r.join(`
|
|
1293
|
+
`)):(i.slice(0,B).forEach((s,o)=>{let a=l(s,"slug")??l(s,"category")??l(s,"name")??`category-${o+1}`,c=l(s,"name")??a,u=s.count;r.push(`${o+1}. ${Is(c)}`);let d=[a?`slug: ${a}`:void 0,u!==void 0?`count: ${Y("count",u)}`:void 0].filter(g=>!!g);d.length>0&&r.push(` ${d.join("; ")}`)}),i.length>B&&r.push(` ${n.muted(`... ${i.length-B} more`)}`),r.join(`
|
|
1294
|
+
`))}function du(e,t,n){let i=he(e.reviews??e.results),r=[`${n.ok("OK")} ${t}`,"",n.section(`Reviews (${i.length})`)];return i.length===0&&r.push(` ${n.muted("No reviews yet.")}`),i.forEach((s,o)=>{let a=l(s,"reviewId")??l(s,"id"),u=l(s,"skillSlug")??l(s,"slug")??l(s,"skill")??a??`Review ${o+1}`,d=s.rating??s.score,g=l(s,"status"),f=l(s,"updatedAt")??l(s,"createdAt"),m=[a?`review: ${a}`:void 0,d!=null?`rating: ${Y("rating",d)}`:void 0,g?`status: ${g}`:void 0,f?`updated: ${f}`:void 0].filter(v=>!!v);r.push(`${o+1}. ${u}`),m.length>0&&r.push(` ${m.join("; ")}`);let y=l(s,"feedback")??l(s,"comment")??l(s,"message");y&&r.push(` ${n.label("feedback")}: ${Le(y)}`)}),r.join(`
|
|
1295
|
+
`)}function pu(e,t,n){let i=P(e,"decision"),r=P(e,"enforcement"),s=P(e,"auditEvent"),o=N(i,"status")??N(r,"status")??"unknown",a=N(r,"actionType")??N(s,"actionType")??"action",c=N(i,"capability")??N(r,"capability")??"not specified",u=N(i,"reasonCode")??N(r,"reasonCode")??"not specified",d=N(i,"message")??N(r,"message")??"Guardian policy resolved this action.",g=N(s,"skillSlug")??"unknown",f=N(s,"version")??"unknown",m=dn(r,"canExecute"),y=dn(r,"auditRequired"),v=dn(r,"telemetryRequired"),C=o==="blocked"?"BLOCKED":o==="allowed"?"ALLOWED":"WARNING",_=[`${n.ok("OK")} ${t}`,"",n.section(`${C} ${gu(a)}`),` ${n.label("Skill")}: ${g}`,` ${n.label("Version")}: ${f}`,` ${n.label("Capability")}: ${c}`,` ${n.label("Reason")}: ${d}`,` ${n.label("Reason code")}: ${u}`,` ${n.label("Can execute")}: ${m===!0?"yes":"no"}`,` ${n.label("Audit required")}: ${y===!1?"no":"yes"}`,` ${n.label("Cloud telemetry")}: ${v===!0?"yes":"no"}`,"",n.section("Next")];return o==="blocked"?_.push(` ${n.arrow} Do not run this action.`,` ${n.arrow} Review \`skills-layer trust ${g}\`.`,` ${n.arrow} Run \`skills-layer guardian incident --skill ${g} --version ${f} --path <installed-skill-path> --reason "<reason>"\` if this was unexpected.`):_.push(` ${n.arrow} Continue only with the action Guardian evaluated.`,` ${n.arrow} Re-run guardian check if the action changes.`),_.join(`
|
|
1296
|
+
`)}function dn(e,t){if(R(e))return typeof e[t]=="boolean"?e[t]:void 0}function N(e,t){return R(e)?l(e,t):void 0}function gu(e){return e.split(/[_-]+/u).filter(Boolean).map(t=>`${t[0]?.toUpperCase()??""}${t.slice(1)}`).join(" ")}function xr(e){return!!(P(e,"backend")&&P(e,"auth")&&Array.isArray(e.checks))}function mu(e,t,n){let i=[`${n.ok("OK")} ${t}`,"",n.section("Readiness")],r=l(e,"summary");r&&i.push(` ${r}`);let s=P(e,"backend"),o=s?wu(s):void 0;o&&i.push(` ${n.label("Backend")}: ${o}`);let a=P(e,"auth"),c=a?vu(a):void 0;c&&i.push(` ${n.label("Account")}: ${c}`);let u=a?q(a,"workspaceCount"):void 0;u!==void 0&&i.push(` ${n.label("Workspaces")}: ${u}`);let d=a?q(a,"libraryCount"):void 0;d!==void 0&&i.push(` ${n.label("Owned skills")}: ${d}`);let g=Ss(e);return g.length>0&&i.push("",n.section("Next"),...g.map(f=>` ${n.arrow} ${f}`)),i.push(` ${n.arrow} Run \`skills-layer doctor\` for diagnostics.`),i.join(`
|
|
1297
|
+
`)}function fu(e,t,n){let i=[`${n.ok("OK")} ${t}`,"",n.section("Diagnostics")],r=l(e,"summary");r&&i.push(` ${r}`);let s=l(e,"status");s&&i.push(` ${n.label("Status")}: ${s}`);let o=Ps(e),a=o.filter(d=>bu(l(d,"status"))),c=o.filter(d=>l(d,"status")!=="pass");i.push(a.length===0?" No blocking issues found.":` ${a.length} check${a.length===1?"":"s"} need attention.`),a.length===0&&c.length>0&&i.push(` Advisory checks needing attention: ${c.length}.`),i.push("",n.section(`Checks (${o.length})`)),o.length===0&&i.push(` ${n.muted("No checks returned by the backend.")}`),o.forEach((d,g)=>{let f=l(d,"status")??"unknown",m=l(d,"title")??l(d,"id")??`Check ${g+1}`;i.push(`${g+1}. ${n.label(`[${f}] ${m}`)}`);let y=l(d,"summary");y&&i.push(` ${y}`);let v=l(d,"why");if(v&&i.push(` ${n.label("Why")}: ${v}`),f!=="pass"){let C=l(d,"nextStep");C&&i.push(` ${n.label("Fix")}: ${C}`);let _=l(d,"recommendedCommand");_&&i.push(` ${n.label("Try")}: ${_}`)}});let u=Ss(e);return u.length>0&&i.push("",n.section(a.length>0?"Recommended Fix":"Next"),...u.map(d=>` ${n.arrow} ${d}`)),i.join(`
|
|
1298
|
+
