skills-layer 0.1.8 → 0.1.9

package/public/skills-layer-public.mjs

@@ -1,12 +1,150 @@
 /* istanbul ignore file -- generated npm bundle is verified by boundary and tarball smoke tests. */
 import { createRequire as __skillsLayerCreateRequire } from "node:module"; const require = __skillsLayerCreateRequire(import.meta.url);
-import{spawn as ks}from"node:child_process";import{createHash as ni}from"node:crypto";import{access as ws,appendFile as hl,chmod as vs,mkdir as ft,readdir as ii,readFile as He,rm as ri,stat as yl,writeFile as si}from"node:fs/promises";import{basename as D,dirname as ae,join as U,posix as oi,relative as Ke,resolve as ai,win32 as ze}from"node:path";import{createInterface as li}from"node:readline/promises";import{spawn as Mi}from"node:child_process";import{createHash as Io}from"node:crypto";import{chmod as jo,mkdir as vt,readFile as Bi,rm as rn,writeFile as Te}from"node:fs/promises";import{dirname as Qe,posix as Lo,win32 as Uo}from"node:path";import{posix as Ro,win32 as $o}from"node:path";var Re=["codex","claude-code","cursor","opencode","amp","kimi-cli","replit","universal","antigravity","augment","openclaw","cline","warp","codebuddy","command-code","continue","cortex","crush","deepagents","droid","gemini-cli","github-copilot","goose","junie","iflow-cli","kilo","kiro-cli","kode","mcpjam","mistral-vibe","mux","openhands","pi","qoder","qwen-code","roo","trae","trae-cn","windsurf","zencoder","neovate","pochi","adal"],Ii=[E("codex","Codex",".codex",{capabilities:B({allowedTools:!0})}),E("claude-code","Claude Code",".claude",{envVar:"CLAUDE_CODE_HOME",capabilities:B({allowedTools:!0,hooks:!0,forkedContext:!0})}),E("cursor","Cursor",".cursor",{capabilities:B({allowedTools:!0})}),E("opencode","OpenCode",".opencode",{globalRootRelativePath:".config/opencode",capabilities:B({allowedTools:!0})}),fe("amp","Amp",".config/agents",{capabilities:B({allowedTools:!0})}),fe("kimi-cli","Kimi Code CLI",".config/agents"),fe("replit","Replit",".config/agents"),fe("universal","Universal",".config/agents"),fe("antigravity","Antigravity",".gemini/antigravity",{capabilities:B({allowedTools:!0}),detectGlobal:!0}),E("augment","Augment",".augment"),{id:"openclaw",displayName:"OpenClaw",envVar:"OPENCLAW_HOME",capabilities:B({allowedTools:!0}),targets:{projectRootRelativePath:null,projectSkillsRelativePath:"skills",globalRootRelativePath:".openclaw",globalSkillsRelativePath:".openclaw/skills"},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:[".openclaw",".openclaw/skills"]}},fe("cline","Cline",".agents",{capabilities:B({allowedTools:!0,hooks:!0})}),fe("warp","Warp",".agents"),E("codebuddy","CodeBuddy",".codebuddy",{capabilities:B({allowedTools:!0})}),E("command-code","Command Code",".commandcode",{capabilities:B({allowedTools:!0})}),E("continue","Continue",".continue"),E("cortex","Cortex Code",".cortex",{globalRootRelativePath:".snowflake/cortex"}),E("crush","Crush",".crush",{globalRootRelativePath:".config/crush"}),fe("deepagents","Deep Agents",".deepagents/agent",{detectGlobal:!0}),E("droid","Droid",".factory"),fe("gemini-cli","Gemini CLI",".gemini",{detectGlobal:!0}),fe("github-copilot","GitHub Copilot",".copilot",{capabilities:B({allowedTools:!0}),detectGlobal:!0}),E("goose","Goose",".goose",{globalRootRelativePath:".config/goose"}),E("junie","Junie",".junie"),E("iflow-cli","iFlow CLI",".iflow"),E("kilo","Kilo Code",".kilocode"),E("kiro-cli","Kiro CLI",".kiro"),E("kode","Kode",".kode"),E("mcpjam","MCPJam",".mcpjam"),E("mistral-vibe","Mistral Vibe",".vibe"),E("mux","Mux",".mux"),E("openhands","OpenHands",".openhands",{capabilities:B({allowedTools:!0})}),E("pi","Pi",".pi",{globalRootRelativePath:".pi/agent",capabilities:B({allowedTools:!0})}),E("qoder","Qoder",".qoder",{capabilities:B({allowedTools:!0})}),E("qwen-code","Qwen Code",".qwen"),E("roo","Roo Code",".roo",{capabilities:B({allowedTools:!0})}),E("trae","Trae",".trae",{detectProject:!1}),E("trae-cn","Trae CN",".trae",{globalRootRelativePath:".trae-cn",detectProject:!1}),E("windsurf","Windsurf",".windsurf",{globalRootRelativePath:".codeium/windsurf"}),E("zencoder","Zencoder",".zencoder",{capabilities:B({allowedTools:!0})}),E("neovate","Neovate",".neovate",{capabilities:B({allowedTools:!0})}),E("pochi","Pochi",".pochi"),E("adal","AdaL",".adal")];function Pe(e=process.env,t=process.platform,n=process.cwd()){let i=Ui(t),r=Li(e,t);return Ii.map(s=>{let o=kt(e[s.envVar]),a=r&&s.targets.globalRootRelativePath?Je(i,r,s.targets.globalRootRelativePath):null,c=r&&s.targets.globalSkillsRelativePath?Je(i,r,s.targets.globalSkillsRelativePath):null,u=s.targets.projectRootRelativePath?Je(i,n,s.targets.projectRootRelativePath):null,d=o??a;return{id:s.id,displayName:s.displayName,envVar:s.envVar,capabilities:s.capabilities,detectionSources:[],targets:{projectRoot:u,projectSkillsPath:Je(i,n,s.targets.projectSkillsRelativePath),globalRoot:d,globalSkillsPath:o?i.join(o,"skills"):c}}})}async function ji(e={}){let t=e.env??process.env,n=e.platform??process.platform,i=e.cwd??process.cwd(),r=Ui(n),s=Li(t,n),o=Pe(t,n,i),a=e.pathExists??(async()=>!1);return(await Promise.all(o.map(async c=>{let u=Eo(c.id),d=[],g=kt(t[c.envVar]);return(g&&await a(g)||g&&await a(r.join(g,"skills")))&&d.push("override"),u.detection.projectProbeRelativePaths.length>0&&await Ei({basePath:i,relativePaths:u.detection.projectProbeRelativePaths,pathApi:r,pathExists:a})&&d.push("project"),s&&u.detection.globalProbeRelativePaths.length>0&&await Ei({basePath:s,relativePaths:u.detection.globalProbeRelativePaths,pathApi:r,pathExists:a})&&d.push("global"),d.length===0?null:{...c,detectionSources:Ao(d)}}))).flatMap(c=>c?[c]:[])}function Li(e,t){return t==="win32"?kt(e.USERPROFILE,e.HOME):kt(e.HOME)}function Ui(e){return e==="win32"?$o:Ro}function kt(...e){return e.find(t=>typeof t=="string"&&t.trim().length>0)?.trim()}function Ao(e){return[...new Set(e)]}async function Ei(e){for(let t of e.relativePaths)if(await e.pathExists(Je(e.pathApi,e.basePath,t)))return!0;return!1}function Je(e,t,n){return e.join(t,...n.split("/"))}function E(e,t,n,i={}){let r=i.globalRootRelativePath??n,s=i.detectProject??!0;return{id:e,displayName:t,envVar:i.envVar??Ti(e),capabilities:i.capabilities??B(),targets:{projectRootRelativePath:n,projectSkillsRelativePath:`${n}/skills`,globalRootRelativePath:r,globalSkillsRelativePath:`${r}/skills`},detection:{projectProbeRelativePaths:s?[n,`${n}/skills`]:[],globalProbeRelativePaths:[r,`${r}/skills`]}}}function fe(e,t,n,i={}){let r=i.detectGlobal??!1;return{id:e,displayName:t,envVar:i.envVar??Ti(e),capabilities:i.capabilities??B(),targets:{projectRootRelativePath:".agents",projectSkillsRelativePath:".agents/skills",globalRootRelativePath:n,globalSkillsRelativePath:`${n}/skills`},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:r?[n,`${n}/skills`]:[]}}}function B(e={}){let t=["basic_skills"];return e.allowedTools&&t.push("allowed_tools"),e.hooks&&t.push("hooks"),e.forkedContext&&t.push("forked_context"),t.push("local_install"),t}function Ti(e){return`${e.replaceAll("-","_").toUpperCase()}_HOME`}function Eo(e){return Ii.find(t=>t.id===e)}var $e="skills-layer",To="2025-06-18",Fo=["mcp","skills-layer-mcp-proxy.mjs"],No=["mcp","skills-layer-mcp-broker.mjs"],Mo=["mcp","skills-layer-mcp-broker.sock"],Bo={codex:{tier:"tier_1",configKind:"codex_toml",resolveConfigPath(e,t,n){let i=sn(n);return i.join(e.targets.globalRoot??i.join(Zo({},n)??t,".codex"),"config.toml")}},cursor:Ye(".cursor/mcp.json"),"claude-code":Ye(".mcp.json"),cline:Ye(".cline/mcp.json"),"gemini-cli":Ye(".gemini/settings.json"),windsurf:Ye(".windsurf/mcp.json")},Oo=new Set(["universal"]);function et(e){let t=Pe(e.env,e.platform,e.cwd),n=new Map(t.map(P=>[P.id,P])),i=e.platform??process.platform,r=e.cwd??process.cwd(),s=e.stateDir??Yo(e.env,i),o=e.mcpConfigPath??Ze(i,s,"mcp.json"),a=Ze(i,s,...Fo),c=Ze(i,s,...No),u=Ze(i,s,...Mo),d=e.nodePath??process.execPath,g=Oi({mcpConfigPath:o}),f=qi({mcpConfigPath:o,socketPath:u}),m=Fe(g),y=Fe(f),v=Re.map(P=>{let R=n.get(P),L=Bo[P];if(L){let K=L.resolveConfigPath(R,r,i);return qo({agentId:P,displayName:R.displayName,configPath:K,configKind:L.configKind,bridgePath:a,brokerPath:c,brokerSocketPath:u,mcpConfigPath:o,nodePath:d,bridgeChecksum:m,brokerChecksum:y})}return Oo.has(P)?Ni({agentId:P,displayName:R.displayName,tier:"tier_3",status:"skills_only",verification:"skills_only",reason:"This agent is currently supported through Skills Layer skill files, not MCP auto-install.",instructions:[`Install skills for ${R.displayName} with \`skills-layer install <skill> --agent ${P}\`.`,"MCP auto-install is not claimed for this agent yet."]}):Ni({agentId:P,displayName:R.displayName,tier:"tier_2",status:"manual_handoff",verification:"manual",reason:"MCP support or the safe writable config shape has not been verified yet.",instructions:[`Add a local stdio MCP server named ${$e}.`,`Command: ${d}`,`Args: ${a}`,"Restart or reload the agent if it does not reconnect automatically."]})});return{status:"mcp_registration_plan",serverName:$e,mcpUrl:e.mcpUrl,bearerTokenEnvVar:e.bearerTokenEnvVar,clientId:e.clientId,environment:e.environment,generatedAt:e.now,bridgePath:a,brokerPath:c,brokerSocketPath:u,nodePath:d,mcpConfigPath:o,bridgeChecksum:m,brokerChecksum:y,automaticCount:v.filter(P=>P.status==="automatic").length,manualCount:v.filter(P=>P.status==="manual_handoff").length,skillsOnlyCount:v.filter(P=>P.status==="skills_only").length,unsupportedCount:v.filter(P=>P.status==="unsupported").length,targets:v}}async function tt(e){let t=et(e),n=Qo(e.clientId),i=t.targets.find(v=>v.agentId===n),r=e.mcpConfig??await bt(t.mcpConfigPath,{allowMissing:!0});if(!r)return Fi({plan:t,target:i,mcpConfig:null,tokenConfig:null,tokenPresent:!1,tokenRefPresent:!1,bridgeExists:!1,checksumMatches:!1,brokerExists:!1,brokerChecksumMatches:!1,targetConfigured:!1,rawTokenLeaked:!1});let s=await Xe(t.bridgePath),o=s!==null,a=s!==null&&Fe(s)===t.bridgeChecksum,c=await Xe(t.brokerPath),u=c!==null,d=c!==null&&Fe(c)===t.brokerChecksum,g=Xo(r,i.agentId),f=de(g,"token"),m=de(g,"tokenRef"),y=i.status==="automatic"?await Ho(i,f):{configured:!1,rawTokenLeaked:!1};return Fi({plan:t,target:i,mcpConfig:r,tokenConfig:g,tokenPresent:!!f,tokenRefPresent:!!m,bridgeExists:o,checksumMatches:a,brokerExists:u,brokerChecksumMatches:d,targetConfigured:y.configured,rawTokenLeaked:y.rawTokenLeaked})}function Oi(e){return`#!/usr/bin/env node
+var Vk=Object.create;var Lu=Object.defineProperty;var Gk=Object.getOwnPropertyDescriptor;var zk=Object.getOwnPropertyNames;var Kk=Object.getPrototypeOf,Hk=Object.prototype.hasOwnProperty;var gr=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var T=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Jk=(e,t,n,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of zk(t))!Hk.call(e,r)&&r!==n&&Lu(e,r,{get:()=>t[r],enumerable:!(i=Gk(t,r))||i.enumerable});return e};var Ou=(e,t,n)=>(n=e!=null?Vk(Kk(e)):{},Jk(t||!e||!e.__esModule?Lu(n,"default",{value:e,enumerable:!0}):n,e));var M=T(ae=>{"use strict";var Za=Symbol.for("yaml.alias"),wd=Symbol.for("yaml.document"),Lr=Symbol.for("yaml.map"),vd=Symbol.for("yaml.pair"),Xa=Symbol.for("yaml.scalar"),Or=Symbol.for("yaml.seq"),ot=Symbol.for("yaml.node.type"),vv=e=>!!e&&typeof e=="object"&&e[ot]===Za,bv=e=>!!e&&typeof e=="object"&&e[ot]===wd,Sv=e=>!!e&&typeof e=="object"&&e[ot]===Lr,_v=e=>!!e&&typeof e=="object"&&e[ot]===vd,bd=e=>!!e&&typeof e=="object"&&e[ot]===Xa,Pv=e=>!!e&&typeof e=="object"&&e[ot]===Or;function Sd(e){if(e&&typeof e=="object")switch(e[ot]){case Lr:case Or:return!0}return!1}function Av(e){if(e&&typeof e=="object")switch(e[ot]){case Za:case Lr:case Xa:case Or:return!0}return!1}var Rv=e=>(bd(e)||Sd(e))&&!!e.anchor;ae.ALIAS=Za;ae.DOC=wd;ae.MAP=Lr;ae.NODE_TYPE=ot;ae.PAIR=vd;ae.SCALAR=Xa;ae.SEQ=Or;ae.hasAnchor=Rv;ae.isAlias=vv;ae.isCollection=Sd;ae.isDocument=bv;ae.isMap=Sv;ae.isNode=Av;ae.isPair=_v;ae.isScalar=bd;ae.isSeq=Pv});var ni=T(Qa=>{"use strict";var ne=M(),ve=Symbol("break visit"),_d=Symbol("skip children"),Ye=Symbol("remove node");function Nr(e,t){let n=Pd(t);ne.isDocument(e)?un(null,e.contents,n,Object.freeze([e]))===Ye&&(e.contents=null):un(null,e,n,Object.freeze([]))}Nr.BREAK=ve;Nr.SKIP=_d;Nr.REMOVE=Ye;function un(e,t,n,i){let r=Ad(e,t,n,i);if(ne.isNode(r)||ne.isPair(r))return Rd(e,i,r),un(e,r,n,i);if(typeof r!="symbol"){if(ne.isCollection(t)){i=Object.freeze(i.concat(t));for(let s=0;s<t.items.length;++s){let a=un(s,t.items[s],n,i);if(typeof a=="number")s=a-1;else{if(a===ve)return ve;a===Ye&&(t.items.splice(s,1),s-=1)}}}else if(ne.isPair(t)){i=Object.freeze(i.concat(t));let s=un("key",t.key,n,i);if(s===ve)return ve;s===Ye&&(t.key=null);let a=un("value",t.value,n,i);if(a===ve)return ve;a===Ye&&(t.value=null)}}return r}async function jr(e,t){let n=Pd(t);ne.isDocument(e)?await dn(null,e.contents,n,Object.freeze([e]))===Ye&&(e.contents=null):await dn(null,e,n,Object.freeze([]))}jr.BREAK=ve;jr.SKIP=_d;jr.REMOVE=Ye;async function dn(e,t,n,i){let r=await Ad(e,t,n,i);if(ne.isNode(r)||ne.isPair(r))return Rd(e,i,r),dn(e,r,n,i);if(typeof r!="symbol"){if(ne.isCollection(t)){i=Object.freeze(i.concat(t));for(let s=0;s<t.items.length;++s){let a=await dn(s,t.items[s],n,i);if(typeof a=="number")s=a-1;else{if(a===ve)return ve;a===Ye&&(t.items.splice(s,1),s-=1)}}}else if(ne.isPair(t)){i=Object.freeze(i.concat(t));let s=await dn("key",t.key,n,i);if(s===ve)return ve;s===Ye&&(t.key=null);let a=await dn("value",t.value,n,i);if(a===ve)return ve;a===Ye&&(t.value=null)}}return r}function Pd(e){return typeof e=="object"&&(e.Collection||e.Node||e.Value)?Object.assign({Alias:e.Node,Map:e.Node,Scalar:e.Node,Seq:e.Node},e.Value&&{Map:e.Value,Scalar:e.Value,Seq:e.Value},e.Collection&&{Map:e.Collection,Seq:e.Collection},e):e}function Ad(e,t,n,i){if(typeof n=="function")return n(e,t,i);if(ne.isMap(t))return n.Map?.(e,t,i);if(ne.isSeq(t))return n.Seq?.(e,t,i);if(ne.isPair(t))return n.Pair?.(e,t,i);if(ne.isScalar(t))return n.Scalar?.(e,t,i);if(ne.isAlias(t))return n.Alias?.(e,t,i)}function Rd(e,t,n){let i=t[t.length-1];if(ne.isCollection(i))i.items[e]=n;else if(ne.isPair(i))e==="key"?i.key=n:i.value=n;else if(ne.isDocument(i))i.contents=n;else{let r=ne.isAlias(i)?"alias":"scalar";throw new Error(`Cannot replace node with ${r} parent`)}}Qa.visit=Nr;Qa.visitAsync=jr});var eo=T(Ed=>{"use strict";var Cd=M(),Cv=ni(),Ev={"!":"%21",",":"%2C","[":"%5B","]":"%5D","{":"%7B","}":"%7D"},xv=e=>e.replace(/[!,[\]{}]/g,t=>Ev[t]),ii=class e{constructor(t,n){this.docStart=null,this.docEnd=!1,this.yaml=Object.assign({},e.defaultYaml,t),this.tags=Object.assign({},e.defaultTags,n)}clone(){let t=new e(this.yaml,this.tags);return t.docStart=this.docStart,t}atDocument(){let t=new e(this.yaml,this.tags);switch(this.yaml.version){case"1.1":this.atNextDocument=!0;break;case"1.2":this.atNextDocument=!1,this.yaml={explicit:e.defaultYaml.explicit,version:"1.2"},this.tags=Object.assign({},e.defaultTags);break}return t}add(t,n){this.atNextDocument&&(this.yaml={explicit:e.defaultYaml.explicit,version:"1.1"},this.tags=Object.assign({},e.defaultTags),this.atNextDocument=!1);let i=t.trim().split(/[ \t]+/),r=i.shift();switch(r){case"%TAG":{if(i.length!==2&&(n(0,"%TAG directive should contain exactly two parts"),i.length<2))return!1;let[s,a]=i;return this.tags[s]=a,!0}case"%YAML":{if(this.yaml.explicit=!0,i.length!==1)return n(0,"%YAML directive should contain exactly one part"),!1;let[s]=i;if(s==="1.1"||s==="1.2")return this.yaml.version=s,!0;{let a=/^\d+\.\d+$/.test(s);return n(6,`Unsupported YAML version ${s}`,a),!1}}default:return n(0,`Unknown directive ${r}`,!0),!1}}tagName(t,n){if(t==="!")return"!";if(t[0]!=="!")return n(`Not a valid tag: ${t}`),null;if(t[1]==="<"){let a=t.slice(2,-1);return a==="!"||a==="!!"?(n(`Verbatim tags aren't resolved, so ${t} is invalid.`),null):(t[t.length-1]!==">"&&n("Verbatim tags must end with a >"),a)}let[,i,r]=t.match(/^(.*!)([^!]*)$/s);r||n(`The ${t} tag has no suffix`);let s=this.tags[i];if(s)try{return s+decodeURIComponent(r)}catch(a){return n(String(a)),null}return i==="!"?t:(n(`Could not resolve tag: ${t}`),null)}tagString(t){for(let[n,i]of Object.entries(this.tags))if(t.startsWith(i))return n+xv(t.substring(i.length));return t[0]==="!"?t:`!<${t}>`}toString(t){let n=this.yaml.explicit?[`%YAML ${this.yaml.version||"1.2"}`]:[],i=Object.entries(this.tags),r;if(t&&i.length>0&&Cd.isNode(t.contents)){let s={};Cv.visit(t.contents,(a,o)=>{Cd.isNode(o)&&o.tag&&(s[o.tag]=!0)}),r=Object.keys(s)}else r=[];for(let[s,a]of i)s==="!!"&&a==="tag:yaml.org,2002:"||(!t||r.some(o=>o.startsWith(a)))&&n.push(`%TAG ${s} ${a}`);return n.join(`
+`)}};ii.defaultYaml={explicit:!1,version:"1.2"};ii.defaultTags={"!!":"tag:yaml.org,2002:"};Ed.Directives=ii});var Br=T(ri=>{"use strict";var xd=M(),Iv=ni();function Tv(e){if(/[\x00-\x19\s,[\]{}]/.test(e)){let n=`Anchor must not contain whitespace or control characters: ${JSON.stringify(e)}`;throw new Error(n)}return!0}function Id(e){let t=new Set;return Iv.visit(e,{Value(n,i){i.anchor&&t.add(i.anchor)}}),t}function Td(e,t){for(let n=1;;++n){let i=`${e}${n}`;if(!t.has(i))return i}}function $v(e,t){let n=[],i=new Map,r=null;return{onAnchor:s=>{n.push(s),r??(r=Id(e));let a=Td(t,r);return r.add(a),a},setAnchors:()=>{for(let s of n){let a=i.get(s);if(typeof a=="object"&&a.anchor&&(xd.isScalar(a.node)||xd.isCollection(a.node)))a.node.anchor=a.anchor;else{let o=new Error("Failed to resolve repeated object (this should not happen)");throw o.source=s,o}}},sourceObjects:i}}ri.anchorIsValid=Tv;ri.anchorNames=Id;ri.createNodeAnchors=$v;ri.findNewAnchor=Td});var to=T($d=>{"use strict";function si(e,t,n,i){if(i&&typeof i=="object")if(Array.isArray(i))for(let r=0,s=i.length;r<s;++r){let a=i[r],o=si(e,i,String(r),a);o===void 0?delete i[r]:o!==a&&(i[r]=o)}else if(i instanceof Map)for(let r of Array.from(i.keys())){let s=i.get(r),a=si(e,i,r,s);a===void 0?i.delete(r):a!==s&&i.set(r,a)}else if(i instanceof Set)for(let r of Array.from(i)){let s=si(e,i,r,r);s===void 0?i.delete(r):s!==r&&(i.delete(r),i.add(s))}else for(let[r,s]of Object.entries(i)){let a=si(e,i,r,s);a===void 0?delete i[r]:a!==s&&(i[r]=a)}return e.call(t,n,i)}$d.applyReviver=si});var pt=T(Od=>{"use strict";var Lv=M();function Ld(e,t,n){if(Array.isArray(e))return e.map((i,r)=>Ld(i,String(r),n));if(e&&typeof e.toJSON=="function"){if(!n||!Lv.hasAnchor(e))return e.toJSON(t,n);let i={aliasCount:0,count:1,res:void 0};n.anchors.set(e,i),n.onCreate=s=>{i.res=s,delete n.onCreate};let r=e.toJSON(t,n);return n.onCreate&&n.onCreate(r),r}return typeof e=="bigint"&&!n?.keep?Number(e):e}Od.toJS=Ld});var Fr=T(jd=>{"use strict";var Ov=to(),Nd=M(),Nv=pt(),no=class{constructor(t){Object.defineProperty(this,Nd.NODE_TYPE,{value:t})}clone(){let t=Object.create(Object.getPrototypeOf(this),Object.getOwnPropertyDescriptors(this));return this.range&&(t.range=this.range.slice()),t}toJS(t,{mapAsMap:n,maxAliasCount:i,onAnchor:r,reviver:s}={}){if(!Nd.isDocument(t))throw new TypeError("A document argument is required");let a={anchors:new Map,doc:t,keep:!0,mapAsMap:n===!0,mapKeyWarned:!1,maxAliasCount:typeof i=="number"?i:100},o=Nv.toJS(this,"",a);if(typeof r=="function")for(let{count:l,res:c}of a.anchors.values())r(c,l);return typeof s=="function"?Ov.applyReviver(s,{"":o},"",o):o}};jd.NodeBase=no});var ai=T(Bd=>{"use strict";var jv=Br(),Bv=ni(),pn=M(),Fv=Fr(),Dv=pt(),io=class extends Fv.NodeBase{constructor(t){super(pn.ALIAS),this.source=t,Object.defineProperty(this,"tag",{set(){throw new Error("Alias nodes cannot have tags")}})}resolve(t,n){if(n?.maxAliasCount===0)throw new ReferenceError("Alias resolution is disabled");let i;n?.aliasResolveCache?i=n.aliasResolveCache:(i=[],Bv.visit(t,{Node:(s,a)=>{(pn.isAlias(a)||pn.hasAnchor(a))&&i.push(a)}}),n&&(n.aliasResolveCache=i));let r;for(let s of i){if(s===this)break;s.anchor===this.source&&(r=s)}return r}toJSON(t,n){if(!n)return{source:this.source};let{anchors:i,doc:r,maxAliasCount:s}=n,a=this.resolve(r,n);if(!a){let l=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw new ReferenceError(l)}let o=i.get(a);if(o||(Dv.toJS(a,null,n),o=i.get(a)),o?.res===void 0){let l="This should not happen: Alias anchor was not resolved?";throw new ReferenceError(l)}if(s>=0&&(o.count+=1,o.aliasCount===0&&(o.aliasCount=Dr(r,a,i)),o.count*o.aliasCount>s)){let l="Excessive alias count indicates a resource exhaustion attack";throw new ReferenceError(l)}return o.res}toString(t,n,i){let r=`*${this.source}`;if(t){if(jv.anchorIsValid(this.source),t.options.verifyAliasOrder&&!t.anchors.has(this.source)){let s=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw new Error(s)}if(t.implicitKey)return`${r} `}return r}};function Dr(e,t,n){if(pn.isAlias(t)){let i=t.resolve(e),r=n&&i&&n.get(i);return r?r.count*r.aliasCount:0}else if(pn.isCollection(t)){let i=0;for(let r of t.items){let s=Dr(e,r,n);s>i&&(i=s)}return i}else if(pn.isPair(t)){let i=Dr(e,t.key,n),r=Dr(e,t.value,n);return Math.max(i,r)}return 1}Bd.Alias=io});var Q=T(ro=>{"use strict";var qv=M(),Mv=Fr(),Uv=pt(),Vv=e=>!e||typeof e!="function"&&typeof e!="object",ft=class extends Mv.NodeBase{constructor(t){super(qv.SCALAR),this.value=t}toJSON(t,n){return n?.keep?this.value:Uv.toJS(this.value,t,n)}toString(){return String(this.value)}};ft.BLOCK_FOLDED="BLOCK_FOLDED";ft.BLOCK_LITERAL="BLOCK_LITERAL";ft.PLAIN="PLAIN";ft.QUOTE_DOUBLE="QUOTE_DOUBLE";ft.QUOTE_SINGLE="QUOTE_SINGLE";ro.Scalar=ft;ro.isScalarValue=Vv});var oi=T(Dd=>{"use strict";var Gv=ai(),Ot=M(),Fd=Q(),zv="tag:yaml.org,2002:";function Kv(e,t,n){if(t){let i=n.filter(s=>s.tag===t),r=i.find(s=>!s.format)??i[0];if(!r)throw new Error(`Tag ${t} not found`);return r}return n.find(i=>i.identify?.(e)&&!i.format)}function Hv(e,t,n){if(Ot.isDocument(e)&&(e=e.contents),Ot.isNode(e))return e;if(Ot.isPair(e)){let p=n.schema[Ot.MAP].createNode?.(n.schema,null,n);return p.items.push(e),p}(e instanceof String||e instanceof Number||e instanceof Boolean||typeof BigInt<"u"&&e instanceof BigInt)&&(e=e.valueOf());let{aliasDuplicateObjects:i,onAnchor:r,onTagObj:s,schema:a,sourceObjects:o}=n,l;if(i&&e&&typeof e=="object"){if(l=o.get(e),l)return l.anchor??(l.anchor=r(e)),new Gv.Alias(l.anchor);l={anchor:null,node:null},o.set(e,l)}t?.startsWith("!!")&&(t=zv+t.slice(2));let c=Kv(e,t,a.tags);if(!c){if(e&&typeof e.toJSON=="function"&&(e=e.toJSON()),!e||typeof e!="object"){let p=new Fd.Scalar(e);return l&&(l.node=p),p}c=e instanceof Map?a[Ot.MAP]:Symbol.iterator in Object(e)?a[Ot.SEQ]:a[Ot.MAP]}s&&(s(c),delete n.onTagObj);let d=c?.createNode?c.createNode(n.schema,e,n):typeof c?.nodeClass?.from=="function"?c.nodeClass.from(n.schema,e,n):new Fd.Scalar(e);return t?d.tag=t:c.default||(d.tag=c.tag),l&&(l.node=d),d}Dd.createNode=Hv});var Mr=T(qr=>{"use strict";var Jv=oi(),Ze=M(),Wv=Fr();function so(e,t,n){let i=n;for(let r=t.length-1;r>=0;--r){let s=t[r];if(typeof s=="number"&&Number.isInteger(s)&&s>=0){let a=[];a[s]=i,i=a}else i=new Map([[s,i]])}return Jv.createNode(i,void 0,{aliasDuplicateObjects:!1,keepUndefined:!1,onAnchor:()=>{throw new Error("This should not happen, please report a bug.")},schema:e,sourceObjects:new Map})}var qd=e=>e==null||typeof e=="object"&&!!e[Symbol.iterator]().next().done,ao=class extends Wv.NodeBase{constructor(t,n){super(t),Object.defineProperty(this,"schema",{value:n,configurable:!0,enumerable:!1,writable:!0})}clone(t){let n=Object.create(Object.getPrototypeOf(this),Object.getOwnPropertyDescriptors(this));return t&&(n.schema=t),n.items=n.items.map(i=>Ze.isNode(i)||Ze.isPair(i)?i.clone(t):i),this.range&&(n.range=this.range.slice()),n}addIn(t,n){if(qd(t))this.add(n);else{let[i,...r]=t,s=this.get(i,!0);if(Ze.isCollection(s))s.addIn(r,n);else if(s===void 0&&this.schema)this.set(i,so(this.schema,r,n));else throw new Error(`Expected YAML collection at ${i}. Remaining path: ${r}`)}}deleteIn(t){let[n,...i]=t;if(i.length===0)return this.delete(n);let r=this.get(n,!0);if(Ze.isCollection(r))return r.deleteIn(i);throw new Error(`Expected YAML collection at ${n}. Remaining path: ${i}`)}getIn(t,n){let[i,...r]=t,s=this.get(i,!0);return r.length===0?!n&&Ze.isScalar(s)?s.value:s:Ze.isCollection(s)?s.getIn(r,n):void 0}hasAllNullValues(t){return this.items.every(n=>{if(!Ze.isPair(n))return!1;let i=n.value;return i==null||t&&Ze.isScalar(i)&&i.value==null&&!i.commentBefore&&!i.comment&&!i.tag})}hasIn(t){let[n,...i]=t;if(i.length===0)return this.has(n);let r=this.get(n,!0);return Ze.isCollection(r)?r.hasIn(i):!1}setIn(t,n){let[i,...r]=t;if(r.length===0)this.set(i,n);else{let s=this.get(i,!0);if(Ze.isCollection(s))s.setIn(r,n);else if(s===void 0&&this.schema)this.set(i,so(this.schema,r,n));else throw new Error(`Expected YAML collection at ${i}. Remaining path: ${r}`)}}};qr.Collection=ao;qr.collectionFromPath=so;qr.isEmptyPath=qd});var li=T(Ur=>{"use strict";var Yv=e=>e.replace(/^(?!$)(?: $)?/gm,"#");function oo(e,t){return/^\n+$/.test(e)?e.substring(1):t?e.replace(/^(?! *$)/gm,t):e}var Zv=(e,t,n)=>e.endsWith(`
+`)?oo(n,t):n.includes(`
+`)?`
+`+oo(n,t):(e.endsWith(" ")?"":" ")+n;Ur.indentComment=oo;Ur.lineComment=Zv;Ur.stringifyComment=Yv});var Ud=T(ci=>{"use strict";var Xv="flow",lo="block",Vr="quoted";function Qv(e,t,n="flow",{indentAtStart:i,lineWidth:r=80,minContentWidth:s=20,onFold:a,onOverflow:o}={}){if(!r||r<0)return e;r<s&&(s=0);let l=Math.max(1+s,1+r-t.length);if(e.length<=l)return e;let c=[],d={},p=r-t.length;typeof i=="number"&&(i>r-Math.max(2,s)?c.push(0):p=r-i);let f,g,h=!1,m=-1,y=-1,w=-1;n===lo&&(m=Md(e,m,t.length),m!==-1&&(p=m+l));for(let S;S=e[m+=1];){if(n===Vr&&S==="\\"){switch(y=m,e[m+1]){case"x":m+=3;break;case"u":m+=5;break;case"U":m+=9;break;default:m+=1}w=m}if(S===`
+`)n===lo&&(m=Md(e,m,t.length)),p=m+t.length+l,f=void 0;else{if(S===" "&&g&&g!==" "&&g!==`
+`&&g!=="	"){let A=e[m+1];A&&A!==" "&&A!==`
+`&&A!=="	"&&(f=m)}if(m>=p)if(f)c.push(f),p=f+l,f=void 0;else if(n===Vr){for(;g===" "||g==="	";)g=S,S=e[m+=1],h=!0;let A=m>w+1?m-2:y-1;if(d[A])return e;c.push(A),d[A]=!0,p=A+l,f=void 0}else h=!0}g=S}if(h&&o&&o(),c.length===0)return e;a&&a();let v=e.slice(0,c[0]);for(let S=0;S<c.length;++S){let A=c[S],x=c[S+1]||e.length;A===0?v=`
+${t}${e.slice(0,x)}`:(n===Vr&&d[A]&&(v+=`${e[A]}\\`),v+=`
+${t}${e.slice(A+1,x)}`)}return v}function Md(e,t,n){let i=t,r=t+1,s=e[r];for(;s===" "||s==="	";)if(t<r+n)s=e[++t];else{do s=e[++t];while(s&&s!==`
+`);i=t,r=t+1,s=e[r]}return i}ci.FOLD_BLOCK=lo;ci.FOLD_FLOW=Xv;ci.FOLD_QUOTED=Vr;ci.foldFlowLines=Qv});var di=T(Vd=>{"use strict";var Ue=Q(),gt=Ud(),zr=(e,t)=>({indentAtStart:t?e.indent.length:e.indentAtStart,lineWidth:e.options.lineWidth,minContentWidth:e.options.minContentWidth}),Kr=e=>/^(%|---|\.\.\.)/m.test(e);function eb(e,t,n){if(!t||t<0)return!1;let i=t-n,r=e.length;if(r<=i)return!1;for(let s=0,a=0;s<r;++s)if(e[s]===`
+`){if(s-a>i)return!0;if(a=s+1,r-a<=i)return!1}return!0}function ui(e,t){let n=JSON.stringify(e);if(t.options.doubleQuotedAsJSON)return n;let{implicitKey:i}=t,r=t.options.doubleQuotedMinMultiLineLength,s=t.indent||(Kr(e)?"  ":""),a="",o=0;for(let l=0,c=n[l];c;c=n[++l])if(c===" "&&n[l+1]==="\\"&&n[l+2]==="n"&&(a+=n.slice(o,l)+"\\ ",l+=1,o=l,c="\\"),c==="\\")switch(n[l+1]){case"u":{a+=n.slice(o,l);let d=n.substr(l+2,4);switch(d){case"0000":a+="\\0";break;case"0007":a+="\\a";break;case"000b":a+="\\v";break;case"001b":a+="\\e";break;case"0085":a+="\\N";break;case"00a0":a+="\\_";break;case"2028":a+="\\L";break;case"2029":a+="\\P";break;default:d.substr(0,2)==="00"?a+="\\x"+d.substr(2):a+=n.substr(l,6)}l+=5,o=l+1}break;case"n":if(i||n[l+2]==='"'||n.length<r)l+=1;else{for(a+=n.slice(o,l)+`
+
+`;n[l+2]==="\\"&&n[l+3]==="n"&&n[l+4]!=='"';)a+=`
+`,l+=2;a+=s,n[l+2]===" "&&(a+="\\"),l+=1,o=l+1}break;default:l+=1}return a=o?a+n.slice(o):n,i?a:gt.foldFlowLines(a,s,gt.FOLD_QUOTED,zr(t,!1))}function co(e,t){if(t.options.singleQuote===!1||t.implicitKey&&e.includes(`
+`)||/[ \t]\n|\n[ \t]/.test(e))return ui(e,t);let n=t.indent||(Kr(e)?"  ":""),i="'"+e.replace(/'/g,"''").replace(/\n+/g,`$&
+${n}`)+"'";return t.implicitKey?i:gt.foldFlowLines(i,n,gt.FOLD_FLOW,zr(t,!1))}function fn(e,t){let{singleQuote:n}=t.options,i;if(n===!1)i=ui;else{let r=e.includes('"'),s=e.includes("'");r&&!s?i=co:s&&!r?i=ui:i=n?co:ui}return i(e,t)}var uo;try{uo=new RegExp(`(^|(?<!
+))
++(?!
+|$)`,"g")}catch{uo=/\n+(?!\n|$)/g}function Gr({comment:e,type:t,value:n},i,r,s){let{blockQuote:a,commentString:o,lineWidth:l}=i.options;if(!a||/\n[\t ]+$/.test(n))return fn(n,i);let c=i.indent||(i.forceBlockIndent||Kr(n)?"  ":""),d=a==="literal"?!0:a==="folded"||t===Ue.Scalar.BLOCK_FOLDED?!1:t===Ue.Scalar.BLOCK_LITERAL?!0:!eb(n,l,c.length);if(!n)return d?`|
+`:`>
+`;let p,f;for(f=n.length;f>0;--f){let x=n[f-1];if(x!==`
+`&&x!=="	"&&x!==" ")break}let g=n.substring(f),h=g.indexOf(`
+`);h===-1?p="-":n===g||h!==g.length-1?(p="+",s&&s()):p="",g&&(n=n.slice(0,-g.length),g[g.length-1]===`
+`&&(g=g.slice(0,-1)),g=g.replace(uo,`$&${c}`));let m=!1,y,w=-1;for(y=0;y<n.length;++y){let x=n[y];if(x===" ")m=!0;else if(x===`
+`)w=y;else break}let v=n.substring(0,w<y?w+1:y);v&&(n=n.substring(v.length),v=v.replace(/\n+/g,`$&${c}`));let A=(m?c?"2":"1":"")+p;if(e&&(A+=" "+o(e.replace(/ ?[\r\n]+/g," ")),r&&r()),!d){let x=n.replace(/\n+/g,`
+$&`).replace(/(?:^|\n)([\t ].*)(?:([\n\t ]*)\n(?![\n\t ]))?/g,"$1$2").replace(/\n+/g,`$&${c}`),$=!1,O=zr(i,!0);a!=="folded"&&t!==Ue.Scalar.BLOCK_FOLDED&&(O.onOverflow=()=>{$=!0});let I=gt.foldFlowLines(`${v}${x}${g}`,c,gt.FOLD_BLOCK,O);if(!$)return`>${A}
+${c}${I}`}return n=n.replace(/\n+/g,`$&${c}`),`|${A}
+${c}${v}${n}${g}`}function tb(e,t,n,i){let{type:r,value:s}=e,{actualString:a,implicitKey:o,indent:l,indentStep:c,inFlow:d}=t;if(o&&s.includes(`
+`)||d&&/[[\]{},]/.test(s))return fn(s,t);if(/^[\n\t ,[\]{}#&*!|>'"%@`]|^[?-]$|^[?-][ \t]|[\n:][ \t]|[ \t]\n|[\n\t ]#|[\n\t :]$/.test(s))return o||d||!s.includes(`
+`)?fn(s,t):Gr(e,t,n,i);if(!o&&!d&&r!==Ue.Scalar.PLAIN&&s.includes(`
+`))return Gr(e,t,n,i);if(Kr(s)){if(l==="")return t.forceBlockIndent=!0,Gr(e,t,n,i);if(o&&l===c)return fn(s,t)}let p=s.replace(/\n+/g,`$&
+${l}`);if(a){let f=m=>m.default&&m.tag!=="tag:yaml.org,2002:str"&&m.test?.test(p),{compat:g,tags:h}=t.doc.schema;if(h.some(f)||g?.some(f))return fn(s,t)}return o?p:gt.foldFlowLines(p,l,gt.FOLD_FLOW,zr(t,!1))}function nb(e,t,n,i){let{implicitKey:r,inFlow:s}=t,a=typeof e.value=="string"?e:Object.assign({},e,{value:String(e.value)}),{type:o}=e;o!==Ue.Scalar.QUOTE_DOUBLE&&/[\x00-\x08\x0b-\x1f\x7f-\x9f\u{D800}-\u{DFFF}]/u.test(a.value)&&(o=Ue.Scalar.QUOTE_DOUBLE);let l=d=>{switch(d){case Ue.Scalar.BLOCK_FOLDED:case Ue.Scalar.BLOCK_LITERAL:return r||s?fn(a.value,t):Gr(a,t,n,i);case Ue.Scalar.QUOTE_DOUBLE:return ui(a.value,t);case Ue.Scalar.QUOTE_SINGLE:return co(a.value,t);case Ue.Scalar.PLAIN:return tb(a,t,n,i);default:return null}},c=l(o);if(c===null){let{defaultKeyType:d,defaultStringType:p}=t.options,f=r&&d||p;if(c=l(f),c===null)throw new Error(`Unsupported default string type ${f}`)}return c}Vd.stringifyString=nb});var pi=T(po=>{"use strict";var ib=Br(),mt=M(),rb=li(),sb=di();function ab(e,t){let n=Object.assign({blockQuote:!0,commentString:rb.stringifyComment,defaultKeyType:null,defaultStringType:"PLAIN",directives:null,doubleQuotedAsJSON:!1,doubleQuotedMinMultiLineLength:40,falseStr:"false",flowCollectionPadding:!0,indentSeq:!0,lineWidth:80,minContentWidth:20,nullStr:"null",simpleKeys:!1,singleQuote:null,trailingComma:!1,trueStr:"true",verifyAliasOrder:!0},e.schema.toStringOptions,t),i;switch(n.collectionStyle){case"block":i=!1;break;case"flow":i=!0;break;default:i=null}return{anchors:new Set,doc:e,flowCollectionPadding:n.flowCollectionPadding?" ":"",indent:"",indentStep:typeof n.indent=="number"?" ".repeat(n.indent):"  ",inFlow:i,options:n}}function ob(e,t){if(t.tag){let r=e.filter(s=>s.tag===t.tag);if(r.length>0)return r.find(s=>s.format===t.format)??r[0]}let n,i;if(mt.isScalar(t)){i=t.value;let r=e.filter(s=>s.identify?.(i));if(r.length>1){let s=r.filter(a=>a.test);s.length>0&&(r=s)}n=r.find(s=>s.format===t.format)??r.find(s=>!s.format)}else i=t,n=e.find(r=>r.nodeClass&&i instanceof r.nodeClass);if(!n){let r=i?.constructor?.name??(i===null?"null":typeof i);throw new Error(`Tag not resolved for ${r} value`)}return n}function lb(e,t,{anchors:n,doc:i}){if(!i.directives)return"";let r=[],s=(mt.isScalar(e)||mt.isCollection(e))&&e.anchor;s&&ib.anchorIsValid(s)&&(n.add(s),r.push(`&${s}`));let a=e.tag??(t.default?null:t.tag);return a&&r.push(i.directives.tagString(a)),r.join(" ")}function cb(e,t,n,i){if(mt.isPair(e))return e.toString(t,n,i);if(mt.isAlias(e)){if(t.doc.directives)return e.toString(t);if(t.resolvedAliases?.has(e))throw new TypeError("Cannot stringify circular structure without alias nodes");t.resolvedAliases?t.resolvedAliases.add(e):t.resolvedAliases=new Set([e]),e=e.resolve(t.doc)}let r,s=mt.isNode(e)?e:t.doc.createNode(e,{onTagObj:l=>r=l});r??(r=ob(t.doc.schema.tags,s));let a=lb(s,r,t);a.length>0&&(t.indentAtStart=(t.indentAtStart??0)+a.length+1);let o=typeof r.stringify=="function"?r.stringify(s,t,n,i):mt.isScalar(s)?sb.stringifyString(s,t,n,i):s.toString(t,n,i);return a?mt.isScalar(s)||o[0]==="{"||o[0]==="["?`${a} ${o}`:`${a}
+${t.indent}${o}`:o}po.createStringifyContext=ab;po.stringify=cb});var Hd=T(Kd=>{"use strict";var lt=M(),Gd=Q(),zd=pi(),fi=li();function ub({key:e,value:t},n,i,r){let{allNullValues:s,doc:a,indent:o,indentStep:l,options:{commentString:c,indentSeq:d,simpleKeys:p}}=n,f=lt.isNode(e)&&e.comment||null;if(p){if(f)throw new Error("With simple keys, key nodes cannot have comments");if(lt.isCollection(e)||!lt.isNode(e)&&typeof e=="object"){let O="With simple keys, collection cannot be used as a key value";throw new Error(O)}}let g=!p&&(!e||f&&t==null&&!n.inFlow||lt.isCollection(e)||(lt.isScalar(e)?e.type===Gd.Scalar.BLOCK_FOLDED||e.type===Gd.Scalar.BLOCK_LITERAL:typeof e=="object"));n=Object.assign({},n,{allNullValues:!1,implicitKey:!g&&(p||!s),indent:o+l});let h=!1,m=!1,y=zd.stringify(e,n,()=>h=!0,()=>m=!0);if(!g&&!n.inFlow&&y.length>1024){if(p)throw new Error("With simple keys, single line scalar must not span more than 1024 characters");g=!0}if(n.inFlow){if(s||t==null)return h&&i&&i(),y===""?"?":g?`? ${y}`:y}else if(s&&!p||t==null&&g)return y=`? ${y}`,f&&!h?y+=fi.lineComment(y,n.indent,c(f)):m&&r&&r(),y;h&&(f=null),g?(f&&(y+=fi.lineComment(y,n.indent,c(f))),y=`? ${y}
+${o}:`):(y=`${y}:`,f&&(y+=fi.lineComment(y,n.indent,c(f))));let w,v,S;lt.isNode(t)?(w=!!t.spaceBefore,v=t.commentBefore,S=t.comment):(w=!1,v=null,S=null,t&&typeof t=="object"&&(t=a.createNode(t))),n.implicitKey=!1,!g&&!f&&lt.isScalar(t)&&(n.indentAtStart=y.length+1),m=!1,!d&&l.length>=2&&!n.inFlow&&!g&&lt.isSeq(t)&&!t.flow&&!t.tag&&!t.anchor&&(n.indent=n.indent.substring(2));let A=!1,x=zd.stringify(t,n,()=>A=!0,()=>m=!0),$=" ";if(f||w||v){if($=w?`
+`:"",v){let O=c(v);$+=`
+${fi.indentComment(O,n.indent)}`}x===""&&!n.inFlow?$===`
+`&&S&&($=`
+
+`):$+=`
+${n.indent}`}else if(!g&&lt.isCollection(t)){let O=x[0],I=x.indexOf(`
+`),G=I!==-1,se=n.inFlow??t.flow??t.items.length===0;if(G||!se){let Ie=!1;if(G&&(O==="&"||O==="!")){let W=x.indexOf(" ");O==="&"&&W!==-1&&W<I&&x[W+1]==="!"&&(W=x.indexOf(" ",W+1)),(W===-1||I<W)&&(Ie=!0)}Ie||($=`
+${n.indent}`)}}else(x===""||x[0]===`
+`)&&($="");return y+=$+x,n.inFlow?A&&i&&i():S&&!A?y+=fi.lineComment(y,n.indent,c(S)):m&&r&&r(),y}Kd.stringifyPair=ub});var go=T(fo=>{"use strict";var Jd=gr("process");function db(e,...t){e==="debug"&&console.log(...t)}function pb(e,t){(e==="debug"||e==="warn")&&(typeof Jd.emitWarning=="function"?Jd.emitWarning(t):console.warn(t))}fo.debug=db;fo.warn=pb});var Zr=T(Yr=>{"use strict";var Wr=M(),Wd=Q(),Hr="<<",Jr={identify:e=>e===Hr||typeof e=="symbol"&&e.description===Hr,default:"key",tag:"tag:yaml.org,2002:merge",test:/^<<$/,resolve:()=>Object.assign(new Wd.Scalar(Symbol(Hr)),{addToJSMap:Yd}),stringify:()=>Hr},fb=(e,t)=>(Jr.identify(t)||Wr.isScalar(t)&&(!t.type||t.type===Wd.Scalar.PLAIN)&&Jr.identify(t.value))&&e?.doc.schema.tags.some(n=>n.tag===Jr.tag&&n.default);function Yd(e,t,n){let i=Zd(e,n);if(Wr.isSeq(i))for(let r of i.items)mo(e,t,r);else if(Array.isArray(i))for(let r of i)mo(e,t,r);else mo(e,t,i)}function mo(e,t,n){let i=Zd(e,n);if(!Wr.isMap(i))throw new Error("Merge sources must be maps or map aliases");let r=i.toJSON(null,e,Map);for(let[s,a]of r)t instanceof Map?t.has(s)||t.set(s,a):t instanceof Set?t.add(s):Object.prototype.hasOwnProperty.call(t,s)||Object.defineProperty(t,s,{value:a,writable:!0,enumerable:!0,configurable:!0});return t}function Zd(e,t){return e&&Wr.isAlias(t)?t.resolve(e.doc,e):t}Yr.addMergeToJSMap=Yd;Yr.isMergeKey=fb;Yr.merge=Jr});var yo=T(ep=>{"use strict";var gb=go(),Xd=Zr(),mb=pi(),Qd=M(),ho=pt();function hb(e,t,{key:n,value:i}){if(Qd.isNode(n)&&n.addToJSMap)n.addToJSMap(e,t,i);else if(Xd.isMergeKey(e,n))Xd.addMergeToJSMap(e,t,i);else{let r=ho.toJS(n,"",e);if(t instanceof Map)t.set(r,ho.toJS(i,r,e));else if(t instanceof Set)t.add(r);else{let s=yb(n,r,e),a=ho.toJS(i,s,e);s in t?Object.defineProperty(t,s,{value:a,writable:!0,enumerable:!0,configurable:!0}):t[s]=a}}return t}function yb(e,t,n){if(t===null)return"";if(typeof t!="object")return String(t);if(Qd.isNode(e)&&n?.doc){let i=mb.createStringifyContext(n.doc,{});i.anchors=new Set;for(let s of n.anchors.keys())i.anchors.add(s.anchor);i.inFlow=!0,i.inStringifyKey=!0;let r=e.toString(i);if(!n.mapKeyWarned){let s=JSON.stringify(r);s.length>40&&(s=s.substring(0,36)+'..."'),gb.warn(n.doc.options.logLevel,`Keys with collection values will be stringified due to JS Object restrictions: ${s}. Set mapAsMap: true to use object keys.`),n.mapKeyWarned=!0}return r}return JSON.stringify(t)}ep.addPairToJSMap=hb});var ht=T(ko=>{"use strict";var tp=oi(),kb=Hd(),wb=yo(),Xr=M();function vb(e,t,n){let i=tp.createNode(e,void 0,n),r=tp.createNode(t,void 0,n);return new Qr(i,r)}var Qr=class e{constructor(t,n=null){Object.defineProperty(this,Xr.NODE_TYPE,{value:Xr.PAIR}),this.key=t,this.value=n}clone(t){let{key:n,value:i}=this;return Xr.isNode(n)&&(n=n.clone(t)),Xr.isNode(i)&&(i=i.clone(t)),new e(n,i)}toJSON(t,n){let i=n?.mapAsMap?new Map:{};return wb.addPairToJSMap(n,i,this)}toString(t,n,i){return t?.doc?kb.stringifyPair(this,t,n,i):JSON.stringify(this)}};ko.Pair=Qr;ko.createPair=vb});var wo=T(ip=>{"use strict";var Nt=M(),np=pi(),es=li();function bb(e,t,n){return(t.inFlow??e.flow?_b:Sb)(e,t,n)}function Sb({comment:e,items:t},n,{blockItemPrefix:i,flowChars:r,itemIndent:s,onChompKeep:a,onComment:o}){let{indent:l,options:{commentString:c}}=n,d=Object.assign({},n,{indent:s,type:null}),p=!1,f=[];for(let h=0;h<t.length;++h){let m=t[h],y=null;if(Nt.isNode(m))!p&&m.spaceBefore&&f.push(""),ts(n,f,m.commentBefore,p),m.comment&&(y=m.comment);else if(Nt.isPair(m)){let v=Nt.isNode(m.key)?m.key:null;v&&(!p&&v.spaceBefore&&f.push(""),ts(n,f,v.commentBefore,p))}p=!1;let w=np.stringify(m,d,()=>y=null,()=>p=!0);y&&(w+=es.lineComment(w,s,c(y))),p&&y&&(p=!1),f.push(i+w)}let g;if(f.length===0)g=r.start+r.end;else{g=f[0];for(let h=1;h<f.length;++h){let m=f[h];g+=m?`
+${l}${m}`:`
+`}}return e?(g+=`
+`+es.indentComment(c(e),l),o&&o()):p&&a&&a(),g}function _b({items:e},t,{flowChars:n,itemIndent:i}){let{indent:r,indentStep:s,flowCollectionPadding:a,options:{commentString:o}}=t;i+=s;let l=Object.assign({},t,{indent:i,inFlow:!0,type:null}),c=!1,d=0,p=[];for(let h=0;h<e.length;++h){let m=e[h],y=null;if(Nt.isNode(m))m.spaceBefore&&p.push(""),ts(t,p,m.commentBefore,!1),m.comment&&(y=m.comment);else if(Nt.isPair(m)){let v=Nt.isNode(m.key)?m.key:null;v&&(v.spaceBefore&&p.push(""),ts(t,p,v.commentBefore,!1),v.comment&&(c=!0));let S=Nt.isNode(m.value)?m.value:null;S?(S.comment&&(y=S.comment),S.commentBefore&&(c=!0)):m.value==null&&v?.comment&&(y=v.comment)}y&&(c=!0);let w=np.stringify(m,l,()=>y=null);c||(c=p.length>d||w.includes(`
+`)),h<e.length-1?w+=",":t.options.trailingComma&&(t.options.lineWidth>0&&(c||(c=p.reduce((v,S)=>v+S.length+2,2)+(w.length+2)>t.options.lineWidth)),c&&(w+=",")),y&&(w+=es.lineComment(w,i,o(y))),p.push(w),d=p.length}let{start:f,end:g}=n;if(p.length===0)return f+g;if(!c){let h=p.reduce((m,y)=>m+y.length+2,2);c=t.options.lineWidth>0&&h>t.options.lineWidth}if(c){let h=f;for(let m of p)h+=m?`
+${s}${r}${m}`:`
+`;return`${h}
+${r}${g}`}else return`${f}${a}${p.join(" ")}${a}${g}`}function ts({indent:e,options:{commentString:t}},n,i,r){if(i&&r&&(i=i.replace(/^\n+/,"")),i){let s=es.indentComment(t(i),e);n.push(s.trimStart())}}ip.stringifyCollection=bb});var kt=T(bo=>{"use strict";var Pb=wo(),Ab=yo(),Rb=Mr(),yt=M(),ns=ht(),Cb=Q();function gi(e,t){let n=yt.isScalar(t)?t.value:t;for(let i of e)if(yt.isPair(i)&&(i.key===t||i.key===n||yt.isScalar(i.key)&&i.key.value===n))return i}var vo=class extends Rb.Collection{static get tagName(){return"tag:yaml.org,2002:map"}constructor(t){super(yt.MAP,t),this.items=[]}static from(t,n,i){let{keepUndefined:r,replacer:s}=i,a=new this(t),o=(l,c)=>{if(typeof s=="function")c=s.call(n,l,c);else if(Array.isArray(s)&&!s.includes(l))return;(c!==void 0||r)&&a.items.push(ns.createPair(l,c,i))};if(n instanceof Map)for(let[l,c]of n)o(l,c);else if(n&&typeof n=="object")for(let l of Object.keys(n))o(l,n[l]);return typeof t.sortMapEntries=="function"&&a.items.sort(t.sortMapEntries),a}add(t,n){let i;yt.isPair(t)?i=t:!t||typeof t!="object"||!("key"in t)?i=new ns.Pair(t,t?.value):i=new ns.Pair(t.key,t.value);let r=gi(this.items,i.key),s=this.schema?.sortMapEntries;if(r){if(!n)throw new Error(`Key ${i.key} already set`);yt.isScalar(r.value)&&Cb.isScalarValue(i.value)?r.value.value=i.value:r.value=i.value}else if(s){let a=this.items.findIndex(o=>s(i,o)<0);a===-1?this.items.push(i):this.items.splice(a,0,i)}else this.items.push(i)}delete(t){let n=gi(this.items,t);return n?this.items.splice(this.items.indexOf(n),1).length>0:!1}get(t,n){let r=gi(this.items,t)?.value;return(!n&&yt.isScalar(r)?r.value:r)??void 0}has(t){return!!gi(this.items,t)}set(t,n){this.add(new ns.Pair(t,n),!0)}toJSON(t,n,i){let r=i?new i:n?.mapAsMap?new Map:{};n?.onCreate&&n.onCreate(r);for(let s of this.items)Ab.addPairToJSMap(n,r,s);return r}toString(t,n,i){if(!t)return JSON.stringify(this);for(let r of this.items)if(!yt.isPair(r))throw new Error(`Map items must all be pairs; found ${JSON.stringify(r)} instead`);return!t.allNullValues&&this.hasAllNullValues(!1)&&(t=Object.assign({},t,{allNullValues:!0})),Pb.stringifyCollection(this,t,{blockItemPrefix:"",flowChars:{start:"{",end:"}"},itemIndent:t.indent||"",onChompKeep:i,onComment:n})}};bo.YAMLMap=vo;bo.findPair=gi});var gn=T(sp=>{"use strict";var Eb=M(),rp=kt(),xb={collection:"map",default:!0,nodeClass:rp.YAMLMap,tag:"tag:yaml.org,2002:map",resolve(e,t){return Eb.isMap(e)||t("Expected a mapping for this tag"),e},createNode:(e,t,n)=>rp.YAMLMap.from(e,t,n)};sp.map=xb});var wt=T(ap=>{"use strict";var Ib=oi(),Tb=wo(),$b=Mr(),rs=M(),Lb=Q(),Ob=pt(),So=class extends $b.Collection{static get tagName(){return"tag:yaml.org,2002:seq"}constructor(t){super(rs.SEQ,t),this.items=[]}add(t){this.items.push(t)}delete(t){let n=is(t);return typeof n!="number"?!1:this.items.splice(n,1).length>0}get(t,n){let i=is(t);if(typeof i!="number")return;let r=this.items[i];return!n&&rs.isScalar(r)?r.value:r}has(t){let n=is(t);return typeof n=="number"&&n<this.items.length}set(t,n){let i=is(t);if(typeof i!="number")throw new Error(`Expected a valid index, not ${t}.`);let r=this.items[i];rs.isScalar(r)&&Lb.isScalarValue(n)?r.value=n:this.items[i]=n}toJSON(t,n){let i=[];n?.onCreate&&n.onCreate(i);let r=0;for(let s of this.items)i.push(Ob.toJS(s,String(r++),n));return i}toString(t,n,i){return t?Tb.stringifyCollection(this,t,{blockItemPrefix:"- ",flowChars:{start:"[",end:"]"},itemIndent:(t.indent||"")+"  ",onChompKeep:i,onComment:n}):JSON.stringify(this)}static from(t,n,i){let{replacer:r}=i,s=new this(t);if(n&&Symbol.iterator in Object(n)){let a=0;for(let o of n){if(typeof r=="function"){let l=n instanceof Set?o:String(a++);o=r.call(n,l,o)}s.items.push(Ib.createNode(o,void 0,i))}}return s}};function is(e){let t=rs.isScalar(e)?e.value:e;return t&&typeof t=="string"&&(t=Number(t)),typeof t=="number"&&Number.isInteger(t)&&t>=0?t:null}ap.YAMLSeq=So});var mn=T(lp=>{"use strict";var Nb=M(),op=wt(),jb={collection:"seq",default:!0,nodeClass:op.YAMLSeq,tag:"tag:yaml.org,2002:seq",resolve(e,t){return Nb.isSeq(e)||t("Expected a sequence for this tag"),e},createNode:(e,t,n)=>op.YAMLSeq.from(e,t,n)};lp.seq=jb});var mi=T(cp=>{"use strict";var Bb=di(),Fb={identify:e=>typeof e=="string",default:!0,tag:"tag:yaml.org,2002:str",resolve:e=>e,stringify(e,t,n,i){return t=Object.assign({actualString:!0},t),Bb.stringifyString(e,t,n,i)}};cp.string=Fb});var ss=T(pp=>{"use strict";var up=Q(),dp={identify:e=>e==null,createNode:()=>new up.Scalar(null),default:!0,tag:"tag:yaml.org,2002:null",test:/^(?:~|[Nn]ull|NULL)?$/,resolve:()=>new up.Scalar(null),stringify:({source:e},t)=>typeof e=="string"&&dp.test.test(e)?e:t.options.nullStr};pp.nullTag=dp});var _o=T(gp=>{"use strict";var Db=Q(),fp={identify:e=>typeof e=="boolean",default:!0,tag:"tag:yaml.org,2002:bool",test:/^(?:[Tt]rue|TRUE|[Ff]alse|FALSE)$/,resolve:e=>new Db.Scalar(e[0]==="t"||e[0]==="T"),stringify({source:e,value:t},n){if(e&&fp.test.test(e)){let i=e[0]==="t"||e[0]==="T";if(t===i)return e}return t?n.options.trueStr:n.options.falseStr}};gp.boolTag=fp});var hn=T(mp=>{"use strict";function qb({format:e,minFractionDigits:t,tag:n,value:i}){if(typeof i=="bigint")return String(i);let r=typeof i=="number"?i:Number(i);if(!isFinite(r))return isNaN(r)?".nan":r<0?"-.inf":".inf";let s=Object.is(i,-0)?"-0":JSON.stringify(i);if(!e&&t&&(!n||n==="tag:yaml.org,2002:float")&&/^-?\d/.test(s)&&!s.includes("e")){let a=s.indexOf(".");a<0&&(a=s.length,s+=".");let o=t-(s.length-a-1);for(;o-- >0;)s+="0"}return s}mp.stringifyNumber=qb});var Ao=T(as=>{"use strict";var Mb=Q(),Po=hn(),Ub={identify:e=>typeof e=="number",default:!0,tag:"tag:yaml.org,2002:float",test:/^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/,resolve:e=>e.slice(-3).toLowerCase()==="nan"?NaN:e[0]==="-"?Number.NEGATIVE_INFINITY:Number.POSITIVE_INFINITY,stringify:Po.stringifyNumber},Vb={identify:e=>typeof e=="number",default:!0,tag:"tag:yaml.org,2002:float",format:"EXP",test:/^[-+]?(?:\.[0-9]+|[0-9]+(?:\.[0-9]*)?)[eE][-+]?[0-9]+$/,resolve:e=>parseFloat(e),stringify(e){let t=Number(e.value);return isFinite(t)?t.toExponential():Po.stringifyNumber(e)}},Gb={identify:e=>typeof e=="number",default:!0,tag:"tag:yaml.org,2002:float",test:/^[-+]?(?:\.[0-9]+|[0-9]+\.[0-9]*)$/,resolve(e){let t=new Mb.Scalar(parseFloat(e)),n=e.indexOf(".");return n!==-1&&e[e.length-1]==="0"&&(t.minFractionDigits=e.length-n-1),t},stringify:Po.stringifyNumber};as.float=Gb;as.floatExp=Vb;as.floatNaN=Ub});var Co=T(ls=>{"use strict";var hp=hn(),os=e=>typeof e=="bigint"||Number.isInteger(e),Ro=(e,t,n,{intAsBigInt:i})=>i?BigInt(e):parseInt(e.substring(t),n);function yp(e,t,n){let{value:i}=e;return os(i)&&i>=0?n+i.toString(t):hp.stringifyNumber(e)}var zb={identify:e=>os(e)&&e>=0,default:!0,tag:"tag:yaml.org,2002:int",format:"OCT",test:/^0o[0-7]+$/,resolve:(e,t,n)=>Ro(e,2,8,n),stringify:e=>yp(e,8,"0o")},Kb={identify:os,default:!0,tag:"tag:yaml.org,2002:int",test:/^[-+]?[0-9]+$/,resolve:(e,t,n)=>Ro(e,0,10,n),stringify:hp.stringifyNumber},Hb={identify:e=>os(e)&&e>=0,default:!0,tag:"tag:yaml.org,2002:int",format:"HEX",test:/^0x[0-9a-fA-F]+$/,resolve:(e,t,n)=>Ro(e,2,16,n),stringify:e=>yp(e,16,"0x")};ls.int=Kb;ls.intHex=Hb;ls.intOct=zb});var wp=T(kp=>{"use strict";var Jb=gn(),Wb=ss(),Yb=mn(),Zb=mi(),Xb=_o(),Eo=Ao(),xo=Co(),Qb=[Jb.map,Yb.seq,Zb.string,Wb.nullTag,Xb.boolTag,xo.intOct,xo.int,xo.intHex,Eo.floatNaN,Eo.floatExp,Eo.float];kp.schema=Qb});var Sp=T(bp=>{"use strict";var eS=Q(),tS=gn(),nS=mn();function vp(e){return typeof e=="bigint"||Number.isInteger(e)}var cs=({value:e})=>JSON.stringify(e),iS=[{identify:e=>typeof e=="string",default:!0,tag:"tag:yaml.org,2002:str",resolve:e=>e,stringify:cs},{identify:e=>e==null,createNode:()=>new eS.Scalar(null),default:!0,tag:"tag:yaml.org,2002:null",test:/^null$/,resolve:()=>null,stringify:cs},{identify:e=>typeof e=="boolean",default:!0,tag:"tag:yaml.org,2002:bool",test:/^true$|^false$/,resolve:e=>e==="true",stringify:cs},{identify:vp,default:!0,tag:"tag:yaml.org,2002:int",test:/^-?(?:0|[1-9][0-9]*)$/,resolve:(e,t,{intAsBigInt:n})=>n?BigInt(e):parseInt(e,10),stringify:({value:e})=>vp(e)?e.toString():JSON.stringify(e)},{identify:e=>typeof e=="number",default:!0,tag:"tag:yaml.org,2002:float",test:/^-?(?:0|[1-9][0-9]*)(?:\.[0-9]*)?(?:[eE][-+]?[0-9]+)?$/,resolve:e=>parseFloat(e),stringify:cs}],rS={default:!0,tag:"",test:/^/,resolve(e,t){return t(`Unresolved plain scalar ${JSON.stringify(e)}`),e}},sS=[tS.map,nS.seq].concat(iS,rS);bp.schema=sS});var To=T(_p=>{"use strict";var hi=gr("buffer"),Io=Q(),aS=di(),oS={identify:e=>e instanceof Uint8Array,default:!1,tag:"tag:yaml.org,2002:binary",resolve(e,t){if(typeof hi.Buffer=="function")return hi.Buffer.from(e,"base64");if(typeof atob=="function"){let n=atob(e.replace(/[\n\r]/g,"")),i=new Uint8Array(n.length);for(let r=0;r<n.length;++r)i[r]=n.charCodeAt(r);return i}else return t("This environment does not support reading binary tags; either Buffer or atob is required"),e},stringify({comment:e,type:t,value:n},i,r,s){if(!n)return"";let a=n,o;if(typeof hi.Buffer=="function")o=a instanceof hi.Buffer?a.toString("base64"):hi.Buffer.from(a.buffer).toString("base64");else if(typeof btoa=="function"){let l="";for(let c=0;c<a.length;++c)l+=String.fromCharCode(a[c]);o=btoa(l)}else throw new Error("This environment does not support writing binary tags; either Buffer or btoa is required");if(t??(t=Io.Scalar.BLOCK_LITERAL),t!==Io.Scalar.QUOTE_DOUBLE){let l=Math.max(i.options.lineWidth-i.indent.length,i.options.minContentWidth),c=Math.ceil(o.length/l),d=new Array(c);for(let p=0,f=0;p<c;++p,f+=l)d[p]=o.substr(f,l);o=d.join(t===Io.Scalar.BLOCK_LITERAL?`
+`:" ")}return aS.stringifyString({comment:e,type:t,value:o},i,r,s)}};_p.binary=oS});var ps=T(ds=>{"use strict";var us=M(),$o=ht(),lS=Q(),cS=wt();function Pp(e,t){if(us.isSeq(e))for(let n=0;n<e.items.length;++n){let i=e.items[n];if(!us.isPair(i)){if(us.isMap(i)){i.items.length>1&&t("Each pair must have its own sequence indicator");let r=i.items[0]||new $o.Pair(new lS.Scalar(null));if(i.commentBefore&&(r.key.commentBefore=r.key.commentBefore?`${i.commentBefore}
+${r.key.commentBefore}`:i.commentBefore),i.comment){let s=r.value??r.key;s.comment=s.comment?`${i.comment}
+${s.comment}`:i.comment}i=r}e.items[n]=us.isPair(i)?i:new $o.Pair(i)}}else t("Expected a sequence for this tag");return e}function Ap(e,t,n){let{replacer:i}=n,r=new cS.YAMLSeq(e);r.tag="tag:yaml.org,2002:pairs";let s=0;if(t&&Symbol.iterator in Object(t))for(let a of t){typeof i=="function"&&(a=i.call(t,String(s++),a));let o,l;if(Array.isArray(a))if(a.length===2)o=a[0],l=a[1];else throw new TypeError(`Expected [key, value] tuple: ${a}`);else if(a&&a instanceof Object){let c=Object.keys(a);if(c.length===1)o=c[0],l=a[o];else throw new TypeError(`Expected tuple with one key, not ${c.length} keys`)}else o=a;r.items.push($o.createPair(o,l,n))}return r}var uS={collection:"seq",default:!1,tag:"tag:yaml.org,2002:pairs",resolve:Pp,createNode:Ap};ds.createPairs=Ap;ds.pairs=uS;ds.resolvePairs=Pp});var No=T(Oo=>{"use strict";var Rp=M(),Lo=pt(),yi=kt(),dS=wt(),Cp=ps(),jt=class e extends dS.YAMLSeq{constructor(){super(),this.add=yi.YAMLMap.prototype.add.bind(this),this.delete=yi.YAMLMap.prototype.delete.bind(this),this.get=yi.YAMLMap.prototype.get.bind(this),this.has=yi.YAMLMap.prototype.has.bind(this),this.set=yi.YAMLMap.prototype.set.bind(this),this.tag=e.tag}toJSON(t,n){if(!n)return super.toJSON(t);let i=new Map;n?.onCreate&&n.onCreate(i);for(let r of this.items){let s,a;if(Rp.isPair(r)?(s=Lo.toJS(r.key,"",n),a=Lo.toJS(r.value,s,n)):s=Lo.toJS(r,"",n),i.has(s))throw new Error("Ordered maps must not include duplicate keys");i.set(s,a)}return i}static from(t,n,i){let r=Cp.createPairs(t,n,i),s=new this;return s.items=r.items,s}};jt.tag="tag:yaml.org,2002:omap";var pS={collection:"seq",identify:e=>e instanceof Map,nodeClass:jt,default:!1,tag:"tag:yaml.org,2002:omap",resolve(e,t){let n=Cp.resolvePairs(e,t),i=[];for(let{key:r}of n.items)Rp.isScalar(r)&&(i.includes(r.value)?t(`Ordered maps must not include duplicate keys: ${r.value}`):i.push(r.value));return Object.assign(new jt,n)},createNode:(e,t,n)=>jt.from(e,t,n)};Oo.YAMLOMap=jt;Oo.omap=pS});var $p=T(jo=>{"use strict";var Ep=Q();function xp({value:e,source:t},n){return t&&(e?Ip:Tp).test.test(t)?t:e?n.options.trueStr:n.options.falseStr}var Ip={identify:e=>e===!0,default:!0,tag:"tag:yaml.org,2002:bool",test:/^(?:Y|y|[Yy]es|YES|[Tt]rue|TRUE|[Oo]n|ON)$/,resolve:()=>new Ep.Scalar(!0),stringify:xp},Tp={identify:e=>e===!1,default:!0,tag:"tag:yaml.org,2002:bool",test:/^(?:N|n|[Nn]o|NO|[Ff]alse|FALSE|[Oo]ff|OFF)$/,resolve:()=>new Ep.Scalar(!1),stringify:xp};jo.falseTag=Tp;jo.trueTag=Ip});var Lp=T(fs=>{"use strict";var fS=Q(),Bo=hn(),gS={identify:e=>typeof e=="number",default:!0,tag:"tag:yaml.org,2002:float",test:/^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/,resolve:e=>e.slice(-3).toLowerCase()==="nan"?NaN:e[0]==="-"?Number.NEGATIVE_INFINITY:Number.POSITIVE_INFINITY,stringify:Bo.stringifyNumber},mS={identify:e=>typeof e=="number",default:!0,tag:"tag:yaml.org,2002:float",format:"EXP",test:/^[-+]?(?:[0-9][0-9_]*)?(?:\.[0-9_]*)?[eE][-+]?[0-9]+$/,resolve:e=>parseFloat(e.replace(/_/g,"")),stringify(e){let t=Number(e.value);return isFinite(t)?t.toExponential():Bo.stringifyNumber(e)}},hS={identify:e=>typeof e=="number",default:!0,tag:"tag:yaml.org,2002:float",test:/^[-+]?(?:[0-9][0-9_]*)?\.[0-9_]*$/,resolve(e){let t=new fS.Scalar(parseFloat(e.replace(/_/g,""))),n=e.indexOf(".");if(n!==-1){let i=e.substring(n+1).replace(/_/g,"");i[i.length-1]==="0"&&(t.minFractionDigits=i.length)}return t},stringify:Bo.stringifyNumber};fs.float=hS;fs.floatExp=mS;fs.floatNaN=gS});var Np=T(wi=>{"use strict";var Op=hn(),ki=e=>typeof e=="bigint"||Number.isInteger(e);function gs(e,t,n,{intAsBigInt:i}){let r=e[0];if((r==="-"||r==="+")&&(t+=1),e=e.substring(t).replace(/_/g,""),i){switch(n){case 2:e=`0b${e}`;break;case 8:e=`0o${e}`;break;case 16:e=`0x${e}`;break}let a=BigInt(e);return r==="-"?BigInt(-1)*a:a}let s=parseInt(e,n);return r==="-"?-1*s:s}function Fo(e,t,n){let{value:i}=e;if(ki(i)){let r=i.toString(t);return i<0?"-"+n+r.substr(1):n+r}return Op.stringifyNumber(e)}var yS={identify:ki,default:!0,tag:"tag:yaml.org,2002:int",format:"BIN",test:/^[-+]?0b[0-1_]+$/,resolve:(e,t,n)=>gs(e,2,2,n),stringify:e=>Fo(e,2,"0b")},kS={identify:ki,default:!0,tag:"tag:yaml.org,2002:int",format:"OCT",test:/^[-+]?0[0-7_]+$/,resolve:(e,t,n)=>gs(e,1,8,n),stringify:e=>Fo(e,8,"0")},wS={identify:ki,default:!0,tag:"tag:yaml.org,2002:int",test:/^[-+]?[0-9][0-9_]*$/,resolve:(e,t,n)=>gs(e,0,10,n),stringify:Op.stringifyNumber},vS={identify:ki,default:!0,tag:"tag:yaml.org,2002:int",format:"HEX",test:/^[-+]?0x[0-9a-fA-F_]+$/,resolve:(e,t,n)=>gs(e,2,16,n),stringify:e=>Fo(e,16,"0x")};wi.int=wS;wi.intBin=yS;wi.intHex=vS;wi.intOct=kS});var qo=T(Do=>{"use strict";var ys=M(),ms=ht(),hs=kt(),Bt=class e extends hs.YAMLMap{constructor(t){super(t),this.tag=e.tag}add(t){let n;ys.isPair(t)?n=t:t&&typeof t=="object"&&"key"in t&&"value"in t&&t.value===null?n=new ms.Pair(t.key,null):n=new ms.Pair(t,null),hs.findPair(this.items,n.key)||this.items.push(n)}get(t,n){let i=hs.findPair(this.items,t);return!n&&ys.isPair(i)?ys.isScalar(i.key)?i.key.value:i.key:i}set(t,n){if(typeof n!="boolean")throw new Error(`Expected boolean value for set(key, value) in a YAML set, not ${typeof n}`);let i=hs.findPair(this.items,t);i&&!n?this.items.splice(this.items.indexOf(i),1):!i&&n&&this.items.push(new ms.Pair(t))}toJSON(t,n){return super.toJSON(t,n,Set)}toString(t,n,i){if(!t)return JSON.stringify(this);if(this.hasAllNullValues(!0))return super.toString(Object.assign({},t,{allNullValues:!0}),n,i);throw new Error("Set items must all have null values")}static from(t,n,i){let{replacer:r}=i,s=new this(t);if(n&&Symbol.iterator in Object(n))for(let a of n)typeof r=="function"&&(a=r.call(n,a,a)),s.items.push(ms.createPair(a,null,i));return s}};Bt.tag="tag:yaml.org,2002:set";var bS={collection:"map",identify:e=>e instanceof Set,nodeClass:Bt,default:!1,tag:"tag:yaml.org,2002:set",createNode:(e,t,n)=>Bt.from(e,t,n),resolve(e,t){if(ys.isMap(e)){if(e.hasAllNullValues(!0))return Object.assign(new Bt,e);t("Set items must all have null values")}else t("Expected a mapping for this tag");return e}};Do.YAMLSet=Bt;Do.set=bS});var Uo=T(ks=>{"use strict";var SS=hn();function Mo(e,t){let n=e[0],i=n==="-"||n==="+"?e.substring(1):e,r=a=>t?BigInt(a):Number(a),s=i.replace(/_/g,"").split(":").reduce((a,o)=>a*r(60)+r(o),r(0));return n==="-"?r(-1)*s:s}function jp(e){let{value:t}=e,n=a=>a;if(typeof t=="bigint")n=a=>BigInt(a);else if(isNaN(t)||!isFinite(t))return SS.stringifyNumber(e);let i="";t<0&&(i="-",t*=n(-1));let r=n(60),s=[t%r];return t<60?s.unshift(0):(t=(t-s[0])/r,s.unshift(t%r),t>=60&&(t=(t-s[0])/r,s.unshift(t))),i+s.map(a=>String(a).padStart(2,"0")).join(":").replace(/000000\d*$/,"")}var _S={identify:e=>typeof e=="bigint"||Number.isInteger(e),default:!0,tag:"tag:yaml.org,2002:int",format:"TIME",test:/^[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+$/,resolve:(e,t,{intAsBigInt:n})=>Mo(e,n),stringify:jp},PS={identify:e=>typeof e=="number",default:!0,tag:"tag:yaml.org,2002:float",format:"TIME",test:/^[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+\.[0-9_]*$/,resolve:e=>Mo(e,!1),stringify:jp},Bp={identify:e=>e instanceof Date,default:!0,tag:"tag:yaml.org,2002:timestamp",test:RegExp("^([0-9]{4})-([0-9]{1,2})-([0-9]{1,2})(?:(?:t|T|[ \\t]+)([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2}(\\.[0-9]+)?)(?:[ \\t]*(Z|[-+][012]?[0-9](?::[0-9]{2})?))?)?$"),resolve(e){let t=e.match(Bp.test);if(!t)throw new Error("!!timestamp expects a date, starting with yyyy-mm-dd");let[,n,i,r,s,a,o]=t.map(Number),l=t[7]?Number((t[7]+"00").substr(1,3)):0,c=Date.UTC(n,i-1,r,s||0,a||0,o||0,l),d=t[8];if(d&&d!=="Z"){let p=Mo(d,!1);Math.abs(p)<30&&(p*=60),c-=6e4*p}return new Date(c)},stringify:({value:e})=>e?.toISOString().replace(/(T00:00:00)?\.000Z$/,"")??""};ks.floatTime=PS;ks.intTime=_S;ks.timestamp=Bp});var qp=T(Dp=>{"use strict";var AS=gn(),RS=ss(),CS=mn(),ES=mi(),xS=To(),Fp=$p(),Vo=Lp(),ws=Np(),IS=Zr(),TS=No(),$S=ps(),LS=qo(),Go=Uo(),OS=[AS.map,CS.seq,ES.string,RS.nullTag,Fp.trueTag,Fp.falseTag,ws.intBin,ws.intOct,ws.int,ws.intHex,Vo.floatNaN,Vo.floatExp,Vo.float,xS.binary,IS.merge,TS.omap,$S.pairs,LS.set,Go.intTime,Go.floatTime,Go.timestamp];Dp.schema=OS});var Yp=T(Ho=>{"use strict";var Gp=gn(),NS=ss(),zp=mn(),jS=mi(),BS=_o(),zo=Ao(),Ko=Co(),FS=wp(),DS=Sp(),Kp=To(),vi=Zr(),Hp=No(),Jp=ps(),Mp=qp(),Wp=qo(),vs=Uo(),Up=new Map([["core",FS.schema],["failsafe",[Gp.map,zp.seq,jS.string]],["json",DS.schema],["yaml11",Mp.schema],["yaml-1.1",Mp.schema]]),Vp={binary:Kp.binary,bool:BS.boolTag,float:zo.float,floatExp:zo.floatExp,floatNaN:zo.floatNaN,floatTime:vs.floatTime,int:Ko.int,intHex:Ko.intHex,intOct:Ko.intOct,intTime:vs.intTime,map:Gp.map,merge:vi.merge,null:NS.nullTag,omap:Hp.omap,pairs:Jp.pairs,seq:zp.seq,set:Wp.set,timestamp:vs.timestamp},qS={"tag:yaml.org,2002:binary":Kp.binary,"tag:yaml.org,2002:merge":vi.merge,"tag:yaml.org,2002:omap":Hp.omap,"tag:yaml.org,2002:pairs":Jp.pairs,"tag:yaml.org,2002:set":Wp.set,"tag:yaml.org,2002:timestamp":vs.timestamp};function MS(e,t,n){let i=Up.get(t);if(i&&!e)return n&&!i.includes(vi.merge)?i.concat(vi.merge):i.slice();let r=i;if(!r)if(Array.isArray(e))r=[];else{let s=Array.from(Up.keys()).filter(a=>a!=="yaml11").map(a=>JSON.stringify(a)).join(", ");throw new Error(`Unknown schema "${t}"; use one of ${s} or define customTags array`)}if(Array.isArray(e))for(let s of e)r=r.concat(s);else typeof e=="function"&&(r=e(r.slice()));return n&&(r=r.concat(vi.merge)),r.reduce((s,a)=>{let o=typeof a=="string"?Vp[a]:a;if(!o){let l=JSON.stringify(a),c=Object.keys(Vp).map(d=>JSON.stringify(d)).join(", ");throw new Error(`Unknown custom tag ${l}; use one of ${c}`)}return s.includes(o)||s.push(o),s},[])}Ho.coreKnownTags=qS;Ho.getTags=MS});var Yo=T(Zp=>{"use strict";var Jo=M(),US=gn(),VS=mn(),GS=mi(),bs=Yp(),zS=(e,t)=>e.key<t.key?-1:e.key>t.key?1:0,Wo=class e{constructor({compat:t,customTags:n,merge:i,resolveKnownTags:r,schema:s,sortMapEntries:a,toStringDefaults:o}){this.compat=Array.isArray(t)?bs.getTags(t,"compat"):t?bs.getTags(null,t):null,this.name=typeof s=="string"&&s||"core",this.knownTags=r?bs.coreKnownTags:{},this.tags=bs.getTags(n,this.name,i),this.toStringOptions=o??null,Object.defineProperty(this,Jo.MAP,{value:US.map}),Object.defineProperty(this,Jo.SCALAR,{value:GS.string}),Object.defineProperty(this,Jo.SEQ,{value:VS.seq}),this.sortMapEntries=typeof a=="function"?a:a===!0?zS:null}clone(){let t=Object.create(e.prototype,Object.getOwnPropertyDescriptors(this));return t.tags=this.tags.slice(),t}};Zp.Schema=Wo});var Qp=T(Xp=>{"use strict";var KS=M(),Zo=pi(),bi=li();function HS(e,t){let n=[],i=t.directives===!0;if(t.directives!==!1&&e.directives){let l=e.directives.toString(e);l?(n.push(l),i=!0):e.directives.docStart&&(i=!0)}i&&n.push("---");let r=Zo.createStringifyContext(e,t),{commentString:s}=r.options;if(e.commentBefore){n.length!==1&&n.unshift("");let l=s(e.commentBefore);n.unshift(bi.indentComment(l,""))}let a=!1,o=null;if(e.contents){if(KS.isNode(e.contents)){if(e.contents.spaceBefore&&i&&n.push(""),e.contents.commentBefore){let d=s(e.contents.commentBefore);n.push(bi.indentComment(d,""))}r.forceBlockIndent=!!e.comment,o=e.contents.comment}let l=o?void 0:()=>a=!0,c=Zo.stringify(e.contents,r,()=>o=null,l);o&&(c+=bi.lineComment(c,"",s(o))),(c[0]==="|"||c[0]===">")&&n[n.length-1]==="---"?n[n.length-1]=`--- ${c}`:n.push(c)}else n.push(Zo.stringify(e.contents,r));if(e.directives?.docEnd)if(e.comment){let l=s(e.comment);l.includes(`
+`)?(n.push("..."),n.push(bi.indentComment(l,""))):n.push(`... ${l}`)}else n.push("...");else{let l=e.comment;l&&a&&(l=l.replace(/^\n+/,"")),l&&((!a||o)&&n[n.length-1]!==""&&n.push(""),n.push(bi.indentComment(s(l),"")))}return n.join(`
+`)+`
+`}Xp.stringifyDocument=HS});var Si=T(ef=>{"use strict";var JS=ai(),yn=Mr(),Oe=M(),WS=ht(),YS=pt(),ZS=Yo(),XS=Qp(),Xo=Br(),QS=to(),e_=oi(),Qo=eo(),el=class e{constructor(t,n,i){this.commentBefore=null,this.comment=null,this.errors=[],this.warnings=[],Object.defineProperty(this,Oe.NODE_TYPE,{value:Oe.DOC});let r=null;typeof n=="function"||Array.isArray(n)?r=n:i===void 0&&n&&(i=n,n=void 0);let s=Object.assign({intAsBigInt:!1,keepSourceTokens:!1,logLevel:"warn",prettyErrors:!0,strict:!0,stringKeys:!1,uniqueKeys:!0,version:"1.2"},i);this.options=s;let{version:a}=s;i?._directives?(this.directives=i._directives.atDocument(),this.directives.yaml.explicit&&(a=this.directives.yaml.version)):this.directives=new Qo.Directives({version:a}),this.setSchema(a,i),this.contents=t===void 0?null:this.createNode(t,r,i)}clone(){let t=Object.create(e.prototype,{[Oe.NODE_TYPE]:{value:Oe.DOC}});return t.commentBefore=this.commentBefore,t.comment=this.comment,t.errors=this.errors.slice(),t.warnings=this.warnings.slice(),t.options=Object.assign({},this.options),this.directives&&(t.directives=this.directives.clone()),t.schema=this.schema.clone(),t.contents=Oe.isNode(this.contents)?this.contents.clone(t.schema):this.contents,this.range&&(t.range=this.range.slice()),t}add(t){kn(this.contents)&&this.contents.add(t)}addIn(t,n){kn(this.contents)&&this.contents.addIn(t,n)}createAlias(t,n){if(!t.anchor){let i=Xo.anchorNames(this);t.anchor=!n||i.has(n)?Xo.findNewAnchor(n||"a",i):n}return new JS.Alias(t.anchor)}createNode(t,n,i){let r;if(typeof n=="function")t=n.call({"":t},"",t),r=n;else if(Array.isArray(n)){let y=v=>typeof v=="number"||v instanceof String||v instanceof Number,w=n.filter(y).map(String);w.length>0&&(n=n.concat(w)),r=n}else i===void 0&&n&&(i=n,n=void 0);let{aliasDuplicateObjects:s,anchorPrefix:a,flow:o,keepUndefined:l,onTagObj:c,tag:d}=i??{},{onAnchor:p,setAnchors:f,sourceObjects:g}=Xo.createNodeAnchors(this,a||"a"),h={aliasDuplicateObjects:s??!0,keepUndefined:l??!1,onAnchor:p,onTagObj:c,replacer:r,schema:this.schema,sourceObjects:g},m=e_.createNode(t,d,h);return o&&Oe.isCollection(m)&&(m.flow=!0),f(),m}createPair(t,n,i={}){let r=this.createNode(t,null,i),s=this.createNode(n,null,i);return new WS.Pair(r,s)}delete(t){return kn(this.contents)?this.contents.delete(t):!1}deleteIn(t){return yn.isEmptyPath(t)?this.contents==null?!1:(this.contents=null,!0):kn(this.contents)?this.contents.deleteIn(t):!1}get(t,n){return Oe.isCollection(this.contents)?this.contents.get(t,n):void 0}getIn(t,n){return yn.isEmptyPath(t)?!n&&Oe.isScalar(this.contents)?this.contents.value:this.contents:Oe.isCollection(this.contents)?this.contents.getIn(t,n):void 0}has(t){return Oe.isCollection(this.contents)?this.contents.has(t):!1}hasIn(t){return yn.isEmptyPath(t)?this.contents!==void 0:Oe.isCollection(this.contents)?this.contents.hasIn(t):!1}set(t,n){this.contents==null?this.contents=yn.collectionFromPath(this.schema,[t],n):kn(this.contents)&&this.contents.set(t,n)}setIn(t,n){yn.isEmptyPath(t)?this.contents=n:this.contents==null?this.contents=yn.collectionFromPath(this.schema,Array.from(t),n):kn(this.contents)&&this.contents.setIn(t,n)}setSchema(t,n={}){typeof t=="number"&&(t=String(t));let i;switch(t){case"1.1":this.directives?this.directives.yaml.version="1.1":this.directives=new Qo.Directives({version:"1.1"}),i={resolveKnownTags:!1,schema:"yaml-1.1"};break;case"1.2":case"next":this.directives?this.directives.yaml.version=t:this.directives=new Qo.Directives({version:t}),i={resolveKnownTags:!0,schema:"core"};break;case null:this.directives&&delete this.directives,i=null;break;default:{let r=JSON.stringify(t);throw new Error(`Expected '1.1', '1.2' or null as first argument, but found: ${r}`)}}if(n.schema instanceof Object)this.schema=n.schema;else if(i)this.schema=new ZS.Schema(Object.assign(i,n));else throw new Error("With a null YAML version, the { schema: Schema } option is required")}toJS({json:t,jsonArg:n,mapAsMap:i,maxAliasCount:r,onAnchor:s,reviver:a}={}){let o={anchors:new Map,doc:this,keep:!t,mapAsMap:i===!0,mapKeyWarned:!1,maxAliasCount:typeof r=="number"?r:100},l=YS.toJS(this.contents,n??"",o);if(typeof s=="function")for(let{count:c,res:d}of o.anchors.values())s(d,c);return typeof a=="function"?QS.applyReviver(a,{"":l},"",l):l}toJSON(t,n){return this.toJS({json:!0,jsonArg:t,mapAsMap:!1,onAnchor:n})}toString(t={}){if(this.errors.length>0)throw new Error("Document with errors cannot be stringified");if("indent"in t&&(!Number.isInteger(t.indent)||Number(t.indent)<=0)){let n=JSON.stringify(t.indent);throw new Error(`"indent" option must be a positive integer, not ${n}`)}return XS.stringifyDocument(this,t)}};function kn(e){if(Oe.isCollection(e))return!0;throw new Error("Expected a YAML collection as document contents")}ef.Document=el});var Ai=T(Pi=>{"use strict";var _i=class extends Error{constructor(t,n,i,r){super(),this.name=t,this.code=i,this.message=r,this.pos=n}},tl=class extends _i{constructor(t,n,i){super("YAMLParseError",t,n,i)}},nl=class extends _i{constructor(t,n,i){super("YAMLWarning",t,n,i)}},t_=(e,t)=>n=>{if(n.pos[0]===-1)return;n.linePos=n.pos.map(o=>t.linePos(o));let{line:i,col:r}=n.linePos[0];n.message+=` at line ${i}, column ${r}`;let s=r-1,a=e.substring(t.lineStarts[i-1],t.lineStarts[i]).replace(/[\n\r]+$/,"");if(s>=60&&a.length>80){let o=Math.min(s-39,a.length-79);a="\u2026"+a.substring(o),s-=o-1}if(a.length>80&&(a=a.substring(0,79)+"\u2026"),i>1&&/^ *$/.test(a.substring(0,s))){let o=e.substring(t.lineStarts[i-2],t.lineStarts[i-1]);o.length>80&&(o=o.substring(0,79)+`\u2026
+`),a=o+a}if(/[^ ]/.test(a)){let o=1,l=n.linePos[1];l?.line===i&&l.col>r&&(o=Math.max(1,Math.min(l.col-r,80-s)));let c=" ".repeat(s)+"^".repeat(o);n.message+=`:
+
+${a}
+${c}
+`}};Pi.YAMLError=_i;Pi.YAMLParseError=tl;Pi.YAMLWarning=nl;Pi.prettifyError=t_});var Ri=T(tf=>{"use strict";function n_(e,{flow:t,indicator:n,next:i,offset:r,onError:s,parentIndent:a,startOnNewline:o}){let l=!1,c=o,d=o,p="",f="",g=!1,h=!1,m=null,y=null,w=null,v=null,S=null,A=null,x=null;for(let I of e)switch(h&&(I.type!=="space"&&I.type!=="newline"&&I.type!=="comma"&&s(I.offset,"MISSING_CHAR","Tags and anchors must be separated from the next token by white space"),h=!1),m&&(c&&I.type!=="comment"&&I.type!=="newline"&&s(m,"TAB_AS_INDENT","Tabs are not allowed as indentation"),m=null),I.type){case"space":!t&&(n!=="doc-start"||i?.type!=="flow-collection")&&I.source.includes("	")&&(m=I),d=!0;break;case"comment":{d||s(I,"MISSING_CHAR","Comments must be separated from other tokens by white space characters");let G=I.source.substring(1)||" ";p?p+=f+G:p=G,f="",c=!1;break}case"newline":c?p?p+=I.source:(!A||n!=="seq-item-ind")&&(l=!0):f+=I.source,c=!0,g=!0,(y||w)&&(v=I),d=!0;break;case"anchor":y&&s(I,"MULTIPLE_ANCHORS","A node can have at most one anchor"),I.source.endsWith(":")&&s(I.offset+I.source.length-1,"BAD_ALIAS","Anchor ending in : is ambiguous",!0),y=I,x??(x=I.offset),c=!1,d=!1,h=!0;break;case"tag":{w&&s(I,"MULTIPLE_TAGS","A node can have at most one tag"),w=I,x??(x=I.offset),c=!1,d=!1,h=!0;break}case n:(y||w)&&s(I,"BAD_PROP_ORDER",`Anchors and tags must be after the ${I.source} indicator`),A&&s(I,"UNEXPECTED_TOKEN",`Unexpected ${I.source} in ${t??"collection"}`),A=I,c=n==="seq-item-ind"||n==="explicit-key-ind",d=!1;break;case"comma":if(t){S&&s(I,"UNEXPECTED_TOKEN",`Unexpected , in ${t}`),S=I,c=!1,d=!1;break}default:s(I,"UNEXPECTED_TOKEN",`Unexpected ${I.type} token`),c=!1,d=!1}let $=e[e.length-1],O=$?$.offset+$.source.length:r;return h&&i&&i.type!=="space"&&i.type!=="newline"&&i.type!=="comma"&&(i.type!=="scalar"||i.source!=="")&&s(i.offset,"MISSING_CHAR","Tags and anchors must be separated from the next token by white space"),m&&(c&&m.indent<=a||i?.type==="block-map"||i?.type==="block-seq")&&s(m,"TAB_AS_INDENT","Tabs are not allowed as indentation"),{comma:S,found:A,spaceBefore:l,comment:p,hasNewline:g,anchor:y,tag:w,newlineAfterProp:v,end:O,start:x??O}}tf.resolveProps=n_});var Ss=T(nf=>{"use strict";function il(e){if(!e)return null;switch(e.type){case"alias":case"scalar":case"double-quoted-scalar":case"single-quoted-scalar":if(e.source.includes(`