`)}function hu(e,t,n,i){let r=[`${n.ok("OK")} ${t}`],s=se(e,"requestedSlugs");s&&s.length>0&&r.push("",n.section("Requested"),` ${s.join(", ")}`);let o=he(e.results);r.push("",n.section(`Comparison (${o.length})`)),o.length===0&&r.push(` ${n.muted("No comparable skills returned.")}`),o.forEach((d,g)=>{let f=Cn(d)??`Skill ${g+1}`;r.push(`${g+1}. ${f}`);let m=yu(d);m&&r.push(` ${m}`);let y=As(d);y&&r.push(` ${n.label("summary")}: ${i?y.replace(/\s+/gu," ").trim():Le(y)}`)});let a=he(e.missing);a.length>0&&(r.push("",n.section(`Missing (${a.length})`)),a.forEach((d,g)=>{let f=l(d,"slug")??l(d,"skillSlug")??Cn(d)??`Entry ${g+1}`,m=l(d,"reason")??l(d,"status");r.push(`${g+1}. ${m?`${f} - ${m}`:f}`)}));let c=se(e,"guidance")??je(e.guidance);c.length>0&&r.push("",n.section("Guidance"),...c.slice(0,3).map(d=>` ${n.arrow} ${Le(d)}`));let u=ku(o);return u.length>0&&r.push("",n.section("Next"),...u.map(d=>` ${n.arrow} ${d}`)),r.join(`
|
|
1299
|
+
`)}function yu(e){let t=P(e,"securityPosture"),n=l(e,"trust")??l(e,"trustStatus")??l(e,"trustLabel")??(t?l(t,"label"):void 0),i=e.score??e.securityScore??(t?t.securityScore:void 0),r=l(e,"risk")??l(e,"runtimeRisk")??(t?l(t,"runtimeRisk"):void 0);return[["slug",l(e,"slug")??l(e,"skillSlug")],["version",l(e,"version")??l(e,"currentVersion")],["category",l(e,"category")],["type",l(e,"type")??l(e,"skillType")],["trust",n],["score",i],["risk",r]].flatMap(([o,a])=>a==null||a===""?[]:[`${o}: ${Y(String(o),a)}`]).join("; ")}function ku(e){let t=[];for(let n of e.slice(0,5)){let i=l(n,"slug")??l(n,"skillSlug");i&&t.push(`skills-layer show ${i}`,`skills-layer trust ${i}`,`skills-layer install ${i}`)}return t}function wu(e){let t=l(e,"edition"),n=l(e,"baseUrl");return t&&n?`${t} at ${n}`:t??n}function vu(e){let t=l(e,"state");if(t&&t!=="authenticated")return t==="anonymous"?"not signed in":t;let n=l(e,"email"),i=se(e,"roles");return n&&i&&i.length>0?`${n} (${i.join(", ")})`:n??l(e,"role")}function Ss(e){let t=[],n=l(e,"recommendedCommand");n&&t.push(n);let i=l(e,"nextStep");return i&&t.push(i),t}function Ps(e){return Array.isArray(e.checks)?e.checks.filter(R):[]}function bu(e){return e!==void 0&&e!=="pass"&&e!=="warn"&&e!=="advisory"}function he(e){return Array.isArray(e)?e.filter(R):[]}function je(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}function Su(e){let t=e.commerce===!0;return{status:t?"available":"unavailable",summary:t?"Marketplace purchases, invoices, refunds, and creator commerce flows are available.":"Marketplace commerce is not available on this backend.",availableWorkflows:t?["Browse skills with `skills-layer featured` or `skills-layer search <query>`.","Start purchase handoff with `skills-layer buy <skill-slug>`.","Review account purchases with `skills-layer purchases list`."]:["Browse and install available free skills.","Use `skills-layer help topic install` for install guidance."]}}var Pu={"core.identity":"Account and sign-in","core.catalog":"Catalog discovery","core.validation":"Creator validation","core.creator":"Creator submissions","core.library":"Owned skills","core.workspace":"Workspace rollout","core.guardian":"Runtime trust checks","core.source":"Source installs","core.discovery":"Catalog discovery","marketplace.commerce":"Marketplace commerce","marketplace.reviews":"Reviews and issues","marketplace.payouts":"Creator earnings"};function Cu(e){let t=je(e.capabilities);return{status:"ok",edition:l(e,"edition")??"unknown",summary:"Public product capabilities available on the selected backend.",capabilities:t.map(n=>({name:Pu[n]??Nt(n.replace(/^[^.]+\./u,"").replace(/[._-]+/gu," ")),available:!0})),count:t.length}}function _u(e,t){let n=p(e);if(!n)return;let i=Number(n);return!Number.isInteger(i)||i<=0?k("help optimize-tokens --max-characters must be a positive integer.",t):i<120||i>4e3?k("help optimize-tokens --max-characters must be between 120 and 4000.",t):i}function xu(e,t,n){let i=Q(n),r=P(e,"validation")??e,s=P(r,"parsedSkill")??P(e,"parsedSkill"),o=s?P(s,"frontmatter"):void 0,a=l(e,"skillSlug")??(o?l(o,"name"):void 0),c=r.valid===!0||e.valid===!0,u=pn(r,e,"issues"),d=pn(r,e,"warnings"),g=pn(r,e,"advice"),f=P(r,"stats")??P(e,"stats"),m=[`${i.ok("OK")} Validation complete.`,"",i.section("Bundle")];if(m.push(` ${i.label("Path")}: ${t}`),a&&m.push(` ${i.label("Skill")}: ${a}`),m.push(` ${i.label("Readiness")}: ${c?"ready for dry-run submission":"needs changes before submission"}`),m.push("",i.section("Checks")),m.push(` ${i.arrow} SKILL.md structure and frontmatter`),m.push(` ${i.arrow} Required bundle files and supported directories`),m.push(` ${i.arrow} Secret hygiene, unsafe script signals, and trust-review readiness`),m.push(` ${i.arrow} Trigger quality inputs for should-trigger / should-not-trigger testing`),f){let y=f.fileCount??f.files??e.fileCount,v=f.bodyWordCount??f.bodyWords??e.bodyWordCount;m.push("",i.section("File Summary")),y!==void 0&&m.push(` ${i.label("File count")}: ${Y("fileCount",y)}`),v!==void 0&&m.push(` ${i.label("Body words")}: ${Y("bodyWordCount",v)}`)}return m.push("",...gn("Issues",u,i,"No blocking issues found.")),m.push("",...gn("Warnings",d,i,"No warnings returned.")),m.push("",...gn("Advice",g,i,"No extra advice returned.")),m.push("",i.section("Next")),m.push(` ${i.arrow} skills-layer preview-trigger ${t} --should-trigger "<prompt>" --should-not-trigger "<prompt>"`),m.push(` ${i.arrow} skills-layer creator submit ${t} --dry-run`),m.join(`
|
|
1300
|
+
`)}function pn(e,t,n){let i=Array.isArray(e[n])?e[n]:[],r=Array.isArray(t[n])?t[n]:[];return i.length>0?i:r}function gn(e,t,n,i){let r=[n.section(`${e} (${t.length})`)];return t.length===0?(r.push(` ${n.muted(i)}`),r):(t.slice(0,B).forEach((s,o)=>{r.push(`${o+1}. ${Cs(s)}`)}),r)}function Cs(e){return R(e)?(l(e,"message")??l(e,"title")??l(e,"code")??l(e,"path")??tt(e))||"Details available with --json":Y("",e)}function Ru(e,t,n){let i=Q(n),r=$u(e),s=Au(e),o=[`${i.ok("OK")} Trigger preview complete.`,"",i.section("Bundle"),` ${i.label("Path")}: ${t}`],a=l(e,"skillSlug")??l(e,"slug");return a&&o.push(` ${i.label("Skill")}: ${a}`),o.push("",i.section(`Prompt Results (${r.length})`)),r.length===0&&o.push(` ${i.muted("No prompt results returned. Use --json to inspect the raw backend response.")}`),r.slice(0,B).forEach((c,u)=>{o.push(`${u+1}. ${Iu(c,u)}`)}),o.push("",i.section(`Guidance (${s.length})`)),s.length===0&&o.push(` ${i.muted("No extra trigger guidance returned.")}`),s.slice(0,B).forEach((c,u)=>{o.push(`${u+1}. ${c}`)}),o.push("",i.section("Next")),o.push(` ${i.arrow} skills-layer validate ${t}`),o.push(` ${i.arrow} skills-layer creator submit ${t} --dry-run`),o.join(`
|
|
1301
|
+
`)}function $u(e){return[...he(e.promptResults),...he(e.results),...he(e.shouldTriggerResults),...he(e.shouldNotTriggerResults),...he(e.paraphraseResults)]}function Au(e){let t=je(e.guidance),n=he(e.guidance).map(i=>Cs(i));return[...t,...n]}function Iu(e,t){let n=l(e,"prompt")??l(e,"text")??l(e,"input")??`Prompt ${t+1}`,i=ju(e),r=Eu(e),s=Lu(e),o=e.score??e.confidence,a=l(e,"reason")??l(e,"explanation")??l(e,"message");return[`"${Le(n)}"`,i?`expected: ${i}`:void 0,r?`actual: ${r}`:void 0,s,o!==void 0?`score: ${Y("score",o)}`:void 0,a?`reason: ${Le(a)}`:void 0].filter(c=>!!c).join("; ")}function ju(e){return typeof e.shouldTrigger=="boolean"?e.shouldTrigger?"should trigger":"should not trigger":typeof e.expectedTrigger=="boolean"?e.expectedTrigger?"should trigger":"should not trigger":l(e,"expected")??l(e,"kind")??l(e,"type")}function Eu(e){return typeof e.triggered=="boolean"?e.triggered?"triggered":"did not trigger":typeof e.actualTrigger=="boolean"?e.actualTrigger?"triggered":"did not trigger":l(e,"actual")??l(e,"classification")??l(e,"decision")}function Lu(e){return typeof e.passed=="boolean"?e.passed?"pass":"fail":typeof e.pass=="boolean"?e.pass?"pass":"fail":l(e,"status")}function Uu(e,t,n,i){let r=Q(i),s=l(e,"skillSlug")??V(t),o=[`${r.ok("OK")} Created ${n}.`,"",r.section("Local Skill")];o.push(` ${r.label("Path")}: ${n}`),o.push(` ${r.label("Skill")}: ${s}`);let a=l(e,"skillType"),c=l(e,"category");return a&&o.push(` ${r.label("Type")}: ${a}`),c&&o.push(` ${r.label("Category")}: ${c}`),o.push("",r.section("Next")),o.push(` ${r.arrow} Edit ${n}`),o.push(` ${r.arrow} skills-layer validate ${t}`),o.push(` ${r.arrow} skills-layer preview-trigger ${t} --should-trigger "<prompt>" --should-not-trigger "<prompt>"`),o.push(` ${r.arrow} skills-layer creator submit ${t} --dry-run`),o.join(`
|
|
1302
|
+
`)}function Tu(e,t,n){let i=P(e,"profile")??e,r=mn(i,"requirementsCurrentlyDue"),s=mn(i,"requirementsPastDue"),o=mn(i,"requirementsPendingVerification"),a=["payouts","Enabled"].join(""),c=i.readyForPayouts??i[a],u=c===!0,d=[`${n.ok("OK")} ${t}`,"",n.section("Payout Profile")];return d.push(` ${n.label("Status")}: ${vt(l(i,"status"))}`),d.push(` ${n.label("Ready for payouts")}: ${$r(c)}`),d.push(` ${n.label("Account details submitted")}: ${$r(i.detailsSubmitted)}`),d.push(` ${n.label("Currency")}: ${vt(l(i,"currency")?.toUpperCase())}`),d.push(` ${n.label("Country")}: ${vt(l(i,"country")?.toUpperCase())}`),d.push(` ${n.label("Minimum withdrawal")}: ${Bu(i)}`),d.push(` ${n.label("Updated at")}: ${vt(l(i,"updatedAt"))}`),d.push("",n.section("Requirements")),d.push(` ${n.label("Currently due")}: ${fn(r)}`),d.push(` ${n.label("Past due")}: ${fn(s)}`),d.push(` ${n.label("Pending verification")}: ${fn(o)}`),d.push("",n.section("Next")),u?(d.push(` ${n.arrow} skills-layer creator earnings`),d.push(` ${n.arrow} skills-layer creator withdraw --amount-cents <amount>`),d.push(` ${n.arrow} skills-layer creator payouts`)):(d.push(` ${n.arrow} skills-layer creator payout-link`),d.push(` ${n.arrow} skills-layer creator earnings`)),d.join(`
|
|
1303
|
+