+`))return!0;if(e.end){for(let t of e.end)if(t.type==="newline")return!0}return!1;case"flow-collection":for(let t of e.items){for(let n of t.start)if(n.type==="newline")return!0;if(t.sep){for(let n of t.sep)if(n.type==="newline")return!0}if(il(t.key)||il(t.value))return!0}return!1;default:return!0}}nf.containsNewline=il});var rl=T(rf=>{"use strict";var i_=Ss();function r_(e,t,n){if(t?.type==="flow-collection"){let i=t.end[0];i.indent===e&&(i.source==="]"||i.source==="}")&&i_.containsNewline(t)&&n(i,"BAD_INDENT","Flow end indicator should be more indented than parent",!0)}}rf.flowIndentCheck=r_});var sl=T(af=>{"use strict";var sf=M();function s_(e,t,n){let{uniqueKeys:i}=e.options;if(i===!1)return!1;let r=typeof i=="function"?i:(s,a)=>s===a||sf.isScalar(s)&&sf.isScalar(a)&&s.value===a.value;return t.some(s=>r(s.key,n))}af.mapIncludes=s_});var pf=T(df=>{"use strict";var of=ht(),a_=kt(),lf=Ri(),o_=Ss(),cf=rl(),l_=sl(),uf="All mapping items must start at the same column";function c_({composeNode:e,composeEmptyNode:t},n,i,r,s){let a=s?.nodeClass??a_.YAMLMap,o=new a(n.schema);n.atRoot&&(n.atRoot=!1);let l=i.offset,c=null;for(let d of i.items){let{start:p,key:f,sep:g,value:h}=d,m=lf.resolveProps(p,{indicator:"explicit-key-ind",next:f??g?.[0],offset:l,onError:r,parentIndent:i.indent,startOnNewline:!0}),y=!m.found;if(y){if(f&&(f.type==="block-seq"?r(l,"BLOCK_AS_IMPLICIT_KEY","A block sequence may not be used as an implicit map key"):"indent"in f&&f.indent!==i.indent&&r(l,"BAD_INDENT",uf)),!m.anchor&&!m.tag&&!g){c=m.end,m.comment&&(o.comment?o.comment+=`
+`+m.comment:o.comment=m.comment);continue}(m.newlineAfterProp||o_.containsNewline(f))&&r(f??p[p.length-1],"MULTILINE_IMPLICIT_KEY","Implicit keys need to be on a single line")}else m.found?.indent!==i.indent&&r(l,"BAD_INDENT",uf);n.atKey=!0;let w=m.end,v=f?e(n,f,m,r):t(n,w,p,null,m,r);n.schema.compat&&cf.flowIndentCheck(i.indent,f,r),n.atKey=!1,l_.mapIncludes(n,o.items,v)&&r(w,"DUPLICATE_KEY","Map keys must be unique");let S=lf.resolveProps(g??[],{indicator:"map-value-ind",next:h,offset:v.range[2],onError:r,parentIndent:i.indent,startOnNewline:!f||f.type==="block-scalar"});if(l=S.end,S.found){y&&(h?.type==="block-map"&&!S.hasNewline&&r(l,"BLOCK_AS_IMPLICIT_KEY","Nested mappings are not allowed in compact mappings"),n.options.strict&&m.start<S.found.offset-1024&&r(v.range,"KEY_OVER_1024_CHARS","The : indicator must be at most 1024 chars after the start of an implicit block mapping key"));let A=h?e(n,h,S,r):t(n,l,g,null,S,r);n.schema.compat&&cf.flowIndentCheck(i.indent,h,r),l=A.range[2];let x=new of.Pair(v,A);n.options.keepSourceTokens&&(x.srcToken=d),o.items.push(x)}else{y&&r(v.range,"MISSING_CHAR","Implicit map keys need to be followed by map values"),S.comment&&(v.comment?v.comment+=`
+`+S.comment:v.comment=S.comment);let A=new of.Pair(v);n.options.keepSourceTokens&&(A.srcToken=d),o.items.push(A)}}return c&&c<l&&r(c,"IMPOSSIBLE","Map comment with trailing content"),o.range=[i.offset,l,c??l],o}df.resolveBlockMap=c_});var gf=T(ff=>{"use strict";var u_=wt(),d_=Ri(),p_=rl();function f_({composeNode:e,composeEmptyNode:t},n,i,r,s){let a=s?.nodeClass??u_.YAMLSeq,o=new a(n.schema);n.atRoot&&(n.atRoot=!1),n.atKey&&(n.atKey=!1);let l=i.offset,c=null;for(let{start:d,value:p}of i.items){let f=d_.resolveProps(d,{indicator:"seq-item-ind",next:p,offset:l,onError:r,parentIndent:i.indent,startOnNewline:!0});if(!f.found)if(f.anchor||f.tag||p)p?.type==="block-seq"?r(f.end,"BAD_INDENT","All sequence items must start at the same column"):r(l,"MISSING_CHAR","Sequence item without - indicator");else{c=f.end,f.comment&&(o.comment=f.comment);continue}let g=p?e(n,p,f,r):t(n,f.end,d,null,f,r);n.schema.compat&&p_.flowIndentCheck(i.indent,p,r),l=g.range[2],o.items.push(g)}return o.range=[i.offset,l,c??l],o}ff.resolveBlockSeq=f_});var wn=T(mf=>{"use strict";function g_(e,t,n,i){let r="";if(e){let s=!1,a="";for(let o of e){let{source:l,type:c}=o;switch(c){case"space":s=!0;break;case"comment":{n&&!s&&i(o,"MISSING_CHAR","Comments must be separated from other tokens by white space characters");let d=l.substring(1)||" ";r?r+=a+d:r=d,a="";break}case"newline":r&&(a+=l),s=!0;break;default:i(o,"UNEXPECTED_TOKEN",`Unexpected ${c} at node end`)}t+=l.length}}return{comment:r,offset:t}}mf.resolveEnd=g_});var wf=T(kf=>{"use strict";var m_=M(),h_=ht(),hf=kt(),y_=wt(),k_=wn(),yf=Ri(),w_=Ss(),v_=sl(),al="Block collections are not allowed within flow collections",ol=e=>e&&(e.type==="block-map"||e.type==="block-seq");function b_({composeNode:e,composeEmptyNode:t},n,i,r,s){let a=i.start.source==="{",o=a?"flow map":"flow sequence",l=s?.nodeClass??(a?hf.YAMLMap:y_.YAMLSeq),c=new l(n.schema);c.flow=!0;let d=n.atRoot;d&&(n.atRoot=!1),n.atKey&&(n.atKey=!1);let p=i.offset+i.start.source.length;for(let y=0;y<i.items.length;++y){let w=i.items[y],{start:v,key:S,sep:A,value:x}=w,$=yf.resolveProps(v,{flow:o,indicator:"explicit-key-ind",next:S??A?.[0],offset:p,onError:r,parentIndent:i.indent,startOnNewline:!1});if(!$.found){if(!$.anchor&&!$.tag&&!A&&!x){y===0&&$.comma?r($.comma,"UNEXPECTED_TOKEN",`Unexpected , in ${o}`):y<i.items.length-1&&r($.start,"UNEXPECTED_TOKEN",`Unexpected empty item in ${o}`),$.comment&&(c.comment?c.comment+=`
+`+$.comment:c.comment=$.comment),p=$.end;continue}!a&&n.options.strict&&w_.containsNewline(S)&&r(S,"MULTILINE_IMPLICIT_KEY","Implicit keys of flow sequence pairs need to be on a single line")}if(y===0)$.comma&&r($.comma,"UNEXPECTED_TOKEN",`Unexpected , in ${o}`);else if($.comma||r($.start,"MISSING_CHAR",`Missing , between ${o} items`),$.comment){let O="";e:for(let I of v)switch(I.type){case"comma":case"space":break;case"comment":O=I.source.substring(1);break e;default:break e}if(O){let I=c.items[c.items.length-1];m_.isPair(I)&&(I=I.value??I.key),I.comment?I.comment+=`
+`+O:I.comment=O,$.comment=$.comment.substring(O.length+1)}}if(!a&&!A&&!$.found){let O=x?e(n,x,$,r):t(n,$.end,A,null,$,r);c.items.push(O),p=O.range[2],ol(x)&&r(O.range,"BLOCK_IN_FLOW",al)}else{n.atKey=!0;let O=$.end,I=S?e(n,S,$,r):t(n,O,v,null,$,r);ol(S)&&r(I.range,"BLOCK_IN_FLOW",al),n.atKey=!1;let G=yf.resolveProps(A??[],{flow:o,indicator:"map-value-ind",next:x,offset:I.range[2],onError:r,parentIndent:i.indent,startOnNewline:!1});if(G.found){if(!a&&!$.found&&n.options.strict){if(A)for(let W of A){if(W===G.found)break;if(W.type==="newline"){r(W,"MULTILINE_IMPLICIT_KEY","Implicit keys of flow sequence pairs need to be on a single line");break}}$.start<G.found.offset-1024&&r(G.found,"KEY_OVER_1024_CHARS","The : indicator must be at most 1024 chars after the start of an implicit flow sequence key")}}else x&&("source"in x&&x.source?.[0]===":"?r(x,"MISSING_CHAR",`Missing space after : in ${o}`):r(G.start,"MISSING_CHAR",`Missing , or : between ${o} items`));let se=x?e(n,x,G,r):G.found?t(n,G.end,A,null,G,r):null;se?ol(x)&&r(se.range,"BLOCK_IN_FLOW",al):G.comment&&(I.comment?I.comment+=`
+`+G.comment:I.comment=G.comment);let Ie=new h_.Pair(I,se);if(n.options.keepSourceTokens&&(Ie.srcToken=w),a){let W=c;v_.mapIncludes(n,W.items,I)&&r(O,"DUPLICATE_KEY","Map keys must be unique"),W.items.push(Ie)}else{let W=new hf.YAMLMap(n.schema);W.flow=!0,W.items.push(Ie);let Gn=(se??I).range;W.range=[I.range[0],Gn[1],Gn[2]],c.items.push(W)}p=se?se.range[2]:G.end}}let f=a?"}":"]",[g,...h]=i.end,m=p;if(g?.source===f)m=g.offset+g.source.length;else{let y=o[0].toUpperCase()+o.substring(1),w=d?`${y} must end with a ${f}`:`${y} in block collection must be sufficiently indented and end with a ${f}`;r(p,d?"MISSING_CHAR":"BAD_INDENT",w),g&&g.source.length!==1&&h.unshift(g)}if(h.length>0){let y=k_.resolveEnd(h,m,n.options.strict,r);y.comment&&(c.comment?c.comment+=`
+`+y.comment:c.comment=y.comment),c.range=[i.offset,m,y.offset]}else c.range=[i.offset,m,m];return c}kf.resolveFlowCollection=b_});var bf=T(vf=>{"use strict";var S_=M(),__=Q(),P_=kt(),A_=wt(),R_=pf(),C_=gf(),E_=wf();function ll(e,t,n,i,r,s){let a=n.type==="block-map"?R_.resolveBlockMap(e,t,n,i,s):n.type==="block-seq"?C_.resolveBlockSeq(e,t,n,i,s):E_.resolveFlowCollection(e,t,n,i,s),o=a.constructor;return r==="!"||r===o.tagName?(a.tag=o.tagName,a):(r&&(a.tag=r),a)}function x_(e,t,n,i,r){let s=i.tag,a=s?t.directives.tagName(s.source,f=>r(s,"TAG_RESOLVE_FAILED",f)):null;if(n.type==="block-seq"){let{anchor:f,newlineAfterProp:g}=i,h=f&&s?f.offset>s.offset?f:s:f??s;h&&(!g||g.offset<h.offset)&&r(h,"MISSING_CHAR","Missing newline after block sequence props")}let o=n.type==="block-map"?"map":n.type==="block-seq"?"seq":n.start.source==="{"?"map":"seq";if(!s||!a||a==="!"||a===P_.YAMLMap.tagName&&o==="map"||a===A_.YAMLSeq.tagName&&o==="seq")return ll(e,t,n,r,a);let l=t.schema.tags.find(f=>f.tag===a&&f.collection===o);if(!l){let f=t.schema.knownTags[a];if(f?.collection===o)t.schema.tags.push(Object.assign({},f,{default:!1})),l=f;else return f?r(s,"BAD_COLLECTION_TYPE",`${f.tag} used for ${o} collection, but expects ${f.collection??"scalar"}`,!0):r(s,"TAG_RESOLVE_FAILED",`Unresolved tag: ${a}`,!0),ll(e,t,n,r,a)}let c=ll(e,t,n,r,a,l),d=l.resolve?.(c,f=>r(s,"TAG_RESOLVE_FAILED",f),t.options)??c,p=S_.isNode(d)?d:new __.Scalar(d);return p.range=c.range,p.tag=a,l?.format&&(p.format=l.format),p}vf.composeCollection=x_});var ul=T(Sf=>{"use strict";var cl=Q();function I_(e,t,n){let i=t.offset,r=T_(t,e.options.strict,n);if(!r)return{value:"",type:null,comment:"",range:[i,i,i]};let s=r.mode===">"?cl.Scalar.BLOCK_FOLDED:cl.Scalar.BLOCK_LITERAL,a=t.source?$_(t.source):[],o=a.length;for(let m=a.length-1;m>=0;--m){let y=a[m][1];if(y===""||y==="\r")o=m;else break}if(o===0){let m=r.chomp==="+"&&a.length>0?`
+`.repeat(Math.max(1,a.length-1)):"",y=i+r.length;return t.source&&(y+=t.source.length),{value:m,type:s,comment:r.comment,range:[i,y,y]}}let l=t.indent+r.indent,c=t.offset+r.length,d=0;for(let m=0;m<o;++m){let[y,w]=a[m];if(w===""||w==="\r")r.indent===0&&y.length>l&&(l=y.length);else{y.length<l&&n(c+y.length,"MISSING_CHAR","Block scalars with more-indented leading empty lines must use an explicit indentation indicator"),r.indent===0&&(l=y.length),d=m,l===0&&!e.atRoot&&n(c,"BAD_INDENT","Block scalar values in collections must be indented");break}c+=y.length+w.length+1}for(let m=a.length-1;m>=o;--m)a[m][0].length>l&&(o=m+1);let p="",f="",g=!1;for(let m=0;m<d;++m)p+=a[m][0].slice(l)+`
+`;for(let m=d;m<o;++m){let[y,w]=a[m];c+=y.length+w.length+1;let v=w[w.length-1]==="\r";if(v&&(w=w.slice(0,-1)),w&&y.length<l){let A=`Block scalar lines must not be less indented than their ${r.indent?"explicit indentation indicator":"first line"}`;n(c-w.length-(v?2:1),"BAD_INDENT",A),y=""}s===cl.Scalar.BLOCK_LITERAL?(p+=f+y.slice(l)+w,f=`
+`):y.length>l||w[0]==="	"?(f===" "?f=`
+`:!g&&f===`
+`&&(f=`
+
+`),p+=f+y.slice(l)+w,f=`
+`,g=!0):w===""?f===`
+`?p+=`
+`:f=`
+`:(p+=f+w,f=" ",g=!1)}switch(r.chomp){case"-":break;case"+":for(let m=o;m<a.length;++m)p+=`
+`+a[m][0].slice(l);p[p.length-1]!==`
+`&&(p+=`
+`);break;default:p+=`
+`}let h=i+r.length+t.source.length;return{value:p,type:s,comment:r.comment,range:[i,h,h]}}function T_({offset:e,props:t},n,i){if(t[0].type!=="block-scalar-header")return i(t[0],"IMPOSSIBLE","Block scalar header not found"),null;let{source:r}=t[0],s=r[0],a=0,o="",l=-1;for(let f=1;f<r.length;++f){let g=r[f];if(!o&&(g==="-"||g==="+"))o=g;else{let h=Number(g);!a&&h?a=h:l===-1&&(l=e+f)}}l!==-1&&i(l,"UNEXPECTED_TOKEN",`Block scalar header includes extra characters: ${r}`);let c=!1,d="",p=r.length;for(let f=1;f<t.length;++f){let g=t[f];switch(g.type){case"space":c=!0;case"newline":p+=g.source.length;break;case"comment":n&&!c&&i(g,"MISSING_CHAR","Comments must be separated from other tokens by white space characters"),p+=g.source.length,d=g.source.substring(1);break;case"error":i(g,"UNEXPECTED_TOKEN",g.message),p+=g.source.length;break;default:{let h=`Unexpected token in block scalar header: ${g.type}`;i(g,"UNEXPECTED_TOKEN",h);let m=g.source;m&&typeof m=="string"&&(p+=m.length)}}}return{mode:s,indent:a,chomp:o,comment:d,length:p}}function $_(e){let t=e.split(/\n( *)/),n=t[0],i=n.match(/^( *)/),s=[i?.[1]?[i[1],n.slice(i[1].length)]:["",n]];for(let a=1;a<t.length;a+=2)s.push([t[a],t[a+1]]);return s}Sf.resolveBlockScalar=I_});var pl=T(Pf=>{"use strict";var dl=Q(),L_=wn();function O_(e,t,n){let{offset:i,type:r,source:s,end:a}=e,o,l,c=(f,g,h)=>n(i+f,g,h);switch(r){case"scalar":o=dl.Scalar.PLAIN,l=N_(s,c);break;case"single-quoted-scalar":o=dl.Scalar.QUOTE_SINGLE,l=j_(s,c);break;case"double-quoted-scalar":o=dl.Scalar.QUOTE_DOUBLE,l=B_(s,c);break;default:return n(e,"UNEXPECTED_TOKEN",`Expected a flow scalar value, but found: ${r}`),{value:"",type:null,comment:"",range:[i,i+s.length,i+s.length]}}let d=i+s.length,p=L_.resolveEnd(a,d,t,n);return{value:l,type:o,comment:p.comment,range:[i,d,p.offset]}}function N_(e,t){let n="";switch(e[0]){case"	":n="a tab character";break;case",":n="flow indicator character ,";break;case"%":n="directive indicator character %";break;case"|":case">":{n=`block scalar indicator ${e[0]}`;break}case"@":case"`":{n=`reserved character ${e[0]}`;break}}return n&&t(0,"BAD_SCALAR_START",`Plain value cannot start with ${n}`),_f(e)}function j_(e,t){return(e[e.length-1]!=="'"||e.length===1)&&t(e.length,"MISSING_CHAR","Missing closing 'quote"),_f(e.slice(1,-1)).replace(/''/g,"'")}function _f(e){let t,n;try{t=new RegExp(`(.*?)(?<![ 	])[ 	]*\r?
+`,"sy"),n=new RegExp(`[ 	]*(.*?)(?:(?<![ 	])[ 	]*)?\r?
+`,"sy")}catch{t=/(.*?)[ \t]*\r?\n/sy,n=/[ \t]*(.*?)[ \t]*\r?\n/sy}let i=t.exec(e);if(!i)return e;let r=i[1],s=" ",a=t.lastIndex;for(n.lastIndex=a;i=n.exec(e);)i[1]===""?s===`
+`?r+=s:s=`
+`:(r+=s+i[1],s=" "),a=n.lastIndex;let o=/[ \t]*(.*)/sy;return o.lastIndex=a,i=o.exec(e),r+s+(i?.[1]??"")}function B_(e,t){let n="";for(let i=1;i<e.length-1;++i){let r=e[i];if(!(r==="\r"&&e[i+1]===`
+`))if(r===`
+`){let{fold:s,offset:a}=F_(e,i);n+=s,i=a}else if(r==="\\"){let s=e[++i],a=D_[s];if(a)n+=a;else if(s===`
+`)for(s=e[i+1];s===" "||s==="	";)s=e[++i+1];else if(s==="\r"&&e[i+1]===`
+`)for(s=e[++i+1];s===" "||s==="	";)s=e[++i+1];else if(s==="x"||s==="u"||s==="U"){let o=s==="x"?2:s==="u"?4:8;n+=q_(e,i+1,o,t),i+=o}else{let o=e.substr(i-1,2);t(i-1,"BAD_DQ_ESCAPE",`Invalid escape sequence ${o}`),n+=o}}else if(r===" "||r==="	"){let s=i,a=e[i+1];for(;a===" "||a==="	";)a=e[++i+1];a!==`
+`&&!(a==="\r"&&e[i+2]===`
+`)&&(n+=i>s?e.slice(s,i+1):r)}else n+=r}return(e[e.length-1]!=='"'||e.length===1)&&t(e.length,"MISSING_CHAR",'Missing closing "quote'),n}function F_(e,t){let n="",i=e[t+1];for(;(i===" "||i==="	"||i===`
+`||i==="\r")&&!(i==="\r"&&e[t+2]!==`
+`);)i===`
+`&&(n+=`
+`),t+=1,i=e[t+1];return n||(n=" "),{fold:n,offset:t}}var D_={0:"\0",a:"\x07",b:"\b",e:"\x1B",f:"\f",n:`
+`,r:"\r",t:"	",v:"\v",N:"\x85",_:"\xA0",L:"\u2028",P:"\u2029"," ":" ",'"':'"',"/":"/","\\":"\\","	":"	"};function q_(e,t,n,i){let r=e.substr(t,n),a=r.length===n&&/^[0-9a-fA-F]+$/.test(r)?parseInt(r,16):NaN;try{return String.fromCodePoint(a)}catch{let o=e.substr(t-2,n+2);return i(t-2,"BAD_DQ_ESCAPE",`Invalid escape sequence ${o}`),o}}Pf.resolveFlowScalar=O_});var Cf=T(Rf=>{"use strict";var Ft=M(),Af=Q(),M_=ul(),U_=pl();function V_(e,t,n,i){let{value:r,type:s,comment:a,range:o}=t.type==="block-scalar"?M_.resolveBlockScalar(e,t,i):U_.resolveFlowScalar(t,e.options.strict,i),l=n?e.directives.tagName(n.source,p=>i(n,"TAG_RESOLVE_FAILED",p)):null,c;e.options.stringKeys&&e.atKey?c=e.schema[Ft.SCALAR]:l?c=G_(e.schema,r,l,n,i):t.type==="scalar"?c=z_(e,r,t,i):c=e.schema[Ft.SCALAR];let d;try{let p=c.resolve(r,f=>i(n??t,"TAG_RESOLVE_FAILED",f),e.options);d=Ft.isScalar(p)?p:new Af.Scalar(p)}catch(p){let f=p instanceof Error?p.message:String(p);i(n??t,"TAG_RESOLVE_FAILED",f),d=new Af.Scalar(r)}return d.range=o,d.source=r,s&&(d.type=s),l&&(d.tag=l),c.format&&(d.format=c.format),a&&(d.comment=a),d}function G_(e,t,n,i,r){if(n==="!")return e[Ft.SCALAR];let s=[];for(let o of e.tags)if(!o.collection&&o.tag===n)if(o.default&&o.test)s.push(o);else return o;for(let o of s)if(o.test?.test(t))return o;let a=e.knownTags[n];return a&&!a.collection?(e.tags.push(Object.assign({},a,{default:!1,test:void 0})),a):(r(i,"TAG_RESOLVE_FAILED",`Unresolved tag: ${n}`,n!=="tag:yaml.org,2002:str"),e[Ft.SCALAR])}function z_({atKey:e,directives:t,schema:n},i,r,s){let a=n.tags.find(o=>(o.default===!0||e&&o.default==="key")&&o.test?.test(i))||n[Ft.SCALAR];if(n.compat){let o=n.compat.find(l=>l.default&&l.test?.test(i))??n[Ft.SCALAR];if(a.tag!==o.tag){let l=t.tagString(a.tag),c=t.tagString(o.tag),d=`Value may be parsed as either ${l} or ${c}`;s(r,"TAG_RESOLVE_FAILED",d,!0)}}return a}Rf.composeScalar=V_});var xf=T(Ef=>{"use strict";function K_(e,t,n){if(t){n??(n=t.length);for(let i=n-1;i>=0;--i){let r=t[i];switch(r.type){case"space":case"comment":case"newline":e-=r.source.length;continue}for(r=t[++i];r?.type==="space";)e+=r.source.length,r=t[++i];break}}return e}Ef.emptyScalarPosition=K_});var $f=T(gl=>{"use strict";var H_=ai(),J_=M(),W_=bf(),If=Cf(),Y_=wn(),Z_=xf(),X_={composeNode:Tf,composeEmptyNode:fl};function Tf(e,t,n,i){let r=e.atKey,{spaceBefore:s,comment:a,anchor:o,tag:l}=n,c,d=!0;switch(t.type){case"alias":c=Q_(e,t,i),(o||l)&&i(t,"ALIAS_PROPS","An alias node must not specify any properties");break;case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":case"block-scalar":c=If.composeScalar(e,t,l,i),o&&(c.anchor=o.source.substring(1));break;case"block-map":case"block-seq":case"flow-collection":try{c=W_.composeCollection(X_,e,t,n,i),o&&(c.anchor=o.source.substring(1))}catch(p){let f=p instanceof Error?p.message:String(p);i(t,"RESOURCE_EXHAUSTION",f)}break;default:{let p=t.type==="error"?t.message:`Unsupported token (type: ${t.type})`;i(t,"UNEXPECTED_TOKEN",p),d=!1}}return c??(c=fl(e,t.offset,void 0,null,n,i)),o&&c.anchor===""&&i(o,"BAD_ALIAS","Anchor cannot be an empty string"),r&&e.options.stringKeys&&(!J_.isScalar(c)||typeof c.value!="string"||c.tag&&c.tag!=="tag:yaml.org,2002:str")&&i(l??t,"NON_STRING_KEY","With stringKeys, all keys must be strings"),s&&(c.spaceBefore=!0),a&&(t.type==="scalar"&&t.source===""?c.comment=a:c.commentBefore=a),e.options.keepSourceTokens&&d&&(c.srcToken=t),c}function fl(e,t,n,i,{spaceBefore:r,comment:s,anchor:a,tag:o,end:l},c){let d={type:"scalar",offset:Z_.emptyScalarPosition(t,n,i),indent:-1,source:""},p=If.composeScalar(e,d,o,c);return a&&(p.anchor=a.source.substring(1),p.anchor===""&&c(a,"BAD_ALIAS","Anchor cannot be an empty string")),r&&(p.spaceBefore=!0),s&&(p.comment=s,p.range[2]=l),p}function Q_({options:e},{offset:t,source:n,end:i},r){let s=new H_.Alias(n.substring(1));s.source===""&&r(t,"BAD_ALIAS","Alias cannot be an empty string"),s.source.endsWith(":")&&r(t+n.length-1,"BAD_ALIAS","Alias ending in : is ambiguous",!0);let a=t+n.length,o=Y_.resolveEnd(i,a,e.strict,r);return s.range=[t,a,o.offset],o.comment&&(s.comment=o.comment),s}gl.composeEmptyNode=fl;gl.composeNode=Tf});var Nf=T(Of=>{"use strict";var eP=Si(),Lf=$f(),tP=wn(),nP=Ri();function iP(e,t,{offset:n,start:i,value:r,end:s},a){let o=Object.assign({_directives:t},e),l=new eP.Document(void 0,o),c={atKey:!1,atRoot:!0,directives:l.directives,options:l.options,schema:l.schema},d=nP.resolveProps(i,{indicator:"doc-start",next:r??s?.[0],offset:n,onError:a,parentIndent:0,startOnNewline:!0});d.found&&(l.directives.docStart=!0,r&&(r.type==="block-map"||r.type==="block-seq")&&!d.hasNewline&&a(d.end,"MISSING_CHAR","Block collection cannot start on same line with directives-end marker")),l.contents=r?Lf.composeNode(c,r,d,a):Lf.composeEmptyNode(c,d.end,i,null,d,a);let p=l.contents.range[2],f=tP.resolveEnd(s,p,!1,a);return f.comment&&(l.comment=f.comment),l.range=[n,p,f.offset],l}Of.composeDoc=iP});var hl=T(Ff=>{"use strict";var rP=gr("process"),sP=eo(),aP=Si(),Ci=Ai(),jf=M(),oP=Nf(),lP=wn();function Ei(e){if(typeof e=="number")return[e,e+1];if(Array.isArray(e))return e.length===2?e:[e[0],e[1]];let{offset:t,source:n}=e;return[t,t+(typeof n=="string"?n.length:1)]}function Bf(e){let t="",n=!1,i=!1;for(let r=0;r<e.length;++r){let s=e[r];switch(s[0]){case"#":t+=(t===""?"":i?`
+
+`:`
+`)+(s.substring(1)||" "),n=!0,i=!1;break;case"%":e[r+1]?.[0]!=="#"&&(r+=1),n=!1;break;default:n||(i=!0),n=!1}}return{comment:t,afterEmptyLine:i}}var ml=class{constructor(t={}){this.doc=null,this.atDirectives=!1,this.prelude=[],this.errors=[],this.warnings=[],this.onError=(n,i,r,s)=>{let a=Ei(n);s?this.warnings.push(new Ci.YAMLWarning(a,i,r)):this.errors.push(new Ci.YAMLParseError(a,i,r))},this.directives=new sP.Directives({version:t.version||"1.2"}),this.options=t}decorate(t,n){let{comment:i,afterEmptyLine:r}=Bf(this.prelude);if(i){let s=t.contents;if(n)t.comment=t.comment?`${t.comment}
+${i}`:i;else if(r||t.directives.docStart||!s)t.commentBefore=i;else if(jf.isCollection(s)&&!s.flow&&s.items.length>0){let a=s.items[0];jf.isPair(a)&&(a=a.key);let o=a.commentBefore;a.commentBefore=o?`${i}
+${o}`:i}else{let a=s.commentBefore;s.commentBefore=a?`${i}
+${a}`:i}}if(n){for(let s=0;s<this.errors.length;++s)t.errors.push(this.errors[s]);for(let s=0;s<this.warnings.length;++s)t.warnings.push(this.warnings[s])}else t.errors=this.errors,t.warnings=this.warnings;this.prelude=[],this.errors=[],this.warnings=[]}streamInfo(){return{comment:Bf(this.prelude).comment,directives:this.directives,errors:this.errors,warnings:this.warnings}}*compose(t,n=!1,i=-1){for(let r of t)yield*this.next(r);yield*this.end(n,i)}*next(t){switch(rP.env.LOG_STREAM&&console.dir(t,{depth:null}),t.type){case"directive":this.directives.add(t.source,(n,i,r)=>{let s=Ei(t);s[0]+=n,this.onError(s,"BAD_DIRECTIVE",i,r)}),this.prelude.push(t.source),this.atDirectives=!0;break;case"document":{let n=oP.composeDoc(this.options,this.directives,t,this.onError);this.atDirectives&&!n.directives.docStart&&this.onError(t,"MISSING_CHAR","Missing directives-end/doc-start indicator line"),this.decorate(n,!1),this.doc&&(yield this.doc),this.doc=n,this.atDirectives=!1;break}case"byte-order-mark":case"space":break;case"comment":case"newline":this.prelude.push(t.source);break;case"error":{let n=t.source?`${t.message}: ${JSON.stringify(t.source)}`:t.message,i=new Ci.YAMLParseError(Ei(t),"UNEXPECTED_TOKEN",n);this.atDirectives||!this.doc?this.errors.push(i):this.doc.errors.push(i);break}case"doc-end":{if(!this.doc){let i="Unexpected doc-end without preceding document";this.errors.push(new Ci.YAMLParseError(Ei(t),"UNEXPECTED_TOKEN",i));break}this.doc.directives.docEnd=!0;let n=lP.resolveEnd(t.end,t.offset+t.source.length,this.doc.options.strict,this.onError);if(this.decorate(this.doc,!0),n.comment){let i=this.doc.comment;this.doc.comment=i?`${i}
+${n.comment}`:n.comment}this.doc.range[2]=n.offset;break}default:this.errors.push(new Ci.YAMLParseError(Ei(t),"UNEXPECTED_TOKEN",`Unsupported token ${t.type}`))}}*end(t=!1,n=-1){if(this.doc)this.decorate(this.doc,!0),yield this.doc,this.doc=null;else if(t){let i=Object.assign({_directives:this.directives},this.options),r=new aP.Document(void 0,i);this.atDirectives&&this.onError(n,"MISSING_CHAR","Missing directives-end indicator line"),r.range=[0,n,n],this.decorate(r,!1),yield r}}};Ff.Composer=ml});var Mf=T(_s=>{"use strict";var cP=ul(),uP=pl(),dP=Ai(),Df=di();function pP(e,t=!0,n){if(e){let i=(r,s,a)=>{let o=typeof r=="number"?r:Array.isArray(r)?r[0]:r.offset;if(n)n(o,s,a);else throw new dP.YAMLParseError([o,o+1],s,a)};switch(e.type){case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return uP.resolveFlowScalar(e,t,i);case"block-scalar":return cP.resolveBlockScalar({options:{strict:t}},e,i)}}return null}function fP(e,t){let{implicitKey:n=!1,indent:i,inFlow:r=!1,offset:s=-1,type:a="PLAIN"}=t,o=Df.stringifyString({type:a,value:e},{implicitKey:n,indent:i>0?" ".repeat(i):"",inFlow:r,options:{blockQuote:!0,lineWidth:-1}}),l=t.end??[{type:"newline",offset:-1,indent:i,source:`
+`}];switch(o[0]){case"|":case">":{let c=o.indexOf(`
+`),d=o.substring(0,c),p=o.substring(c+1)+`
+`,f=[{type:"block-scalar-header",offset:s,indent:i,source:d}];return qf(f,l)||f.push({type:"newline",offset:-1,indent:i,source:`
+`}),{type:"block-scalar",offset:s,indent:i,props:f,source:p}}case'"':return{type:"double-quoted-scalar",offset:s,indent:i,source:o,end:l};case"'":return{type:"single-quoted-scalar",offset:s,indent:i,source:o,end:l};default:return{type:"scalar",offset:s,indent:i,source:o,end:l}}}function gP(e,t,n={}){let{afterKey:i=!1,implicitKey:r=!1,inFlow:s=!1,type:a}=n,o="indent"in e?e.indent:null;if(i&&typeof o=="number"&&(o+=2),!a)switch(e.type){case"single-quoted-scalar":a="QUOTE_SINGLE";break;case"double-quoted-scalar":a="QUOTE_DOUBLE";break;case"block-scalar":{let c=e.props[0];if(c.type!=="block-scalar-header")throw new Error("Invalid block scalar header");a=c.source[0]===">"?"BLOCK_FOLDED":"BLOCK_LITERAL";break}default:a="PLAIN"}let l=Df.stringifyString({type:a,value:t},{implicitKey:r||o===null,indent:o!==null&&o>0?" ".repeat(o):"",inFlow:s,options:{blockQuote:!0,lineWidth:-1}});switch(l[0]){case"|":case">":mP(e,l);break;case'"':yl(e,l,"double-quoted-scalar");break;case"'":yl(e,l,"single-quoted-scalar");break;default:yl(e,l,"scalar")}}function mP(e,t){let n=t.indexOf(`
+`),i=t.substring(0,n),r=t.substring(n+1)+`
+`;if(e.type==="block-scalar"){let s=e.props[0];if(s.type!=="block-scalar-header")throw new Error("Invalid block scalar header");s.source=i,e.source=r}else{let{offset:s}=e,a="indent"in e?e.indent:-1,o=[{type:"block-scalar-header",offset:s,indent:a,source:i}];qf(o,"end"in e?e.end:void 0)||o.push({type:"newline",offset:-1,indent:a,source:`
+`});for(let l of Object.keys(e))l!=="type"&&l!=="offset"&&delete e[l];Object.assign(e,{type:"block-scalar",indent:a,props:o,source:r})}}function qf(e,t){if(t)for(let n of t)switch(n.type){case"space":case"comment":e.push(n);break;case"newline":return e.push(n),!0}return!1}function yl(e,t,n){switch(e.type){case"scalar":case"double-quoted-scalar":case"single-quoted-scalar":e.type=n,e.source=t;break;case"block-scalar":{let i=e.props.slice(1),r=t.length;e.props[0].type==="block-scalar-header"&&(r-=e.props[0].source.length);for(let s of i)s.offset+=r;delete e.props,Object.assign(e,{type:n,source:t,end:i});break}case"block-map":case"block-seq":{let r={type:"newline",offset:e.offset+t.length,indent:e.indent,source:`
+`};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let i="indent"in e?e.indent:-1,r="end"in e&&Array.isArray(e.end)?e.end.filter(s=>s.type==="space"||s.type==="comment"||s.type==="newline"):[];for(let s of Object.keys(e))s!=="type"&&s!=="offset"&&delete e[s];Object.assign(e,{type:n,indent:i,source:t,end:r})}}}_s.createScalarToken=fP;_s.resolveAsScalar=pP;_s.setScalarValue=gP});var Vf=T(Uf=>{"use strict";var hP=e=>"type"in e?As(e):Ps(e);function As(e){switch(e.type){case"block-scalar":{let t="";for(let n of e.props)t+=As(n);return t+e.source}case"block-map":case"block-seq":{let t="";for(let n of e.items)t+=Ps(n);return t}case"flow-collection":{let t=e.start.source;for(let n of e.items)t+=Ps(n);for(let n of e.end)t+=n.source;return t}case"document":{let t=Ps(e);if(e.end)for(let n of e.end)t+=n.source;return t}default:{let t=e.source;if("end"in e&&e.end)for(let n of e.end)t+=n.source;return t}}}function Ps({start:e,key:t,sep:n,value:i}){let r="";for(let s of e)r+=s.source;if(t&&(r+=As(t)),n)for(let s of n)r+=s.source;return i&&(r+=As(i)),r}Uf.stringify=hP});var Hf=T(Kf=>{"use strict";var kl=Symbol("break visit"),yP=Symbol("skip children"),Gf=Symbol("remove item");function Dt(e,t){"type"in e&&e.type==="document"&&(e={start:e.start,value:e.value}),zf(Object.freeze([]),e,t)}Dt.BREAK=kl;Dt.SKIP=yP;Dt.REMOVE=Gf;Dt.itemAtPath=(e,t)=>{let n=e;for(let[i,r]of t){let s=n?.[i];if(s&&"items"in s)n=s.items[r];else return}return n};Dt.parentCollection=(e,t)=>{let n=Dt.itemAtPath(e,t.slice(0,-1)),i=t[t.length-1][0],r=n?.[i];if(r&&"items"in r)return r;throw new Error("Parent collection not found")};function zf(e,t,n){let i=n(t,e);if(typeof i=="symbol")return i;for(let r of["key","value"]){let s=t[r];if(s&&"items"in s){for(let a=0;a<s.items.length;++a){let o=zf(Object.freeze(e.concat([[r,a]])),s.items[a],n);if(typeof o=="number")a=o-1;else{if(o===kl)return kl;o===Gf&&(s.items.splice(a,1),a-=1)}}typeof i=="function"&&r==="key"&&(i=i(t,e))}}return typeof i=="function"?i(t,e):i}Kf.visit=Dt});var Rs=T(be=>{"use strict";var wl=Mf(),kP=Vf(),wP=Hf(),vl="\uFEFF",bl="",Sl="",_l="",vP=e=>!!e&&"items"in e,bP=e=>!!e&&(e.type==="scalar"||e.type==="single-quoted-scalar"||e.type==="double-quoted-scalar"||e.type==="block-scalar");function SP(e){switch(e){case vl:return"<BOM>";case bl:return"<DOC>";case Sl:return"<FLOW_END>";case _l:return"<SCALAR>";default:return JSON.stringify(e)}}function _P(e){switch(e){case vl:return"byte-order-mark";case bl:return"doc-mode";case Sl:return"flow-error-end";case _l:return"scalar";case"---":return"doc-start";case"...":return"doc-end";case"":case`
+`:case`\r
+`:return"newline";case"-":return"seq-item-ind";case"?":return"explicit-key-ind";case":":return"map-value-ind";case"{":return"flow-map-start";case"}":return"flow-map-end";case"[":return"flow-seq-start";case"]":return"flow-seq-end";case",":return"comma"}switch(e[0]){case" ":case"	":return"space";case"#":return"comment";case"%":return"directive-line";case"*":return"alias";case"&":return"anchor";case"!":return"tag";case"'":return"single-quoted-scalar";case'"':return"double-quoted-scalar";case"|":case">":return"block-scalar-header"}return null}be.createScalarToken=wl.createScalarToken;be.resolveAsScalar=wl.resolveAsScalar;be.setScalarValue=wl.setScalarValue;be.stringify=kP.stringify;be.visit=wP.visit;be.BOM=vl;be.DOCUMENT=bl;be.FLOW_END=Sl;be.SCALAR=_l;be.isCollection=vP;be.isScalar=bP;be.prettyToken=SP;be.tokenType=_P});var Rl=T(Wf=>{"use strict";var xi=Rs();function Ve(e){switch(e){case void 0:case" ":case`
+`:case"\r":case"	":return!0;default:return!1}}var Jf=new Set("0123456789ABCDEFabcdef"),PP=new Set("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-#;/?:@&=+$_.!~*'()"),Cs=new Set(",[]{}"),AP=new Set(` ,[]{}
+\r	`),Pl=e=>!e||AP.has(e),Al=class{constructor(){this.atEnd=!1,this.blockScalarIndent=-1,this.blockScalarKeep=!1,this.buffer="",this.flowKey=!1,this.flowLevel=0,this.indentNext=0,this.indentValue=0,this.lineEndPos=null,this.next=null,this.pos=0}*lex(t,n=!1){if(t){if(typeof t!="string")throw TypeError("source is not a string");this.buffer=this.buffer?this.buffer+t:t,this.lineEndPos=null}this.atEnd=!n;let i=this.next??"stream";for(;i&&(n||this.hasChars(1));)i=yield*this.parseNext(i)}atLineEnd(){let t=this.pos,n=this.buffer[t];for(;n===" "||n==="	";)n=this.buffer[++t];return!n||n==="#"||n===`
+`?!0:n==="\r"?this.buffer[t+1]===`
+`:!1}charAt(t){return this.buffer[this.pos+t]}continueScalar(t){let n=this.buffer[t];if(this.indentNext>0){let i=0;for(;n===" ";)n=this.buffer[++i+t];if(n==="\r"){let r=this.buffer[i+t+1];if(r===`
+`||!r&&!this.atEnd)return t+i+1}return n===`
+`||i>=this.indentNext||!n&&!this.atEnd?t+i:-1}if(n==="-"||n==="."){let i=this.buffer.substr(t,3);if((i==="---"||i==="...")&&Ve(this.buffer[t+3]))return-1}return t}getLine(){let t=this.lineEndPos;return(typeof t!="number"||t!==-1&&t<this.pos)&&(t=this.buffer.indexOf(`
+`,this.pos),this.lineEndPos=t),t===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[t-1]==="\r"&&(t-=1),this.buffer.substring(this.pos,t))}hasChars(t){return this.pos+t<=this.buffer.length}setNext(t){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=t,null}peek(t){return this.buffer.substr(this.pos,t)}*parseNext(t){switch(t){case"stream":return yield*this.parseStream();case"line-start":return yield*this.parseLineStart();case"block-start":return yield*this.parseBlockStart();case"doc":return yield*this.parseDocument();case"flow":return yield*this.parseFlowCollection();case"quoted-scalar":return yield*this.parseQuotedScalar();case"block-scalar":return yield*this.parseBlockScalar();case"plain-scalar":return yield*this.parsePlainScalar()}}*parseStream(){let t=this.getLine();if(t===null)return this.setNext("stream");if(t[0]===xi.BOM&&(yield*this.pushCount(1),t=t.substring(1)),t[0]==="%"){let n=t.length,i=t.indexOf("#");for(;i!==-1;){let s=t[i-1];if(s===" "||s==="	"){n=i-1;break}else i=t.indexOf("#",i+1)}for(;;){let s=t[n-1];if(s===" "||s==="	")n-=1;else break}let r=(yield*this.pushCount(n))+(yield*this.pushSpaces(!0));return yield*this.pushCount(t.length-r),this.pushNewline(),"stream"}if(this.atLineEnd()){let n=yield*this.pushSpaces(!0);return yield*this.pushCount(t.length-n),yield*this.pushNewline(),"stream"}return yield xi.DOCUMENT,yield*this.parseLineStart()}*parseLineStart(){let t=this.charAt(0);if(!t&&!this.atEnd)return this.setNext("line-start");if(t==="-"||t==="."){if(!this.atEnd&&!this.hasChars(4))return this.setNext("line-start");let n=this.peek(3);if((n==="---"||n==="...")&&Ve(this.charAt(3)))return yield*this.pushCount(3),this.indentValue=0,this.indentNext=0,n==="---"?"doc":"stream"}return this.indentValue=yield*this.pushSpaces(!1),this.indentNext>this.indentValue&&!Ve(this.charAt(1))&&(this.indentNext=this.indentValue),yield*this.parseBlockStart()}*parseBlockStart(){let[t,n]=this.peek(2);if(!n&&!this.atEnd)return this.setNext("block-start");if((t==="-"||t==="?"||t===":")&&Ve(n)){let i=(yield*this.pushCount(1))+(yield*this.pushSpaces(!0));return this.indentNext=this.indentValue+1,this.indentValue+=i,"block-start"}return"doc"}*parseDocument(){yield*this.pushSpaces(!0);let t=this.getLine();if(t===null)return this.setNext("doc");let n=yield*this.pushIndicators();switch(t[n]){case"#":yield*this.pushCount(t.length-n);case void 0:return yield*this.pushNewline(),yield*this.parseLineStart();case"{":case"[":return yield*this.pushCount(1),this.flowKey=!1,this.flowLevel=1,"flow";case"}":case"]":return yield*this.pushCount(1),"doc";case"*":return yield*this.pushUntil(Pl),"doc";case'"':case"'":return yield*this.parseQuotedScalar();case"|":case">":return n+=yield*this.parseBlockScalarHeader(),n+=yield*this.pushSpaces(!0),yield*this.pushCount(t.length-n),yield*this.pushNewline(),yield*this.parseBlockScalar();default:return yield*this.parsePlainScalar()}}*parseFlowCollection(){let t,n,i=-1;do t=yield*this.pushNewline(),t>0?(n=yield*this.pushSpaces(!1),this.indentValue=i=n):n=0,n+=yield*this.pushSpaces(!0);while(t+n>0);let r=this.getLine();if(r===null)return this.setNext("flow");if((i!==-1&&i<this.indentNext&&r[0]!=="#"||i===0&&(r.startsWith("---")||r.startsWith("..."))&&Ve(r[3]))&&!(i===this.indentNext-1&&this.flowLevel===1&&(r[0]==="]"||r[0]==="}")))return this.flowLevel=0,yield xi.FLOW_END,yield*this.parseLineStart();let s=0;for(;r[s]===",";)s+=yield*this.pushCount(1),s+=yield*this.pushSpaces(!0),this.flowKey=!1;switch(s+=yield*this.pushIndicators(),r[s]){case void 0:return"flow";case"#":return yield*this.pushCount(r.length-s),"flow";case"{":case"[":return yield*this.pushCount(1),this.flowKey=!1,this.flowLevel+=1,"flow";case"}":case"]":return yield*this.pushCount(1),this.flowKey=!0,this.flowLevel-=1,this.flowLevel?"flow":"doc";case"*":return yield*this.pushUntil(Pl),"flow";case'"':case"'":return this.flowKey=!0,yield*this.parseQuotedScalar();case":":{let a=this.charAt(1);if(this.flowKey||Ve(a)||a===",")return this.flowKey=!1,yield*this.pushCount(1),yield*this.pushSpaces(!0),"flow"}default:return this.flowKey=!1,yield*this.parsePlainScalar()}}*parseQuotedScalar(){let t=this.charAt(0),n=this.buffer.indexOf(t,this.pos+1);if(t==="'")for(;n!==-1&&this.buffer[n+1]==="'";)n=this.buffer.indexOf("'",n+2);else for(;n!==-1;){let s=0;for(;this.buffer[n-1-s]==="\\";)s+=1;if(s%2===0)break;n=this.buffer.indexOf('"',n+1)}let i=this.buffer.substring(0,n),r=i.indexOf(`
+`,this.pos);if(r!==-1){for(;r!==-1;){let s=this.continueScalar(r+1);if(s===-1)break;r=i.indexOf(`
+`,s)}r!==-1&&(n=r-(i[r-1]==="\r"?2:1))}if(n===-1){if(!this.atEnd)return this.setNext("quoted-scalar");n=this.buffer.length}return yield*this.pushToIndex(n+1,!1),this.flowLevel?"flow":"doc"}*parseBlockScalarHeader(){this.blockScalarIndent=-1,this.blockScalarKeep=!1;let t=this.pos;for(;;){let n=this.buffer[++t];if(n==="+")this.blockScalarKeep=!0;else if(n>"0"&&n<="9")this.blockScalarIndent=Number(n)-1;else if(n!=="-")break}return yield*this.pushUntil(n=>Ve(n)||n==="#")}*parseBlockScalar(){let t=this.pos-1,n=0,i;e:for(let s=this.pos;i=this.buffer[s];++s)switch(i){case" ":n+=1;break;case`
+`:t=s,n=0;break;case"\r":{let a=this.buffer[s+1];if(!a&&!this.atEnd)return this.setNext("block-scalar");if(a===`
+`)break}default:break e}if(!i&&!this.atEnd)return this.setNext("block-scalar");if(n>=this.indentNext){this.blockScalarIndent===-1?this.indentNext=n:this.indentNext=this.blockScalarIndent+(this.indentNext===0?1:this.indentNext);do{let s=this.continueScalar(t+1);if(s===-1)break;t=this.buffer.indexOf(`
+`,s)}while(t!==-1);if(t===-1){if(!this.atEnd)return this.setNext("block-scalar");t=this.buffer.length}}let r=t+1;for(i=this.buffer[r];i===" ";)i=this.buffer[++r];if(i==="	"){for(;i==="	"||i===" "||i==="\r"||i===`
+`;)i=this.buffer[++r];t=r-1}else if(!this.blockScalarKeep)do{let s=t-1,a=this.buffer[s];a==="\r"&&(a=this.buffer[--s]);let o=s;for(;a===" ";)a=this.buffer[--s];if(a===`
+`&&s>=this.pos&&s+1+n>o)t=s;else break}while(!0);return yield xi.SCALAR,yield*this.pushToIndex(t+1,!0),yield*this.parseLineStart()}*parsePlainScalar(){let t=this.flowLevel>0,n=this.pos-1,i=this.pos-1,r;for(;r=this.buffer[++i];)if(r===":"){let s=this.buffer[i+1];if(Ve(s)||t&&Cs.has(s))break;n=i}else if(Ve(r)){let s=this.buffer[i+1];if(r==="\r"&&(s===`
+`?(i+=1,r=`
+`,s=this.buffer[i+1]):n=i),s==="#"||t&&Cs.has(s))break;if(r===`
+`){let a=this.continueScalar(i+1);if(a===-1)break;i=Math.max(i,a-2)}}else{if(t&&Cs.has(r))break;n=i}return!r&&!this.atEnd?this.setNext("plain-scalar"):(yield xi.SCALAR,yield*this.pushToIndex(n+1,!0),t?"flow":"doc")}*pushCount(t){return t>0?(yield this.buffer.substr(this.pos,t),this.pos+=t,t):0}*pushToIndex(t,n){let i=this.buffer.slice(this.pos,t);return i?(yield i,this.pos+=i.length,i.length):(n&&(yield""),0)}*pushIndicators(){let t=0;e:for(;;){switch(this.charAt(0)){case"!":t+=yield*this.pushTag(),t+=yield*this.pushSpaces(!0);continue e;case"&":t+=yield*this.pushUntil(Pl),t+=yield*this.pushSpaces(!0);continue e;case"-":case"?":case":":{let n=this.flowLevel>0,i=this.charAt(1);if(Ve(i)||n&&Cs.has(i)){n?this.flowKey&&(this.flowKey=!1):this.indentNext=this.indentValue+1,t+=yield*this.pushCount(1),t+=yield*this.pushSpaces(!0);continue e}}}break e}return t}*pushTag(){if(this.charAt(1)==="<"){let t=this.pos+2,n=this.buffer[t];for(;!Ve(n)&&n!==">";)n=this.buffer[++t];return yield*this.pushToIndex(n===">"?t+1:t,!1)}else{let t=this.pos+1,n=this.buffer[t];for(;n;)if(PP.has(n))n=this.buffer[++t];else if(n==="%"&&Jf.has(this.buffer[t+1])&&Jf.has(this.buffer[t+2]))n=this.buffer[t+=3];else break;return yield*this.pushToIndex(t,!1)}}*pushNewline(){let t=this.buffer[this.pos];return t===`
+`?yield*this.pushCount(1):t==="\r"&&this.charAt(1)===`
+`?yield*this.pushCount(2):0}*pushSpaces(t){let n=this.pos-1,i;do i=this.buffer[++n];while(i===" "||t&&i==="	");let r=n-this.pos;return r>0&&(yield this.buffer.substr(this.pos,r),this.pos=n),r}*pushUntil(t){let n=this.pos,i=this.buffer[n];for(;!t(i);)i=this.buffer[++n];return yield*this.pushToIndex(n,!1)}};Wf.Lexer=Al});var El=T(Yf=>{"use strict";var Cl=class{constructor(){this.lineStarts=[],this.addNewLine=t=>this.lineStarts.push(t),this.linePos=t=>{let n=0,i=this.lineStarts.length;for(;n<i;){let s=n+i>>1;this.lineStarts[s]<t?n=s+1:i=s}if(this.lineStarts[n]===t)return{line:n+1,col:1};if(n===0)return{line:0,col:t};let r=this.lineStarts[n-1];return{line:n,col:t-r+1}}}};Yf.LineCounter=Cl});var Il=T(tg=>{"use strict";var RP=gr("process"),Zf=Rs(),CP=Rl();function vt(e,t){for(let n=0;n<e.length;++n)if(e[n].type===t)return!0;return!1}function Xf(e){for(let t=0;t<e.length;++t)switch(e[t].type){case"space":case"comment":case"newline":break;default:return t}return-1}function eg(e){switch(e?.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":case"flow-collection":return!0;default:return!1}}function Es(e){switch(e.type){case"document":return e.start;case"block-map":{let t=e.items[e.items.length-1];return t.sep??t.start}case"block-seq":return e.items[e.items.length-1].start;default:return[]}}function vn(e){if(e.length===0)return[];let t=e.length;e:for(;--t>=0;)switch(e[t].type){case"doc-start":case"explicit-key-ind":case"map-value-ind":case"seq-item-ind":case"newline":break e}for(;e[++t]?.type==="space";);return e.splice(t,e.length)}function xs(e,t){if(t.length<1e5)Array.prototype.push.apply(e,t);else for(let n=0;n<t.length;++n)e.push(t[n])}function Qf(e){if(e.start.type==="flow-seq-start")for(let t of e.items)t.sep&&!t.value&&!vt(t.start,"explicit-key-ind")&&!vt(t.sep,"map-value-ind")&&(t.key&&(t.value=t.key),delete t.key,eg(t.value)?t.value.end?xs(t.value.end,t.sep):t.value.end=t.sep:xs(t.start,t.sep),delete t.sep)}var xl=class{constructor(t){this.atNewLine=!0,this.atScalar=!1,this.indent=0,this.offset=0,this.onKeyLine=!1,this.stack=[],this.source="",this.type="",this.lexer=new CP.Lexer,this.onNewLine=t}*parse(t,n=!1){this.onNewLine&&this.offset===0&&this.onNewLine(0);for(let i of this.lexer.lex(t,n))yield*this.next(i);n||(yield*this.end())}*next(t){if(this.source=t,RP.env.LOG_TOKENS&&console.log("|",Zf.prettyToken(t)),this.atScalar){this.atScalar=!1,yield*this.step(),this.offset+=t.length;return}let n=Zf.tokenType(t);if(n)if(n==="scalar")this.atNewLine=!1,this.atScalar=!0,this.type="scalar";else{switch(this.type=n,yield*this.step(),n){case"newline":this.atNewLine=!0,this.indent=0,this.onNewLine&&this.onNewLine(this.offset+t.length);break;case"space":this.atNewLine&&t[0]===" "&&(this.indent+=t.length);break;case"explicit-key-ind":case"map-value-ind":case"seq-item-ind":this.atNewLine&&(this.indent+=t.length);break;case"doc-mode":case"flow-error-end":return;default:this.atNewLine=!1}this.offset+=t.length}else{let i=`Not a YAML token: ${t}`;yield*this.pop({type:"error",offset:this.offset,message:i,source:t}),this.offset+=t.length}}*end(){for(;this.stack.length>0;)yield*this.pop()}get sourceToken(){return{type:this.type,offset:this.offset,indent:this.indent,source:this.source}}*step(){let t=this.peek(1);if(this.type==="doc-end"&&t?.type!=="doc-end"){for(;this.stack.length>0;)yield*this.pop();this.stack.push({type:"doc-end",offset:this.offset,source:this.source});return}if(!t)return yield*this.stream();switch(t.type){case"document":return yield*this.document(t);case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return yield*this.scalar(t);case"block-scalar":return yield*this.blockScalar(t);case"block-map":return yield*this.blockMap(t);case"block-seq":return yield*this.blockSequence(t);case"flow-collection":return yield*this.flowCollection(t);case"doc-end":return yield*this.documentEnd(t)}yield*this.pop()}peek(t){return this.stack[this.stack.length-t]}*pop(t){let n=t??this.stack.pop();if(!n)yield{type:"error",offset:this.offset,source:"",message:"Tried to pop an empty stack"};else if(this.stack.length===0)yield n;else{let i=this.peek(1);switch(n.type==="block-scalar"?n.indent="indent"in i?i.indent:0:n.type==="flow-collection"&&i.type==="document"&&(n.indent=0),n.type==="flow-collection"&&Qf(n),i.type){case"document":i.value=n;break;case"block-scalar":i.props.push(n);break;case"block-map":{let r=i.items[i.items.length-1];if(r.value){i.items.push({start:[],key:n,sep:[]}),this.onKeyLine=!0;return}else if(r.sep)r.value=n;else{Object.assign(r,{key:n,sep:[]}),this.onKeyLine=!r.explicitKey;return}break}case"block-seq":{let r=i.items[i.items.length-1];r.value?i.items.push({start:[],value:n}):r.value=n;break}case"flow-collection":{let r=i.items[i.items.length-1];!r||r.value?i.items.push({start:[],key:n,sep:[]}):r.sep?r.value=n:Object.assign(r,{key:n,sep:[]});return}default:yield*this.pop(),yield*this.pop(n)}if((i.type==="document"||i.type==="block-map"||i.type==="block-seq")&&(n.type==="block-map"||n.type==="block-seq")){let r=n.items[n.items.length-1];r&&!r.sep&&!r.value&&r.start.length>0&&Xf(r.start)===-1&&(n.indent===0||r.start.every(s=>s.type!=="comment"||s.indent<n.indent))&&(i.type==="document"?i.end=r.start:i.items.push({start:r.start}),n.items.splice(-1,1))}}}*stream(){switch(this.type){case"directive-line":yield{type:"directive",offset:this.offset,source:this.source};return;case"byte-order-mark":case"space":case"comment":case"newline":yield this.sourceToken;return;case"doc-mode":case"doc-start":{let t={type:"document",offset:this.offset,start:[]};this.type==="doc-start"&&t.start.push(this.sourceToken),this.stack.push(t);return}}yield{type:"error",offset:this.offset,message:`Unexpected ${this.type} token in YAML stream`,source:this.source}}*document(t){if(t.value)return yield*this.lineEnd(t);switch(this.type){case"doc-start":{Xf(t.start)!==-1?(yield*this.pop(),yield*this.step()):t.start.push(this.sourceToken);return}case"anchor":case"tag":case"space":case"comment":case"newline":t.start.push(this.sourceToken);return}let n=this.startBlockValue(t);n?this.stack.push(n):yield{type:"error",offset:this.offset,message:`Unexpected ${this.type} token in YAML document`,source:this.source}}*scalar(t){if(this.type==="map-value-ind"){let n=Es(this.peek(2)),i=vn(n),r;t.end?(r=t.end,r.push(this.sourceToken),delete t.end):r=[this.sourceToken];let s={type:"block-map",offset:t.offset,indent:t.indent,items:[{start:i,key:t,sep:r}]};this.onKeyLine=!0,this.stack[this.stack.length-1]=s}else yield*this.lineEnd(t)}*blockScalar(t){switch(this.type){case"space":case"comment":case"newline":t.props.push(this.sourceToken);return;case"scalar":if(t.source=this.source,this.atNewLine=!0,this.indent=0,this.onNewLine){let n=this.source.indexOf(`
+`)+1;for(;n!==0;)this.onNewLine(this.offset+n),n=this.source.indexOf(`
+`,n)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(t){let n=t.items[t.items.length-1];switch(this.type){case"newline":if(this.onKeyLine=!1,n.value){let i="end"in n.value?n.value.end:void 0;(Array.isArray(i)?i[i.length-1]:void 0)?.type==="comment"?i?.push(this.sourceToken):t.items.push({start:[this.sourceToken]})}else n.sep?n.sep.push(this.sourceToken):n.start.push(this.sourceToken);return;case"space":case"comment":if(n.value)t.items.push({start:[this.sourceToken]});else if(n.sep)n.sep.push(this.sourceToken);else{if(this.atIndentedComment(n.start,t.indent)){let r=t.items[t.items.length-2]?.value?.end;if(Array.isArray(r)){xs(r,n.start),r.push(this.sourceToken),t.items.pop();return}}n.start.push(this.sourceToken)}return}if(this.indent>=t.indent){let i=!this.onKeyLine&&this.indent===t.indent,r=i&&(n.sep||n.explicitKey)&&this.type!=="seq-item-ind",s=[];if(r&&n.sep&&!n.value){let a=[];for(let o=0;o<n.sep.length;++o){let l=n.sep[o];switch(l.type){case"newline":a.push(o);break;case"space":break;case"comment":l.indent>t.indent&&(a.length=0);break;default:a.length=0}}a.length>=2&&(s=n.sep.splice(a[1]))}switch(this.type){case"anchor":case"tag":r||n.value?(s.push(this.sourceToken),t.items.push({start:s}),this.onKeyLine=!0):n.sep?n.sep.push(this.sourceToken):n.start.push(this.sourceToken);return;case"explicit-key-ind":!n.sep&&!n.explicitKey?(n.start.push(this.sourceToken),n.explicitKey=!0):r||n.value?(s.push(this.sourceToken),t.items.push({start:s,explicitKey:!0})):this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken],explicitKey:!0}]}),this.onKeyLine=!0;return;case"map-value-ind":if(n.explicitKey)if(n.sep)if(n.value)t.items.push({start:[],key:null,sep:[this.sourceToken]});else if(vt(n.sep,"map-value-ind"))this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:s,key:null,sep:[this.sourceToken]}]});else if(eg(n.key)&&!vt(n.sep,"newline")){let a=vn(n.start),o=n.key,l=n.sep;l.push(this.sourceToken),delete n.key,delete n.sep,this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:a,key:o,sep:l}]})}else s.length>0?n.sep=n.sep.concat(s,this.sourceToken):n.sep.push(this.sourceToken);else if(vt(n.start,"newline"))Object.assign(n,{key:null,sep:[this.sourceToken]});else{let a=vn(n.start);this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:a,key:null,sep:[this.sourceToken]}]})}else n.sep?n.value||r?t.items.push({start:s,key:null,sep:[this.sourceToken]}):vt(n.sep,"map-value-ind")?this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:[],key:null,sep:[this.sourceToken]}]}):n.sep.push(this.sourceToken):Object.assign(n,{key:null,sep:[this.sourceToken]});this.onKeyLine=!0;return;case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":{let a=this.flowScalar(this.type);r||n.value?(t.items.push({start:s,key:a,sep:[]}),this.onKeyLine=!0):n.sep?this.stack.push(a):(Object.assign(n,{key:a,sep:[]}),this.onKeyLine=!0);return}default:{let a=this.startBlockValue(t);if(a){if(a.type==="block-seq"){if(!n.explicitKey&&n.sep&&!vt(n.sep,"newline")){yield*this.pop({type:"error",offset:this.offset,message:"Unexpected block-seq-ind on same line with key",source:this.source});return}}else i&&t.items.push({start:s});this.stack.push(a);return}}}}yield*this.pop(),yield*this.step()}*blockSequence(t){let n=t.items[t.items.length-1];switch(this.type){case"newline":if(n.value){let i="end"in n.value?n.value.end:void 0;(Array.isArray(i)?i[i.length-1]:void 0)?.type==="comment"?i?.push(this.sourceToken):t.items.push({start:[this.sourceToken]})}else n.start.push(this.sourceToken);return;case"space":case"comment":if(n.value)t.items.push({start:[this.sourceToken]});else{if(this.atIndentedComment(n.start,t.indent)){let r=t.items[t.items.length-2]?.value?.end;if(Array.isArray(r)){xs(r,n.start),r.push(this.sourceToken),t.items.pop();return}}n.start.push(this.sourceToken)}return;case"anchor":case"tag":if(n.value||this.indent<=t.indent)break;n.start.push(this.sourceToken);return;case"seq-item-ind":if(this.indent!==t.indent)break;n.value||vt(n.start,"seq-item-ind")?t.items.push({start:[this.sourceToken]}):n.start.push(this.sourceToken);return}if(this.indent>t.indent){let i=this.startBlockValue(t);if(i){this.stack.push(i);return}}yield*this.pop(),yield*this.step()}*flowCollection(t){let n=t.items[t.items.length-1];if(this.type==="flow-error-end"){let i;do yield*this.pop(),i=this.peek(1);while(i?.type==="flow-collection")}else if(t.end.length===0){switch(this.type){case"comma":case"explicit-key-ind":!n||n.sep?t.items.push({start:[this.sourceToken]}):n.start.push(this.sourceToken);return;case"map-value-ind":!n||n.value?t.items.push({start:[],key:null,sep:[this.sourceToken]}):n.sep?n.sep.push(this.sourceToken):Object.assign(n,{key:null,sep:[this.sourceToken]});return;case"space":case"comment":case"newline":case"anchor":case"tag":!n||n.value?t.items.push({start:[this.sourceToken]}):n.sep?n.sep.push(this.sourceToken):n.start.push(this.sourceToken);return;case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":{let r=this.flowScalar(this.type);!n||n.value?t.items.push({start:[],key:r,sep:[]}):n.sep?this.stack.push(r):Object.assign(n,{key:r,sep:[]});return}case"flow-map-end":case"flow-seq-end":t.end.push(this.sourceToken);return}let i=this.startBlockValue(t);i?this.stack.push(i):(yield*this.pop(),yield*this.step())}else{let i=this.peek(2);if(i.type==="block-map"&&(this.type==="map-value-ind"&&i.indent===t.indent||this.type==="newline"&&!i.items[i.items.length-1].sep))yield*this.pop(),yield*this.step();else if(this.type==="map-value-ind"&&i.type!=="flow-collection"){let r=Es(i),s=vn(r);Qf(t);let a=t.end.splice(1,t.end.length);a.push(this.sourceToken);let o={type:"block-map",offset:t.offset,indent:t.indent,items:[{start:s,key:t,sep:a}]};this.onKeyLine=!0,this.stack[this.stack.length-1]=o}else yield*this.lineEnd(t)}}flowScalar(t){if(this.onNewLine){let n=this.source.indexOf(`
+`)+1;for(;n!==0;)this.onNewLine(this.offset+n),n=this.source.indexOf(`
+`,n)+1}return{type:t,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(t){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken]}]};case"explicit-key-ind":{this.onKeyLine=!0;let n=Es(t),i=vn(n);return i.push(this.sourceToken),{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:i,explicitKey:!0}]}}case"map-value-ind":{this.onKeyLine=!0;let n=Es(t),i=vn(n);return{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:i,key:null,sep:[this.sourceToken]}]}}}return null}atIndentedComment(t,n){return this.type!=="comment"||this.indent<=n?!1:t.every(i=>i.type==="newline"||i.type==="space")}*documentEnd(t){this.type!=="doc-mode"&&(t.end?t.end.push(this.sourceToken):t.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop()))}*lineEnd(t){switch(this.type){case"comma":case"doc-start":case"doc-end":case"flow-seq-end":case"flow-map-end":case"map-value-ind":yield*this.pop(),yield*this.step();break;case"newline":this.onKeyLine=!1;default:t.end?t.end.push(this.sourceToken):t.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop())}}};tg.Parser=xl});var ag=T(Ti=>{"use strict";var ng=hl(),EP=Si(),Ii=Ai(),xP=go(),IP=M(),TP=El(),ig=Il();function rg(e){let t=e.prettyErrors!==!1;return{lineCounter:e.lineCounter||t&&new TP.LineCounter||null,prettyErrors:t}}function $P(e,t={}){let{lineCounter:n,prettyErrors:i}=rg(t),r=new ig.Parser(n?.addNewLine),s=new ng.Composer(t),a=Array.from(s.compose(r.parse(e)));if(i&&n)for(let o of a)o.errors.forEach(Ii.prettifyError(e,n)),o.warnings.forEach(Ii.prettifyError(e,n));return a.length>0?a:Object.assign([],{empty:!0},s.streamInfo())}function sg(e,t={}){let{lineCounter:n,prettyErrors:i}=rg(t),r=new ig.Parser(n?.addNewLine),s=new ng.Composer(t),a=null;for(let o of s.compose(r.parse(e),!0,e.length))if(!a)a=o;else if(a.options.logLevel!=="silent"){a.errors.push(new Ii.YAMLParseError(o.range.slice(0,2),"MULTIPLE_DOCS","Source contains multiple documents; please use YAML.parseAllDocuments()"));break}return i&&n&&(a.errors.forEach(Ii.prettifyError(e,n)),a.warnings.forEach(Ii.prettifyError(e,n))),a}function LP(e,t,n){let i;typeof t=="function"?i=t:n===void 0&&t&&typeof t=="object"&&(n=t);let r=sg(e,n);if(!r)return null;if(r.warnings.forEach(s=>xP.warn(r.options.logLevel,s)),r.errors.length>0){if(r.options.logLevel!=="silent")throw r.errors[0];r.errors=[]}return r.toJS(Object.assign({reviver:i},n))}function OP(e,t,n){let i=null;if(typeof t=="function"||Array.isArray(t)?i=t:n===void 0&&t&&(n=t),typeof n=="string"&&(n=n.length),typeof n=="number"){let r=Math.round(n);n=r<1?void 0:r>8?{indent:8}:{indent:r}}if(e===void 0){let{keepUndefined:r}=n??t??{};if(!r)return}return IP.isDocument(e)&&!i?e.toString(n):new EP.Document(e,i,n).toString(n)}Ti.parse=LP;Ti.parseAllDocuments=$P;Ti.parseDocument=sg;Ti.stringify=OP});var $l=T(z=>{"use strict";var NP=hl(),jP=Si(),BP=Yo(),Tl=Ai(),FP=ai(),bt=M(),DP=ht(),qP=Q(),MP=kt(),UP=wt(),VP=Rs(),GP=Rl(),zP=El(),KP=Il(),Is=ag(),og=ni();z.Composer=NP.Composer;z.Document=jP.Document;z.Schema=BP.Schema;z.YAMLError=Tl.YAMLError;z.YAMLParseError=Tl.YAMLParseError;z.YAMLWarning=Tl.YAMLWarning;z.Alias=FP.Alias;z.isAlias=bt.isAlias;z.isCollection=bt.isCollection;z.isDocument=bt.isDocument;z.isMap=bt.isMap;z.isNode=bt.isNode;z.isPair=bt.isPair;z.isScalar=bt.isScalar;z.isSeq=bt.isSeq;z.Pair=DP.Pair;z.Scalar=qP.Scalar;z.YAMLMap=MP.YAMLMap;z.YAMLSeq=UP.YAMLSeq;z.CST=VP;z.Lexer=GP.Lexer;z.LineCounter=zP.LineCounter;z.Parser=KP.Parser;z.parse=Is.parse;z.parseAllDocuments=Is.parseAllDocuments;z.parseDocument=Is.parseDocument;z.stringify=Is.stringify;z.visit=og.visit;z.visitAsync=og.visitAsync});import{spawn as ox}from"node:child_process";import{createHash as qn,randomBytes as it}from"node:crypto";import{constants as fh}from"node:fs";import{access as fy,appendFile as lx,chmod as cx,lstat as gy,mkdir as Mn,open as my,readdir as ux,readFile as ur,realpath as rr,rename as dx,rm as Tt,stat as lu,writeFile as Aa}from"node:fs/promises";import{basename as me,dirname as ge,join as K,posix as Qt,relative as ka,resolve as Ra,win32 as rt}from"node:path";import{createInterface as cu}from"node:readline/promises";import{spawn as zu}from"node:child_process";import{createHash as iw}from"node:crypto";import{chmod as rw,mkdir as br,readFile as Ku,rm as Fa,writeFile as nn}from"node:fs/promises";import{dirname as Hn,posix as sw,win32 as aw}from"node:path";import{posix as Wk,win32 as Fu}from"node:path";var Yk="https://github.com/vercel-labs/skills#supported-agents",wr="2026-07-15",Te=["codex","claude-code","cursor","opencode","amp","kimi-code-cli","replit","universal","antigravity","augment","openclaw","cline","warp","codebuddy","command-code","continue","cortex","crush","deepagents","droid","gemini-cli","github-copilot","goose","junie","iflow-cli","kilo","kiro-cli","kode","mcpjam","mistral-vibe","mux","openhands","pi","qoder","qwen-code","roo","trae","trae-cn","windsurf","zencoder","neovate","pochi","adal","aider-desk","antigravity-cli","astrbot","autohand-code","bob","dexto","loaf","zed","codearts-agent","codemaker","codestudio","devin","eve","firebender","forgecode","hermes-agent","inference-sh","jazz","lingma","moxby","ona","qoder-cn","reasonix","rovodev","tabnine-cli","terramind","tinycloud","zcode","zenflow","promptscript"];var Zk={"kimi-cli":"kimi-code-cli"},yr=[N("codex","Codex",".codex",{capabilities:te({allowedTools:!0}),compatibleProjectSkillsRelativePaths:[".agents/skills"]}),N("claude-code","Claude Code",".claude",{envVar:"CLAUDE_CODE_HOME",capabilities:te({allowedTools:!0,hooks:!0,forkedContext:!0})}),N("cursor","Cursor",".cursor",{capabilities:te({allowedTools:!0}),compatibleProjectSkillsRelativePaths:[".agents/skills"]}),N("opencode","OpenCode",".opencode",{globalRootRelativePath:".config/opencode",capabilities:te({allowedTools:!0}),compatibleProjectSkillsRelativePaths:[".agents/skills"]}),de("amp","Amp",".config/agents",{capabilities:te({allowedTools:!0})}),de("kimi-code-cli","Kimi Code CLI",".agents",{legacyEnvVars:["KIMI_CLI_HOME"],legacyGlobalSkillsRelativePaths:[".config/agents/skills"]}),de("replit","Replit",".config/agents"),de("universal","Universal",".config/agents"),de("antigravity","Antigravity",".gemini/antigravity",{capabilities:te({allowedTools:!0}),detectGlobal:!0}),N("augment","Augment",".augment"),{id:"openclaw",displayName:"OpenClaw",envVar:"OPENCLAW_HOME",legacyEnvVars:[],capabilities:te({allowedTools:!0}),adapterRevision:wr,targets:{projectRootRelativePath:null,projectSkillsRelativePath:"skills",globalRootRelativePath:".openclaw",globalSkillsRelativePath:".openclaw/skills",projectCompatibleRelativePaths:[],projectLegacyRelativePaths:[],globalCompatibleRelativePaths:[],globalLegacyRelativePaths:[]},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:[".openclaw",".openclaw/skills"]}},de("cline","Cline",".agents",{capabilities:te({allowedTools:!0,hooks:!0})}),de("warp","Warp",".agents"),N("codebuddy","CodeBuddy",".codebuddy",{capabilities:te({allowedTools:!0})}),N("command-code","Command Code",".commandcode",{capabilities:te({allowedTools:!0})}),N("continue","Continue",".continue"),N("cortex","Cortex Code",".cortex",{globalRootRelativePath:".snowflake/cortex"}),N("crush","Crush",".crush",{globalRootRelativePath:".config/crush"}),de("deepagents","Deep Agents",".deepagents/agent",{detectGlobal:!0}),N("droid","Droid",".factory"),de("gemini-cli","Gemini CLI",".gemini",{detectGlobal:!0}),de("github-copilot","GitHub Copilot",".copilot",{capabilities:te({allowedTools:!0}),detectGlobal:!0}),N("goose","Goose",".goose",{globalRootRelativePath:".config/goose"}),N("junie","Junie",".junie"),N("iflow-cli","iFlow CLI",".iflow"),N("kilo","Kilo Code",".kilocode"),N("kiro-cli","Kiro CLI",".kiro"),N("kode","Kode",".kode"),N("mcpjam","MCPJam",".mcpjam"),N("mistral-vibe","Mistral Vibe",".vibe"),N("mux","Mux",".mux"),N("openhands","OpenHands",".openhands",{capabilities:te({allowedTools:!0})}),N("pi","Pi",".pi",{globalRootRelativePath:".pi/agent",capabilities:te({allowedTools:!0})}),N("qoder","Qoder",".qoder",{capabilities:te({allowedTools:!0})}),N("qwen-code","Qwen Code",".qwen"),N("roo","Roo Code",".roo",{capabilities:te({allowedTools:!0})}),N("trae","Trae",".trae",{detectProject:!1}),N("trae-cn","Trae CN",".trae",{globalRootRelativePath:".trae-cn",detectProject:!1}),N("windsurf","Windsurf",".windsurf",{globalRootRelativePath:".codeium/windsurf"}),N("zencoder","Zencoder",".zencoder",{capabilities:te({allowedTools:!0})}),N("neovate","Neovate",".neovate",{capabilities:te({allowedTools:!0})}),N("pochi","Pochi",".pochi"),N("adal","AdaL",".adal"),N("aider-desk","AiderDesk",".aider-desk"),de("antigravity-cli","Antigravity CLI",".gemini/antigravity-cli",{detectGlobal:!0}),N("astrbot","AstrBot","data",{globalRootRelativePath:".astrbot",globalSkillsRelativePath:".astrbot/data/skills"}),N("autohand-code","Autohand Code CLI",".autohand"),N("bob","IBM Bob",".bob"),de("dexto","Dexto",".agents"),de("loaf","Loaf",".agents"),de("zed","Zed",".agents"),N("codearts-agent","CodeArts Agent",".codeartsdoer"),N("codemaker","Codemaker",".codemaker"),N("codestudio","Code Studio",".codestudio"),N("devin","Devin for Terminal",".devin",{globalRootRelativePath:".config/devin"}),N("eve","Eve","agent",{globalApplicable:!1}),de("firebender","Firebender",".firebender",{detectGlobal:!0}),N("forgecode","ForgeCode",".forge"),N("hermes-agent","Hermes Agent",".hermes"),N("inference-sh","inference.sh",".inferencesh"),N("jazz","Jazz",".jazz"),N("lingma","Lingma",".lingma"),N("moxby","Moxby",".moxby"),N("ona","Ona",".ona"),N("qoder-cn","Qoder CN",".qoder",{globalRootRelativePath:".qoder-cn",detectProject:!1}),N("reasonix","Reasonix",".reasonix"),N("rovodev","Rovo Dev",".rovodev"),N("tabnine-cli","Tabnine CLI",".tabnine/agent"),N("terramind","Terramind",".terramind"),N("tinycloud","Tinycloud",".tinycloud"),N("zcode","ZCode",".zcode"),N("zenflow","Zenflow",".zencoder",{detectProject:!1,detectGlobal:!1}),de("promptscript","PromptScript",".agents",{globalApplicable:!1})];ew(Te,Zk);nw();function We(e=process.env,t=process.platform,n=process.cwd()){let i=qu(t),r=Du(e,t);return yr.map(s=>{let a=Uu(s,e,i),o=s.targets.globalSkillsRelativePath!==null,l=o&&r&&s.targets.globalRootRelativePath?tn(i,r,s.targets.globalRootRelativePath):null,c=o&&r&&s.targets.globalSkillsRelativePath?tn(i,r,s.targets.globalSkillsRelativePath):null,d=s.targets.projectRootRelativePath?tn(i,n,s.targets.projectRootRelativePath):null,p=o?a??l:null,f=tn(i,n,s.targets.projectSkillsRelativePath),g=o?a?i.join(a,"skills"):c:null,h=mr();return{id:s.id,displayName:s.displayName,envVar:s.envVar,capabilities:s.capabilities,detectionSources:[],targets:{projectRoot:d,projectSkillsPath:f,globalRoot:p,globalSkillsPath:g},installEvidence:h,adapterRevision:s.adapterRevision,pathContracts:{project:{status:"supported",preferredPath:f,preferredRelativePath:s.targets.projectSkillsRelativePath,compatibleReadOnlyPaths:hr(i,n,s.targets.projectCompatibleRelativePaths),legacyReadOnlyPaths:hr(i,n,s.targets.projectLegacyRelativePaths),evidence:mr()},global:o?{status:"supported",preferredPath:g,preferredRelativePath:s.targets.globalSkillsRelativePath,compatibleReadOnlyPaths:r?hr(i,r,s.targets.globalCompatibleRelativePaths):[],legacyReadOnlyPaths:r?hr(i,r,s.targets.globalLegacyRelativePaths):[],evidence:mr()}:{status:"not_applicable",preferredPath:null,preferredRelativePath:null,compatibleReadOnlyPaths:[],legacyReadOnlyPaths:[],evidence:mr()}}}})}async function ja(e={}){let t=e.env??process.env,n=e.platform??process.platform,i=e.cwd??process.cwd(),r=qu(n),s=Du(t,n),a=We(t,n,i),o=e.pathExists??(async()=>!1);return(await Promise.all(a.map(async l=>{let c=Qk(l.id),d=[],p=Uu(c,t,r);return(c.targets.globalSkillsRelativePath!==null&&p&&await o(p)||c.targets.globalSkillsRelativePath!==null&&p&&await o(r.join(p,"skills")))&&d.push("override"),c.detection.projectProbeRelativePaths.length>0&&await Nu({basePath:i,relativePaths:c.detection.projectProbeRelativePaths,pathApi:r,pathExists:o})&&d.push("project"),s&&c.detection.globalProbeRelativePaths.length>0&&await Nu({basePath:s,relativePaths:c.detection.globalProbeRelativePaths,pathApi:r,pathExists:o})&&d.push("global"),d.length===0?null:{...l,detectionSources:Xk(d)}}))).flatMap(l=>l?[l]:[])}function Du(e,t){return t==="win32"?kr(e.USERPROFILE,e.HOME):kr(e.HOME)}function qu(e){return e==="win32"?Fu:Wk}function kr(...e){return e.find(t=>typeof t=="string"&&t.trim().length>0)?.trim()}function Xk(e){return[...new Set(e)]}async function Nu(e){for(let t of e.relativePaths)if(await e.pathExists(tn(e.pathApi,e.basePath,t)))return!0;return!1}function tn(e,t,n){return e.join(t,...n.split("/"))}function N(e,t,n,i={}){let r=i.globalRootRelativePath??n,s=i.detectProject??!0,a=i.globalApplicable??!0,o=i.globalSkillsRelativePath??`${r}/skills`;return{id:e,displayName:t,envVar:i.envVar??Mu(e),legacyEnvVars:i.legacyEnvVars??[],capabilities:i.capabilities??te(),adapterRevision:i.adapterRevision??wr,targets:{projectRootRelativePath:n,projectSkillsRelativePath:`${n}/skills`,globalRootRelativePath:a?r:null,globalSkillsRelativePath:a?o:null,projectCompatibleRelativePaths:i.compatibleProjectSkillsRelativePaths??[],projectLegacyRelativePaths:i.legacyProjectSkillsRelativePaths??[],globalCompatibleRelativePaths:i.compatibleGlobalSkillsRelativePaths??[],globalLegacyRelativePaths:i.legacyGlobalSkillsRelativePaths??[]},detection:{projectProbeRelativePaths:s?[n,`${n}/skills`]:[],globalProbeRelativePaths:a&&(i.detectGlobal??!0)?[r,o]:[]}}}function de(e,t,n,i={}){let r=i.detectGlobal??!1,s=i.globalApplicable??!0;return{id:e,displayName:t,envVar:i.envVar??Mu(e),legacyEnvVars:i.legacyEnvVars??[],capabilities:i.capabilities??te(),adapterRevision:i.adapterRevision??wr,targets:{projectRootRelativePath:".agents",projectSkillsRelativePath:".agents/skills",globalRootRelativePath:s?n:null,globalSkillsRelativePath:s?`${n}/skills`:null,projectCompatibleRelativePaths:i.compatibleProjectSkillsRelativePaths??[],projectLegacyRelativePaths:i.legacyProjectSkillsRelativePaths??[],globalCompatibleRelativePaths:i.compatibleGlobalSkillsRelativePaths??[],globalLegacyRelativePaths:i.legacyGlobalSkillsRelativePaths??[]},detection:{projectProbeRelativePaths:[],globalProbeRelativePaths:r&&s?[n,`${n}/skills`]:[]}}}function te(e={}){let t=["basic_skills"];return e.allowedTools&&t.push("allowed_tools"),e.hooks&&t.push("hooks"),e.forkedContext&&t.push("forked_context"),t.push("local_install"),t}function Mu(e){return`${e.replaceAll("-","_").toUpperCase()}_HOME`}function Qk(e){return yr.find(t=>t.id===e)}function ew(e,t){let n=new Set;for(let i of e){if(!ju(i))throw new Error(`Unsafe canonical agent id: ${JSON.stringify(i)}`);if(n.has(i))throw new Error(`Duplicate canonical agent id: ${i}`);n.add(i)}for(let i of Object.keys(t)){if(!ju(i))throw new Error(`Unsafe alias: ${JSON.stringify(i)}`);if(n.has(i))throw new Error(`Alias ${i} collides with a canonical agent id`);let r=new Set([i]),s=t[i];for(;!n.has(s);){if(r.has(s))throw new Error(`Agent alias cycle detected at ${s}`);r.add(s);let a=t[s];if(!a)throw new Error(`Agent alias ${i} has unknown target ${s}`);s=a}}}function ju(e){return/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(e)}function mr(){return{sourceUrl:Yk,checkedAt:wr,state:"contract_tested",supportedPlatforms:["darwin","linux","win32"],hostVersion:null}}function hr(e,t,n){return n.map(i=>({path:tn(e,t,i),relativePath:i,access:"read_only"}))}function Uu(e,t,n){let i=[{envVar:e.envVar,value:kr(t[e.envVar])},...e.legacyEnvVars.map(r=>({envVar:r,value:kr(t[r])}))].filter(r=>r.value!==void 0);if(i.length>1&&new Set(i.map(s=>tw(n,s.value))).size>1)throw new Error(`Conflicting canonical and legacy overrides for ${e.id}: ${i.map(s=>s.envVar).join(", ")}`);return i[0]?.value}function tw(e,t){let n=e.normalize(t);return e===Fu?n.toLowerCase():n}function nw(){let e=yr.map(t=>t.id);if(e.length!==Te.length||e.some((t,n)=>t!==Te[n]))throw new Error("Agent definitions must exactly match the canonical supported-agent inventory");for(let t of yr){if(!Bu(t.targets.projectSkillsRelativePath))throw new Error(`Unsafe project path contract for ${t.id}`);let n=t.targets.globalSkillsRelativePath;if(n!==null&&!Bu(n))throw new Error(`Unsafe global path contract for ${t.id}`);if(t.targets.globalRootRelativePath===null!=(n===null))throw new Error(`Inconsistent global path contract for ${t.id}`)}}function Bu(e){return e.length>0&&!e.startsWith("/")&&!e.includes("\\")&&!e.includes("\0")&&e.split("/").every(t=>t.length>0&&t!=="."&&t!=="..")}var $t="skills-layer",ow="2025-06-18",lw=["mcp","skills-layer-mcp-proxy.mjs"],cw=["mcp","skills-layer-mcp-broker.mjs"],uw=["mcp","skills-layer-mcp-broker.sock"],dw={codex:{tier:"tier_1",configKind:"codex_toml",resolveConfigPath(e,t,n){let i=Ma(n);return i.join(e.targets.globalRoot??i.join(_w({},n)??t,".codex"),"config.toml")}},cursor:zn(".cursor/mcp.json"),"claude-code":zn(".mcp.json"),cline:zn(".cline/mcp.json"),"gemini-cli":zn(".gemini/settings.json"),windsurf:zn(".windsurf/mcp.json")},pw=new Set(["universal"]);function sn(e){let t=We(e.env,e.platform,e.cwd),n=new Map(t.map(y=>[y.id,y])),i=e.platform??process.platform,r=e.cwd??process.cwd(),s=e.stateDir??Sw(e.env,i),a=e.mcpConfigPath??Kn(i,s,"mcp.json"),o=Kn(i,s,...lw),l=Kn(i,s,...cw),c=Kn(i,s,...uw),d=e.nodePath??process.execPath,p=Hu({mcpConfigPath:a}),f=Ju({mcpConfigPath:a,socketPath:c}),g=rn(p),h=rn(f),m=Te.map(y=>{let w=n.get(y),v=dw[y];if(v){let S=v.resolveConfigPath(w,r,i);return fw({agentId:y,displayName:w.displayName,configPath:S,configKind:v.configKind,bridgePath:o,brokerPath:l,brokerSocketPath:c,mcpConfigPath:a,nodePath:d,bridgeChecksum:g,brokerChecksum:h})}return pw.has(y)?Gu({agentId:y,displayName:w.displayName,tier:"tier_3",status:"skills_only",verification:"skills_only",reason:"This agent is currently supported through Skills Layer skill files, not MCP auto-install.",instructions:[`Install skills for ${w.displayName} with \`skills-layer install <skill> --agent ${y}\`.`,"MCP auto-install is not claimed for this agent yet."]}):Gu({agentId:y,displayName:w.displayName,tier:"tier_2",status:"manual_handoff",verification:"manual",reason:"MCP support or the safe writable config shape has not been verified yet.",instructions:[`Add a local stdio MCP server named ${$t}.`,`Command: ${d}`,`Args: ${o}`,"Restart or reload the agent if it does not reconnect automatically."]})});return{status:"mcp_registration_plan",serverName:$t,mcpUrl:e.mcpUrl,bearerTokenEnvVar:e.bearerTokenEnvVar,clientId:e.clientId,environment:e.environment,generatedAt:e.now,bridgePath:o,brokerPath:l,brokerSocketPath:c,nodePath:d,mcpConfigPath:a,bridgeChecksum:g,brokerChecksum:h,automaticCount:m.filter(y=>y.status==="automatic").length,manualCount:m.filter(y=>y.status==="manual_handoff").length,skillsOnlyCount:m.filter(y=>y.status==="skills_only").length,unsupportedCount:m.filter(y=>y.status==="unsupported").length,targets:m}}async function Wn(e){let t=sn(e),n=Pw(e.clientId),i=t.targets.find(m=>m.agentId===n),r=e.mcpConfig??await Sr(t.mcpConfigPath,{allowMissing:!0});if(!r)return Vu({plan:t,target:i,mcpConfig:null,tokenConfig:null,tokenPresent:!1,tokenRefPresent:!1,bridgeExists:!1,checksumMatches:!1,brokerExists:!1,brokerChecksumMatches:!1,targetConfigured:!1,rawTokenLeaked:!1});let s=await Jn(t.bridgePath),a=s!==null,o=s!==null&&rn(s)===t.bridgeChecksum,l=await Jn(t.brokerPath),c=l!==null,d=l!==null&&rn(l)===t.brokerChecksum,p=Aw(r,i.agentId),f=Me(p,"token"),g=Me(p,"tokenRef"),h=i.status==="automatic"?await kw(i,f):{configured:!1,rawTokenLeaked:!1};return Vu({plan:t,target:i,mcpConfig:r,tokenConfig:p,tokenPresent:!!f,tokenRefPresent:!!g,bridgeExists:a,checksumMatches:o,brokerExists:c,brokerChecksumMatches:d,targetConfigured:h.configured,rawTokenLeaked:h.rawTokenLeaked})}function Hu(e){return`#!/usr/bin/env node
 import { createConnection } from "node:net";
 import { createInterface } from "node:readline";
 import { readFile } from "node:fs/promises";
 