`)}function Nu(e,t,n){let i=Pn(e),r=Jn(e,"withdrawableBalanceCents"),s=[`${n.ok("OK")} ${t}`,"",n.section("Earnings Summary")];return s.push(` ${n.label("Gross sales")}: ${z(e,"successfulSalesCents",i)}`),s.push(` ${n.label("Platform fees")}: ${z(e,"platformFeeCents",i)}`),s.push(` ${n.label("Refunds requested")}: ${z(e,"refundRequestedCents",i)}`),s.push(` ${n.label("Refunded")}: ${z(e,"refundedCents",i)}`),s.push(` ${n.label("Estimated available")}: ${z(e,"estimatedAvailableCents",i)}`),s.push(` ${n.label("Withdrawable now")}: ${z(e,"withdrawableBalanceCents",i)}`),s.push(` ${n.label("Held balance")}: ${z(e,"heldBalanceCents",i)}`),s.push(` ${n.label("Refund exposure")}: ${z(e,"refundExposureCents",i)}`),s.push("",n.section("Activity")),s.push(` ${n.label("Successful purchases")}: ${Rr(e,"successfulPurchaseCount")}`),s.push(` ${n.label("Refund requests")}: ${Rr(e,"refundRequestedCount")}`),s.push(` ${n.label("Pending payouts")}: ${z(e,"pendingPayoutCents",i)}`),s.push(` ${n.label("Completed payouts")}: ${z(e,"completedPayoutCents",i)}`),s.push("",n.section("Guidance")),r>0?(s.push("1. You have a withdrawable balance available."),s.push("2. Confirm payout setup is ready before requesting withdrawal.")):(s.push("1. No withdrawable balance yet."),s.push("2. Sales will appear here after paid purchases settle.")),s.push("",n.section("Next")),r>0&&s.push(` ${n.arrow} skills-layer creator withdraw --amount-cents ${r}`),s.push(` ${n.arrow} skills-layer creator payout-profile`),s.push(` ${n.arrow} skills-layer creator payouts`),s.join(`
|
|
1304
|
+
`)}function Fu(e,t,n){let i=Array.isArray(e.results)?e.results:[],r=Pn(e,i),s=Jn(e,"withdrawableBalanceCents"),o=[`${n.ok("OK")} ${t}`,"",n.section("Payout History")];return o.push(` ${n.label("Withdrawable now")}: ${z(e,"withdrawableBalanceCents",r)}`),o.push(` ${n.label("Pending payouts")}: ${z(e,"pendingPayoutCents",r)}`),o.push(` ${n.label("Completed payouts")}: ${z(e,"completedPayoutCents",r)}`),o.push("",n.section(`Requests (${i.length})`)),i.length===0?o.push(` ${n.muted("No payout requests yet.")}`):(i.slice(0,B).forEach((a,c)=>{if(!R(a)){o.push(`${c+1}. ${Y("",a)}`);return}let u=Pn(a,void 0,r),d=l(a,"payoutId")??l(a,"id")??`Payout ${c+1}`,g=l(a,"status")??"unknown",f=z(a,"amountCents",u),m=l(a,"requestedAt"),y=l(a,"completedAt"),v=l(a,"reason");o.push(`${c+1}. ${d}`),o.push(` ${n.label("Amount")}: ${f}; ${n.label("Status")}: ${g}`),m&&o.push(` ${n.label("Requested")}: ${m}`),y&&o.push(` ${n.label("Completed")}: ${y}`),v&&o.push(` ${n.label("Reason")}: ${v}`)}),i.length>B&&o.push(` ${n.muted(`... ${i.length-B} more`)}`)),o.push("",n.section("Guidance")),i.length===0?o.push("1. Payouts appear here after you request a withdrawal."):o.push("1. Use this history to track requested, processing, paid, or failed payouts."),o.push("2. Check payout profile if setup or verification looks incomplete."),o.push("",n.section("Next")),s>0&&o.push(` ${n.arrow} skills-layer creator withdraw --amount-cents ${s}`),o.push(` ${n.arrow} skills-layer creator earnings`),o.push(` ${n.arrow} skills-layer creator payout-profile`),o.join(`
|
|
1305
|
+
`)}function Pn(e,t,n="GBP"){let i=l(e,"currency");if(i)return i.toUpperCase();let r=t?.find(R);if(r){let s=l(r,"currency");if(s)return s.toUpperCase()}return n}function Jn(e,t){return q(e,t)??0}function Rr(e,t){return q(e,t)??0}function z(e,t,n){return`${_s(Jn(e,t))} ${n}`}function mn(e,t){return(se(e,t)??[]).map(n=>n.replace(/[._-]+/gu," "))}function fn(e){return e.length>0?e.join(", "):"none"}function $r(e){return e===!0?"yes":e===!1?"no":"unknown"}function vt(e){return e??"none"}function Bu(e){let t=q(e,"minimumWithdrawalAmountCents"),n=l(e,"currency")?.toUpperCase()??"minor units";return t===void 0?"none":`${_s(t)} ${n}`}function _s(e){return(e/100).toFixed(2).replace(/\.00$/u,"").replace(/(\.\d)0$/u,"$1")}function Q(e){let t=Mu(e);return{ok:n=>t?Ae(32,n):n,section:n=>t?Ae(1,Ae(36,n)):n,label:n=>t?Ae(1,n):n,muted:n=>t?Ae(2,n):n,arrow:t?Ae(36,"->"):"->"}}function Mu(e){let t=e?.env??{};if(t.NO_COLOR)return!1;let n=t.FORCE_COLOR;return n&&n!=="0"?!0:!!e?.stdoutIsTty&&t.TERM!=="dumb"&&n!=="0"}function Ae(e,t){return`\x1B[${e}m${t}\x1B[0m`}function xs(e,t){let n=[],i=Ou(e,t);i.length>0&&n.push(...i);for(let[r,s]of Gu(e))if(Array.isArray(s))n.push(...qu(r,s,t));else if(R(s)){let o=tt(s);o&&n.push(` ${t.label(_n(r))}: ${o}`)}else n.push(` ${t.label(_n(r))}: ${Y(r,s)}`);return n}function qu(e,t,n){let i=Vu(e),r=[n.section(`${i} (${t.length})`)];return t.length===0?(r.push(` ${n.muted("No entries.")}`),r):(t.slice(0,B).forEach((s,o)=>{r.push(...Rs(s,o,n))}),t.length>B&&r.push(` ${n.muted(`... ${t.length-B} more`)}`),r)}function Rs(e,t,n){if(!R(e))return[`${t+1}. ${Y("",e)}`];let i=Cn(e)??ee(tt(e))??`Item ${t+1}`,r=[`${t+1}. ${i}`],s=As(e);s&&r.push(` ${s}`);let o=tt(e);return o&&r.push(` ${o}`),r}function Ou(e,t){let n=Vl(e,t);if(n.length>0)return n;let i=P(e,"capabilityProfile"),r=i?l(i,"runtimeRisk"):void 0;return r?[t.section("Trust"),` ${t.label("Runtime risk")}: ${r}`]:[]}function Ku(e,t,n){let i=Q(n),r=l(e,"skillSlug")??t,s=l(e,"runtimeRisk")??(P(e,"capabilityProfile")?l(P(e,"capabilityProfile"),"runtimeRisk"):void 0),o=[`${i.ok("OK")} Creator security report loaded.`,"",i.section("Creator Security")];e.securityScore!==void 0&&o.push(` ${i.label("Security score")}: ${Y("securityScore",e.securityScore)}`),s&&o.push(` ${i.label("Runtime risk")}: ${s}`);let a=l(e,"recommendation");a&&o.push(` ${i.label("Recommendation")}: ${a}`),o.push(` ${i.label("Skill")}: ${r}`);let c=l(e,"version");c&&o.push(` ${i.label("Version")}: ${c}`);let u=["semantic","review","no","reviewable","findings"].join("_"),d=je(e.reviewDegradedReasons).includes(u),g=je(e.trustBadges).filter(y=>y==="capability-mismatch"),f=je(e.trustBadges).filter(y=>y!=="capability-mismatch");(d||g.length>0)&&(o.push("",i.section("Creator Notes")),d&&o.push("1. Semantic review was not needed because there were no reviewable findings."),g.forEach((y,v)=>{o.push(`${d?v+2:v+1}. ${y==="capability-mismatch"?"Capability declaration needs review.":y}`)})),f.length>0&&(o.push("",i.section(`Trust badges (${f.length})`)),f.slice(0,B).forEach((y,v)=>o.push(`${v+1}. ${y}`)));let m=Array.isArray(e.findings)?e.findings:[];return o.push("",i.section(`Findings (${m.length})`)),m.length===0?o.push(` ${i.muted("No entries.")}`):m.slice(0,B).forEach((y,v)=>{o.push(...Rs(y,v,i))}),o.push("",i.section("Next")),o.push(` ${i.arrow} skills-layer creator rescan-security ${r}`),o.push(` ${i.arrow} skills-layer creator status ${r}`),o.push(` ${i.arrow} skills-layer trust ${r}`),o.join(`
|
|
1306
|
+
`)}function Du(e,t,n){let r=P(e,"report")??e,s=Q(n),o=r.securityScore,a=l(r,"generatedAt")??l(r,"reportGeneratedAt"),c=Array.isArray(r.findings)?r.findings:void 0,u=[`${s.ok("OK")} Security rescan requested.`,"",s.section("Creator Security")];return u.push(` ${s.label("Skill")}: ${l(r,"skillSlug")??t}`),o!==void 0&&u.push(` ${s.label("Security score")}: ${Y("securityScore",o)}`),c&&u.push(` ${s.label("Findings")}: ${c.length}`),a&&u.push(` ${s.label("Generated at")}: ${a}`),u.push("",s.section("Next")),u.push(` ${s.arrow} skills-layer creator security-report ${t}`),u.push(` ${s.arrow} skills-layer creator status ${t}`),u.join(`
|
|
1307
|
+
`)}function Gu(e){return Object.entries(e).filter(([t,n])=>$s(t,n))}function $s(e,t){let n=e.toLowerCase();return n==="status"||n==="securityscore"||n==="recommendation"||n==="capabilityprofile"||n==="securityposture"||n==="trust"||n.includes("apikey")||n.includes("secret")||n.includes("token")||n==="content"?!1:t!==void 0}function tt(e){let n=[["id","id"],["name","name"],["keyPrefix","prefix"],["slug","slug"],["skillSlug","skill"],["currentVersion","version"],["version","version"],["category","category"],["skillType","type"],["type","type"],["visibility","visibility"],["status","status"],["count","count"],["email","email"],["role","role"],["selectedBackend","backend"],["selectedBaseUrl","base url"],["path","path"],["downloadUrl","download url"],["authorizationUrl","authorization url"],["checkoutUrl","checkout url"],["url","url"],["issueId","issue"],["reviewId","review"],["purchaseId","purchase"],["workspaceId","workspace"],["clientId","client"],["environment","environment"],["expiresAt","expires"],["lastUsedAt","last used"],["revocable","revocable"],["revokeCommand","revoke"],["deploymentId","deployment"],["source","source"],["scope","scope"],["agent","agent"],["bytes","bytes"],["fileCount","file count"],["bodyWordCount","body words"]].flatMap(([r,s])=>{if(!$s(r,e[r]))return[];let o=e[r];return o===void 0?[]:[`${s}: ${Y(r,o)}`]}),i=P(e,"securityPosture");if(i){let r=l(i,"label"),s=l(i,"runtimeRisk");r&&n.push(`trust: ${r}`),s&&n.push(`risk: ${s}`)}return n.join("; ")}function As(e){return l(e,"shortDescription")??l(e,"summary")??l(e,"description")??l(e,"message")}function Cn(e){return l(e,"displayName")??l(e,"name")??l(e,"title")??l(e,"slug")??l(e,"skillSlug")??l(e,"code")??l(e,"id")}function Y(e,t){return e==="downloadUrl"?"<hidden; use --json or --output>":typeof t=="string"?e.toLowerCase()==="category"?Is(t):Le(t):typeof t=="number"||typeof t=="boolean"?String(t):t===null?"none":Array.isArray(t)?`${t.length} item${t.length===1?"":"s"}`:R(t)?tt(t)||"details available with --json":String(t)}function Is(e){return ki(e)}function Le(e){let t=e.replace(/\s+/gu," ").trim();return t.length>160?`${t.slice(0,157)}...`:t}function Vu(e){return Nt(_n(e))}function _n(e){return e.replace(/([a-z0-9])([A-Z])/gu,"$1 $2").replace(/[_-]+/gu," ").toLowerCase()}function js(e){let t=Hu(e),n=t?