 const CONFIG_PATH = ${JSON.stringify(e.mcpConfigPath)};
-const MCP_PROTOCOL_VERSION = ${JSON.stringify(To)};
+const MCP_PROTOCOL_VERSION = ${JSON.stringify(ow)};
 
 function writeMessage(message) {
   process.stdout.write(JSON.stringify(message) + "\\n");
@@ -148,7 +286,7 @@ for await (const line of rl) {
     writeMessage(errorResponse(null, -32603, error instanceof Error ? error.message : "Skills Layer MCP bridge failed."));
   }
 }
-`}function qi(e){return`#!/usr/bin/env node
+`}function Ju(e){return`#!/usr/bin/env node
 import { execFile } from "node:child_process";
 import { createServer } from "node:net";
 import { chmod, readFile, rm } from "node:fs/promises";
@@ -244,32 +382,47 @@ server.listen(SOCKET_PATH, async () => {
     // Some platforms do not support chmod on sockets.
   }
 });
-`}async function Di(e){let t=e.requestId??1,n=e.timeoutMs??5e3,i=Mi(e.nodePath,[e.bridgePath],{stdio:["pipe","pipe","pipe"]}),r="",s=Jo(i.stdout);i.stderr.on("data",u=>{r+=String(u)});let o,a=new Promise(u=>{o=setTimeout(()=>u("timeout"),n)});i.stdin.write(`${JSON.stringify({jsonrpc:"2.0",id:t,method:"tools/list",params:{}})}
-`);let c=await Promise.race([s,a]);if(clearTimeout(o),i.kill(),c==="timeout")return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!1,toolCount:null,reasonCode:"probe_timeout",message:"MCP bridge did not respond before the verification timeout."};if(!c.ok)return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!1,toolCount:null,reasonCode:"probe_failed",message:r.trim()?"MCP bridge failed before returning a response.":c.message};try{let u=JSON.parse(c.line);if(se(u)&&se(u.error))return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:null,reasonCode:"remote_mcp_error",message:de(u.error,"message")??"Skills Layer MCP returned an error."};let d=se(u)&&se(u.result)&&Array.isArray(u.result.tools)?u.result.tools:null;return{status:"ok",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:d?d.length:null,reasonCode:null,message:d?`MCP bridge responded with ${d.length} tool${d.length===1?"":"s"}.`:"MCP bridge responded."}}catch{return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:null,reasonCode:"invalid_probe_response",message:"MCP bridge returned a response that was not valid JSON."}}}function Fi(e){let t=e.target.status==="automatic",n=e.tokenRefPresent&&!e.tokenPresent,i=!n||e.brokerExists&&e.brokerChecksumMatches,r=(e.tokenPresent||e.tokenRefPresent)&&e.bridgeExists&&e.checksumMatches&&i&&t&&e.targetConfigured&&!e.rawTokenLeaked,s=r?"mcp_configured":e.mcpConfig?"mcp_needs_repair":"mcp_not_configured",o=`skills-layer mcp verify --client ${e.target.agentId}`;return{status:s,configured:r,clientId:e.target.agentId,environment:de(e.tokenConfig,"environment")??de(e.mcpConfig,"environment")??e.plan.environment,baseUrl:de(e.mcpConfig,"baseUrl"),mcpUrl:de(e.mcpConfig,"mcpUrl"),tokenPrefix:de(e.tokenConfig,"tokenPrefix")??de(e.mcpConfig,"tokenPrefix"),scopes:Array.isArray(e.tokenConfig?.scopes)?e.tokenConfig.scopes:Array.isArray(e.mcpConfig?.scopes)?e.mcpConfig.scopes:[],configuredClients:ea(e.mcpConfig),tokenPresent:e.tokenPresent||e.tokenRefPresent,tokenStorage:de(e.tokenConfig,"credentialStorage")==="macos_keychain"?"macos_keychain":e.tokenPresent?"local_file_locked":"unknown",bridge:{path:e.plan.bridgePath,exists:e.bridgeExists,checksumMatches:e.checksumMatches},broker:{path:e.plan.brokerPath,socketPath:e.plan.brokerSocketPath,required:n,exists:e.brokerExists,checksumMatches:e.brokerChecksumMatches},target:{agentId:e.target.agentId,displayName:e.target.displayName,tier:e.target.tier,status:e.target.status,configPath:e.target.configPath,configured:e.targetConfigured,rawTokenLeaked:e.rawTokenLeaked,reason:e.target.reason,restartRequired:e.target.restartRequired,instructions:e.target.instructions},liveProbe:{status:"not_run",method:"tools/list",reasonCode:"use_mcp_verify",message:`Live MCP tools/list was not run by status. Run \`${o}\` to verify remote MCP reachability through the local bridge.`,nextCommand:o},nextCommand:r?null:`skills-layer mcp repair --client ${e.target.agentId}`}}function qo(e){return{agentId:e.agentId,displayName:e.displayName,tier:"tier_1",status:"automatic",serverName:$e,configPath:e.configPath,restartRequired:!0,verification:"bridge_config_written",transport:"stdio_bridge",bridgePath:e.bridgePath,nodePath:e.nodePath,configKind:e.configKind,reason:"MCP support and a safe local config shape are known.",instructions:[`Skills Layer will install the local MCP bridge at ${e.bridgePath}.`,`Skills Layer will update ${e.configPath} to launch the bridge with ${e.nodePath}.`,"The raw MCP token stays in Skills Layer local storage and is not written to the agent config.","Open a fresh agent session or restart the agent to load the MCP server."],apply:async()=>{let t=await Do({bridgePath:e.bridgePath,brokerPath:e.brokerPath,brokerSocketPath:e.brokerSocketPath,mcpConfigPath:e.mcpConfigPath,nodePath:e.nodePath});return await Vo({configPath:e.configPath,configKind:e.configKind,bridgePath:e.bridgePath,nodePath:e.nodePath,agentId:e.agentId}),t},disconnect:async()=>{await Go({configPath:e.configPath,configKind:e.configKind})}}}function Ni(e){return{agentId:e.agentId,displayName:e.displayName,tier:e.tier,status:e.status,serverName:$e,configPath:null,restartRequired:!0,verification:e.verification,transport:"manual",bridgePath:null,nodePath:null,configKind:null,reason:e.reason,instructions:e.instructions}}async function Do(e){let t=Oi({mcpConfigPath:e.mcpConfigPath}),n=qi({mcpConfigPath:e.mcpConfigPath,socketPath:e.brokerSocketPath});return await vt(Qe(e.bridgePath),{recursive:!0}),await Te(e.bridgePath,t,"utf8"),await Te(e.brokerPath,n,"utf8"),await nn(Qe(e.bridgePath),448),await nn(e.bridgePath,448),await nn(e.brokerPath,448),Ko({nodePath:e.nodePath,brokerPath:e.brokerPath}),{bridgePath:e.bridgePath,brokerPath:e.brokerPath,brokerSocketPath:e.brokerSocketPath,mcpConfigPath:e.mcpConfigPath,checksum:Fe(t),brokerChecksum:Fe(n),nodePath:e.nodePath}}function Ko(e){if(!(process.env.VITEST==="true"||process.env.SKILLS_LAYER_MCP_BROKER_AUTOSTART==="disabled"))try{Mi(e.nodePath,[e.brokerPath],{detached:!0,stdio:"ignore"}).unref()}catch{}}async function Vo(e){if(e.configKind==="codex_toml"){await Wo(e);return}await zo(e)}async function Go(e){if(e.configKind==="codex_toml"){let i=await Xe(e.configPath);if(i===null)return;await Te(e.configPath,Ki(i),"utf8");return}let t=await bt(e.configPath,{allowMissing:!0});if(!t||!se(t.mcpServers))return;let n={...t.mcpServers};delete n[$e],await vt(Qe(e.configPath),{recursive:!0}),await Te(e.configPath,`${JSON.stringify({...t,mcpServers:n},null,2)}
-`,"utf8")}async function Ho(e,t){if(!e.configPath||!e.configKind||!e.bridgePath||!e.nodePath)return{configured:!1,rawTokenLeaked:!1};if(e.configKind==="codex_toml"){let s=await Xe(e.configPath);return s===null?{configured:!1,rawTokenLeaked:!1}:{configured:s.includes("[mcp_servers.skills-layer]")&&s.includes(`command = ${JSON.stringify(e.nodePath)}`)&&(s.includes(`args = [${JSON.stringify(e.bridgePath)}, "--client", ${JSON.stringify(e.agentId)}]`)||s.includes(`args = [${JSON.stringify(e.bridgePath)}]`)),rawTokenLeaked:!!(t&&s.includes(t))}}let n=await bt(e.configPath,{allowMissing:!0}),i=se(n?.mcpServers)?n.mcpServers[$e]:void 0;return{configured:se(i)&&i.command===e.nodePath&&Array.isArray(i.args)&&i.args[0]===e.bridgePath&&(i.args.length===1||i.args[1]==="--client"&&i.args[2]===e.agentId),rawTokenLeaked:!!(t&&JSON.stringify(n??{}).includes(t))}}async function zo(e){let t=await bt(e.configPath,{allowMissing:!0})??{},n=se(t.mcpServers)?{...t.mcpServers}:{};n[$e]={command:e.nodePath,args:[e.bridgePath,"--client",e.agentId]},await vt(Qe(e.configPath),{recursive:!0}),await Te(e.configPath,`${JSON.stringify({...t,mcpServers:n},null,2)}
-`,"utf8")}async function Wo(e){let t=await Xe(e.configPath)??"",n=["[mcp_servers.skills-layer]",`command = ${JSON.stringify(e.nodePath)}`,`args = [${JSON.stringify(e.bridgePath)}, "--client", ${JSON.stringify(e.agentId)}]`,""].join(`
-`),i=`${Ki(t).trimEnd()}${t.trim().length>0?`
-
-`:""}${n}`;await vt(Qe(e.configPath),{recursive:!0}),await Te(e.configPath,i,"utf8")}function Ki(e){let t=e.split(/\r?\n/u),n=[],i=!1;for(let r of t){if(r.trim()==="[mcp_servers.skills-layer]"){i=!0;continue}i&&/^\s*\[.+\]\s*$/u.test(r)&&(i=!1),i||n.push(r)}return n.join(`
-`).trimEnd()}function Ye(e){return{tier:"tier_1",configKind:"json_mcp_servers",resolveConfigPath(t,n,i){return Ze(i,n,...e.split("/"))}}}async function bt(e,t){try{let n=JSON.parse(await Bi(e,"utf8"));return se(n)?n:{}}catch(n){if(t.allowMissing&&n.code==="ENOENT")return null;throw n}}async function Xe(e){try{return await Bi(e,"utf8")}catch(t){if(t.code==="ENOENT")return null;throw t}}async function nn(e,t){try{await jo(e,t)}catch{}}async function Vi(e){await rn(e,{force:!0})}async function Gi(e,t){await Promise.all([rn(e,{force:!0}),rn(t,{force:!0})])}function Jo(e){return e?new Promise(t=>{let n="";e.on("data",i=>{n+=String(i);let r=n.indexOf(`
-`);r>=0&&t({ok:!0,line:n.slice(0,r)})}),e.on("error",i=>{t({ok:!1,message:i instanceof Error?i.message:"MCP bridge stdout failed."})}),e.on("end",()=>{t({ok:!1,message:"MCP bridge exited before returning a response."})})}):Promise.resolve({ok:!1,message:"MCP bridge stdout was not available."})}function Yo(e,t){let n=sn(t),i=e??process.env,r=t==="win32"?wt(i.APPDATA,i.USERPROFILE,i.HOME):wt(i.XDG_CONFIG_HOME,i.HOME?n.join(i.HOME,".skills-layer"):void 0);return r?t==="win32"||i.XDG_CONFIG_HOME?.trim()?n.join(r,"skills-layer"):r:n.join(process.cwd(),".skills-layer")}function Zo(e,t){return t==="win32"?wt(e.USERPROFILE,e.HOME):wt(e.HOME)}function Qo(e){return Re.includes(e)?e:"codex"}function Xo(e,t){let n=e.tokens;return se(n)&&se(n[t])?n[t]:e}function ea(e){if(!e)return[];let t=e.clientIds;if(Array.isArray(t))return t.filter(r=>typeof r=="string"&&r.trim().length>0);let n=e.tokens;if(se(n))return Object.keys(n);let i=de(e,"clientId");return i?[i]:[]}function Ze(e,...t){return sn(e).join(...t)}function sn(e){return e==="win32"?Uo:Lo}function wt(...e){return e.find(t=>typeof t=="string"&&t.trim().length>0)?.trim()}function de(e,t){let n=e?.[t];return typeof n=="string"&&n.trim().length>0?n:null}function Fe(e){return Io("sha256").update(e).digest("hex")}function se(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function ta(e){let t=na(e);if(t)return t;let n=ia(e);if(n)return n;throw new Error("Unsupported bundle archive format")}function Hi(e){try{return ta(e)}catch{return null}}function na(e){if(e.byteLength<4)return null;let t=new TextDecoder,n=new DataView(e.buffer,e.byteOffset,e.byteLength),i=[],r=0,s=!1;for(;r+4<=e.byteLength;){let o=n.getUint32(r,!0);if(o===67324752){if(s=!0,r+30>e.byteLength)throw new Error("ZIP local header is truncated");let a=n.getUint16(r+8,!0),c=n.getUint32(r+18,!0),u=n.getUint16(r+26,!0),d=n.getUint16(r+28,!0),g=r+30,f=g+u+d,m=f+c;if(a!==0)throw new Error("Only stored ZIP entries are supported");if(m>e.byteLength)throw new Error("ZIP entry data is truncated");i.push({path:t.decode(e.slice(g,g+u)),content:t.decode(e.slice(f,m))}),r=m;continue}return o===33639248||o===101010256?s?i:null:s?(()=>{throw new Error("Unexpected ZIP signature")})():null}return i}function ia(e){try{let t=JSON.parse(new TextDecoder().decode(e));return t.format!=="skills-layer-external-bundle-v1"||!Array.isArray(t.files)?null:t.files.filter(n=>typeof n.path=="string").map(n=>({path:n.path,...typeof n.content=="string"?{content:n.content}:{}}))}catch{return null}}import{createHash as ra}from"node:crypto";function zi(e){let t=ra("sha256");for(let n of e)t.update(n.path),t.update("\0"),t.update(n.content??""),t.update("\0");return t.digest("hex")}var on=["productivity","coding","review","testing","devops","data","documents","media","research","planning","design","security","business","education","automation","communication","email","customer-support","sales","marketing","finance","legal","operations","project-management","writing","translation","knowledge-management","hr","ai","ecommerce"],sa="productivity",oa=new Set(on),aa={ci:"devops","ci-cd":"devops",compliance:"security",content:"documents",crm:"customer-support",docs:"documents",frontend:"coding","customer-service":"customer-support","customer-success":"customer-support","e-commerce":"ecommerce",genai:"ai",legal:"legal",llm:"ai",ops:"operations",pm:"project-management",reporting:"business",reports:"business","team-ops":"operations",ui:"design",ux:"design","web-development":"coding"},la={productivity:["productivity","todo","task","tasks","calendar","meeting","notes","workflow","focus"],coding:["code","coding","developer","frontend","backend","repository","typescript","javascript","react","vite","html","css","component","bundle","artifact"],review:["review","reviews","critique","audit","feedback","pr","pull","quality"],testing:["test","tests","testing","qa","coverage","regression","playwright","vitest"],devops:["deploy","deployment","ci","cd","pipeline","infra","infrastructure","docker","cloudflare","wrangler"],data:["data","dataset","sql","database","analytics","metrics","spreadsheet","csv","json"],documents:["document","documents","doc","docs","pdf","report","reports","contract","proposal","writing"],media:["media","image","video","audio","transcript","youtube","asset","thumbnail"],research:["research","search","sources","citation","citations","summarize","summaries","literature"],planning:["plan","planning","project","roadmap","milestone","sprint","delivery","schedule"],design:["design","ui","ux","layout","wireframe","prototype","figma","tailwind","shadcn"],security:["security","threat","secret","secrets","vulnerability","vulnerabilities","risk","policy"],business:["business","strategy","customer","market","stakeholder","commercial","pricing"],education:["education","teach","teaching","learn","learning","lesson","course","tutorial"],automation:["automation","automate","workflow","script","scripts","bot","trigger","orchestration"],communication:["communication","slack","message","messages","chat","reply","announcement","conversation"],email:["email","emails","gmail","googleemail","googlemail","outlook","inbox","mail","newsletter"],"customer-support":["support","ticket","tickets","helpdesk","customer","service","csat","escalation"],sales:["sales","lead","leads","prospect","pipeline","deal","deals","crm","account"],marketing:["marketing","campaign","brand","seo","content","social","audience","copy"],finance:["finance","financial","invoice","invoices","budget","forecast","accounting","revenue","tax"],legal:["legal","contract","contracts","clause","clauses","compliance","policy","terms","privacy"],operations:["operations","ops","runbook","process","sop","incident","queue","handoff"],"project-management":["project","projects","backlog","dependency","dependencies","kanban","scrum","pm"],writing:["writing","write","draft","edit","editing","blog","article","copywriting"],translation:["translation","translate","localization","locale","language","languages","i18n"],"knowledge-management":["knowledge","wiki","kb","retrieval","archive","taxonomy","knowledgebase"],hr:["hr","hiring","recruiting","interview","onboarding","employee","people","performance"],ai:["ai","llm","prompt","prompts","model","models","agent","agents","rag","embedding"],ecommerce:["ecommerce","commerce","shop","store","checkout","cart","order","orders","product"]};function Wi(e){if(typeof e!="string")return null;let t=Zi(e);return oa.has(t)?t:aa[t]??null}function Ji(e){let t=e.trim().toLowerCase().replace(/[_\s]+/gu,"-"),n={ai:"AI",hr:"HR",ecommerce:"E-commerce","e-commerce":"E-commerce"};return n[t]?n[t]:e.split(/[-_\s]+/u).filter(Boolean).map(i=>`${i.slice(0,1).toUpperCase()}${i.slice(1)}`).join(" ")}function Yi(e){let t=[{value:e.slug??"",weight:3,signal:"slug"},{value:e.name??"",weight:3,signal:"name"},{value:e.description??"",weight:2,signal:"description"},{value:e.skillType??"",weight:1,signal:"skill_type"},{value:e.compatibility??"",weight:1,signal:"compatibility"},{value:(e.tags??[]).join(" "),weight:4,signal:"tags"},{value:e.body??"",weight:1,signal:"body"}].filter(s=>s.value.trim().length>0),n=new Map;for(let s of t){let o=ua(s.value);for(let[a,c]of Object.entries(la)){if(!c.some(g=>o.has(g)))continue;let d=n.get(a)??{score:0,signals:new Set};d.score+=s.weight,d.signals.add(s.signal),n.set(a,d)}}let r=[...n.entries()].sort((s,o)=>o[1].score-s[1].score||on.indexOf(s[0])-on.indexOf(o[0]))[0];return!r||r[1].score<2?{category:ca(e),confidence:"fallback",matchedSignals:[]}:{category:r[0],confidence:r[1].score>=5?"high":r[1].score>=3?"medium":"low",matchedSignals:[...r[1].signals].sort()}}function ca(e){let t=Zi(e.skillType??"");return t.includes("automation")?"automation":t.includes("mcp")?"ai":sa}function Zi(e){return e.trim().toLowerCase().replace(/[_\s]+/gu,"-")}function ua(e){return new Set(e.toLowerCase().split(/[^a-z0-9]+/u).map(t=>t.trim()).filter(t=>t.length>=2).flatMap(da))}function da(e){let t=[e];return e.endsWith("ing")&&e.length>5&&t.push(e.slice(0,-3)),e.endsWith("s")&&e.length>4&&t.push(e.slice(0,-1)),t}import{createHash as pa}from"node:crypto";var ga=new Set(["evals","tests","test","fixtures","examples","golden","goldens","snapshots","__snapshots__",".github",".circleci","coverage"]),ma=new Set([".gitlab-ci.yml","azure-pipelines.yml"]),fa=[".eval.json",".eval.yaml"],ha=[".golden.",".snapshot."];function Ae(e,t){let n=cn(e),i=Qi(t),r=an(n,i),[s]=r.split("/");return s&&ga.has(s)?{path:n,relativePath:r,root:i,type:"evidence",reasonCode:"top_level_evidence_folder"}:ya(r)?{path:n,relativePath:r,root:i,type:"evidence",reasonCode:"top_level_evidence_file"}:{path:n,relativePath:r,root:i,type:"runtime",reasonCode:"runtime_material"}}function ln(e){let t=Qi(e);return e.map(n=>({...n,path:cn(n.path)})).filter(n=>Ae(n.path,e).type==="runtime").sort((n,i)=>ka(n.path,i.path,t))}function he(e){let t=pa("sha256");for(let n of ln(e))t.update(n.path),t.update("\0"),t.update(n.content??""),t.update("\0");return`sha256:${t.digest("hex")}`}function ya(e){return e.includes("/")?!1:ma.has(e)||fa.some(t=>e.endsWith(t))||ha.some(t=>e.includes(t))}function Qi(e){let t=e.map(n=>cn(n.path)).find(n=>n==="SKILL.md"||n.endsWith("/SKILL.md"));return!t||t==="SKILL.md"?"":t.slice(0,-9)}function an(e,t){return t?e===t?"":e.startsWith(`${t}/`)?e.slice(t.length+1):e:e}function ka(e,t,n){let i=an(e,n),r=an(t,n);return i==="SKILL.md"?r==="SKILL.md"?0:-1:r==="SKILL.md"?1:e.localeCompare(t)}function cn(e){return e.replaceAll("\\","/").split("/").filter(t=>t.length>0&&t!==".").join("/")}var wa=["standalone","workflow_automation","mcp_enhanced"];function Xi(e){let t=e?.trim();if(!t)return"standalone";if(t==="workflow")return"workflow_automation";if(!wa.includes(t))throw new Error(`Unsupported skill type "${t}". Supported types: standalone, workflow, workflow_automation, mcp_enhanced.`);return t}function er(e){let t=[{path:"SKILL.md",content:va(e)},{path:"README.md",content:ba(e)},{path:"references/guide.md",content:Pa(e)},{path:"scripts/README.md",content:Sa(e)}],n=he(t);return[...t,{path:"evals/skills-layer.eval.json",content:Ca(e,n)}]}function va(e){let t=_a(e);return`---
-name: ${e.skillSlug}
-description: ${e.description}
-compatibility: Codex, Claude Code
-metadata:
-  category: ${t}
-  price_cents: 0
-  tags:
-    - ${t}
-    - ${e.skillType}
-  skills_layer:
-    capabilities:
-      - model_context
-      - filesystem_read
+`}async function Wu(e){let t=e.requestId??1,n=e.timeoutMs??5e3,i=zu(e.nodePath,[e.bridgePath],{stdio:["pipe","pipe","pipe"]}),r="",s=bw(i.stdout);i.stderr.on("data",c=>{r+=String(c)});let a,o=new Promise(c=>{a=setTimeout(()=>c("timeout"),n)});i.stdin.write(`${JSON.stringify({jsonrpc:"2.0",id:t,method:"tools/list",params:{}})}
+`);let l=await Promise.race([s,o]);if(clearTimeout(a),i.kill(),l==="timeout")return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!1,toolCount:null,reasonCode:"probe_timeout",message:"MCP bridge did not respond before the verification timeout."};if(!l.ok)return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!1,toolCount:null,reasonCode:"probe_failed",message:r.trim()?"MCP bridge failed before returning a response.":l.message};try{let c=JSON.parse(l.line);if($e(c)&&$e(c.error))return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:null,reasonCode:"remote_mcp_error",message:Me(c.error,"message")??"Skills Layer MCP returned an error."};let d=$e(c)&&$e(c.result)&&Array.isArray(c.result.tools)?c.result.tools:null;return{status:"ok",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:d?d.length:null,reasonCode:null,message:d?`MCP bridge responded with ${d.length} tool${d.length===1?"":"s"}.`:"MCP bridge responded."}}catch{return{status:"error",method:"tools/list",bridgePath:e.bridgePath,nodePath:e.nodePath,responseReceived:!0,toolCount:null,reasonCode:"invalid_probe_response",message:"MCP bridge returned a response that was not valid JSON."}}}function Vu(e){let t=e.target.status==="automatic",n=e.tokenRefPresent&&!e.tokenPresent,i=!n||e.brokerExists&&e.brokerChecksumMatches,r=(e.tokenPresent||e.tokenRefPresent)&&e.bridgeExists&&e.checksumMatches&&i&&t&&e.targetConfigured&&!e.rawTokenLeaked,s=r?"mcp_configured":e.mcpConfig?"mcp_needs_repair":"mcp_not_configured",a=`skills-layer mcp verify --client ${e.target.agentId}`;return{status:s,configured:r,clientId:e.target.agentId,environment:Me(e.tokenConfig,"environment")??Me(e.mcpConfig,"environment")??e.plan.environment,baseUrl:Me(e.mcpConfig,"baseUrl"),mcpUrl:Me(e.mcpConfig,"mcpUrl"),tokenPrefix:Me(e.tokenConfig,"tokenPrefix")??Me(e.mcpConfig,"tokenPrefix"),scopes:Array.isArray(e.tokenConfig?.scopes)?e.tokenConfig.scopes:Array.isArray(e.mcpConfig?.scopes)?e.mcpConfig.scopes:[],configuredClients:Rw(e.mcpConfig),tokenPresent:e.tokenPresent||e.tokenRefPresent,tokenStorage:Me(e.tokenConfig,"credentialStorage")==="macos_keychain"?"macos_keychain":e.tokenPresent?"local_file_locked":"unknown",bridge:{path:e.plan.bridgePath,exists:e.bridgeExists,checksumMatches:e.checksumMatches},broker:{path:e.plan.brokerPath,socketPath:e.plan.brokerSocketPath,required:n,exists:e.brokerExists,checksumMatches:e.brokerChecksumMatches},target:{agentId:e.target.agentId,displayName:e.target.displayName,tier:e.target.tier,status:e.target.status,configPath:e.target.configPath,configured:e.targetConfigured,rawTokenLeaked:e.rawTokenLeaked,reason:e.target.reason,restartRequired:e.target.restartRequired,instructions:e.target.instructions},liveProbe:{status:"not_run",method:"tools/list",reasonCode:"use_mcp_verify",message:`Live MCP tools/list was not run by status. Run \`${a}\` to verify remote MCP reachability through the local bridge.`,nextCommand:a},nextCommand:r?null:`skills-layer mcp repair --client ${e.target.agentId}`}}function fw(e){return{agentId:e.agentId,displayName:e.displayName,tier:"tier_1",status:"automatic",serverName:$t,configPath:e.configPath,restartRequired:!0,verification:"bridge_config_written",transport:"stdio_bridge",bridgePath:e.bridgePath,nodePath:e.nodePath,configKind:e.configKind,reason:"MCP support and a safe local config shape are known.",instructions:[`Skills Layer will install the local MCP bridge at ${e.bridgePath}.`,`Skills Layer will update ${e.configPath} to launch the bridge with ${e.nodePath}.`,"The raw MCP token stays in Skills Layer local storage and is not written to the agent config.","Open a fresh agent session or restart the agent to load the MCP server."],apply:async()=>{let t=await gw({bridgePath:e.bridgePath,brokerPath:e.brokerPath,brokerSocketPath:e.brokerSocketPath,mcpConfigPath:e.mcpConfigPath,nodePath:e.nodePath});return await hw({configPath:e.configPath,configKind:e.configKind,bridgePath:e.bridgePath,nodePath:e.nodePath,agentId:e.agentId}),t},disconnect:async()=>{await yw({configPath:e.configPath,configKind:e.configKind})}}}function Gu(e){return{agentId:e.agentId,displayName:e.displayName,tier:e.tier,status:e.status,serverName:$t,configPath:null,restartRequired:!0,verification:e.verification,transport:"manual",bridgePath:null,nodePath:null,configKind:null,reason:e.reason,instructions:e.instructions}}async function gw(e){let t=Hu({mcpConfigPath:e.mcpConfigPath}),n=Ju({mcpConfigPath:e.mcpConfigPath,socketPath:e.brokerSocketPath});return await br(Hn(e.bridgePath),{recursive:!0}),await nn(e.bridgePath,t,"utf8"),await nn(e.brokerPath,n,"utf8"),await Ba(Hn(e.bridgePath),448),await Ba(e.bridgePath,448),await Ba(e.brokerPath,448),mw({nodePath:e.nodePath,brokerPath:e.brokerPath}),{bridgePath:e.bridgePath,brokerPath:e.brokerPath,brokerSocketPath:e.brokerSocketPath,mcpConfigPath:e.mcpConfigPath,checksum:rn(t),brokerChecksum:rn(n),nodePath:e.nodePath}}function mw(e){if(!(process.env.VITEST==="true"||process.env.SKILLS_LAYER_MCP_BROKER_AUTOSTART==="disabled"))try{zu(e.nodePath,[e.brokerPath],{detached:!0,stdio:"ignore"}).unref()}catch{}}async function hw(e){if(e.configKind==="codex_toml"){await vw(e);return}await ww(e)}async function yw(e){if(e.configKind==="codex_toml"){let i=await Jn(e.configPath);if(i===null)return;await nn(e.configPath,Yu(i),"utf8");return}let t=await Sr(e.configPath,{allowMissing:!0});if(!t||!$e(t.mcpServers))return;let n={...t.mcpServers};delete n[$t],await br(Hn(e.configPath),{recursive:!0}),await nn(e.configPath,`${JSON.stringify({...t,mcpServers:n},null,2)}
+`,"utf8")}async function kw(e,t){if(!e.configPath||!e.configKind||!e.bridgePath||!e.nodePath)return{configured:!1,rawTokenLeaked:!1};if(e.configKind==="codex_toml"){let s=await Jn(e.configPath);return s===null?{configured:!1,rawTokenLeaked:!1}:{configured:s.includes("[mcp_servers.skills-layer]")&&s.includes(`command = ${JSON.stringify(e.nodePath)}`)&&(s.includes(`args = [${JSON.stringify(e.bridgePath)}, "--client", ${JSON.stringify(e.agentId)}]`)||s.includes(`args = [${JSON.stringify(e.bridgePath)}]`)),rawTokenLeaked:!!(t&&s.includes(t))}}let n=await Sr(e.configPath,{allowMissing:!0}),i=$e(n?.mcpServers)?n.mcpServers[$t]:void 0;return{configured:$e(i)&&i.command===e.nodePath&&Array.isArray(i.args)&&i.args[0]===e.bridgePath&&(i.args.length===1||i.args[1]==="--client"&&i.args[2]===e.agentId),rawTokenLeaked:!!(t&&JSON.stringify(n??{}).includes(t))}}async function ww(e){let t=await Sr(e.configPath,{allowMissing:!0})??{},n=$e(t.mcpServers)?{...t.mcpServers}:{};n[$t]={command:e.nodePath,args:[e.bridgePath,"--client",e.agentId]},await br(Hn(e.configPath),{recursive:!0}),await nn(e.configPath,`${JSON.stringify({...t,mcpServers:n},null,2)}
+`,"utf8")}async function vw(e){let t=await Jn(e.configPath)??"",n=["[mcp_servers.skills-layer]",`command = ${JSON.stringify(e.nodePath)}`,`args = [${JSON.stringify(e.bridgePath)}, "--client", ${JSON.stringify(e.agentId)}]`,""].join(`
+`),i=`${Yu(t).trimEnd()}${t.trim().length>0?`
+
+`:""}${n}`;await br(Hn(e.configPath),{recursive:!0}),await nn(e.configPath,i,"utf8")}function Yu(e){let t=e.split(/\r?\n/u),n=[],i=!1;for(let r of t){if(r.trim()==="[mcp_servers.skills-layer]"){i=!0;continue}i&&/^\s*\[.+\]\s*$/u.test(r)&&(i=!1),i||n.push(r)}return n.join(`
+`).trimEnd()}function zn(e){return{tier:"tier_1",configKind:"json_mcp_servers",resolveConfigPath(t,n,i){return Kn(i,n,...e.split("/"))}}}async function Sr(e,t){try{let n=JSON.parse(await Ku(e,"utf8"));return $e(n)?n:{}}catch(n){if(t.allowMissing&&n.code==="ENOENT")return null;throw n}}async function Jn(e){try{return await Ku(e,"utf8")}catch(t){if(t.code==="ENOENT")return null;throw t}}async function Ba(e,t){try{await rw(e,t)}catch{}}async function Da(e){await Fa(e,{force:!0})}async function qa(e,t){await Promise.all([Fa(e,{force:!0}),Fa(t,{force:!0})])}function bw(e){return e?new Promise(t=>{let n="";e.on("data",i=>{n+=String(i);let r=n.indexOf(`
+`);r>=0&&t({ok:!0,line:n.slice(0,r)})}),e.on("error",i=>{t({ok:!1,message:i instanceof Error?i.message:"MCP bridge stdout failed."})}),e.on("end",()=>{t({ok:!1,message:"MCP bridge exited before returning a response."})})}):Promise.resolve({ok:!1,message:"MCP bridge stdout was not available."})}function Sw(e,t){let n=Ma(t),i=e??process.env,r=t==="win32"?vr(i.APPDATA,i.USERPROFILE,i.HOME):vr(i.XDG_CONFIG_HOME,i.HOME?n.join(i.HOME,".skills-layer"):void 0);return r?t==="win32"||i.XDG_CONFIG_HOME?.trim()?n.join(r,"skills-layer"):r:n.join(process.cwd(),".skills-layer")}function _w(e,t){return t==="win32"?vr(e.USERPROFILE,e.HOME):vr(e.HOME)}function Pw(e){return Te.includes(e)?e:"codex"}function Aw(e,t){let n=e.tokens;return $e(n)&&$e(n[t])?n[t]:e}function Rw(e){if(!e)return[];let t=e.clientIds;if(Array.isArray(t))return t.filter(r=>typeof r=="string"&&r.trim().length>0);let n=e.tokens;if($e(n))return Object.keys(n);let i=Me(e,"clientId");return i?[i]:[]}function Kn(e,...t){return Ma(e).join(...t)}function Ma(e){return e==="win32"?aw:sw}function vr(...e){return e.find(t=>typeof t=="string"&&t.trim().length>0)?.trim()}function Me(e,t){let n=e?.[t];return typeof n=="string"&&n.trim().length>0?n:null}function rn(e){return iw("sha256").update(e).digest("hex")}function $e(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}import{createHash as Cw,randomBytes as Ew}from"node:crypto";import{constants as ke}from"node:fs";import{chmod as Zu,lstat as nd,open as Zn,realpath as xw,rename as Xu,unlink as Yn}from"node:fs/promises";import{basename as _r,dirname as Iw,isAbsolute as id,join as Pr}from"node:path";var Tw=1024*1024,$w=32,Lw=2e4,rd=4096,Ow=/^sha256:[a-f0-9]{64}$/u,Nw=new Set(["__proto__","constructor","prototype"]);function jw(e){let t=Fw(e.agentId);qw(e.absoluteScriptPath);let n=Qu(e.existingJson),i=Uw(n),r=Bw(t,e.absoluteScriptPath),s=td(r),a=Object.freeze({owner:"skills-layer",agentId:t,eventName:"PreToolUse",entrySha256:s}),o;if(e.operation==="install"){if(e.previousOwnership!==void 0)throw new Error("Install must not supply previous Skills Layer ownership evidence.");o=[...i,r]}else{let c=Dw(e.previousOwnership,t),d=i.flatMap((f,g)=>td(f)===c.entrySha256?[g]:[]);if(d.length===0)throw new Error("Previous Skills Layer hook ownership could not be proven; refusing to modify host config.");let p=d[0];o=[];for(let[f,g]of i.entries())f===p&&o.push(r),d.includes(f)||o.push(g)}Vw(n,o);let l=Xn(Qu(e.existingJson))!==Xn(n);return{json:l?`${JSON.stringify(n,null,2)}
+`:e.existingJson,changed:l,ownership:a}}async function sd(e){if(!id(e.configPath)||e.configPath.length>rd||e.configPath.includes("\0"))throw new Error("Host hook config path must be an absolute bounded path.");let t=Iw(e.configPath),n=await nd(t);if(n.isSymbolicLink()||!n.isDirectory())throw new Error("Host hook config parent must be a real directory, not a symbolic link.");let i=await xw(t),r=Pr(i,_r(e.configPath)),s=Ew(12).toString("hex"),a=Pr(i,`.${_r(r)}.skills-layer.lock`),o=Pr(i,`.${_r(r)}.skills-layer-stage-${s}`),l=Pr(i,`.${_r(r)}.skills-layer-backup-${s}`),c=null,d=!1,p=null,f=null,g=384,h=!1,m=!1;try{c=await Zn(a,ke.O_CREAT|ke.O_EXCL|ke.O_WRONLY,384),d=!0,await c.writeFile(`${process.pid}
+`,"utf8"),await c.sync();let y=await Va(r);f=y?.bytes??null,g=y?.mode??384;let w=f===null?"{}":Buffer.from(f).toString("utf8"),v=jw({...e.update,existingJson:w});if(!v.changed)return{...v,configPath:r,configSha256:za(f)};let S=new TextEncoder().encode(v.json);if(p=await Zn(o,ke.O_CREAT|ke.O_EXCL|ke.O_WRONLY|ke.O_NOFOLLOW,384),await p.writeFile(S),await p.sync(),await p.close(),p=null,f!==null){let $=await Zn(l,ke.O_CREAT|ke.O_EXCL|ke.O_WRONLY|ke.O_NOFOLLOW,384);try{await $.writeFile(f),await $.sync()}finally{await $.close()}h=!0}await Ar(i),await e.checkpoint?.("after_backup");let A=await Va(r);if(!Gw(f,A?.bytes??null))throw new Error("Host hook config changed concurrently; refusing to overwrite it.");await Xu(o,r),m=!0,await Zu(r,384),await Ar(i),await e.checkpoint?.("after_replace");let x=await ed(r);if(!Ga(x.bytes,S))throw new Error("Atomic host hook config verification failed after replacement.");return h&&(await Yn(l),h=!1),await Ar(i),{...v,configPath:r,configSha256:za(x.bytes)}}catch(y){if(m)try{if(f===null)await Yn(r).catch(w=>{if(w.code!=="ENOENT")throw w});else{if(!h)throw new Error("Host hook rollback backup is unavailable.");await Zu(l,g&511),await Xu(l,r),h=!1;let w=await ed(r);if(!Ga(w.bytes,f))throw new Error("Host hook rollback verification failed.")}await Ar(i)}catch(w){throw new AggregateError([y,w],"Host hook config update and exact rollback both failed.")}throw y}finally{p&&await p.close().catch(()=>{}),c&&await c.close(),await Yn(o).catch(Ua),h&&await Yn(l).catch(Ua),d&&await Yn(a).catch(Ua)}}function Bw(e,t){return{matcher:e==="codex"?".*":"",hooks:[{type:"command",command:t,timeout:10}]}}function Fw(e){if(e==="cline")throw new Error("Cline uses file-based hook discovery; JSON hook configuration is not supported.");return e}function Dw(e,t){if(!e||e.owner!=="skills-layer"||e.agentId!==t||e.eventName!=="PreToolUse"||!Ow.test(e.entrySha256))throw new Error("Valid prior Skills Layer hook ownership evidence is required.");return e}function qw(e){if(!id(e)||e.length===0||e.length>rd||e.includes("\0"))throw new Error("Guardian hook script path must be absolute and bounded.")}function Qu(e){if(typeof e!="string"||Buffer.byteLength(e,"utf8")>Tw)throw new Error("Host hook config exceeds the 1 MiB maximum.");let t;try{t=JSON.parse(e)}catch{throw new Error("Host hook config must be valid JSON.")}if(Mw(t),!Rr(t))throw new Error("Host hook config root must be a JSON object.");return t}function Mw(e){let t=0,n=(i,r)=>{if(t+=1,t>Lw)throw new Error("Host hook config contains too many JSON values.");if(r>$w)throw new Error("Host hook config exceeds the maximum JSON depth.");if(!(i===null||typeof i=="string"||typeof i=="boolean")){if(typeof i=="number"){if(!Number.isFinite(i))throw new Error("Host hook config contains a non-finite number.");return}if(Array.isArray(i)){for(let s of i)n(s,r+1);return}if(!Rr(i))throw new Error("Host hook config contains a non-JSON value.");for(let[s,a]of Object.entries(i)){if(Nw.has(s))throw new Error(`Host hook config contains unsafe key ${s}.`);n(a,r+1)}}};n(e,0)}function Uw(e){if(e.hooks===void 0&&(e.hooks={}),!Rr(e.hooks))throw new Error("Host hook config hooks field must be an object.");if(e.hooks.PreToolUse===void 0&&(e.hooks.PreToolUse=[]),!Array.isArray(e.hooks.PreToolUse))throw new Error("Host hook config hooks.PreToolUse must be an array.");return e.hooks.PreToolUse}function Vw(e,t){let n=e.hooks;if(!Rr(n))throw new Error("Host hook config hooks field must be an object.");n.PreToolUse=t}function Rr(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}async function Va(e){let t;try{t=await nd(e)}catch(i){if(i.code==="ENOENT")return null;throw i}if(t.isSymbolicLink())throw new Error(`Host hook config target is a symbolic link: ${e}`);if(!t.isFile())throw new Error(`Host hook config target must be a regular file: ${e}`);let n=await Zn(e,ke.O_RDONLY|ke.O_NOFOLLOW);try{let i=await n.stat();if(!i.isFile())throw new Error(`Host hook config target must be a regular file: ${e}`);return{bytes:new Uint8Array(await n.readFile()),mode:i.mode}}finally{await n.close()}}async function ed(e){let t=await Va(e);if(!t)throw new Error(`Host hook config disappeared: ${e}`);return t}async function Ar(e){let t=await Zn(e,ke.O_RDONLY);try{await t.sync()}finally{await t.close()}}function Gw(e,t){return e===null||t===null?e===t:Ga(e,t)}function Ga(e,t){return e.byteLength===t.byteLength&&Buffer.from(e).equals(Buffer.from(t))}function Ua(e){if(e.code!=="ENOENT")throw e}function td(e){return za(Xn(e))}function Xn(e){if(e===null||typeof e!="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(Xn).join(",")}]`;let t=e;return`{${Object.keys(t).sort().map(n=>`${JSON.stringify(n)}:${Xn(t[n])}`).join(",")}}`}function za(e){return`sha256:${Cw("sha256").update(e).digest("hex")}`}import{createHash as zw,randomBytes as Kw}from"node:crypto";import{constants as we}from"node:fs";import{chmod as ad,lstat as cd,open as ei,realpath as Hw,rename as od,unlink as Qn}from"node:fs/promises";import{basename as Cr,dirname as Jw,isAbsolute as Ww,join as Er}from"node:path";var ud=1024*1024,Yw=4096,Zw=/^sha256:[a-f0-9]{64}$/u;async function Ha(e){Qw(e.filePath);let t=ev(e.content),n=dd(t),i=Object.freeze({owner:"skills-layer",fileSha256:n}),r=Jw(e.filePath),s=await cd(r);if(s.isSymbolicLink()||!s.isDirectory())throw new Error("Owned hook parent must be a real directory, not a symbolic link.");let a=await Hw(r),o=Er(a,Cr(e.filePath)),l=Kw(12).toString("hex"),c=Er(a,`.${Cr(o)}.skills-layer.lock`),d=Er(a,`.${Cr(o)}.skills-layer-stage-${l}`),p=Er(a,`.${Cr(o)}.skills-layer-backup-${l}`),f=null,g=null,h=null,m=!1,y=!1;try{if(f=await ei(c,we.O_CREAT|we.O_EXCL|we.O_WRONLY,384),await f.writeFile(`${process.pid}
+`,"utf8"),await f.sync(),h=await Ka(o),Xw(e,h),h!==null&&Tr(h,t))return{filePath:o,fileSha256:n,changed:!1,ownership:i};if(g=await ei(d,we.O_CREAT|we.O_EXCL|we.O_WRONLY|we.O_NOFOLLOW,448),await g.writeFile(t),await g.sync(),await g.close(),g=null,h!==null){let S=await ei(p,we.O_CREAT|we.O_EXCL|we.O_WRONLY|we.O_NOFOLLOW,448);try{await S.writeFile(h),await S.sync()}finally{await S.close()}m=!0}await xr(a),await e.checkpoint?.("after_backup");let w=await Ka(o);if(!tv(h,w))throw new Error("Owned hook changed concurrently; refusing to overwrite it.");await od(d,o),y=!0,await ad(o,448),await xr(a),await e.checkpoint?.("after_replace");let v=await ld(o);if(!Tr(v,t))throw new Error("Atomic owned hook verification failed after replacement.");return m&&(await Qn(p),m=!1),await xr(a),{filePath:o,fileSha256:n,changed:!0,ownership:i}}catch(w){if(y)try{if(h===null)await Qn(o).catch(Ir);else{if(!m)throw new Error("Owned hook rollback backup is unavailable.");await od(p,o),m=!1,await ad(o,448);let v=await ld(o);if(!Tr(v,h))throw new Error("Owned hook rollback verification failed.")}await xr(a)}catch(v){throw new AggregateError([w,v],"Owned hook update and exact rollback both failed.")}throw w}finally{g&&await g.close().catch(()=>{}),f&&await f.close(),await Qn(d).catch(Ir),m&&await Qn(p).catch(Ir),await Qn(c).catch(Ir)}}function Xw(e,t){if(e.operation==="install"){if(e.previousOwnership!==void 0)throw new Error("Owned hook install must not supply previous ownership evidence.");if(t!==null)throw new Error("Owned hook target already exists; refusing to overwrite a foreign file.");return}let n=e.previousOwnership;if(!n||n.owner!=="skills-layer"||!Zw.test(n.fileSha256))throw new Error("Valid prior Skills Layer hook ownership evidence is required for update.");if(t===null)throw new Error("Previously owned hook is missing; refusing an unproven update.");if(dd(t)!==n.fileSha256)throw new Error("Owned hook changed outside Skills Layer; ownership digest does not match.")}function Qw(e){if(!Ww(e)||e.includes("\0")||Buffer.byteLength(e,"utf8")>Yw)throw new Error("Owned hook path must be an absolute bounded path.")}function ev(e){let t=typeof e=="string"?new TextEncoder().encode(e):new Uint8Array(e);if(t.byteLength===0)throw new Error("Owned hook content must not be empty.");if(t.byteLength>ud)throw new Error("Owned hook content exceeds the 1 MiB maximum.");return t}async function Ka(e){let t;try{t=await cd(e)}catch(i){if(i.code==="ENOENT")return null;throw i}if(t.isSymbolicLink())throw new Error(`Owned hook target is a symbolic link: ${e}`);if(!t.isFile())throw new Error(`Owned hook target must be a regular file: ${e}`);let n=await ei(e,we.O_RDONLY|we.O_NOFOLLOW);try{let i=await n.stat();if(!i.isFile())throw new Error(`Owned hook target must be a regular file: ${e}`);if(i.size>ud)throw new Error("Owned hook target exceeds the 1 MiB maximum.");return new Uint8Array(await n.readFile())}finally{await n.close()}}async function ld(e){let t=await Ka(e);if(t===null)throw new Error(`Owned hook disappeared: ${e}`);return t}async function xr(e){let t=await ei(e,we.O_RDONLY);try{await t.sync()}finally{await t.close()}}function tv(e,t){return e===null||t===null?e===t:Tr(e,t)}function Tr(e,t){return e.byteLength===t.byteLength&&Buffer.from(e).equals(Buffer.from(t))}function dd(e){return`sha256:${zw("sha256").update(e).digest("hex")}`}function Ir(e){if(e.code!=="ENOENT")throw e}import{createHash as IA,timingSafeEqual as TA}from"node:crypto";import{createHash as nv}from"node:crypto";var Le={maxFiles:100,maxDepth:12,maxPathBytes:240,maxFileBytes:512*1024,maxTotalBytes:2*1024*1024},iv=new Set([".skills-layer-install.json",".skills-layer-manifest.json",".skills-layer-quarantine","skills-lock.json"]),rv=new Set([".git",".hg",".next",".svn",".turbo","build","coverage","dist","node_modules"]),sv=/^(?:aux|com[1-9]|con|lpt[1-9]|nul|prn)(?:\.|$)/iu,fd=/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/iu,av=/(?:^|\D)\+?[1-9]\d(?:[\s().-]*\d){8,14}(?:\D|$)/u,ov=[{code:"secret_aws",pattern:/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/u},{code:"secret_github",pattern:/\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/u},{code:"secret_groq",pattern:/\bgsk_[A-Za-z0-9_-]{20,}\b/u},{code:"secret_private_key",pattern:/-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/u},{code:"secret_jwt",pattern:/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/u},{code:"secret_assignment",pattern:/\b(?:api[_-]?key|client[_-]?secret|password|private[_-]?token|secret|token)\s*[:=]\s*["']?[A-Za-z0-9_./+=-]{20,}/iu}];function $r(e){let t=lv(e.limits),n=[],i=[],r=e.skillsIgnore??e.files.find(f=>f.path===".skillsignore")?.content??"",s=hd(r),a=[],o=new Map;for(let f of e.files){if(typeof f?.path!="string"||typeof f.content!="string"){n.push({severity:"error",code:"file_invalid",message:"Bundle entries must contain a string path and string content."});continue}let g=f.path,h=gd(g);if(!h.ok){n.push({severity:"error",code:h.code,path:g,message:h.message});continue}let m=h.path,y=md(m);if(y){i.push({path:m,reason:y});continue}if(s(m)){i.push({path:m,reason:"skillsignore"});continue}let w=m.normalize("NFC").toLocaleLowerCase("en-US"),v=o.get(w);if(v){n.push({severity:"error",code:"path_collision",path:g,message:`Bundle path collides with ${v} after portable normalization.`});continue}o.set(w,m),a.push({path:m,content:f.content,originalPath:g})}a.length>t.maxFiles&&n.push({severity:"error",code:"file_count_exceeded",message:`Bundle contains ${a.length} files; the limit is ${t.maxFiles}.`});let l=0;for(let f of a){let g=Buffer.byteLength(f.path,"utf8"),h=f.path.split("/").length,m=Buffer.byteLength(f.content,"utf8");l+=m,h>t.maxDepth&&n.push({severity:"error",code:"path_depth_exceeded",path:f.originalPath,message:"Bundle path exceeds the depth limit."}),g>t.maxPathBytes&&n.push({severity:"error",code:"path_too_long",path:f.originalPath,message:"Bundle path exceeds the byte limit."}),m>t.maxFileBytes&&n.push({severity:"error",code:"file_too_large",path:f.originalPath,message:"Bundle file exceeds the byte limit."}),f.content.includes("\0")&&n.push({severity:"error",code:"binary_content",path:f.originalPath,message:"Bundle file is not bounded UTF-8 text."}),e.runDlp!==!1&&cv(f.originalPath,f.content,n),fd.test(f.path)&&n.push({severity:"error",code:"pii_path",path:f.originalPath,message:"Bundle path contains personal data."})}l>t.maxTotalBytes&&n.push({severity:"error",code:"total_bytes_exceeded",message:"Bundle exceeds the total byte limit."});let c=a.map(({path:f,content:g})=>({path:f,content:g})).sort((f,g)=>f.path.localeCompare(g.path)),d=c.map(f=>({path:f.path,bytes:Buffer.byteLength(f.content,"utf8"),sha256:pd(f.content)})),p={fileCount:c.length,totalBytes:l,files:d,bundleSha256:pd(c.map(f=>`${f.path}\0${f.content}`).join("\0"))};return{ok:n.length===0,files:c,excluded:i.sort((f,g)=>f.path.localeCompare(g.path)),issues:n,preview:p}}function Lt(e){let t=$r(e);if(!t.ok)throw new Error(`Canonical bundle rejected: ${Array.from(new Set(t.issues.map(n=>n.code))).join(", ")}`);return t}function Ja(e=""){let t=hd(e);return n=>{let i=gd(n);return i.ok?md(i.path)??(t(i.path)?"skillsignore":null):null}}function lv(e){let t={...Le,...e};for(let[n,i]of Object.entries(t))if(!Number.isInteger(i)||i<=0)throw new Error(`Canonical bundle ${n} must be a positive integer.`);return t}function gd(e){if(!e||e.includes("\0")||e.includes("\\")||e.startsWith("/")||/^[A-Za-z]:/u.test(e))return{ok:!1,code:"path_invalid",message:"Bundle path is not portable."};let t=e.normalize("NFC"),n=t.split("/");if(n.some(i=>!i||i==="."||i===".."))return{ok:!1,code:"path_traversal",message:"Bundle path contains an empty or traversal segment."};for(let i of n)if(/[<>:"|?*\u0000-\u001f]/u.test(i)||/[. ]$/u.test(i)||sv.test(i))return{ok:!1,code:"path_invalid",message:"Bundle path contains a reserved platform segment."};return iv.has(t.toLocaleLowerCase("en-US"))?{ok:!1,code:"reserved_path",message:"Bundle path is reserved for Skills Layer state."}:{ok:!0,path:t}}function md(e){if(e===".skillsignore")return"control_file";let t=e.split("/");if(t.some(i=>rv.has(i.toLocaleLowerCase("en-US"))))return"default_exclusion";let n=t.at(-1).toLocaleLowerCase("en-US");return/^\.env(?:\.|$)/u.test(n)||/^(?:credentials?|id_rsa|id_ed25519)(?:\.|$)/u.test(n)||/\.(?:key|p12|pfx|pem)$/u.test(n)||n===".ds_store"||n==="thumbs.db"?"default_exclusion":null}function hd(e){if(Buffer.byteLength(e,"utf8")>32*1024)throw new Error(".skillsignore exceeds 32 KiB.");let t=e.split(/\r?\n/gu).map(i=>i.trim()).filter(i=>i&&!i.startsWith("#"));if(t.length>256)throw new Error(".skillsignore contains too many patterns.");let n=t.map(i=>{if(i.startsWith("!"))throw new Error(".skillsignore negation is not supported by the secure intake policy.");if(i.length>240||i.includes("\0")||i.includes("\\")||i.includes(".."))throw new Error(".skillsignore contains an unsafe pattern.");let r=i.startsWith("/"),s=i.replace(/^\/+|\/+$/gu,""),a=s.replace(/[.+^${}()|[\]\\]/gu,"\\$&").replace(/\*\*/gu,"\0").replace(/\*/gu,"[^/]*").replace(/\?/gu,"[^/]").replace(/\u0000/gu,".*");return new RegExp(`${r||s.includes("/")?"^":"(?:^|/)"}${a}(?:/.*)?$`,"u")});return i=>n.some(r=>r.test(i.normalize("NFC")))}function cv(e,t,n){for(let i of ov)i.pattern.test(t)&&n.push({severity:"error",code:i.code,path:e,message:"Bundle content matched a protected-data rule."});fd.test(t)&&n.push({severity:"error",code:"pii_email",path:e,message:"Bundle content contains an email address."}),av.test(t)&&n.push({severity:"error",code:"pii_phone",path:e,message:"Bundle content contains a phone number."})}function pd(e){return`sha256:${nv("sha256").update(e).digest("hex")}`}var uv="SKILL_ARTIFACTS",dv="intake",pv="approved",fv="quarantine",gv="published",mv=/^sha256:([a-f0-9]{64})$/u;function ti(e){return e.replace(/^\/+|\/+$/g,"")}function yd(e,t){let n=ti(t.trim());if(!n||n.includes("..")||n.includes("\\")||n.split("/").some(i=>!i))throw new Error(`${e} must be a safe storage prefix`);return n}function an(e,t){let n=t.trim();if(!n)throw new Error(`${e} must not be empty`);if(n.includes("..")||n.includes("\\")||n.startsWith("/"))throw new Error(`${e} must be a safe storage segment`);return ti(n)}function Wa(e,t){let n=an(e,t);if(n.includes("/"))throw new Error(`${e} must be a safe storage segment`);return n}function hv(e){let t=mv.exec(e);if(!t)throw new Error("archiveSha256 must be a SHA-256 digest");return t[1]}function kd(e){let t=e.trim();if(!t)throw new Error("relativePath must not be empty");if(t.includes("..")||t.startsWith("/")||t.includes("\\"))throw new Error("relativePath must be a safe storage path");return ti(t)}var on=class{bucketBinding;intakePrefix;approvedPrefix;quarantinePrefix;publishedPrefix;constructor(t={}){this.bucketBinding=t.bucketBinding??uv,this.intakePrefix=yd("intakePrefix",t.intakePrefix??dv),this.approvedPrefix=yd("approvedPrefix",t.approvedPrefix??pv),this.quarantinePrefix=ti(t.quarantinePrefix??fv),this.publishedPrefix=ti(t.publishedPrefix??gv)}getIntakeArtifactKeys(t,n){return this.buildArtifactKeys(this.intakePrefix,t,n)}getApprovedArtifactKeys(t,n){return this.buildArtifactKeys(this.approvedPrefix,t,n)}getIntakeReviewKeys(t,n){let i=this.buildArtifactBasePath(this.intakePrefix,t,n);return Object.freeze({reviewStorageKey:`${i}/review/package.zip`,reviewManifestKey:`${i}/review/manifest.v1.bin`,reviewEnvelopeKey:`${i}/review/envelope.v1.json`,packageBindingKey:`${i}/package-binding.v1.json`})}getApprovedBindingKeys(t,n){let i=this.buildArtifactBasePath(this.approvedPrefix,t,n);return Object.freeze({packageBindingKey:`${i}/package-binding.v1.json`})}resolveApprovedArtifactKeys(t){let n=`${this.approvedPrefix}/v1/`;if(!t.startsWith(n)||!t.endsWith("/bundle.zip"))return null;let i=t.slice(n.length).split("/");if(i.length!==5||i[4]!=="bundle.zip"||!/^[a-f0-9]{64}$/u.test(i[3]))return null;try{return this.getApprovedArtifactKeys({skillSlug:i[0],semanticVersion:i[1],generationId:i[2]},`sha256:${i[3]}`)}catch{return null}}getQuarantineKey(t){return`${this.quarantinePrefix}/${an("uploadId",t)}.zip`}getQuarantineManifestKey(t){return`${this.quarantinePrefix}/${an("uploadId",t)}.manifest.json`}getQuarantinePreviewKey(t,n){return`${this.quarantinePrefix}/${an("uploadId",t)}/preview/${kd(n)}`}getPublishedBundleKey(t,n){return`${this.getPublishedBasePath(t,n)}/bundle.zip`}getPublishedManifestKey(t,n){return`${this.getPublishedBasePath(t,n)}/manifest.json`}getPublishedPreviewKey(t,n,i){return`${this.getPublishedBasePath(t,n)}/preview/${kd(i)}`}getPublishedBasePath(t,n){return`${this.publishedPrefix}/${an("skillId",t)}/${an("version",n)}`}buildArtifactKeys(t,n,i){let r=this.buildArtifactBasePath(t,n,i);return Object.freeze({storageKey:`${r}/bundle.zip`,manifestKey:`${r}/manifest.v1.bin`,envelopeKey:`${r}/envelope.v1.json`})}buildArtifactBasePath(t,n,i){return`${t}/v1/${Wa("skillSlug",n.skillSlug)}/${Wa("semanticVersion",n.semanticVersion)}/${Wa("generationId",n.generationId)}/${hv(i)}`}};var GL=new on;var KL=4*1024*1024,HL=new TextEncoder,JL=new TextDecoder("utf-8",{fatal:!0});var $i=Ou($l(),1);var HP=[...Te],JP=["basic_skills","allowed_tools","hooks","forked_context","local_install"];function cg(e){if(e===void 0)return;if(!lg(e))throw new Error("metadata.agent_compatibility must be an object when provided");let t={};for(let[n,i]of Object.entries(e)){if(!HP.includes(n))throw new Error(`metadata.agent_compatibility contains an unsupported agent id: ${n}`);if(!lg(i))throw new Error(`metadata.agent_compatibility.${n} must be an object`);let r=XP(i,n),s=WP(i.capabilities,`${n}.capabilities`),a=YP(i.notes,`${n}.notes`);t[n]={supported:r,capabilities:s,...a?{notes:a}:{}}}return t}function WP(e,t){if(e===void 0)return[];if(!Array.isArray(e)||e.some(i=>typeof i!="string"))throw new Error(`metadata.agent_compatibility.${t} must be a string array when provided`);let n=e.map(i=>i.trim()).filter(i=>i.length>0);for(let i of n)if(!JP.includes(i))throw new Error(`metadata.agent_compatibility.${t} contains an unsupported capability: ${i}`);return[...new Set(n)]}function YP(e,t){if(e!==void 0){if(typeof e!="string"||e.trim().length===0)throw new Error(`metadata.agent_compatibility.${t} must be a non-empty string when provided`);return e.trim()}}function ZP(e,t){if(typeof e!="boolean")throw new Error(`metadata.agent_compatibility.${t} must be a boolean when provided`);return e}function XP(e,t){return Object.hasOwn(e,"supported")?ZP(e.supported,`${t}.supported`):!0}function lg(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var ug=["claude","anthropic"];function dg(e){let t=QP(e);return t?ug.find(n=>t.includes(n))??null:null}function pg(){return`name must not use reserved ${ug.join(" or ")} terms`}function QP(e){let t=e.normalize("NFKD").replace(/[\u0300-\u036f]/gu,"").toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"").replace(/-{2,}/gu,"-");return t.length>0?t:null}var gg=/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/,eA=/^[a-z0-9]+(?:-[a-z0-9]+)*$/;function $s(e){let t=e.match(gg);if(!t)throw new Error("SKILL.md must start with YAML frontmatter delimited by ---");let[,n,i]=t,r=(0,$i.parse)(n);if(!Ts(r))throw new Error("Frontmatter must parse to an object");return{frontmatter:tA(r),body:i,rawFrontmatter:n}}function mg(e,t,n){let i=e.match(gg);if(!i)throw new Error("SKILL.md must start with YAML frontmatter delimited by ---");let[,r,s]=i,a=(0,$i.parse)(r);if(!Ts(a))throw new Error("Frontmatter must parse to an object");let o={...a};return delete o.license,o.metadata={...Ts(a.metadata)?a.metadata:{},license:t,license_file:n},`---
+${(0,$i.stringify)(o,{lineWidth:0}).trimEnd()}
 ---
-# ${un(e.skillSlug)}
+${s}`}function Ts(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function tA(e){let t=fg(e.name,"name"),n=fg(e.description,"description"),i=e.license,r=nA(e.compatibility,"compatibility"),s=iA(e.metadata,"metadata"),a=cg(s?.agent_compatibility),o=rA(e["allowed-tools"]);if(!eA.test(t))throw new Error("name must be kebab-case");if(dg(t))throw new Error(pg());if(n.length>1024)throw new Error("description must be 1024 characters or fewer");return{name:t,description:n,...i===void 0?{}:{license:i},...r===void 0?{}:{compatibility:r},...a===void 0?{}:{compatibilityMatrix:a},...s===void 0?{}:{metadata:s},...o===void 0?{}:{"allowed-tools":o}}}function fg(e,t){if(typeof e!="string"||e.trim().length===0)throw new Error(`${t} must be a non-empty string`);return e.trim()}function nA(e,t){if(e===void 0)return;if(typeof e!="string"||e.trim().length===0)throw new Error(`${t} must be a non-empty string when provided`);let n=e.trim();if(t==="compatibility"&&n.length>500)throw new Error("compatibility must be 500 characters or fewer");return n}function iA(e,t){if(e!==void 0){if(!Ts(e))throw new Error(`${t} must be an object when provided`);return e}}function rA(e){if(e!==void 0){if(typeof e=="string")return e.trim();if(Array.isArray(e)&&e.every(t=>typeof t=="string"))return e.map(t=>t.trim());throw new Error("allowed-tools must be a string or string array when provided")}}import{createHash as sA}from"node:crypto";var yg=["LICENSE","LICENCE","LICENSE.md","LICENCE.md","LICENSE.txt","COPYING","COPYING.txt"],aA=`MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+`,Ll={MIT:aA},kg=/^LicenseRef-[A-Za-z0-9](?:[A-Za-z0-9.-]{0,126}[A-Za-z0-9])?$/u,oA=/^[A-Za-z0-9][A-Za-z0-9.+-]*(?:\s+(?:AND|OR|WITH)\s+[A-Za-z0-9][A-Za-z0-9.+-]*)*$/u,lA=/^LICENSES\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;function bn(e){return Ll[e]}function Li(e){return Object.hasOwn(Ll,e)}function Sn(e){let t=e.trim();if(t.length===0||t.length>200)throw new Error("license identifier must be between 1 and 200 characters");if(!kg.test(t)&&!oA.test(t))throw new Error("license identifier must be an SPDX identifier/expression or a namespaced LicenseRef-* identifier");return t}function Oi(e){let t=e.trim().replaceAll("\\","/");if(!yg.includes(t)&&!lA.test(t))throw new Error("license file must be a recognised root licence file or a single bounded LICENSES/* path");return t}function Ls(e,t){let n=t.metadata?.license,i=t.license;if(n!==void 0&&(typeof n!="string"||n.trim().length===0))return Ne("license_invalid","metadata.license must be a non-empty SPDX or LicenseRef-* string when supplied.");if(i!==void 0&&(typeof i!="string"||i.trim().length===0))return Ne("license_invalid","The legacy top-level license declaration must be a non-empty string when supplied.");let r=typeof n=="string"?n.trim():void 0,s=typeof i=="string"?i.trim():void 0;if(r&&s&&r!==s)return Ne("license_mismatch","metadata.license conflicts with the legacy top-level license declaration; neither value was selected.");let a=r??s,o=r?"canonical":s?"legacy":null;if(a)try{Sn(a)}catch(h){let m=h instanceof Error?h.message:"The supplied licence identifier is invalid.";return Ne("license_invalid",m)}let l=t.metadata?.license_file,c;if(l!==void 0){if(typeof l!="string")return Ne("license_invalid","metadata.license_file must be a bounded bundle-relative string when supplied.");try{c=Oi(l)}catch(h){let m=h instanceof Error?h.message:"The supplied licence file path is invalid.";return Ne("license_invalid",m)}}let d=cA(e,c);if(d.status==="invalid")return Ne("license_invalid",d.message);let p=d.file;if(!a&&!p)return Ne("license_missing","Licence not supplied by creator.");if(!a&&p){let h=uA(p.content);return h?{status:"confirmation_required",identifier:null,detectedIdentifier:h,declarationSource:null,filePath:p.path,text:p.content,textSha256:hg(p.content),issues:[wg("license_confirmation_required",`A known ${h} licence file was found, but the creator must confirm the identifier before Skills Layer records it.`,"Confirm the detected identifier interactively or set metadata.license explicitly; validation-only operation will not change the bundle.")]}:Ne("license_invalid","Licence text exists without a creator-supplied identifier; Skills Layer will not guess custom or ambiguous terms.")}if(a&&!p)return Ne("license_missing","A licence identifier is declared, but the corresponding in-bundle licence text is missing.");let f=a,g=p;if(Li(f)){if(g.content!==bn(f))return Ne("license_mismatch",`The supplied ${f} declaration does not match the approved immutable template bytes.`)}else if(!kg.test(f))return Ne("license_invalid","This standard licence is not in the approved exact-template set, so Skills Layer cannot verify that its declaration and text agree.");return{status:"verified",identifier:f,detectedIdentifier:null,declarationSource:o,filePath:g.path,text:g.content,textSha256:hg(g.content),issues:[]}}function cA(e,t){let n=e.map(s=>({...s,path:s.path.replaceAll("\\","/").replace(/^\.\//u,"")}));if(t){let s=n.filter(a=>a.path===t);return s.length!==1||typeof s[0]?.content!="string"||s[0].content.length===0?{status:"invalid",message:`Declared licence file ${t} must exist exactly once with text content.`}:{status:"ok",file:{path:t,content:s[0].content}}}let i=new Set(yg),r=n.filter(s=>i.has(s.path)&&typeof s.content=="string"&&s.content.length>0);return r.length>1?{status:"invalid",message:"Multiple root licence files are present; declare metadata.license_file so Skills Layer does not guess which terms apply."}:{status:"ok",file:r[0]?{path:r[0].path,content:r[0].content}:null}}function uA(e){for(let t of Object.keys(Ll))if(e===bn(t))return t;return null}function Ne(e,t){return{status:"unspecified",identifier:null,detectedIdentifier:null,declarationSource:null,filePath:null,text:null,textSha256:null,issues:[wg(e,t,"Run interactive `skills-layer validate <path>` or `skills-layer creator init` to select a template, import exact terms, or explicitly skip.")]}}function wg(e,t,n){return{severity:"warning",code:e,message:t,nextAction:"creator.license",nextStep:n}}function hg(e){return sA("sha256").update(e,"utf8").digest("hex")}var dA=/(^|\/)SKILL\.md$/,pA=[/(^|\n)#+\s+examples?\b/i,/(^|\n)#+\s+usage examples?\b/i,/(^|\n)#+\s+\u793A\u4F8B(?=$|\s)/u,/(^|\n)#+\s+\u4F8B\u5B50(?=$|\s)/u,/(^|\n)#+\s+\u7528\u4F8B(?=$|\s)/u],fA=[/(^|\n)#+\s+troubleshooting\b/i,/(^|\n)#+\s+trouble shooting\b/i,/(^|\n)#+\s+\u6545\u969C\u6392\u9664(?=$|\s)/u,/(^|\n)#+\s+\u95EE\u9898\u6392\u67E5(?=$|\s)/u,/(^|\n)#+\s+\u6392\u9519(?=$|\s)/u],gA=/[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}]+|[\p{L}\p{N}_-]+/gu,mA=/[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}]/u;function qt(e){let t=[],n=e.filter(c=>dA.test(c.path)),i=e.some(c=>c.path.includes("/references/")||c.path.startsWith("references/"));if(n.length===0)return t.push(Ni("skill-missing","Bundle must contain exactly one SKILL.md file")),Ol(t,e.length,0,i);n.length>1&&t.push(Ni("skill-duplicate","Bundle must not contain more than one SKILL.md file"));let r=n[0];if(!r||typeof r.content!="string")return t.push(Ni("skill-content-missing","SKILL.md content must be available for validation")),Ol(t,e.length,0,i);let s;try{s=$s(r.content)}catch(c){let d=c instanceof Error?c.message:"Unknown frontmatter parsing error";return t.push(Ni("frontmatter-invalid",d)),Ol(t,e.length,0,i)}let a=hA(s.body),o=yA(s.frontmatter.metadata);o&&t.push(o);let l=Ls(e,s.frontmatter);return t.push(...l.issues),vg(s.body,pA)||t.push(Os("examples-missing","Consider adding an Examples section to improve skill usability")),vg(s.body,fA)||t.push(Os("troubleshooting-missing","Consider adding a Troubleshooting section for common failure cases")),a>5e3&&t.push(Os("skill-body-too-long","SKILL.md body should stay under 5000 words for progressive disclosure")),a>1200&&!i&&t.push(Os("references-missing","Large skills should move detailed material into references/")),{valid:t.every(c=>c.severity!=="error"),issues:t,parsedSkill:s,license:l,stats:{fileCount:e.length,bodyWordCount:a,hasReferences:i}}}function hA(e){let t=e.trim();if(t.length===0)return 0;let n=t.match(gA);return n?n.reduce((i,r)=>i+(mA.test(r)?r.length:1),0):0}function Ni(e,t){return{severity:"error",code:e,message:t}}function Os(e,t){return{severity:"warning",code:e,message:t}}function vg(e,t){return t.some(n=>n.test(e))}function yA(e){let t=e?.price_cents;return t===void 0?null:!Number.isInteger(t)||Number(t)<0?Ni("price-cents-invalid","metadata.price_cents must be a non-negative integer when provided"):null}function Ol(e,t,n,i){return{valid:!1,issues:e,stats:{fileCount:t,bodyWordCount:n,hasReferences:i}}}var kA=[{prefix:"SL-ARCH",category:"archive_ingest_safety",detectorType:"static_pattern",defaultSeverity:"high",count:5,examples:[{title:"Unsafe archive path",description:"Archive member escapes the bundle root."},{title:"Absolute archive path",description:"Archive member writes to an absolute path."},{title:"Zip expansion budget exceeded",description:"Archive expansion exceeds configured resource limits."}]},{prefix:"SL-PI",category:"prompt_injection",detectorType:"llm_semantic",defaultSeverity:"high",count:5,examples:[{title:"Instruction override",description:"Instructions attempt to override higher-priority system or developer guidance."},{title:"Policy bypass instruction",description:"Instructions ask the agent to ignore safety or trust boundaries."},{title:"Prompt exfiltration instruction",description:"Instructions ask for protected prompts or hidden context."}]},{prefix:"SL-HIDE",category:"hidden_instructions",detectorType:"static_pattern",defaultSeverity:"high",count:4,examples:[{title:"Hidden markdown instruction",description:"Hidden markup contains active instructions."},{title:"Zero-width instruction text",description:"Invisible characters hide security-relevant instructions."},{title:"Large whitespace padding",description:"Whitespace padding hides instructions from normal review."}]},{prefix:"SL-UNI",category:"unicode_deception",detectorType:"static_pattern",defaultSeverity:"high",count:4,examples:[{title:"Bidirectional control character",description:"Unicode bidi controls can make source render differently than it executes."},{title:"Mixed-script deception",description:"Mixed scripts or homoglyphs can disguise identifiers or instructions."}]},{prefix:"SL-EXFIL",category:"data_exfiltration",detectorType:"taint",defaultSeverity:"high",count:5,examples:[{title:"External transmission",description:"Skill content sends local or model data to an external destination.",capability:"network_access"},{title:"Context exfiltration",description:"Skill content transmits model context, prompts, or conversation state.",capability:"model_context"}]},{prefix:"SL-SECRET",category:"secret_harvesting",detectorType:"static_pattern",defaultSeverity:"critical",count:5,examples:[{title:"Hardcoded secret",description:"Bundle contains a credential-like value outside safe example context.",capability:"secret_handling"},{title:"Environment secret enumeration",description:"Script enumerates environment variables or secret stores.",capability:"secret_handling"}]},{prefix:"SL-FS",category:"filesystem_abuse",detectorType:"static_pattern",defaultSeverity:"medium",count:4,examples:[{title:"Broad filesystem read",description:"Skill reads broad local filesystem paths.",capability:"filesystem_read"},{title:"Destructive filesystem write",description:"Skill can remove or overwrite user files.",capability:"filesystem_write"}]},{prefix:"SL-NET",category:"network_abuse",detectorType:"static_pattern",defaultSeverity:"high",count:5,examples:[{title:"Network-capable script",description:"Executable script can reach external network services.",capability:"network_access"},{title:"Remote bootstrap download",description:"Skill downloads and runs remote code.",capability:"network_access"}]},{prefix:"SL-PRIV",category:"privilege_escalation",detectorType:"static_pattern",defaultSeverity:"high",count:4,examples:[{title:"Elevated execution",description:"Skill asks for sudo, root, or administrator execution.",capability:"shell_execution"},{title:"Credential store access",description:"Skill reaches local credential stores.",capability:"secret_handling"}]},{prefix:"SL-RA",category:"persistence_rogue_agent",detectorType:"static_pattern",defaultSeverity:"critical",count:4,examples:[{title:"Self modification",description:"Skill modifies its own code or agent configuration.",capability:"filesystem_write"},{title:"Unauthorized persistence",description:"Skill installs cron, startup, launch, or service persistence.",capability:"shell_execution"}]},{prefix:"SL-NPM",category:"npm_supply_chain",detectorType:"dependency_advisory",defaultSeverity:"high",count:4,examples:[{title:"npm vulnerable dependency",description:"npm package matches signed advisory evidence."},{title:"npm unresolved range",description:"npm dependency range is unresolved and cannot be proven clean."}]},{prefix:"SL-PYPI",category:"pypi_supply_chain",detectorType:"dependency_advisory",defaultSeverity:"high",count:4,examples:[{title:"PyPI vulnerable dependency",description:"PyPI package matches signed advisory evidence."},{title:"PyPI unresolved range",description:"PyPI dependency range is unresolved and cannot be proven clean."}]},{prefix:"SL-OBF",category:"obfuscation",detectorType:"static_pattern",defaultSeverity:"high",count:4,examples:[{title:"Encoded execution",description:"Encoded content is combined with execution behavior."},{title:"Opaque payload",description:"Bundle contains opaque encoded or minified payloads."}]},{prefix:"SL-AST",category:"dangerous_code_ast",detectorType:"ast",defaultSeverity:"high",count:8,examples:[{title:"Dynamic code execution",description:"Script uses exec-like dynamic code execution.",capability:"generated_code_execution"},{title:"Eval expression execution",description:"Script evaluates dynamically built expressions.",capability:"generated_code_execution"},{title:"Subprocess execution",description:"Script launches external commands.",capability:"shell_execution"}]},{prefix:"SL-TAINT",category:"taint_flow",detectorType:"taint",defaultSeverity:"critical",count:5,examples:[{title:"Secret to network flow",description:"Secret-like source flows to network output.",capability:"secret_handling"},{title:"File to network flow",description:"Local file contents flow to network output.",capability:"filesystem_read"},{title:"External input to execution",description:"Untrusted input flows to command or code execution.",capability:"shell_execution"}]},{prefix:"SL-AGENCY",category:"excessive_agency",detectorType:"llm_semantic",defaultSeverity:"medium",count:4,examples:[{title:"Autonomous high-impact action",description:"Skill performs high-impact actions without human confirmation."},{title:"Scope creep",description:"Skill behavior exceeds the stated purpose."}]},{prefix:"SL-TOOL",category:"tool_misuse",detectorType:"static_pattern",defaultSeverity:"high",count:4,examples:[{title:"Dangerous tool parameters",description:"Skill builds unsafe command or tool parameters."},{title:"Wildcard tool grant",description:"Skill requests unrestricted tool access."}]},{prefix:"SL-OUTPUT",category:"output_model_context_risk",detectorType:"taint",defaultSeverity:"medium",count:4,examples:[{title:"Untrusted output promoted to model context",description:"Tool output can become model instructions without filtering."},{title:"Cross-context injection",description:"Output crosses trust boundaries without validation."}]},{prefix:"SL-TRIGGER",category:"trigger_frontmatter_abuse",detectorType:"llm_semantic",defaultSeverity:"medium",count:4,examples:[{title:"Over-broad trigger",description:"Trigger or description matches too many unrelated tasks."},{title:"Shadow command trigger",description:"Trigger shadows built-in commands or other skills."},{title:"Misleading description",description:"Description does not match skill behavior."}]},{prefix:"SL-SIG",category:"signature_malware_indicators",detectorType:"signature",defaultSeverity:"critical",count:4,examples:[{title:"Malicious signature match",description:"Content matches a signed malicious-pattern signature."},{title:"Commodity exfiltration webhook",description:"Content matches a known webhook exfiltration signature."}]}],wA=[{prefix:"SL-RT-SHELL",category:"runtime_shell_execution",detectorType:"guardian_runtime",defaultSeverity:"high",count:4,examples:[{title:"Shell command outside contract",description:"Runtime shell action is outside the Guardian contract.",capability:"shell_execution"}]},{prefix:"SL-RT-NET",category:"runtime_network_egress",detectorType:"guardian_runtime",defaultSeverity:"high",count:4,examples:[{title:"Network domain not allowed",description:"Runtime network target is outside allowed domains.",capability:"network_access"}]},{prefix:"SL-RT-FS",category:"runtime_file_scope",detectorType:"guardian_runtime",defaultSeverity:"high",count:4,examples:[{title:"File scope escape",description:"Runtime file path escapes canonical Guardian scope.",capability:"filesystem_write"}]},{prefix:"SL-RT-SECRET",category:"runtime_secret_broker",detectorType:"guardian_runtime",defaultSeverity:"critical",count:3,examples:[{title:"Secret grant missing",description:"Runtime secret action lacks a scoped broker grant.",capability:"secret_handling"}]},{prefix:"SL-RT-ACTION",category:"runtime_browser_device_api",detectorType:"guardian_runtime",defaultSeverity:"high",count:3,examples:[{title:"High-impact action needs confirmation",description:"Browser, device, or API action needs policy approval."}]},{prefix:"SL-RT-GENCODE",category:"runtime_generated_code",detectorType:"guardian_runtime",defaultSeverity:"critical",count:3,examples:[{title:"Generated-code scan required",description:"Generated code needs scanning before execution.",capability:"generated_code_execution"}]},{prefix:"SL-RT-CONTEXT",category:"runtime_model_context",detectorType:"guardian_runtime",defaultSeverity:"high",count:3,examples:[{title:"Model-context filter required",description:"Untrusted tool output needs filtering before prompt use."}]},{prefix:"SL-RT-DEPS",category:"runtime_dependency_behavior",detectorType:"guardian_runtime",defaultSeverity:"high",count:2,examples:[{title:"Runtime dependency install",description:"Skill attempts package installation during runtime."}]},{prefix:"SL-RT-TRUST",category:"runtime_drift_unmanaged",detectorType:"guardian_runtime",defaultSeverity:"critical",count:3,examples:[{title:"Lockfile drift detected",description:"Installed skill no longer matches trusted lockfile provenance."}]},{prefix:"SL-RT-LEDGER",category:"runtime_ledger_revocation",detectorType:"ledger",defaultSeverity:"critical",count:2,examples:[{title:"Trust Ledger mismatch",description:"Cloud or Public Trust Ledger anchor is missing or mismatched."}]}],vA=Object.freeze([...bg(kA,!1),...bg(wA,!0)]),RN=new Map(vA.map(e=>[e.id,e]));function bg(e,t){return e.flatMap(n=>Array.from({length:n.count},(i,r)=>{let s=n.examples[r]??n.examples[n.examples.length-1];return{id:`${n.prefix}-${String(r+1).padStart(3,"0")}`,category:n.category,title:r<n.examples.length?s.title:`${s.title} ${r+1}`,description:r<n.examples.length?s.description:`${s.description} Variant ${r+1}.`,lifecycleStage:t?"during_run":"pre_install",detectorType:n.detectorType,defaultSeverity:n.defaultSeverity,runtime:t,...s.capability?{capability:s.capability}:{},...t?{guardianControl:n.category}:{}}}))}var EN=256*1024;import{createHash as bA}from"node:crypto";var SA="skills-layer-signatures-v1";var _A="security/signature-packs",NN=`${_A}/source/current.json`;var PA=RA(AA({version:SA,generatedAt:"2026-06-14T00:00:00.000Z",issuer:"skills-layer-local",signatures:[{id:"SL-SIG-COMMODITY-WEBHOOK-EXFIL",ruleId:"SL-SIG-002",title:"Commodity webhook exfiltration",severity:"critical",confidence:.92,tags:["exfiltration","webhook","secret-harvest"],regexes:[`https://(?:discord(?:app)?\\.com/api/webhooks|hooks\\.slack\\.com/services|webhook\\.site)/[^\\s"']+`],explanation:"Content references a commodity webhook endpoint often used for data exfiltration."},{id:"SL-SIG-REMOTE-BOOTSTRAP",ruleId:"SL-SIG-001",title:"Remote bootstrap execution",severity:"high",confidence:.88,tags:["remote-bootstrap","shell"],regexes:["(?:curl|wget)\\s+[^\\n|]+\\|\\s*(?:bash|sh|zsh|python|node)"],explanation:"Content downloads remote code and pipes it directly into an interpreter."},{id:"SL-SIG-DESTRUCTIVE-AUTONOMY",ruleId:"SL-SIG-004",title:"Destructive autonomous action",severity:"high",confidence:.84,tags:["destructive","autonomous"],regexes:["\\b(?:rm\\s+-rf|Remove-Item\\s+-Recurse|format\\s+[A-Z]:|git\\s+push\\s+--force)\\b"],explanation:"Content includes destructive commands that can cause irreversible changes."}]}));function AA(e){return{boundary:"skills_layer_signature_pack",version:e.version,generatedAt:e.generatedAt,issuer:e.issuer??"skills-layer-cloud",signatures:e.signatures.map(CA).sort((t,n)=>t.id.localeCompare(n.id))}}function RA(e){let t=`sha256:${Sg(Ns(e))}`;return{...e,digest:t,signature:Sg(Ns({boundary:e.boundary,digest:t,issuer:e.issuer,version:e.version}))}}function CA(e){return{id:e.id.trim(),ruleId:e.ruleId.trim(),title:e.title.trim(),severity:e.severity,confidence:Math.max(0,Math.min(1,e.confidence)),tags:[...new Set(e.tags.map(t=>t.trim()).filter(Boolean))].sort(),...e.filePattern?{filePattern:e.filePattern}:{},...e.strings?{strings:e.strings.map(t=>t.trim()).filter(Boolean)}:{},...e.regexes?{regexes:e.regexes.map(t=>t.trim()).filter(Boolean)}:{},explanation:e.explanation.trim()}}function Ns(e){return Array.isArray(e)?`[${e.map(Ns).join(",")}]`:e&&typeof e=="object"?`{${Object.entries(e).sort(([t],[n])=>t.localeCompare(n)).map(([t,n])=>`${JSON.stringify(t)}:${Ns(n)}`).join(",")}}`:JSON.stringify(e)}function Sg(e){return bA("sha256").update(e).digest("hex")}function _g(e,t){if(!(e instanceof Uint8Array)||e.byteLength>t.maxArchiveBytes)throw new Error("Artifact v1 ZIP exceeds its archive limit.");if(e.byteLength<22)throw new Error("Artifact v1 ZIP is incomplete.");let n=new DataView(e.buffer,e.byteOffset,e.byteLength),i=e.byteLength-22;if(n.getUint32(i,!0)!==101010256)throw new Error("Artifact v1 ZIP end record is missing or trailing bytes are present.");let r=n.getUint16(i+4,!0),s=n.getUint16(i+6,!0),a=n.getUint16(i+8,!0),o=n.getUint16(i+10,!0),l=n.getUint32(i+12,!0),c=n.getUint32(i+16,!0),d=n.getUint16(i+20,!0);if(r!==0||s!==0||a!==o||o===65535||l===4294967295||c===4294967295||d!==0||o===0||o>t.maxFiles||c+l!==i)throw new Error("Artifact v1 ZIP end record is invalid.");let p=new TextDecoder("utf-8",{fatal:!0,ignoreBOM:!0}),f=[],g=new Set,h=c,m=0,y=0;for(let w=0;w<o;w+=1){if(h+46>i||n.getUint32(h,!0)!==33639248)throw new Error("Artifact v1 ZIP central directory is truncated.");let v=n.getUint16(h+4,!0),S=n.getUint16(h+6,!0),A=n.getUint16(h+8,!0),x=n.getUint16(h+10,!0),$=n.getUint16(h+12,!0),O=n.getUint16(h+14,!0),I=n.getUint32(h+16,!0),G=n.getUint32(h+20,!0),se=n.getUint32(h+24,!0),Ie=n.getUint16(h+28,!0),W=n.getUint16(h+30,!0),Gn=n.getUint16(h+32,!0),Lk=n.getUint16(h+34,!0),Ok=n.getUint16(h+36,!0),Nk=n.getUint32(h+38,!0),ue=n.getUint32(h+42,!0),Eu=h+46+Ie+W+Gn;if(v!==20||S!==20||A!==2048||x!==0||$!==0||O!==0||G!==se||G===4294967295||Ie===0||Ie>t.maxPathBytes||W!==0||Gn!==0||Lk!==0||Ok!==0||Nk!==0||ue!==m||Eu>i||se>t.maxFileBytes)throw new Error("Artifact v1 ZIP central entry is invalid.");if(y+=se,y>t.maxTotalFileBytes)throw new Error("Artifact v1 ZIP exceeds its total file-byte limit.");let $a=e.slice(h+46,h+46+Ie),fr;try{fr=p.decode($a)}catch{throw new Error("Artifact v1 ZIP path is not valid UTF-8.")}if(g.has(fr))throw new Error("Artifact v1 ZIP path uniqueness is invalid.");if(g.add(fr),ue+30>c||n.getUint32(ue,!0)!==67324752)throw new Error("Artifact v1 ZIP local entry is missing.");let jk=n.getUint16(ue+4,!0),Bk=n.getUint16(ue+6,!0),Fk=n.getUint16(ue+8,!0),Dk=n.getUint16(ue+10,!0),qk=n.getUint16(ue+12,!0),Mk=n.getUint32(ue+14,!0),xu=n.getUint32(ue+18,!0),Uk=n.getUint32(ue+22,!0),La=n.getUint16(ue+26,!0),Iu=n.getUint16(ue+28,!0),Tu=ue+30+La+Iu,Oa=Tu+xu;if(jk!==S||Bk!==A||Fk!==x||Dk!==$||qk!==O||Mk!==I||xu!==G||Uk!==se||La!==Ie||Iu!==0||Oa>c||!xA(e.subarray(ue+30,ue+30+La),$a))throw new Error("Artifact v1 ZIP local and central entries do not match.");let Na=e.slice(Tu,Oa);if(EA(Na)!==I)throw new Error("Artifact v1 ZIP entry CRC-32 mismatch.");let $u;try{$u=p.decode(Na)}catch{throw new Error("Artifact v1 ZIP entry is not valid UTF-8.")}f.push({path:fr,pathBytes:$a,content:$u,contentBytes:Na}),m=Oa,h=Eu}if(h!==i||m!==c)throw new Error("Artifact v1 ZIP directory boundaries are invalid.");return f}function EA(e){let t=4294967295;for(let n of e){t^=n;for(let i=0;i<8;i+=1)t=(t&1)===1?t>>>1^3988292384:t>>>1}return(t^4294967295)>>>0}function xA(e,t){for(let n=0;n<e.byteLength;n+=1)if(e[n]!==t[n])return!1;return!0}var Ya="skills-layer-artifact";var Bs="skills-layer-length-delimited-manifest-v1",oe=Object.freeze({id:"skills-layer-stored-zip-parser-v1",version:1,archiveFormat:"zip-stored",manifestEncoding:Bs,pathNormalization:"NFC",pathOrdering:"utf8-bytewise",caseCollisionPolicy:"unicode-lowercase-en-US",maxFiles:Le.maxFiles,maxDepth:Le.maxDepth,maxPathBytes:Le.maxPathBytes,maxFileBytes:Le.maxFileBytes,maxTotalFileBytes:Le.maxTotalBytes,maxArchiveBytes:Le.maxTotalBytes+Le.maxFiles*(76+2*Le.maxPathBytes)+22}),Nl=/^sha256:[a-f0-9]{64}$/u,$A=/^(?:[a-z0-9]+)(?:-[a-z0-9]+)*$/u,LA=/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u,OA=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;var NA=new TextEncoder().encode("SKILLS-LAYER-MANIFEST-V1\0");function ln(e){return Ag(e,Ya,"Artifact").envelope}function cn(e){return jA(e,Ya,"Artifact")}function jA(e,t,n){let i=Ag(e,t,n),r=_g(i.archiveBytes,oe),s=r.map(c=>({path:c.path,content:c.content})),a;try{let c=Lt({files:s,runDlp:!1});if(c.excluded.length>0)throw new Error("excluded path");a=[...c.files].sort((d,p)=>Rg(d.path,p.path))}catch{throw new Error("Artifact archive entries do not satisfy the verified canonical manifest.")}let o=new Map(r.map(c=>[c.path,c])),l=a.map(c=>{let d=o.get(c.path);return{path:d.path,sizeBytes:d.contentBytes.byteLength,sha256:Bl(d.contentBytes)}});if(!zA(l,i.envelope.manifest.files))throw new Error("Artifact archive entries do not match the verified manifest.");return a}function Ag(e,t,n){if(!(e.archiveBytes instanceof Uint8Array))throw new Error(`${n} archive bytes are invalid.`);let i=BA(e.envelope,t,n);if(e.archiveBytes.byteLength>oe.maxArchiveBytes)throw new Error(`${n} archive exceeds the v1 parser policy.`);let r=Uint8Array.from(e.archiveBytes),s=Bl(r);if(!Cg(s,i.archive.sha256))throw new Error(`${n} archive SHA-256 mismatch.`);if(r.byteLength!==i.archive.sizeBytes)throw new Error(`${n} archive size mismatch.`);return{archiveBytes:r,envelope:i}}function BA(e,t,n){if(!_n(e)||e.format!==t||e.formatVersion!==1)throw new Error(`${n} envelope format is invalid.`);if(MA(e.generation,`${n} envelope generation identity is invalid`),!_n(e.archive)||typeof e.archive.sha256!="string"||!Nl.test(e.archive.sha256)||!js(e.archive.sizeBytes)||e.archive.sizeBytes>oe.maxArchiveBytes)throw new Error("Artifact envelope archive metadata is invalid.");if(!_n(e.manifest)||e.manifest.encoding!==Bs||typeof e.manifest.sha256!="string"||!Nl.test(e.manifest.sha256)||!js(e.manifest.fileCount)||e.manifest.fileCount===0||!js(e.manifest.totalFileBytes)||e.manifest.totalFileBytes>oe.maxTotalFileBytes||!Array.isArray(e.manifest.files)||e.manifest.fileCount!==e.manifest.files.length)throw new Error("Artifact envelope manifest metadata is invalid.");if(!UA(e.parserPolicy))throw new Error("Artifact envelope parser policy is invalid.");let i=e.manifest.files.map(a=>FA(a));if(DA(i),i.reduce((a,o)=>a+o.sizeBytes,0)!==e.manifest.totalFileBytes)throw new Error("Artifact manifest totals do not match its entries.");let s=qA(i);if(!Cg(Bl(s),e.manifest.sha256))throw new Error("Artifact manifest SHA-256 mismatch.");return VA({format:t,formatVersion:1,generation:e.generation,archive:{sha256:e.archive.sha256,sizeBytes:e.archive.sizeBytes},manifest:{encoding:Bs,sha256:e.manifest.sha256,fileCount:e.manifest.fileCount,totalFileBytes:e.manifest.totalFileBytes,files:i},parserPolicy:oe})}function FA(e){if(!_n(e)||typeof e.path!="string"||!js(e.sizeBytes)||e.sizeBytes>oe.maxFileBytes||typeof e.sha256!="string"||!Nl.test(e.sha256))throw new Error("Artifact envelope manifest entry is invalid.");return{path:e.path,sizeBytes:e.sizeBytes,sha256:e.sha256}}function DA(e){let t;try{let n=Lt({files:e.map(i=>({path:i.path,content:""})),limits:{maxFiles:oe.maxFiles,maxDepth:oe.maxDepth,maxPathBytes:oe.maxPathBytes,maxFileBytes:oe.maxFileBytes,maxTotalBytes:oe.maxTotalFileBytes},runDlp:!1});if(n.excluded.length>0||n.files.length!==e.length)throw new Error("excluded path");t=n.files.map(i=>i.path).sort(Rg)}catch{throw new Error("Artifact manifest paths are not canonical.")}if(e.some((n,i)=>n.path!==t[i]))throw new Error("Artifact manifest paths are not canonical.")}function qA(e){let t=[NA,Pg(e.length)];for(let n of e){let i=new TextEncoder().encode(n.path);t.push(Pg(i.byteLength),i,KA(n.sizeBytes),jl(n.sha256))}return HA(t)}function MA(e,t){if(!_n(e)||typeof e.skillSlug!="string"||!$A.test(e.skillSlug)||typeof e.semanticVersion!="string"||!LA.test(e.semanticVersion)||typeof e.generationId!="string"||!OA.test(e.generationId))throw new Error(`${t}.`)}function UA(e){return!_n(e)||Object.keys(e).length!==Object.keys(oe).length?!1:Object.entries(oe).every(([t,n])=>e[t]===n)}function VA(e){let t=Object.freeze(e.manifest.files.map(s=>Object.freeze({path:s.path,sizeBytes:s.sizeBytes,sha256:s.sha256}))),n=GA(e.generation),i=Object.freeze({sha256:e.archive.sha256,sizeBytes:e.archive.sizeBytes}),r=Object.freeze({encoding:Bs,sha256:e.manifest.sha256,fileCount:e.manifest.fileCount,totalFileBytes:e.manifest.totalFileBytes,files:t});return Object.freeze({format:e.format,formatVersion:1,generation:n,archive:i,manifest:r,parserPolicy:oe})}function GA(e){return Object.freeze({skillSlug:e.skillSlug,semanticVersion:e.semanticVersion,generationId:e.generationId})}function zA(e,t){return e.length===t.length&&e.every((n,i)=>n.path===t[i]?.path&&n.sizeBytes===t[i]?.sizeBytes&&n.sha256===t[i]?.sha256)}function Rg(e,t){return Buffer.compare(Buffer.from(e,"utf8"),Buffer.from(t,"utf8"))}function Bl(e){return`sha256:${IA("sha256").update(e).digest("hex")}`}function Cg(e,t){return TA(jl(e),jl(t))}function jl(e){return Buffer.from(e.slice(7),"hex")}function Pg(e){let t=new Uint8Array(4);return new DataView(t.buffer).setUint32(0,e,!1),t}function KA(e){let t=new Uint8Array(8);return new DataView(t.buffer).setBigUint64(0,BigInt(e),!1),t}function HA(e){let t=new Uint8Array(e.reduce((i,r)=>i+r.byteLength,0)),n=0;for(let i of e)t.set(i,n),n+=i.byteLength;return t}function js(e){return typeof e=="number"&&Number.isSafeInteger(e)&&e>=0}function _n(e){return typeof e=="object"&&e!==null}var Fl=["productivity","coding","review","testing","devops","data","documents","media","research","planning","design","security","business","education","automation","communication","email","customer-support","sales","marketing","finance","legal","operations","project-management","writing","translation","knowledge-management","hr","ai","ecommerce"],JA="productivity",WA=new Set(Fl),YA={ci:"devops","ci-cd":"devops",compliance:"security",content:"documents",crm:"customer-support",docs:"documents",frontend:"coding","customer-service":"customer-support","customer-success":"customer-support","e-commerce":"ecommerce",genai:"ai",legal:"legal",llm:"ai",ops:"operations",pm:"project-management",reporting:"business",reports:"business","team-ops":"operations",ui:"design",ux:"design","web-development":"coding"},ZA={productivity:["productivity","todo","task","tasks","calendar","meeting","notes","workflow","focus"],coding:["code","coding","developer","frontend","backend","repository","typescript","javascript","react","vite","html","css","component","bundle","artifact"],review:["review","reviews","critique","audit","feedback","pr","pull","quality"],testing:["test","tests","testing","qa","coverage","regression","playwright","vitest"],devops:["deploy","approval","ci","cd","pipeline","infra","infrastructure","docker","cloudflare","wrangler"],data:["data","dataset","sql","database","analytics","metrics","spreadsheet","csv","json"],documents:["document","documents","doc","docs","pdf","report","reports","contract","proposal","writing"],media:["media","image","video","audio","transcript","youtube","asset","thumbnail"],research:["research","search","sources","citation","citations","summarize","summaries","literature"],planning:["plan","planning","project","roadmap","milestone","sprint","delivery","schedule"],design:["design","ui","ux","layout","wireframe","prototype","figma","tailwind","shadcn"],security:["security","threat","secret","secrets","vulnerability","vulnerabilities","risk","policy"],business:["business","strategy","customer","market","stakeholder","commercial","pricing"],education:["education","teach","teaching","learn","learning","lesson","course","tutorial"],automation:["automation","automate","workflow","script","scripts","bot","trigger","orchestration"],communication:["communication","slack","message","messages","chat","reply","announcement","conversation"],email:["email","emails","gmail","googleemail","googlemail","outlook","inbox","mail","newsletter"],"customer-support":["support","ticket","tickets","helpdesk","customer","service","csat","escalation"],sales:["sales","lead","leads","prospect","pipeline","deal","deals","crm","account"],marketing:["marketing","campaign","brand","seo","content","social","audience","copy"],finance:["finance","financial","invoice","invoices","budget","forecast","accounting","revenue","tax"],legal:["legal","contract","contracts","clause","clauses","compliance","policy","terms","privacy"],operations:["operations","ops","runbook","process","sop","incident","queue","handoff"],"project-management":["project","projects","backlog","dependency","dependencies","kanban","scrum","pm"],writing:["writing","write","draft","edit","editing","blog","article","copywriting"],translation:["translation","translate","localization","locale","language","languages","i18n"],"knowledge-management":["knowledge","wiki","kb","retrieval","archive","taxonomy","knowledgebase"],hr:["hr","hiring","recruiting","interview","onboarding","employee","people","performance"],ai:["ai","llm","prompt","prompts","model","models","agent","agents","rag","embedding"],ecommerce:["ecommerce","commerce","shop","store","checkout","cart","order","orders","product"]};function Eg(e){if(typeof e!="string")return null;let t=Tg(e);return WA.has(t)?t:YA[t]??null}function xg(e){let t=e.trim().toLowerCase().replace(/[_\s]+/gu,"-"),n={ai:"AI",hr:"HR",ecommerce:"E-commerce","e-commerce":"E-commerce"};return n[t]?n[t]:e.split(/[-_\s]+/u).filter(Boolean).map(i=>`${i.slice(0,1).toUpperCase()}${i.slice(1)}`).join(" ")}function Ig(e){let t=[{value:e.slug??"",weight:3,signal:"slug"},{value:e.name??"",weight:3,signal:"name"},{value:e.description??"",weight:2,signal:"description"},{value:e.skillType??"",weight:1,signal:"skill_type"},{value:e.compatibility??"",weight:1,signal:"compatibility"},{value:(e.tags??[]).join(" "),weight:4,signal:"tags"},{value:e.body??"",weight:1,signal:"body"}].filter(s=>s.value.trim().length>0),n=new Map;for(let s of t){let a=QA(s.value);for(let[o,l]of Object.entries(ZA)){if(!l.some(p=>a.has(p)))continue;let d=n.get(o)??{score:0,signals:new Set};d.score+=s.weight,d.signals.add(s.signal),n.set(o,d)}}let r=[...n.entries()].sort((s,a)=>a[1].score-s[1].score||Fl.indexOf(s[0])-Fl.indexOf(a[0]))[0];return!r||r[1].score<2?{category:XA(e),confidence:"fallback",matchedSignals:[]}:{category:r[0],confidence:r[1].score>=5?"high":r[1].score>=3?"medium":"low",matchedSignals:[...r[1].signals].sort()}}function XA(e){let t=Tg(e.skillType??"");return t.includes("automation")?"automation":t.includes("mcp")?"ai":JA}function Tg(e){return e.trim().toLowerCase().replace(/[_\s]+/gu,"-")}function QA(e){return new Set(e.toLowerCase().split(/[^a-z0-9]+/u).map(t=>t.trim()).filter(t=>t.length>=2).flatMap(eR))}function eR(e){let t=[e];return e.endsWith("ing")&&e.length>5&&t.push(e.slice(0,-3)),e.endsWith("s")&&e.length>4&&t.push(e.slice(0,-1)),t}import{createHash as tR}from"node:crypto";var nR=new Set(["evals","tests","test","fixtures","examples","golden","goldens","snapshots","__snapshots__",".github",".circleci","coverage"]),iR=new Set([".gitlab-ci.yml","azure-pipelines.yml"]),rR=[".eval.json",".eval.yaml"],sR=[".golden.",".snapshot."];function Mt(e,t){let n=Ml(e),i=$g(t),r=Dl(n,i),[s]=r.split("/");return s&&nR.has(s)?{path:n,relativePath:r,root:i,type:"evidence",reasonCode:"top_level_evidence_folder"}:aR(r)?{path:n,relativePath:r,root:i,type:"evidence",reasonCode:"top_level_evidence_file"}:{path:n,relativePath:r,root:i,type:"runtime",reasonCode:"runtime_material"}}function ql(e){let t=$g(e);return e.map(n=>({...n,path:Ml(n.path)})).filter(n=>Mt(n.path,e).type==="runtime").sort((n,i)=>oR(n.path,i.path,t))}function Re(e){let t=tR("sha256");for(let n of ql(e))t.update(n.path),t.update("\0"),t.update(n.content??""),t.update("\0");return`sha256:${t.digest("hex")}`}function aR(e){return e.includes("/")?!1:iR.has(e)||rR.some(t=>e.endsWith(t))||sR.some(t=>e.includes(t))}function $g(e){let t=e.map(n=>Ml(n.path)).find(n=>n==="SKILL.md"||n.endsWith("/SKILL.md"));return!t||t==="SKILL.md"?"":t.slice(0,-9)}function Dl(e,t){return t?e===t?"":e.startsWith(`${t}/`)?e.slice(t.length+1):e:e}function oR(e,t,n){let i=Dl(e,n),r=Dl(t,n);return i==="SKILL.md"?r==="SKILL.md"?0:-1:r==="SKILL.md"?1:e.localeCompare(t)}function Ml(e){return e.replaceAll("\\","/").split("/").filter(t=>t.length>0&&t!==".").join("/")}var Lg=Ou($l(),1);var lR=["standalone","workflow_automation","mcp_enhanced"];function Og(e){let t=e?.trim();if(!t)return"standalone";if(t==="workflow")return"workflow_automation";if(!lR.includes(t))throw new Error(`Unsupported skill type "${t}". Supported types: standalone, workflow, workflow_automation, mcp_enhanced.`);return t}function Ng(e){uR(e);let t=dR(e.licenseSelection??{mode:"skip"}),n=[{path:"SKILL.md",content:cR(e)},{path:"README.md",content:fR(e)},{path:"references/guide.md",content:mR(e)},{path:"scripts/README.md",content:gR(e)},...t],i=Re(n);return[...n,{path:"evals/skills-layer.eval.json",content:hR(e,i)}]}function cR(e){let t=yR(e),n=e.licenseSelection??{mode:"skip"},i=n.mode==="skip"?{}:{license:n.identifier,license_file:pR(n)},r=(0,Lg.stringify)({name:e.skillSlug,description:e.description,compatibility:"Codex, Claude Code",metadata:{category:t,price_cents:0,...i,tags:[t,e.skillType],skills_layer:{capabilities:["model_context","filesystem_read"]}}},{lineWidth:0}).trimEnd(),s=e.description.replace(/\s+/gu," ").trim().toLowerCase();return`---
+${r}
+---
+# ${Ul(e.skillSlug)}
 