[`skills-layer show ${t}`,`skills-layer trust ${t}`,`skills-layer install ${t}`]:[],i=typeof e.downloadUrl=="string",r=Array.isArray(e.materializedWrites)&&e.materializedWrites.length>0;return i&&n.push("Use --output <path> to write exports without printing temporary download URLs"),r&&n.push("Review the materialized files in this workspace"),e.valid===!0&&n.push("skills-layer creator submit <path> --dry-run"),n}function Hu(e){let t=l(e,"skillSlug")??l(e,"slug");if(t)return t;let n=e.results;if(Array.isArray(n)){for(let i of n)if(R(i)){let r=l(i,"skillSlug")??l(i,"slug");if(r)return r}}}function R(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function k(e,t){let n=zu(e);return n?w(n.payload,e,t,n.reasonCode):{exitCode:1,stdout:"",stderr:t?JSON.stringify({schemaVersion:Un,status:"error",reasonFamily:"invalid_input",summary:e,why:null,nextAction:null,nextStep:null,data:{error:e},warnings:[],links:[],reasonCode:null,handoff:null},null,2):e}}function zu(e){let t=/^(?<code>EACCES|EPERM|EROFS):\s*(?<detail>.+)$/iu.exec(e);if(t?.groups){let d=t.groups.code.toUpperCase(),g=/'(?<path>[^']+)'/u.exec(e)?.groups?.path;return{reasonCode:"local_filesystem_permission_denied",payload:{status:"error",reasonCode:"local_filesystem_permission_denied",code:d,...g?{path:g}:{},nextAction:"check_local_permissions",nextStep:"Check the local path permissions, choose a writable installed skill directory, or rerun the command from a workspace you can write to."}}}let n=/^--(?<flag>[a-z0-9-]+) must be valid JSON\.$/iu.exec(e);if(n?.groups){let d=n.groups.flag;return{reasonCode:"invalid_json",payload:{status:"error",reasonCode:"invalid_json",flag:d,nextAction:"fix_json_flag",nextStep:`Provide valid JSON for --${d}.`}}}let i=/^Unknown flag --(?<flag>[a-z0-9-]+)\.$/iu.exec(e);if(i?.groups)return{reasonCode:"unknown_flag",payload:{status:"error",reasonCode:"unknown_flag",flag:i.groups.flag,nextAction:"help",nextStep:"Run `skills-layer <command> --help` to see supported flags for that command."}};let r=/^(?<command>.+?) --(?<flag>[a-z0-9-]+) must be one of: (?<accepted>.+?)\.$/iu.exec(e);if(r?.groups){let d=r.groups.flag,g=r.groups.accepted.split(",").map(f=>f.trim()).filter(Boolean);return{reasonCode:`invalid_${d.replace(/-/gu,"_")}`,payload:{status:"error",reasonCode:`invalid_${d.replace(/-/gu,"_")}`,command:r.groups.command,flag:d,acceptedValues:g,nextAction:r.groups.command.replace(/\s+/gu,"."),nextStep:`Use --${d} with one of: ${g.join(", ")}.`}}}let s=/^Unknown (?<namespace>.+?) command "(?<subcommand>.*?)"\.$/u.exec(e);if(s?.groups){let d=s.groups.namespace.trim(),g=s.groups.subcommand;return{reasonCode:"unknown_subcommand",payload:{status:"error",reasonCode:"unknown_subcommand",namespace:d,subcommand:g,nextAction:`${d.replace(/\s+/gu,".")}.help`,nextStep:`Run \`skills-layer ${d} --help\` to see supported ${d} commands.`}}}let o=/^(?<command>.+?) requires (?<argument>.+?)\.$/u.exec(e);if(!o?.groups)return;let a=o.groups.command.trim(),c=o.groups.argument.trim(),u=Wu(c);return{reasonCode:"missing_required_argument",payload:{status:"error",reasonCode:"missing_required_argument",command:a,argument:u,nextAction:a.replace(/\s+/gu,"."),nextStep:`Provide ${u.startsWith("--")?u:`<${u}>`} and retry.`}}}function Wu(e){let t=e.replace(/^(?:a|an|the)\s+/iu,"");if(/^two or more skill slugs$/iu.test(t))return"two-or-more-skill-slugs";let n=/--(?<name>[a-z0-9-]+)/iu.exec(t)?.groups?.name;return n||(/<(?<name>[^>]+)>/u.exec(t)?.groups?.name??t).replace(/\s+or\s+.*$/iu,"").replace(/[^a-z0-9]+/giu,"-").replace(/^-+|-+$/gu,"").toLowerCase()||"argument"}function w(e,t,n,i){let r=$t(e),s=i??l(r,"reasonCode")??null,o={schemaVersion:Un,status:l(r,"status")??"error",summary:t,why:l(r,"why")??null,nextAction:l(r,"nextAction")??null,nextStep:l(r,"nextStep")??null,data:r,warnings:Array.isArray(r.warnings)?r.warnings:[],links:Array.isArray(r.links)?r.links:[],reasonCode:s,reasonFamily:ou(s),handoff:r.handoff??null};return{exitCode:1,stdout:"",stderr:n?JSON.stringify(o,null,2):t}}function Ut(e,t){let n=e.details??{};if(e.status===401){let s=l(n,"error")??"Login required.",o=l(n,"nextAction")??"login",a=l(n,"nextStep")??"Run `skills-layer login` to sign in, then retry this command.";return w({status:"login_required",reasonCode:"login_required",error:s,nextAction:o,nextStep:a},`${s==="Login required."?"Login required":s}. ${a}`,t,"login_required")}let i=l(n,"reasonCode");if(i){let s=R(n.data)?n.data:null,a=s!==null&&("summary"in n||"data"in n)?s:n,c=l(a,"error")??l(n,"error")??l(n,"summary")??e.message;return w({...a,status:l(n,"status")??l(a,"status")??(e.status===404?"not_found":"error"),nextAction:l(a,"nextAction")??l(n,"nextAction"),nextStep:l(a,"nextStep")??l(n,"nextStep"),warnings:Array.isArray(a.warnings)?a.warnings:n.warnings,links:Array.isArray(a.links)?a.links:n.links,handoff:a.handoff??n.handoff,reasonCode:i},c,t,i)}let r=Ju(e);return r?w(r.payload,r.message,t,r.reasonCode):k(l(n,"error")??e.message,t)}function Ju(e){let t=l(e.details??