-Use this skill when the user needs ${e.description.toLowerCase()}
+Use this skill when the user needs ${s}
 
 ## Examples
 
@@ -280,7 +433,7 @@ Use this skill when the user needs ${e.description.toLowerCase()}
 
 - If the skill does not trigger, make the user request more explicit and mention the task directly.
 - Move deeper procedures into [references/guide.md](references/guide.md) to keep this file concise.
-`}function ba(e){return`# ${un(e.skillSlug)}
+`}function uR(e){if(!/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(e.skillSlug))throw new Error("skillSlug must be kebab-case");if(e.skillSlug.length>128)throw new Error("skillSlug must be 128 characters or fewer");if(e.description.trim().length===0)throw new Error("description must be a non-empty string");if(e.description.length>1024)throw new Error("description must be 1024 characters or fewer");if(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u.test(e.description))throw new Error("description contains unsupported control characters");let t=e.licenseSelection;if(!t||t.mode==="skip")return;let n=Sn(t.identifier);if(t.mode==="template"&&!Li(n))throw new Error(`No approved immutable licence template is available for ${n}`);if(t.mode!=="template"){if(t.text.length===0)throw new Error("creator-supplied licence text must not be empty");if(Buffer.byteLength(t.text,"utf8")>256*1024)throw new Error("creator-supplied licence text must be 256 KiB or smaller");Oi(t.filePath??"LICENSE")}}function dR(e){return e.mode==="skip"?[]:e.mode==="template"?[{path:"LICENSE",content:bn(e.identifier)}]:[{path:Oi(e.filePath??"LICENSE"),content:e.text}]}function pR(e){return e.mode==="template"?"LICENSE":Oi(e.filePath??"LICENSE")}function fR(e){return`# ${Ul(e.skillSlug)}
 
 This scaffold was created for a ${e.skillType.replaceAll("_"," ")} skill.
 
@@ -303,12 +456,12 @@ Current summary:
 - Slug: \`${e.skillSlug}\`
 - Description: ${e.description}
 - Default price: free (\`price_cents: 0\`)
-`}function Sa(e){return`# Scripts
+`}function gR(e){return`# Scripts
 
 Place optional helper scripts for \`${e.skillSlug}\` here.
 
 Only include files that are required by the skill workflow. Keep the runtime surface small so bundle packaging stays predictable.
-`}function Pa(e){return`# ${un(e.skillSlug)} Guide
+`}function mR(e){return`# ${Ul(e.skillSlug)} Guide
 
 ## Intent
 
@@ -320,16 +473,17 @@ Document the decision rules, expected inputs, and success criteria for this ${e.
 - Example prompts that should trigger the skill
 - Failure cases and recovery guidance
 - Tooling or policy constraints
-`}function Ca(e,t){return`${JSON.stringify({schemaVersion:"skills-layer.eval.pack.v1",artifactDigest:t,origin:"inferred",confidence:"starter",creatorReviewed:!1,redaction:{mode:"content_free"},cases:[{id:"starter-trigger-fit",title:"Skill has a clear trigger and usage path",assertions:[{type:"section_exists",target:"Examples"},{type:"section_exists",target:"Troubleshooting"},{type:"max_duration_ms",value:3e4}]}],notes:[`Review and expand this starter eval pack before submitting ${e.skillSlug}.`,"Keep prompts, fixtures, and expected private outputs out of cloud summaries."]},null,2)}
-`}function un(e){return e.split("-").map(t=>t.charAt(0).toUpperCase()+t.slice(1)).join(" ")}function _a(e){let t=Wi(e.category);return t||Yi({name:e.skillSlug,slug:e.skillSlug,description:e.description,skillType:e.skillType}).category}function nr(e,t){switch(e.type){case"file_exists":return dn(t.files,Ee(e.path))?_e("file_exists"):J("file_missing");case"json_valid":return xa(e,t);case"section_exists":return Ra(e,t);case"regex_match":return $a(e,t);case"schema_match":return Aa(e,t);case"artifact_valid":return he(t.files)===Ee(e.artifactDigest)?_e("artifact_digest_matched"):J("artifact_digest_mismatch");case"max_duration_ms":return typeof t.durationMs=="number"&&t.durationMs<=tr(e.value)?_e("duration_within_limit"):J("duration_exceeded");case"command_exit":return typeof t.commandExitCode=="number"&&t.commandExitCode===tr(e.value)?_e("command_exit_matched"):J("command_exit_mismatch");default:return ja("assertion_type_unsupported")}}function xa(e,t){let n=dn(t.files,Ee(e.path));if(!n)return J("file_missing");try{return JSON.parse(n.content??""),_e("json_valid")}catch{return J("json_invalid")}}function Ra(e,t){let n=Ee(e.target);if(!n)return J("section_target_missing");let i=new RegExp(`(^|\\n)#+\\s+${Ea(n)}(?=$|\\s)`,"iu");return t.files.some(r=>i.test(r.content??""))?_e("section_exists"):J("section_missing")}function $a(e,t){let n=Ee(e.pattern);if(!n)return J("regex_missing");let i;try{i=new RegExp(n,"u")}catch{return J("regex_invalid")}let r=Ee(e.path);return(r?t.files.filter(o=>St(o.path)===St(r)):t.files).some(o=>i.test(o.content??""))?_e("regex_matched"):J("regex_not_matched")}function Aa(e,t){let n=dn(t.files,Ee(e.path));if(!n)return J("file_missing");let i;try{i=JSON.parse(n.content??"")}catch{return J("json_invalid")}return Ia(i)?(Array.isArray(e.requiredKeys)?e.requiredKeys.map(String):[]).every(s=>Object.prototype.hasOwnProperty.call(i,s))?_e("schema_matched"):J("schema_required_key_missing"):J("schema_target_not_object")}function dn(e,t){if(!t)return;let n=St(t);return e.find(i=>St(i.path)===n)}function Ee(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function tr(e){return typeof e=="number"&&Number.isFinite(e)?e:Number.NaN}function St(e){return e.replaceAll("\\","/").replace(/^\.\//u,"")}function Ea(e){return e.replace(/[.*+?^${}()|[\]\\]/gu,"\\$&")}function Ia(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function _e(e){return{status:"passed",reasonCode:e}}function J(e){return{status:"failed",reasonCode:e}}function ja(e){return{status:"skipped",reasonCode:e}}import{createHash as La}from"node:crypto";var Ua=["submitted","inferred","submitted_plus_inferred"],Ta=["starter","reviewed","verified"],Fa=["file_exists","json_valid","schema_match","section_exists","regex_match","command_exit","artifact_valid","max_duration_ms"],Na=new Set(Ua),Ma=new Set(Ta),Ba=new Set(Fa);function ir(e){let t=[];return nt(e)?(e.schemaVersion!=="skills-layer.eval.pack.v1"&&t.push(ne("eval-pack-schema-invalid","$.schemaVersion","Eval pack schemaVersion is unsupported")),(typeof e.artifactDigest!="string"||!/^sha256:[a-f0-9]{64}$/u.test(e.artifactDigest))&&t.push(ne("eval-pack-artifact-digest-invalid","$.artifactDigest","Eval pack must target a sha256 artifact digest")),(typeof e.origin!="string"||!Na.has(e.origin))&&t.push(ne("eval-pack-origin-invalid","$.origin","Eval pack origin is not canonical")),(typeof e.confidence!="string"||!Ma.has(e.confidence))&&t.push(ne("eval-pack-confidence-invalid","$.confidence","Eval pack confidence is not canonical")),typeof e.creatorReviewed!="boolean"&&t.push(ne("eval-pack-review-invalid","$.creatorReviewed","Eval pack must state whether the creator reviewed it")),(!nt(e.redaction)||e.redaction.mode!=="content_free")&&t.push(ne("eval-pack-redaction-invalid","$.redaction.mode","Eval pack must use content_free redaction by default")),!Array.isArray(e.cases)||e.cases.length===0?t.push(ne("eval-pack-cases-invalid","$.cases","Eval pack must include at least one case")):Oa(e.cases,t),{valid:t.length===0,issues:t}):{valid:!1,issues:[ne("eval-pack-invalid","$","Eval pack must be an object")]}}function Pt(e){return`sha256:${La("sha256").update(qa(e)).digest("hex")}`}function Oa(e,t){let n=new Set;e.forEach((i,r)=>{let s=`$.cases[${r}]`;if(!nt(i)){t.push(ne("eval-pack-case-invalid",s,"Eval case must be an object"));return}if(typeof i.id!="string"||i.id.trim().length===0?t.push(ne("eval-pack-case-id-invalid",`${s}.id`,"Eval case id is required")):n.has(i.id)?t.push(ne("eval-pack-case-id-duplicate",`${s}.id`,"Eval case ids must be unique")):n.add(i.id),!Array.isArray(i.assertions)||i.assertions.length===0){t.push(ne("eval-pack-assertions-invalid",`${s}.assertions`,"Eval case must include assertions"));return}i.assertions.forEach((o,a)=>{let c=`${s}.assertions[${a}]`;(!nt(o)||typeof o.type!="string"||!Ba.has(o.type))&&t.push(ne("eval-pack-assertion-type-invalid",`${c}.type`,"Eval assertion type is not supported"))})})}function qa(e){return JSON.stringify(pn(e))}function pn(e){return Array.isArray(e)?e.map(pn).sort(Da):nt(e)?Object.fromEntries(Object.entries(e).filter(([t])=>t!=="evalPackDigest").sort(([t],[n])=>t.localeCompare(n)).map(([t,n])=>[t,pn(n)])):e}function Da(e,t){return JSON.stringify(e).localeCompare(JSON.stringify(t))}function nt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function ne(e,t,n){return{code:e,path:t,message:n}}function sr(e){let t=e.assertionsPassed+e.assertionsFailed,n={coverageRatio:rr(e.evaluatedCapabilities,e.declaredCapabilities),passRate:t===0?0:rr(e.assertionsPassed,t),freshnessFactor:Va(e),evidenceConfidence:Ka(e),baselineDelta:Ct(Math.max(0,e.baselineDelta??0)),telemetrySignal:Ct(e.aggregationThresholdMet?e.telemetrySignal??0:0)},i=gn(n.coverageRatio*.25+n.passRate*.25+n.freshnessFactor*.15+n.evidenceConfidence*.2+n.baselineDelta*.05+n.telemetrySignal*.1);return{components:n,overallScore:i,effectiveScorePercent:Ha(i*100),assertionsFailed:e.assertionsFailed,executedAssertions:t,aggregationThresholdMet:e.aggregationThresholdMet}}function or(e){return e.executedAssertions===0&&e.components.coverageRatio===0?"unknown":e.components.freshnessFactor===0?"stale":e.assertionsFailed>0&&e.components.passRate<.8?"failing":e.overallScore>=.8&&e.components.coverageRatio>=.8&&e.components.passRate>=.9&&e.components.evidenceConfidence>=.7?"strong":e.aggregationThresholdMet&&e.components.telemetrySignal>=.7?"telemetry-backed":"limited"}function Ka(e){let t=e.origin==="submitted"?.65:e.origin==="submitted_plus_inferred"?.55:.25,n=e.creatorReviewed?.15:0,i=Math.min(e.runCount*.03,.15),r=Math.min(new Set(e.runnerTypes).size*.04,.1),s=e.aggregationThresholdMet?.1:0;return gn(Ct(t+n+i+r+s))}function Va(e){if(e.freshnessPolicy==="never")return 1;if(!e.generatedAt||!e.now)return 0;let t=Date.parse(e.generatedAt),n=Date.parse(e.now);if(!Number.isFinite(t)||!Number.isFinite(n)||n<t)return 0;let i=Ga(e.freshnessPolicy);return n-t<=i?1:0}function Ga(e){return e==="3_months"?2160*60*60*1e3:e==="6_months"?4392*60*60*1e3:365*24*60*60*1e3}function rr(e,t){return t<=0?0:gn(Ct(e/t))}function Ct(e){return Math.max(0,Math.min(1,e))}function gn(e){return Math.round(e*1e4)/1e4}function Ha(e){return Math.round(e*10)/10}var mn=["passed","failed","not_run","generated_only","policy_skipped","runner_unavailable"],hg=new Set(mn);function _t(e){return{schemaVersion:"skills-layer.eval.summary.v1",status:e.status,skillSlug:e.skillSlug,version:e.version,artifactDigest:e.artifactDigest,...e.evalPackDigest?{evalPackDigest:e.evalPackDigest}:{},...e.runnerVersion?{runnerVersion:e.runnerVersion}:{},generatedAt:e.generatedAt,...e.counts?{counts:e.counts}:{},redaction:{mode:"content_free",rawContentIncluded:!1}}}function ar(e){let t=he(e),n=ln(e),i=e.map(c=>Ae(c.path,e)).filter(c=>c.type==="evidence"),r=za(e),s=r?"submitted":"inferred",o=sr({declaredCapabilities:4,evaluatedCapabilities:r?2:1,assertionsPassed:0,assertionsFailed:0,assertionsSkipped:0,origin:s,creatorReviewed:!1,runCount:0,runnerTypes:["dry"],aggregationThresholdMet:!1,freshnessPolicy:"never"}),a=or(o);return{schemaVersion:"skills-layer.eval.readiness.v1",status:a,label:a,artifactDigest:t,origin:s,confidence:"starter",creatorReviewed:!1,runtimeFileCount:n.length,evidenceFileCount:i.length,excludedEvidencePaths:i.map(c=>c.path),score:{overallScore:o.overallScore,effectiveScorePercent:o.effectiveScorePercent,components:o.components},summaryEnvelope:{requiredOnSubmit:!0,statuses:[...mn]},nextAction:"creator.submit",nextStep:"creator submit must attach a mandatory redacted eval summary envelope."}}function za(e){return e.map(t=>Ae(t.path,e)).some(t=>t.type==="evidence"&&(t.relativePath.startsWith("evals/")||t.relativePath.endsWith(".eval.json")||t.relativePath.endsWith(".eval.yaml")))}var Wa=/^github:([^/]+)\/([^/#]+)(?:\/([^#]+))?(?:#(.+))?$/,Ja=/^gitlab:([^/#]+(?:\/[^/#]+)*?)\/([^/#]+)(?:\/([^/#]+))?(?:#(.+))?$/,Ya=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)(?:\/(.+?))?(?:#([^@]+))?$/,Za=/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/.+)?(?:#[^@]+)?$/,Qa=/^(?:\.{1,2}(?:[\\/]|$)|[\\/]|[A-Za-z]:[\\/])/,Xa=/^(?:ssh:\/\/)?git@github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/,el=/^(?:ssh:\/\/)?git@gitlab\.com[:/]([^/]+(?:\/[^/]+)*)\/([^/]+?)(?:\.git)?$/;function it(e){let t=e.trim();if(t.length===0)throw new Error("import requires a non-empty source.");let{sourceInput:n,skillFilter:i}=tl(t),r=n.match(Wa);if(r){let[,g,f,m,y]=r;return xt({input:t,owner:g,repo:f,ref:y?.trim()||"main",subpath:m,skillFilter:i})}let s=n.match(Ja);if(s){let[,g,f,m,y]=s;return fn({input:t,host:"gitlab.com",namespace:g,repo:f,ref:y?.trim()||"main",subpath:m,skillFilter:i})}let o=nl(t);if(o)return o;let a=il(t);if(a)return a;let c=n.match(Xa);if(c){let[,g,f]=c;return xt({input:t,owner:g,repo:ye(f),ref:"main",subpath:"SKILL.md"})}let u=n.match(el);if(u){let[,g,f]=u;return fn({input:t,host:"gitlab.com",namespace:g,repo:ye(f),ref:"main",subpath:"SKILL.md"})}if(/^(?:git\+)?https?:\/\//u.test(n)){if(/[?&]skill=/u.test(n)){let g=new URL(n.replace(/^git\+/u,"")),f=g.searchParams.get("skill")?.trim();return g.searchParams.delete("skill"),{kind:"url",input:t,url:g.toString(),canonicalSource:g.toString(),...f?{skillFilter:f}:{}}}return{kind:"url",input:t,url:n.replace(/^git\+/u,""),canonicalSource:n.replace(/^git\+/u,"")}}let d=n.match(Ya);if(d&&!Qa.test(n)){let[,g,f,m,y]=d;return xt({input:t,owner:g,repo:ye(f),ref:y?.trim()||"main",subpath:m,skillFilter:i})}return/^(?:ssh:\/\/)?git@/u.test(n)||/^(?:git\+)?ssh:\/\//u.test(n)?{kind:"git",input:t,url:n.replace(/^git\+/u,""),canonicalSource:n.replace(/^git\+/u,""),...i?{skillFilter:i}:{}}:{kind:"local",input:t,location:n,canonicalSource:n,...i?{skillFilter:i}:{}}}function Rt(e){let t=e?.trim();return t&&t.length>0?t:"SKILL.md"}function tl(e){if(e.startsWith("http://")||e.startsWith("https://")||e.startsWith("git@")||e.startsWith("ssh://"))return{sourceInput:e};let t=e.lastIndexOf("@");if(t<=0||t===e.length-1)return{sourceInput:e};let n=e.slice(0,t),i=e.slice(t+1).trim();return i.match(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u)?n.includes("#")?{sourceInput:n,skillFilter:i}:n.startsWith("github:")||n.startsWith("gitlab:")||Za.test(n)?{sourceInput:n,skillFilter:i}:{sourceInput:n,skillFilter:i}:{sourceInput:e}}function lr(e,t,n,i,r){return e==="gitlab"&&r&&r!=="gitlab.com"?`${e}://${r}/${t}@${n}/${i}`:`${e}://${t}@${n}/${i}`}function ye(e){return e.replace(/\.git$/u,"")}function nl(e){if(!e.startsWith("http://")&&!e.startsWith("https://"))return null;let t=new URL(e);if(t.hostname!=="github.com")return null;let n=t.pathname.split("/").filter(Boolean);if(n.length<2)throw new Error("GitHub URLs must include an owner and repository.");let i=n[0],r=ye(n[1]),s="main",o="SKILL.md";(n[2]==="tree"||n[2]==="blob")&&(s=n[3]?.trim()||"main",o=Rt(n.slice(4).join("/")));let a=t.searchParams.get("skill")?.trim()||void 0;return t.searchParams.delete("skill"),xt({input:e,owner:i,repo:r,ref:s,subpath:o,skillFilter:a})}function il(e){if(!e.startsWith("http://")&&!e.startsWith("https://"))return null;let t=new URL(e);if(t.hostname==="github.com")return null;let n=t.pathname.split("/").filter(Boolean),i=n.indexOf("-");if(t.hostname!=="gitlab.com"&&i===-1)return null;let r=i===-1?n:n.slice(0,i);if(r.length<2)throw new Error("GitLab URLs must include a namespace and repository.");let s=ye(r[r.length-1]),o=r.slice(0,-1).join("/"),a=i===-1?void 0:n[i+1],c=i===-1?[]:n.slice(i+2),u=(a==="tree"||a==="blob")&&c[0]?.trim()||"main",d=a==="tree"||a==="blob"?Rt(c.slice(1).join("/")):"SKILL.md",g=t.searchParams.get("skill")?.trim()||void 0;return t.searchParams.delete("skill"),fn({input:e,host:t.hostname,namespace:o,repo:s,ref:u,subpath:d,skillFilter:g})}function xt(e){let t=Rt(e.subpath);return{kind:"github",input:e.input,owner:e.owner,repo:ye(e.repo),ref:e.ref,subpath:t,repoUrl:`https://github.com/${e.owner}/${ye(e.repo)}`,rawUrl:`https://raw.githubusercontent.com/${e.owner}/${ye(e.repo)}/${e.ref}/${t}`,canonicalSource:lr("github",`${e.owner}/${ye(e.repo)}`,e.ref,t),...e.skillFilter?{skillFilter:e.skillFilter}:{}}}function fn(e){let t=ye(e.repo),n=Rt(e.subpath);return{kind:"gitlab",input:e.input,host:e.host,namespace:e.namespace,repo:t,ref:e.ref,subpath:n,repoUrl:`https://${e.host}/${e.namespace}/${t}`,rawUrl:`https://${e.host}/${e.namespace}/${t}/-/raw/${e.ref}/${n}`,canonicalSource:lr("gitlab",`${e.namespace}/${t}`,e.ref,n,e.host),...e.skillFilter?{skillFilter:e.skillFilter}:{}}}var rl="private",cr="public",ur="unlisted",dr="delisted";function $t(e){if(typeof e!="string"||e.trim().length===0)return null;let t=e.trim().toLowerCase();return t==="private"?rl:t===cr?cr:t===ur?ur:t===dr?dr:null}import{execFile as sl}from"node:child_process";import{createHash as ol}from"node:crypto";import{promisify as al}from"node:util";var hn=al(sl),rt="apiKey",Ne="apiKeyRef",st="Skills Layer CLI";function yn(e=process.platform,t=process.env){let n=t.SKILLS_LAYER_CREDENTIAL_STORE?.trim().toLowerCase();return n==="local-file"||n==="local_file"||n==="disabled"||e!=="darwin"||process.env.VITEST==="true"&&n!=="macos-keychain"&&n!=="macos_keychain"?null:ul()}async function pr(e,t){if(!(typeof e[rt]=="string"&&e[rt].length>0))return e;let i=kn(t);if(!i)return e;try{let r={...e,credentialStorage:"macos_keychain"},s=ll(e);return await i.set(wn(t),s,e[rt]),r[Ne]=s,delete r[rt],r}catch{return cl(e)}}async function gr(e,t){if(e.credentialStorage!=="macos_keychain"||e[rt]||!e[Ne])return e;let n=kn(t);if(!n)return e;let i=await n.get(wn(t),e[Ne]);return i?{...e,apiKey:i}:e}async function mr(e,t){if(!e||e.credentialStorage!=="macos_keychain"||!e[Ne])return;let n=kn(t);n&&await n.delete(wn(t),e[Ne])}function ll(e){let t=[e.baseUrl??"unknown-base-url",e.userId??e.email??e.role??"unknown-user","apiKey"].join(`
-`);return`skills-layer-cli:api-key:${ol("sha256").update(t).digest("base64url").slice(0,32)}`}function kn(e){return e.store!==void 0?e.store:yn(e.platform,e.env??process.env)}function wn(e){return e.service??st}function cl(e){let t={...e,credentialStorage:"local_file_locked"};return delete t[Ne],t}function ul(){return{kind:"macos_keychain",async set(e,t,n){await hn("/usr/bin/security",["add-generic-password","-a",t,"-s",e,"-w",n,"-U"])},async get(e,t){try{let{stdout:n}=await hn("/usr/bin/security",["find-generic-password","-a",t,"-s",e,"-w"]);return n.trim()||null}catch{return null}},async delete(e,t){try{await hn("/usr/bin/security",["delete-generic-password","-a",t,"-s",e])}catch{}}}}function vn(e){let t=e.skillSlug??"<skill-slug>";return{localWork:{purpose:e.purpose,command:e.command,jsonCommand:e.jsonCommand},guardian:{checkCommand:`skills-layer guardian check --skill ${t} --json`,execCommand:`skills-layer guardian exec ${t} --json -- <command>`,mcpTools:["guardian.check","guardian.enforce","guardian.status","guardian.incident"],guidance:"Before risky shell, network, file, secret, browser, API, generated-code, or model-context actions, call MCP guardian.check/guardian.enforce or run skills-layer guardian check. Route shell actions through skills-layer guardian exec when strict local blocking is needed."},setup:{setupCommand:"skills-layer setup",hookStatusCommand:"skills-layer guardian hook status",hookInstallProjectCommand:"skills-layer guardian hook install --agent codex --scope project",hookInstallGlobalCommand:"skills-layer guardian hook install --agent codex --scope global"}}}var fr=`  ____  _    _ _ _       _
+`}function hR(e,t){return`${JSON.stringify({schemaVersion:"skills-layer.eval.pack.v1",artifactDigest:t,origin:"inferred",confidence:"starter",creatorReviewed:!1,redaction:{mode:"content_free"},cases:[{id:"starter-trigger-fit",title:"Skill has a clear trigger and usage path",assertions:[{type:"section_exists",target:"Examples"},{type:"section_exists",target:"Troubleshooting"},{type:"max_duration_ms",value:3e4}]}],notes:[`Review and expand this starter eval pack before submitting ${e.skillSlug}.`,"Keep prompts, fixtures, and expected private outputs out of cloud summaries."]},null,2)}
+`}function Ul(e){return e.split("-").map(t=>t.charAt(0).toUpperCase()+t.slice(1)).join(" ")}function yR(e){let t=Eg(e.category);return t||Ig({name:e.skillSlug,slug:e.skillSlug,description:e.description,skillType:e.skillType}).category}import{randomUUID as kR}from"node:crypto";import{constants as ct}from"node:fs";import{lstat as Ge,mkdir as Fs,mkdtemp as wR,open as Gl,realpath as Ds,readdir as vR,rename as ji,rm as jg}from"node:fs/promises";import{basename as Vl,dirname as qs,isAbsolute as bR,join as Xe,parse as Fg,posix as Dg,resolve as Ms,sep as qg}from"node:path";var Bg=16*1024*1024,SR=64*1024*1024,zl=typeof ct.O_NOFOLLOW=="number"?ct.O_NOFOLLOW:0;async function Mg(e){let t=await Vg(e);await Ut(t);let n=await Jl(t);return{exists:n.exists,files:n.files.map(i=>({path:i.relativePath,content:Buffer.from(i.bytes).toString("utf8")}))}}async function Kl(e){let t=await _R(e);if(t.plan.confirmationRequired&&!e.confirmed)return{status:"confirmation_required",plan:t.plan};let n=t.targetDir,i=qs(n);await Ut(i),await Fs(i,{recursive:!0}),await Ut(i);let r=await wR(Xe(i,`.${Vl(n)}.skills-layer-stage-`)),s=null,a=!0;try{t.tree.exists&&await RR(t.tree,r);for(let o of e.files)await CR(r,o);if(await xR(n,t.tree),!t.tree.exists)return await ji(r,n),a=!1,{status:"created",plan:t.plan};s=Xe(i,`.${Vl(n)}.skills-layer-backup-${kR()}`),await ji(n,s);try{await ji(r,n),a=!1}catch(o){throw await ji(s,n),s=null,o}return await jg(s,{recursive:!0,force:!0}),s=null,{status:"replaced",plan:t.plan}}finally{a&&await jg(r,{recursive:!0,force:!0}),s&&await IR(n,s)}}async function Hl(e,t=256*1024){let n=await Gg(Ms(e));if(await Ut(n),(await Ge(n)).isSymbolicLink())throw new Error(`Scaffold transaction refuses symbolic links: ${n}`);let r=await Ds(n);await Ut(r);let s=await Ug(r,t);return Buffer.from(s).toString("utf8")}async function _R(e){PR(e.files);let t=Ms(e.targetDir),n=await Vg(t);await Ut(n);let i=await Jl(n),r=new Map(i.files.map(l=>[l.relativePath,l])),s=new Set(i.directories.map(l=>l.relativePath)),a=e.files.map(l=>{let c=r.get(l.path);if(s.has(l.path))throw new Error(`Scaffold file ${l.path} conflicts with an existing directory.`);let d=Buffer.byteLength(l.content,"utf8");if(!c)return{path:l.path,action:"create",previousBytes:null,nextBytes:d};let p=Buffer.from(c.bytes).equals(Buffer.from(l.content,"utf8"));return{path:l.path,action:p?"unchanged":"replace",previousBytes:c.bytes.byteLength,nextBytes:d}}),o=i.files.length+i.directories.length;return{tree:i,targetDir:n,plan:{targetDir:t,targetExists:i.exists,confirmationRequired:i.exists&&o>0,preservedEntryCount:o,changes:a}}}function PR(e){let t=new Set;for(let i of e){if(AR(i.path),t.has(i.path))throw new Error(`Scaffold contains duplicate generated path ${i.path}.`);t.add(i.path)}let n=qt(e);if(!n.valid)throw new Error(`Scaffold bundle validation failed: ${n.issues.filter(i=>i.severity==="error").map(i=>`${i.code}: ${i.message}`).join("; ")}`)}function AR(e){if(e.length===0||e.includes("\\")||e.includes("\0")||bR(e)||Dg.normalize(e)!==e||e===".."||e.startsWith("../"))throw new Error(`Unsafe scaffold path: ${e}`)}async function Jl(e){let t;try{t=await Ge(e,{bigint:!0})}catch(a){if(Pn(a))return{exists:!1,identity:null,files:[],directories:[]};throw a}if(t.isSymbolicLink())throw new Error(`Scaffold transaction refuses symbolic links: ${e}`);if(!t.isDirectory())throw new Error(`Scaffold target must be a directory: ${e}`);let n=[],i=[],r=0,s=async(a,o)=>{let l=await Ge(a,{bigint:!0});if(l.isSymbolicLink())throw new Error(`Scaffold transaction refuses symbolic links: ${a}`);if(!l.isDirectory())throw new Error(`Scaffold target changed while it was inspected: ${a}`);let c=(await vR(a,{withFileTypes:!0})).sort((p,f)=>p.name.localeCompare(f.name));for(let p of c){let f=Xe(a,p.name),g=o?Dg.join(o,p.name):p.name,h=await Ge(f,{bigint:!0});if(h.isSymbolicLink())throw new Error(`Scaffold transaction refuses symbolic links: ${f}`);if(h.isDirectory()){i.push({relativePath:g,absolutePath:f}),await s(f,g);continue}if(!h.isFile())throw new Error(`Scaffold transaction refuses non-regular filesystem entries: ${f}`);let m=Number(h.size);if(m>Bg||r+m>SR)throw new Error("Existing scaffold target exceeds the bounded transaction copy limit.");let y=await Ug(f,Bg);r+=y.byteLength,n.push({relativePath:g,absolutePath:f,bytes:y})}let d=await Ge(a,{bigint:!0});if(d.dev!==l.dev||d.ino!==l.ino||!d.isDirectory())throw new Error(`Scaffold target changed while it was inspected: ${a}`)};return await s(e,""),{exists:!0,identity:{dev:t.dev,ino:t.ino},files:n,directories:i}}async function Ug(e,t){let n=await Gl(e,ct.O_RDONLY|zl);try{let i=await n.stat();if(!i.isFile())throw new Error(`Expected a regular file: ${e}`);if(i.size>t)throw new Error(`File exceeds the bounded read limit: ${e}`);return new Uint8Array(await n.readFile())}finally{await n.close()}}async function RR(e,t){for(let n of e.directories)await Fs(Xe(t,...n.relativePath.split("/")),{recursive:!0});for(let n of e.files){let i=Xe(t,...n.relativePath.split("/"));await Fs(qs(i),{recursive:!0}),await ER(i,n.bytes)}}async function CR(e,t){let n=Xe(e,...t.path.split("/"));await Fs(qs(n),{recursive:!0});let i=await Gl(n,ct.O_WRONLY|ct.O_CREAT|ct.O_TRUNC|zl,384);try{await i.writeFile(t.content,"utf8"),await i.sync()}finally{await i.close()}}async function ER(e,t){let n=await Gl(e,ct.O_WRONLY|ct.O_CREAT|ct.O_EXCL|zl,384);try{await n.writeFile(t)}finally{await n.close()}}async function Ut(e){let t=Ms(e),n=Fg(t).root,i=t.slice(n.length).split(qg).filter(Boolean),r=n;for(let s of i){r=Xe(r,s);try{if((await Ge(r)).isSymbolicLink())throw new Error(`Scaffold transaction refuses symbolic links: ${r}`)}catch(a){if(Pn(a))return;throw a}}}async function Vg(e){let t=await Gg(Ms(e));await Ut(t);try{if((await Ge(t)).isSymbolicLink())throw new Error(`Scaffold transaction refuses symbolic links: ${t}`);return await Ds(t)}catch(s){if(!Pn(s))throw s}let n=[],i=t;for(;;)try{await Ge(i);break}catch(s){if(!Pn(s))throw s;let a=qs(i);if(a===i)throw new Error(`Unable to resolve scaffold target parent: ${t}`);n.unshift(Vl(i)),i=a}let r=await Ds(i);return Xe(r,...n)}async function Gg(e){let t=Fg(e).root,n=e.slice(t.length).split(qg).filter(Boolean);if(n.length===0)return e;let i=Xe(t,n[0]);return(await Ge(i)).isSymbolicLink()?Xe(await Ds(i),...n.slice(1)):e}async function xR(e,t){let n=await Jl(e);if(n.exists!==t.exists)throw new Error("Scaffold target changed after preview; rerun creator init to review a fresh diff.");if(!t.exists)return;if(!t.identity||!n.identity||n.identity.dev!==t.identity.dev||n.identity.ino!==t.identity.ino)throw new Error("Scaffold target changed after preview; rerun creator init to review a fresh diff.");let i=t.directories.map(s=>s.relativePath),r=n.directories.map(s=>s.relativePath);if(i.join("\0")!==r.join("\0"))throw new Error("Scaffold target changed after preview; rerun creator init to review a fresh diff.");if(n.files.length!==t.files.length)throw new Error("Scaffold target changed after preview; rerun creator init to review a fresh diff.");for(let s=0;s<t.files.length;s+=1){let a=t.files[s],o=n.files[s];if(a.relativePath!==o.relativePath||!Buffer.from(a.bytes).equals(Buffer.from(o.bytes)))throw new Error("Scaffold target changed after preview; rerun creator init to review a fresh diff.")}}async function IR(e,t){try{await Ge(t)}catch(n){if(Pn(n))return;throw n}try{await Ge(e)}catch(n){if(Pn(n)){await ji(t,e);return}throw n}throw new Error(`Scaffold backup requires manual recovery: ${t}`)}function Pn(e){return typeof e=="object"&&e!==null&&"code"in e&&e.code==="ENOENT"}import{resolve as zg}from"node:path";async function Wl(e){if(e.skip&&(e.explicitIdentifier||e.explicitLicenseFile))throw new Error("--skip-license cannot be combined with --license or --license-file.");if(e.explicitLicenseFile&&!e.explicitIdentifier)throw new Error("--license-file requires --license <SPDX-or-LicenseRef-identifier>.");if(e.skip)return{selection:{mode:"skip"},source:"skip"};if(e.explicitIdentifier){let r=Sn(e.explicitIdentifier);if(e.explicitLicenseFile)return{selection:{mode:"custom",identifier:r,text:await Hl(zg(e.cwd,e.explicitLicenseFile)),filePath:"LICENSE"},source:"explicit_import"};if(!Li(r))throw new Error(`--license ${r} requires --license-file because Skills Layer will not invent or guess terms.`);return{selection:{mode:"template",identifier:r},source:"explicit_template"}}let t=TR(e.files??[]);if(t?.status==="verified")return{selection:Kg(t),source:"existing"};if(!e.interactive||!e.prompt)return{selection:{mode:"skip"},source:"skip"};let n=[];t?.status==="confirmation_required"&&t.detectedIdentifier&&t.text&&t.filePath&&n.push({value:`existing:${t.detectedIdentifier}`,label:`Confirm detected ${t.detectedIdentifier} terms`,description:`Preserve ${t.filePath} byte-for-byte and bind its detected identifier.`}),n.push({value:"template:MIT",label:"Use the approved MIT template",description:"Creator-selected immutable standard template; review and replace placeholders before publication."},{value:"import",label:"Import my exact terms",description:"Supply an SPDX/LicenseRef identifier and a local text file; Skills Layer will not alter it."},{value:"skip",label:"Skip for now",description:"Continue with a visible, non-blocking license_missing warning."});let i=await e.prompt.select("Choose optional creator licence terms:",n);if(!i||i==="skip")return{selection:{mode:"skip"},source:"skip"};if(i.startsWith("existing:")&&t?.text&&t.filePath)return{selection:Kg(t),source:"existing"};if(i==="template:MIT")return{selection:{mode:"template",identifier:"MIT"},source:"interactive_template"};if(i==="import"){let r=Sn(await e.prompt.text("SPDX or LicenseRef-* identifier: ")),s=(await e.prompt.text("Path to the exact licence terms file: ")).trim();if(!s)throw new Error("A licence terms file path is required for import.");return{selection:{mode:"custom",identifier:r,text:await Hl(zg(e.cwd,s)),filePath:"LICENSE"},source:"interactive_import"}}throw new Error("Unsupported creator licence selection.")}function Hg(e,t){let n=e.filter(s=>/(^|\/)SKILL\.md$/u.test(s.path)&&typeof s.content=="string");if(n.length!==1||!n[0]?.content)throw new Error("Licence remediation requires exactly one readable SKILL.md file.");let i=t.mode==="template"?"LICENSE":t.filePath??"LICENSE",r=t.mode==="template"?bn(t.identifier):t.text;return[{path:n[0].path,content:mg(n[0].content,t.identifier,i)},{path:i,content:r}]}function TR(e){let t=e.filter(n=>/(^|\/)SKILL\.md$/u.test(n.path)&&typeof n.content=="string");if(t.length!==1||!t[0]?.content)return null;try{return Ls(e,$s(t[0].content).frontmatter)}catch{return null}}function Kg(e){if(!e.identifier&&!e.detectedIdentifier)throw new Error("Existing licence selection requires a creator-confirmed identifier.");if(!e.text||!e.filePath)throw new Error("Existing licence selection requires exact in-bundle terms.");return{mode:"existing",identifier:e.identifier??e.detectedIdentifier,text:e.text,filePath:e.filePath}}var Jg={maxPatternBytes:512,maxWildcards:8},$R=new Set(["[","]","(",")","{","}","+","?","|"]);function Bi(e,t=Jg){if(typeof e!="string"||e.length===0||Buffer.byteLength(e,"utf8")>t.maxPatternBytes||!Number.isSafeInteger(t.maxWildcards)||t.maxWildcards<0)return An();let n=e.startsWith("^"),i=e.endsWith("$")&&!LR(e,e.length-1),r=n?1:0,s=i?e.length-1:e.length;if(r>=s)return An();let a=[""],o=0,l=!1;for(let c=r;c<s;c+=1){let d=e[c];if(l){a[a.length-1]+=d,l=!1;continue}if(d==="\\"){l=!0;continue}if(d==="*"){if(a[a.length-1]===""&&a.length>1)continue;if(o+=1,o>t.maxWildcards)return An();a.push("");continue}if($R.has(d)||d==="^"||d==="$"||d.charCodeAt(0)<32||d.charCodeAt(0)===127)return An();a[a.length-1]+=d}return l||a.every(c=>c.length===0)?An():{valid:!0,anchoredStart:n,anchoredEnd:i,segments:a,wildcardCount:o}}function Wg(e,t,n=Jg){let i=Bi(t,n);if(!i.valid)return{matched:!1,reasonCode:"unsafe_pattern"};let{segments:r,anchoredStart:s,anchoredEnd:a,wildcardCount:o}=i;if(o===0){let c=r[0];return s&&a?{matched:e===c}:s?{matched:e.startsWith(c)}:a?{matched:e.endsWith(c)}:{matched:e.includes(c)}}let l=0;for(let c=0;c<r.length;c+=1){let d=r[c];if(d.length===0)continue;let p=c===0,f=c===r.length-1;if(p&&s){if(!e.startsWith(d))return{matched:!1};l=d.length;continue}if(f&&a)return{matched:e.length-d.length>=l&&e.endsWith(d)};let g=e.indexOf(d,l);if(g<0)return{matched:!1};l=g+d.length}return{matched:!0}}function LR(e,t){let n=0;for(let i=t-1;i>=0&&e[i]==="\\";i-=1)n+=1;return n%2===1}function An(){return{valid:!1,reasonCode:"unsafe_pattern"}}var St=Object.freeze({schemaVersion:"skills-layer.eval.resource-policy.v1",maxPackBytes:256*1024,maxNestingDepth:16,maxObjectKeys:4096,maxCases:64,maxAssertions:512,maxPatternBytes:512,maxPatternWildcards:8,maxPathBytes:512,maxFiles:256,maxFileBytes:1024*1024,maxScannedBytes:8*1024*1024,maxJsonDepth:32,maxJsonKeys:4096,maxDurationMs:5e3,maxResultBytes:256*1024});function Us(e,t=St){let n=Zg(e,{maxBytes:t.maxPackBytes,maxDepth:t.maxNestingDepth,maxKeys:t.maxObjectKeys,rootPath:"$"});if(!n.valid)return n;if(!Yl(e))return Ce("invalid_pack","eval-pack-invalid","$","Eval pack must be an object");let i=e.cases;if(Array.isArray(i)&&i.length>t.maxCases)return Ce("resource_limit","eval-pack-case-limit","$.cases","Eval case count exceeds the checked resource policy.");let r=0;if(Array.isArray(i))for(let s=0;s<i.length;s+=1){let a=i[s];if(!(!Yl(a)||!Array.isArray(a.assertions))){if(r+=a.assertions.length,r>t.maxAssertions)return Ce("resource_limit","eval-pack-assertion-limit",`$.cases[${s}].assertions`,"Eval assertion count exceeds the checked resource policy.");for(let o=0;o<a.assertions.length;o+=1){let l=a.assertions[o];if(!Yl(l))continue;let c=`$.cases[${s}].assertions[${o}]`;if(l.type==="regex_match"&&!Bi(l.pattern,{maxPatternBytes:t.maxPatternBytes,maxWildcards:t.maxPatternWildcards}).valid)return Ce("unsafe_pattern","eval-pack-unsafe-pattern",`${c}.pattern`,"Eval pattern is outside the bounded literal/glob language.");if(l.path!==void 0&&!Xg(l.path,t.maxPathBytes))return Ce("invalid_pack","eval-pack-target-path-invalid",`${c}.path`,"Eval target must be a bounded portable relative path.")}}}return{valid:!0,outcome:"valid",issues:[]}}function Vs(e,t=St){if(!Array.isArray(e)||e.length>t.maxFiles)return Ce("resource_limit","eval-file-count-limit","$files","Eval file count exceeds the checked resource policy.");let n=0,i=new Set;for(let r=0;r<e.length;r+=1){let s=e[r];if(!s||!Xg(s.path,t.maxPathBytes)||i.has(Yg(s.path)))return Ce("invalid_pack","eval-file-path-invalid",`$files[${r}].path`,"Eval file paths must be unique bounded portable relative paths.");i.add(Yg(s.path));let a=Buffer.byteLength(s.content??"","utf8");if(a>t.maxFileBytes)return Ce("resource_limit","eval-file-byte-limit",`$files[${r}]`,"Eval target file exceeds the per-file byte limit.");if(n+=a,n>t.maxScannedBytes)return Ce("resource_limit","eval-scan-byte-limit","$files","Eval target bytes exceed the cumulative scan limit.")}return{valid:!0,outcome:"valid",issues:[]}}function Zl(e,t=St){return Zg(e,{maxBytes:t.maxFileBytes,maxDepth:t.maxJsonDepth,maxKeys:t.maxJsonKeys,rootPath:"$json"})}function Zg(e,t){let n=new WeakSet,i=[{value:e,depth:0,path:t.rootPath}],r=0,s=0;for(;i.length>0;){let a=i.pop();if(a.depth>t.maxDepth)return Ce("resource_limit","eval-nesting-limit",a.path,"Eval input exceeds the nesting-depth limit.");if(typeof a.value=="string")r+=Buffer.byteLength(a.value,"utf8");else if(typeof a.value=="number"||typeof a.value=="boolean")r+=String(a.value).length;else if(a.value===null)r+=4;else if(typeof a.value=="object"){if(n.has(a.value))return Ce("invalid_pack","eval-cycle-invalid",a.path,"Eval input must be acyclic JSON data.");if(n.add(a.value),Array.isArray(a.value)){s+=a.value.length;for(let o=a.value.length-1;o>=0;o-=1)i.push({value:a.value[o],depth:a.depth+1,path:`${a.path}[${o}]`})}else for(let[o,l]of Object.entries(a.value))s+=1,r+=Buffer.byteLength(o,"utf8"),i.push({value:l,depth:a.depth+1,path:`${a.path}.${o}`})}else if(a.value!==void 0)return Ce("invalid_pack","eval-json-type-invalid",a.path,"Eval input must contain JSON-compatible values only.");if(s>t.maxKeys||r>t.maxBytes)return Ce("resource_limit","eval-byte-or-key-limit",a.path,"Eval input exceeds the checked byte or key limit.")}return{valid:!0,outcome:"valid",issues:[]}}function Xg(e,t){return typeof e!="string"||e.length===0||Buffer.byteLength(e,"utf8")>t||e.includes("\\")||e.includes("\0")||e.startsWith("/")||/^[A-Za-z]:/u.test(e)?!1:e.split("/").every(i=>i.length>0&&i!=="."&&i!=="..")}function Yg(e){return e.normalize("NFC").toLowerCase()}function Yl(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Ce(e,t,n,i){return{valid:!1,outcome:e,issues:[{code:t,path:n,message:i}]}}function Qg(e={}){let t=e.maxScannedBytes??St.maxScannedBytes;if(!Number.isSafeInteger(t)||t<0)throw new Error("Eval scan budget must be a non-negative safe integer.");return{maxScannedBytes:t,scannedBytes:0}}function zs(e,t){switch(e.type){case"file_exists":return Xl(t.files,Vt(e.path))?Rn("file_exists"):je("file_missing");case"json_valid":return OR(e,t);case"section_exists":return NR(e,t);case"regex_match":return jR(e,t);case"schema_match":return BR(e,t);case"artifact_valid":return FR(e,t);case"max_duration_ms":return Be("runner_unavailable");case"command_exit":return Be("runner_unavailable");default:return Be("assertion_type_unsupported")}}function OR(e,t){let n=Xl(t.files,Vt(e.path));if(!n)return je("file_missing");let i=Fi(n,t);if(!i.ok)return Be("resource_limit");try{let r=JSON.parse(i.content);return Zl(r).valid?Rn("json_valid"):Be("resource_limit")}catch{return je("json_invalid")}}function NR(e,t){let n=Vt(e.target);if(!n)return je("section_target_missing");for(let i of t.files){let r=Fi(i,t);if(!r.ok)return Be("resource_limit");if(r.content.split(/\r?\n/u).some(s=>DR(s,n)))return Rn("section_exists")}return je("section_missing")}function jR(e,t){let n=Vt(e.pattern);if(!n)return je("regex_missing");if(!Bi(n).valid)return Be("unsafe_pattern");let i=Vt(e.path),r=i?t.files.filter(s=>Gs(s.path)===Gs(i)):t.files;for(let s of r){let a=Fi(s,t);if(!a.ok)return Be("resource_limit");if(Wg(a.content,n).matched)return Rn("regex_matched")}return je("regex_not_matched")}function BR(e,t){let n=Xl(t.files,Vt(e.path));if(!n)return je("file_missing");let i=Fi(n,t);if(!i.ok)return Be("resource_limit");let r;try{r=JSON.parse(i.content)}catch{return je("json_invalid")}return Zl(r).valid?qR(r)?(Array.isArray(e.requiredKeys)?e.requiredKeys.map(String):[]).every(a=>Object.prototype.hasOwnProperty.call(r,a))?Rn("schema_matched"):je("schema_required_key_missing"):je("schema_target_not_object"):Be("resource_limit")}function FR(e,t){let n=Vs(t.files);if(!n.valid)return Be(n.outcome);for(let i of t.files)if(!Fi(i,t).ok)return Be("resource_limit");return Re(t.files)===Vt(e.artifactDigest)?Rn("artifact_digest_matched"):je("artifact_digest_mismatch")}function Xl(e,t){if(!t)return;let n=Gs(t);return e.find(i=>Gs(i.path)===n)}function Vt(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function Gs(e){return e.replaceAll("\\","/").replace(/^\.\//u,"")}function Fi(e,t){let n=e.content??"",i=Buffer.byteLength(n,"utf8");if(i>St.maxFileBytes)return{ok:!1};if(t.scanBudget){if(t.scanBudget.scannedBytes+i>t.scanBudget.maxScannedBytes)return{ok:!1};t.scanBudget.scannedBytes+=i}return{ok:!0,content:n}}function DR(e,t){let n=e.trimStart(),i=0;for(;n[i]==="#";)i+=1;return i===0||n[i]!==" "?!1:n.slice(i+1).trim().localeCompare(t.trim(),void 0,{sensitivity:"accent"})===0}function qR(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Rn(e){return{status:"passed",reasonCode:e}}function je(e){return{status:"failed",reasonCode:e}}function Be(e){return{status:"skipped",reasonCode:e}}import{createHash as MR}from"node:crypto";var UR=["submitted","inferred","submitted_plus_inferred"],VR=["starter","reviewed","verified"],GR=["file_exists","json_valid","schema_match","section_exists","regex_match","command_exit","artifact_valid","max_duration_ms"],zR=new Set(UR),KR=new Set(VR),HR=new Set(GR);function Hs(e){let t=Us(e);if(!t.valid)return{valid:!1,issues:t.issues};let n=[],i=e;return i.schemaVersion!=="skills-layer.eval.pack.v1"&&n.push(Fe("eval-pack-schema-invalid","$.schemaVersion","Eval pack schemaVersion is unsupported")),(typeof i.artifactDigest!="string"||!/^sha256:[a-f0-9]{64}$/u.test(i.artifactDigest))&&n.push(Fe("eval-pack-artifact-digest-invalid","$.artifactDigest","Eval pack must target a sha256 artifact digest")),(typeof i.origin!="string"||!zR.has(i.origin))&&n.push(Fe("eval-pack-origin-invalid","$.origin","Eval pack origin is not canonical")),(typeof i.confidence!="string"||!KR.has(i.confidence))&&n.push(Fe("eval-pack-confidence-invalid","$.confidence","Eval pack confidence is not canonical")),typeof i.creatorReviewed!="boolean"&&n.push(Fe("eval-pack-review-invalid","$.creatorReviewed","Eval pack must state whether the creator reviewed it")),(!Ks(i.redaction)||i.redaction.mode!=="content_free")&&n.push(Fe("eval-pack-redaction-invalid","$.redaction.mode","Eval pack must use content_free redaction by default")),!Array.isArray(i.cases)||i.cases.length===0?n.push(Fe("eval-pack-cases-invalid","$.cases","Eval pack must include at least one case")):JR(i.cases,n),{valid:n.length===0,issues:n}}function Cn(e){return`sha256:${MR("sha256").update(WR(e)).digest("hex")}`}function JR(e,t){let n=new Set;e.forEach((i,r)=>{let s=`$.cases[${r}]`;if(!Ks(i)){t.push(Fe("eval-pack-case-invalid",s,"Eval case must be an object"));return}if(typeof i.id!="string"||i.id.trim().length===0?t.push(Fe("eval-pack-case-id-invalid",`${s}.id`,"Eval case id is required")):n.has(i.id)?t.push(Fe("eval-pack-case-id-duplicate",`${s}.id`,"Eval case ids must be unique")):n.add(i.id),!Array.isArray(i.assertions)||i.assertions.length===0){t.push(Fe("eval-pack-assertions-invalid",`${s}.assertions`,"Eval case must include assertions"));return}i.assertions.forEach((a,o)=>{let l=`${s}.assertions[${o}]`;(!Ks(a)||typeof a.type!="string"||!HR.has(a.type))&&t.push(Fe("eval-pack-assertion-type-invalid",`${l}.type`,"Eval assertion type is not supported"))})})}function WR(e){return JSON.stringify(Ql(e))}function Ql(e){return Array.isArray(e)?e.map(Ql).sort(YR):Ks(e)?Object.fromEntries(Object.entries(e).filter(([t])=>t!=="evalPackDigest").sort(([t],[n])=>t.localeCompare(n)).map(([t,n])=>[t,Ql(n)])):e}function YR(e,t){return JSON.stringify(e).localeCompare(JSON.stringify(t))}function Ks(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Fe(e,t,n){return{code:e,path:t,message:n}}function tm(e){let t=e.assertionsPassed+e.assertionsFailed,n={coverageRatio:em(e.evaluatedCapabilities,e.declaredCapabilities),passRate:t===0?0:em(e.assertionsPassed,t),freshnessFactor:XR(e),evidenceConfidence:e.evidenceConfidenceOverride===void 0?ZR(e):Js(Di(e.evidenceConfidenceOverride)),baselineDelta:Di(Math.max(0,e.baselineDelta??0)),telemetrySignal:Di(e.aggregationThresholdMet?e.telemetrySignal??0:0)},i=Js(n.coverageRatio*.25+n.passRate*.25+n.freshnessFactor*.15+n.evidenceConfidence*.2+n.baselineDelta*.05+n.telemetrySignal*.1);return{components:n,overallScore:i,effectiveScorePercent:eC(i*100),assertionsFailed:e.assertionsFailed,executedAssertions:t,aggregationThresholdMet:e.aggregationThresholdMet}}function nm(e){return e.executedAssertions===0&&e.components.coverageRatio===0?"unknown":e.components.freshnessFactor===0?"stale":e.assertionsFailed>0&&e.components.passRate<.8?"failing":e.overallScore>=.8&&e.components.coverageRatio>=.8&&e.components.passRate>=.9&&e.components.evidenceConfidence>=.7?"strong":e.aggregationThresholdMet&&e.components.telemetrySignal>=.7?"telemetry-backed":"limited"}function ZR(e){let t=e.origin==="submitted"?.65:e.origin==="submitted_plus_inferred"?.55:.25,n=e.creatorReviewed?.15:0,i=Math.min(e.runCount*.03,.15),r=Math.min(new Set(e.runnerTypes).size*.04,.1),s=e.aggregationThresholdMet?.1:0;return Js(Di(t+n+i+r+s))}function XR(e){if(e.freshnessPolicy==="never")return 1;if(!e.generatedAt||!e.now)return 0;let t=Date.parse(e.generatedAt),n=Date.parse(e.now);if(!Number.isFinite(t)||!Number.isFinite(n)||n<t)return 0;let i=QR(e.freshnessPolicy);return n-t<=i?1:0}function QR(e){return e==="3_months"?2160*60*60*1e3:e==="6_months"?4392*60*60*1e3:365*24*60*60*1e3}function em(e,t){return t<=0?0:Js(Di(e/t))}function Di(e){return Math.max(0,Math.min(1,e))}function Js(e){return Math.round(e*1e4)/1e4}function eC(e){return Math.round(e*10)/10}var ec=["passed","failed","not_run","generated_only","policy_skipped","runner_unavailable"],ej=new Set(ec);function En(e){return{schemaVersion:"skills-layer.eval.summary.v1",status:e.status,skillSlug:e.skillSlug,version:e.version,...e.generationId?{generationId:e.generationId}:{},artifactDigest:e.artifactDigest,...e.evalPackDigest?{evalPackDigest:e.evalPackDigest}:{},...e.runnerVersion?{runnerVersion:e.runnerVersion}:{},generatedAt:e.generatedAt,...e.counts?{counts:e.counts}:{},redaction:{mode:"content_free",rawContentIncluded:!1}}}function im(e){let t=Re(e),n=ql(e),i=e.map(l=>Mt(l.path,e)).filter(l=>l.type==="evidence"),r=tC(e),s=r?"submitted":"inferred",a=tm({declaredCapabilities:4,evaluatedCapabilities:r?2:1,assertionsPassed:0,assertionsFailed:0,assertionsSkipped:0,origin:s,creatorReviewed:!1,runCount:0,runnerTypes:["dry"],aggregationThresholdMet:!1,freshnessPolicy:"never"}),o=nm(a);return{schemaVersion:"skills-layer.eval.readiness.v1",status:o,label:o,artifactDigest:t,origin:s,confidence:"starter",creatorReviewed:!1,runtimeFileCount:n.length,evidenceFileCount:i.length,excludedEvidencePaths:i.map(l=>l.path),score:{overallScore:a.overallScore,effectiveScorePercent:a.effectiveScorePercent,components:a.components},summaryEnvelope:{requiredOnSubmit:!0,statuses:[...ec]},nextAction:"creator.submit",nextStep:"creator submit must attach a mandatory redacted eval summary envelope."}}function tC(e){return e.map(t=>Mt(t.path,e)).some(t=>t.type==="evidence"&&(t.relativePath.startsWith("evals/")||t.relativePath.endsWith(".eval.json")||t.relativePath.endsWith(".eval.yaml")))}function rm(e){if(e.activationState!=="inactive_staging")return Ws("invalid_pack","inactive_staging_required","$activationState","Static Eval must run before activation in an inactive staging tree.");let t=Us(e.pack);if(!t.valid)return{outcome:t.outcome,reasonCode:t.issues[0]?.code??t.outcome,issues:t.issues};let n=Hs(e.pack);if(!n.valid)return{outcome:"invalid_pack",reasonCode:n.issues[0]?.code??"invalid_pack",issues:n.issues};let i=Vs(e.files);if(!i.valid)return{outcome:i.outcome,reasonCode:i.issues[0]?.code??i.outcome,issues:i.issues};let r=e.pack,s=Re(e.files);if(r.artifactDigest!==s)return Ws("invalid_pack","artifact_digest_mismatch","$.artifactDigest","Eval pack is not bound to the staged runtime artifact.");let a=Qg(),o=r.cases.map(p=>({id:p.id,assertions:p.assertions.map(f=>zs(f,{files:e.files,scanBudget:a}))})),l=o.flatMap(p=>p.assertions).find(p=>p.reasonCode==="resource_limit"||p.reasonCode==="unsafe_pattern");if(l){let p=l.reasonCode;return Ws(p,p,"$cases","Static Eval stopped at the checked security boundary.")}let c=nC(o),d=En({status:c.failed>0?"failed":c.passed>0?"passed":"not_run",skillSlug:e.skillSlug,version:e.version,generationId:e.generationId,artifactDigest:s,evalPackDigest:Cn(e.pack),generatedAt:e.generatedAt,runnerVersion:e.runnerVersion,counts:{cases:o.length,assertions:c.total,passed:c.passed,failed:c.failed,skipped:c.skipped}});return Buffer.byteLength(JSON.stringify(d),"utf8")>St.maxResultBytes?Ws("resource_limit","eval-result-byte-limit","$result","Static Eval result exceeds the checked byte limit."):{outcome:"completed",result:{summary:d,cases:o}}}function nC(e){let t={total:0,passed:0,failed:0,skipped:0};for(let n of e)for(let i of n.assertions)t.total+=1,i.status==="passed"?t.passed+=1:i.status==="failed"?t.failed+=1:t.skipped+=1;return t}function Ws(e,t,n,i){return{outcome:e,reasonCode:t,issues:[{code:t,path:n,message:i}]}}var iC=/^github:([^/]+)\/([^/#]+)(?:\/([^#]+))?(?:#(.+))?$/,rC=/^gitlab:([^/#]+(?:\/[^/#]+)*?)\/([^/#]+)(?:\/([^/#]+))?(?:#(.+))?$/,sC=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)(?:\/(.+?))?(?:#([^@]+))?$/,aC=/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/.+)?(?:#[^@]+)?$/,oC=/^(?:\.{1,2}(?:[\\/]|$)|[\\/]|[A-Za-z]:[\\/])/,lC=/^(?:ssh:\/\/)?git@github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/,cC=/^(?:ssh:\/\/)?git@gitlab\.com[:/]([^/]+(?:\/[^/]+)*)\/([^/]+?)(?:\.git)?$/;function qi(e){let t=e.trim();if(t.length===0)throw new Error("import requires a non-empty source.");let{sourceInput:n,skillFilter:i}=uC(t),r=n.match(iC);if(r){let[,p,f,g,h]=r;return Ys({input:t,owner:p,repo:f,ref:h?.trim()||"main",subpath:g,skillFilter:i})}let s=n.match(rC);if(s){let[,p,f,g,h]=s;return tc({input:t,host:"gitlab.com",namespace:p,repo:f,ref:h?.trim()||"main",subpath:g,skillFilter:i})}let a=dC(t);if(a)return a;let o=pC(t);if(o)return o;let l=n.match(lC);if(l){let[,p,f]=l;return Ys({input:t,owner:p,repo:Qe(f),ref:"main",subpath:"SKILL.md"})}let c=n.match(cC);if(c){let[,p,f]=c;return tc({input:t,host:"gitlab.com",namespace:p,repo:Qe(f),ref:"main",subpath:"SKILL.md"})}if(/^(?:git\+)?https?:\/\//u.test(n)){if(/[?&]skill=/u.test(n)){let p=new URL(n.replace(/^git\+/u,"")),f=p.searchParams.get("skill")?.trim();return p.searchParams.delete("skill"),{kind:"url",input:t,url:p.toString(),canonicalSource:p.toString(),...f?{skillFilter:f}:{}}}return{kind:"url",input:t,url:n.replace(/^git\+/u,""),canonicalSource:n.replace(/^git\+/u,"")}}let d=n.match(sC);if(d&&!oC.test(n)){let[,p,f,g,h]=d;return Ys({input:t,owner:p,repo:Qe(f),ref:h?.trim()||"main",subpath:g,skillFilter:i})}return/^(?:ssh:\/\/)?git@/u.test(n)||/^(?:git\+)?ssh:\/\//u.test(n)?{kind:"git",input:t,url:n.replace(/^git\+/u,""),canonicalSource:n.replace(/^git\+/u,""),...i?{skillFilter:i}:{}}:{kind:"local",input:t,location:n,canonicalSource:n,...i?{skillFilter:i}:{}}}function Zs(e){let t=e?.trim();return t&&t.length>0?t:"SKILL.md"}function uC(e){if(e.startsWith("http://")||e.startsWith("https://")||e.startsWith("git@")||e.startsWith("ssh://"))return{sourceInput:e};let t=e.lastIndexOf("@");if(t<=0||t===e.length-1)return{sourceInput:e};let n=e.slice(0,t),i=e.slice(t+1).trim();return i.match(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u)?n.includes("#")?{sourceInput:n,skillFilter:i}:n.startsWith("github:")||n.startsWith("gitlab:")||aC.test(n)?{sourceInput:n,skillFilter:i}:{sourceInput:n,skillFilter:i}:{sourceInput:e}}function sm(e,t,n,i){return`${e}://${t}@${n}/${i}`}function Qe(e){return e.replace(/\.git$/u,"")}function dC(e){if(!e.startsWith("http://")&&!e.startsWith("https://"))return null;let t=new URL(e);if(t.hostname!=="github.com")return null;let n=t.pathname.split("/").filter(Boolean);if(n.length<2)throw new Error("GitHub URLs must include an owner and repository.");let i=n[0],r=Qe(n[1]),s="main",a="SKILL.md";(n[2]==="tree"||n[2]==="blob")&&(s=n[3]?.trim()||"main",a=Zs(n.slice(4).join("/")));let o=t.searchParams.get("skill")?.trim()||void 0;return t.searchParams.delete("skill"),Ys({input:e,owner:i,repo:r,ref:s,subpath:a,skillFilter:o})}function pC(e){if(!e.startsWith("http://")&&!e.startsWith("https://"))return null;let t=new URL(e);if(t.hostname==="github.com")return null;let n=t.pathname.split("/").filter(Boolean),i=n.indexOf("-");if(t.hostname!=="gitlab.com"&&i!==-1)throw new Error("Self-hosted GitLab sources are not supported for the public launch; use GitLab.com.");if(t.hostname!=="gitlab.com")return null;let r=i===-1?n:n.slice(0,i);if(r.length<2)throw new Error("GitLab URLs must include a namespace and repository.");let s=Qe(r[r.length-1]),a=r.slice(0,-1).join("/"),o=i===-1?void 0:n[i+1],l=i===-1?[]:n.slice(i+2),c=(o==="tree"||o==="blob")&&l[0]?.trim()||"main",d=o==="tree"||o==="blob"?Zs(l.slice(1).join("/")):"SKILL.md",p=t.searchParams.get("skill")?.trim()||void 0;return t.searchParams.delete("skill"),tc({input:e,host:t.hostname,namespace:a,repo:s,ref:c,subpath:d,skillFilter:p})}function Ys(e){let t=Zs(e.subpath);return{kind:"github",input:e.input,owner:e.owner,repo:Qe(e.repo),ref:e.ref,subpath:t,repoUrl:`https://github.com/${e.owner}/${Qe(e.repo)}`,rawUrl:`https://raw.githubusercontent.com/${e.owner}/${Qe(e.repo)}/${e.ref}/${t}`,canonicalSource:sm("github",`${e.owner}/${Qe(e.repo)}`,e.ref,t),...e.skillFilter?{skillFilter:e.skillFilter}:{}}}function tc(e){let t=Qe(e.repo),n=Zs(e.subpath);return{kind:"gitlab",input:e.input,host:e.host,namespace:e.namespace,repo:t,ref:e.ref,subpath:n,repoUrl:`https://${e.host}/${e.namespace}/${t}`,rawUrl:`https://${e.host}/${e.namespace}/${t}/-/raw/${e.ref}/${n}`,canonicalSource:sm("gitlab",`${e.namespace}/${t}`,e.ref,n),...e.skillFilter?{skillFilter:e.skillFilter}:{}}}import{constants as am}from"node:fs";import{lstat as ea,open as fC,opendir as gC,realpath as lm}from"node:fs/promises";import{dirname as cm,isAbsolute as ic,parse as um,relative as Mi,resolve as Ui,sep as dm}from"node:path";var q=class extends Error{code;issueCodes;constructor(t,n=[]){super(`Local bundle rejected (${t}).`),this.name="LocalBundleIntakeError",this.code=t,this.issueCodes=[...new Set(n)].sort((i,r)=>i.localeCompare(r))}},mC=32*1024,hC=64*1024;async function xn(e){let t=yC(e.limits),n=kC(e.maxTraversalEntries,t.maxFiles),i=Ui(e.cwd),r=Ui(i,e.sourcePath);await wC(i,e.sourcePath,r);let s=await hm(r);rc(s);let a=await om(r),o=s.isDirectory()?a:await om(cm(r));sc(o,a);let l={rootRealPath:o,limits:t,maxTraversalEntries:n,traversalEntries:0,fileCount:0,declaredTotalBytes:0,skillsIgnore:"",excludePath:Ja(),files:[],excluded:[],hooks:e.hooks};if(s.isFile()){let p=CC(r),f=l.excludePath(p);f?l.excluded.push({path:p,reason:f}):await gm(r,p,s,l)}else await SC(r,s,l);let c;try{c=Lt({files:l.files,skillsIgnore:l.skillsIgnore,limits:t})}catch{let p=$r({files:l.files,skillsIgnore:l.skillsIgnore,limits:t});throw new q("canonical_bundle_rejected",p.issues.map(f=>f.code))}if(c.files.length===0)throw new q("local_bundle_empty");let d=new Map;for(let p of[...l.excluded,...c.excluded])d.set(p.path,p);return{...c,excluded:[...d.values()].sort((p,f)=>p.path.localeCompare(f.path))}}function yC(e){let t={...Le,...e};return $r({files:[],limits:t,runDlp:!1}),t}function kC(e,t){let n=e??Math.max(256,t*8);if(!Number.isInteger(n)||n<=0)throw new q("local_traversal_budget_exceeded");return n}async function wC(e,t,n){let i=bC(e,t,n);for(let r=0;r<i.length;r+=1){let s=await hm(i[r]);if(s.isSymbolicLink()){if(vC(i[r],s,t,e,n,r))continue;throw new q("local_entry_symlink")}if(r<i.length-1&&!s.isDirectory())throw new q("local_entry_non_regular")}}function vC(e,t,n,i,r,s){if(process.platform==="win32"||!ic(n)||ac(Mi(i,r))||s!==0||t.uid!==0n)return!1;let a=um(e).root;return cm(e)===a}function bC(e,t,n){if(!ic(t))return nc(e,Mi(e,n));let i=Mi(e,n);if(ac(i))return nc(e,i);let r=um(n).root;return nc(r,Mi(r,n))}function nc(e,t){let n=[],i=e;for(let r of t.split(dm))!r||r==="."||(i=Ui(i,r),n.at(-1)!==i&&n.push(i));return n}async function SC(e,t,n){let i=await fm(e,t,n);if(i.includes(".skillsignore")){let r=Ui(e,".skillsignore"),s=await ym(r);if(rc(s),!s.isFile())throw new q("local_entry_non_regular");n.skillsIgnore=await mm(r,".skillsignore",s,mC,n);try{n.excludePath=Ja(n.skillsIgnore)}catch{throw new q("canonical_bundle_rejected",["skillsignore_invalid"])}n.files.push({path:".skillsignore",content:n.skillsIgnore})}await pm(e,t,i,"",n)}async function _C(e,t,n,i){let r=await fm(e,n,i);await pm(e,n,r,t,i)}async function pm(e,t,n,i,r){for(let s of n){let a=i?`${i}/${s}`:s;if(!i&&a===".skillsignore")continue;let o=r.excludePath(a);if(o){r.excluded.push({path:a.normalize("NFC"),reason:o});continue}RC(a,r.limits);let l=Ui(e,s);await r.hooks?.beforeEntryInspection?.({relativePath:a});let c=await ym(l);rc(c),await r.hooks?.afterEntryInspection?.({relativePath:a,kind:c.isDirectory()?"directory":"file"}),await Xs(l,c);let d={relativePath:a,kind:c.isDirectory()?"directory":"file"};await r.hooks?.afterEntryValidation?.(d);let p=await km(l);sc(r.rootRealPath,p),c.isDirectory()?await _C(l,a,c,r):await gm(l,a,c,r)}await Xs(e,t)}async function fm(e,t,n){let i;try{i=await gC(e)}catch{throw new q("local_entry_unreadable")}let r=[];try{for(;;){let s=await i.read();if(!s)break;if(n.traversalEntries+=1,n.traversalEntries>n.maxTraversalEntries)throw new q("local_traversal_budget_exceeded");r.push(s.name)}}catch(s){throw s instanceof q?s:new q("local_entry_unreadable")}finally{await i.close().catch(()=>{})}return await Xs(e,t),r.sort((s,a)=>s.localeCompare(a))}async function gm(e,t,n,i){if(i.fileCount+=1,i.fileCount>i.limits.maxFiles)throw new q("local_file_count_exceeded");if(n.size>BigInt(i.limits.maxFileBytes))throw new q("local_file_bytes_exceeded");let r=i.declaredTotalBytes+Number(n.size);if(!Number.isSafeInteger(r)||r>i.limits.maxTotalBytes)throw new q("local_total_bytes_exceeded");let s=await mm(e,t,n,i.limits.maxFileBytes,i);i.declaredTotalBytes=r,i.files.push({path:t,content:s})}async function mm(e,t,n,i,r){await Xs(e,n);let s=await km(e);sc(r.rootRealPath,s);let a={relativePath:t,kind:"file"};await r.hooks?.beforeFileOpen?.(a);let o;try{o=await fC(e,am.O_RDONLY|am.O_NOFOLLOW)}catch(l){throw new q(EC(l)?"local_entry_raced":"local_entry_unreadable")}try{let l=await o.stat({bigint:!0});if(!l.isFile())throw new q("local_entry_non_regular");if(!Qs(n,l))throw new q("local_entry_raced");await r.hooks?.afterFileOpen?.(a);let c=await PC(o,i),d=await o.stat({bigint:!0});if(!Qs(l,d)||BigInt(c.byteLength)!==d.size)throw new q("local_entry_raced");await r.hooks?.afterFileMetadataValidation?.(a),await AC(e,d);try{return new TextDecoder("utf-8",{fatal:!0}).decode(c)}catch{throw new q("local_entry_invalid_utf8")}}catch(l){throw l instanceof q?l:new q("local_entry_unreadable")}finally{await o.close().catch(()=>{})}}async function PC(e,t){let n=[],i=0;for(;;){let r=t+1-i,s=Buffer.allocUnsafe(Math.min(hC,r)),{bytesRead:a}=await e.read(s,0,s.byteLength,i);if(a===0)break;if(i+=a,i>t)throw new q("local_file_bytes_exceeded");n.push(s.subarray(0,a))}return Buffer.concat(n,i)}async function hm(e){try{return await ea(e,{bigint:!0})}catch{throw new q("local_entry_unreadable")}}async function ym(e){try{return await ea(e,{bigint:!0})}catch{throw new q("local_entry_unreadable")}}function rc(e){if(e.isSymbolicLink())throw new q("local_entry_symlink");if(!e.isDirectory()&&!e.isFile())throw new q("local_entry_non_regular")}async function Xs(e,t){let n;try{n=await ea(e,{bigint:!0})}catch{throw new q("local_entry_raced")}if(!Qs(t,n))throw new q("local_entry_raced")}async function AC(e,t){let n;try{n=await ea(e,{bigint:!0})}catch{throw new q("local_entry_raced")}if(!Qs(t,n))throw new q("local_entry_raced")}function Qs(e,t){return e.dev===t.dev&&e.ino===t.ino&&e.mode===t.mode&&e.size===t.size&&e.mtimeNs===t.mtimeNs&&e.ctimeNs===t.ctimeNs}async function om(e){try{return await lm(e)}catch{throw new q("local_entry_unreadable")}}async function km(e){try{return await lm(e)}catch{throw new q("local_entry_raced")}}function sc(e,t){if(!ac(Mi(e,t)))throw new q("local_entry_outside_root")}function ac(e){return e===""||!e.startsWith(`..${dm}`)&&e!==".."&&!ic(e)}function RC(e,t){if(e.split("/").length>t.maxDepth)throw new q("local_path_depth_exceeded");if(Buffer.byteLength(e,"utf8")>t.maxPathBytes)throw new q("local_path_length_exceeded")}function CC(e){let t=e.replaceAll("\\","/").split("/");return t[t.length-1]}function EC(e){return["ELOOP","ENOENT","ENOTDIR"].includes(String(e.code))}import{createHash as xC,randomUUID as Sm,timingSafeEqual as IC}from"node:crypto";import{constants as _t}from"node:fs";import{chmod as TC,lstat as At,mkdir as fc,mkdtemp as $C,open as ia,realpath as cc,readdir as LC,rename as Rt,rm as _m}from"node:fs/promises";import{basename as zt,dirname as ut,join as De,parse as ra,posix as oc,resolve as sa,sep as Vi}from"node:path";var OC=3e4,wm=5*6e4,Gi=/^sha256:[a-f0-9]{64}$/u,Pm=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u,Am=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u,NC=new TextEncoder().encode("SKILLS-LAYER-MANIFEST-V1\0"),aa=typeof _t.O_NOFOLLOW=="number"?_t.O_NOFOLLOW:0;async function Rm(e){let t=jC(e.preActivationTimeoutMs),n=ln({archiveBytes:e.archiveBytes,envelope:e.envelope});BC(e.approval,n);let i=cn({archiveBytes:e.archiveBytes,envelope:n});Cm(i);let r=sa(e.targetDir),s=await Tn(r);if(s===ra(s).root)throw new Error("Atomic install target cannot be a filesystem root.");if(zt(s)!==n.generation.skillSlug)throw new Error("Atomic install target basename must equal the approved skill slug.");let a=ut(s);await zi(a),await fc(a,{recursive:!0,mode:448}),await zi(a);let o=await ze(a,"Atomic install parent"),l=await mc(s),c=await $C(De(a,`.${zt(s)}.skills-layer-stage-`)),d=await ze(c,"Atomic install stage"),p=null,f=!1,g=!1;try{await Gt(e.checkpoint,"after_stage_created");for(let w of i)await FC(c,w),await Gt(e.checkpoint,"after_file_written");await In(c,n.manifest.files,d);let h=await MC({callback:e.preActivate,stageDir:c,files:n.manifest.files,timeoutMs:t});if(h.status!=="passed")throw new Error(`Static pre-activation Eval failed: ${h.reasonCode}`);await In(c,n.manifest.files,d),await vm(c,n.manifest.files),await Gt(e.checkpoint,"after_static_eval"),await In(c,n.manifest.files,d),await vm(c,n.manifest.files),await Pt(a,o,"Atomic install parent changed during staging."),await Nm(s,l),await Se(a),l.exists&&(p=De(a,`.${zt(s)}.skills-layer-backup-${Sm()}`),await Rt(s,p),f=!0,await Se(a),await Gt(e.checkpoint,"after_target_backed_up")),await Rt(c,s),g=!0,await Se(a),await Gt(e.checkpoint,"after_stage_activated");let m=QC({targetDir:r,generation:n.generation,archiveSha256:n.archive.sha256,manifestSha256:n.manifest.sha256,files:n.manifest.files}),y=await VC(p,a);return p=y.backupStillExists?p:null,{status:l.exists?"replaced":"created",receipt:m,staticEvaluation:h,cleanupPending:y.backupStillExists,...y.backupStillExists&&p?{cleanupPath:p}:{}}}catch(h){throw await UC({targetDir:s,stageDir:c,parentDir:a,backupDir:p,backupMoved:f,stageActivated:g,originalError:h}),h}}function Cm(e){if(e.some(t=>typeof t.path=="string"&&t.path!==t.path.normalize("NFC")))throw new Error("Portable install paths must use NFC Unicode normalization.");try{let t=Lt({files:e,runDlp:!1});if(t.excluded.length>0||t.files.length!==e.length)throw new Error("install-control or excluded paths are not deliverable files");for(let n=0;n<t.files.length;n+=1){let i=t.files[n],r=e.find(s=>s.path===i.path);if(!r||r.content!==i.content)throw new Error("portable normalization changed the approved file set")}}catch(t){throw new Error(`Portable install paths rejected: ${Bm(t)}`,{cause:t})}}async function Em(e){if(!Pm.test(e.reasonCode))throw new Error("Quarantine reason code is invalid.");gc(e.receipt);let t=await Tn(e.receipt.targetDir),n=ut(t);await zi(t);let i=await ze(n,"Atomic quarantine parent"),r=await Im(t,e.receipt),s=await Om(e.discoveryRoots),a=await Tn(e.quarantineRoot);uc({targetDir:t,quarantineRoot:a,discoveryRoots:s});let o=await Tm({callback:e.authorizeQuarantine,context:{receipt:e.receipt,targetDir:t,quarantineRoot:a,discoveryRoots:s,reasonCode:e.reasonCode},receipt:e.receipt,allowedPurposes:["quarantine_blocked","quarantine_revoked"]});await fc(a,{recursive:!0,mode:448}),await zi(a),await TC(a,448);let l=await dc(a,"External quarantine root");uc({targetDir:t,quarantineRoot:l,discoveryRoots:s});let c=await ze(l,"External quarantine root");if(c.dev!==i.dev)throw new Error("External quarantine root must be on the same filesystem for an atomic fail-closed move.");let d=De(l,`${zt(t)}.skills-layer-quarantine-${Sm()}`);await Pt(n,i,"Atomic quarantine parent changed."),await Pt(l,c,"External quarantine root changed."),await Pt(t,r,"Installed generation changed before quarantine."),await Rt(t,d);try{await Se(n),await Se(l),await In(d,e.receipt.files,r),await Gt(e.checkpoint,"after_quarantine_rename")}catch(p){throw await Rt(d,t),await Se(n),await Se(l),p}return Object.freeze({status:"quarantined",reasonCode:e.reasonCode,targetDir:e.receipt.targetDir,quarantineRoot:l,quarantineDir:d,discoveryRoots:Object.freeze([...s]),quarantineAuthorization:o,receipt:e.receipt})}async function xm(e){GC(e.quarantine);let t=await Tn(e.quarantine.receipt.targetDir),n=await Om(e.quarantine.discoveryRoots),i=await dc(e.quarantine.quarantineRoot,"External quarantine root"),r=await dc(e.quarantine.quarantineDir,"Quarantine tree"),s=ut(t);if(uc({targetDir:t,quarantineRoot:i,discoveryRoots:n}),ut(r)!==i||!zt(r).startsWith(`${zt(t)}.skills-layer-quarantine-`))throw new Error("Quarantine generation is outside its validated external quarantine root.");let a=await ze(s,"Atomic restore parent"),o=await ze(i,"External quarantine root"),l=await Im(r,e.quarantine.receipt),c=await mc(t);if(c.exists)throw new Error("Cannot restore quarantine because the install target already exists.");let d={receipt:e.quarantine.receipt,targetDir:t,quarantineRoot:i,quarantineDir:r,discoveryRoots:n,reasonCode:e.quarantine.reasonCode,quarantineAuthorization:e.quarantine.quarantineAuthorization},p=await Tm({callback:e.authorizeRestore,context:d,receipt:e.quarantine.receipt,allowedPurposes:["restore_fresh_approval"],forbiddenAuthorizationId:e.quarantine.quarantineAuthorization.authorizationId});await Pt(s,a,"Atomic restore parent changed."),await Pt(i,o,"External quarantine root changed."),await Pt(r,l,"Quarantine generation changed before restore."),await Nm(t,c),await Rt(r,t);try{await Se(s),await Se(i),await In(t,e.quarantine.receipt.files,l),await Gt(e.checkpoint,"after_restore_rename"),await zC(e.finalizeRestore,{...d,restoreAuthorization:p})}catch(f){throw await Rt(t,r),await Se(s),await Se(i),f}return e.quarantine.receipt}function jC(e){let t=e??OC;if(!Number.isInteger(t)||t<=0||t>wm)throw new Error(`Static pre-activation timeout must be an integer from 1 to ${wm} ms.`);return t}function BC(e,t){let n=e?.generation;if(e?.status!=="approved"||!n||n.skillSlug!==t.generation.skillSlug||n.semanticVersion!==t.generation.semanticVersion||n.generationId!==t.generation.generationId||!$n(e.archiveSha256,t.archive.sha256)||!$n(e.manifestSha256,t.manifest.sha256))throw new Error("Install denied: approved artifact identity does not match the verified deliverable.")}async function FC(e,t){let n=De(e,...t.path.split("/"));await DC(e,ut(n));let i=await ia(n,_t.O_WRONLY|_t.O_CREAT|_t.O_EXCL|aa,384);try{await i.writeFile(t.content,"utf8"),await i.sync()}finally{await i.close()}}async function DC(e,t){let n=t.slice(e.length).split(Vi).filter(Boolean),i=e;for(let r of n){i=De(i,r);try{await fc(i,{mode:448})}catch(a){if(!tE(a))throw a}let s=await At(i);if(s.isSymbolicLink())throw new Error(`Atomic install refuses a symbolic link in the staged tree: ${i}`);if(!s.isDirectory())throw new Error(`Atomic install staged path is not a directory: ${i}`)}}async function In(e,t,n){let i=await ze(e,"Install generation root");if(n&&!na(i,n))throw new Error("Install generation root changed during staging.");let r=new Map(t.map(c=>[c.path,c])),s=new Set;for(let c of t){let d=oc.dirname(c.path);for(;d!==".";)s.add(d),d=oc.dirname(d)}let a=new Set,o=new Set,l=async(c,d)=>{let p=await ze(c,"Install generation directory"),f=(await LC(c,{withFileTypes:!0})).sort((h,m)=>eE(h.name,m.name));for(let h of f){let m=De(c,h.name),y=d?oc.join(d,h.name):h.name,w=await At(m);if(w.isSymbolicLink())throw new Error(`Atomic install refuses a symbolic link in the generation tree: ${y}`);if(w.isDirectory()){if(!s.has(y))throw new Error(`Installed generation manifest has an unexpected directory: ${y}`);o.add(y),await l(m,y);continue}if(!w.isFile())throw new Error(`Atomic install refuses a non-regular generation entry: ${y}`);let v=r.get(y);if(!v)throw new Error(`Installed generation manifest has an unexpected file: ${y}`);let S=await qC(m,v.sizeBytes);if(S.sizeBytes!==v.sizeBytes||!$n(S.sha256,v.sha256))throw new Error(`Installed generation manifest mismatch for ${y}.`);a.add(y)}let g=await ze(c,"Install generation directory");if(!na(p,g))throw new Error(`Install generation directory changed while verified: ${d||"."}`)};if(await l(e,""),a.size!==t.length||o.size!==s.size)throw new Error("Installed generation manifest is incomplete.");return await Pt(e,i,"Install generation root changed while verified."),i}async function qC(e,t){let n=await ia(e,_t.O_RDONLY|aa);try{let i=await n.stat();if(!i.isFile())throw new Error(`Expected a regular installed generation file: ${e}`);if(i.size>t)throw new Error(`Installed generation file exceeds its approved size: ${e}`);let r=new Uint8Array(await n.readFile());return{sizeBytes:r.byteLength,sha256:jm(r)}}finally{await n.close()}}async function MC(e){let t=new AbortController,n,i=new Promise((r,s)=>{n=setTimeout(()=>{t.abort(),s(new Error(`Static pre-activation Eval timed out after ${e.timeoutMs} ms.`))},e.timeoutMs)});try{let r=await Promise.race([Promise.resolve().then(()=>e.callback({stageDir:e.stageDir,files:e.files,signal:t.signal})),i]);if(!r||r.status!=="passed"&&r.status!=="failed"||r.status==="passed"&&(typeof r.evidenceId!="string"||r.evidenceId.length===0)||r.status==="failed"&&(typeof r.reasonCode!="string"||r.reasonCode.length===0))throw new Error("Static pre-activation Eval returned an invalid result.");return r}finally{clearTimeout(n)}}async function vm(e,t){for(let i of t){let r=await ia(De(e,...i.path.split("/")),_t.O_RDONLY|aa);try{await r.sync()}finally{await r.close()}}let n=new Set([e]);for(let i of t){let r=ut(De(e,...i.path.split("/")));for(;r.startsWith(e)&&r!==ut(e)&&(n.add(r),r!==e);)r=ut(r)}for(let i of[...n].sort((r,s)=>s.length-r.length))await Se(i)}async function UC(e){try{e.stageActivated&&await Rt(e.targetDir,e.stageDir),e.backupMoved&&e.backupDir&&await Rt(e.backupDir,e.targetDir),await WC(e.stageDir),await Se(e.parentDir)}catch(t){let n=e.backupDir?` from ${e.backupDir}`:"";throw new Error(`Atomic install rollback requires manual recovery${n}.`,{cause:new AggregateError([e.originalError,t])})}}async function VC(e,t){if(!e)return{backupStillExists:!1};try{return await _m(e,{recursive:!0,force:!1}),await Se(t),{backupStillExists:!1}}catch(n){return Kt(n)?{backupStillExists:!1}:{backupStillExists:!0}}}async function Im(e,t){gc(t);try{return await In(e,t.files)}catch(n){throw new Error(`Installed generation manifest verification failed: ${Bm(n)}`,{cause:n})}}function gc(e){if(!e||typeof e.targetDir!="string"||!Gi.test(e.archiveSha256)||!Gi.test(e.manifestSha256)||!Array.isArray(e.files)||e.files.length===0)throw new Error("Installed generation receipt manifest is invalid.");let t=YC(e.files),n=e.files.map(i=>({path:i.path,content:""}));if(Cm(n),!$n(jm(t),e.manifestSha256))throw new Error("Installed generation receipt manifest digest is invalid.")}function GC(e){if(!e||e.status!=="quarantined"||!Pm.test(e.reasonCode)||typeof e.targetDir!="string"||typeof e.quarantineRoot!="string"||typeof e.quarantineDir!="string"||!Array.isArray(e.discoveryRoots)||e.discoveryRoots.length===0||!e.receipt||!$m(e.quarantineAuthorization)||e.quarantineAuthorization.purpose!=="quarantine_blocked"&&e.quarantineAuthorization.purpose!=="quarantine_revoked"||!Lm(e.quarantineAuthorization,e.receipt)||e.targetDir!==e.receipt?.targetDir)throw new Error("Quarantine record is invalid.");gc(e.receipt)}async function Tm(e){if(typeof e.callback!="function")throw new Error("Exact-generation authorization callback is required.");let t=await e.callback(e.context);if(t?.status==="denied")throw new Error(`Exact-generation authorization denied: ${t.reasonCode||"unspecified"}.`);if(!$m(t)||!e.allowedPurposes.includes(t.purpose)||!Lm(t,e.receipt)||t.authorizationId===e.forbiddenAuthorizationId)throw new Error("Exact-generation authorization is invalid, stale, reused, or bound to different bytes.");return KC(t)}async function zC(e,t){if(typeof e!="function")throw new Error("Restore release callback is required.");let n=await e(t);if(n?.status!=="released"||!Am.test(n.releaseId)){let i=n?.status==="denied"?n.reasonCode:"invalid_release_decision";throw new Error(`Restore release denied: ${i}.`)}}function $m(e){return typeof e=="object"&&e!==null&&"status"in e&&e.status==="authorized"&&"authorizationId"in e&&typeof e.authorizationId=="string"&&Am.test(e.authorizationId)&&"purpose"in e&&(e.purpose==="quarantine_blocked"||e.purpose==="quarantine_revoked"||e.purpose==="restore_fresh_approval"||e.purpose==="purge_quarantined")&&"generation"in e&&typeof e.generation=="object"&&e.generation!==null&&"archiveSha256"in e&&typeof e.archiveSha256=="string"&&"manifestSha256"in e&&typeof e.manifestSha256=="string"}function Lm(e,t){return e.generation.skillSlug===t.generation.skillSlug&&e.generation.semanticVersion===t.generation.semanticVersion&&e.generation.generationId===t.generation.generationId&&$n(e.archiveSha256,t.archiveSha256)&&$n(e.manifestSha256,t.manifestSha256)}function KC(e){return Object.freeze({...e,generation:Object.freeze({...e.generation})})}async function Om(e){if(!Array.isArray(e)||e.length===0||e.some(i=>typeof i!="string"||i.length===0))throw new Error("External quarantine requires the complete non-empty discovery root set.");let t=[],n=new Set;for(let i of e){let r=await Tn(i),s=ta(r);n.has(s)||(t.push(r),n.add(s))}return Object.freeze(t)}function uc(e){let t=ta(e.targetDir),n=ta(e.quarantineRoot),i=e.discoveryRoots.map(ta);if(!i.some(r=>t!==r&&lc(t,r)))throw new Error("Install target is not inside the authoritative discovery root set.");for(let r of i)if(lc(n,r)||lc(r,n))throw new Error("Quarantine root must be physically outside and non-overlapping with every discovery root.")}function ta(e){let t=sa(e).normalize("NFC"),n=ra(t).root,i=t===n?t:t.replace(/[\\/]+$/u,"");return process.platform==="linux"?i:i.toLocaleLowerCase("en-US")}function lc(e,t){return e===t||e.startsWith(t.endsWith(Vi)?t:`${t}${Vi}`)}async function mc(e){try{let t=await At(e,{bigint:!0});if(t.isSymbolicLink())throw new Error(`Atomic install refuses a symbolic link target: ${e}`);if(!t.isDirectory())throw new Error(`Atomic install target must be a directory: ${e}`);return{exists:!0,identity:{dev:t.dev,ino:t.ino}}}catch(t){if(Kt(t))return{exists:!1,identity:null};throw t}}async function Nm(e,t){let n=await mc(e);if(n.exists!==t.exists||t.identity!==null&&(n.identity===null||!na(t.identity,n.identity)))throw new Error("Atomic install target changed while the approved generation was staged.")}async function ze(e,t){let n=await At(e,{bigint:!0});if(n.isSymbolicLink())throw new Error(`${t} refuses a symbolic link: ${e}`);if(!n.isDirectory())throw new Error(`${t} must be a directory: ${e}`);return{dev:n.dev,ino:n.ino}}async function Pt(e,t,n){let i=await ze(e,"Atomic install identity check");if(!na(i,t))throw new Error(n)}function na(e,t){return e.dev===t.dev&&e.ino===t.ino}async function Tn(e){let t=await HC(sa(e));await zi(t);try{if((await At(t)).isSymbolicLink())throw new Error(`Atomic install refuses a symbolic link: ${t}`);return await cc(t)}catch(r){if(!Kt(r))throw r}let n=[],i=t;for(;;)try{await At(i);break}catch(r){if(!Kt(r))throw r;let s=ut(i);if(s===i)throw new Error(`Unable to resolve atomic install target parent: ${t}`);n.unshift(zt(i)),i=s}return De(await cc(i),...n)}async function dc(e,t){let n=await Tn(e);return await ze(n,t),n}async function HC(e){let t=ra(e).root,n=e.slice(t.length).split(Vi).filter(Boolean);if(n.length===0)return e;let i=De(t,n[0]),r;try{r=await At(i)}catch(s){if(Kt(s))return e;throw s}return r.isSymbolicLink()?De(await cc(i),...n.slice(1)):e}async function zi(e){let t=sa(e),n=ra(t).root,i=t.slice(n.length).split(Vi).filter(Boolean),r=n;for(let s of i){r=De(r,s);try{if((await At(r)).isSymbolicLink())throw new Error(`Atomic install refuses a symbolic link: ${r}`)}catch(a){if(Kt(a))return;throw a}}}async function Se(e){let t;try{t=await ia(e,_t.O_RDONLY|aa),await t.sync()}catch(n){if(!JC(n))throw n}finally{await t?.close()}}function JC(e){if(typeof e!="object"||e===null||!("code"in e))return!1;let t=e.code;return t==="EINVAL"||t==="ENOTSUP"||t==="EOPNOTSUPP"||process.platform==="win32"&&(t==="EPERM"||t==="EISDIR"||t==="EBADF")}async function WC(e){try{await _m(e,{recursive:!0,force:!1})}catch(t){if(!Kt(t))throw t}}async function Gt(e,t){await e?.(t)}function YC(e){let t=[NC,bm(e.length)];for(let n of e){if(typeof n.path!="string"||!Number.isSafeInteger(n.sizeBytes)||n.sizeBytes<0||!Gi.test(n.sha256))throw new Error("Installed generation receipt manifest entry is invalid.");let i=new TextEncoder().encode(n.path);t.push(bm(i.byteLength),i,ZC(n.sizeBytes),pc(n.sha256))}return XC(t)}function bm(e){let t=new Uint8Array(4);return new DataView(t.buffer).setUint32(0,e,!1),t}function ZC(e){let t=new Uint8Array(8);return new DataView(t.buffer).setBigUint64(0,BigInt(e),!1),t}function XC(e){let t=new Uint8Array(e.reduce((i,r)=>i+r.byteLength,0)),n=0;for(let i of e)t.set(i,n),n+=i.byteLength;return t}function QC(e){let t=Object.freeze({...e.generation}),n=Object.freeze(e.files.map(i=>Object.freeze({...i})));return Object.freeze({...e,generation:t,files:n})}function jm(e){return`sha256:${xC("sha256").update(e).digest("hex")}`}function $n(e,t){return typeof e=="string"&&Gi.test(e)&&Gi.test(t)&&IC(pc(e),pc(t))}function pc(e){return Buffer.from(e.slice(7),"hex")}function eE(e,t){return Buffer.compare(Buffer.from(e,"utf8"),Buffer.from(t,"utf8"))}function Bm(e){return e instanceof Error?e.message:String(e)}function Kt(e){return Fm(e)==="ENOENT"}function tE(e){return Fm(e)==="EEXIST"}function Fm(e){return typeof e=="object"&&e!==null&&"code"in e?e.code:void 0}import{spawn as wE}from"node:child_process";import{createHash as vE}from"node:crypto";import{constants as bE}from"node:fs";import{chmod as Hm,copyFile as SE,lstat as _E,mkdir as Vm,mkdtemp as PE,open as AE,realpath as Jm,rm as RE,stat as Wm}from"node:fs/promises";import{tmpdir as CE}from"node:os";import{extname as EE,join as la}from"node:path";import{createHash as nE,randomBytes as Rj}from"node:crypto";import{posix as iE,win32 as rE}from"node:path";var sE=new Set(["shell_execution","filesystem_read","filesystem_write","network_access","browser_access","device_control","api_access","generated_code_execution"]),aE=new Set(["darwin","linux","win32"]),oE=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,191}$/u,lE=/^[a-z0-9]+(?:-[a-z0-9]+)*$/u,cE=/^[0-9A-Za-z][0-9A-Za-z.+-]{0,127}$/u,Dm=/^sha256:[a-f0-9]{64}$/u,uE=/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u,dE=/^[^\u0000-\u001f\u007f]{1,4096}$/u;var pE=256,qm=64,fE=64;function gE(e){mE(e);let t=e.platform==="win32"?rE:iE,n={planVersion:1,actionFamily:e.actionFamily,platform:e.platform,executableRealPath:hc(e.executableRealPath,t),executableSha256:e.executableSha256,argv:Object.freeze([...e.argv]),cwdRealPath:hc(e.cwdRealPath,t),fileTargets:Object.freeze(e.fileTargets.map(i=>hc(i,t))),networkTargets:Object.freeze(e.networkTargets.map(yE)),environmentKeys:Object.freeze([...new Set(e.environmentKeys)].sort()),skill:Object.freeze({slug:e.skillSlug,version:e.version,generationId:e.generationId}),subject:Object.freeze({actorId:e.actorId,...e.deviceId===void 0?{}:{deviceId:e.deviceId},tenantId:e.tenantId,...e.workspaceId===void 0?{}:{workspaceId:e.workspaceId}}),host:Object.freeze({agentId:e.agentId,hostVersion:e.hostVersion,sessionId:e.sessionId}),policy:Object.freeze({revision:e.policyRevision,digest:e.policyDigest})};return Object.freeze(n)}function Um(e){return hE(e),kE(Ki(e))}function mE(e){(!aE.has(e.platform)||!sE.has(e.actionFamily)||!Dm.test(e.executableSha256))&&Ke(),(!Array.isArray(e.argv)||e.argv.length>pE||e.argv.some(t=>!oa(t)))&&Ke(),(!Array.isArray(e.fileTargets)||e.fileTargets.length>qm||!Array.isArray(e.networkTargets)||e.networkTargets.length>qm||!Array.isArray(e.environmentKeys)||e.environmentKeys.length>fE||e.environmentKeys.some(t=>!uE.test(t)))&&Ke(),(!lE.test(e.skillSlug)||!cE.test(e.version)||!Ln(e.generationId)||!Ln(e.actorId)||!Mm(e.deviceId)||!Ln(e.tenantId)||!Mm(e.workspaceId)||!Ln(e.agentId)||!oa(e.hostVersion)||!Ln(e.sessionId)||!Number.isSafeInteger(e.policyRevision)||e.policyRevision<=0||!Dm.test(e.policyDigest))&&Ke()}function hE(e){(typeof e!="object"||e===null||e.planVersion!==1)&&Ke();let t=gE({platform:e.platform,actionFamily:e.actionFamily,executableRealPath:e.executableRealPath,executableSha256:e.executableSha256,argv:[...e.argv],cwdRealPath:e.cwdRealPath,fileTargets:[...e.fileTargets],networkTargets:[...e.networkTargets],environmentKeys:[...e.environmentKeys],skillSlug:e.skill.slug,version:e.skill.version,generationId:e.skill.generationId,actorId:e.subject.actorId,...e.subject.deviceId===void 0?{}:{deviceId:e.subject.deviceId},tenantId:e.subject.tenantId,...e.subject.workspaceId===void 0?{}:{workspaceId:e.subject.workspaceId},agentId:e.host.agentId,hostVersion:e.host.hostVersion,sessionId:e.host.sessionId,policyRevision:e.policy.revision,policyDigest:e.policy.digest});Ki(t)!==Ki(e)&&Ke()}function hc(e,t){(!oa(e)||!t.isAbsolute(e))&&Ke();let n=t.normalize(e);return n!==e&&Ke(),n}function yE(e){oa(e)||Ke();let t;try{t=new URL(e)}catch{Ke()}return(t.protocol!=="https:"||t.username||t.password||t.hash||t.port&&t.port!=="443")&&Ke(),t.toString()}function Ke(){throw new Error("Guardian execution plan input is invalid or unresolved.")}function oa(e){return typeof e=="string"&&dE.test(e)}function Ln(e){return typeof e=="string"&&oE.test(e)}function Mm(e){return e===void 0||Ln(e)}function Ki(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(Ki).join(",")}]`:`{${Object.entries(e).filter(([,n])=>n!==void 0).sort(([n],[i])=>n<i?-1:1).map(([n,i])=>`${JSON.stringify(n)}:${Ki(i)}`).join(",")}}`}function kE(e){return`sha256:${nE("sha256").update(e,"utf8").digest("hex")}`}var xE=3e4,IE=50,TE=3e5,$E=64*1024,LE=256,OE=1024*1024,NE=256*1024*1024,Ym=64*1024,jE=250,BE="/usr/local/bin:/usr/bin:/bin",Zm=new Set(["LANG","LC_ALL","LC_CTYPE","TZ","TERM","COLORTERM","NO_COLOR"]),FE=new Set(["HOME","TMPDIR","TMP","TEMP","USERPROFILE","PATH","SystemRoot"]),DE=new Set(["darwin","linux","win32"]),qE=/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u,Y=class extends Error{constructor(n){super(`Guardian process refused execution: ${n}.`);this.reasonCode=n;this.name="GuardianProcessError"}reasonCode};async function Xm(e){let t=Km(e.timeoutMs??xE,IE,TE,"timeout"),n=Km(e.outputLimitBytes??$E,LE,OE,"output limit"),i=JE(process.platform);if(e.plan.platform!==i)throw new Y("platform_mismatch");let r=Um(e.plan),s=await UE(e.plan);await GE(e.plan.cwdRealPath);let a=zE(e.approvedSecrets??{},e.plan.environmentKeys),o=e.temporaryParent??CE(),l=await PE(la(o,"skills-layer-guardian-"));await Hm(l,448);let c=la(l,"home"),d=la(l,"tmp");await Promise.all([Vm(c,{mode:448}),Vm(d,{mode:448})]);try{let p=await VE(s,e.plan.executableSha256,l),f=KE({platform:i,plannedKeys:e.plan.environmentKeys,ambient:e.ambientEnvironment??process.env,approvedSecrets:a,isolatedHome:c,isolatedTemp:d});return e.signal?.aborted?Qm("aborted",r):(ME(i,e.treeTerminator),await HE({executable:p,argv:[...e.plan.argv],cwd:e.plan.cwdRealPath,environment:f,approvedSecrets:Object.values(a),timeoutMs:t,outputLimitBytes:n,signal:e.signal,platform:i,planHash:r,treeTerminator:e.treeTerminator}))}finally{await RE(l,{recursive:!0,force:!0})}}function Gm(e,t=[]){let n=e;for(let i of[...new Set(t)].sort((r,s)=>s.length-r.length))i.length>0&&(n=n.split(i).join("[SECRET_REDACTED]"));return n.replace(/-----BEGIN [^-\r\n]{1,64} PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]{1,64} PRIVATE KEY-----/gu,"[PRIVATE_KEY_REDACTED]").replace(/\b(?:mktplace_|slg_exec_|github_pat_|gh[opusr]_|sk-)[A-Za-z0-9_-]{8,}\b/gu,"[TOKEN_REDACTED]").replace(/\bAuthorization\s*:\s*(?:Bearer|Basic)\s+[^\s,;]+/giu,"Authorization: [REDACTED]").replace(/\b(password|passwd|secret|token|api[_-]?key)\s*[=:]\s*[^\s,;]+/giu,"$1=[REDACTED]").replace(/[^\t\n\r\u0020-\u007e\u00a0-\uffff]/gu,"\uFFFD")}function ME(e,t){if(e==="win32"&&!t)throw new Y("windows_process_tree_isolation_unavailable")}async function UE(e){let t=await Jm(e.executableRealPath).catch(()=>"");if(t!==e.executableRealPath)throw new Y("executable_path_changed");let[n,i]=await Promise.all([_E(t),Wm(t)]);if(!n.isFile())throw new Y("executable_not_regular_file");if(i.size<=0||i.size>NE)throw new Y("executable_size_invalid");if(e.platform!=="win32"&&(i.mode&73)===0)throw new Y("executable_not_executable");return t}async function VE(e,t,n){let i=la(n,`executable${EE(e)}`);await SE(e,i,bE.COPYFILE_EXCL),await Hm(i,320);let r=await AE(i,"r");try{let s=await r.readFile();if(await r.sync(),`sha256:${vE("sha256").update(s).digest("hex")}`!==t)throw new Y("executable_digest_changed")}finally{await r.close()}return i}async function GE(e){let t=await Jm(e).catch(()=>"");if(t!==e)throw new Y("working_directory_changed");if(!(await Wm(t)).isDirectory())throw new Y("working_directory_not_directory")}function zE(e,t){let n=new Set(t),i={};for(let[r,s]of Object.entries(e)){if(!qE.test(r)||!n.has(r)||FE.has(r)||Zm.has(r))throw new Y("secret_not_exactly_approved");if(typeof s!="string"||s.length===0||s.includes("\0")||Buffer.byteLength(s,"utf8")>Ym)throw new Y("secret_value_invalid");i[r]=s}return i}function KE(e){let t=e.platform==="win32"?{PATH:"C:\\Windows\\System32",SystemRoot:"C:\\Windows",USERPROFILE:e.isolatedHome,TEMP:e.isolatedTemp,TMP:e.isolatedTemp}:{PATH:BE,HOME:e.isolatedHome,TMPDIR:e.isolatedTemp},n=new Set(Object.keys(t));for(let i of e.plannedKeys){if(n.has(i))continue;if(Object.hasOwn(e.approvedSecrets,i)){t[i]=e.approvedSecrets[i],n.add(i);continue}if(!Zm.has(i))throw new Y("unapproved_environment_key");let r=e.ambient[i];if(typeof r!="string"||r.includes("\0")||Buffer.byteLength(r,"utf8")>Ym)throw new Y("ambient_environment_value_invalid");t[i]=r,n.add(i)}if(n.size!==e.plannedKeys.length)throw new Y("environment_plan_mismatch");return t}async function HE(e){let t;try{t=wE(e.executable,e.argv,{cwd:e.cwd,env:e.environment,shell:!1,windowsHide:!0,detached:e.platform!=="win32",stdio:["ignore","pipe","pipe"]})}catch{return Qm("spawn_failed",e.planHash)}return await new Promise(n=>{let i=[],r=[],s=0,a="exited",o=!1,l=!1,c,d=m=>{a==="exited"&&(a=m,zm(t,!1,e.treeTerminator),c=setTimeout(()=>zm(t,!0,e.treeTerminator),jE),c.unref?.())},p=(m,y)=>{if(o)return;let w=y,v=e.outputLimitBytes-s;if(w.byteLength<=v){m.push(w),s+=w.byteLength;return}m.push(w.subarray(0,Math.max(v,0))),s=e.outputLimitBytes,o=!0,d("output_limit")},f=(m,y)=>{if(l)return;l=!0,clearTimeout(h),c&&clearTimeout(c),e.signal?.removeEventListener("abort",g);let w=o?`
+[output truncated; process terminated]`:"";n({reason:a,exitCode:m,signal:y,stdout:Gm(Buffer.concat(i).toString("utf8")+w,e.approvedSecrets),stderr:Gm(Buffer.concat(r).toString("utf8"),e.approvedSecrets),outputTruncated:o,planHash:e.planHash})},g=()=>d("aborted"),h=setTimeout(()=>d("timed_out"),e.timeoutMs);h.unref?.(),e.signal?.addEventListener("abort",g,{once:!0}),t.stdout.on("data",m=>p(i,m)),t.stderr.on("data",m=>p(r,m)),t.once("error",()=>{a="spawn_failed",f(null,null)}),t.once("close",f)})}function zm(e,t,n){if(n){n.terminate(e,t);return}let i=t?"SIGKILL":"SIGTERM";try{if(typeof e.pid!="number"){e.kill(i);return}process.kill(-e.pid,i)}catch{e.kill(i)}}function JE(e){if(!DE.has(e))throw new Y("unsupported_platform");return e}function Km(e,t,n,i){if(!Number.isSafeInteger(e)||e<t||e>n)throw new Y(`${i.replaceAll(" ","_")}_invalid`);return e}function Qm(e,t){return{reason:e,exitCode:null,signal:null,stdout:"",stderr:"",outputTruncated:!1,planHash:t}}var WE="private",eh="public",th="unlisted",nh="delisted";function ca(e){if(typeof e!="string"||e.trim().length===0)return null;let t=e.trim().toLowerCase();return t==="private"?WE:t===eh?eh:t===th?th:t===nh?nh:null}import{execFile as YE}from"node:child_process";import{createHash as ZE}from"node:crypto";import{promisify as XE}from"node:util";var yc=XE(YE),Hi="apiKey",On="apiKeyRef",Ji="Skills Layer CLI";function kc(e=process.platform,t=process.env){let n=t.SKILLS_LAYER_CREDENTIAL_STORE?.trim().toLowerCase();return n==="local-file"||n==="local_file"||n==="disabled"||e!=="darwin"||process.env.VITEST==="true"&&n!=="macos-keychain"&&n!=="macos_keychain"?null:tx()}async function ih(e,t){if(!(typeof e[Hi]=="string"&&e[Hi].length>0))return e;let i=wc(t);if(!i)return e;try{let r={...e,credentialStorage:"macos_keychain"},s=QE(e);return await i.set(vc(t),s,e[Hi]),r[On]=s,delete r[Hi],r}catch{return ex(e)}}async function rh(e,t){if(e.credentialStorage!=="macos_keychain"||e[Hi]||!e[On])return e;let n=wc(t);if(!n)return e;let i=await n.get(vc(t),e[On]);return i?{...e,apiKey:i}:e}async function sh(e,t){if(!e||e.credentialStorage!=="macos_keychain"||!e[On])return;let n=wc(t);n&&await n.delete(vc(t),e[On])}function QE(e){let t=[e.baseUrl??"unknown-base-url",e.userId??e.email??e.role??"unknown-user","apiKey"].join(`
+`);return`skills-layer-cli:api-key:${ZE("sha256").update(t).digest("base64url").slice(0,32)}`}function wc(e){return e.store!==void 0?e.store:kc(e.platform,e.env??process.env)}function vc(e){return e.service??Ji}function ex(e){let t={...e,credentialStorage:"local_file_locked"};return delete t[On],t}function tx(){return{kind:"macos_keychain",async set(e,t,n){await yc("/usr/bin/security",["add-generic-password","-a",t,"-s",e,"-w",n,"-U"])},async get(e,t){try{let{stdout:n}=await yc("/usr/bin/security",["find-generic-password","-a",t,"-s",e,"-w"]);return n.trim()||null}catch{return null}},async delete(e,t){try{await yc("/usr/bin/security",["delete-generic-password","-a",t,"-s",e])}catch{}}}}function bc(e){let t=e.skillSlug??"<skill-slug>";return{localWork:{purpose:e.purpose,command:e.command,jsonCommand:e.jsonCommand},guardian:{checkCommand:`skills-layer guardian check --skill ${t} --json`,execCommand:`skills-layer guardian exec ${t} --json -- <command>`,mcpTools:["guardian.check","guardian.enforce","guardian.status","guardian.incident"],guidance:"Before risky shell, network, file, secret, browser, API, generated-code, or model-context actions, call MCP guardian.check/guardian.enforce or run skills-layer guardian check. Route shell actions through skills-layer guardian exec when strict local blocking is needed."},setup:{setupCommand:"skills-layer setup",hookStatusCommand:"skills-layer guardian hook status",hookInstallProjectCommand:"skills-layer guardian hook install --agent codex --scope project",hookInstallGlobalCommand:"skills-layer guardian hook install --agent codex --scope global"}}}var ah=`  ____  _    _ _ _       _
  / ___|| | _(_) | |___  | |    __ _ _   _  ___ _ __
  \\___ \\| |/ / | | / __| | |   / _\` | | | |/ _ \\ '__|
   ___) |   <| | | \\__ \\ | |__| (_| | |_| |  __/ |
  |____/|_|\\_\\_|_|_|___/ |_____\\__,_|\\__, |\\___|_|
                                      |___/
 Skills-Layer
-AI Agent first platform for Skills`;var hr=`Skills Layer MCP
+AI Agent first platform for Skills`;var oh=`Skills Layer MCP
 Configure Skills Layer for AI agents through a local stdio bridge.
 
 Usage:
@@ -360,7 +514,7 @@ Checks:
   repair  rewrites the local bridge and supported target config.
   disconnect removes Skills Layer MCP local state and the selected target config entry.
 
-After setup or repair, open a fresh agent session or restart the agent if tools are not visible.`;var wr=`Skills Layer CLI
+After setup or repair, open a fresh agent session or restart the agent if tools are not visible.`;var uh=`Skills Layer CLI
 Agent-first skill marketplace for developers. CLI, MCP, and API share one journey model.
 
 Usage:
@@ -403,7 +557,8 @@ Fast paths:
     skills-layer installed
 
   Approve a skill for a workspace:
-    skills-layer workspace deploy <workspace-id> project-planner --dry-run
+    skills-layer workspace request <workspace-id> project-planner
+    skills-layer workspace approve <workspace-id> project-planner
     skills-layer workspace guide <workspace-id> project-planner
 
   Create and submit a skill:
@@ -496,14 +651,30 @@ Primary commands:
     skills-layer creator analytics <skill-slug> [--json]
     skills-layer creator earnings [--json]
     skills-layer creator payouts [--json]
-    skills-layer creator withdraw [--amount-cents <n>] [--reason <text>] [--json]
+    skills-layer creator withdraw [--amount-cents <n>] [--reason <text>] [--idempotency-key <opaque-key>] [--json]
 
   Workspace:
+    skills-layer enterprise checkout --seats <n> --enterprise-name <name> --workspace-name <name> [--new-enterprise] [--json]
+    skills-layer enterprise rename <enterprise-id> --name <enterprise-name> [--json]
+    skills-layer enterprise primary-admin transfer <enterprise-id> <target-user-id> [--leave-enterprise] [--json]
+    skills-layer enterprise primary-admin status|accept|cancel <transfer-id> [--json]
+    skills-layer enterprise seats [--json]
+    skills-layer enterprise seats add <enterprise-id> --seats <n> [--no-open] [--json]
+    skills-layer enterprise invite <enterprise-id> --email <email> [--role <role>] [--workspace <workspace-id|all|id1,id2>] [--json]
+    skills-layer enterprise revoke-invite <enterprise-id> <invite-id> [--json]
+    skills-layer enterprise resend-invite <enterprise-id> <invite-id> [--json]
+    skills-layer enterprise workspace create <enterprise-id> --name <workspace-name> [--json]
+    skills-layer enterprise workspace rename <enterprise-id> <workspace-id> --name <workspace-name> [--json]
+    skills-layer enterprise workspace archive <enterprise-id> <workspace-id> [--json]
+    skills-layer enterprise skill quote <enterprise-id> <skill-slug> [--json]
+    skills-layer enterprise skill buy <enterprise-id> <skill-slug> [--json]
     skills-layer workspace list [--json]
-    skills-layer workspace create [<name>] [--kind <kind>] [--json]
+    skills-layer workspace current [--json]
+    skills-layer workspace use <workspace-id> [--json]
+    skills-layer workspace request <workspace-id> <skill-slug> [--reason <text>] [--json]
+    skills-layer workspace approve <workspace-id> <skill-slug> [--json]
+    skills-layer workspace reject <workspace-id> <skill-slug> [--json]
     skills-layer workspace skills <workspace-id> [--json]
-    skills-layer workspace deploy <workspace-id> <skill-slug> [--dry-run] [--json]
-    skills-layer workspace remove <workspace-id> <skill-slug> [--json]
     skills-layer workspace guide <workspace-id> <skill-slug> [--json]
 
   Additional tools:
@@ -530,7 +701,7 @@ Primary commands:
 Concepts:
   - whoami = session identity. profile = editable account profile.
   - install = machine/project/global materialization for an agent runtime.
-  - workspace deploy = governed workspace availability. It does not install on every member machine.
+  - workspace approve = governed Enterprise workspace approval. It does not install on every member machine.
   - workspace guide explains how an approved workspace skill becomes usable locally.
   - featured and trending are browse views; search scopes them and sort controls ranking.
   - buy is an explicit SaaS checkout handoff. Money movement stays human-in-the-loop.
@@ -551,9 +722,9 @@ Safety:
   - Use guardian status [skill-slug] to see Cloud policy, stored user preference, effective mode, local hook posture, and the next Guardian action.
   - Use guardian hook install to add native host hooks where supported; status reports the actual enforcement layer instead of overclaiming strict blocking.
   - Use guardian exec when you need a stronger wrapper that refuses blocked shell actions before spawning the command.
-  - Use --dry-run before mutating catalog/source installs, workspace deployments, submissions, visibility, or ownership state.`,ot=`${fr}
+  - Use --dry-run before mutating catalog/source installs, submissions, visibility, or ownership state.`,Wi=`${ah}
 
-${wr}`;var bn=new Set(["add-issue","add-review","agents","api-key","approval","auth","backend","buy","categories","check","compare","creator","doctor","export","featured","find","guardian","help","identity","import","install","installed","library","login","logout","mcp","owned","preview-trigger","profile","purchases","recommend","register","remove","restore","search","show","show-issues","show-reviews","source","status","sync","trending","trust","update","validate","whoami","workspace","workspaces"]),Sn=[...bn].sort(),vr={description:"Run this Skills Layer command.",mutates:!1,supportsDryRun:!1,requiresLogin:!1,requiresNetwork:!0,writesPaths:[],sideEffects:["cloud_read"],dryRun:void 0},yr={root:{description:"Show public CLI guidance and command discovery.",requiresNetwork:!1,sideEffects:["read_only"]},"add-issue":{description:"Report a public skill issue.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_write"]},"add-review":{description:"Add a public skill review.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_write"]},agents:{description:"Inspect supported local agent targets.",requiresNetwork:!1,sideEffects:["local_read"]},"api-key":{description:"Create, list, and revoke scoped automation API keys.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","credential_mutation","human_handoff"]},"api-key create":{description:"Create a named scoped automation API key, or validate it with --dry-run.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","credential_mutation","human_handoff"],dryRun:{flag:"--dry-run",mutates:!1,validates:["name","scopes","expiry","active-key-limit"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},"api-key list":{description:"List scoped automation, MCP, and session keys without exposing raw secrets.",mutates:!1,requiresLogin:!0,sideEffects:["cloud_read"]},"api-key revoke":{description:"Revoke a scoped API key after dry-run or confirmation.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","credential_mutation","destructive_cloud"],dryRun:{flag:"--dry-run",mutates:!1,validates:["key-id","key-exists","revocation-preview"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},approval:{description:"Inspect and complete human approval requests.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},auth:{description:"Inspect, verify, repair, and recover account authentication.",mutates:!0,requiresNetwork:!0,sideEffects:["cloud_read","credential_mutation","human_handoff"]},backend:{description:"Inspect or select the backend used by this CLI.",mutates:!0,requiresNetwork:!1,writesPaths:["~/.skills-layer/backend.json"],sideEffects:["local_read","local_write"]},buy:{description:"Start a human-in-the-loop purchase flow for a skill.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","payment_mutation","human_handoff"]},check:{description:"Check one installed skill against local install state.",requiresNetwork:!1,sideEffects:["local_read"]},creator:{description:"Create, validate, submit, and manage creator-owned skills.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["local_read","local_write","cloud_read","cloud_write","human_handoff"]},"creator source prepare":{description:"Prepare a source connection for creator publication review.",mutates:!0,requiresLogin:!0,sideEffects:["local_read","cloud_read","cloud_write","human_handoff"]},"creator source publish-request":{description:"Request publication from a prepared source connection.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},"creator source release-status":{description:"Read source-connection release status.",requiresLogin:!0,sideEffects:["cloud_read"]},doctor:{description:"Run backend, auth, workspace, and Guardian readiness checks.",sideEffects:["local_read","cloud_read"]},export:{description:"Export an owned skill bundle or signed download URL.",mutates:!0,requiresLogin:!0,writesPaths:["<output path>"],sideEffects:["cloud_read","local_write"]},guardian:{description:"Run Guardian checks, incidents, modes, hooks, and guarded exec.",mutates:!0,supportsDryRun:!0,requiresLogin:!1,sideEffects:["local_read","local_write","cloud_read","cloud_write","human_handoff"]},help:{description:"Show local or Cloud-backed help.",requiresNetwork:!1,sideEffects:["read_only"]},identity:{description:"Manage social identity providers and linked identities.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},import:{description:"Inspect or import supported skill sources.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["local_read","cloud_read","cloud_write"]},install:{description:"Install a catalog or source skill onto this machine.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,writesPaths:[".codex/skills/<skill-slug>","~/.skills-layer/installs.json"],sideEffects:["local_read","local_write","cloud_read","cloud_write"],dryRun:{flag:"--dry-run",mutates:!1,validates:["slug-or-source","scope","agent","trust","materialization-plan"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},installed:{description:"List locally installed skill records.",requiresNetwork:!1,sideEffects:["local_read"]},library:{description:"Manage owned library records and buyer feedback.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"]},login:{description:"Sign in and optionally set up MCP and Security Guardian.",mutates:!0,supportsDryRun:!1,writesPaths:["~/.skills-layer/config.json","~/.skills-layer/mcp.json"],sideEffects:["local_write","cloud_read","credential_mutation","human_handoff"]},logout:{description:"Remove the local CLI session.",mutates:!0,requiresNetwork:!1,writesPaths:["~/.skills-layer/config.json"],sideEffects:["credential_mutation","destructive_local"]},mcp:{description:"Set up, verify, repair, and disconnect MCP clients.",mutates:!0,requiresLogin:!0,writesPaths:["~/.skills-layer/mcp.json","agent MCP config files"],sideEffects:["local_read","local_write","cloud_read","credential_mutation"]},owned:{description:"List skills owned by the signed-in user.",requiresLogin:!0,sideEffects:["cloud_read"]},"preview-trigger":{description:"Preview skill trigger behavior from local source.",requiresNetwork:!0,sideEffects:["local_read","cloud_read"]},profile:{description:"View or update the signed-in account profile.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"]},purchases:{description:"Inspect purchases, invoices, refunds, and spending.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","payment_mutation"]},register:{description:"Create or verify an account through email or social auth.",mutates:!0,sideEffects:["cloud_write","human_handoff"]},remove:{description:"Remove a local skill install record and materialized files.",mutates:!0,requiresLogin:!1,writesPaths:[".codex/skills/<skill-slug>","~/.skills-layer/installs.json"],sideEffects:["local_read","destructive_local"]},restore:{description:"Inspect and restore a previously removed local install where possible.",mutates:!0,writesPaths:[".codex/skills/<skill-slug>","~/.skills-layer/installs.json"],sideEffects:["local_read","local_write","cloud_read"]},setup:{description:"Set up MCP and Security Guardian for detected AI tools.",mutates:!0,requiresLogin:!0,writesPaths:["~/.skills-layer/mcp.json","agent MCP and hook config files"],sideEffects:["local_read","local_write","cloud_read","credential_mutation","human_handoff"]},source:{description:"Manage source connections, approvals, and source references.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},sync:{description:"Reconcile local install records against the selected backend catalog.",mutates:!1,sideEffects:["local_read","cloud_read"]},update:{description:"Check whether an installed skill has updates.",supportsDryRun:!0,sideEffects:["local_read","cloud_read"]},validate:{description:"Validate a local skill bundle.",requiresNetwork:!0,sideEffects:["local_read","cloud_read"]},workspace:{description:"Manage workspace skill availability.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"],dryRun:{flag:"--dry-run",mutates:!1,validates:["workspace","skill","trust","entitlement","policy"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},workspaces:{description:"Alias for workspace commands.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"],dryRun:{flag:"--dry-run",mutates:!1,validates:["workspace","skill","trust","entitlement","policy"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}}},dl=new Set([...Sn,"api-key create","api-key list","api-key revoke","approval request","approval request complete","approval request status","auth recover","auth verify","creator init","creator source prepare","creator source publish-request","creator source release-status","creator submit","featured sort","find examples","guardian check","guardian exec","guardian hook","guardian hook install","guardian hook status","mcp disconnect","mcp repair","mcp setup","mcp status","mcp verify","profile update","source connection","source connection cancel","source connection complete","source connection start","source connection status","status details","validate examples","workspace create","workspace deploy","workspace guide","workspace list","workspace remove","workspace skills"]);function at(e,t){let n=br(e,t),i=n[0],r=n.slice(1).join(" ")||void 0;if(!i||!bn.has(i)||!dl.has(n.join(" ")))return null;if(i==="install")return`Skills Layer install help
+${uh}`;var Sc=new Set(["add-issue","add-review","agents","api-key","approval","auth","backend","buy","categories","check","compare","creator","doctor","enterprise","export","featured","find","guardian","help","identity","import","install","installed","library","login","logout","mcp","owned","preview-trigger","profile","purchases","recommend","register","remove","restore","search","setup","show","show-issues","show-reviews","source","status","sync","trending","trust","update","validate","whoami","workspace","workspaces"]),_c=[...Sc].sort(),dh={description:"Run this Skills Layer command.",mutates:!1,supportsDryRun:!1,requiresLogin:!1,requiresNetwork:!0,writesPaths:[],sideEffects:["cloud_read"],dryRun:void 0},lh={root:{description:"Show public CLI guidance and command discovery.",requiresNetwork:!1,sideEffects:["read_only"]},"add-issue":{description:"Report a public skill issue.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_write"]},"add-review":{description:"Add a public skill review.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_write"]},agents:{description:"Inspect supported local agent targets.",requiresNetwork:!1,sideEffects:["local_read"]},"api-key":{description:"Create, list, and revoke scoped automation API keys.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","credential_mutation","human_handoff"]},"api-key create":{description:"Create a named scoped automation API key, or validate it with --dry-run.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","credential_mutation","human_handoff"],dryRun:{flag:"--dry-run",mutates:!1,validates:["name","scopes","expiry","active-key-limit"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},"api-key list":{description:"List scoped automation, MCP, and session keys without exposing raw secrets.",mutates:!1,requiresLogin:!0,sideEffects:["cloud_read"]},"api-key revoke":{description:"Revoke a scoped API key after dry-run or confirmation.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","credential_mutation","destructive_cloud"],dryRun:{flag:"--dry-run",mutates:!1,validates:["key-id","key-exists","revocation-preview"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},approval:{description:"Inspect and complete human approval requests.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},auth:{description:"Inspect, verify, repair, and recover account authentication.",mutates:!0,requiresNetwork:!0,sideEffects:["cloud_read","credential_mutation","human_handoff"]},backend:{description:"Inspect or select the backend used by this CLI.",mutates:!0,requiresNetwork:!1,writesPaths:["~/.skills-layer/backend.json"],sideEffects:["local_read","local_write"]},buy:{description:"Start a human-in-the-loop purchase flow for a skill.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","payment_mutation","human_handoff"]},check:{description:"Check one installed skill against local install state.",requiresNetwork:!1,sideEffects:["local_read"]},creator:{description:"Create, validate, submit, and manage creator-owned skills.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["local_read","local_write","cloud_read","cloud_write","human_handoff"]},"creator source prepare":{description:"Prepare a source connection for creator publication review.",mutates:!0,requiresLogin:!0,sideEffects:["local_read","cloud_read","cloud_write","human_handoff"]},"creator source publish-request":{description:"Request publication from a prepared source connection.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},"creator source release-status":{description:"Read source-connection release status.",requiresLogin:!0,sideEffects:["cloud_read"]},doctor:{description:"Run backend, auth, workspace, and Guardian readiness checks.",sideEffects:["local_read","cloud_read"]},enterprise:{description:"Prepare enterprise checkout, seats, members, workspaces, and paid skill purchase handoffs.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","payment_mutation","human_handoff"]},export:{description:"Export an owned skill bundle or signed download URL.",mutates:!0,requiresLogin:!0,writesPaths:["<output path>"],sideEffects:["cloud_read","local_write"]},guardian:{description:"Run Guardian checks, incidents, modes, hooks, and guarded exec.",mutates:!0,supportsDryRun:!0,requiresLogin:!1,sideEffects:["local_read","local_write","cloud_read","cloud_write","human_handoff"]},help:{description:"Show local or Cloud-backed help.",requiresNetwork:!1,sideEffects:["read_only"]},identity:{description:"Manage social identity providers and linked identities.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},import:{description:"Inspect or import supported skill sources.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["local_read","cloud_read","cloud_write"]},install:{description:"Install a catalog or source skill onto this machine.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,writesPaths:[".codex/skills/<skill-slug>","~/.skills-layer/installs.json"],sideEffects:["local_read","local_write","cloud_read","cloud_write"],dryRun:{flag:"--dry-run",mutates:!1,validates:["slug-or-source","scope","agent","trust","materialization-plan"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},installed:{description:"List locally installed skill records.",requiresNetwork:!1,sideEffects:["local_read"]},library:{description:"Manage owned library records and buyer feedback.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"]},login:{description:"Sign in and optionally set up MCP and Security Guardian.",mutates:!0,supportsDryRun:!1,writesPaths:["~/.skills-layer/config.json","~/.skills-layer/mcp.json"],sideEffects:["local_write","cloud_read","credential_mutation","human_handoff"]},logout:{description:"Remove the local CLI session.",mutates:!0,requiresNetwork:!1,writesPaths:["~/.skills-layer/config.json"],sideEffects:["credential_mutation","destructive_local"]},mcp:{description:"Set up, verify, repair, and disconnect MCP clients.",mutates:!0,requiresLogin:!0,writesPaths:["~/.skills-layer/mcp.json","agent MCP config files"],sideEffects:["local_read","local_write","cloud_read","credential_mutation"]},owned:{description:"List skills owned by the signed-in user.",requiresLogin:!0,sideEffects:["cloud_read"]},"preview-trigger":{description:"Preview skill trigger behavior from local source.",requiresNetwork:!0,sideEffects:["local_read","cloud_read"]},profile:{description:"View or update the signed-in account profile.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"]},purchases:{description:"Inspect purchases, invoices, refunds, and spending.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","payment_mutation"]},register:{description:"Create or verify an account through email or social auth.",mutates:!0,sideEffects:["cloud_write","human_handoff"]},remove:{description:"Remove a local skill install record and materialized files.",mutates:!0,requiresLogin:!1,writesPaths:[".codex/skills/<skill-slug>","~/.skills-layer/installs.json"],sideEffects:["local_read","destructive_local"]},restore:{description:"Inspect and restore a previously removed local install where possible.",mutates:!0,writesPaths:[".codex/skills/<skill-slug>","~/.skills-layer/installs.json"],sideEffects:["local_read","local_write","cloud_read"]},setup:{description:"Set up MCP and Security Guardian for detected AI tools.",mutates:!0,requiresLogin:!0,writesPaths:["~/.skills-layer/mcp.json","agent MCP and hook config files"],sideEffects:["local_read","local_write","cloud_read","credential_mutation","human_handoff"]},source:{description:"Manage source connections, approvals, and source references.",mutates:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write","human_handoff"]},sync:{description:"Reconcile local install records against the selected backend catalog.",mutates:!1,sideEffects:["local_read","cloud_read"]},update:{description:"Check whether an installed skill has updates.",supportsDryRun:!0,sideEffects:["local_read","cloud_read"]},validate:{description:"Validate a local skill bundle.",requiresNetwork:!0,sideEffects:["local_read","cloud_read"]},workspace:{description:"Manage workspace skill availability.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"],dryRun:{flag:"--dry-run",mutates:!1,validates:["workspace","skill","trust","entitlement","policy"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}},workspaces:{description:"Alias for workspace commands.",mutates:!0,supportsDryRun:!0,requiresLogin:!0,sideEffects:["cloud_read","cloud_write"],dryRun:{flag:"--dry-run",mutates:!1,validates:["workspace","skill","trust","entitlement","policy"],mayContactCloud:!0,createsRecords:!1,sendsEmail:!1}}},nx=new Set([..._c,"api-key create","api-key list","api-key revoke","approval request","approval request complete","approval request status","auth recover","auth verify","creator init","creator source prepare","creator source publish-request","creator source release-status","creator submit","featured sort","find examples","guardian check","guardian exec","guardian hook","guardian hook install","guardian hook status","mcp disconnect","mcp repair","mcp setup","mcp status","mcp verify","profile update","enterprise","source connection","source connection cancel","source connection complete","source connection start","source connection status","status details","validate examples","workspace approve","workspace current","workspace guide","workspace list","workspace reject","workspace request","workspace skills","workspace use"]);function Yi(e,t){let n=ph(e,t),i=n[0],r=n.slice(1).join(" ")||void 0;if(!i||!Sc.has(i)||!nx.has(n.join(" ")))return null;if(i==="install")return`Skills Layer install help
 
 Usage:
   skills-layer install <skill-slug> [--version <semver>] [--scope <local|project|global|workspace>] [--agent <agent>] [--dry-run] [--json]
@@ -563,11 +734,17 @@ Usage:
 What it does:
   - Catalog install checks Skills Layer Cloud, then materializes approved files for your selected local agent/runtime.
   - Source install materializes locally after Cloud source inspection and trust checks.
+  - In a human terminal, omitting --agent detects supported agents and asks you to choose when needed.
+  - In a human terminal, omitting --scope asks whether to install for this project or globally on the first install.
+  - You can reuse that target with a mandatory recheck on every 5th install, or choose to be asked every time. There is no permanent-memory option.
+  - A working-mode change invalidates the remembered target, and explicit --agent/--scope values do not overwrite it.
+  - JSON and non-interactive callers are never prompted. Pass --agent and --scope for deterministic automation.
   - Local paths upload the bundle to your private Cloud library by default so the skill can travel across machines.
   - Public GitHub sources create or reuse a shared public-source catalog record when anonymous inspection succeeds, even if you are signed in.
   - Private GitHub/GitLab sources require login plus a provider/source connection so Cloud can verify access.
-  - Add --visibility private when you intentionally want a private Cloud skill instead of public-source intake.
-  - Add --visibility public on a private source only when you want the governed public submission/review path.
+  - Verified anonymously readable GitHub and GitLab.com repositories default to public intent; all other sources default private.
+  - Add --visibility private when you intentionally want an owner-only skill from a public provider repository.
+  - Add --visibility public on a private or arbitrary source only when you want the governed public submission/review path.
 