{},"error")??e.message,n=t.toLowerCase();return e.status===404&&n.includes("source connection")?{reasonCode:"source_connection_not_found",message:"Source connection not found.",payload:{status:"not_found",error:t,reasonCode:"source_connection_not_found",nextAction:"source.connection.start",nextStep:"Check the source connection id, or start a new source connection."}}:e.status===404&&n.includes("approval request")?{reasonCode:"approval_request_not_found",message:"Approval request not found.",payload:{status:"not_found",error:t,reasonCode:"approval_request_not_found",nextAction:"approval.request.status",nextStep:"Check the approval request id, or rerun the workflow that created the approval request."}}:e.status===404&&(n.includes("purchase")||n.includes("invoice"))?{reasonCode:"purchase_not_found",message:"Purchase not found.",payload:{status:"not_found",error:t,reasonCode:"purchase_not_found",nextAction:"purchases.list",nextStep:"Run `skills-layer purchases list` to find a valid purchase id."}}:e.status===404&&(n.includes("security report")||n.includes("trust report"))?{reasonCode:"trust_report_not_found",message:"Trust report not found.",payload:{status:"not_found",error:t,reasonCode:"trust_report_not_found",nextAction:"trust",nextStep:"Run `skills-layer show <skill-slug>` to confirm the skill exists, then retry trust after the security report is generated."}}:e.status===404&&n.includes("help topic")?{reasonCode:"help_topic_not_found",message:"Help topic not found.",payload:{status:"not_found",error:t,reasonCode:"help_topic_not_found",nextAction:"help",nextStep:"Run `skills-layer help full` or `skills-layer --help` to see available topics."}}:e.status===404&&n.includes("skill")?{reasonCode:"skill_not_found",message:"Skill not found.",payload:{status:"not_found",error:t,reasonCode:"skill_not_found",nextAction:"search",nextStep:"Run `skills-layer search <query>` to find a valid skill slug before retrying."}}:null}async function D(e){try{return JSON.parse(await it(e,"utf8"))}catch{return null}}async function Yu(e,t){let n=await D(e);return n?$i(n,{env:t.env,platform:t.platform,store:t.credentialStore}):null}async function Yn(e,t,n){let i=await Ri(t,{env:n.env,platform:n.platform,store:n.credentialStore});await W(e,i)}async function W(e,t){await Es(ne(e)),await In(e,`${JSON.stringify(t,null,2)}
|
|
1308
|
+
`,{encoding:"utf8",mode:384}),await Zn(e,384)}async function Es(e){await nt(e,{recursive:!0,mode:448}),await Zn(e,448)}async function Zn(e,t){if(process.platform!=="win32")try{await Er(e,t)}catch{}}async function le(e,t){await nt(ne(e),{recursive:!0}),await In(e,t,"utf8")}async function xn(e,t){await nt(ne(e),{recursive:!0}),await In(e,t)}function Zu(e=process.stdin,t=process.stdout,n=En){return async i=>{if(!e.isTTY||!t.isTTY)throw new Error("Interactive prompt is not available in this environment.");let r=n({input:e,output:t});try{return(await r.question(i)).trim()}finally{r.close()}}}function Qu(e=process.stdin,t=process.stdout,n=En){return async i=>{if(!e.isTTY||!t.isTTY)throw new Error("Interactive secret prompt is not available in this environment.");if(typeof e.setRawMode=="function"&&typeof e.on=="function"&&typeof e.off=="function")return new Promise((s,o)=>{let a=e,c=a.isRaw===!0,u="",d=!1,g=m=>{d||(d=!0,a.off("data",f),a.setRawMode(c),a.pause?.(),t.write(`
|
|
1309
|
+
`),m())},f=m=>{let y=typeof m=="string"?m:m.toString("utf8");for(let v of y){if(v==="\r"||v===`
|
|
1310
|
+
`){g(()=>s(u.trim()));return}if(v===""){g(()=>o(new Error("Interactive secret prompt cancelled.")));return}if(v==="\b"||v==="\x7F"){u.length>0&&(u=u.slice(0,-1),t.write("\b \b"));continue}u+=v,t.write("*")}};t.write(i),a.resume?.(),a.on("data",f),a.setRawMode(!0)});let r=n({input:e,output:t,terminal:!0});r.stdoutMuted=!0,r._writeToOutput=function(o){if(!this.stdoutMuted){t.write(o);return}if(o==="\b"||o==="\x7F"){t.write("\b \b");return}if(o!=="\r"&&o!==`
|
|
1311
|
+
`){let a=[...o].filter(c=>c!=="\r"&&c!==`
|
|
1312
|
+
`).length;a>0&&t.write("*".repeat(a))}};try{t.write(i);let s=await r.question("");return t.write(`
|
|
1313
|
+
`),s.trim()}finally{r.close()}}}function Xu(e=process.stdin,t=process.stdout,n=En){return async(i,r)=>{if(r.length===0)throw new Error("Interactive selection has no available options.");if(!e.isTTY||!t.isTTY)throw new Error("Interactive selection is not available in this environment.");let s=e;if(typeof s.setRawMode=="function"&&typeof s.on=="function"&&typeof s.off=="function")return new Promise((a,c)=>{let u=0,d="",g=0,f=!1,m=s.isRaw===!0,y=()=>{g>0&&t.write(`\x1B[${g}F\x1B[J`),t.write(`${i}
|
|
1314
|
+
`);for(let[_,L]of r.entries())t.write(`${ed(_===u)} ${_+1}. ${Ar(L)}
|
|
1113
1315
|
`);t.write(`Choice: ${d}
|
|
1114
1316
|
`),t.write(`Use up/down arrows, type a number, then press Enter.