 Good defaults:
   skills-layer install <skill-slug> --dry-run
@@ -832,7 +1009,8 @@ Supported sources:
 What it does:
   - Imports a Skills Layer-compatible source through Cloud.
   - Local paths must exist before the import request is sent.
-  - Use --visibility public only when you explicitly want public-source publication.
+  - Verified anonymously readable GitHub and GitLab.com repositories default to public intent; all other sources default private.
+  - Use --visibility public on a private or arbitrary source only when you explicitly want governed public promotion.
 
 Examples:
   skills-layer import ./my-skill --visibility private
@@ -901,6 +1079,8 @@ Usage:
 What it does:
   - Starts a browser-first sign-in for humans, then stores the CLI session securely.
   - Email sign-in sends a one-time code and then waits for the code in interactive terminals.
+  - When working-mode selection is required, the picker includes Personal and every accessible Enterprise workspace.
+  - Distinct Enterprise workspaces with the same display name receive a short identifier so the choices remain unambiguous.
   - After sign-in, the CLI can set up Skills Layer MCP once for detected AI tools.
   - --json is agent-safe: it returns structured status and never prints raw secrets.
   - --no-open returns a browser handoff without launching a browser.
@@ -947,11 +1127,11 @@ Examples:
 Related:
   skills-layer search planning
   skills-layer show <skill-slug>
-  skills-layer install <skill-slug>`;let o=i==="find"?"find":"search";return`${i==="find"?"Skills Layer find help":"Skills Layer search help"}
+  skills-layer install <skill-slug>`;let a=i==="find"?"find":"search";return`${i==="find"?"Skills Layer find help":"Skills Layer search help"}
 
 Usage:
-  skills-layer ${o} [query] [--agent <agent>] [--capability <capability>] [--trust <label>] [--runtime-risk <low|elevated|high>] [--security-capability <capability>] [--limit <n>] [--json]
-  skills-layer ${o} [query] --install <skill-slug>
+  skills-layer ${a} [query] [--agent <agent>] [--capability <capability>] [--trust <label>] [--runtime-risk <low|elevated|high>] [--security-capability <capability>] [--limit <n>] [--json]
+  skills-layer ${a} [query] --install <skill-slug>
 
 What it does:
   - Searches the Skills Layer catalog and returns installable, trust-aware skill matches.
@@ -963,10 +1143,10 @@ Accepted values:
   --trust high|medium|low|published|published_with_findings|high_risk
 
 Examples:
-  skills-layer ${o} planning
-  skills-layer ${o} planning --runtime-risk low --limit 3 --json
-  skills-layer ${o} "research plan" --agent codex --json
-  skills-layer ${o} planning --install project-planner
+  skills-layer ${a} planning
+  skills-layer ${a} planning --runtime-risk low --limit 3 --json
+  skills-layer ${a} "research plan" --agent codex --json
+  skills-layer ${a} planning --install project-planner
 
 Next:
   skills-layer show <skill-slug>
@@ -991,12 +1171,14 @@ Next:
   skills-layer trust <skill-slug>`;if(i==="creator")return r==="init"?`Skills Layer creator init help
 
 Usage:
-  skills-layer creator init <skill-slug> [--type <standalone|workflow|workflow_automation|mcp_enhanced>] [--dir <target-dir>] [--description <text>] [--category <category>] [--json]
+  skills-layer creator init <skill-slug> [--type <standalone|workflow|workflow_automation|mcp_enhanced>] [--dir <target-dir>] [--description <text>] [--category <category>] [--license MIT | --license <LicenseRef-id> --license-file <path> | --skip-license] [--confirm] [--json]
 
 What it does:
   - Creates a local starter skill bundle with SKILL.md, README.md, references, and optional script space.
   - Writes category into the metadata block used by submit validation.
-  - Fails before overwriting an existing target directory.
+  - Shows a create/replace diff and changes an existing target only with --confirm; destination symlinks are refused.
+  - Licence terms are optional: choose the approved template, import exact creator terms, or Skip with a non-blocking warning.
+  - JSON and non-TTY validation never prompt or modify licence files.
 
 Examples:
   skills-layer creator init project-planner
@@ -1029,6 +1211,7 @@ Usage:
   skills-layer creator security-report <skill-slug> [--json]
   skills-layer creator earnings [--json]
   skills-layer creator payouts [--json]
+  skills-layer creator withdraw [--amount-cents <n>] [--reason <text>] [--idempotency-key <opaque-key>] [--json]
 
 Start here:
   skills-layer creator init <skill-slug>
@@ -1134,24 +1317,61 @@ Enforcement:
   - native_hook means the selected host has a concrete pre-action hook configuration installed.
   - native_hook_candidate means Skills Layer wrote integration metadata but does not yet claim strict host blocking.
   - strict pre-action blocking still requires a host agent or wrapper that calls Guardian before tool execution.
-  - Cloud-managed decisions should receive only minimal action metadata, not raw files, secrets, or terminal output.`;if(i==="workspace"||i==="workspaces")return`Skills Layer workspace help
+  - Cloud-managed decisions should receive only minimal action metadata, not raw files, secrets, or terminal output.`;if(i==="enterprise")return`Skills Layer enterprise help
+
+Usage:
+  skills-layer enterprise checkout --seats <n> --enterprise-name <name> --workspace-name <name> [--new-enterprise] [--json]
+  skills-layer enterprise rename <enterprise-id> --name <enterprise-name> [--json]
+  skills-layer enterprise primary-admin transfer <enterprise-id> <target-user-id> [--leave-enterprise] [--json]
+  skills-layer enterprise primary-admin status <transfer-id> [--json]
+  skills-layer enterprise primary-admin accept <transfer-id> [--json]
+  skills-layer enterprise primary-admin cancel <transfer-id> [--json]
+  skills-layer enterprise seats [--json]
+  skills-layer enterprise seats add <enterprise-id> --seats <n> [--no-open] [--json]
+  skills-layer enterprise invite <enterprise-id> --email <email> [--role <role>] [--workspace <workspace-id|all|id1,id2>] [--json]
+  skills-layer enterprise revoke-invite <enterprise-id> <invite-id> [--json]
+  skills-layer enterprise resend-invite <enterprise-id> <invite-id> [--json]
+  skills-layer enterprise workspaces <enterprise-id> [--json]
+  skills-layer enterprise workspace create <enterprise-id> --name <workspace-name> [--json]
+  skills-layer enterprise workspace rename <enterprise-id> <workspace-id> --name <workspace-name> [--json]
+  skills-layer enterprise workspace archive <enterprise-id> <workspace-id> [--json]
+  skills-layer enterprise skill quote <enterprise-id> <skill-slug> [--json]
+  skills-layer enterprise skill buy <enterprise-id> <skill-slug> [--json]
+
+What it does:
+  - Opens provider-backed enterprise checkout and manages seats, members, workspaces, and paid skill purchases.
+  - Use --new-enterprise only for deliberate additional Enterprise creation; retries and normalized same-name matches do not start another purchase.
+  - Primary Admin is continuity responsibility held by one Enterprise Admin, not a fourth role; transfers expire after 48 hours.
+  - In non-JSON mode, opens provider checkout URLs where possible, then waits on authenticated webhook-backed status.
+  - Signed payment-provider webhooks are the only payment-completion authority; clients cannot submit payment intent ids.
+  - Adding seats opens secure payment checkout; capacity changes only after the payment provider's signed webhook confirms payment.
+  - Invites members, creates enterprise workspaces, and manages paid skill purchase handoffs.
+  - Enterprise Admins can archive workspaces; Workspace Managers can rename assigned workspaces but cannot archive them.
+  - invite defaults to the first workspace when --workspace is omitted; use --workspace all to grant every current workspace.`;if(i==="workspace"||i==="workspaces")return`Skills Layer workspace help
 
 Usage:
   skills-layer workspace list [--json]
-  skills-layer workspace create [<name>] [--kind <kind>] [--json]
+  skills-layer workspace current [--json]
+  skills-layer workspace use <workspace-id> [--json]
+  skills-layer workspace request <workspace-id> <skill-slug> [--reason <text>] [--json]
+  skills-layer workspace approve <workspace-id> <skill-slug> [--json]
+  skills-layer workspace reject <workspace-id> <skill-slug> [--json]
   skills-layer workspace skills <workspace-id> [--json]
-  skills-layer workspace deploy <workspace-id> <skill-slug> [--dry-run] [--json]
-  skills-layer workspace remove <workspace-id> <skill-slug> [--json]
   skills-layer workspace guide <workspace-id> <skill-slug> [--json]
 
 What it does:
-  - Manages Cloud workspace availability for skills.
-  - deploy --dry-run previews trust, entitlement, and workspace policy before changing availability.
+  - Requests, approves, rejects, and inspects Enterprise workspace skill availability.
+  - Enterprise-owned mutations stay under enterprise; day-to-day selection and approvals stay under workspace.
+  - Skill name, version, and price are loaded from the catalog rather than accepted from the client.
+  - use selects the active Enterprise workspace for governed installs.
+  - approve evaluates trust, entitlement, and workspace policy before changing availability.
   - guide explains how an approved workspace skill becomes usable on a member machine.
 
 Examples:
   skills-layer workspace list
-  skills-layer workspace deploy ws_123 project-planner --dry-run
+  skills-layer workspace use ws_123
+  skills-layer workspace request ws_123 project-planner
+  skills-layer workspace approve ws_123 project-planner
   skills-layer workspace guide ws_123 project-planner`;if(i==="source")return`Skills Layer source help
 
 Usage:
@@ -1203,13 +1423,13 @@ Examples:
 
 Next:
   skills-layer source connection status <source-connection-id>
-  skills-layer creator source prepare <source-connection-id> <path>`;if(i==="mcp")return hr;let s=r?` ${r}`:"";return`Skills Layer ${i}${s} help
+  skills-layer creator source prepare <source-connection-id> <path>`;if(i==="mcp")return oh;let s=r?` ${r}`:"";return`Skills Layer ${i}${s} help
 
-Run \`skills-layer --help\` for public CLI usage.`}function Me(e,t){let n=br(e,t),i=n[0],r=n.slice(1).join(" ")||void 0;if(!i)return kr("root",void 0,wr);if(!bn.has(i))return null;let s=at(i,r?n.slice(1):void 0);return s?kr(i,r,s):null}function br(e,t){return[e,...Array.isArray(t)?t:t?[t]:[]].flatMap(n=>n?.split(/\s+/u)??[]).map(n=>n.trim().toLowerCase()).filter(Boolean)}function kr(e,t,n){let i=yr[e]??{},r=t?yr[`${e} ${t}`]??{}:{},s={...vr,...i,...r},o=r.description??i.description,a=pl(o,n),c=`skills-layer ${e==="root"?"<command>":e} [options]`;return{command:e,...t?{subcommand:t}:{},usage:ml(n,"Usage")||c,description:a,options:fl(n),examples:Pn(n,"Examples").filter(u=>u.startsWith("skills-layer ")),mutates:s.mutates,supportsJson:!0,supportsDryRun:s.supportsDryRun,requiresLogin:s.requiresLogin,requiresNetwork:s.requiresNetwork,writesPaths:s.writesPaths,sideEffects:s.sideEffects,...s.supportsDryRun?{dryRun:s.dryRun??{flag:"--dry-run",mutates:!1,validates:["arguments","policy"],mayContactCloud:s.requiresNetwork,createsRecords:!1,sendsEmail:!1}}:{}}}function pl(e,t){if(e)return e;let n=gl(t);return n||vr.description}function gl(e){let n=Pn(e,"What it does").find(i=>i.startsWith("- "));return n?n.replace(/^-+\s*/u,"").trim():""}function ml(e,t){return Pn(e,t).join(`
-`).trim()}function Pn(e,t){let n=e.split(/\r?\n/u),i=n.findIndex(s=>s.trim().toLowerCase()===`${t.toLowerCase()}:`);return i===-1?[]:n.slice(i+1).join(`
-`).trimStart().split(/\n\s*\n/u)[0].split(/\r?\n/u).map(s=>s.trim()).filter(Boolean)}function fl(e){return[...new Set([...e.matchAll(/--[a-z0-9][a-z0-9-]*/giu)].map(t=>t[0]).sort())]}var Be="0.1.8";var A=class extends Error{status;details;constructor(t,n,i){super(n),this.name="ApiError",this.status=t,this.details=i}},bs=1,ci=1,Sr=1,ui="skills-layer-public-cli-v1",be="skills-layer-security-hook",le="Skills Layer Security Hook",di="https://api.skills-layer.com",kl="http://127.0.0.1:8787",Pr=new Set(["json","dry-run","help","list","all","deep","verbose","show-url","no-open","quarantine","confirm","confirmed","yes","with-mcp","no-mcp","allow-unmanaged-once","disclose-source","allow-findings-featured"]),Cn=new Set(["accept-capability","approval-request-id","grant-json","paraphrase","should-not-trigger","should-trigger"]),Cr=new Set(["bio","company","description","display-name","feedback","message","note","reason","search","summary"]),_r=new Set(["action","action-json","agent","amount-cents","api-key","base-url","capability","category","claim-id","client","cloud-trust-ledger","code","commit-sha","created-after","created-before","decision","decision-evidence-json","dependency-audit-status","dir","email","environment","eval-summary","evidence-json","expires","expires-after","expires-before","fixed-version","format","install","issue-id","issue-type","key-id","kind","license","limit","listing-status","max-characters","method","mode","name","output","path","payment-method","pin","price-cents","provider","provider-installation-id","provider-owner-id","provider-project-id","provider-repo-id","provenance-intent","publication-status","rating","requested-role","review-id","runtime-risk","scope","security-capability","skill","skill-type","sort","source","source-intake-context","state","status","text","telemetry-mode","trust","type","unmanaged-policy","version","version-id","visibility","workspace"]),xr=new Set(Sn),wl=new Set(["standards","marketplace-status","capabilities","schema-plan","optimize-tokens"]);async function rm(e,t={}){let n={env:t.env??process.env,platform:t.platform??process.platform,cwd:t.cwd??process.cwd(),now:t.now??(()=>new Date().toISOString()),fetchFn:t.fetch??globalThis.fetch,openUrl:t.openUrl??Np(t.platform??process.platform),stdoutIsTty:t.stdoutIsTty??!!process.stdout.isTTY,promptText:t.promptText??Lp(),promptSecret:t.promptSecret??Up(),promptSelect:t.promptSelect??Tp(t.selectInput??process.stdin,t.selectOutput??process.stdout),sleep:t.sleep??(a=>new Promise(c=>setTimeout(c,a))),emitInfo:t.emitInfo??(a=>process.stdout.write(`${a}
-`)),credentialStore:t.credentialStore!==void 0?t.credentialStore:yn(t.platform??process.platform,t.env??process.env)},i=e[0];if(!i){let a=xn([]),c=await lt(a.flags,n);return await od(a.flags,c)}if(i==="--help"||i==="-h"){let a=xn(e.slice(1));if(a.flags.json){let c=await lt(a.flags,n),u=Me();return h(u,"Help loaded.",!0,c)}return{exitCode:0,stdout:ot,stderr:""}}if(i==="--version"||i==="-v")return{exitCode:0,stdout:`skills-layer ${Be}
-`,stderr:""};let r=xn(e.slice(1));if(r.error)return k(r.error,r.flags.json);let{flags:s,positionals:o}=r;if(i==="admin")return k("The public skills-layer package does not include internal commands.",s.json);if(i==="version"){let a=await lt(s,n);return h({status:"ok",name:"skills-layer",version:Be},`skills-layer ${Be}`,s.json,a)}if(s.help){if(s.json){let c=await lt(s,n),u=Me(i,o);return u?h(u,"Help loaded.",!0,c):xr.has(i)?Vn([i,...o],!0):k(_n(i),!0)}let a=at(i,o);return a?{exitCode:0,stdout:a,stderr:""}:xr.has(i)?Vn([i,...o],s.json):k(_n(i),s.json)}try{let a=await lt(s,n);switch(i){case"agents":return await Sl(o,s,a);case"backend":return await Pl(o,s,a);case"register":return await Ss(s,a);case"login":return await Ps(s,a);case"logout":return await Cs(s,a);case"whoami":return await $("/api/v1/whoami",s,a,"Account loaded.",{authenticated:!0});case"profile":return await xl(o,s,a);case"auth":return await $l(o,s,a);case"identity":return await jl(o,s,a);case"api-key":return await Ll(o,s,a);case"mcp":return await Ml(o,s,a);case"search":case"find":return await Vl(o,s,a);case"featured":case"trending":return await mc(i,s,a);case"categories":return o.length>0?qr("categories",o[0],s):await $("/api/v1/categories",s,a,"Categories loaded.");case"recommend":return await fc(o,s,a);case"compare":return await hc(o,s,a);case"show":return await yc(o,s,a);case"trust":return await kc(o,s,a);case"help":return await wc(o,s,a);case"status":return o.length>0?qr("status",o[0],s):await $("/api/v1/status",s,a,"Status loaded.");case"doctor":return await Ud(s,a);case"setup":return await Zs(s,a);case"validate":return await vc(o,s,a);case"preview-trigger":return await Cc(o,s,a);case"creator":return await _c(o,s,a);case"install":return await hi(o,s,a);case"installed":return await $u(s,a);case"remove":return await Au(o,s,a);case"update":return await Eu(o,s,a);case"sync":return await ju(s,a);case"restore":return await Du(o,s,a);case"check":return await Ku(o,s,a);case"import":return await Vu(o,s,a);case"source":return await Hu(o,s,a);case"approval":return await Ju(o,s,a);case"workspace":case"workspaces":return await Yu(o,s,a);case"buy":return await Zu(o,s,a);case"purchases":return await Qu(o,s,a);case"owned":return await $("/api/v1/me/library",s,a,"Owned skills loaded.",{authenticated:!0});case"export":return await ed(o,s,a);case"library":return await Xu(o,s,a);case"add-review":return await ns("add",o,s,a);case"show-reviews":return await ns("show",o,s,a);case"add-issue":return await is("add",o,s,a);case"show-issues":return await is("show",o,s,a);case"guardian":return await td(o,s,a);default:return k(_n(i),s.json)}}catch(a){return a instanceof A?Qt(a,s.json):k(te(a),s.json)}}function _n(e){let t=e.trim().toLowerCase();return t==="purchase"?`Unknown command "${e}".
+Run \`skills-layer --help\` for public CLI usage.`}function Nn(e,t){let n=ph(e,t),i=n[0],r=n.slice(1).join(" ")||void 0;if(!i)return ch("root",void 0,uh);if(!Sc.has(i))return null;let s=Yi(i,r?n.slice(1):void 0);return s?ch(i,r,s):null}function ph(e,t){return[e,...Array.isArray(t)?t:t?[t]:[]].flatMap(n=>n?.split(/\s+/u)??[]).map(n=>n.trim().toLowerCase()).filter(Boolean)}function ch(e,t,n){let i=lh[e]??{},r=t?lh[`${e} ${t}`]??{}:{},s={...dh,...i,...r},a=r.description??i.description,o=ix(a,n),l=`skills-layer ${e==="root"?"<command>":e} [options]`;return{command:e,...t?{subcommand:t}:{},usage:sx(n,"Usage")||l,description:o,options:ax(n),examples:Pc(n,"Examples").filter(c=>c.startsWith("skills-layer ")),mutates:s.mutates,supportsJson:!0,supportsDryRun:s.supportsDryRun,requiresLogin:s.requiresLogin,requiresNetwork:s.requiresNetwork,writesPaths:s.writesPaths,sideEffects:s.sideEffects,...s.supportsDryRun?{dryRun:s.dryRun??{flag:"--dry-run",mutates:!1,validates:["arguments","policy"],mayContactCloud:s.requiresNetwork,createsRecords:!1,sendsEmail:!1}}:{}}}function ix(e,t){if(e)return e;let n=rx(t);return n||dh.description}function rx(e){let n=Pc(e,"What it does").find(i=>i.startsWith("- "));return n?n.replace(/^-+\s*/u,"").trim():""}function sx(e,t){return Pc(e,t).join(`
+`).trim()}function Pc(e,t){let n=e.split(/\r?\n/u),i=n.findIndex(s=>s.trim().toLowerCase()===`${t.toLowerCase()}:`);return i===-1?[]:n.slice(i+1).join(`
+`).trimStart().split(/\n\s*\n/u)[0].split(/\r?\n/u).map(s=>s.trim()).filter(Boolean)}function ax(e){return[...new Set([...e.matchAll(/--[a-z0-9][a-z0-9-]*/giu)].map(t=>t[0]).sort())]}var Ht="0.1.9";var D=class extends Error{status;details;constructor(t,n,i){super(n),this.name="ApiError",this.status=t,this.details=i}},px=1,uu=1,gh=1,du="skills-layer-public-cli-v1",Ct="skills-layer-security-hook",Et="Skills Layer Security Hook",pu="https://api.skills-layer.com",fx="http://127.0.0.1:8787",mh=new Set(["json","dry-run","help","list","all","deep","verbose","show-url","no-open","quarantine","confirm","confirmed","yes","with-mcp","no-mcp","allow-unmanaged-once","disclose-source","allow-findings-featured","new-enterprise","leave-enterprise","skip-license"]),Ac=new Set(["accept-capability","approval-request-id","grant-json","paraphrase","secret-env","should-not-trigger","should-trigger"]),hh=new Set(["bio","company","description","display-name","feedback","message","note","reason","search","summary"]),yh=new Set(["action","action-json","agent","amount-cents","api-key","base-url","capability","category","claim-id","client","cloud-trust-ledger","code","commit-sha","created-after","created-before","decision","decision-evidence-json","dependency-audit-status","dir","email","environment","eval-summary","evidence-json","expires","expires-after","expires-before","external-reference","idempotency-key","fixed-version","format","install","issue-id","issue-type","key-id","kind","license","license-file","limit","listing-status","max-characters","method","mode","name","output","path","payment-method","pin","price-cents","provider","provider-installation-id","provider-owner-id","provider-project-id","provider-repo-id","provenance-intent","publication-status","rating","requested-role","review-id","role","runtime-risk","scope","security-capability","skill","skill-type","sort","source","source-intake-context","state","status","seats","text","telemetry-mode","telemetry-policy","trust","type","unmanaged-policy","version","version-id","visibility","workspace","workspace-name","enterprise-name"]),kh=new Set(_c),gx=new Set(["standards","marketplace-status","capabilities","schema-plan","optimize-tokens"]);async function CB(e,t={}){let n={env:t.env??process.env,platform:t.platform??process.platform,cwd:t.cwd??process.cwd(),now:t.now??(()=>new Date().toISOString()),fetchFn:t.fetch??globalThis.fetch,openUrl:t.openUrl??pL(t.platform??process.platform),stdoutIsTty:t.stdoutIsTty??!!process.stdout.isTTY,promptText:t.promptText??lL(),promptSecret:t.promptSecret??cL(),promptSelect:t.promptSelect??uL(t.selectInput??process.stdin,t.selectOutput??process.stdout),sleep:t.sleep??(o=>new Promise(l=>setTimeout(l,o))),emitInfo:t.emitInfo??(o=>process.stdout.write(`${o}
+`)),credentialStore:t.credentialStore!==void 0?t.credentialStore:kc(t.platform??process.platform,t.env??process.env)},i=e[0];if(!i){let o=Cc([]),l=await Zi(o.flags,n);return await ST(o.flags,l)}if(i==="--help"||i==="-h"){let o=Cc(e.slice(1));if(o.flags.json){let l=await Zi(o.flags,n),c=Nn();return b(c,"Help loaded.",!0,l)}return{exitCode:0,stdout:Wi,stderr:""}}if(i==="--version"||i==="-v")return{exitCode:0,stdout:`skills-layer ${Ht}
+`,stderr:""};let r=Cc(e.slice(1));if(r.error)return _(r.error,r.flags.json);let{flags:s,positionals:a}=r;if(i==="admin")return _("The public skills-layer package does not include internal commands.",s.json);if(i==="version"){let o=await Zi(s,n);return b({status:"ok",name:"skills-layer",version:Ht},`skills-layer ${Ht}`,s.json,o)}if(s.help){if(s.json){let l=await Zi(s,n),c=Nn(i,a);return c?b(c,"Help loaded.",!0,l):kh.has(i)?Kc([i,...a],!0):_(Rc(i),!0)}let o=Yi(i,a);return o?{exitCode:0,stdout:o,stderr:""}:kh.has(i)?Kc([i,...a],s.json):_(Rc(i),s.json)}try{let o=await Zi(s,n);switch(i){case"agents":return await yx(a,s,o);case"backend":return await kx(a,s,o);case"register":return await hy(s,o);case"login":return await yy(s,o);case"logout":return await ky(s,o);case"whoami":return await F("/api/v1/whoami",s,o,"Account loaded.",{authenticated:!0});case"profile":return await Sx(a,s,o);case"auth":return await Px(a,s,o);case"identity":return await Ex(a,s,o);case"api-key":return await xx(a,s,o);case"mcp":return await Ox(a,s,o);case"enterprise":return await Nx(a,s,o);case"search":case"find":return await Zx(a,s,o);case"featured":case"trending":return await vI(i,s,o);case"categories":return a.length>0?Lh("categories",a[0],s):await F("/api/v1/categories",s,o,"Categories loaded.");case"recommend":return await bI(a,s,o);case"compare":return await SI(a,s,o);case"show":return await _I(a,s,o);case"trust":return await PI(a,s,o);case"help":return await AI(a,s,o);case"status":return a.length>0?Lh("status",a[0],s):await F("/api/v1/status",s,o,"Status loaded.");case"doctor":return await l$(s,o);case"setup":return await rk(s,o);case"validate":return await RI(a,s,o);case"preview-trigger":return await TI(a,s,o);case"creator":return await $I(a,s,o);case"install":return await Ca(a,s,o);case"installed":return await q0(s,o);case"remove":return await M0(a,s,o);case"update":return await V0(a,s,o);case"sync":return await z0(s,o);case"restore":return await eT(a,s,o);case"check":return await nT(a,s,o);case"import":return await iT(a,s,o);case"source":return await sT(a,s,o);case"approval":return await lT(a,s,o);case"workspace":case"workspaces":return await cT(a,s,o);case"buy":return await fT(a,s,o);case"purchases":return await gT(a,s,o);case"owned":return await F("/api/v1/me/library",s,o,"Owned skills loaded.",{authenticated:!0});case"export":return await hT(a,s,o);case"library":return await mT(a,s,o);case"add-review":return await Wh("add",a,s,o);case"show-reviews":return await Wh("show",a,s,o);case"add-issue":return await Yh("add",a,s,o);case"show-issues":return await Yh("show",a,s,o);case"guardian":return await yT(a,s,o);default:return _(Rc(i),s.json)}}catch(o){return o instanceof D?dr(o,s.json):_(X(o),s.json)}}function Rc(e){let t=e.trim().toLowerCase();return t==="purchase"?`Unknown command "${e}".
 
 Did you mean:
   skills-layer buy <skill-slug>
@@ -1222,7 +1442,8 @@ Did you mean:
   skills-layer show <skill-slug>`:t==="security-report"?`Unknown command "${e}".
 
 Did you mean:
-  skills-layer trust <skill-slug>`:`Unknown command "${e}".`}function xn(e){let t={json:e.includes("--json"),help:!1,dryRun:!1,list:!1,all:!1,deep:!1,verbose:!1,showUrl:!1,noOpen:!1,quarantine:!1,confirmed:!1,allowUnmanagedOnce:!1,discloseSource:!1,allowFindingsFeatured:!1,shouldTrigger:[],shouldNotTrigger:[],paraphrase:[],grantJson:[],findingCode:[],acceptCapability:[],approvalRequestId:[]},n=[];for(let i=0;i<e.length;i+=1){let r=e[i];if(!r)continue;if(r==="--"){n.push(...e.slice(i+1));break}if(r==="-h"){t.help=!0;continue}if(!r.startsWith("--")){n.push(r);continue}let s=r.slice(2);if(s!=="install"&&!Pr.has(s)&&!Cr.has(s)&&!_r.has(s)&&!Cn.has(s))return{flags:t,positionals:n,error:`Unknown flag --${s}.`};if(Pr.has(s)){let a=Rn(s);s==="confirm"||s==="yes"?t.confirmed=!0:t[a]=!0;continue}let o=e[i+1];if(!o||o.startsWith("--")){if(s==="install"){t.install="";continue}return{flags:t,positionals:n,error:`Flag --${s} requires a value.`}}if(Cr.has(s)){let a=vl(e,i);if(!a.value)return{flags:t,positionals:n,error:`Flag --${s} requires a value.`};t[Rn(s)]=a.value,i=a.nextIndex;continue}if(_r.has(s)||Cn.has(s)){let a=Rn(s);if(Cn.has(s)){let c=Array.isArray(t[a])?t[a]:[];c.push(o),t[a]=c}else t[a]=o;i+=1;continue}return{flags:t,positionals:n,error:`Unknown flag --${s}.`}}return{flags:t,positionals:n}}function vl(e,t){let n=[],i=t;for(let r=t+1;r<e.length;r+=1){let s=e[r];if(!s||s.startsWith("--"))break;n.push(s),i=r}return{value:n.length>0?n.join(" "):null,nextIndex:i}}function Rn(e){return e.replace(/-([a-z])/gu,(t,n)=>n.toUpperCase())}async function lt(e,t){let n=bl(t.env,t.platform),[i,r]=await Promise.all([jp(n.configPath,t),W(n.backendPreferencePath)]),s=Ce(p(e.baseUrl)??oe(t.env.SKILLS_LAYER_BASE_URL)??oe(r?.preferredBaseUrl)??oe(i?.baseUrl)??di),o=p(e.apiKey)??oe(t.env.SKILLS_LAYER_API_KEY),a=oe(i?.apiKey),c=oe(i?.baseUrl),u=!c||mt(c,s),d=o??(u?a:void 0),g=!o&&a&&c&&!u?`Your saved login belongs to ${Ce(c)}, but the selected backend is ${s}. Run \`skills-layer backend --base-url ${Ce(c)}\` to use that login, or run \`skills-layer login\` for ${s}.`:void 0;return{...t,paths:n,config:i,baseUrl:s,apiKey:d,authBlockedMessage:g}}function bl(e,t){let n=t==="win32"?ze:oi,i=t==="win32"?oe(e.USERPROFILE)??oe(e.HOME):oe(e.HOME),r=n.join(i??".",".skills-layer");return{stateDir:r,configPath:n.join(r,"config.json"),backendPreferencePath:n.join(r,"backend-preference.json"),installsPath:n.join(r,"installs.json"),importsPath:n.join(r,"imports.json"),mcpConfigPath:n.join(r,"mcp.json"),mcpPreferencePath:n.join(r,"mcp-preference.json"),bundlesDir:n.join(r,"bundles"),incidentsDir:n.join(r,"incidents")}}async function Sl(e,t,n){if(e[0]!=="list")return k(`Unknown agents command "${e[0]??""}".`,t.json);let i=Pe(n.env,n.platform,n.cwd).map(r=>({id:r.id,displayName:r.displayName,capabilities:r.capabilities,projectSkillsPath:r.targets.projectSkillsPath,globalSkillsPath:r.targets.globalSkillsPath}));return h({status:"ok",results:i},`Found ${i.length} supported agent targets.`,t.json,n)}async function Pl(e,t,n){let i=e[0],r=p(t.baseUrl);if(!i&&r||i==="cloud"||i==="local"){let c=Ce(r??(i==="local"?kl:di)),u=uc(c,t);if(u)return u;let d=pe(c),g=n.config?.baseUrl??null,f=!n.config?.baseUrl||mt(n.config.baseUrl,c);return await ee(n.paths.backendPreferencePath,{version:ci,preferredBaseUrl:c,savedAt:n.now()}),h({status:"updated",selectedBackend:d,selectedBaseUrl:c,savedLoginBaseUrl:g,loginMatchesSelectedBackend:f,loggedIn:!!n.apiKey&&f,...f?{}:{warning:`Saved login belongs to ${g}; selected backend is ${c}.`}},f?`Backend set to ${d}.`:`Backend set to ${d}. Saved login is for ${g}.`,t.json,n)}if(i&&i!=="status")return k(`Unknown backend command "${i}".`,t.json);let s=pe(n.baseUrl),o=!n.config?.baseUrl||mt(n.config.baseUrl,n.baseUrl),a=!!n.apiKey&&o;return h({status:"ok",selectedBackend:s,selectedBaseUrl:n.baseUrl,savedLoginBaseUrl:n.config?.baseUrl??null,loginMatchesSelectedBackend:o,loggedIn:a,email:a?n.config?.email??null:null,role:a?n.config?.role??null:null},`Backend: ${n.baseUrl}`,t.json,n)}var pi=[{value:"google",label:"Google",description:"Open browser sign-in and return here"},{value:"github",label:"GitHub",description:"Open browser sign-in and return here"},{value:"gitlab",label:"GitLab",description:"Open browser sign-in and return here"},{value:"microsoft",label:"Microsoft",description:"Open browser sign-in and return here"}],Cl=[...pi,{value:"email",label:"Email code",description:"Use an emailed one-time code"},{value:"api_key",label:"API key (advanced)",description:"Paste an existing Skills Layer login key"}],_l=[{value:"email",label:"Email",description:"Use an emailed verification code and API key"},...pi];async function Ss(e,t){let n=p(e.method);if(!n)if(e.json)n="email";else try{n=await t.promptSelect("Choose how to register:",_l)}catch{return k("register requires --method when interactive selection is unavailable. Try `skills-layer register --method email --email you@example.com`, `skills-layer register --method google`, `skills-layer register --method github`, `skills-layer register --method gitlab`, or `skills-layer register --method microsoft`.",!1)}let i=ce("register","method",n,Xl,e,"invalid_method");if(i)return i;if(n==="email"){let s=p(e.email);if(!s&&!e.json)try{s=await t.promptText("Enter your email address: ")}catch{return k("register --method email requires --email when interactive prompts are unavailable.",!1)}s=b(s,"register requires --email.");let o=await S(t,"/api/v1/register",{method:"POST",headers:I(),body:JSON.stringify({method:n,email:s})});if(e.json){let c=o.status==="already_registered"?ti(o):Y({...o,nextCommand:`skills-layer auth verify --email ${s} --code <code> --json`,nextAction:"auth.verify"}),u=o.status==="already_registered"?`${s} is already registered.`:`Registration started for ${s}.`;return h(c,u,e.json,t)}if(o.status==="already_registered")return h(ti(o),`${s} is already registered. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,!1,t);let a;try{a=await t.promptText(`Enter the verification code sent to ${s} (check spam/junk folder if missing): `)}catch{return h(Y(o),`Registration started for ${s}. Check your email (including spam/junk folder) for the verification code, then run \`skills-layer auth verify --email ${s} --code <code>\`.`,!1,t)}return await co(s,a,e,t,`Verified ${s}.`)}let r=await S(t,"/api/v1/identity/social/start",{method:"POST",headers:I(),body:JSON.stringify({provider:n,mode:"login"})});return e.json?h(r,"Social registration started.",e.json,t):await _i(n,r,e,t,"login")}async function Ps(e,t){if(e.withMcp&&e.noMcp)return k("login cannot combine --with-mcp and --no-mcp.",e.json);let n=p(e.apiKey);if(n){let a=await pt(t,n,{notifyLogin:!0}),c=await Kn(e,{...t,config:a,apiKey:n});return H(c)?c:h(Y({status:"verified",...a,...c.data?{mcp:c.data}:{}}),[`Logged in as ${a.email}.`,c.message??""].filter(Boolean).join(" "),e.json,t)}let i=p(e.method);if(!i&&!e.json)try{let a=await t.promptSelect("Choose how to sign in:",Cl);i=a==="api_key"?void 0:a}catch{return k("login requires --api-key or --method <email|google|github|gitlab|microsoft> when interactive selection is unavailable.",!1)}let r=ce("login","method",i,Ql,e,"invalid_method");if(r)return r;if(i){if(i==="email"){let c=p(e.email);!c&&!e.json&&(c=(await t.promptText("Enter your email address: ")).trim()),c=b(c,"login --method email requires --email.");let u=await S(t,"/api/v1/identity/recover/start",{method:"POST",headers:I(),body:JSON.stringify({email:c,method:"email",intent:"login"})});if(e.json)return h(u,`Passwordless email login started for ${c}.`,!0,t);let d;try{d=(await t.promptText(`Enter the sign-in code sent to ${c} (check spam/junk folder if missing): `)).trim()}catch{return h(u,`Passwordless email login started for ${c}. Check your email, then run \`skills-layer login --method email --email ${c}\` again when prompts are available.`,!1,t)}let g=await S(t,"/api/v1/identity/recover/complete",{method:"POST",headers:I(),body:JSON.stringify({email:c,code:d,intent:"login"})});return await Wt(c,g,e,t,`Verified ${c}.`)}if(!["google","github","gitlab","microsoft"].includes(i))return k("login --method must be email, google, github, gitlab, or microsoft.",e.json);let a=await S(t,"/api/v1/identity/social/start",{method:"POST",headers:I(),body:JSON.stringify({provider:i,mode:"login"})});return e.json?h(a,"Social login started.",!0,t):await _i(i,a,e,t,"login")}if(!e.json)try{n=(await t.promptSecret("Enter your Skills Layer API key: ")).trim()}catch{return k("login requires an API key.",e.json)}if(!n)return k("login requires --api-key or --method <email|google|github|gitlab|microsoft>.",e.json);let s=await pt(t,n,{notifyLogin:!0}),o=await Kn(e,{...t,config:s,apiKey:n});return H(o)?o:h(Y({status:"verified",...s,...o.data?{mcp:o.data}:{}}),[`Logged in as ${s.email}.`,o.message??""].filter(Boolean).join(" "),e.json,t)}async function Cs(e,t){return await mr(t.config,{env:t.env,platform:t.platform,store:t.credentialStore}),await ri(t.paths.configPath,{force:!0}),h({status:"logged_out"},"Logged out.",e.json,t)}async function xl(e,t,n){let i=e[0]??"show";if(i==="show")return await $("/api/v1/profile",t,n,"Editable profile loaded.",{authenticated:!0});if(i==="update"){let r=await Rl(t,n);if(H(r))return r;let s=await S(n,"/api/v1/profile",{method:"PATCH",headers:I(n.apiKey),body:JSON.stringify(r)});return h(s,"Profile updated.",t.json,n)}return k(`Unknown profile command "${i}".`,t.json)}async function Rl(e,t){let n=Z(e,["displayName","bio","company"]);if(Object.keys(n).length>0)return n;if(e.json)return k("profile update requires at least one of --display-name, --bio, or --company.",!0);try{let i=await t.promptText("Display name (leave blank to keep unchanged): "),r=await t.promptText("Bio (leave blank to keep unchanged): "),s=await t.promptText("Company (leave blank to keep unchanged): "),o=_({displayName:i||void 0,bio:r||void 0,company:s||void 0});return Object.keys(o).length===0?k("No profile changes entered.",!1):o}catch{return k("profile update requires at least one of --display-name, --bio, or --company.",!1)}}async function $l(e,t,n){let i=e[0];if(i==="register")return await Ss({...t,method:"email"},n);if(i==="verify"){let r=b(t.email,"auth verify requires --email."),s=b(t.code,"auth verify requires --code.");return await co(r,s,t,n,`Verified ${r}.`)}return i==="recover"?await Il(e.slice(1),t,n):i==="login"?await Ps(t,n):i==="logout"?await Cs(t,n):i==="status"?Al(t,n):i==="repair"?await El(t,n):k(`Unknown auth command "${i??""}".`,t.json)}function Al(e,t){let n=t.config?.baseUrl?Ce(t.config.baseUrl):null,i=!!(t.apiKey&&n&&mt(n,t.baseUrl));return h({status:"auth_status",selectedBackend:pe(t.baseUrl),selectedBaseUrl:t.baseUrl,loggedIn:i,requiresLogin:!i,...t.config?.email?{savedLogin:{baseUrl:n,email:t.config.email,role:t.config.role??null,roles:t.config.roles??[],savedAt:t.config.savedAt??null,...t.config.credentialStorage?{credentialStorage:t.config.credentialStorage}:{},matchesSelectedBackend:i}}:{}},i&&t.config?.email?`Logged in as ${t.config.email}.`:t.config?.baseUrl?`Saved login targets ${n}; selected backend is ${t.baseUrl}. Run \`skills-layer auth repair\` or \`skills-layer login\`.`:"Not logged in. Run `skills-layer login`.",e.json,t)}async function El(e,t){if(!t.config?.baseUrl||!t.config.apiKey||!t.config.email||!t.config.role||!t.config.savedAt)return w({status:"login_required",reasonCode:"login_required",nextAction:"login",nextStep:"Run `skills-layer login` to create a saved session, then use `skills-layer auth repair` only if backend/session metadata drifts."},"No saved Skills Layer login was found to repair. Run `skills-layer login`.",e.json,"login_required");let n=Ce(t.config.baseUrl);return await ee(t.paths.backendPreferencePath,{version:ci,preferredBaseUrl:n,savedAt:t.now()}),await Ri(t.paths.configPath,{...t.config,baseUrl:n,savedAt:t.now()},t),h({status:"auth_repaired",baseUrl:n,loggedIn:!0,email:t.config.email,role:t.config.role,credentialStorage:t.config.credentialStorage??"local_file_locked"},`Auth repaired for ${t.config.email}. Backend preference now matches ${n}.`,e.json,t)}async function Il(e,t,n){let i=e[0]??p(t.method)??"email",r=p(t.email);if(!r&&!t.json)try{r=await n.promptText("Enter your email address: ")}catch{return k("auth recover requires --email when interactive prompts are unavailable.",!1)}if(r=b(r,"auth recover requires --email."),i==="complete"){let c=p(t.code);if(!c&&!t.json)try{c=await n.promptText("Enter the recovery code: ")}catch{return k("auth recover complete requires --code when interactive prompts are unavailable.",!1)}return c=b(c,"auth recover complete requires --code."),await Rr(r,c,t,n)}let s=await S(n,"/api/v1/identity/recover/start",{method:"POST",headers:I(),body:JSON.stringify({email:r,method:i})}),o=ti(s);if(t.json)return h(o,"Recovery started.",!0,n);let a="";try{a=(await n.promptText("Enter the recovery code if you received one, or press Enter to stop: ")).trim()}catch{return h(o,`If this email can continue, instructions have been sent. Check your inbox and spam folder. When you have a code, run \`skills-layer auth recover complete --email ${r} --code <code>\`.`,!1,n)}return a?await Rr(r,a,t,n):h(o,`If this email can continue, instructions have been sent. When you have a code, run \`skills-layer auth recover complete --email ${r} --code <code>\`.`,!1,n)}async function Rr(e,t,n,i){let r=await S(i,"/api/v1/identity/recover/complete",{method:"POST",headers:I(),body:JSON.stringify({email:e,code:t})});if(n.json){let s=l(r,"apiKey");return s?(await pt(i,s,{expectedEmail:e,knownEmail:l(r,"email")??e,knownRole:l(r,"role")??"user",knownRoles:ue(r,"roles"),knownUserId:l(r,"userId")}),h(Y({...r,loggedIn:!0}),"Recovery complete.",!0,i)):h(Y({...r,email:e,loggedIn:!1}),"Recovery complete.",!0,i)}return await Wt(e,r,n,i,`Recovered access for ${e}.`)}async function jl(e,t,n){let i=e[0],r=1;if(i==="providers")return await $("/api/v1/identity/social/providers",t,n,"Identity providers loaded.");if(i==="start"){let s=p(t.provider);if(!s&&!t.json)try{s=await n.promptSelect("Choose identity provider:",pi)}catch{return k("identity start requires --provider when interactive selection is unavailable.",!1)}s=b(s,"identity start requires --provider.");let o=await S(n,"/api/v1/identity/social/start",{method:"POST",headers:I(n.apiKey),body:JSON.stringify({provider:s,mode:p(t.mode)??"login"})});return t.json?h(o,"Social auth started.",!0,n):await _i(s,o,t,n,"login")}if(i==="status"){let s=p(t.state)??e[r];return s?await $(`/api/v1/identity/social/status/${encodeURIComponent(s)}`,t,n,"Social auth status loaded."):k("identity status requires --state.",t.json)}if(i==="complete"){let s=b(t.provider,"identity complete requires --provider."),o=b(t.state,"identity complete requires --state."),a=b(t.code,"identity complete requires --code."),c=await S(n,"/api/v1/identity/social/complete",{method:"POST",headers:I(n.apiKey),body:JSON.stringify({provider:s,state:o,code:a})});return await Bd(c,n),h(Y(c),"Social auth complete.",t.json,n)}if(i==="list")return await $("/api/v1/me/linked-identities",t,n,"Linked identities loaded.",{authenticated:!0});if(i==="unlink"){let s=b(t.provider??e[r],"identity unlink requires a provider."),o=await S(n,`/api/v1/me/linked-identities/${encodeURIComponent(s)}`,{method:"DELETE",headers:F(n.apiKey,n.authBlockedMessage)});return h(o,"Identity unlinked.",t.json,n)}return k(`Unknown identity command "${i??""}".`,t.json)}async function Ll(e,t,n){let i=e[0];if(!i)return k("api-key requires create, list, or revoke.",t.json);if(i==="list"){let r=Ul(t);if(r.failure)return r.failure;let s=await S(n,"/api/v1/me/api-keys",{headers:F(n.apiKey,n.authBlockedMessage)}),o=Tl(Dn(s),r.filters);return h({...s,filters:_({...r.filters}),results:o},"API keys loaded.",t.json,n)}if(i==="create"){let r=p(t.name),s=qp(t.scope);if(!r)return k("api-key create requires --name.",t.json);if(s.length===0)return k("api-key create requires at least one --scope.",t.json);let o=s.find(u=>!Tr.includes(u));if(o)return je("api-key.create","scope",o,Tr,t,"invalid_scope");let a=pc("api-key.create",t.expires,t);if(a)return a;if(t.dryRun){let u=await S(n,"/api/v1/me/api-keys",{headers:F(n.apiKey,n.authBlockedMessage)}),d=Dn(u).filter(g=>_s(g)==="active"&&l(g,"type")==="automation");return d.length>=Br?w({status:"error",reasonCode:"api_key_active_limit_reached",maxActiveAutomationKeys:Br,activeAutomationKeyCount:d.length,nextAction:"api-key.revoke",nextStep:"Revoke an unused automation key before creating another."},"Too many active automation keys. Revoke unused keys before creating another.",t.json,"api_key_active_limit_reached"):h(_({status:"pass",wouldCreate:!0,type:"automation",name:r,scopes:s,expiresAt:Nl(p(t.expires),n.now()),secretReturned:!1,secretDelivery:"email",warnings:[]}),"API key create dry run passed.",t.json,n)}let c=await S(n,"/api/v1/me/api-keys",{method:"POST",headers:{"content-type":"application/json",...F(n.apiKey,n.authBlockedMessage)},body:JSON.stringify({name:r,scopes:s,...p(t.expires)?{expiresIn:p(t.expires)}:{}})});return h({...Y(c),secretReturned:!1,secretDelivery:"email"},"Automation API key created. The full key was sent to your verified email. Run `skills-layer api-key list` to manage keys.",t.json,n)}if(i==="rotate")return k(`api-key rotate is not part of normal login.
+  skills-layer trust <skill-slug>`:`Unknown command "${e}".`}function Cc(e){let t={json:e.includes("--json"),help:!1,dryRun:!1,list:!1,all:!1,deep:!1,verbose:!1,showUrl:!1,noOpen:!1,quarantine:!1,confirmed:!1,allowUnmanagedOnce:!1,discloseSource:!1,allowFindingsFeatured:!1,shouldTrigger:[],shouldNotTrigger:[],paraphrase:[],grantJson:[],findingCode:[],acceptCapability:[],approvalRequestId:[]},n=[];for(let i=0;i<e.length;i+=1){let r=e[i];if(!r)continue;if(r==="--"){n.push(...e.slice(i+1));break}if(r==="-h"){t.help=!0;continue}if(!r.startsWith("--")){n.push(r);continue}let s=r.slice(2);if(s!=="install"&&!mh.has(s)&&!hh.has(s)&&!yh.has(s)&&!Ac.has(s))return{flags:t,positionals:n,error:`Unknown flag --${s}.`};if(mh.has(s)){let o=Ec(s);s==="confirm"||s==="yes"?t.confirmed=!0:t[o]=!0;continue}let a=e[i+1];if(!a||a.startsWith("--")){if(s==="install"){t.install="";continue}return{flags:t,positionals:n,error:`Flag --${s} requires a value.`}}if(hh.has(s)){let o=mx(e,i);if(!o.value)return{flags:t,positionals:n,error:`Flag --${s} requires a value.`};t[Ec(s)]=o.value,i=o.nextIndex;continue}if(yh.has(s)||Ac.has(s)){let o=Ec(s);if(Ac.has(s)){let l=Array.isArray(t[o])?t[o]:[];l.push(a),t[o]=l}else t[o]=a;i+=1;continue}return{flags:t,positionals:n,error:`Unknown flag --${s}.`}}return{flags:t,positionals:n}}function mx(e,t){let n=[],i=t;for(let r=t+1;r<e.length;r+=1){let s=e[r];if(!s||s.startsWith("--"))break;n.push(s),i=r}return{value:n.length>0?n.join(" "):null,nextIndex:i}}function Ec(e){return e.replace(/-([a-z])/gu,(t,n)=>n.toUpperCase())}async function Zi(e,t){let n=hx(t.env,t.platform),[i,r]=await Promise.all([oL(n.configPath,t),le(n.backendPreferencePath)]),s=nt(k(e.baseUrl)??J(t.env.SKILLS_LAYER_BASE_URL)??J(r?.preferredBaseUrl)??J(i?.baseUrl)??pu),a=k(e.apiKey)??J(t.env.SKILLS_LAYER_API_KEY),o=J(i?.apiKey),l=J(i?.baseUrl),c=!l||cr(l,s),d=a??(c?o:void 0),p=!a&&o&&l&&!c?`Your saved login belongs to ${nt(l)}, but the selected backend is ${s}. Run \`skills-layer backend --base-url ${nt(l)}\` to use that login, or run \`skills-layer login\` for ${s}.`:void 0;return{...t,paths:n,config:i,baseUrl:s,apiKey:d,authBlockedMessage:p}}function hx(e,t){let n=t==="win32"?rt:Qt,i=t==="win32"?J(e.USERPROFILE)??J(e.HOME):J(e.HOME),r=n.join(i??".",".skills-layer");return{stateDir:r,configPath:n.join(r,"config.json"),backendPreferencePath:n.join(r,"backend-preference.json"),installTargetPreferencePath:n.join(r,"install-target-preference.json"),installsPath:n.join(r,"installs.json"),importsPath:n.join(r,"imports.json"),mcpConfigPath:n.join(r,"mcp.json"),mcpPreferencePath:n.join(r,"mcp-preference.json"),bundlesDir:n.join(r,"bundles"),incidentsDir:n.join(r,"incidents")}}async function yx(e,t,n){if(e[0]!=="list")return _(`Unknown agents command "${e[0]??""}".`,t.json);let i=We(n.env,n.platform,n.cwd).map(r=>({id:r.id,displayName:r.displayName,capabilities:r.capabilities,projectSkillsPath:r.targets.projectSkillsPath,globalSkillsPath:r.targets.globalSkillsPath}));return b({status:"ok",results:i},`Found ${i.length} supported agent targets.`,t.json,n)}async function kx(e,t,n){let i=e[0],r=k(t.baseUrl);if(!i&&r||i==="cloud"||i==="local"){let l=nt(r??(i==="local"?fx:pu)),c=hI(l,t);if(c)return c;let d=Ee(l),p=n.config?.baseUrl??null,f=!n.config?.baseUrl||cr(n.config.baseUrl,l);return await xe(n.paths.backendPreferencePath,{version:uu,preferredBaseUrl:l,savedAt:n.now()}),b({status:"updated",selectedBackend:d,selectedBaseUrl:l,savedLoginBaseUrl:p,loginMatchesSelectedBackend:f,loggedIn:!!n.apiKey&&f,...f?{}:{warning:`Saved login belongs to ${p}; selected backend is ${l}.`}},f?`Backend set to ${d}.`:`Backend set to ${d}. Saved login is for ${p}.`,t.json,n)}if(i&&i!=="status")return _(`Unknown backend command "${i}".`,t.json);let s=Ee(n.baseUrl),a=!n.config?.baseUrl||cr(n.config.baseUrl,n.baseUrl),o=!!n.apiKey&&a;return b({status:"ok",selectedBackend:s,selectedBaseUrl:n.baseUrl,savedLoginBaseUrl:n.config?.baseUrl??null,loginMatchesSelectedBackend:a,loggedIn:o,email:o?n.config?.email??null:null,role:o?n.config?.role??null:null},`Backend: ${n.baseUrl}`,t.json,n)}var fu=[{value:"google",label:"Google",description:"Open browser sign-in and return here"},{value:"github",label:"GitHub",description:"Open browser sign-in and return here"},{value:"gitlab",label:"GitLab",description:"Open browser sign-in and return here"},{value:"microsoft",label:"Microsoft",description:"Open browser sign-in and return here"}],wx=[...fu,{value:"email",label:"Email code",description:"Use an emailed one-time code"},{value:"api_key",label:"API key (advanced)",description:"Paste an existing Skills Layer login key"}],vx=[{value:"email",label:"Email",description:"Use an emailed verification code and API key"},...fu];async function hy(e,t){let n=k(e.method);if(!n)if(e.json)n="email";else try{n=await t.promptSelect("Choose how to register:",vx)}catch{return _("register requires --method when interactive selection is unavailable. Try `skills-layer register --method email --email you@example.com`, `skills-layer register --method google`, `skills-layer register --method github`, `skills-layer register --method gitlab`, or `skills-layer register --method microsoft`.",!1)}let i=Je("register","method",n,aI,e,"invalid_method");if(i)return i;if(n==="email"){let a=k(e.email);if(!a&&!e.json)try{a=await t.promptText("Enter your email address: ")}catch{return _("register --method email requires --email when interactive prompts are unavailable.",!1)}a=R(a,"register requires --email.");let o=await C(t,"/api/v1/register",{method:"POST",headers:j(),body:JSON.stringify({method:n,email:a})});if(e.json){let c=o.status==="already_registered"?ou(o):Ae({...o,nextCommand:`skills-layer auth verify --email ${a} --code <code> --json`,nextAction:"auth.verify"}),d=o.status==="already_registered"?`${a} is already registered.`:`Registration started for ${a}.`;return b(c,d,e.json,t)}if(o.status==="already_registered")return b(ou(o),`${a} is already registered. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,!1,t);let l;try{l=await t.promptText(`Enter the verification code sent to ${a} (check spam/junk folder if missing): `)}catch{return b(Ae(o),`Registration started for ${a}. Check your email (including spam/junk folder) for the verification code, then run \`skills-layer auth verify --email ${a} --code <code>\`.`,!1,t)}return await hk(a,l,e,t,`Verified ${a}.`)}let r=en(),s=await C(t,"/api/v1/identity/social/start",{method:"POST",headers:j(),body:JSON.stringify({provider:n,mode:"login",handoffCodeHash:r.authorizationCodeHash,handoffCodeChallenge:r.codeChallenge})});return await Pu(n,s,r,e,t,"login")}async function yy(e,t){if(e.withMcp&&e.noMcp)return _("login cannot combine --with-mcp and --no-mcp.",e.json);let n=k(e.apiKey);if(n){let l=await sr(t,n,{notifyLogin:!0}),c=await zc(e,{...t,config:l,apiKey:n});if(Z(c))return c;let d=await Gc(e,{...t,config:l,apiKey:n});return Z(d)?d:b(Ae({status:"verified",...l,...c.data?{workingMode:c.data}:{},...d.data?{mcp:d.data}:{}}),[`Logged in as ${l.email}.`,c.message??"",d.message??""].filter(Boolean).join(" "),e.json,t)}let i=k(e.method);if(!i&&!e.json)try{let l=await t.promptSelect("Choose how to sign in:",wx);i=l==="api_key"?void 0:l}catch{return _("login requires --api-key or --method <email|google|github|gitlab|microsoft> when interactive selection is unavailable.",!1)}let r=Je("login","method",i,sI,e,"invalid_method");if(r)return r;if(i){if(i==="email"){let d=k(e.email);!d&&!e.json&&(d=(await t.promptText("Enter your email address: ")).trim()),d=R(d,"login --method email requires --email.");let p=await C(t,"/api/v1/identity/recover/start",{method:"POST",headers:j(),body:JSON.stringify({email:d,method:"email",intent:"login"})});if(e.json)return b(p,`Passwordless email login started for ${d}.`,!0,t);let f;try{f=(await t.promptText(`Enter the sign-in code sent to ${d} (check spam/junk folder if missing): `)).trim()}catch{return b(p,`Passwordless email login started for ${d}. Check your email, then run \`skills-layer login --method email --email ${d}\` again when prompts are available.`,!1,t)}return await qc(d,f,e,t,{intent:"login",successLead:`Verified ${d}.`})}if(!["google","github","gitlab","microsoft"].includes(i))return _("login --method must be email, google, github, gitlab, or microsoft.",e.json);let l=en(),c=await C(t,"/api/v1/identity/social/start",{method:"POST",headers:j(),body:JSON.stringify({provider:i,mode:"login",handoffCodeHash:l.authorizationCodeHash,handoffCodeChallenge:l.codeChallenge})});return await Pu(i,c,l,e,t,"login")}if(!e.json)try{n=(await t.promptSecret("Enter your Skills Layer API key: ")).trim()}catch{return _("login requires an API key.",e.json)}if(!n)return _("login requires --api-key or --method <email|google|github|gitlab|microsoft>.",e.json);let s=await sr(t,n,{notifyLogin:!0}),a=await zc(e,{...t,config:s,apiKey:n});if(Z(a))return a;let o=await Gc(e,{...t,config:s,apiKey:n});return Z(o)?o:b(Ae({status:"verified",...s,...a.data?{workingMode:a.data}:{},...o.data?{mcp:o.data}:{}}),[`Logged in as ${s.email}.`,a.message??"",o.message??""].filter(Boolean).join(" "),e.json,t)}async function ky(e,t){let n=!1,i=J(t.config?.apiKey)??t.apiKey,r=nt(J(t.config?.baseUrl)??t.baseUrl);if(i)try{await C({...t,baseUrl:r,apiKey:i},"/api/v1/me/working-mode",{method:"DELETE",headers:V(i)}),n=!0}catch{n=!1}return await sh(t.config,{env:t.env,platform:t.platform,store:t.credentialStore}),await bx(t),await Tt(t.paths.configPath,{force:!0}),b({status:"logged_out",serverWorkingModeCleared:n,mcpAuthCleared:!0},"Logged out.",e.json,t)}async function bx(e){let t=await le(e.paths.mcpConfigPath),n=t?u(t,"baseUrl")??e.baseUrl:e.baseUrl,i=t?u(t,"clientId")??"codex":"codex",r=sn({baseUrl:n,mcpUrl:t?u(t,"mcpUrl")??`${n}/mcp`:`${n}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:i,environment:t?u(t,"environment")??Ee(n):Ee(n),now:e.now(),env:e.env,platform:e.platform,cwd:e.cwd,stateDir:e.paths.stateDir,mcpConfigPath:e.paths.mcpConfigPath,nodePath:process.execPath});await by(t,e),await Da(r.bridgePath),await qa(r.brokerPath,r.brokerSocketPath),await Tt(e.paths.mcpConfigPath,{force:!0}),await Tt(e.paths.mcpPreferencePath,{force:!0})}async function Sx(e,t,n){let i=e[0]??"show";if(i==="show")return await F("/api/v1/profile",t,n,"Editable profile loaded.",{authenticated:!0});if(i==="update"){let r=await _x(t,n);if(Z(r))return r;let s=await C(n,"/api/v1/profile",{method:"PATCH",headers:j(n.apiKey),body:JSON.stringify(r)});return b(s,"Profile updated.",t.json,n)}return _(`Unknown profile command "${i}".`,t.json)}async function _x(e,t){let n=he(e,["displayName","bio","company"]);if(Object.keys(n).length>0)return n;if(e.json)return _("profile update requires at least one of --display-name, --bio, or --company.",!0);try{let i=await t.promptText("Display name (leave blank to keep unchanged): "),r=await t.promptText("Bio (leave blank to keep unchanged): "),s=await t.promptText("Company (leave blank to keep unchanged): "),a=B({displayName:i||void 0,bio:r||void 0,company:s||void 0});return Object.keys(a).length===0?_("No profile changes entered.",!1):a}catch{return _("profile update requires at least one of --display-name, --bio, or --company.",!1)}}async function Px(e,t,n){let i=e[0];if(i==="register")return await hy({...t,method:"email"},n);if(i==="verify"){let r=R(t.email,"auth verify requires --email."),s=R(t.code,"auth verify requires --code.");return await hk(r,s,t,n,`Verified ${r}.`)}return i==="recover"?await Cx(e.slice(1),t,n):i==="login"?await yy(t,n):i==="logout"?await ky(t,n):i==="status"?Ax(t,n):i==="repair"?await Rx(t,n):_(`Unknown auth command "${i??""}".`,t.json)}function Ax(e,t){let n=t.config?.baseUrl?nt(t.config.baseUrl):null,i=!!(t.apiKey&&n&&cr(n,t.baseUrl));return b({status:"auth_status",selectedBackend:Ee(t.baseUrl),selectedBaseUrl:t.baseUrl,loggedIn:i,requiresLogin:!i,...t.config?.email?{savedLogin:{baseUrl:n,email:t.config.email,role:t.config.role??null,roles:t.config.roles??[],savedAt:t.config.savedAt??null,...t.config.credentialStorage?{credentialStorage:t.config.credentialStorage}:{},matchesSelectedBackend:i}}:{}},i&&t.config?.email?`Logged in as ${t.config.email}.`:t.config?.baseUrl?`Saved login targets ${n}; selected backend is ${t.baseUrl}. Run \`skills-layer auth repair\` or \`skills-layer login\`.`:"Not logged in. Run `skills-layer login`.",e.json,t)}async function Rx(e,t){if(!t.config?.baseUrl||!t.config.apiKey||!t.config.email||!t.config.role||!t.config.savedAt)return P({status:"login_required",reasonCode:"login_required",nextAction:"login",nextStep:"Run `skills-layer login` to create a saved session, then use `skills-layer auth repair` only if backend/session metadata drifts."},"No saved Skills Layer login was found to repair. Run `skills-layer login`.",e.json,"login_required");let n=nt(t.config.baseUrl);return await xe(t.paths.backendPreferencePath,{version:uu,preferredBaseUrl:n,savedAt:t.now()}),await Ru(t.paths.configPath,{...t.config,baseUrl:n,savedAt:t.now()},t),b({status:"auth_repaired",baseUrl:n,loggedIn:!0,email:t.config.email,role:t.config.role,credentialStorage:t.config.credentialStorage??"local_file_locked"},`Auth repaired for ${t.config.email}. Backend preference now matches ${n}.`,e.json,t)}async function Cx(e,t,n){let i=e[0]??k(t.method)??"email",r=k(t.email);if(!r&&!t.json)try{r=await n.promptText("Enter your email address: ")}catch{return _("auth recover requires --email when interactive prompts are unavailable.",!1)}if(r=R(r,"auth recover requires --email."),i==="complete"){let l=k(t.code);if(!l&&!t.json)try{l=await n.promptText("Enter the recovery code: ")}catch{return _("auth recover complete requires --code when interactive prompts are unavailable.",!1)}return l=R(l,"auth recover complete requires --code."),await qc(r,l,t,n)}let s=await C(n,"/api/v1/identity/recover/start",{method:"POST",headers:j(),body:JSON.stringify({email:r,method:i})}),a=ou(s);if(t.json)return b(a,"Recovery started.",!0,n);let o="";try{o=(await n.promptText("Enter the recovery code if you received one, or press Enter to stop: ")).trim()}catch{return b(a,`If this email can continue, instructions have been sent. Check your inbox and spam folder. When you have a code, run \`skills-layer auth recover complete --email ${r} --code <code>\`.`,!1,n)}return o?await qc(r,o,t,n):b(a,`If this email can continue, instructions have been sent. When you have a code, run \`skills-layer auth recover complete --email ${r} --code <code>\`.`,!1,n)}async function qc(e,t,n,i,r={}){let s=en(),a=await C(i,"/api/v1/identity/recover/complete",{method:"POST",headers:j(),body:JSON.stringify({email:e,code:t,...r.intent?{intent:r.intent}:{},handoffCodeHash:s.authorizationCodeHash,handoffCodeChallenge:s.codeChallenge})});if(u(a,"status")!=="recovered")return _("Email recovery did not prepare a secure credential handoff. Start recovery again.",n.json);let o=await C(i,"/api/v1/identity/credential-handoff/exchange",{method:"POST",headers:j(),body:JSON.stringify({authorizationCode:s.authorizationCode,codeVerifier:s.codeVerifier})});if(u(o,"status")!=="exchanged"||!u(o,"email")||!u(o,"role")||!u(o,"apiKey"))return _("Email recovery credential handoff failed closed. Start recovery again.",n.json);if(n.json){let l=u(o,"apiKey");return l?(await sr(i,l,{expectedEmail:e,knownEmail:u(o,"email")??e,knownRole:u(o,"role")??"user",knownRoles:at(o,"roles"),knownUserId:u(o,"userId")}),b(Ae({...o,loggedIn:!0}),"Recovery complete.",!0,i)):b(Ae({...o,email:e,loggedIn:!1}),"Recovery complete.",!0,i)}return await _u(e,o,n,i,r.successLead??`Recovered access for ${e}.`)}async function Ex(e,t,n){let i=e[0],r=1;if(i==="providers")return await F("/api/v1/identity/social/providers",t,n,"Identity providers loaded.");if(i==="start"){let s=k(t.provider);if(!s&&!t.json)try{s=await n.promptSelect("Choose identity provider:",fu)}catch{return _("identity start requires --provider when interactive selection is unavailable.",!1)}s=R(s,"identity start requires --provider.");let a=k(t.mode)??"login",o=a==="link"?void 0:en(),l=await C(n,"/api/v1/identity/social/start",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({provider:s,mode:a,...o?{handoffCodeHash:o.authorizationCodeHash,handoffCodeChallenge:o.codeChallenge}:{}})});return await Pu(s,l,o,t,n,a==="recovery"?"recovery":"login")}if(i==="status"){let s=k(t.state)??e[r];return s?await F(`/api/v1/identity/social/status/${encodeURIComponent(s)}`,t,n,"Social auth status loaded."):_("identity status requires --state.",t.json)}if(i==="complete"){let s=R(t.provider,"identity complete requires --provider."),a=R(t.state,"identity complete requires --state."),o=R(t.code,"identity complete requires --code."),l=await C(n,"/api/v1/identity/social/complete",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({provider:s,state:a,code:o})});return b(Ae(l),"Social auth complete.",t.json,n)}if(i==="list")return await F("/api/v1/me/linked-identities",t,n,"Linked identities loaded.",{authenticated:!0});if(i==="unlink"){let s=R(t.provider??e[r],"identity unlink requires a provider."),a=await C(n,`/api/v1/me/linked-identities/${encodeURIComponent(s)}`,{method:"DELETE",headers:V(n.apiKey,n.authBlockedMessage)});return b(a,"Identity unlinked.",t.json,n)}return _(`Unknown identity command "${i??""}".`,t.json)}async function xx(e,t,n){let i=e[0];if(!i)return _("api-key requires create, list, or revoke.",t.json);if(i==="list"){let r=Ix(t);if(r.failure)return r.failure;let s=await C(n,"/api/v1/me/api-keys",{headers:V(n.apiKey,n.authBlockedMessage)}),a=Tx(Mc(s),r.filters,Date.parse(n.now()));return b({...s,filters:B({...r.filters}),results:a},"API keys loaded.",t.json,n)}if(i==="create"){let r=k(t.name),s=hL(t.scope);if(!r)return _("api-key create requires --name.",t.json);if(s.length===0)return _("api-key create requires at least one --scope.",t.json);let a=s.find(f=>!Ch.includes(f));if(a)return Wt("api-key.create","scope",a,Ch,t,"invalid_scope");let o=kI("api-key.create",t.expires,t);if(o)return o;if(t.dryRun){let f=await C(n,"/api/v1/me/api-keys",{headers:V(n.apiKey,n.authBlockedMessage)}),g=Mc(f).filter(h=>wy(h)==="active"&&u(h,"type")==="automation");return g.length>=Th?P({status:"error",reasonCode:"api_key_active_limit_reached",maxActiveAutomationKeys:Th,activeAutomationKeyCount:g.length,nextAction:"api-key.revoke",nextStep:"Revoke an unused automation key before creating another."},"Too many active automation keys. Revoke unused keys before creating another.",t.json,"api_key_active_limit_reached"):b(B({status:"pass",wouldCreate:!0,type:"automation",name:r,scopes:s,expiresAt:Lx(k(t.expires),n.now()),secretReturned:!1,secretDelivery:"one_time_client_bound_exchange",warnings:[]}),"API key create dry run passed.",t.json,n)}let l=en(),c=await C(n,"/api/v1/me/api-keys",{method:"POST",headers:{"content-type":"application/json",...V(n.apiKey,n.authBlockedMessage)},body:JSON.stringify({name:r,scopes:s,...k(t.expires)?{expiresIn:k(t.expires)}:{},handoffCodeHash:l.authorizationCodeHash,handoffCodeChallenge:l.codeChallenge})});if(u(c,"credentialHandoff")!=="ready")return _("API key creation did not prepare a secure credential handoff.",t.json);let d=await C(n,"/api/v1/credential-handoffs/exchange",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({authorizationCode:l.authorizationCode,codeVerifier:l.codeVerifier})}),p=u(d,"apiKey");return u(d,"status")!=="exchanged"||!p?_("API key credential exchange failed closed; prepare the key again.",t.json):b({...d,secretReturned:!0,secretDelivery:"one_time_client_bound_exchange"},`Automation API key created. Copy this one-time secret now: ${p}
+Run \`skills-layer api-key list\` to manage keys.`,t.json,n)}if(i==="rotate")return _(`api-key rotate is not part of normal login.
 
 For CLI access:
   skills-layer login
@@ -1232,26 +1453,32 @@ For automation:
 
 To remove an old key:
   skills-layer api-key list
-  skills-layer api-key revoke --key-id <key-id>`,t.json);if(i==="revoke"){let r=t.keyId??e[1];if(!r)return w({status:"error",reasonCode:"missing_required_argument",command:"api-key revoke",argument:"key-id",nextAction:"api-key.list",nextStep:"Run `skills-layer api-key list`, then revoke a key with `skills-layer api-key revoke --key-id <key-id>`."},`api-key revoke needs a key id.
+  skills-layer api-key revoke --key-id <key-id>`,t.json);if(i==="revoke"){let r=t.keyId??e[1];if(!r)return P({status:"error",reasonCode:"missing_required_argument",command:"api-key revoke",argument:"key-id",nextAction:"api-key.list",nextStep:"Run `skills-layer api-key list`, then revoke a key with `skills-layer api-key revoke --key-id <key-id>`."},`api-key revoke needs a key id.
 
 Run:
   skills-layer api-key list
-  skills-layer api-key revoke --key-id <key-id>`,t.json,"missing_required_argument");let s=String(r);if(t.dryRun){let a=await Ar(s,n);return a?h(_({status:"pass",wouldRevoke:!0,keyId:s,keyPrefix:l(a,"keyPrefix"),type:l(a,"type"),name:l(a,"name"),scopes:ue(a,"scopes")??[],revokedAt:a.revokedAt??null,nextAction:"api-key.revoke",nextStep:`Run \`skills-layer api-key revoke --key-id ${s} --yes\` to revoke this key.`}),"API key revoke dry run passed.",t.json,n):Er(s,t)}if(!t.confirmed){let a=await Ar(s,n);if(!a)return Er(s,t);let c=_({status:"confirmation_required",reasonCode:"confirmation_required",keyId:s,keyPrefix:l(a,"keyPrefix"),type:l(a,"type"),name:l(a,"name"),nextAction:"api-key.revoke",nextStep:`Re-run with \`skills-layer api-key revoke --key-id ${s} --yes\` after confirming this is the key to revoke.`});if(t.json||!n.stdoutIsTty)return w(c,"API key revoke needs confirmation. Re-run with --yes after checking the key id.",t.json,"confirmation_required");if(await n.promptSelect(`Revoke API key ${s}?`,[{value:"cancel",label:"Cancel",description:"Leave this API key active"},{value:"confirm",label:"Revoke",description:"Permanently revoke this API key"}])!=="confirm")return h({status:"canceled",keyId:s},"API key revoke canceled.",t.json,n)}let o=await S(n,`/api/v1/me/api-keys/${encodeURIComponent(s)}/revoke`,{method:"POST",headers:F(n.apiKey,n.authBlockedMessage)});return h(o,"API key revoked.",t.json,n)}return k(`Unknown api-key command "${i}".`,t.json)}function Ul(e){let t=p(e.type);if(t&&!Fr.includes(t))return{failure:je("api-key.list","type",t,Fr,e,"invalid_api_key_filter","type")};let n=p(e.status)??"active";if(!Nr.includes(n))return{failure:je("api-key.list","status",n,Nr,e,"invalid_api_key_filter","status")};let i=p(e.sort)??"created-desc";if(!Mr.includes(i))return{failure:je("api-key.list","sort",i,Mr,e,"invalid_api_key_filter","sort")};let r=[["createdAfter","created-after",e.createdAfter],["createdBefore","created-before",e.createdBefore],["expiresAfter","expires-after",e.expiresAfter],["expiresBefore","expires-before",e.expiresBefore]],s={status:n,sort:i};for(let[o,a,c]of r){let u=p(c);if(u){if(Number.isNaN(Date.parse(u)))return{failure:w({status:"error",reasonCode:"invalid_api_key_filter",field:a,value:u,nextAction:"api-key.list",nextStep:`Use --${a} with an ISO date or timestamp.`},`Invalid api-key list --${a} "${u}". Use an ISO date or timestamp.`,e.json,"invalid_api_key_filter")};s[o]=u}}return{filters:_({...s,...t?{type:t}:{},...p(e.name)?{name:p(e.name)}:{}})}}function Dn(e){return(we(e,"results")??[]).filter(t=>x(t))}function Tl(e,t){let n=t.name?.toLowerCase();return e.filter(i=>!t.type||l(i,"type")===t.type).filter(i=>t.status==="all"||_s(i)===t.status).filter(i=>!n||(l(i,"name")??l(i,"id")??"").toLowerCase().includes(n)).filter(i=>At(i,"createdAt",t.createdAfter,"after")).filter(i=>At(i,"createdAt",t.createdBefore,"before")).filter(i=>At(i,"expiresAt",t.expiresAfter,"after")).filter(i=>At(i,"expiresAt",t.expiresBefore,"before")).sort((i,r)=>Fl(i,r,t.sort))}function _s(e,t=Date.now()){if(e.revokedAt!==null&&e.revokedAt!==void 0)return"revoked";let n=l(e,"expiresAt");if(!n)return"active";let i=Date.parse(n);return Number.isNaN(i)||i>t?"active":"expired"}function At(e,t,n,i){if(!n)return!0;let r=l(e,t);if(!r)return!1;let s=Date.parse(r),o=Date.parse(n);return Number.isNaN(s)||Number.isNaN(o)?!1:i==="after"?s>=o:s<=o}function Fl(e,t,n){if(n==="name-asc"||n==="name-desc")return(n==="name-asc"?1:-1)*(l(e,"name")??l(e,"id")??"").localeCompare(l(t,"name")??l(t,"id")??"");let i=n.endsWith("-asc")?1:-1,r=n.startsWith("expires-")?"expiresAt":n.startsWith("last-used-")?"lastUsedAt":"createdAt";return i*($r(e,r)-$r(t,r))}function $r(e,t){let n=l(e,t);if(!n)return 0;let i=Date.parse(n);return Number.isNaN(i)?0:i}function Nl(e,t){if(!e)return;let n=/^(\d+)d$/iu.exec(e.trim());if(!n)return;let i=Date.parse(t),r=Number.isNaN(i)?Date.now():i;return new Date(r+Number.parseInt(n[1],10)*24*60*60*1e3).toISOString()}async function Ar(e,t){let n=await S(t,"/api/v1/me/api-keys",{headers:F(t.apiKey,t.authBlockedMessage)});return Dn(n).find(i=>l(i,"id")===e)}function Er(e,t){return w({status:"not_found",reasonCode:"api_key_not_found",keyId:e,nextAction:"api-key.list",nextStep:"Run `skills-layer api-key list` to find an active key id, then retry revoke."},`API key ${e} was not found.`,t.json,"api_key_not_found")}async function Ml(e,t,n){let i=e[0]??"status";if(i==="setup"||i==="repair"){let r=p(t.client)??p(t.agent);if(r&&t.all)return w({status:"error",reasonCode:"conflicting_mcp_client_selection",client:r,all:!0,nextAction:`mcp.${i}`,nextStep:"Use either --client <agent-id> for one agent or --all for every detected MCP-capable agent."},`mcp ${i} cannot use --client and --all together.`,t.json,"conflicting_mcp_client_selection");if(r&&!ct(r))return $n(r,t);if(r){let o=await W(n.paths.mcpConfigPath),a=o?l(o,"baseUrl")??n.baseUrl:n.baseUrl,c=await tt({baseUrl:a,mcpUrl:o?l(o,"mcpUrl")??`${a}/mcp`:`${a}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:o?l(o,"environment")??pe(a):pe(a),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:o});if(c.target.status==="skills_only"){let u=Et(c);return h(u,`${c.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}}let s=await gi(t,n);return H(s)?s:h({...s},`MCP configuration written for ${s.clientId}. Open a fresh agent session to load Skills Layer tools, then run \`skills-layer mcp verify --client ${s.clientId}\` if they are not visible.`,t.json,n)}if(i==="status"||i==="verify"){let r=p(t.client)??p(t.agent);if(r&&!ct(r))return $n(r,t);let s=await W(n.paths.mcpConfigPath);if(!s){if(r){let u=await tt({baseUrl:n.baseUrl,mcpUrl:`${n.baseUrl}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:pe(n.baseUrl),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:null});if(u.target.status==="skills_only"){let d=Et(u);return h(d,`${u.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}}return h({status:"mcp_not_configured",configured:!1,nextCommand:"skills-layer mcp setup"},"MCP is not configured on this machine.",t.json,n)}let o=r??l(s,"clientId")??"codex",a=l(s,"baseUrl")??n.baseUrl,c=await tt({baseUrl:a,mcpUrl:l(s,"mcpUrl")??`${a}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:o,environment:l(s,"environment")??pe(a),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:s});if(c.target.status==="skills_only"){let u=Et(c);return h(u,`${c.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}if(i==="verify"&&c.configured){let u=await Di({nodePath:process.execPath,bridgePath:c.bridge.path}),d={...c,verified:u.status==="ok",liveProbe:u};return u.status!=="ok"?w(d,`MCP config exists for ${c.clientId}, but live bridge verification failed: ${u.message}`,t.json,u.reasonCode??void 0):h(d,`MCP verified for ${c.clientId}. ${u.message} Open a fresh agent session or restart the agent if tools are not visible yet.`,t.json,n)}return h(c,c.configured?`MCP configuration is present for ${c.clientId}. Open a fresh agent session if tools are not visible, or run \`skills-layer mcp verify --client ${c.clientId}\` for a live check.`:`MCP needs repair for ${c.clientId}. Run \`${c.nextCommand}\`.`,t.json,n)}if(i==="disconnect"||i==="logout"){let r=p(t.client)??p(t.agent)??"codex";if(!ct(r))return $n(r,t);let s=await W(n.paths.mcpConfigPath),o=s?l(s,"baseUrl")??n.baseUrl:n.baseUrl,a=await tt({baseUrl:o,mcpUrl:s?l(s,"mcpUrl")??`${o}/mcp`:`${o}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:s?l(s,"environment")??pe(o):pe(o),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:s});if(a.target.status==="skills_only"){let d=Et(a);return h(d,`${a.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}let c=et({baseUrl:n.baseUrl,mcpUrl:`${n.baseUrl}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:pe(n.baseUrl),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath}),u=c.targets.find(d=>d.agentId===r);return await ql(s,n),await u?.disconnect?.(),await Vi(c.bridgePath),await Gi(c.brokerPath,c.brokerSocketPath),await ri(n.paths.mcpConfigPath,{force:!0}),h({status:"mcp_disconnected",configured:!1,clientId:r},"MCP disconnected on this machine.",t.json,n)}return k(`Unknown mcp command "${i}". Use setup, status, verify, repair, or disconnect.`,t.json)}function ct(e){return Re.includes(e)}function $n(e,t){return w({status:"error",reasonCode:"unknown_mcp_client",requestedClient:e,nextAction:"mcp.status",nextStep:"Run `skills-layer agents list` to see supported client ids."},`Unknown MCP client "${e}". Run \`skills-layer agents list\` to see supported client ids.`,t.json,"unknown_mcp_client")}function Et(e){let t=e.target.instructions,n=Array.isArray(t)&&typeof t[0]=="string"?t[0]:`Install skills with \`skills-layer install <skill> --agent ${e.clientId}\`.`;return{...e,status:"skills_only",configured:!1,nextCommand:null,nextAction:"install.skills",nextStep:n}}async function gi(e,t){let n=p(e.environment)??pe(t.baseUrl),i=["mcp:use","catalog:read","library:read","guardian:check","guardian:incident","creator:read"],r=`${t.baseUrl}/mcp`,s=et({baseUrl:t.baseUrl,mcpUrl:r,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:"codex",environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),o=await Bl(e,t,s),a=o.clientIds[0]??"codex",c=et({baseUrl:t.baseUrl,mcpUrl:r,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:a,environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),u={},d=null;for(let m of o.clientIds){let y=await S(t,"/api/v1/me/mcp-tokens",{method:"POST",headers:I(t.apiKey),body:JSON.stringify({clientId:m,environment:n,scopes:i})}),v=l(y,"apiKey");if(!v)return k("MCP setup did not receive a token from the backend.",e.json);let P=await Ol(t,{token:v,clientId:m,environment:n});u[m]={clientId:m,environment:n,...P,tokenPrefix:l(y,"keyPrefix")??null,scopes:Array.isArray(y.scopes)?y.scopes:[],savedAt:t.now()},d??=y}let g=u[a]??{};await ee(t.paths.mcpConfigPath,{version:1,baseUrl:t.baseUrl,mcpUrl:r,clientId:a,clientIds:o.clientIds,environment:n,selectionSource:o.selectionSource,detectedClientIds:o.detectedClientIds,...g,tokens:u,brokerPath:c.brokerPath,brokerSocketPath:c.brokerSocketPath,savedAt:t.now()});let f=c.targets.filter(m=>m.status==="automatic"&&o.clientIds.includes(m.agentId));for(let m of f)await m.apply?.();return{...Y(d??{}),status:"mcp_configured",clientId:a,clientIds:o.clientIds,selectionSource:o.selectionSource,detectedClientIds:o.detectedClientIds,environment:n,mcpUrl:r,bridgePath:c.bridgePath,brokerPath:c.brokerPath,brokerSocketPath:c.brokerSocketPath,nodePath:c.nodePath,bridgeChecksum:c.bridgeChecksum,brokerChecksum:c.brokerChecksum,saved:!0,readiness:{status:"configured_needs_agent_reload",verifyCommand:`skills-layer mcp verify --client ${a}`,nextStep:"Open a fresh agent session so the host can load the updated MCP configuration. Run verify or repair if Skills Layer tools are still not visible."},registrations:{status:"mcp_registration_plan",automaticCount:c.automaticCount,manualCount:c.manualCount,skillsOnlyCount:c.skillsOnlyCount,unsupportedCount:c.unsupportedCount,appliedCount:f.length,appliedClients:f.map(m=>m.agentId),targets:c.targets.map(m=>({agentId:m.agentId,displayName:m.displayName,tier:m.tier,status:m.status,transport:m.transport,configPath:m.configPath,bridgePath:m.bridgePath,restartRequired:m.restartRequired,reason:m.reason,instructions:m.instructions}))}}}async function Bl(e,t,n){let i=p(e.client)??p(e.agent),r=n.targets.filter(c=>c.status==="automatic").map(c=>c.agentId);if(i)return{clientIds:[i],detectedClientIds:[],selectionSource:"explicit"};if(e.all)return{clientIds:r,detectedClientIds:r,selectionSource:"all"};let s=await ji({env:t.env,platform:t.platform,cwd:t.cwd,pathExists:me}),o=new Set(r),a=s.map(c=>c.id).filter(c=>o.has(c));return a.length>0?{clientIds:a,detectedClientIds:a,selectionSource:"detected"}:{clientIds:["codex"],detectedClientIds:[],selectionSource:"fallback"}}async function Ol(e,t){if(!e.credentialStore)return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"};let n=Kl({baseUrl:e.baseUrl,userId:e.config?.userId,email:e.config?.email,clientId:t.clientId,environment:t.environment});try{return await e.credentialStore.set(st,n,t.token),{tokenRef:n,credentialStorage:"macos_keychain",credentialService:st,tokenStorage:"macos_keychain"}}catch{return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"}}}async function ql(e,t){if(!e||!t.credentialStore)return;let n=Dl(e,st);for(let i of n)await t.credentialStore.delete(i.service,i.tokenRef)}function Dl(e,t){let n=new Map;Ir(e,t,n);let i=e.tokens;if(x(i))for(let r of Object.values(i))x(r)&&Ir(r,t,n);return[...n.values()]}function Ir(e,t,n){let i=l(e,"tokenRef");if(!i||l(e,"credentialStorage")!=="macos_keychain")return;let r=l(e,"credentialService")??t;n.set(`${r}:${i}`,{service:r,tokenRef:i})}function Kl(e){let t=[e.baseUrl,e.userId??e.email??"unknown-user",e.clientId,e.environment,"mcpToken"].join(`
-`);return`skills-layer-cli:mcp-token:${ni("sha256").update(t).digest("base64url").slice(0,32)}`}async function Kn(e,t){if(e.noMcp)return{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."};let n=await W(t.paths.mcpConfigPath),i=n?l(n,"baseUrl"):void 0,r=n?l(n,"clientId")??"codex":"codex";if(!e.withMcp&&i===t.baseUrl&&r)return{data:{status:"mcp_already_configured",configured:!0,clientId:r,mcpUrl:n?l(n,"mcpUrl")??`${t.baseUrl}/mcp`:`${t.baseUrl}/mcp`},message:"MCP is already configured for this machine."};if(!e.withMcp&&!e.json){let a=await W(t.paths.mcpPreferencePath),c=a?l(a,"baseUrl"):void 0,u=a?l(a,"clientId")??"codex":void 0;if((a?l(a,"choice"):void 0)==="not_now"&&c===t.baseUrl&&u==="codex")return{data:{status:"mcp_skipped_previously",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup was skipped previously. Run `skills-layer mcp setup` when you want AI-tool access."}}let s=e.withMcp===!0;if(!s&&!e.json)try{let a=await t.promptSelect("Set up Skills Layer MCP for your AI tools on this machine?",[{value:"yes",label:"Yes, set up MCP",description:"Mint a scoped token and write local MCP configuration"},{value:"no",label:"Not now",description:"You can run skills-layer mcp setup later"}]);if(s=a==="yes",a==="no")return await ee(t.paths.mcpPreferencePath,{version:1,choice:"not_now",baseUrl:t.baseUrl,clientId:"codex",savedAt:t.now()}),{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."}}catch{return{}}if(!s)return{};let o=await gi(e,t);return H(o)?o:{data:o,message:"MCP configuration written for this machine. Open a fresh agent session so your AI tools can load it."}}async function Vl(e,t,n){let i=e.join(" ").trim()||p(t.search)||"",r=new URLSearchParams;i&&r.set("query",i);let s=p(t.runtimeRisk);if(s&&!jr.includes(s))return jt("runtime-risk",s,jr,t);let o=p(t.agent);if(o&&!ct(o))return w({status:"error",reasonCode:"unknown_agent",filter:"agent",value:o,acceptedValues:Re,nextAction:"search",nextStep:"Use --agent with a supported Skills Layer agent id."},`Unknown search --agent "${o}". Run \`skills-layer agents list\` to inspect supported agents.`,t.json,"unknown_agent");let a=p(t.trust);if(a&&!Lr.includes(a))return jt("trust",a,Lr,t);let c=p(t.securityCapability),u=sc(c);if(c&&!u)return jt("security-capability",c,xs,t);let d=p(t.limit);if(d){let f=Number(d);if(!Number.isInteger(f)||f<1||f>100)return jt("limit",d,["1-100"],t);r.set("limit",String(f))}q(r,"agent",t.agent),q(r,"capability",t.capability),q(r,"trust",a),q(r,"runtime-risk",s),q(r,"security-capability",u);let g=await S(n,`/api/v1/search${ie(r)}`);if(t.install!==void 0){let f=p(t.install);if(!f){if(t.json)return k("search --install requires an explicit skill slug in the public CLI package.",!0);let y=ht(g);if(y.length===0)return k("Search results do not include any installable skills. Run search again with a broader query.",!1);if(y.length===1)f=y[0].value;else try{f=await n.promptSelect("Select a search result to install:",y)}catch{return k("No search result was selected for install.",!1)}}let m=Mp(g);return m.includes(f)?await hi([f],t,n):k(m.length===0?`Search results do not include "${f}". Run search again with a matching query first.`:`Search results do not include "${f}". Run search again with a matching query or choose one of: ${m.join(", ")}.`,t.json)}return h(g,"Search complete.",t.json,n)}var jr=["low","elevated","high"],Lr=["high","medium","low","published","published_with_findings","publishable","publishable_with_findings","blocked","unknown"],xs=["filesystem_read","filesystem_write","network_access","api_access","browser_access","device_control","generated_code_execution","secret_handling","model_context","shell_access"],Gl={network:"network_access",filesystem:"filesystem_read",files:"filesystem_read",file_read:"filesystem_read",file_write:"filesystem_write",shell:"shell_access",browser:"browser_access",device:"device_control",api:"api_access",secrets:"secret_handling",model:"model_context"},An=["local","project","global","workspace"],ut=["private","public","unlisted"],qe=["private","public","unlisted"],Ur=["github","gitlab","local","generic_git","domain"],Hl=["owner","maintainer"],zl=["submitted","published","draft","pending_review","suspended","blocked","archived","unlisted"],Wl=["open","acknowledged","fixed","closed","rejected","abusive","reopened","resolved"],Jl=["visible","flagged","hidden"],Yl=["bug","quality","safety","other"],Zl=["approved","denied"],Ql=["email","google","github","gitlab","microsoft"],Xl=["email","google","github","gitlab","microsoft"],Tr=["catalog:read","library:read","creator:read","creator:submit","guardian:check","guardian:incident","workspace:read","workspace:write","workspace:deploy","mcp:use"],Fr=["automation","mcp","agent"],Nr=["active","expired","revoked","all"],Mr=["created-desc","created-asc","expires-desc","expires-asc","name-asc","name-desc","last-used-desc","last-used-asc"],Br=10,ec=["personal","shared","team"],Rs=["json","sarif"],It=["featured","trending","newest","name","relevance"],tc=/^(?:card(?:_[A-Za-z0-9]+)*|pm_[A-Za-z0-9_]+)$/u,nc=/^[a-z0-9]+(?:-[a-z0-9]+)*$/u,ic=/^[a-f0-9]{6,64}$/iu,rc=new Set(["http:","https:"]);function $s(e,t,n,i){let r=p(t);if(!r)return{};if(!/^\d+$/u.test(r))return{failure:w({status:"error",reasonCode:"invalid_limit",command:e,value:r,acceptedRange:`1-${n}`,nextAction:e,nextStep:`Use --limit with a whole number from 1 to ${n}.`},`${e} --limit must be a whole number from 1 to ${n}.`,i.json,"invalid_limit")};let s=Number.parseInt(r,10);return!Number.isInteger(s)||s<1||s>n?{failure:w({status:"error",reasonCode:"invalid_limit",command:e,value:r,acceptedRange:`1-${n}`,nextAction:e,nextStep:`Use --limit with a whole number from 1 to ${n}.`},`${e} --limit must be between 1 and ${n}.`,i.json,"invalid_limit")}:{value:String(s)}}function jt(e,t,n,i){return w({status:"error",reasonCode:"invalid_search_filter",filter:e,value:t,acceptedValues:n,nextAction:"search",nextStep:e==="runtime-risk"?"Use --runtime-risk low, elevated, or high.":e==="limit"?"Use --limit with a whole number from 1 to 100.":`Use --${e} with one of: ${n.join(", ")}.`},e==="runtime-risk"?`Invalid runtime risk "${t}". Use one of: ${n.join(", ")}.`:e==="limit"?`Invalid search limit "${t}". Use a whole number from 1 to 100.`:`Invalid search --${e} "${t}". Use one of: ${n.join(", ")}.`,i.json,"invalid_search_filter")}function sc(e){if(e)return xs.includes(e)?e:Gl[e]}function je(e,t,n,i,r,s,o=t){return w({status:"error",reasonCode:s,[t]:n,acceptedValues:i,nextAction:e,nextStep:`Use --${o} with one of: ${i.join(", ")}.`},`Invalid ${e} --${o} "${n}". Use one of: ${i.join(", ")}.`,r.json,s)}function ce(e,t,n,i,r,s,o=t){let a=p(n);if(!(!a||i.includes(a)))return je(e,t,a,i,r,s,o)}function xe(e,t){let n=p(t.version);return n&&!zt(n)?fi(e,n,t):void 0}function oc(e,t,n){return w({status:"error",reasonCode:"invalid_slug",value:t,acceptedFormat:"lowercase words separated by hyphens",nextAction:e,nextStep:"Use a lowercase skill slug such as project-planner or year9-history-study-guide."},`Invalid skill slug "${t}". Use lowercase letters, numbers, and single hyphens.`,n.json,"invalid_slug")}function As(e,t,n){return t&&!nc.test(t)?oc(e,t,n):void 0}function ac(e,t,n){return w({status:"error",reasonCode:"invalid_format",format:t,acceptedValues:Rs,nextAction:e,nextStep:"Use --format json or --format sarif."},`Invalid ${e} --format "${t}". Use json or sarif.`,n.json,"invalid_format")}function Es(e,t){let n=p(t.format);return n&&!Rs.includes(n.toLowerCase())?ac(e,n,t):void 0}function lc(e,t,n){return w({status:"error",reasonCode:"invalid_commit_sha",commitSha:t,nextAction:e,nextStep:"Use --commit-sha with a 6 to 64 character hexadecimal commit SHA."},`Invalid --commit-sha "${t}". Use a hexadecimal commit SHA.`,n.json,"invalid_commit_sha")}function cc(e,t){let n=p(t.commitSha);return n&&!ic.test(n)?lc(e,n,t):void 0}function Or(e,t){return w({status:"error",reasonCode:"invalid_base_url",baseUrl:e,nextAction:"backend",nextStep:"Use --base-url with an http or https URL, for example https://api.skills-layer.com."},`Invalid backend base URL "${e}". Use an http or https URL.`,t.json,"invalid_base_url")}function uc(e,t){try{let n=new URL(e);return!rc.has(n.protocol)||!n.hostname?Or(e,t):void 0}catch{return Or(e,t)}}function qr(e,t,n){return w({status:"error",reasonCode:"unexpected_argument",command:e,argument:t,nextAction:e,nextStep:`Run \`skills-layer ${e} --help\` to see supported arguments for this command.`},`Unexpected argument "${t}" for ${e}.`,n.json,"unexpected_argument")}function mi(e,t){let n=p(t.scope);if(n&&!An.includes(n))return{failure:w({status:"error",reasonCode:"invalid_install_filter",filter:"scope",value:n,acceptedValues:An,nextAction:e,nextStep:"Use --scope local, project, global, or workspace."},`Invalid ${e} --scope "${n}". Use one of: ${An.join(", ")}.`,t.json,"invalid_install_filter")};let i=p(t.agent);return i&&!ct(i)?{failure:w({status:"error",reasonCode:"unknown_agent",filter:"agent",value:i,acceptedValues:Re,nextAction:e,nextStep:"Use --agent with a supported Skills Layer agent id."},`Unknown ${e} --agent "${i}". Run \`skills-layer agents\` to inspect supported agents.`,t.json,"unknown_agent")}:{scope:n,agent:i}}function Is(e,t){let n=mi(e,t);if(n.failure)return n.failure;let i=p(t.version);if(e==="install"&&i&&!zt(i))return fi("install",i,t)}function fi(e,t,n){return w({status:"error",reasonCode:"invalid_version",command:e,version:t,nextAction:e,nextStep:"Use a semver version such as 1.2.3 or an external-<digest> Skills Layer version."},`Invalid --version "${t}". Use a semver version or an external-<digest> version.`,n.json,"invalid_version")}function dc(e,t,n){return w({status:"error",reasonCode:"invalid_expiry",command:e,expiresIn:t,acceptedFormat:"<positive whole number>d",nextAction:e,nextStep:"Use --expires with a day duration such as 7d, 30d, or 90d."},`Invalid --expires "${t}". Use a day duration such as 7d, 30d, or 90d.`,n.json,"invalid_expiry")}function pc(e,t,n){let i=p(t);if(i&&!/^[1-9]\d*d$/iu.test(i))return dc(e,i,n)}function Ve(e,t,n,i,r,s){let o=p(e);if(!o)return{};if(!/^\d+$/u.test(o))return{failure:w({status:"error",reasonCode:i,[n]:o,nextAction:t.includes("price")?"creator.pricing":"creator.withdraw",nextStep:`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`},`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`,r.json,i)};let a=Number(o);return!Number.isSafeInteger(a)||a<s.minimum?{failure:w({status:"error",reasonCode:i,[n]:o,nextAction:t.includes("price")?"creator.pricing":"creator.withdraw",nextStep:`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`},`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`,r.json,i)}:{value:a}}function gc(e){let t=p(e.paymentMethod)??"card";return tc.test(t)?{value:t}:{failure:w({status:"error",reasonCode:"invalid_payment_method",paymentMethod:t,acceptedValues:["card","card_<test-card>","pm_<provider-method-id>"],nextAction:"buy",nextStep:"Use --payment-method card or a provider token such as pm_<id>."},`Invalid payment method "${t}". Use card or a provider token such as pm_<id>.`,e.json,"invalid_payment_method")}}async function mc(e,t,n){let i=new URLSearchParams,r=$s(e,t.limit,20,t);if(r.failure)return r.failure;let s=p(t.sort);return s&&!It.includes(s)?w({status:"error",reasonCode:"invalid_sort",sort:s,acceptedValues:It,nextAction:e,nextStep:`Use --sort with one of: ${It.join(", ")}.`},`${e} --sort must be one of: ${It.join(", ")}.`,t.json,"invalid_sort"):(q(i,"limit",r.value),q(i,"search",t.search),q(i,"sort",s),await $(`/api/v1/${e}${ie(i)}`,t,n,`${en(e)} skills loaded.`))}async function fc(e,t,n){let i=e.join(" ").trim();if(!i)return k("recommend requires a task.",t.json);let r=$s("recommend",t.limit,20,t);if(r.failure)return r.failure;let s=new URLSearchParams({task:i});return q(s,"limit",r.value),await $(`/api/v1/recommend?${s.toString()}`,t,n,"Recommendations loaded.")}async function hc(e,t,n){if(e.length<2)return k("compare requires two or more skill slugs.",t.json);if(e.length>5)return w({status:"error",reasonCode:"too_many_compare_slugs",requestedCount:e.length,maxItems:5,nextAction:"compare",nextStep:"Compare up to 5 skills at a time."},"compare supports up to 5 skill slugs at a time.",t.json,"too_many_compare_slugs");let i=new URLSearchParams({slugs:e.join(",")}),r=await S(n,`/api/v1/skills/compare?${i.toString()}`),s=Array.isArray(r.missing)?r.missing.filter(o=>typeof o=="string"):[];return s.length>0?w({...r,status:"not_found",reasonCode:"compare_missing_skills",missing:s,nextAction:"search",nextStep:`Run \`skills-layer search ${s[0]}\` to find the correct slug, then retry compare.`},`Comparison could not find: ${s.join(", ")}.`,t.json,"compare_missing_skills"):t.json?h(r,"Comparison loaded.",!0,n):{exitCode:0,stdout:Zd(r,"Comparison loaded.",re(n),t.verbose),stderr:""}}async function yc(e,t,n){let i=b(e[0],"show requires a skill slug."),r=await S(n,`/api/v1/skills/${encodeURIComponent(i)}`);return h(_u(r),"Skill loaded.",t.json,n)}async function kc(e,t,n){let i=b(e[0],"trust requires a skill slug."),r=Es("trust",t);if(r)return r;let s=new URLSearchParams;q(s,"format",t.format),q(s,"version",t.version);let o=await S(n,`/api/v1/skills/${encodeURIComponent(i)}/trust${ie(s)}`);return p(t.format)?.toLowerCase()==="sarif"&&!t.json?{exitCode:0,stdout:xu(o,i,n),stderr:""}:h(o,"Trust report loaded.",t.json,n)}async function wc(e,t,n){if(t.json){let s=e[0]==="full"?Me():e[0]==="topic"?Me(e[1]):Me(e[0],e.slice(1));if(s)return h(s,"Help loaded.",!0,n);if(e[0]!=="topic"&&!wl.has(e[0]??""))return Vn(e,!0)}let i=at(e[0],e.slice(1));if(i)return En(i,e.filter(Boolean).join(" "),t,n);let r=e[0];if(!r)return{exitCode:0,stdout:ot,stderr:""};if(r==="full")return En(ot,"full",t,n);if(r==="topic"){let s=at(e[1]);if(s)return En(s,e[1]??"overview",t,n);let o=new URLSearchParams;return e[1]&&o.set("topic",e[1]),await $(`/api/v1/help${ie(o)}`,t,n,"Help topic loaded.")}if(r==="standards")return await $("/api/v1/standards",t,n,"Marketplace standards loaded.");if(r==="marketplace-status"){let s=await S(n,"/api/v1/marketplace/status");return t.json?h(s,"Marketplace status loaded.",!0,n):h(ip(s),"Marketplace status loaded.",!1,n)}if(r==="capabilities"){let s=await S(n,"/api/v1/capabilities");return h(sp(s),"Edition capabilities loaded.",t.json,n)}if(r==="schema-plan")return k("help schema-plan is not included in the public npm CLI.",t.json);if(r==="optimize-tokens"){let s=b(t.text,"help optimize-tokens requires --text."),o=op(t.maxCharacters,t.json);if(H(o))return o;let a=await S(n,"/api/v1/optimize-tokens",{method:"POST",headers:I(n.apiKey),body:JSON.stringify({text:s,...o?{maxCharacters:o}:{}})});return h(a,"Token optimization complete.",t.json,n)}return k(`Unknown help command "${r}".`,t.json)}function En(e,t,n,i){return n.json?h({status:"ok",topic:t,content:e},"Help topic loaded.",!0,i):{exitCode:0,stdout:e,stderr:""}}function Vn(e,t){let n=e.filter(Boolean).join(" ").trim()||"help";return w({status:"not_found",reasonCode:"help_topic_not_found",topic:n,nextAction:"help",nextStep:"Run `skills-layer --help`, `skills-layer help full`, or `skills-layer <command> --help` for a supported command."},`Help topic not found: ${n}.`,t,"help_topic_not_found")}async function vc(e,t,n){let i=b(e[0]??t.path,"validate requires a file or directory."),r=V(n.cwd,i);if(!await me(r))return Ws("validate",i,t,n);let s=await Zt(r),o={files:s,sourceIntakeContext:p(t.sourceIntakeContext),publicationStatus:p(t.publicationStatus),dependencyAuditStatus:p(t.dependencyAuditStatus),category:p(t.category),discloseSource:!!t.discloseSource,allowFindingsFeatured:!!t.allowFindingsFeatured},a;try{a=await S(n,"/api/v1/validation/preview",{method:"POST",headers:I(n.apiKey),body:JSON.stringify(_(o))})}catch(u){if(u instanceof A&&u.status===422&&u.details)a=Op(u.details);else throw u}let c=bc(a,s);return t.json?h(c,"Validation complete.",!0,n):{exitCode:0,stdout:ap(c,i,n),stderr:""}}function bc(e,t){return{...e,evalReadiness:ar(t)}}function Sc(e,t){let n=Pc(e);return _t({status:n?"not_run":"generated_only",skillSlug:t.skillSlug,version:t.version,artifactDigest:he(e),...n?{evalPackDigest:n}:{},generatedAt:t.generatedAt,runnerVersion:Be,counts:{cases:0,assertions:0,passed:0,failed:0,skipped:0}})}function Pc(e){let t=e.find(n=>{let i=Ae(n.path,e);return i.type==="evidence"&&typeof n.content=="string"&&(i.relativePath.startsWith("evals/")||i.relativePath.endsWith(".eval.json")||i.relativePath.endsWith(".eval.yaml"))});if(t?.content)try{return Pt(JSON.parse(t.content))}catch{return}}async function Cc(e,t,n){let i=b(e[0]??t.path,"preview-trigger requires a file or directory."),r=V(n.cwd,i);if(!await me(r))return Ws("preview-trigger",i,t,n);let s=await Zt(r),o=await S(n,"/api/v1/validation/trigger-preview",{method:"POST",headers:I(n.apiKey),body:JSON.stringify({files:s,shouldTriggerPrompts:t.shouldTrigger,shouldNotTriggerPrompts:t.shouldNotTrigger,paraphrasePrompts:t.paraphrase})});return t.json?h(o,"Trigger preview complete.",!0,n):{exitCode:0,stdout:lp(o,i,n),stderr:""}}async function _c(e,t,n){let i=e[0];if(i==="init")return await xc(e.slice(1),t,n);if(i==="rules")return await $("/api/v1/creator/rules",t,n,"Creator rules loaded.");if(i==="submissions")return await $("/api/v1/me/submissions",t,n,"Submissions loaded.",{authenticated:!0});if(i==="status"){let r=b(e[1],"creator status requires a skill slug.");try{return await $(`/api/v1/me/submissions/${encodeURIComponent(r)}/status`,t,n,"Submission status loaded.",{authenticated:!0})}catch(s){if(s instanceof A&&s.status===404)return Lc(r,t);throw s}}if(i==="charge-status"){let r=b(e[1],"creator charge-status requires a charge id.");return await $(`/api/v1/me/private-skill-charges/${encodeURIComponent(r)}`,t,n,"Charge status loaded.",{authenticated:!0})}if(i==="submit")return await Dr(e.slice(1),t,n,!1);if(i==="submit-version")return await Dr(e.slice(1),t,n,!0);if(i==="check-slug"){let r=b(e[1],"creator check-slug requires a slug.");return await Ic(r,t,n)}if(i==="rename"){let r=b(e[1],"creator rename requires the current slug."),s=b(e[2],"creator rename requires the new slug."),o=As("creator.rename",s,t);return o||await Jt(`/api/v1/me/submissions/${encodeURIComponent(r)}/slug`,{nextSkillSlug:s},t,n,"Skill renamed.")}if(i==="pricing")return await Tc(e,t,n);if(i==="update-listing"){let r=b(e[1],"creator update-listing requires a skill slug.");return await Fc(r,t,n)}if(i==="visibility"){let r=b(e[1],"creator visibility requires a skill slug."),s=xe("creator.visibility",t);if(s)return s;let o=p(t.visibility)??e[2],a=$t(o);if(!a||!ut.includes(a))return w({status:"error",reasonCode:"invalid_visibility",skillSlug:r,visibility:o??null,acceptedValues:ut,nextAction:"creator.visibility",nextStep:"Use --visibility private, public, or unlisted."},`Invalid creator visibility "${o??""}". Use one of: ${ut.join(", ")}.`,t.json,"invalid_visibility");let c=await S(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/visibility`,{method:"PATCH",headers:I(n.apiKey),body:JSON.stringify(_({visibility:a,dryRun:t.dryRun}))});return Ou(c)?w(c,qu(c,r),t.json,l(c,"reasonCode")??l(c,"status")):h(c,t.dryRun?"Visibility preview loaded.":"Visibility updated.",t.json,n)}if(i==="security-report"){let r=b(e[1],"creator security-report requires a skill slug."),s=Es("creator.security-report",t);if(s)return s;let o=xe("creator.security-report",t);if(o)return o;let a=new URLSearchParams;q(a,"format",t.format),q(a,"version",t.version),q(a,"versionId",t.versionId);let c=await S(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/trust${ie(a)}`,{headers:F(n.apiKey,n.authBlockedMessage)});return t.json||t.verbose?h(c,"Creator security report loaded.",t.json,n):{exitCode:0,stdout:Cp(c,r,n),stderr:""}}if(i==="rescan-security"){let r=b(e[1],"creator rescan-security requires a skill slug."),s=xe("creator.rescan-security",t);if(s)return s;let o=await S(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/trust/rescan`,{method:"POST",headers:I(n.apiKey),body:JSON.stringify(_(Z(t,["version","versionId"])))});return t.json?h(o,"Security rescan requested.",!0,n):{exitCode:0,stdout:_p(o,r,n),stderr:""}}if(i==="provenance"){let r=b(e[1],"creator provenance requires a skill slug.");return await $(`/api/v1/me/submissions/${encodeURIComponent(r)}/provenance`,t,n,"Provenance loaded.",{authenticated:!0})}if(i==="claim"||i==="verify"||i==="dispute")return await Nc(i,e,t,n);if(i==="issues"||i==="reviews"||i==="update-issue"||i==="moderate-review")return await Vc(i,e,t,n);if(i==="analytics"){let r=b(e[1],"creator analytics requires a skill slug.");return await Mc(r,t,n)}if(i==="earnings")return await $("/api/v1/me/earnings",t,n,"Creator earnings loaded.",{authenticated:!0});if(i==="payout-profile")return await Bc(t,n);if(i==="payout-link")return await Oc(t,n);if(i==="payouts")return await $("/api/v1/me/payouts",t,n,"Creator payouts loaded.",{authenticated:!0});if(i==="withdraw"){if(!p(t.amountCents))return k("creator withdraw requires --amount-cents.",t.json);let r=Ve(t.amountCents,"--amount-cents","amountCents","invalid_amount_cents",t,{minimum:1});return r.failure?r.failure:await z("/api/v1/me/payouts/withdrawals",_({amountCents:r.value,reason:p(t.reason)}),t,n,"Withdrawal requested.")}return i==="source"?await zc(e.slice(1),t,n):k(`Unknown creator command "${i??""}".`,t.json)}async function xc(e,t,n){let i=p(t.skill)??e[0]??"my-skill",r=As("creator.init",i,t);if(r)return r;let s=V(n.cwd,p(t.dir)??i),o=U(s,"SKILL.md"),a;try{a=Xi(p(t.type))}catch(m){return k(te(m),t.json)}let c=p(t.category),u=await Rc(s);if((await me(o)||u)&&!t.confirmed)return k(`Creator init target already exists at ${s}. Re-run with --confirm only if you want to overwrite ${o}.`,t.json);await ft(s,{recursive:!0});let g=er({skillSlug:i,description:p(t.description)??"Describe what this skill helps an agent do.",skillType:a,category:c});for(let m of g)await ge(U(s,m.path),m.content);let f=_({status:"created",path:o,skillSlug:i,skillType:a,category:c,fileCount:g.length});return t.json?h(f,`Created ${o}.`,!0,n):{exitCode:0,stdout:fp(f,s,o,n),stderr:""}}async function me(e){try{return await ws(e),!0}catch{return!1}}async function Rc(e){try{return(await ii(e)).length>0}catch{return await me(e)}}async function Dr(e,t,n,i){let r=p(t.visibility);if(r){let P=$t(r);if(!P||!ut.includes(P))return je(i?"creator.submit-version":"creator.submit","visibility",r,ut,t,"invalid_visibility")}let s=Ve(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(s.failure)return s.failure;let o=i?b(p(t.skill)??e[0],"creator submit-version requires a skill slug."):p(t.skill),a=b(p(t.source)??(i?e[1]:e[0])??t.path,`creator ${i?"submit-version":"submit"} requires a <path-or-source> or --source <source>.`),c=await Vt(a,n.cwd);if(t.list)return await $c(a,c,o,t,n);let u=xe(i?"creator.submit-version":"creator.submit",t);if(u)return u;if(p(t.source)&&!c&&xo(a))return Ac(a,t);let d=c?.files??await Zt(V(n.cwd,a));if(!i&&!t.dryRun){let P=await Ec(d,t,n);if(P)return P}let g=_({files:d,version:p(t.version),dryRun:t.dryRun,evalSummary:Sc(d,{skillSlug:o??Ls(d)??"unknown",version:p(t.version)??"0.0.0",generatedAt:n.now()}),allowFindingsFeatured:t.allowFindingsFeatured,pricing:s.value!==void 0?{priceCents:s.value}:void 0,...c?{sourceMetadata:c.sourceMetadata}:{},...Z(t,["displayName","skillType","category","visibility","source","skill"])}),f=i&&o?`/api/v1/me/submissions/${encodeURIComponent(o)}/versions`:"/api/v1/me/submissions",m=await S(n,f,{method:"POST",headers:I(n.apiKey),body:JSON.stringify(g)});if(t.json||t.noOpen||m.status!=="checkout_required"||typeof m.checkoutUrl!="string"||typeof m.chargeId!="string")return h(m,i?"Version submitted.":"Submission uploaded.",t.json,n);n.emitInfo("Opening payment setup for skill submission. Complete the payment in your browser, then come back here."),await n.openUrl(m.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${m.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let v=await Id(m.chargeId,n);return H(v)?v:v.status!=="submitted"?h({...m,chargeStatus:v.status},`Payment is still ${v.status}. You can rerun \`skills-layer creator charge-status ${m.chargeId}\` to continue tracking it.`,t.json,n):h(v,i?"Version submitted.":"Submission uploaded.",t.json,n)}async function $c(e,t,n,i,r){if(t)return h(Kr(Fs(e,t,n)),"Source skills loaded.",i.json,r);let s=await qs(r,e,{source:e,skillSlug:n,listOnly:!0,operation:"creator.submit"},i);return s.kind==="failure"?s.result:h(Kr(s.inspection),"Source skills loaded.",i.json,r)}function Kr(e){return{...e,sourceSubmissionSupported:!0}}function Ac(e,t){let i=`skills-layer source connection start --provider ${Vs(e)} --source ${e} --visibility private --provenance-intent private_source_import`;return w({status:"source_connection_required",reasonCode:"source_connection_required",source:e,nextAction:"source.connection.start",nextStep:i},`Creator submit can list ${e} safely, but publishing from a remote source requires a source connection. Run \`${i}\`.`,t.json,"source_connection_required")}async function Ec(e,t,n){let i=p(t.skill)??Ls(e);if(!i)return null;let r;try{r=await S(n,`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(i)}`,{headers:F(n.apiKey,n.authBlockedMessage)})}catch(s){if(s instanceof A&&s.status===404)return js(i,t);throw s}if(r.available===!1||l(r,"reasonCode")==="unavailable"||l(r,"reasonCode")==="reserved"){let s=l(r,"assignedSlug"),o=_({status:"duplicate_candidate",reasonCode:l(r,"reasonCode")??"slug_unavailable",requestedSlug:i,assignedSlug:s,nextAction:"creator.status",nextStep:`Run \`skills-layer creator status ${i}\`, \`skills-layer creator submissions\`, or submit a new version of the existing skill instead of creating a duplicate listing.`});return w(o,`A public skill slug "${i}" already exists or is not available. Run \`skills-layer creator status ${i}\`, check your creator submissions, or submit a new version instead of creating a duplicate listing.`,t.json,l(o,"reasonCode"))}return null}async function Ic(e,t,n){try{let i=await S(n,`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(e)}`,{headers:F(n.apiKey,n.authBlockedMessage)});return h(jc(i),"Slug status loaded.",t.json,n)}catch(i){if(i instanceof A&&i.status===404)return js(e,t);throw i}}function js(e,t){let n={status:"slug_check_unavailable",reasonCode:"slug_check_route_unavailable",requestedSlug:e,nextAction:"creator.status",nextStep:`Slug availability could not be checked on the selected backend. Run \`skills-layer creator submissions\`, \`skills-layer creator status ${e}\`, or retry after selecting a compatible Skills Layer backend.`};return w(n,`Slug availability could not be checked for ${e} on the selected backend. Run \`skills-layer creator submissions\` or retry after selecting a compatible Skills Layer backend.`,t.json,"slug_check_route_unavailable")}function jc(e){let t=e.available===!0,n=l(e,"assignedSlug");if(t)return _({requestedSlug:l(e,"requestedSlug"),available:!0,reasonCode:l(e,"reasonCode")??"available",assignedSlug:n});let i=C(e,"slugAssignment"),r=Array.isArray(i?.candidateSlugs)?i.candidateSlugs.filter(s=>typeof s=="string").slice(0,5):void 0;return _({...e,...i?{slugAssignment:{...i,...r?{candidateSlugs:r}:{}}}:{},...r?{candidateSlugs:r}:{}})}function Lc(e,t){return w({status:"not_submitted",reasonCode:"creator_submission_not_found",skillSlug:e,nextAction:"creator.submit",nextStep:"Run `skills-layer creator submit <path> --dry-run` to validate a local skill before submitting it, or run `skills-layer creator submissions` to see your existing submissions."},`No creator submission was found for ${e}. Run \`skills-layer creator submit <path> --dry-run\` before checking status.`,t.json,"creator_submission_not_found")}function Ls(e){let t=e.find(i=>i.path.split("/").pop()?.toLowerCase()==="skill.md");if(!t)return;let n=/^---\s*\n(?<body>[\s\S]*?)\n---/u.exec(t.content??"")?.groups?.body?.split(/\r?\n/u).map(i=>i.match(/^name\s*:\s*(?<name>.+?)\s*$/u)?.groups?.name?.trim().replace(/^["']|["']$/gu,"")).find(i=>!!i);return Uc(n??D(ae(t.path)))}function Uc(e){return e?.toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||void 0}async function Tc(e,t,n){let i=b(e[1],"creator pricing requires a skill slug."),r=xe("creator.pricing",t);if(r)return r;let s=new URLSearchParams;if(q(s,"version",t.version),!t.priceCents)return await $(`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing${ie(s)}`,t,n,"Pricing loaded.",{authenticated:!0});let o=Ve(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(o.failure)return o.failure;let a=o.value??0,c=await S(n,`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing${ie(s)}`,{headers:F(n.apiKey,n.authBlockedMessage)}),u=T(c,"priceCents")??0;if(a>u){let d=_({status:"pending_approval",reasonCode:u===0?"paid_activation_requires_approval":"price_increase_requires_approval",skillSlug:i,version:l(c,"version"),currentPriceCents:u,requestedPriceCents:a,currency:l(c,"currency")??"gbp",nextStep:"Pricing changes that increase buyer-facing cost require approval. Keep the current price for now, then retry after approval is available."});return h(d,"Pricing change requires approval before it can affect buyers.",t.json,n)}return await Jt(`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing`,{priceCents:a,version:p(t.version)},t,n,"Pricing updated.")}async function Fc(e,t,n){let i=ce("creator.update-listing","listingStatus",t.listingStatus,zl,t,"invalid_listing_status","listing-status");if(i)return i;try{return await Jt(`/api/v1/me/submissions/${encodeURIComponent(e)}`,Z(t,["displayName","summary","description","category","skillType","license","listingStatus"]),t,n,"Listing updated.")}catch(r){if(r instanceof A&&r.status===404){let s={status:"listing_not_found_or_not_editable",reasonCode:"creator_listing_not_found_or_not_owned",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see editable listings, or \`skills-layer show ${e}\` to inspect the public catalog entry.`};return w(s,`No editable creator listing was found for ${e}. Run \`skills-layer creator submissions\` to see listings you can update.`,t.json,"creator_listing_not_found_or_not_owned")}throw r}}async function Nc(e,t,n,i){let r=b(t[1],`creator ${e} requires a skill slug.`);if(e==="claim"){let s=ce("creator.claim","requestedRole",n.requestedRole,Hl,n,"invalid_requested_role","requested-role");if(s)return s}try{if(e==="claim")return await z(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/claim`,Z(n,["requestedRole","message"]),n,i,"Ownership claim submitted.");if(e==="verify"){let s=b(n.claimId,"creator verify requires --claim-id.");return await z(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/verify`,{claimId:s},n,i,"Ownership claim verified.")}return b(n.message,"creator dispute requires --message."),await z(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/dispute`,Z(n,["message"]),n,i,"Ownership dispute submitted.")}catch(s){if(s instanceof A&&s.status===404){let o={status:"ownership_action_unavailable",reasonCode:e==="claim"?"skill_not_found_or_not_claimable":"ownership_claim_not_found",skillSlug:r,requestedRole:p(n.requestedRole),nextAction:e==="claim"?"search":"creator.claim",nextStep:e==="claim"?`Run \`skills-layer search ${r}\`, \`skills-layer show ${r}\`, or submit/source-install the skill before claiming it.`:`Run \`skills-layer creator claim ${r}\` to start a new claim if the skill is claimable.`};return w(o,e==="claim"?`No claimable skill was found for ${r}. Search or show the skill first, then claim it only when it exists and is claimable.`:`No matching ownership claim was found for ${r}. Start a new claim if the skill is claimable.`,n.json,l(o,"reasonCode")??"ownership_action_unavailable")}throw s}}async function Mc(e,t,n){try{return await $(`/api/v1/me/submissions/${encodeURIComponent(e)}/analytics`,t,n,"Analytics loaded.",{authenticated:!0})}catch(i){if(i instanceof A&&i.status===404){let r={status:"no_creator_submission",reasonCode:"creator_submission_not_found",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see skills you own, \`skills-layer show ${e}\` to inspect the catalog listing, or \`skills-layer creator claim ${e}\` if it is a claimable public-source skill.`};return w(r,`No creator-owned analytics submission was found for ${e}. Run \`skills-layer creator submissions\`, \`skills-layer show ${e}\`, or \`skills-layer creator claim ${e}\` if you should manage it.`,t.json,"creator_submission_not_found")}throw i}}async function Bc(e,t){let n=await S(t,"/api/v1/me/payout-profile",{headers:F(t.apiKey,t.authBlockedMessage)});return h(n,"Creator payout profile loaded.",e.json,t)}async function Oc(e,t){let n=qc(p(e.mode));if(e.mode&&n===null)return k("creator payout-link --mode must be account_onboarding|account_update|onboarding|update.",e.json);let i;try{i=await S(t,"/api/v1/me/payout-profile/link",{method:"POST",headers:I(t.apiKey),body:JSON.stringify(n?{mode:n}:{})})}catch(s){if(s instanceof A&&Kc(s))return w({status:"payout_setup_already_submitted",reasonCode:"payout_update_link_unavailable",nextAction:"creator.payout-profile",nextStep:"Run `skills-layer creator payout-profile` to confirm readiness, then use `skills-layer creator earnings` or `skills-layer creator withdraw --amount-cents <amount>`."},"Payout setup is already submitted for this account. Run `skills-layer creator payout-profile` to confirm readiness before requesting a withdrawal.",e.json,"payout_update_link_unavailable");throw s}let r=jd(i);return r&&Dc(e)&&e.showUrl!==!0&&(t.emitInfo("Opening payout setup in your browser. Finish the flow there, then come back here."),await t.openUrl(r)||t.emitInfo(`Open this payout setup URL manually to continue: ${r}`)),h(i,"Payout setup link created.",e.json,t)}function qc(e){if(!e)return null;let t=e.trim().toLowerCase();return t==="account_onboarding"||t==="onboarding"?"account_onboarding":t==="account_update"||t==="update"?"account_update":null}function Dc(e){return!e.json&&!e.noOpen}function Kc(e){let t=`${e.message} ${l(e.details??{},"error")??""}`.toLowerCase();return t.includes("account_update")&&t.includes("account_onboarding")&&t.includes("account link")}async function Vc(e,t,n,i){let r=b(t[1],`creator ${e} requires a skill slug.`);if(e==="issues")return await $(`/api/v1/me/library/${encodeURIComponent(r)}/issues`,n,i,"Issues loaded.",{authenticated:!0});if(e==="reviews")return await $(`/api/v1/me/submissions/${encodeURIComponent(r)}/reviews`,n,i,"Reviews loaded.",{authenticated:!0});if(e==="update-issue"){let c=b(n.issueId,"creator update-issue requires --issue-id."),u=b(n.status,"creator update-issue requires --status."),d=ce("creator.update-issue","status",u,Wl,n,"invalid_issue_status");if(d)return d;let g=xe("creator.update-issue",{...n,version:n.fixedVersion});if(g)return g;try{return await Jt(`/api/v1/me/skills/${encodeURIComponent(r)}/issues/${encodeURIComponent(c)}`,Z(n,["status","fixedVersion","note"]),n,i,"Issue updated.")}catch(f){if(f instanceof A&&f.status===404)return Gc(r,c,n);throw f}}let s=b(n.reviewId,"creator moderate-review requires --review-id."),o=b(n.status,"creator moderate-review requires --status."),a=ce("creator.moderate-review","status",o,Jl,n,"invalid_review_status");if(a)return a;try{return await z(`/api/v1/me/submissions/${encodeURIComponent(r)}/reviews/${encodeURIComponent(s)}/moderate`,Z(n,["status","reason"]),n,i,"Review updated.")}catch(c){if(c instanceof A&&c.status===404)return Hc(r,s,n);throw c}}function Gc(e,t,n){return w({status:"not_found",reasonCode:"issue_not_found",skillSlug:e,issueId:t,nextAction:"creator.issues",nextStep:`Run \`skills-layer creator issues ${e}\` to inspect open issues before updating one.`},`Issue ${t} was not found for ${e}. Run \`skills-layer creator issues ${e}\` first.`,n.json,"issue_not_found")}function Hc(e,t,n){return w({status:"not_found",reasonCode:"review_not_found",skillSlug:e,reviewId:t,nextAction:"creator.reviews",nextStep:`Run \`skills-layer creator reviews ${e}\` to inspect review ids before moderating one.`},`Review ${t} was not found for ${e}. Run \`skills-layer creator reviews ${e}\` first.`,n.json,"review_not_found")}async function zc(e,t,n){let i=e[0],r=b(e[1],`creator source ${i??""} requires a source connection id.`),s=p(t.skill)??e[2];if(i==="prepare"){let o=xe("creator.source.prepare",t);if(o)return o;let a=ce("creator.source.prepare","visibility",t.visibility,qe,t,"invalid_visibility");if(a)return a;let c=Ve(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});return c.failure?c.failure:await z(`/api/v1/me/source-connections/${encodeURIComponent(r)}/prepare`,_({...Z(t,["skill","source","version","displayName","skillType","category","visibility"]),...c.value!==void 0?{priceCents:c.value}:{},source:p(t.source)??e[2]}),t,n,"Source release prepared.")}if(i==="publish-request"){let o=xe("creator.source.publish-request",t);if(o)return o;let a=ce("creator.source.publish-request","visibility",t.visibility,qe,t,"invalid_visibility");if(a)return a;let c=Ve(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(c.failure)return c.failure;let u=t.approvalRequestId.length>0?t.approvalRequestId:p(t.approvalRequestId)?[String(t.approvalRequestId)]:[];return await z(`/api/v1/me/source-connections/${encodeURIComponent(r)}/publish-request`,_({skillSlug:s,approvalRequestIds:u,version:p(t.version),...Z(t,["visibility","license","discloseSource"]),...c.value!==void 0?{priceCents:c.value}:{}}),t,n,"Source publish requested.")}if(i==="release-status"){let o=new URLSearchParams;return s&&o.set("skill",s),await $(`/api/v1/me/source-connections/${encodeURIComponent(r)}/release-status${ie(o)}`,t,n,"Source release status loaded.",{authenticated:!0})}return k(`Unknown creator source command "${i??""}".`,t.json)}async function hi(e,t,n){let i=Is("install",t);if(i)return i;let r=p(t.source);if(r){let d=p(t.skill),g=Wr(r,d,t);if(g)return g;let f=await Vt(r,n.cwd);if(f)return await Hr(r,f,d,t,n);let m=Jr(r,t);if(m)return m;let y=t.list||t.dryRun||!d&&!t.json&&!t.all,v=await Qr(n,r,{source:r,skillSlug:d,listOnly:y},t);if(v.kind==="failure")return v.result;let P=v.inspection;if(t.list)return h(P,"Source skills loaded.",t.json,n);let R=zn(r,P,t);if(R)return R;let L=await Mt({source:r,inspection:P,requestedSkillSlug:d,mode:"install",flags:t,backend:n});if(L.kind==="failure")return L.result;if(t.dryRun)return h(Hn(r,P,L.skillSlug,t),"Source install preview ready.",t.json,n);let K;try{K=await Zr({source:r,skillSlug:L.skillSlug,flags:t,backend:n,sourceAccess:v.sourceAccess})}catch(Q){if(Q instanceof A)return Xr(r,Q,t);throw Q}let j=await Tn(n,K),Se=Vr(j)?await In(n,j,L.skillSlug??l(j,"skillSlug")??r,t,{exportMode:Gn(j)?"public":"auto"}):j;if(H(Se))return Se;let M=await Nt(n,Se,L.skillSlug??l(Se,"skillSlug")??r,t);return await Ot(n,M,L.skillSlug??l(M,"skillSlug")??r),Bt(M,zr(r,t,n,M,v.sourceAccess),t.json,n)}let s=b(e[0]??t.install,"install requires a skill slug or --source.");if(xo(s)){let d=Wr(s,p(t.skill),t);if(d)return d;let g=await Vt(s,n.cwd);if(g)return await Hr(s,g,p(t.skill),t,n);let f=Jr(s,t);if(f)return f;let m=p(t.skill),y,v="unknown",P=async M=>{if(y)return null;let Q=await Qr(n,s,{source:s,skillSlug:m,listOnly:M},t);return Q.kind==="failure"?Q.result:(y=Q.inspection,v=Q.sourceAccess,null)};if(t.list){let M=await P(!0);return M||h(y,"Source skills loaded.",t.json,n)}if(!m&&!t.json&&!t.all){let M=await P(!0);if(M)return M;let Q=y,Ue=zn(s,Q,t);if(Ue)return Ue;let tn=await Mt({source:s,inspection:Q,requestedSkillSlug:m,mode:"install",flags:t,backend:n});if(tn.kind==="failure")return tn.result;m=tn.skillSlug}if(t.dryRun){let M=await P(!0);if(M)return M;let Q=y,Ue=await Mt({source:s,inspection:Q,requestedSkillSlug:m,mode:"install",flags:t,backend:n});return Ue.kind==="failure"?Ue.result:(m=Ue.skillSlug,h(Hn(s,Q,m,t),"Source install preview ready.",t.json,n))}let R=await P(!1);if(R)return R;let L;try{L=await Zr({source:s,skillSlug:m,flags:t,backend:n,sourceAccess:v})}catch(M){if(M instanceof A)return Xr(s,M,t);throw M}let K=await Tn(n,L),j=Vr(K)?await In(n,K,m??l(K,"skillSlug")??D(s),t,{exportMode:Gn(K)?"public":"auto"}):K;if(H(j))return j;let Se=await Nt(n,j,m??l(j,"skillSlug")??D(s),t);return await Ot(n,Se,m??l(Se,"skillSlug")??D(s)),Bt(Se,zr(s,t,n,Se,v),t.json,n)}if(p(t.scope)==="workspace"){let d=b(t.workspace,"workspace installs require --workspace <workspace-id>."),g=await S(n,`/api/v1/workspaces/${encodeURIComponent(d)}/skills`,{method:"POST",headers:I(n.apiKey),body:JSON.stringify(_({skillSlug:s,version:p(t.version),dryRun:t.dryRun}))});return t.dryRun?await Gs(g,"Workspace install preview ready.",t,n):h(g,"Workspace deployment requested.",t.json,n)}let o=await S(n,"/api/v1/install",{method:"POST",headers:I(n.apiKey),body:JSON.stringify(_({skillSlug:s,version:p(t.version),scope:p(t.scope),agent:p(t.agent),dryRun:t.dryRun}))});if(t.dryRun)return await Pu(o,t,n);let a=await Tn(n,o),c=await In(n,a,s,t);if(H(c))return c;let u=await Nt(n,c,s,t);return await Ot(n,u,s),Bt(u,"Skill installed.",t.json,n)}async function In(e,t,n,i,r={}){if(Array.isArray(t.materializedWrites)&&t.materializedWrites.length>0)return t;let s=Wc(e,t,n,i);if(s.status==="skip")return t;if(s.status==="failure")return w({status:"materialization_target_invalid",reasonCode:"materialization_target_invalid",skillSlug:s.skillSlug,nextStep:s.nextStep},s.message,i.json,"materialization_target_invalid");let o=await Jc(e,t,s.skillSlug,s.version,r),a=await Us({backend:e,exportResult:o,flags:i,skillSlug:s.skillSlug});if(H(a))return a;let c=await eu({backend:e,skillSlug:s.skillSlug,version:s.version??l(o,"version")??"latest",scope:s.scope,agent:s.agent,skillsPath:s.skillsPath,bytes:a.bytes,files:a.files,archiveSha256:a.archiveSha256});return{...t,...Zc(o),archiveSha256:a.archiveSha256,archiveHashFormat:a.archiveHashFormat,scope:s.scope,agent:s.agent.id,targetAgent:s.agent.id,materializationPlan:{scope:s.scope,agent:s.agent.id},...c}}function Wc(e,t,n,i){let r=C(t,"materializationPlan")??C(t,"installPlan"),s=p(i.scope)??l(t,"scope")??(r?l(r,"scope"):void 0);if(s!=="project"&&s!=="global")return{status:"skip"};let o=l(t,"skillSlug")??l(t,"slug")??n,a=p(i.agent)??l(t,"agent")??l(t,"targetAgent")??(r?l(r,"agent")??l(r,"targetAgent"):void 0)??oe(e.config?.lastSelectedAgent)??"codex",c=Pe(e.env,e.platform,e.cwd).find(d=>d.id===a);if(!c)return{status:"failure",skillSlug:o,message:`Unsupported agent "${a}". Run \`skills-layer agents list\` to choose a supported local install target.`,nextStep:"Run `skills-layer agents list` and retry with a supported --agent value."};let u=s==="global"?c.targets.globalSkillsPath:c.targets.projectSkillsPath;return u?{status:"ok",scope:s,agent:c,skillsPath:u,skillSlug:o,version:l(t,"version")??l(t,"currentVersion")}:{status:"failure",skillSlug:o,message:`${c.displayName} does not expose a ${s} skills path on this machine.`,nextStep:"Retry with --scope project, or choose another agent from `skills-layer agents list`."}}async function Jc(e,t,n,i,r={}){if(typeof t.downloadUrl=="string"&&typeof t.archiveSha256=="string")return t;let s=new URLSearchParams;i&&s.set("version",i);let o=r.exportMode==="public"||!e.apiKey,a=o?`/api/v1/skills/${encodeURIComponent(n)}/export${ie(s)}`:`/api/v1/me/library/${encodeURIComponent(n)}/export${ie(s)}`,c=await S(e,a,{headers:o?{}:F(e.apiKey,e.authBlockedMessage)});return o?{...c,downloadUrl:Yc(n,l(c,"version")??i)}:c}function Yc(e,t){let n=new URLSearchParams;return t&&n.set("version",t),`/api/v1/skills/${encodeURIComponent(e)}/download${ie(n)}`}function Gn(e){let t=l(e,"visibility")??l(e,"versionVisibility"),n=l(e,"listingStatus"),i=l(e,"versionStatus"),r=l(e,"publicationStatus");return t==="public"||n==="published"&&i==="published"||r==="clean_publishable"||r==="publishable_with_findings"}function Vr(e){return Gn(e)||typeof e.downloadUrl=="string"&&typeof e.archiveSha256=="string"}function Zc(e){return _({version:l(e,"version"),storageKey:l(e,"storageKey"),expiresAt:l(e,"expiresAt")})}async function Us(e){let t=l(e.exportResult,"downloadUrl");if(!t)return w({status:"export_download_unavailable",reasonCode:"export_download_unavailable",skillSlug:e.skillSlug,nextStep:"Retry after the backend returns a signed bundle download URL."},`Export for ${e.skillSlug} did not include a signed download URL.`,e.flags.json,"export_download_unavailable");let n=await e.backend.fetchFn(Qc(e.backend.baseUrl,t));if(!n.ok)throw new A(n.status,`Unable to download exported bundle (${n.status}).`);let i=new Uint8Array(await n.arrayBuffer()),r=Xc(i),s=l(e.exportResult,"archiveSha256")??n.headers.get("x-skills-layer-archive-sha256")?.trim()??void 0;return s&&r.archiveSha256!==s?w({status:"download_integrity_failed",reasonCode:"download_hash_mismatch",skillSlug:e.skillSlug,version:l(e.exportResult,"version"),expectedArchiveSha256:s,observedArchiveSha256:r.archiveSha256,archiveHashFormat:r.format,nextStep:"Retry after the catalog artifact is refreshed, or contact Skills Layer support if this repeats."},`Downloaded ${e.skillSlug} did not match the catalog artifact hash.`,e.flags.json,"download_hash_mismatch"):r.files.length===0?w({status:"download_integrity_failed",reasonCode:"download_bundle_empty",skillSlug:e.skillSlug,archiveHashFormat:r.format,nextStep:"Retry after the catalog artifact is refreshed."},`Downloaded ${e.skillSlug} did not contain any skill files.`,e.flags.json,"download_bundle_empty"):{status:"ok",bytes:i,files:r.files,archiveSha256:r.archiveSha256,archiveBytesSha256:r.archiveBytesSha256,archiveHashFormat:r.format}}function Qc(e,t){return/^https?:\/\//iu.test(t)?t:`${Ce(e)}${t.startsWith("/")?"":"/"}${t}`}function Xc(e){let t=ni("sha256").update(e).digest("hex"),n=Hi(e);return n?{archiveSha256:zi(n),archiveBytesSha256:t,format:"bundle_archive",files:n}:{archiveSha256:t,archiveBytesSha256:t,format:"raw",files:[]}}async function eu(e){let t=e.backend.platform==="win32"?ze:oi,n=t.join(e.backend.paths.bundlesDir,e.skillSlug,e.version,"bundle.zip"),i=t.join(e.skillsPath,e.skillSlug),r=t.join(i,e.version,"bundle.zip"),s=[];await ei(n,e.bytes),await ri(i,{recursive:!0,force:!0}),await ei(r,e.bytes),s.push({path:qt(e.backend.cwd,r),bytes:e.bytes.byteLength});for(let o of e.files){let a=t.join(i,...gu(o.path)),c=o.content??"";if(await ge(a,c),s.push({path:qt(e.backend.cwd,a),bytes:new TextEncoder().encode(c).length}),D(o.path).toLowerCase()==="skill.md"){let u=await Ci({backend:e.backend,skillSlug:e.skillSlug,version:e.version,skillDocumentPath:a,skillDocumentContent:c});s.push(u)}}return{bundlePath:n,materializedPath:r,materializedSkillRoot:i,archiveSha256:e.archiveSha256,materializedWrites:s}}var tu=new Set(["file_exists","json_valid","schema_match","section_exists","regex_match","artifact_valid"]);async function Nt(e,t,n,i){let r=l(t,"materializedSkillRoot");if(!r)return t;let s=l(t,"skillSlug")??l(t,"slug")??n,o=l(t,"version")??l(t,"currentVersion")??p(i.version)??"local";try{let a=await nu(V(e.cwd,r));if(a.length===0)return Lt(t,i,{status:"runner_unavailable",summaryStatus:"runner_unavailable",reasonCode:"installed_files_unreadable"});let c=ru({files:a,skillSlug:s,version:o,generatedAt:e.now()}),u=await pu(e,c.summary);return u.status==="recorded"?Lt({...t,...u.effectiveness?{effectiveness:u.effectiveness}:{}},i,{status:"recorded",source:c.source,summaryStatus:c.summary.status,evalPackDigest:c.summary.evalPackDigest,evidenceRevision:u.evidenceRevision}):Lt(t,i,{status:u.status,source:c.source,summaryStatus:c.summary.status,evalPackDigest:c.summary.evalPackDigest,reasonCode:u.reasonCode})}catch(a){return Lt(t,i,{status:"runner_unavailable",summaryStatus:"runner_unavailable",reasonCode:"local_eval_failed",message:te(a)})}}async function nu(e){let t=[];return await Ts(e,e,t),t.sort((n,i)=>n.path.localeCompare(i.path))}async function Ts(e,t,n){for(let i of await ii(t,{withFileTypes:!0})){if(po(i.name))continue;let r=U(t,i.name);if(i.isDirectory()){await Ts(e,r,n);continue}if(!(!i.isFile()||iu(i.name)))try{n.push({path:Ke(e,r).split("\\").join("/"),content:await He(r,"utf8")})}catch{continue}}}function iu(e){return e==="bundle.zip"||/^\.skills-layer-.*\.json$/u.test(e)}function ru(e){let t=he(e.files),n=su(e.files,t);if(!ir(n.pack).valid)return{source:"invalid_submitted",summary:_t({status:"runner_unavailable",skillSlug:e.skillSlug,version:e.version,artifactDigest:t,evalPackDigest:Pt(n.pack),generatedAt:e.generatedAt,runnerVersion:Gr(),counts:{cases:0,assertions:0,passed:0,failed:0,skipped:0}})};let r=lu(n.pack).map(o=>({id:o.id,assertions:o.assertions.map(a=>cu(a,e.files))})),s=uu(r);return{source:n.source,summary:_t({status:du(s),skillSlug:e.skillSlug,version:e.version,artifactDigest:typeof n.pack.artifactDigest=="string"?n.pack.artifactDigest:t,evalPackDigest:Pt(n.pack),generatedAt:e.generatedAt,runnerVersion:Gr(),counts:{cases:r.length,assertions:s.total,passed:s.passed,failed:s.failed,skipped:s.skipped}})}}function su(e,t){let n=ou(e);return n?{pack:n,source:"submitted"}:{pack:au(e,t),source:"inferred"}}function ou(e){for(let t of e){let n=Ae(t.path,e);if(!(n.type!=="evidence"||!t.content||!n.relativePath.toLowerCase().endsWith(".eval.json")))try{let i=JSON.parse(t.content);if(x(i))return i}catch{return{schemaVersion:"invalid",artifactDigest:he(e),origin:"submitted",confidence:"starter",creatorReviewed:!1,redaction:{mode:"content_free"},cases:[]}}}}function au(e,t){let i=e.find(r=>r.path.replaceAll("\\","/").split("/").at(-1)?.toLowerCase()==="skill.md")?.path??"SKILL.md";return{schemaVersion:"skills-layer.eval.pack.v1",artifactDigest:t,origin:"inferred",confidence:"starter",creatorReviewed:!1,redaction:{mode:"content_free"},cases:[{id:"starter-runtime-shape",assertions:[{type:"file_exists",path:i},{type:"regex_match",path:i,pattern:"^---[\\s\\S]*\\nname:\\s*"},{type:"artifact_valid",artifactDigest:t}]}]}}function lu(e){return Array.isArray(e.cases)?e.cases.flatMap(t=>!x(t)||typeof t.id!="string"||!Array.isArray(t.assertions)?[]:[{id:t.id,assertions:t.assertions.filter(x)}]):[]}function cu(e,t){return typeof e.type=="string"&&!tu.has(e.type)?{status:"skipped",reasonCode:"runner_unavailable"}:nr(e,{files:t})}function uu(e){return e.reduce((t,n)=>{for(let i of n.assertions)t.total+=1,i.status==="passed"&&(t.passed+=1),i.status==="failed"&&(t.failed+=1),i.status==="skipped"&&(t.skipped+=1);return t},{total:0,passed:0,failed:0,skipped:0})}function du(e){return e.failed>0?"failed":e.passed>0?"passed":e.skipped>0?"runner_unavailable":"not_run"}function Gr(){return`skills-layer-public-cli:${Be}:local-install`}async function pu(e,t){if(!e.apiKey)return{status:"local_only",reasonCode:"not_authenticated"};try{let n=await S(e,"/api/v1/me/evals/results",{method:"POST",headers:{"content-type":"application/json",...F(e.apiKey,e.authBlockedMessage)},body:JSON.stringify({evalSummary:t})}),i=C(n,"evalEvidence");return{status:"recorded",effectiveness:C(n,"effectiveness"),evidenceRevision:i?T(i,"revision"):void 0}}catch(n){return{status:"submit_failed",reasonCode:n instanceof A?`http_${n.status}`:"request_failed"}}}function Lt(e,t,n){return t.json?{...e,localEval:n}:e}function gu(e){let n=e.replaceAll("\\","/").replace(/^\/+/u,"").trim().split("/").filter(i=>i.length>0);if(n.length===0||n.some(i=>i==="."||i===".."))throw new Error(`Unsafe bundle path "${e}".`);return n}async function Hr(e,t,n,i,r){let s=p(i.visibility)??"private";if(s!=="private")return w({status:"local_install_visibility_not_allowed",reasonCode:"local_install_visibility_not_allowed",source:e,requestedVisibility:s,nextStep:`Use \`skills-layer creator submit ${e} --visibility ${s} --dry-run\` when you want to submit a local skill with non-private visibility.`},`Local path install creates a private Cloud skill by default. Use creator submit when you want ${s} visibility.`,i.json,"local_install_visibility_not_allowed");let o=Fs(e,t,n);if(i.list)return h(o,"Local source skills loaded.",i.json,r);let a=zn(e,o,i);if(a)return a;let c=await Mt({source:e,inspection:o,requestedSkillSlug:n,mode:"install",flags:i,backend:r});if(c.kind==="failure")return c.result;let u=c.skillSlug??ht(o)[0]?.value??Ms(e);if(i.dryRun)return h({...Hn(e,o,u,i),installKind:"local_private",publicationStatus:"none",catalogRecord:"not_created",nextStep:`Re-run without --dry-run to install ${u} locally. Use \`skills-layer creator submit ${e} --visibility private --dry-run\` when you want a private creator submission.`},"Local private install preview ready.",i.json,r);let d=await S(r,"/api/v1/me/submissions",{method:"POST",headers:{"content-type":"application/json",...F(r.apiKey,r.authBlockedMessage)},body:JSON.stringify(_({files:t.files,version:p(i.version),visibility:"private",category:p(i.category),displayName:p(i.displayName),skillType:p(i.skillType),sourceMetadata:t.sourceMetadata}))}),g=await hu({backend:r,source:e,upload:t,skillSlug:l(d,"skillSlug")??u,flags:i,submitted:d}),f=await Nt(r,g,u,i);return await Ot(r,f,u),Bt(f,"Private Cloud skill installed.",i.json,r)}function Fs(e,t,n){let i=mu(t.files),r=n?i.find(s=>s.skillSlug===n)??null:i.length===1?i[0]??null:null;return{status:"ok",source:t.sourceMetadata,selectedSkill:r,results:i,issues:[],sourceInstallSupported:!0,sourceInstallMode:"local_private",publicationStatus:"none",originalSource:e}}function mu(e){return e.filter(t=>t.path.split("/").at(-1)?.toLowerCase()==="skill.md").map(t=>{let n=ae(t.path).replaceAll("\\","/"),i=n==="."?".":n,r=Ns(t.content??"")??Ms(i==="."?t.path:i),s=fu(t.content??"");return{skillSlug:r,name:r,...s?{description:s}:{},relativeSkillRoot:i,relativeSkillFile:t.path,sourceKind:"local",discoveryRoute:"local_bundle",validation:{valid:!0,issueCount:0}}})}function Ns(e){return/^---\s*[\s\S]*?\nname:\s*["']?([^"'\n]+)["']?\s*(?:\n|$)/u.exec(e)?.[1]?.trim()}function fu(e){return/^---\s*[\s\S]*?\ndescription:\s*["']?([^"'\n]+)["']?\s*(?:\n|$)/u.exec(e)?.[1]?.trim()}function Ms(e){return(e.replaceAll("\\","/").replace(/\/+$/u,"").split("/").filter(Boolean).at(-1)??"local-skill").toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||"local-skill"}async function hu(e){let t=yu(e.backend,e.flags);if(t.status==="failure")throw new Error(t.message);let n=e.upload.files.map(r=>({path:U(t.skillsPath,e.skillSlug,go(r.path)),content:r.content??""})),i=[];for(let r of n)if(await ge(r.path,r.content),i.push({path:qt(e.backend.cwd,r.path),bytes:new TextEncoder().encode(r.content).length}),D(r.path).toLowerCase()==="skill.md"){let s=await Ci({backend:e.backend,skillSlug:e.skillSlug,version:l(e.submitted,"version")??p(e.flags.version)??"private",skillDocumentPath:r.path,skillDocumentContent:r.content});i.push(s)}return{...e.submitted,status:"installed",cloudStatus:l(e.submitted,"status")??"submitted",installKind:"cloud_private",source:e.source,sourceKind:"local",skillSlug:e.skillSlug,version:l(e.submitted,"version")??p(e.flags.version)??"private",scope:t.scope,agent:t.agent,visibility:"private",publicationStatus:"private",catalogRecord:"private",privacy:{publication:"private",catalogRecord:"private",message:"This local install was saved as a private Cloud skill and did not create a public catalog record."},materializationPlan:{scope:t.scope,agent:t.agent},materializedSkillRoot:U(t.skillsPath,e.skillSlug),materializedWrites:i}}function yu(e,t){let n=p(t.scope)??"project";if(!["local","project","global"].includes(n))return{status:"failure",message:"Local private installs support --scope local, project, or global. Use `skills-layer creator submit <path> --visibility private` for private creator workflows."};let i=p(t.agent)??oe(e.config?.lastSelectedAgent)??"codex",r=Pe(e.env,e.platform,e.cwd).find(o=>o.id===i);if(!r)return{status:"failure",message:`Unsupported agent "${i}". Run \`skills-layer agents list\` to choose a supported local install target.`};let s=n==="global"?r.targets.globalSkillsPath:r.targets.projectSkillsPath;return s?{status:"ok",scope:n,agent:r.id,skillsPath:s}:{status:"failure",message:`${r.displayName} does not expose a ${n} skills path on this machine.`}}function qt(e,t){let n=Ke(e,t);return n&&!n.startsWith("..")&&!ze.isAbsolute(n)?n.split("\\").join("/"):t}function yi(e,t,n,i="unknown"){let r=p(t.visibility);return r==="public"||r==="private"?r:i==="anonymous"?"public":i==="authenticated"?"private":!n.apiKey&&Bs(e)?"public":"private"}function Bs(e){try{return it(e).kind==="github"}catch{return/^https:\/\/github\.com\//iu.test(e.trim())}}function Os(e,t,n,i="unknown"){return yi(e,t,n,i)==="private"||i==="authenticated"?"/api/v1/me/source-installs":"/api/v1/source-imports"}function ku(e,t,n,i="unknown"){return{"content-type":"application/json",...Os(e,t,n,i)==="/api/v1/me/source-installs"?F(n.apiKey,n.authBlockedMessage):{}}}function zr(e,t,n,i,r="unknown"){let s=i?l(i,"visibility")??l(i,"versionVisibility"):void 0,o=i?l(i,"publicationStatus"):void 0,a=i?l(i,"catalogRecord"):void 0,c=i?l(i,"status"):void 0;return s==="public"||o==="clean_publishable"||o==="publishable_with_findings"||c==="published"?"Public source install planned.":s==="private"||o==="private"||a==="private"||c==="private_source_installed"?"Private source skill installed.":yi(e,t,n,r)==="public"?"Public source install planned.":"Private source skill installed."}async function Mt(e){let t=ht(e.inspection);if(e.requestedSkillSlug)return t.length>0&&!t.some(n=>n.value===e.requestedSkillSlug)?{kind:"failure",result:wu(e.source,e.requestedSkillSlug,t.map(n=>n.value),e.flags)}:{kind:"selected",skillSlug:e.requestedSkillSlug};if(e.flags.json||e.flags.all)return{kind:"selected",skillSlug:e.requestedSkillSlug};if(t.length<=1)return{kind:"selected",skillSlug:t[0]?.value};try{return{kind:"selected",skillSlug:await e.backend.promptSelect(`${e.source} exposes multiple skills. Select one to ${e.mode}:`,t)}}catch{return{kind:"failure",result:k(`Source "${e.source}" exposes multiple skills. Re-run with --list or --skill <skill-slug>. Available skills: ${t.map(n=>n.value).join(", ")}.`,e.flags.json)}}}function Wr(e,t,n){if(n.all&&t)return w({status:"error",reasonCode:"conflicting_source_selection",source:e,selectedSkillSlug:t,all:!0,nextAction:"install",nextStep:"Use either --all to install every discovered skill or --skill <skill-slug> to install one skill, not both."},"Source install cannot combine --all with --skill. Choose one selection mode before retrying.",n.json,"conflicting_source_selection")}function Jr(e,t){try{if(it(e).kind!=="local")return}catch{return}return w({status:"error",reasonCode:"invalid_source",source:e,nextAction:"install",nextStep:Dt(e)?"Check that the local path exists and contains SKILL.md, or pass a supported GitHub/GitLab/source URL.":"Use an existing local path such as ./my-skill, a GitHub/GitLab source URL, or run `skills-layer install --source <source> --list` with a supported source."},Dt(e)?`Install source ${e} was not found or is not readable.`:`Install source "${e}" is not a supported remote source and no local path was found.`,t.json,"invalid_source")}function wu(e,t,n,i){return w({status:"not_found",reasonCode:"source_skill_not_found",source:e,requestedSkillSlug:t,availableSkills:n,nextAction:"install.source.list",nextStep:`Run \`skills-layer install --source ${e} --list\` to inspect discovered skills, then retry with one of the listed slugs.`},`Source ${e} does not contain a discovered skill named ${t}. Run with --list to inspect available skills.`,i.json,"source_skill_not_found")}function ht(e){let t=[e.results,e.skills,e.discoveredSkills,C(e,"source")?.results,C(e,"inspection")?.results],n=new Set,i=[];for(let r of t)if(Array.isArray(r))for(let s of r){let o=vu(s);!o||n.has(o.value)||(n.add(o.value),i.push(o))}return i}function vu(e){if(!x(e))return;let t=l(e,"skillSlug")??l(e,"slug")??l(e,"name");if(!t)return;let n=l(e,"displayName")??l(e,"title")??l(e,"name"),i=n&&n!==t?`${t} - ${n}`:t,r=C(e,"parsedSkill"),s=C(e,"frontmatter")??(r?C(r,"frontmatter"):void 0),o=l(e,"shortDescription")??l(e,"summary")??l(e,"description")??(s?l(s,"description"):void 0)??l(e,"relativeSkillRoot")??l(e,"path")??l(e,"discoveryRoute")??l(e,"sourceKind");return o?{value:t,label:i,description:o}:{value:t,label:i}}function Yr(e,t,n,i,r,s={}){return _({...t,skillSlug:n,scope:p(i.scope),agent:p(i.agent),workspace:p(i.workspace),version:p(i.version),visibility:s.visibility??yi(e,i,r,s.sourceAccess),category:p(i.category),displayName:p(i.displayName),skillType:p(i.skillType),all:i.all,quarantine:i.quarantine,acceptCapability:i.acceptCapability})}async function Zr(e){let t=e.sourceAccess??"unknown",n=Os(e.source,e.flags,e.backend,t);try{return await S(e.backend,n,{method:"POST",headers:ku(e.source,e.flags,e.backend,t),body:JSON.stringify(Yr(e.source,{source:e.source},e.skillSlug,e.flags,e.backend,{sourceAccess:t}))})}catch(i){if(i instanceof A&&i.status===401&&p(e.flags.visibility)!=="private"&&t!=="authenticated"&&Bs(e.source))return await S(e.backend,"/api/v1/source-imports",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(Yr(e.source,{source:e.source},e.skillSlug,e.flags,e.backend,{visibility:"public"}))});throw i}}function Hn(e,t,n,i){return _({status:"dry_run",source:e,selectedSkillSlug:n,all:i.all,scope:p(i.scope)??"local",agent:p(i.agent),workspace:p(i.workspace),quarantine:i.quarantine,acceptCapability:i.acceptCapability,candidates:ht(t).map(r=>({skillSlug:r.value,name:r.label,description:r.description})),nextStep:i.all?`Re-run without --dry-run to install every discovered skill from ${e}.`:`Re-run without --dry-run${n?"":" and add --skill <skill-slug> if needed"} to install from ${e}.`})}async function qs(e,t,n,i,r={}){try{return{kind:"ok",inspection:await S(e,"/api/v1/source-inspect",{method:"POST",headers:Ds(e,r.authMode??"auto"),body:JSON.stringify(_(n))})}}catch(s){if(s instanceof A)return{kind:"failure",result:Wn(t,s,i)};throw s}}function Ds(e,t){return t==="anonymous"?{"content-type":"application/json"}:I(e.apiKey)}async function Qr(e,t,n,i){try{return{kind:"ok",inspection:await S(e,"/api/v1/source-inspect",{method:"POST",headers:Ds(e,"anonymous"),body:JSON.stringify(_(n))}),sourceAccess:"anonymous"}}catch(s){if(!(s instanceof A))throw s;let o=s.details??{},a=l(o,"error")??s.message;if(!ki(s.status,a))return{kind:"failure",result:Wn(t,s,i)};if(!e.apiKey)return{kind:"failure",result:Wn(t,s,i)}}let r=await qs(e,t,n,i,{authMode:"authenticated"});return r.kind==="failure"?r:{kind:"ok",inspection:r.inspection,sourceAccess:"authenticated"}}function zn(e,t,n){if(ht(t).length>0)return null;let r=bu(t);return w({status:"unsupported_source_layout",source:e,reasonCode:"source_no_discoverable_skills",issues:r,nextStep:"Run with --list to inspect the source, use a subfolder containing SKILL.md, or install from a Skills Layer-compatible source layout."},Su(e,r),n.json)}function bu(e){return(Array.isArray(e.issues)?e.issues:[]).filter(x).map(n=>({...l(n,"code")?{code:l(n,"code")}:{},...l(n,"message")?{message:l(n,"message")}:{},...l(n,"path")?{path:l(n,"path")}:{}}))}function Wn(e,t,n){let i=t.details??{},r=l(i,"error")??t.message;if(ki(t.status,r))return Ks(e,t,n,"inspect");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(r)))return Qt(t,n.json);let o={status:"unsupported_source_layout",source:e,reasonCode:"source_not_inspectable",backendStatus:t.status,backendMessage:r,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return w(o,`Source ${e} could not be inspected as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function Xr(e,t,n){let i=t.details??{},r=l(i,"error")??t.message;if(ki(t.status,r))return Ks(e,t,n,"install");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(r)))return Qt(t,n.json);let o={status:"unsupported_source_layout",source:e,reasonCode:"source_not_installable",backendStatus:t.status,backendMessage:r,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return w(o,`Source ${e} could not be installed as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function ki(e,t){return e===401||e===403||/private source|provider authorization|unauthorized|forbidden|access denied/iu.test(t)}function Ks(e,t,n,i){let r=t.details??{},s=l(r,"error")??t.message,a=`skills-layer source connection start --provider ${Vs(e)} --source ${e} --visibility private --provenance-intent private_source_import`,c={status:"private_source_access_required",source:e,reasonCode:"private_source_access_required",backendStatus:t.status,backendMessage:s,nextStep:a};return w(c,`Cloud could not ${i} ${e} directly. If this is a private source, start a private source connection first:
-${a}`,n.json,"private_source_access_required")}function Vs(e){return/gitlab\./iu.test(e)?"gitlab":/github\./iu.test(e)||/^gh:/iu.test(e)?"github":"generic_git"}function Su(e,t){let n=[`No Skills Layer-compatible skills were found in ${e}.`];if(t.length>0){n.push("Detected issues:");for(let i of t.slice(0,5)){let r=i.code??"source-inspection";n.push(`- ${r}: ${i.message??"No details returned."}${i.path?` (${i.path})`:""}`)}}return n.push("Try --list, a subfolder containing SKILL.md, or a Skills Layer-compatible source layout."),n.join(`