|
|
1115
|
-
`),g=r.length+3},
|
|
1116
|
-
`),_())},
|
|
1117
|
-
`)){if(d){let
|
|
1118
|
-
`);for(let[u,d]of r.entries())t.write(`${u+1}. ${
|
|
1119
|
-
`);let
|
|
1317
|
+
`),g=r.length+3},v=_=>{f||(f=!0,s.off?.("data",C),s.setRawMode?.(m),s.pause?.(),t.write(`
|
|
1318
|
+
`),_())},C=_=>{let L=typeof _=="string"?_:_.toString("utf8");if(L.includes("")){v(()=>c(new Error("Interactive selection cancelled.")));return}if(L.includes("\x1B[A")){d="",u=(u-1+r.length)%r.length,y();return}if(L.includes("\x1B[B")){d="",u=(u+1)%r.length,y();return}if(L.includes("\r")||L.includes(`
|
|
1319
|
+
`)){if(d){let U=Number.parseInt(d,10)-1;if(Number.isNaN(U)||U<0||U>=r.length){d="",t.write("\x07"),y();return}u=U}v(()=>a(r[u]?.value??r[0].value));return}if(L.includes("\b")||L.includes("\x7F")){d=d.slice(0,-1);let U=Number.parseInt(d,10)-1;!Number.isNaN(U)&&U>=0&&U<r.length&&(u=U),y();return}let de=[...L].filter(U=>/[0-9]/u.test(U));if(de.length>0){d=`${d}${de.join("")}`;let U=Number.parseInt(d,10)-1;!Number.isNaN(U)&&U>=0&&U<r.length&&(u=U),y()}};y(),s.resume?.(),s.on("data",C),s.setRawMode(!0)});let o=n({input:e,output:t});try{t.write(`${i}
|
|
1320
|
+
`);for(let[u,d]of r.entries())t.write(`${u+1}. ${Ar(d)}
|
|
1321
|
+
`);let a=(await o.question("Choose a number and press enter: ")).trim(),c=Number.parseInt(a,10)-1;if(Number.isNaN(c)||c<0||c>=r.length)throw new Error("No valid option selected.");return r[c].value}finally{o.close()}}}function ed(e){return e?"\x1B[36m>\x1B[0m":" "}function Ar(e){return e.description?`${e.label} (${e.description})`:e.label}function td(e){return async t=>{let n=e==="win32"?{file:"rundll32.exe",args:["url.dll,FileProtocolHandler",t]}:e==="darwin"?{file:"open",args:[t]}:{file:"xdg-open",args:[t]};return new Promise(i=>{try{let r=Ir(n.file,n.args,{detached:!0,stdio:"ignore"});r.on("error",()=>i(!1)),r.unref(),i(!0)}catch{i(!1)}})}}function H(e,t){let n={};for(let i of t){let r=e[i];r!==void 0&&r!==!1&&(i.endsWith("Cents")||i==="rating"?n[i]=Number(r):n[i]=r)}return x(n)}function nd(e){let t=e.results;return Array.isArray(t)?t.flatMap(n=>{if(!n||typeof n!="object"||Array.isArray(n))return[];let i=l(n,"slug")??l(n,"skillSlug");return i?[i]:[]}):[]}function id(e){let t=p(e)??"auto";return t==="auto"||t==="required"||t==="optional"||t==="off"?{status:"ok",policy:t}:{status:"invalid",message:"guardian check --cloud-trust-ledger must be one of: auto, required, optional, off."}}function x(e){let t={};for(let[n,i]of Object.entries(e))i!==void 0&&(t[n]=i);return t}function Tt(e,t){let n=p(e);return n?Qn(n,t):void 0}function Qn(e,t){try{return JSON.parse(e)}catch{throw new Error(`--${t} must be valid JSON.`)}}function G(e){if(!e||typeof e!="object"||Array.isArray(e))return e;let t={...e};return delete t.apiKey,delete t[["ad","min","Api","Key"].join("")],t}function Rn(e){let t=G(e);for(let n of["role","roles","verifiedAt","expiresAt","userId","tenantId","linkedAccount","linkedIdentity","createdUser"])delete t[n];return t}function b(e,t){let n=p(e);if(!n)throw new Error(t);return n}function p(e){return typeof e=="string"&&e.trim().length>0?e.trim():void 0}function ee(e){return typeof e=="string"&&e.trim().length>0?e.trim():void 0}function l(e,t){let n=e[t];return typeof n=="string"&&n.trim().length>0?n.trim():void 0}function q(e,t){let n=e[t];if(typeof n=="number"&&Number.isFinite(n))return n;if(typeof n=="string"&&n.trim().length>0){let i=Number(n);return Number.isFinite(i)?i:void 0}}function P(e,t){let n=e[t];return n&&typeof n=="object"&&!Array.isArray(n)?n:void 0}function se(e,t){let n=e[t];return Array.isArray(n)?n.filter(i=>typeof i=="string"):void 0}function fe(e,t){let n=e[t];return Array.isArray(n)?n:void 0}function rd(e){return P(e,"data")??e}function sd(e){let t=Array.isArray(e)?e:typeof e=="string"?[e]:[];return[...new Set(t.flatMap(n=>n.split(",")).map(n=>n.trim()).filter(Boolean))]}function M(e,t,n){let i=p(n);i&&e.set(t,i)}function ue(e){let t=e.toString();return t?`?${t}`:""}function te(e){return e.replace(/\/+$/u,"")}function ae(e){if(te(e)===Tn)return"cloud";try{let t=new URL(e);return t.hostname==="127.0.0.1"||t.hostname==="localhost"||t.hostname==="::1"||t.hostname==="[::1]"?"local":"custom"}catch{return"custom"}}function Ls(e){return e.includes("/")||e.startsWith(".")||/^https?:\/\//u.test(e)||/^[a-z]+:/iu.test(e)}function K(e,t){return Ur(e,t)}function Nt(e){return`${e[0]?.toUpperCase()??""}${e.slice(1)}`}var od={github:"GitHub",gitlab:"GitLab",google:"Google",microsoft:"Microsoft"};function ad(e){return od[e.toLowerCase()]??Nt(e)}function Z(e){return e instanceof Error?e.message:String(e)}export{np as executePublicCli};
|