-`)}async function Pu(e,t,n){if(Hs(e)){let s=l(e,"reasonCode")??l(e,"reason")??"install_not_ready",o=l(e,"why")??l(e,"summary")??"The requested skill is not ready to install from this backend.";return w(e,`Install preview is not ready: ${o}`,t.json,s)}let i=await zs(e,n),r=Array.isArray(i.warnings)&&i.warnings.length>0;return Cu(i,r?"Install preview ready with warnings.":"Install preview ready.",t,n)}function Cu(e,t,n,i){return n.json?h(e,t,!0,i):{exitCode:0,stdout:wi(e,t,i),stderr:""}}async function Gs(e,t,n,i){if(Hs(e)){let s=l(e,"reasonCode")??l(e,"reason")??"workspace_deploy_not_ready",o=l(e,"why")??l(e,"summary")??l(e,"nextStep")??"The requested workspace deployment is not ready.";return w(e,`Workspace deployment preview is not ready: ${o}`,n.json,s)}let r=await zs(e,i);return n.json?h(r,t,!0,i):{exitCode:0,stdout:wi(r,t,i),stderr:""}}function Hs(e){let t=l(e,"status")?.toLowerCase(),n=l(e,"reasonCode")?.toLowerCase();return t==="not_found"||t==="missing"||t==="blocked"||t==="not_ready"||n==="skill_not_found"||n==="not_found"}async function zs(e,t){let n=es(e);if(n)return{...e,...n};let i=l(e,"skillSlug")??l(e,"slug");if(!i)return e;try{let r=await S(t,`/api/v1/skills/${encodeURIComponent(i)}/trust`),s=es(r);return s?{...e,...s}:e}catch{return e}}function es(e){let t=C(e,"securityReport")??C(e,"report")??e,n=C(e,"trust")??C(t,"trust")??t,i=C(e,"securityPosture")??C(t,"securityPosture"),r=C(e,"capabilityProfile")??C(t,"capabilityProfile"),s=_({securityScore:T(n,"securityScore")??T(n,"score")??T(e,"securityScore")??(i?T(i,"securityScore"):void 0),runtimeRisk:l(n,"runtimeRisk")??l(e,"runtimeRisk")??(i?l(i,"runtimeRisk"):void 0)??(r?l(r,"runtimeRisk"):void 0),recommendation:l(n,"recommendation")??l(e,"recommendation")??(i?l(i,"recommendation"):void 0),detectedCapabilities:we(n,"detectedCapabilities")??we(e,"detectedCapabilities")??(r?we(r,"detectedCapabilities"):void 0),capabilityMismatches:we(n,"capabilityMismatches")??we(e,"capabilityMismatches")??(r?we(r,"capabilityMismatches"):void 0),organizationPolicyDecision:l(n,"organizationPolicyDecision")??l(n,"policyDecision")??l(e,"organizationPolicyDecision")??l(e,"policyDecision")??(i?l(i,"organizationPolicyDecision"):void 0)});if(Object.keys(s).length!==0)return _({trust:s,runtimeRisk:l(s,"runtimeRisk"),detectedCapabilities:Array.isArray(s.detectedCapabilities)?s.detectedCapabilities:void 0,capabilityMismatches:Array.isArray(s.capabilityMismatches)?s.capabilityMismatches:void 0,organizationPolicyDecision:l(s,"organizationPolicyDecision"),warnings:we(e,"warnings")??we(t,"warnings")??we(n,"warnings")})}function _u(e){let t=C(e,"securityPosture"),n=C(e,"trust"),i=t?T(t,"securityScore"):void 0,r=n?T(n,"securityScore")??T(n,"score"):void 0;return i===void 0&&r===void 0?e:_({...e,...t?{securityPosture:{...t,scoreLabel:"published_ledger_score"}}:{},...n?{trust:{...n,scoreLabel:"effective_buyer_trust_score"}}:{},publishedLedgerScore:i,effectiveBuyerTrustScore:r})}function Bt(e,t,n,i){return n?h(e,t,!0,i):{exitCode:0,stdout:wi(e,t,i),stderr:""}}function xu(e,t,n){let i=re(n),r=Array.isArray(e.runs)?e.runs.filter(x):[],s=r.flatMap(c=>Array.isArray(c.results)?c.results.filter(x):[]),o=r.flatMap(c=>{let u=C(c,"tool"),d=u?C(u,"driver"):void 0;return d&&Array.isArray(d.rules)?d.rules.filter(x):[]}),a=[`${i.ok("OK")} Trust report loaded.`,"",i.section("SARIF")];if(a.push(`  ${i.label("Skill")}: ${t}`),a.push(`  ${i.label("Runs")}: ${r.length}`),a.push(`  ${i.label("Rules")}: ${o.length}`),a.push(`  ${i.label("Results")}: ${s.length}`),s.length===0)a.push(`  ${i.muted("No SARIF findings found.")}`);else{a.push("",i.section("Findings"));for(let[c,u]of s.slice(0,O).entries()){let d=l(u,"ruleId")??"unknown-rule",g=C(u,"message");a.push(`${c+1}. ${d}${g?` - ${l(g,"text")??""}`:""}`)}}return a.push("",i.section("Next")),a.push(`  ${i.arrow} skills-layer trust ${t} --format sarif --json`),a.join(`
-`)}function wi(e,t,n){let i=re(n),r=[`${i.ok("OK")} ${t}`],s=l(e,"skillSlug")??l(e,"slug"),o=l(e,"version")??l(e,"currentVersion");(s||o)&&(r.push("",i.section("Skill")),s&&r.push(`  ${i.label("Slug")}: ${s}`),o&&r.push(`  ${i.label("Version")}: ${o}`));let a=l(e,"visibility")??l(e,"versionVisibility"),c=l(e,"publicationStatus"),u=l(e,"catalogRecord");(a||c||u)&&(r.push("",i.section("Privacy")),a&&r.push(`  ${i.label("Visibility")}: ${a}`),c&&r.push(`  ${i.label("Publication")}: ${c}`),u&&r.push(`  ${i.label("Catalog record")}: ${u}`));let d=C(e,"materializationPlan")??C(e,"installPlan"),g=l(e,"scope")??(d?l(d,"scope"):void 0),f=l(e,"agent")??l(e,"targetAgent")??(d?l(d,"agent")??l(d,"targetAgent"):void 0),m=Array.isArray(e.materializedWrites)?e.materializedWrites.filter(x):[];if(g||f||m.length>0)if(r.push("",i.section("Local Materialization")),g&&r.push(`  ${i.label("Scope")}: ${g}`),f&&r.push(`  ${i.label("Agent")}: ${f}`),m.length===0)r.push(`  ${i.muted("No local files were written by this command.")}`);else for(let P of m.slice(0,O)){let R=l(P,"path");R&&r.push(`  ${i.arrow} ${R}`)}let y=wo(e,i).filter(P=>!P.includes("materialized writes:"));y.length>0&&r.push("",...y);let v=Co(e);return v.length>0&&r.push("",i.section("Next"),...v.map(P=>`  ${i.arrow} ${P}`)),r.join(`
-`)}function Ru(e,t){let n=C(e,"trust"),i=C(e,"securityPosture"),r=C(e,"capabilityProfile"),s=n?.securityScore??n?.score??e.securityScore??i?.securityScore,o=N(n,"runtimeRisk")??l(e,"runtimeRisk")??N(i,"runtimeRisk")??N(r,"runtimeRisk"),a=N(n,"recommendation")??l(e,"recommendation")??N(i,"recommendation"),c=N(n,"label")??N(n,"trust")??l(e,"trustStatus")??l(e,"trust")??N(i,"label");if(s===void 0&&!o&&!a&&!c)return[];let u=[t.section("Trust")];return s!==void 0&&u.push(`  ${t.label("Security score")}: ${G("securityScore",s)}`),o&&u.push(`  ${t.label("Runtime risk")}: ${o}`),a&&u.push(`  ${t.label("Recommendation")}: ${a}`),c&&u.push(`  ${t.label("Status")}: ${c}`),u.push(`  ${t.label("Source")}: skills-layer trust`),u}async function $u(e,t){let n=mi("installed",e);if(n.failure)return n.failure;let i=await Le(t),r=Object.values(i.installs).filter(s=>{let o=l(s,"scope"),a=l(s,"agent");return(!n.scope||o===n.scope)&&(!n.agent||a===n.agent)});return h({status:"ok",results:r},`Found ${r.length} local install records.`,e.json,t)}async function Au(e,t,n){let i=b(e[0],"remove requires a skill slug."),r=Is("remove",t);if(r)return r;let s=await Le(n),o=s.installs[i];if(!o)return w({status:"not_installed",reasonCode:"local_install_not_found",skillSlug:i},`${i} is not installed locally. Run \`skills-layer installed\` or \`skills-layer sync\` to inspect local records.`,t.json,"local_install_not_found");delete s.installs[i],await mo(n,s);let a={status:"removed",skillSlug:i,removedRecord:o};return t.json?h(a,`Removed ${i}.`,!0,n):{exitCode:0,stdout:Mu(i,n),stderr:""}}async function Eu(e,t,n){let i=b(e[0],"update requires a skill slug."),r=new URLSearchParams,s=p(t.pin);if(s&&!zt(s))return w({status:"error",reasonCode:"invalid_pin",skillSlug:i,requestedPin:s,nextAction:"update",nextStep:"Use --pin with a semver version such as 1.2.3 or an external-<digest> Skills Layer version."},`Invalid --pin "${s}". Use a semver version or an external-<digest> version.`,t.json,"invalid_pin");q(r,"pin",s),t.dryRun&&r.set("dryRun","true");let a=(await Le(n)).installs[i],c;try{c=await S(n,`/api/v1/skills/${encodeURIComponent(i)}${ie(r)}`,{headers:F(n.apiKey,n.authBlockedMessage)})}catch(d){if(d instanceof A&&d.status===404&&a){let g={status:"backend_missing",reasonCode:"local_install_backend_missing",skillSlug:i,localInstall:a,installedVersion:l(a,"version")??l(a,"currentVersion"),selectedBackend:n.baseUrl,nextStep:`This skill is installed locally, but no catalog update source was found on ${n.baseUrl}. Reinstall from its source, run \`skills-layer search ${i}\`, or run \`skills-layer remove ${i}\` if you no longer need it.`};return w(g,`${i} is installed locally, but no catalog update source was found on this backend. Reinstall from its source, search for a replacement, or remove the local install.`,t.json,"local_install_backend_missing")}if(d instanceof A)return Qt(d,t.json);throw d}let u=Lu(i,c,a,n);return s&&t.dryRun&&!Iu(u,s)?w({status:"not_found",reasonCode:"pin_not_resolved",skillSlug:i,requestedPin:s,installedVersion:l(a,"version")??l(a,"currentVersion"),currentVersion:l(u,"currentVersion"),nextAction:"update",nextStep:`Choose a version returned by \`skills-layer show ${i} --json\` or omit --pin to check the latest available version.`},`${i} does not have a resolvable version for --pin ${s}.`,t.json,"pin_not_resolved"):t.json?h(u,"Update check complete.",!0,n):{exitCode:0,stdout:Fu(u,n),stderr:""}}function zt(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(e)||/^external-[0-9A-Za-z][0-9A-Za-z._-]*$/u.test(e)}function Iu(e,t){let n=[l(e,"version"),l(e,"currentVersion"),l(e,"latestVersion"),l(e,"targetVersion"),l(e,"availableVersion")].filter(Boolean),i=C(e,"update");return i&&n.push(l(i,"version"),l(i,"currentVersion"),l(i,"latestVersion"),l(i,"targetVersion"),l(i,"availableVersion")),n.some(r=>r===t)}async function ju(e,t){let n=mi("sync",e);if(n.failure)return n.failure;let i=await Le(t),r=Object.values(i.installs).filter(a=>{let c=l(a,"scope"),u=l(a,"agent");return(!n.scope||c===n.scope)&&(!n.agent||u===n.agent)}),o={status:"synced",results:await Promise.all(r.map(async a=>Uu(a,t)))};return e.json?h(o,"Local install records synced.",!0,t):{exitCode:0,stdout:Nu(o,t),stderr:""}}function Lu(e,t,n,i){let r=n?l(n,"version")??l(n,"currentVersion"):void 0,s=l(t,"currentVersion")??l(t,"version"),o=n?r&&s&&r!==s?"update_available":"up_to_date":"not_installed";return _({...t,skillSlug:l(t,"skillSlug")??l(t,"slug")??e,updateStatus:o,installedVersion:r,latestAvailableVersion:s,selectedBackend:i.baseUrl,localInstall:n,nextStep:o==="not_installed"?`Run \`skills-layer install ${e}\` to install this skill locally.`:o==="update_available"?`Run \`skills-layer install ${e}\` to apply the latest available version.`:`No update is needed for ${e}.`})}async function Uu(e,t){let n=l(e,"skillSlug")??l(e,"slug");if(!n)return{...e,syncStatus:"local_only",backendStatus:"unchecked"};try{let i=await S(t,`/api/v1/skills/${encodeURIComponent(n)}`,{headers:yt(t.apiKey)}),s=(l(i,"claimedOrigin")??l(i,"sourceKind")??l(e,"sourceKind"))==="public_source"||l(e,"sourceKind")==="external";return{...e,syncStatus:s?"source_backed":"catalog_backed",backendStatus:"found",latestAvailableVersion:l(i,"currentVersion")??l(i,"version"),catalog:Tu(i)}}catch(i){return i instanceof A&&i.status===404?{...e,syncStatus:"backend_missing",backendStatus:"not_found",selectedBackend:t.baseUrl}:{...e,syncStatus:"unchecked",backendStatus:"error",backendError:te(i)}}}function Tu(e){return _({slug:l(e,"slug")??l(e,"skillSlug"),currentVersion:l(e,"currentVersion")??l(e,"version"),claimedOrigin:l(e,"claimedOrigin"),trust:l(e,"trust")??l(e,"publicationStatus")})}function Fu(e,t){let n=re(t),i=l(e,"skillSlug")??l(e,"slug")??"skill",r=l(e,"updateStatus")??"checked",s=[`${n.ok("OK")} Update check complete.`,"",n.section("Update")];s.push(`  ${n.label("Skill")}: ${i}`),s.push(`  ${n.label("Status")}: ${r.replaceAll("_"," ")}`);let o=l(e,"installedVersion"),a=l(e,"latestAvailableVersion");o&&s.push(`  ${n.label("Installed version")}: ${o}`),a&&s.push(`  ${n.label("Latest available version")}: ${a}`);let c=C(e,"localInstall"),u=c?l(c,"materializedPath")??l(c,"path"):void 0,d=c?l(c,"scope"):void 0,g=c?l(c,"targetAgent")??l(c,"agent"):void 0;c&&(s.push("",n.section("Local Install")),d&&s.push(`  ${n.label("Scope")}: ${d}`),g&&s.push(`  ${n.label("Agent")}: ${g}`),u&&s.push(`  ${n.label("Path")}: ${u}`));let f=l(e,"nextStep");return f&&s.push("",n.section("Next"),`  ${n.arrow} ${f}`),s.join(`
-`)}function Nu(e,t){let n=re(t),i=[`${n.ok("OK")} Local install records synced.`,"",n.section(`Results (${e.results.length})`)];return e.results.length===0?(i.push(`  ${n.muted("No local install records found.")}`),i.join(`
-`)):(e.results.slice(0,O).forEach((r,s)=>{let o=l(r,"skillSlug")??l(r,"slug")??`item-${s+1}`,a=l(r,"syncStatus")??"unchecked",c=l(r,"version")??l(r,"currentVersion");i.push(`${s+1}. ${o}`),i.push(`   status: ${a.replaceAll("_"," ")}${c?`; version: ${c}`:""}`),a==="backend_missing"&&i.push(`   ${n.muted("Installed locally, but missing from the selected backend catalog.")}`)}),e.results.length>O&&i.push(`  ${n.muted(`... ${e.results.length-O} more`)}`),i.push("",n.section("Next")),i.push(`  ${n.arrow} skills-layer installed`),i.push(`  ${n.arrow} skills-layer update <skill-slug>`),i.join(`
-`))}function Mu(e,t){let n=re(t);return[`${n.ok("OK")} Removed ${e}.`,"",n.section("Local Install"),`  ${n.label("Skill")}: ${e}`,`  ${n.label("Status")}: removed locally`,"",n.section("Next"),`  ${n.arrow} skills-layer installed`,`  ${n.arrow} skills-layer sync`].join(`
-`)}function Bu(e,t,n){let i=re(n),r=l(t,"version")??l(t,"currentVersion"),s=l(t,"scope");return[`${i.ok("OK")} Restore record found for ${e}.`,"",i.section("Local Install"),`  ${i.label("Skill")}: ${e}`,...r?[`  ${i.label("Version")}: ${r}`]:[],...s?[`  ${i.label("Scope")}: ${s}`]:[],"",i.section("Next"),`  ${i.arrow} skills-layer installed`,`  ${i.arrow} skills-layer sync`,`  ${i.arrow} skills-layer update ${e}`].join(`
-`)}function Ou(e){let t=l(e,"status"),n=l(e,"reasonCode");return t==="invalid_transition"||t==="forbidden"||t==="not_found"||n==="invalid_transition"}function qu(e,t){let n=l(e,"why")??l(e,"reason")??l(e,"error"),i=l(e,"currentVisibility"),r=l(e,"nextVisibility")??l(e,"visibility"),s=i||r?` Current visibility: ${i??"unknown"}; requested visibility: ${r??"unknown"}.`:"",o=l(e,"nextStep")??`Run \`skills-layer creator status ${t}\` and choose a valid visibility transition.`;return`Visibility was not changed for ${t}.${s}${n?` ${n}`:""}
-Next step: ${o}`}async function Du(e,t,n){let i=await Le(n),r=b(e[0],"restore requires a skill slug."),s=i.installs[r];if(!s)return w({status:"missing_record",reasonCode:"restore_record_not_found",skillSlug:r,record:null,nextAction:"installed",nextStep:`Run \`skills-layer installed\` to see local records, \`skills-layer sync\` to refresh status, or \`skills-layer search ${r}\` if you want to find a catalog/source replacement.`},`No restorable local install record was found for ${r}. Run \`skills-layer installed\`, \`skills-layer sync\`, or \`skills-layer search ${r}\` next.`,t.json,"restore_record_not_found");let o={status:"restored",skillSlug:r,record:s};return t.json?h(o,`Restore checked for ${r}.`,!0,n):{exitCode:0,stdout:Bu(r,s,n),stderr:""}}async function Ku(e,t,n){let i=b(e[0],"check requires a skill slug.");return await $(`/api/v1/skills/${encodeURIComponent(i)}/trust`,t,n,"Install trust checked.",{authenticated:!!n.apiKey})}async function Vu(e,t,n){let i=b(e[0]??t.source,"import requires a source."),r=ce("import","visibility",t.visibility,qe,t,"invalid_visibility");if(r)return r;let s=await Vt(i,n.cwd);if(!s){let a=Gu(i,t);if(a)return a}let o=await S(n,"/api/v1/source-imports",{method:"POST",headers:I(n.apiKey),body:JSON.stringify(_({...s??{source:i},quarantine:t.quarantine,skillSlug:p(t.skill),visibility:p(t.visibility)}))});return await ee(n.paths.importsPath,{version:1,lastImport:o,savedAt:n.now()}),h(o,"Source import submitted.",t.json,n)}function Gu(e,t){try{return it(e).kind!=="local"?null:w({status:"error",reasonCode:"invalid_source",source:e,nextAction:"import",nextStep:Dt(e)?"Check that the local path exists and contains SKILL.md, or pass a supported GitHub/GitLab/source URL.":"Use an existing local path such as ./my-skill, a GitHub/GitLab source, or --help for import examples."},Dt(e)?`Import source ${e} was not found or is not readable.`:`Import source "${e}" is not a supported source. Use a local path, GitHub/GitLab source, or URL.`,t.json,"invalid_source")}catch(n){return w({status:"error",reasonCode:"invalid_source",source:e,error:te(n),nextAction:"import",nextStep:"Use an existing local path such as ./my-skill, a GitHub/GitLab source, or URL."},`Import source "${e}" is invalid. ${te(n)}`,t.json,"invalid_source")}}function Dt(e){return/^(?:\.{1,2}(?:[\\/]|$)|[\\/]|[A-Za-z]:[\\/])/u.test(e)}function Ws(e,t,n,i){let r=V(i.cwd,t);return w({status:"error",reasonCode:"source_path_not_found",path:r,nextAction:e,nextStep:`Check that ${t} exists and contains a readable SKILL.md, then retry.`},`${e} source path does not exist: ${r}`,n.json,"source_path_not_found")}async function Hu(e,t,n){let i=e[0];if(i==="reference"&&e[1]==="resolve"){let r=b(e[2],"source reference resolve requires a reference."),s=await S(n,`/api/v1/source-references/resolve?reference=${encodeURIComponent(r)}`);return s.status==="not_found"?w({...s,status:"not_found",reasonCode:"source_reference_not_found",reference:r,nextAction:"source.connection.start",nextStep:"Start or complete the source connection before resolving this reference."},`Source reference ${r} was not found.`,t.json,"source_reference_not_found"):h(s,"Source reference resolved.",t.json,n)}return i==="connection"?await zu(e.slice(1),t,n):k(`Unknown source command "${e.join(" ")}".`,t.json)}async function zu(e,t,n){let i=e[0];if(i==="start"){let s=p(t.provider),o=p(t.source),a=p(t.visibility),c=s?.replace(/-/gu,"_");if(c&&!Ur.includes(c))return je("source.connection.start","provider",s??"",Ur,t,"invalid_source_provider");let u=Ve(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(u.failure)return u.failure;let d=Wu(s,o,a,t);return d||await z("/api/v1/me/source-connections",Z(t,["provider","source","skill","mode","visibility","priceCents","license","provenanceIntent","discloseSource"]),t,n,"Source connection started.")}let r=b(e[1],`source connection ${i??""} requires a connection id.`);if(i==="status")return await $(`/api/v1/me/source-connections/${encodeURIComponent(r)}`,t,n,"Source connection loaded.",{authenticated:!0});if(i==="complete"){let s=cc("source.connection.complete",t);return s||await z(`/api/v1/me/source-connections/${encodeURIComponent(r)}/complete`,Z(t,["providerOwnerId","providerRepoId","providerProjectId","providerInstallationId","commitSha"]),t,n,"Source connection completed.")}return i==="cancel"?await z(`/api/v1/me/source-connections/${encodeURIComponent(r)}/cancel`,{},t,n,"Source connection cancelled."):k(`Unknown source connection command "${i??""}".`,t.json)}function Wu(e,t,n,i){if(n){let r=$t(n);if(!r||!qe.includes(r))return w({status:"error",reasonCode:"invalid_visibility",visibility:n,acceptedValues:qe,nextAction:"source.connection.start",nextStep:"Use --visibility private, public, or unlisted."},`Invalid source connection visibility "${n}". Use one of: ${qe.join(", ")}.`,i.json,"invalid_visibility")}if(!e||!t)return null;try{let r=it(t);if((e==="github"||e==="gitlab")&&r.kind!==e)return jn(e,t,i);if(e==="domain"){let s=new URL(t);if(s.protocol!=="https:"||!s.hostname)return jn(e,t,i)}}catch{return jn(e,t,i)}return null}function jn(e,t,n){return w({status:"error",reasonCode:"invalid_source",provider:e,source:t,nextAction:"source.connection.start",nextStep:e==="github"?"Use a GitHub source such as https://github.com/OWNER/REPO or github:OWNER/REPO.":e==="gitlab"?"Use a GitLab source such as https://gitlab.com/GROUP/REPO or gitlab:GROUP/REPO.":"Use a valid source URL or provider-specific source."},`Invalid ${e} source "${t}".`,n.json,"invalid_source")}async function Ju(e,t,n){if(e[0]!=="request")return k(`Unknown approval command "${e[0]??""}".`,t.json);let i=e[1];if(i!=="status"&&i!=="complete")return k("approval request requires `status <approval-request-id>` or `complete <approval-request-id> --decision <approved|denied>`.",t.json);let r=b(e[2],`approval request ${i??""} requires an approval id.`);if(i==="status")return await $(`/api/v1/me/approvals/${encodeURIComponent(r)}`,t,n,"Approval status loaded.",{authenticated:!0});let s=b(t.decision,"approval request complete requires --decision."),o=ce("approval.request.complete","decision",s,Zl,t,"invalid_decision");return o||await z(`/api/v1/me/approvals/${encodeURIComponent(r)}/complete`,_({decision:s,evidence:Xt(t.decisionEvidenceJson,"decision-evidence-json")}),t,n,"Approval completed.")}async function Yu(e,t,n){let i=e[0]??"list";if(i==="list")return await $("/api/v1/me/workspaces",t,n,"Workspaces loaded.",{authenticated:!0});if(i==="create"){let s=e.slice(1).join(" ").trim();if(!s)return k("workspace create requires a workspace name.",t.json);let o=ce("workspace.create","kind",t.kind,ec,t,"invalid_workspace_kind");if(o)return o;let a=p(t.kind);return await z("/api/v1/workspaces",{name:s,kind:a==="team"?"shared":a},t,n,"Workspace created.")}let r=b(e[1],`workspace ${i} requires a workspace id.`);if(i==="skills")try{return await $(`/api/v1/workspaces/${encodeURIComponent(r)}/skills`,t,n,"Workspace skills loaded.",{authenticated:!0})}catch(s){if(s instanceof A&&(s.status===403||s.status===404))return Ln(r,t);throw s}if(i==="deploy"){let s=b(e[2],"workspace deploy requires a skill slug."),o;try{o=await S(n,`/api/v1/workspaces/${encodeURIComponent(r)}/skills`,{method:"POST",headers:I(n.apiKey),body:JSON.stringify(_({skillSlug:s,dryRun:t.dryRun}))})}catch(a){if(a instanceof A&&(a.status===403||a.status===404))return Ln(r,t);throw a}return t.dryRun?await Gs(o,"Workspace deployment preview ready.",t,n):h(o,"Workspace deployment requested.",t.json,n)}if(i==="remove"){let s=b(e[2],"workspace remove requires a skill slug.");try{return await Yt(`/api/v1/workspaces/${encodeURIComponent(r)}/skills/${encodeURIComponent(s)}`,{method:"DELETE",headers:F(n.apiKey,n.authBlockedMessage)},t,n,"Workspace skill removed.")}catch(o){if(o instanceof A&&o.status===404)return ts(r,s,t);if(o instanceof A&&o.status===403)return Ln(r,t);throw o}}if(i==="guide"){let s=b(e[2],"workspace guide requires a skill slug.");try{return await $(`/api/v1/workspaces/${encodeURIComponent(r)}/skills/${encodeURIComponent(s)}/install-guide`,t,n,"Workspace install guide loaded.",{authenticated:!0})}catch(o){if(o instanceof A&&o.status===404)return ts(r,s,t);throw o}}return k(`Unknown workspace command "${i}".`,t.json)}function Ln(e,t){return w({status:"not_found_or_forbidden",reasonCode:"workspace_not_found_or_forbidden",workspaceId:e,nextAction:"workspace.list",nextStep:"Run `skills-layer workspace list` to find a workspace you can access, then retry with that workspace id."},`Workspace ${e} was not found or you do not have access. Run \`skills-layer workspace list\` to inspect accessible workspaces.`,t.json,"workspace_not_found_or_forbidden")}function ts(e,t,n){let i={status:"deployment_not_found",reasonCode:"workspace_deployment_not_found",workspaceId:e,skillSlug:t,nextAction:"workspace.deploy",nextStep:`Run \`skills-layer workspace deploy ${e} ${t}\` first, then run \`skills-layer workspace guide ${e} ${t}\` after the deployment exists.`};return w(i,`Workspace deployment not found for ${t}. Run \`skills-layer workspace deploy ${e} ${t}\` first.`,n.json,"workspace_deployment_not_found")}async function Zu(e,t,n){let i=b(e[0],"buy requires a skill slug."),r=gc(t);if(r.failure)return r.failure;let s=await S(n,"/api/v1/buy",{method:"POST",headers:I(n.apiKey),body:JSON.stringify({skillSlug:i,paymentMethod:r.value})});if(s.status==="already_owned")return h(s,`You already own ${i}. Run \`skills-layer install ${i}\` to install or update it.`,t.json,n);if(t.json||t.noOpen||s.status!=="checkout_required"||typeof s.checkoutUrl!="string"||typeof s.purchaseId!="string")return h(s,`Purchase flow started for ${i}.`,t.json,n);n.emitInfo(`Opening checkout for ${i}. Complete the payment in your browser, then come back here.`),await n.openUrl(s.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${s.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let a=await Ed(s.purchaseId,n);return H(a)?a:a.status!=="succeeded"&&a.status!=="refund_requested"?h({...s,purchaseStatus:a.status},`Checkout is still ${a.status} for ${i}. You can rerun install after payment reconciliation completes.`,t.json,n):(n.emitInfo("Payment confirmed. Continuing with install."),await hi([i],t,n))}async function Qu(e,t,n){let i=e[0]??"list";if(i==="list")return await $("/api/v1/purchases",t,n,"Purchases loaded.",{authenticated:!0});if(i==="spending")return await $("/api/v1/spending",t,n,"Spending loaded.",{authenticated:!0});let r=b(e[1],`purchases ${i} requires a purchase id.`);return i==="invoice"?await $(`/api/v1/purchases/${encodeURIComponent(r)}/invoice`,t,n,"Invoice loaded.",{authenticated:!0}):i==="refund-quote"?await $(`/api/v1/purchases/${encodeURIComponent(r)}/refund-quote`,t,n,"Refund quote loaded.",{authenticated:!0}):i==="refund"?await z(`/api/v1/purchases/${encodeURIComponent(r)}/refund`,Z(t,["reason"]),t,n,"Refund requested."):k(`Unknown purchases command "${i}".`,t.json)}async function Xu(e,t,n){let i=e[0];if(i==="add"){let r=b(e[1],"library add requires a skill slug.");return await z("/api/v1/install",{skillSlug:r},t,n,"Skill added to library.")}return k(`Unknown library command "${i}".`,t.json)}async function ed(e,t,n){let i=b(e[0],"export requires a skill slug.");if(t.showUrl&&p(t.output))return w({status:"error",reasonCode:"conflicting_export_output",nextAction:"export",nextStep:"Use either --show-url to inspect the signed URL or --output <file> to download the bundle, not both."},"export cannot use --show-url and --output together.",t.json,"conflicting_export_output");let r=new URLSearchParams,s=p(t.version);if(s&&!zt(s))return fi("export",s,t);q(r,"version",s);let o=await S(n,`/api/v1/me/library/${encodeURIComponent(i)}/export${ie(r)}`,{headers:F(n.apiKey,n.authBlockedMessage)}),a=p(t.output);if(a){let c=await Us({backend:n,exportResult:o,flags:t,skillSlug:i});if(H(c))return c;let u=V(n.cwd,a);await ei(u,c.bytes);let d={...o};return delete d.downloadUrl,h({...d,archiveSha256:c.archiveSha256,archiveSha256Meaning:"canonical_bundle_sha256",canonicalBundleSha256:c.archiveSha256,downloadedArchiveSha256:c.archiveBytesSha256,downloadedFileSha256:c.archiveBytesSha256,archiveHashFormat:c.archiveHashFormat,outputPath:u,downloaded:!0},`Exported ${i} to ${u}. Downloaded file SHA-256: ${c.archiveBytesSha256}.`,t.json,n)}return h(o,a?`Exported ${i} to ${a}.`:"Export prepared.",t.json,n)}async function ns(e,t,n,i){let r=b(t[0],`${e==="add"?"add-review":"show-reviews"} requires a skill slug.`);if(e==="show")return await $(`/api/v1/me/library/reviews?skillSlug=${encodeURIComponent(r)}`,n,i,"Reviews loaded.",{authenticated:!0});let s=b(n.rating,"add-review requires --rating.");if(!/^[1-5]$/u.test(s))return w({status:"error",reasonCode:"invalid_rating",rating:s,acceptedValues:["1","2","3","4","5"],nextAction:"add-review",nextStep:"Use --rating with a whole number from 1 to 5."},`Invalid review rating "${s}". Use a whole number from 1 to 5.`,n.json,"invalid_rating");let o=Z(n,["rating","feedback"]);if(typeof n.evalSummary=="string"){let a=await W(ai(i.cwd,n.evalSummary));if(a===null)return w({status:"error",reasonCode:"invalid_eval_summary_file",path:n.evalSummary,nextAction:"add-review",nextStep:"Pass --eval-summary with a readable JSON redacted eval summary envelope."},`Could not read eval summary JSON from ${n.evalSummary}.`,n.json,"invalid_eval_summary_file");o.evalSummary=a}return await z(`/api/v1/me/library/${encodeURIComponent(r)}/review`,o,n,i,"Review added.")}async function is(e,t,n,i){let r=b(t[0],`${e==="add"?"add-issue":"show-issues"} requires a skill slug.`);if(e==="show")return await $(`/api/v1/me/library/${encodeURIComponent(r)}/issues`,n,i,"Issues loaded.",{authenticated:!0});b(n.message,"add-issue requires --message.");let s=ce("add-issue","issueType",n.issueType,Yl,n,"invalid_issue_type","issue-type");return s||await z(`/api/v1/me/library/${encodeURIComponent(r)}/report-issue`,Z(n,["issueType","message"]),n,i,"Issue reported.")}async function td(e,t,n){let i=e[0];if(i==="hook"){let r=e[1];return r==="install"?await Ys(t,n):r==="status"?await sd(t,n):k(`Unknown guardian hook command "${r??""}".`,t.json)}if(i==="enable")return e[1]||t.skill?await Un("enforce",e,t,n):k("guardian enable requires a skill slug.",t.json);if(i==="disable")return await Un("disabled",e,t,n);if(i==="enable-warnings-only")return await Un("warning_only",e,t,n);if(i==="status")return await id(e,t,n);if(i==="exec")return await nd(e,t,n);if(i==="check"){let r=b(e[1]??t.skill,"guardian check requires a skill slug."),s=ds(t,"check"),o=t.grantJson.map(y=>Ai(y,"grant-json")),a=Bp(t.cloudTrustLedger);if(a.status==="invalid")return k(a.message,t.json);let c=Jn(t.telemetryMode,a.policy==="off"?"local_only":"cloud_managed");if(c.status==="invalid")return k(c.message,t.json);let u=await Qs({skillSlug:r,version:p(t.version),action:s,flags:t,backend:n,telemetryMode:c.mode});if(u.status!=="ok")return u.result;let d=u.context.installedPath,g=p(t.version)??u.context.version,f=_({skillSlug:r,version:g,action:s,authorizationGrants:o,path:d,guardianPreference:await bi(n,r),unmanagedPolicy:u.context.unmanagedPolicy,allowUnmanagedOnce:t.allowUnmanagedOnce,telemetryMode:c.mode,localPreflight:Ie(u.context)}),m=await S(n,"/api/v1/guardian/enforce",{method:"POST",headers:I(n.apiKey),body:JSON.stringify(f)});return await dt(n,{skillSlug:r,version:g,action:s,decisionStatus:Kt(m),reasonCode:Yn(m),telemetryMode:c.mode,path:d}),h({...m,localPreflight:Ie(u.context)},"Guardian check complete.",t.json,n)}if(i==="incident"){let r=b(e[1]??t.skill,"guardian incident requires a skill slug."),s=b(t.version,"guardian incident requires --version."),o=Jn(t.telemetryMode,"cloud_managed");if(o.status==="invalid")return k(o.message,t.json);let a=p(t.path);if(a&&!await me(V(n.cwd,a)))return w({status:"error",reasonCode:"invalid_incident_path",path:a,nextAction:"guardian.incident",nextStep:"Use --path with an installed skill directory, or omit --path so Skills Layer resolves the local install record."},`Guardian incident path does not exist: ${a}`,t.json,"invalid_incident_path");let c=a??(await Xs({skillSlug:r,flags:t,backend:n})).installedPath,u=ds(t,"incident"),d=Xt(t.evidenceJson,"evidence-json"),g=o.mode==="cloud_managed"&&!n.apiKey?"local_only":o.mode,f=_({skillSlug:r,version:s,action:u,evidence:d,path:c,telemetryMode:g,incident:!0,reason:p(t.reason)});if(g==="local_only"){if(!c)return k("guardian incident --telemetry-mode local_only requires --path <installed-skill-path>.",t.json);let P=await ls({backend:n,skillSlug:r,version:s,installedPath:c,action:u,reason:p(t.reason)??"Guardian local-only incident"});await dt(n,{skillSlug:r,version:s,action:u,decisionStatus:"blocked",reasonCode:"incident_recorded",telemetryMode:g,path:c});let R=cs(n,r);return await ge(R,JSON.stringify({request:f,response:null,localResponse:P,savedAt:n.now()},null,2)),h({status:"written",skillSlug:r,version:s,telemetryMode:g,cloudTelemetry:n.apiKey?"not_requested":"login_required",localResponse:P,incidentStatePath:R,incidentPath:P.incidentPath},n.apiKey?"Guardian incident recorded locally.":"Guardian incident recorded locally. Log in to submit Cloud incident evidence.",t.json,n)}let m=await S(n,"/api/v1/guardian/enforce",{method:"POST",headers:I(n.apiKey),body:JSON.stringify(f)}),y=c?await ls({backend:n,skillSlug:r,version:s,installedPath:c,action:u,reason:p(t.reason)??"Guardian Cloud-managed incident"}):null;await ft(n.paths.incidentsDir,{recursive:!0});let v=cs(n,r);return await ge(v,JSON.stringify({request:f,response:m,localResponse:y,savedAt:n.now()},null,2)),await dt(n,{skillSlug:r,version:s,action:u,decisionStatus:Kt(m),reasonCode:Yn(m),telemetryMode:o.mode,path:c}),h({...m,telemetryMode:o.mode,localResponse:y,incidentPath:v},"Guardian incident recorded.",t.json,n)}return k(`Unknown guardian command "${i??""}".`,t.json)}async function nd(e,t,n){let i=p(t.skill),r=b(i??e[1],"guardian exec requires a skill slug."),s=i?e.slice(1):e.slice(2);if(s.length===0)return k("guardian exec requires a command after --.",t.json);let o=Jn(t.telemetryMode,"cloud_managed");if(o.status==="invalid")return k(o.message,t.json);let a=gd(t,s),c=await Qs({skillSlug:r,version:p(t.version),action:a,flags:t,backend:n,telemetryMode:o.mode});if(c.status!=="ok")return c.result;let u=c.context.installedPath,d=p(t.version)??c.context.version,g=_({skillSlug:r,version:d,action:a,authorizationGrants:t.grantJson.map(P=>Ai(P,"grant-json")),path:u,guardianPreference:await bi(n,r),telemetryMode:o.mode,localPreflight:Ie(c.context)}),f=await S(n,"/api/v1/guardian/enforce",{method:"POST",headers:I(n.apiKey),body:JSON.stringify(g)}),m=Kt(f),y=Yn(f);if(await dt(n,{skillSlug:r,version:d,action:a,decisionStatus:m,reasonCode:y,telemetryMode:o.mode,path:u}),!md(f))return w({status:"blocked",reasonCode:y,skillSlug:r,guardian:f,localPreflight:Ie(c.context),command:{executable:D(s[0]??""),executed:!1}},"Guardian blocked guarded execution.",t.json,y);if(t.dryRun)return h({status:"allowed",skillSlug:r,guardian:f,localPreflight:Ie(c.context),command:{executable:D(s[0]??""),executed:!1,dryRun:!0}},"Guardian guarded execution allowed.",t.json,n);let v=await fd(s,n);return{exitCode:v.exitCode,stdout:t.json?JSON.stringify({status:v.exitCode===0?"executed":"command_failed",summary:"Guardian guarded execution complete.",why:null,nextAction:null,nextStep:null,data:{skillSlug:r,guardian:f,localPreflight:Ie(c.context),command:v},warnings:[],links:[],reasonCode:v.exitCode===0?null:"command_failed",handoff:null},null,2):hd(v),stderr:v.stderr}}async function Un(e,t,n,i){let r=b(t[1]??n.skill,`guardian ${t[0]??"mode"} requires a skill slug.`),s=await S(i,"/api/v1/guardian/mode",{method:"POST",headers:I(i.apiKey),body:JSON.stringify({skillSlug:r,requestedPreference:e,source:"public-cli"})});return s.preferenceAccepted===!0&&await yd(i,r,s),h(s,s.preferenceAccepted===!0?"Guardian mode updated.":"Guardian mode resolved by policy.",n.json,i)}async function id(e,t,n){let i=p(t.skill)??p(e[1]),r;try{r=await Js(n,i)}catch(d){r={status:"unavailable",skillSlug:i,policySource:"cloud",reasonCode:"guardian_policy_status_unavailable",message:te(d),nextAction:"guardian.status",nextStep:"Cloud Guardian policy could not be loaded. Local hook and preference posture are still shown below."}}let s=await We(n),o=i?await kd(n,i):void 0,a=l(r,"status")==="unavailable",u=l(s,"enforcementLayer")!=="not_installed"&&!!s.strictPreActionBlocking?{status:"installed",reasonCode:"guardian_hook_installed",strictPreActionBlocking:!0,nextAction:"guardian.check",nextStep:"Cloud Guardian policy is enforced when checked, and the local host hook can block supported risky actions before execution."}:{status:"not_installed",reasonCode:"guardian_hook_not_installed",strictPreActionBlocking:!1,nextAction:"guardian.hook.install",nextStep:"Cloud Guardian policy is enforced when checked, but local pre-action blocking is not installed for this host. Run `skills-layer guardian hook install --agent codex --scope global` or `skills-layer setup`."};return h(_({status:a?"degraded":"ok",skillSlug:l(r,"skillSlug")??i,policy:r,localPreference:o,hook:s,cloudPolicy:{status:l(r,"effectiveMode")??l(r,"status")??"unknown",reasonCode:l(r,"reasonCode"),enforcementBoundary:"cloud_policy_when_checked",nextAction:l(r,"nextAction"),nextStep:l(r,"nextStep")},localEnforcement:u,nextAction:l(u,"nextAction"),nextStep:l(u,"nextStep")}),a?"Guardian status loaded with limited Cloud policy data.":"Guardian status loaded.",t.json,n)}async function Js(e,t){let n=t?await bi(e,t):void 0;return await S(e,"/api/v1/guardian/status",{method:"POST",headers:I(e.apiKey),body:JSON.stringify(_({skillSlug:t,requestedPreference:n,source:"public-cli"}))})}async function rd(e){if(!e.apiKey)return{status:"unknown",policySource:"cloud",reasonCode:"login_required",nextAction:"skills-layer login",nextStep:"Sign in to read the Cloud Guardian policy that applies to your account."};try{return await Js(e)}catch(t){return{status:"unavailable",policySource:"cloud",reasonCode:"guardian_policy_status_unavailable",message:te(t),nextAction:"skills-layer guardian status",nextStep:"Retry Guardian status after backend connectivity or authentication is healthy."}}}async function Ys(e,t){let n=p(e.agent)??"codex",i=to(e.scope);if(i.status==="invalid")return k(i.message,e.json);let r=Pe(t.env,t.platform,t.cwd).find(g=>g.id===n);if(!r)return w({status:"error",reasonCode:"unknown_agent",agent:n,nextAction:"agents.list",nextStep:"Run `skills-layer agents list` to see supported agents, then retry Guardian hook install with a supported --agent value."},`Unsupported Guardian agent "${n}". Run skills-layer agents list to see supported agents.`,e.json,"unknown_agent");let s=wd(r,i.scope,t);if(!s)return k(`Guardian ${i.scope} hooks are not available for ${r.displayName}.`,e.json);await vd(s,t);let o=ro(t,i.scope),a=us(Ke(t.cwd,s.hookPath)),c=us(Ke(t.cwd,s.configPath)),d=[...(await so(o)).hooks.filter(g=>l(g,"agent")!==r.id||l(g,"scope")!==i.scope),{hookId:be,hookName:le,agent:r.id,agentName:r.displayName,scope:i.scope,hookPath:a.startsWith("..")?s.hookPath:a,configPath:c.startsWith("..")?s.configPath:c,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,enabledAt:t.now()}];return await ee(o,{version:1,hooks:d}),h({status:"enabled",hookId:be,hookName:le,agent:r.id,agentName:r.displayName,scope:i.scope,hookPath:s.hookPath,configPath:s.configPath,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,agentCommandMatrix:vn({purpose:"materialize_skill",command:"skills-layer install <skill-slug>",jsonCommand:"skills-layer install <skill-slug> --json"}),nextStep:"Guardian is installed into the selected host configuration. Local hooks call `skills-layer guardian check`; shell agents can route risky commands through `skills-layer guardian exec`; MCP-capable agents can call `guardian.check` or `guardian.enforce` before risky tool use.",warnings:s.enforcementLayer==="native_hook_candidate"?["This host does not expose the same stable native hook contract as Codex or Claude Code yet; Skills Layer records the guardrail config for host integration."]:[]},"Guardian hook enabled.",e.json,t)}async function sd(e,t){let n=p(e.scope),i=n?to(n):null;if(i?.status==="invalid")return k(i.message,e.json);let r=await We(t,i?.status==="valid"?i.scope:void 0);return h(r,"Guardian status loaded.",e.json,t)}async function We(e,t){let n=t?[t]:["project","global"],i=[];for(let a of n){let c=ro(e,a),u=await so(c);for(let d of u.hooks){let g=l(d,"hookPath"),f=g?as(e,a,g):null,m=l(d,"configPath"),y=m?as(e,a,m):null,v=f?await me(f):!1,P=y?await me(y):null,R=v?P===!1?"active_missing_config":"active":"stale_missing_hook";i.push({hookId:l(d,"hookId")??be,hookName:l(d,"hookName")??le,...d,scope:l(d,"scope")??a,hookPath:f??g??null,configPath:y??m??null,active:v,configActive:P,hookState:R})}}let r=i.filter(a=>a.active===!0).length,s=i.filter(a=>a.active===!1).length,o=r>0?0:s;return{status:"ok",enforcementLayer:r>0?"native_hook":"not_installed",strictPreActionBlocking:i.some(a=>a.active===!0&&a.strictPreActionBlocking===!0),activeHookCount:r,missingHookCount:o,staleHookCount:s,hooks:i,setup:await Si(e),warnings:s>0?r>0?["One or more stale Guardian hook records were found, but an active Skills Layer Security Hook is installed."]:["One or more configured Guardian hooks are missing from disk. Run skills-layer guardian hook install --agent <agent> again to repair them."]:[]}}async function Zs(e,t){if(e.json){let u=await W(t.paths.mcpConfigPath);return h({setup:await Si(t),mcp:{status:u?"mcp_configured":"mcp_not_configured",configured:!!u,clientId:u?l(u,"clientId")??"codex":void 0,clientIds:u&&Array.isArray(u.clientIds)?u.clientIds:void 0,mcpUrl:u?l(u,"mcpUrl"):void 0,readiness:u?{status:"configured_needs_agent_reload",verifyCommand:`skills-layer mcp verify --client ${l(u,"clientId")??"codex"}`,nextStep:"Open a fresh agent session if Skills Layer tools are not visible yet."}:void 0,nextCommand:u?"skills-layer mcp verify":"skills-layer mcp setup"},guardian:await We(t)},"Setup status loaded.",!0,t)}if(!t.stdoutIsTty)return h({status:"setup_needs_terminal",mcp:{nextCommand:"skills-layer mcp setup"},security:{nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Setup needs an interactive terminal. Run `skills-layer setup`, or use `skills-layer mcp setup` and `skills-layer guardian hook install --agent codex --scope project`.",!1,t);let n=await t.promptSelect("Set up Skills Layer on this machine?",[{value:"mcp",label:"Setup Skills-Layer MCP",description:"Configure Skills Layer MCP for AI tools"},{value:"security",label:"Setup Skills-Layer Security Guardian",description:"Install Guardian hooks for this workspace"},{value:"both",label:"Setup both - MCP & Security Guardian",description:"Connect supported AI tools and install Guardian hooks"},{value:"not_now",label:"Remind me Later",description:"Skip setup for now; you can run skills-layer setup later"}]);if(n==="not_now"){let u={version:1,setupChoice:"not_now",mcpChoice:"not_now",mcpPromptedAt:t.now(),guardianHookChoice:"not_now",guardianHookPromptedAt:t.now(),remindAfter:ld(t.now(),7)};return await os(t,u),h({status:"setup_skipped",mcp:{status:"not_configured",nextCommand:"skills-layer mcp setup"},security:{status:"not_configured",nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Skills Layer setup skipped for now. Run `skills-layer setup` when you want MCP and Security hooks on this machine.",!1,t)}if(n!=="both"&&n!=="mcp"&&n!=="security")return k(`Unknown setup option "${n}".`,e.json);let i=n==="both"||n==="mcp",r=n==="both"||n==="security",s={status:"setup_complete",setupChoice:n},o={version:1,setupChoice:n,mcpChoice:i?"configured":"not_requested",mcpPromptedAt:t.now(),guardianHookChoice:r?p(e.scope)??"project":"not_requested",guardianHookPromptedAt:t.now()};if(i)if(!t.apiKey)s.mcp={status:"login_required",configured:!1,nextCommand:"skills-layer login"},o.mcpChoice="login_required";else{let u=await gi(e,t);if(H(u))return u;s.mcp=u}if(r){let u={...e,json:!0,scope:p(e.scope)??"project",agent:p(e.agent)??"codex"},d=await Ys(u,t);if(d.exitCode!==0)return d;s.security=Rd(d.stdout)??{status:"enabled",agent:p(u.agent),scope:p(u.scope)}}await os(t,o);let c=(x(s.mcp)?l(s.mcp,"status"):void 0)==="login_required"?"Skills Layer Security setup complete. MCP setup needs login; run `skills-layer login`, then `skills-layer setup`.":"Skills Layer setup complete. Open a fresh agent session if MCP tools are not visible yet.";return h(s,c,e.json,t)}async function od(e,t){let n=await We(t),i=await Si(t),r=T(n,"activeHookCount")??0;if(t.stdoutIsTty&&r===0&&!i)return await Zs(e,t);let s=r>0?"Guardian host hooks are already configured. Run `skills-layer guardian hook status` to inspect them.":"Guardian is enabled for Skills Layer runtime checks. Run `skills-layer setup` when you want MCP and Security hooks on this machine.";return{exitCode:0,stdout:`${ot}
-
-${s}`,stderr:""}}function ad(e,t){let n=T(e,"activeHookCount")??0,i=T(e,"missingHookCount")??0,r=l(t,"status")??"unknown",s=l(t,"effectiveMode"),o=l(t,"adminPolicy"),a=l(t,"nextAction"),c=l(t,"nextStep");return n>0&&i===0?{id:"guardian-local-hook",title:"Guardian local hook",status:"pass",summary:`Guardian native hook active count: ${n}.`,enforcementLayer:l(e,"enforcementLayer")??"native_hook",strictPreActionBlocking:e.strictPreActionBlocking===!0,policyStatus:r,adminPolicy:o,effectiveMode:s,policyNextAction:a,policyNextStep:c,recommendedCommand:"skills-layer guardian hook status"}:{id:"guardian-local-hook",title:"Guardian local hook",status:"warn",summary:`Guardian native hook setup needs attention. Active hooks: ${n}; missing hooks: ${i}.`,enforcementLayer:l(e,"enforcementLayer")??"not_installed",strictPreActionBlocking:e.strictPreActionBlocking===!0,policyStatus:r,adminPolicy:o,effectiveMode:s,policyNextAction:a,policyNextStep:c,recommendedCommand:"skills-layer guardian hook install --agent codex --scope project",nextStep:"Install a Guardian host hook for automatic checks, or route risky shell actions through `skills-layer guardian exec` for strict pre-execution blocking."}}function ld(e,t){let n=new Date(e);return Number.isNaN(n.getTime())?e:(n.setUTCDate(n.getUTCDate()+t),n.toISOString())}async function Qs(e){let t=eo(p(e.flags.unmanagedPolicy)??e.backend.env.SKILLS_LAYER_UNMANAGED_SKILL_POLICY);if(t.status==="invalid")return{status:"invalid",result:k(t.message,e.flags.json)};let n=await Xs({skillSlug:e.skillSlug,flags:e.flags,backend:e.backend,unmanagedPolicy:t.policy});if(n.unmanaged&&n.unmanagedPolicy==="block")return Ut({...e,context:n,reasonCode:"unmanaged_skill_blocked",message:"Guardian blocked unmanaged local skill execution.",why:"The skill path is not backed by a public install index or lockfile entry and unmanaged policy is block.",nextStep:"Install the skill with `skills-layer install <path>` or choose --unmanaged-policy warn/allow for a one-off diagnostic check."});if(!n.installedPath)return{status:"ok",context:n};if(await _d(n.installedPath))return Ut({...e,context:n,reasonCode:"skill_disabled",message:"Guardian blocked the action because this local skill is disabled.",why:"A local Guardian incident marker is present for this skill.",nextAction:"guardian.incident.review",nextStep:"Review the local incident report before running this skill again."});if(n.unmanaged)return{status:"ok",context:n};let i=await dd(e.skillSlug,n.installedPath);if(n.identityAssessment=i,i.reattestationRequired===!0)return Ut({...e,context:n,reasonCode:l(i,"reasonCode")??"skill_identity_mismatch",message:"Guardian blocked the action because the installed skill identity changed.",why:"The visible SKILL.md identity no longer matches the installed skill record.",nextStep:"Reinstall or re-attest the skill before running it again."});let r=await pd(e.skillSlug,n.installedPath);return n.driftAssessment=r,r.reattestationRequired===!0?Ut({...e,context:n,reasonCode:l(r,"reasonCode")??"installed_artifact_changed",message:"Guardian blocked the action because local runtime metadata detected installed artifact drift.",why:"The installed SKILL.md hash no longer matches the materialized runtime metadata.",nextStep:"Reinstall or re-attest the skill before running it again."}):{status:"ok",context:n}}async function Ut(e){return await dt(e.backend,{skillSlug:e.skillSlug,version:e.version??e.context.version,action:e.action,decisionStatus:"blocked",reasonCode:e.reasonCode,telemetryMode:e.telemetryMode,path:e.context.installedPath}),{status:"blocked",result:w({status:"blocked",skillSlug:e.skillSlug,version:e.version??e.context.version,reasonCode:e.reasonCode,localPreflight:Ie(e.context),unmanaged:e.context.unmanaged,unmanagedPolicy:e.context.unmanagedPolicy,allowUnmanagedOnce:e.context.allowUnmanagedOnce,why:e.why,nextAction:e.nextAction,nextStep:e.nextStep},e.message,e.flags.json,e.reasonCode)}}async function Xs(e){let t=eo(p(e.flags.unmanagedPolicy)),n=e.unmanagedPolicy??(t.status==="valid"?t.policy:"warn"),i=p(e.flags.path),r=await cd(e.skillSlug,e.backend),s=i?V(e.backend.cwd,i):r?.installedPath;return{source:i?"explicit_path":r?.source??"install_index",status:i?"ok":r?.status,reasonCode:i?void 0:r?.reasonCode,installedPath:s,archivePath:i?void 0:r?.archivePath,installedPathSource:i?"explicit_path":r?.installedPathSource,version:p(e.flags.version)??r?.version,record:r?.record,unmanaged:!!(i&&!r),unmanagedPolicy:n,allowUnmanagedOnce:e.flags.allowUnmanagedOnce}}async function cd(e,t){let i=(await Le(t)).installs[e];if(i){let r=rs(i,t);return{source:"install_index",installedPath:r.installedPath,archivePath:r.archivePath,installedPathSource:r.installedPathSource,status:r.status,reasonCode:r.reasonCode,version:l(i,"version"),record:i}}for(let r of ud(t)){let s=await W(r);if(!x(s)||!x(s.installs))continue;let o=s.installs[e];if(x(o)){let a=rs(o,t);return{source:"lockfile",installedPath:a.installedPath,archivePath:a.archivePath,installedPathSource:a.installedPathSource,status:a.status,reasonCode:a.reasonCode,version:l(o,"version"),record:o}}}return null}function ud(e){return Array.from(new Set([U(e.cwd,"skills-layer-lock.json"),U(e.paths.stateDir,"skills-layer-lock.json")]))}function rs(e,t){let n=l(e,"materializedSkillRoot");if(n)return{installedPath:Tt(V(t.cwd,n)),installedPathSource:"materializedSkillRoot",status:"ok"};let i=l(e,"canonicalPath");if(i)return{installedPath:Tt(V(t.cwd,i)),installedPathSource:"canonicalPath",status:"ok"};let r=l(e,"path");if(r)return{installedPath:Tt(V(t.cwd,r)),installedPathSource:"path",status:"ok"};let s=l(e,"materializedPath")??l(e,"bundlePath");if(s){let u=V(t.cwd,s),d=D(u).toLowerCase()==="bundle.zip"||u.toLowerCase().endsWith(".zip");return{installedPath:d?ae(ae(u)):Tt(u),archivePath:d?u:void 0,installedPathSource:l(e,"materializedPath")?"materializedPath":"bundlePath",status:d?"degraded":"ok",reasonCode:d?"installed_skill_root_missing":void 0}}let a=(Array.isArray(e.materializedWrites)?e.materializedWrites.filter(x):[]).find(u=>{let d=l(u,"path");return d?.toLowerCase().endsWith("/skill.md")||d?.toLowerCase()==="skill.md"}),c=a?l(a,"path"):void 0;return{installedPath:c?ae(V(t.cwd,c)):void 0,installedPathSource:c?"materializedWrites":void 0,status:c?"ok":void 0}}function Tt(e){return D(e).toLowerCase()==="skill.md"?ae(e):e}async function dd(e,t){let n=U(t,"SKILL.md");if(!await me(n))return{status:"not_checked",reasonCode:"skill_document_unavailable",expectedSkillSlug:e,reattestationRequired:!1};try{let i=Ns(await He(n,"utf8"));return i?i!==e?{status:"mismatch",reasonCode:"skill_identity_mismatch",expectedSkillSlug:e,observedSkillName:i,skillDocumentPath:n,reattestationRequired:!0}:{status:"matched",expectedSkillSlug:e,observedSkillName:i,skillDocumentPath:n,reattestationRequired:!1}:{status:"not_checked",reasonCode:"skill_identity_metadata_unavailable",expectedSkillSlug:e,skillDocumentPath:n,reattestationRequired:!1}}catch(i){return{status:"invalid",reasonCode:"skill_identity_unreadable",expectedSkillSlug:e,skillDocumentPath:n,message:te(i),reattestationRequired:!0}}}async function pd(e,t){let n=U(t,".skills-layer-runtime.json"),i=await W(n),r=i?C(i,"materialization"):void 0,s=r?l(r,"skillDocumentSha256"):void 0;if(!i||!s)return{status:"not_checked",reasonCode:"runtime_metadata_unavailable",skillSlug:e,reattestationRequired:!1};let o=U(t,"SKILL.md");if(!await me(o))return{status:"changed",reasonCode:"installed_artifact_changed",skillSlug:e,expectedSkillDocumentSha256:s,reattestationRequired:!0};let a=lo(await He(o,"utf8")),c=a===s;return{status:c?"unchanged":"changed",reasonCode:c?"installed_artifact_matches":"installed_artifact_changed",skillSlug:e,expectedSkillDocumentSha256:s,observedSkillDocumentSha256:a,reattestationRequired:!c}}function Ie(e){return _({source:e.source,status:e.status,reasonCode:e.reasonCode,installedPath:e.installedPath,archivePath:e.archivePath,installedPathSource:e.installedPathSource,version:e.version,unmanaged:e.unmanaged,unmanagedPolicy:e.unmanagedPolicy,allowUnmanagedOnce:e.allowUnmanagedOnce,identityAssessment:e.identityAssessment,driftAssessment:e.driftAssessment})}function eo(e){if(e===void 0||e.trim()==="")return{status:"valid",policy:"warn"};let t=e.trim().toLowerCase();return t==="allow"||t==="warn"||t==="block"?{status:"valid",policy:t}:{status:"invalid",message:"guardian check --unmanaged-policy must be one of: allow, warn, block."}}function Jn(e,t){let n=p(e)??t;return n==="cloud_managed"||n==="local_only"?{status:"valid",mode:n}:{status:"invalid",message:"guardian --telemetry-mode must be one of: cloud_managed, local_only."}}function gd(e,t){let n=Xt(e.actionJson,"action-json");return n&&typeof n=="object"&&!Array.isArray(n)?n:{type:"shell_command",command:D(t[0]??"command")}}function md(e){let t=C(e,"enforcement");return typeof t?.canExecute=="boolean"?t.canExecute:Kt(e)!=="blocked"}async function fd(e,t){let[n,...i]=e;return await new Promise((r,s)=>{let o=ks(n,i,{cwd:t.cwd,env:{...process.env,...t.env},stdio:["ignore","pipe","pipe"]}),a="",c="";o.stdout?.setEncoding("utf8"),o.stderr?.setEncoding("utf8"),o.stdout?.on("data",u=>{a=ss(`${a}${u}`)}),o.stderr?.on("data",u=>{c=ss(`${c}${u}`)}),o.on("error",s),o.on("close",u=>{r({executable:D(n),argsCount:i.length,exitCode:typeof u=="number"?u:1,stdout:a,stderr:c})})})}function ss(e){return e.length>2e4?`${e.slice(0,2e4)}
-[output truncated]`:e}function hd(e){let t=[e.exitCode===0?"OK Guardian guarded execution complete.":"Guardian guarded execution finished with a command error.","","Command",`  executable: ${e.executable}`,`  args count: ${e.argsCount}`,`  exit code: ${e.exitCode}`];return e.stdout&&t.push("","Stdout",e.stdout),e.stderr&&t.push("","Stderr",e.stderr),t.join(`
-`)}function to(e){let t=p(e)??"project";return t==="project"||t==="global"?{status:"valid",scope:t}:{status:"invalid",message:"guardian hooks --scope must be one of: project, global."}}function no(e){return U(e.paths.stateDir,"guardian-modes.json")}function io(e){return U(e.paths.stateDir,"setup-state.json")}async function vi(e){let t=await W(no(e));return{version:1,skills:x(t?.skills)?t.skills:{}}}async function yd(e,t,n){let i=await vi(e);await ee(no(e),{version:1,skills:{...i.skills,[t]:{requestedPreference:l(n,"requestedPreference")??"enforce",effectiveMode:l(n,"effectiveMode")??"enforce",reasonCode:l(n,"reasonCode"),auditId:l(n,"auditId"),updatedAt:e.now()}}})}async function bi(e,t){let i=(await vi(e)).skills[t];return i?l(i,"requestedPreference"):void 0}async function kd(e,t){return(await vi(e)).skills[t]}async function Si(e){let t=await W(io(e));return x(t)?{version:1,setupChoice:l(t,"setupChoice"),mcpChoice:l(t,"mcpChoice"),mcpPromptedAt:l(t,"mcpPromptedAt"),guardianHookChoice:l(t,"guardianHookChoice"),guardianHookPromptedAt:l(t,"guardianHookPromptedAt"),remindAfter:l(t,"remindAfter")}:null}async function os(e,t){await ee(io(e),t)}function wd(e,t,n){let i=t==="global"?e.targets.globalRoot:e.targets.projectRoot;return i?e.id==="codex"?{agent:e.id,agentName:e.displayName,scope:t,hookId:be,hookName:le,configPath:U(i,"hooks.json"),hookPath:U(i,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook",strictPreActionBlocking:!0}:e.id==="claude-code"?{agent:e.id,agentName:e.displayName,scope:t,hookId:be,hookName:le,configPath:U(i,"settings.json"),hookPath:U(i,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook",strictPreActionBlocking:!0}:e.id==="cline"?{agent:e.id,agentName:e.displayName,scope:t,hookId:be,hookName:le,configPath:U(i,"guardian-hooks.json"),hookPath:U(i,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook_candidate",strictPreActionBlocking:!1}:null:null}async function vd(e,t){if(await ge(e.hookPath,Cd(e.agentName)),await vs(e.hookPath,448).catch(()=>{}),e.agent==="codex"){await ee(e.configPath,bd(e.hookPath));return}if(e.agent==="claude-code"){await ee(e.configPath,Sd(e.hookPath));return}e.agent==="cline"&&await ee(e.configPath,Pd(e,t))}function ro(e,t){return t==="global"?U(e.paths.stateDir,"guardian-hooks.json"):U(e.cwd,".skills-layer","guardian-hooks.json")}async function so(e){let t=await W(e);return{version:1,hooks:Array.isArray(t?.hooks)?t.hooks.filter(x):[]}}function as(e,t,n){return ze.isAbsolute(n)||n.startsWith("/")?n:ai(t==="global"?e.paths.stateDir:e.cwd,n)}function bd(e){return{hooks:{PreToolUse:[{name:le,id:be,matcher:"Bash|Shell|Read|Write|Edit|apply_patch|mcp__.*",hooks:[{name:le,type:"command",command:`node ${Pi(e)}`}]}]}}}function Sd(e){return{hooks:{PreToolUse:[{name:le,id:be,matcher:"Bash|Read|Write|Edit|MultiEdit|NotebookEdit|WebFetch|WebSearch",hooks:[{name:le,type:"command",command:`node ${Pi(e)}`}]}]}}}function Pd(e,t){return{version:1,hookId:be,hookName:le,agent:e.agent,agentName:e.agentName,scope:e.scope,enforcementLayer:e.enforcementLayer,strictPreActionBlocking:e.strictPreActionBlocking,installedAt:t.now(),hooks:[{name:le,id:be,event:"PreToolUse",command:`node ${Pi(e.hookPath)}`,status:"candidate"}]}}function Cd(e){return`#!/usr/bin/env node
+  skills-layer api-key revoke --key-id <key-id>`,t.json,"missing_required_argument");let s=String(r);if(t.dryRun){let o=await vh(s,n);return o?b(B({status:"pass",wouldRevoke:!0,keyId:s,keyPrefix:u(o,"keyPrefix"),type:u(o,"type"),name:u(o,"name"),scopes:at(o,"scopes")??[],revokedAt:o.revokedAt??null,nextAction:"api-key.revoke",nextStep:`Run \`skills-layer api-key revoke --key-id ${s} --yes\` to revoke this key.`}),"API key revoke dry run passed.",t.json,n):bh(s,t)}if(!t.confirmed){let o=await vh(s,n);if(!o)return bh(s,t);let l=B({status:"confirmation_required",reasonCode:"confirmation_required",keyId:s,keyPrefix:u(o,"keyPrefix"),type:u(o,"type"),name:u(o,"name"),nextAction:"api-key.revoke",nextStep:`Re-run with \`skills-layer api-key revoke --key-id ${s} --yes\` after confirming this is the key to revoke.`});if(t.json||!n.stdoutIsTty)return P(l,"API key revoke needs confirmation. Re-run with --yes after checking the key id.",t.json,"confirmation_required");if(await n.promptSelect(`Revoke API key ${s}?`,[{value:"cancel",label:"Cancel",description:"Leave this API key active"},{value:"confirm",label:"Revoke",description:"Permanently revoke this API key"}])!=="confirm")return b({status:"canceled",keyId:s},"API key revoke canceled.",t.json,n)}let a=await C(n,`/api/v1/me/api-keys/${encodeURIComponent(s)}/revoke`,{method:"POST",headers:V(n.apiKey,n.authBlockedMessage)});return b(a,"API key revoked.",t.json,n)}return _(`Unknown api-key command "${i}".`,t.json)}function Ix(e){let t=k(e.type);if(t&&!Eh.includes(t))return{failure:Wt("api-key.list","type",t,Eh,e,"invalid_api_key_filter","type")};let n=k(e.status)??"active";if(!xh.includes(n))return{failure:Wt("api-key.list","status",n,xh,e,"invalid_api_key_filter","status")};let i=k(e.sort)??"created-desc";if(!Ih.includes(i))return{failure:Wt("api-key.list","sort",i,Ih,e,"invalid_api_key_filter","sort")};let r=[["createdAfter","created-after",e.createdAfter],["createdBefore","created-before",e.createdBefore],["expiresAfter","expires-after",e.expiresAfter],["expiresBefore","expires-before",e.expiresBefore]],s={status:n,sort:i};for(let[a,o,l]of r){let c=k(l);if(c){if(Number.isNaN(Date.parse(c)))return{failure:P({status:"error",reasonCode:"invalid_api_key_filter",field:o,value:c,nextAction:"api-key.list",nextStep:`Use --${o} with an ISO date or timestamp.`},`Invalid api-key list --${o} "${c}". Use an ISO date or timestamp.`,e.json,"invalid_api_key_filter")};s[a]=c}}return{filters:B({...s,...t?{type:t}:{},...k(e.name)?{name:k(e.name)}:{}})}}function Mc(e){return(He(e,"results")??[]).filter(t=>L(t))}function Tx(e,t,n){let i=t.name?.toLowerCase();return e.filter(r=>!t.type||u(r,"type")===t.type).filter(r=>t.status==="all"||wy(r,n)===t.status).filter(r=>!i||(u(r,"name")??u(r,"id")??"").toLowerCase().includes(i)).filter(r=>ua(r,"createdAt",t.createdAfter,"after")).filter(r=>ua(r,"createdAt",t.createdBefore,"before")).filter(r=>ua(r,"expiresAt",t.expiresAfter,"after")).filter(r=>ua(r,"expiresAt",t.expiresBefore,"before")).sort((r,s)=>$x(r,s,t.sort))}function wy(e,t=Date.now()){if(e.revokedAt!==null&&e.revokedAt!==void 0)return"revoked";let n=u(e,"expiresAt");if(!n)return"active";let i=Date.parse(n);return Number.isNaN(i)||i>t?"active":"expired"}function ua(e,t,n,i){if(!n)return!0;let r=u(e,t);if(!r)return!1;let s=Date.parse(r),a=Date.parse(n);return Number.isNaN(s)||Number.isNaN(a)?!1:i==="after"?s>=a:s<=a}function $x(e,t,n){if(n==="name-asc"||n==="name-desc")return(n==="name-asc"?1:-1)*(u(e,"name")??u(e,"id")??"").localeCompare(u(t,"name")??u(t,"id")??"");let i=n.endsWith("-asc")?1:-1,r=n.startsWith("expires-")?"expiresAt":n.startsWith("last-used-")?"lastUsedAt":"createdAt";return i*(wh(e,r)-wh(t,r))}function wh(e,t){let n=u(e,t);if(!n)return 0;let i=Date.parse(n);return Number.isNaN(i)?0:i}function Lx(e,t){if(!e)return;let n=/^(\d+)d$/iu.exec(e.trim());if(!n)return;let i=Date.parse(t),r=Number.isNaN(i)?Date.now():i;return new Date(r+Number.parseInt(n[1],10)*24*60*60*1e3).toISOString()}async function vh(e,t){let n=await C(t,"/api/v1/me/api-keys",{headers:V(t.apiKey,t.authBlockedMessage)});return Mc(n).find(i=>u(i,"id")===e)}function bh(e,t){return P({status:"not_found",reasonCode:"api_key_not_found",keyId:e,nextAction:"api-key.list",nextStep:"Run `skills-layer api-key list` to find an active key id, then retry revoke."},`API key ${e} was not found.`,t.json,"api_key_not_found")}async function Ox(e,t,n){let i=e[0]??"status";if(i==="setup"||i==="repair"){let r=k(t.client)??k(t.agent);if(r&&t.all)return P({status:"error",reasonCode:"conflicting_mcp_client_selection",client:r,all:!0,nextAction:`mcp.${i}`,nextStep:"Use either --client <agent-id> for one agent or --all for every detected MCP-capable agent."},`mcp ${i} cannot use --client and --all together.`,t.json,"conflicting_mcp_client_selection");if(r&&!er(r))return xc(r,t);if(r){let a=await le(n.paths.mcpConfigPath),o=a?u(a,"baseUrl")??n.baseUrl:n.baseUrl,l=await Wn({baseUrl:o,mcpUrl:a?u(a,"mcpUrl")??`${o}/mcp`:`${o}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:a?u(a,"environment")??Ee(o):Ee(o),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:a});if(l.target.status==="skills_only"){let c=da(l);return b(c,`${l.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}}let s=await gu(t,n);return Z(s)?s:b({...s},`MCP configuration written for ${s.clientId}. Open a fresh agent session to load Skills Layer tools, then run \`skills-layer mcp verify --client ${s.clientId}\` if they are not visible.`,t.json,n)}if(i==="status"||i==="verify"){let r=k(t.client)??k(t.agent);if(r&&!er(r))return xc(r,t);let s=await le(n.paths.mcpConfigPath);if(!s){if(r){let c=await Wn({baseUrl:n.baseUrl,mcpUrl:`${n.baseUrl}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:Ee(n.baseUrl),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:null});if(c.target.status==="skills_only"){let d=da(c);return b(d,`${c.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}}return b({status:"mcp_not_configured",configured:!1,nextCommand:"skills-layer mcp setup"},"MCP is not configured on this machine.",t.json,n)}let a=r??u(s,"clientId")??"codex",o=u(s,"baseUrl")??n.baseUrl,l=await Wn({baseUrl:o,mcpUrl:u(s,"mcpUrl")??`${o}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:a,environment:u(s,"environment")??Ee(o),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:s});if(l.target.status==="skills_only"){let c=da(l);return b(c,`${l.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}if(i==="verify"&&l.configured){let c=await Wu({nodePath:process.execPath,bridgePath:l.bridge.path}),d={...l,verified:c.status==="ok",liveProbe:c};return c.status!=="ok"?P(d,`MCP config exists for ${l.clientId}, but live bridge verification failed: ${c.message}`,t.json,c.reasonCode??void 0):b(d,`MCP verified for ${l.clientId}. ${c.message} Open a fresh agent session or restart the agent if tools are not visible yet.`,t.json,n)}return b(l,l.configured?`MCP configuration is present for ${l.clientId}. Open a fresh agent session if tools are not visible, or run \`skills-layer mcp verify --client ${l.clientId}\` for a live check.`:`MCP needs repair for ${l.clientId}. Run \`${l.nextCommand}\`.`,t.json,n)}if(i==="disconnect"||i==="logout"){let r=k(t.client)??k(t.agent)??"codex";if(!er(r))return xc(r,t);let s=await le(n.paths.mcpConfigPath),a=s?u(s,"baseUrl")??n.baseUrl:n.baseUrl,o=await Wn({baseUrl:a,mcpUrl:s?u(s,"mcpUrl")??`${a}/mcp`:`${a}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:s?u(s,"environment")??Ee(a):Ee(a),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath,mcpConfig:s});if(o.target.status==="skills_only"){let d=da(o);return b(d,`${o.target.displayName} uses Skills Layer skill files, not MCP auto-install.`,t.json,n)}let l=sn({baseUrl:n.baseUrl,mcpUrl:`${n.baseUrl}/mcp`,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:r,environment:Ee(n.baseUrl),now:n.now(),env:n.env,platform:n.platform,cwd:n.cwd,stateDir:n.paths.stateDir,mcpConfigPath:n.paths.mcpConfigPath,nodePath:process.execPath}),c=l.targets.find(d=>d.agentId===r);return await by(s,n),await c?.disconnect?.(),await Da(l.bridgePath),await qa(l.brokerPath,l.brokerSocketPath),await Tt(n.paths.mcpConfigPath,{force:!0}),await Tt(n.paths.mcpPreferencePath,{force:!0}),b({status:"mcp_disconnected",configured:!1,clientId:r},"MCP disconnected on this machine.",t.json,n)}return _(`Unknown mcp command "${i}". Use setup, status, verify, repair, or disconnect.`,t.json)}async function Nx(e,t,n){let i=e[0]??"seats";if(i==="checkout"){let r=Oh(t.seats,"--seats","seats","enterprise checkout",t,{minimum:2});if(Z(r))return r;let s=R(t.enterpriseName??t.name,"enterprise checkout requires --enterprise-name <name>."),a=R(t.workspaceName??t.workspace,"enterprise checkout requires --workspace-name <name>."),o=Fx(),l=await C(n,"/api/v1/enterprise/checkout",{method:"POST",headers:{...j(n.apiKey,n.authBlockedMessage),"idempotency-key":o},body:JSON.stringify({seatCount:r,enterpriseName:s,firstWorkspaceName:a,creationIntentId:o,createNewEnterprise:t.newEnterprise===!0})});return u(l,"status")==="enterprise_exists"?vy(l,Bx(l,n),"Existing Enterprise found.",t.json,n):await Uc(l,t,n,"Enterprise checkout prepared.","Opening Enterprise checkout. Complete payment in your browser, then come back here.",{kind:"enterprise",statusPathForCheckoutId:c=>`/api/v1/enterprise/checkout/${encodeURIComponent(c)}`,waitingMessage:"Waiting for Enterprise checkout completion...",completedMessage:"Enterprise checkout completed."})}if(i==="rename"||i==="update"){let r=R(e[1],`enterprise ${i} requires <enterprise-id>.`),s=R(t.enterpriseName??t.name??e[2],`enterprise ${i} requires --name <enterprise-name>.`);return await Yt(`/api/v1/enterprises/${encodeURIComponent(r)}`,{name:s},t,n,"Enterprise updated.")}if(i==="primary-admin"){let r=R(e[1],"enterprise primary-admin requires transfer, status, accept, or cancel.");if(r==="transfer"){let o=R(e[2],"enterprise primary-admin transfer requires <enterprise-id>."),l=R(e[3],"enterprise primary-admin transfer requires <target-user-id>.");return await H(`/api/v1/enterprises/${encodeURIComponent(o)}/primary-admin-transfers`,{targetUserId:l,outgoingAction:t.leaveEnterprise===!0?"leave_enterprise":"remain_admin"},t,n,"Primary Admin transfer started.")}let s=R(e[2],`enterprise primary-admin ${r} requires <transfer-id>.`),a=`/api/v1/enterprise/primary-admin-transfers/${encodeURIComponent(s)}`;return r==="status"?await F(a,t,n,"Primary Admin transfer loaded.",{authenticated:!0}):r==="accept"?await H(`${a}/accept`,{},t,n,"Primary Admin responsibility transferred."):r==="cancel"?await H(`${a}/cancel`,{},t,n,"Primary Admin transfer cancelled."):_(`Unknown enterprise primary-admin command "${r}". Use transfer, status, accept, or cancel.`,t.json)}if(i==="seats"){if(e[1]==="add"){let r=R(e[2],"enterprise seats add requires <enterprise-id>."),s=Oh(t.seats,"--seats","seats","enterprise seats add",t,{minimum:1});if(Z(s))return s;let a=await C(n,"/api/v1/enterprise/seats/add",{method:"POST",headers:j(n.apiKey,n.authBlockedMessage),body:JSON.stringify({enterpriseId:r,additionalSeats:s})});return await Uc(a,t,n,"Enterprise seat checkout prepared.",`Opening checkout for ${s} additional Enterprise seat${s===1?"":"s"}. Complete payment in your browser, then come back here.`,{kind:"enterprise_seats",statusPathForCheckoutId:o=>`/api/v1/enterprise/seats/checkout/${encodeURIComponent(o)}`,waitingMessage:"Waiting for Enterprise seat checkout completion...",completedMessage:"Enterprise seats added."})}return await F("/api/v1/enterprise/seats",t,n,"Enterprise seats loaded.",{authenticated:!0})}if(i==="members"){let r=R(e[1],"enterprise members requires <enterprise-id>.");return await F(`/api/v1/enterprises/${encodeURIComponent(r)}/members`,t,n,"Enterprise members loaded.",{authenticated:!0})}if(i==="invite"){let r=R(e[1],"enterprise invite requires <enterprise-id>."),s=R(t.email??e[2],"enterprise invite requires --email <email>.");return await H(`/api/v1/enterprises/${encodeURIComponent(r)}/invites`,{email:s,role:k(t.role)??k(t.requestedRole)??"workspace_user",workspaceIds:Yx(t.workspace)},t,n,"Enterprise invite created.")}if(i==="accept-invite"){let r=R(e[1],"enterprise accept-invite requires <invite-id>."),s=await C(n,`/api/v1/enterprise-invites/${encodeURIComponent(r)}/accept`,{method:"POST",headers:j(n.apiKey,n.authBlockedMessage),body:JSON.stringify({})});return await Zt(n,s),b(s,"Enterprise invite accepted.",t.json,n)}if(i==="revoke-invite"||i==="resend-invite"){let r=R(e[1],`enterprise ${i} requires <enterprise-id> and <invite-id>.`),s=R(e[2],`enterprise ${i} requires <enterprise-id> and <invite-id>.`),a=i==="revoke-invite"?"revoke":"resend";return await H(`/api/v1/enterprises/${encodeURIComponent(r)}/invites/${encodeURIComponent(s)}/${a}`,{},t,n,i==="revoke-invite"?"Enterprise invite revoked.":"Enterprise invite resent.")}if(i==="member"){let r=e[1],s=R(e[2],"enterprise member <role|remove> requires <enterprise-id> and <user-id>."),a=R(e[3],"enterprise member <role|remove> requires <enterprise-id> and <user-id>.");if(r==="role"){let o=R(t.role??t.requestedRole,"enterprise member role requires --role <enterprise_admin|workspace_manager|workspace_user>.");return await Yt(`/api/v1/enterprises/${encodeURIComponent(s)}/members/${encodeURIComponent(a)}`,{role:o},t,n,"Enterprise member role updated.")}if(r==="remove")return await ar(`/api/v1/enterprises/${encodeURIComponent(s)}/members/${encodeURIComponent(a)}`,{method:"DELETE",headers:V(n.apiKey,n.authBlockedMessage)},t,n,"Enterprise member removed.")}if(i==="workspaces"){let r=R(e[1],"enterprise workspaces requires <enterprise-id>.");return await F(`/api/v1/enterprises/${encodeURIComponent(r)}/workspaces`,t,n,"Enterprise workspaces loaded.",{authenticated:!0})}if(i==="workspace"){let r=e[1],s=R(e[2],"enterprise workspace <create|rename|archive> requires <enterprise-id>.");if(r==="create"){let o=R(t.workspaceName??t.name??e[3],"enterprise workspace create requires --name <workspace-name>.");return await H(`/api/v1/enterprises/${encodeURIComponent(s)}/workspaces`,{name:o},t,n,"Enterprise workspace created.")}let a=R(e[3],"enterprise workspace <rename|archive> requires <workspace-id>.");if(r==="rename"||r==="update"){let o=k(t.workspaceName)??k(t.name)??e[4],l=k(t.telemetryPolicy);return r==="rename"&&!o?_("enterprise workspace rename requires --name <workspace-name>.",t.json):!o&&!l?_("enterprise workspace update requires --name <workspace-name> or --telemetry-policy <best_effort|required>.",t.json):l&&l!=="best_effort"&&l!=="required"?_("--telemetry-policy must be best_effort or required.",t.json):await Yt(`/api/v1/workspaces/${encodeURIComponent(a)}`,{enterpriseId:s,...o?{name:o}:{},...l?{telemetryPolicy:l}:{}},t,n,"Enterprise workspace updated.")}return r==="archive"?await H(`/api/v1/workspaces/${encodeURIComponent(a)}/archive`,{enterpriseId:s},t,n,"Enterprise workspace archived."):_(`Unknown enterprise workspace command "${r??""}".`,t.json)}if(i==="workspace-member"){let r=e[1],s=R(e[2],"enterprise workspace-member <add|remove> requires <enterprise-id> <workspace-id> <user-id>."),a=R(e[3],"enterprise workspace-member <add|remove> requires <enterprise-id> <workspace-id> <user-id>."),o=R(e[4],"enterprise workspace-member <add|remove> requires <enterprise-id> <workspace-id> <user-id>.");if(r==="add")return await H(`/api/v1/workspaces/${encodeURIComponent(a)}/members`,{enterpriseId:s,userId:o,role:k(t.role)??k(t.requestedRole)??"workspace_user"},t,n,"Workspace member added.");if(r==="remove")return await ar(`/api/v1/workspaces/${encodeURIComponent(a)}/members/${encodeURIComponent(o)}`,{method:"DELETE",headers:j(n.apiKey,n.authBlockedMessage),body:JSON.stringify({enterpriseId:s})},t,n,"Workspace member removed.")}if(i==="skill")return await jx(e.slice(1),t,n);if(i==="install-authorize"){let r=R(e[1],"enterprise install-authorize requires <skill-slug>.");return await H(`/api/v1/skills/${encodeURIComponent(r)}/install-authorize`,{},t,n,"Install authorization evaluated.")}return _(`Unknown enterprise command "${i}".`,t.json)}async function jx(e,t,n){let i=e[0];if(i==="quote"||i==="buy"){let r=R(e[1],`enterprise skill ${i} requires <enterprise-id> and <skill-slug>.`),s=R(e[2],`enterprise skill ${i} requires <enterprise-id> and <skill-slug>.`),a=await C(n,`/api/v1/enterprises/${encodeURIComponent(r)}/skills/${encodeURIComponent(s)}/${i==="quote"?"quote":"checkout"}`,{method:"POST",headers:j(n.apiKey,n.authBlockedMessage),body:JSON.stringify({})});return i==="quote"?b(a,"Enterprise skill quote loaded.",t.json,n):await Uc(a,t,n,"Enterprise skill checkout prepared.",`Opening Enterprise skill checkout for ${s}. Complete payment in your browser, then come back here.`,{kind:"enterprise_skill",statusPathForCheckoutId:o=>`/api/v1/enterprises/_/skills/_/checkout/${encodeURIComponent(o)}`,waitingMessage:"Waiting for Enterprise skill checkout completion...",completedMessage:"Enterprise skill checkout completed."})}if(i==="entitlements"){let r=R(e[1],"enterprise skill entitlements requires <enterprise-id>.");return await F(`/api/v1/enterprises/${encodeURIComponent(r)}/skill-entitlements`,t,n,"Enterprise skill entitlements loaded.",{authenticated:!0})}return _(`Unknown enterprise skill command "${i??""}".`,t.json)}async function Uc(e,t,n,i,r,s){let a=u(e,"checkoutUrl"),o=u(e,"checkoutId"),l=u(e,"status");if(!t.json&&!t.noOpen&&(l==="checkout_required"&&a&&(n.emitInfo(r),await n.openUrl(a)||n.emitInfo(`Open this checkout URL manually to continue: ${a}`)),s&&o&&(l==="checkout_required"||l==="finalizing"))){n.emitInfo(s.waitingMessage);let c=await r$(s.statusPathForCheckoutId(o),n);if(Z(c))return c;let d=u(c,"status");return d!=="completed"&&d!=="already_completed"?_(Ux(d,s.kind),t.json):(n.emitInfo(s.completedMessage),vy(c,s.kind==="enterprise"?Dx(c,n):s.kind==="enterprise_seats"?Mx(c,n):qx(c,n),s.completedMessage,t.json,n))}return b(e,i,t.json,n)}function Bx(e,t){let n=ce(t),i=E(e,"enterprise"),r=E(e,"membership"),s=Array.isArray(e.workspaces)?e.workspaces.filter(L):[],a=[`${n.ok("OK")} Existing Enterprise found. No payment was started.`,"",n.section("Enterprise")];if(a.push(`  ${n.label("Name")}: ${i?u(i,"name")??"unknown":"unknown"}`),a.push(`  ${n.label("ID")}: ${i?u(i,"enterpriseId")??"unknown":"unknown"}`),a.push(`  ${n.label("Your role")}: ${Vc(r?u(r,"role")??"unknown":"unknown")}`),s.length>0){a.push("",n.section("Workspaces"));for(let l of s)a.push(`  ${n.arrow} ${u(l,"name")??"Unnamed"} (${u(l,"workspaceId")??"unknown"})`)}let o=u(e,"nextStep");return o&&a.push("",n.section("Next"),`  ${n.arrow} ${o}`),a.join(`
+`)}function Fx(){return`enterprise_creation_${globalThis.crypto.randomUUID().replaceAll("-","").toLowerCase()}`}function Dx(e,t){let n=ce(t),i=E(e,"enterprise"),r=E(e,"firstWorkspace"),s=E(e,"membership"),a=i?u(i,"enterpriseId"):void 0,o=r?u(r,"workspaceId"):void 0,l=i?U(i,"seatCapacity"):void 0,c=i?U(i,"usedSeats"):void 0,d=i?U(i,"availableSeats"):void 0,p=[`${n.ok("OK")} Enterprise is ready.`,"",n.section("Enterprise")];return p.push(`  ${n.label("Name")}: ${i?u(i,"name")??"unknown":"unknown"}`),p.push(`  ${n.label("ID")}: ${a??"unknown"}`),l!==void 0&&c!==void 0&&d!==void 0&&p.push(`  ${n.label("Seats")}: ${c} used, ${d} available of ${l}`),p.push("",n.section("First workspace")),p.push(`  ${n.label("Name")}: ${r?u(r,"name")??"unknown":"unknown"}`),p.push(`  ${n.label("ID")}: ${o??"unknown"}`),r&&p.push(`  ${n.label("Policy")}: ${Vc(u(r,"policy")??"unknown")}`),p.push("",n.section("Your access")),p.push(`  ${n.label("Role")}: ${Vc(s?u(s,"role")??"unknown":"unknown")}`),a&&o&&(p.push("",n.section("Next")),p.push(`  ${n.arrow} skills-layer enterprise invite ${a} --email <email>`),p.push(`  ${n.arrow} skills-layer workspace current`),p.push(`  ${n.arrow} skills-layer workspace approve ${o} <skill-slug>`)),p.join(`
+`)}function qx(e,t){let n=ce(t),i=E(e,"entitlement"),r=i?u(i,"enterpriseId"):void 0,s=i?u(i,"skillSlug"):void 0,a=[`${n.ok("OK")} Enterprise skill is ready for workspace approval.`,"",n.section("Entitlement")];return a.push(`  ${n.label("Skill")}: ${i?u(i,"skillName")??s??"unknown":"unknown"}`),s&&a.push(`  ${n.label("Slug")}: ${s}`),i&&a.push(`  ${n.label("Version")}: ${u(i,"version")??"latest"}`),r&&a.push(`  ${n.label("Enterprise ID")}: ${r}`),a.push("",n.section("Next")),r&&a.push(`  ${n.arrow} skills-layer enterprise skill entitlements ${r}`),s&&a.push(`  ${n.arrow} skills-layer workspace approve <workspace-id> ${s}`),a.join(`
+`)}function Mx(e,t){let n=ce(t),i=E(e,"enterprise"),r=U(e,"addedSeats"),s=i?U(i,"seatCapacity"):void 0,a=i?U(i,"usedSeats"):void 0,o=i?U(i,"availableSeats"):void 0,l=[`${n.ok("OK")} ${r??"Additional"} Enterprise seat${r===1?"":"s"} added.`,"",n.section("Enterprise")];return l.push(`  ${n.label("Name")}: ${i?u(i,"name")??"unknown":"unknown"}`),l.push(`  ${n.label("ID")}: ${i?u(i,"enterpriseId")??"unknown":"unknown"}`),s!==void 0&&a!==void 0&&o!==void 0&&l.push(`  ${n.label("Seats")}: ${a} used, ${o} available of ${s}`),l.push("",n.section("Next"),`  ${n.arrow} skills-layer enterprise seats`),l.join(`
+`)}function Ux(e,t){let n=e==="canceled"||e==="cancelled",i=t==="enterprise"?"Enterprise checkout":t==="enterprise_seats"?"Enterprise seat checkout":"Enterprise skill checkout",r=t==="enterprise"?"No Enterprise, workspace, or seats were created.":t==="enterprise_seats"?"No seats were added and the Enterprise capacity is unchanged.":"No Enterprise skill entitlement was created and no workspace access changed.",s=t==="enterprise"?"Enterprise checkout":t==="enterprise_seats"?"Enterprise seat purchase":"Enterprise skill purchase";return n?`${i} was cancelled. ${r} Rerun the ${s} command when you are ready.`:e==="expired"?`${i} expired. ${r} Start a new ${s} when you are ready.`:`${i} failed${e?` (${e})`:""}. ${r} Retry the ${s} command or contact support if payment was charged.`}function Vc(e){if(e==="workspace_approved_only")return"Workspace-approved only";let t=e.replace(/[_-]+/gu," ").trim().toLowerCase();return t.length>0?t[0].toUpperCase()+t.slice(1):"Unknown"}function vy(e,t,n,i,r){return i?b(e,n,!0,r):{exitCode:0,stdout:t,stderr:""}}function er(e){return Te.includes(e)}function xc(e,t){return P({status:"error",reasonCode:"unknown_mcp_client",requestedClient:e,nextAction:"mcp.status",nextStep:"Run `skills-layer agents list` to see supported client ids."},`Unknown MCP client "${e}". Run \`skills-layer agents list\` to see supported client ids.`,t.json,"unknown_mcp_client")}function da(e){let t=e.target.instructions,n=Array.isArray(t)&&typeof t[0]=="string"?t[0]:`Install skills with \`skills-layer install <skill> --agent ${e.clientId}\`.`;return{...e,status:"skills_only",configured:!1,nextCommand:null,nextAction:"install.skills",nextStep:n}}async function gu(e,t){let n=k(e.environment)??Ee(t.baseUrl),i=["mcp:use","catalog:read","library:read","guardian:check","guardian:incident","creator:read"],r=`${t.baseUrl}/mcp`,s=sn({baseUrl:t.baseUrl,mcpUrl:r,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:"codex",environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),a=await Vx(e,t,s),o=a.clientIds[0]??"codex",l=sn({baseUrl:t.baseUrl,mcpUrl:r,bearerTokenEnvVar:"SKILLS_LAYER_MCP_TOKEN",clientId:o,environment:n,now:t.now(),env:t.env,platform:t.platform,cwd:t.cwd,stateDir:t.paths.stateDir,mcpConfigPath:t.paths.mcpConfigPath,nodePath:process.execPath}),c={},d=null;for(let g of a.clientIds){let h=en(),m=await C(t,"/api/v1/me/mcp-tokens",{method:"POST",headers:j(t.apiKey),body:JSON.stringify({clientId:g,environment:n,scopes:i,handoffCodeHash:h.authorizationCodeHash,handoffCodeChallenge:h.codeChallenge})});if(u(m,"credentialHandoff")!=="ready")return _("MCP setup did not prepare a secure credential handoff.",e.json);let y=await C(t,"/api/v1/credential-handoffs/exchange",{method:"POST",headers:j(t.apiKey),body:JSON.stringify({authorizationCode:h.authorizationCode,codeVerifier:h.codeVerifier})}),w=u(y,"apiKey");if(!w)return _("MCP token credential exchange failed closed.",e.json);let v=await Gx(t,{token:w,clientId:g,environment:n});c[g]={clientId:g,environment:n,...v,tokenPrefix:u(y,"keyPrefix")??null,scopes:Array.isArray(y.scopes)?y.scopes:[],savedAt:t.now()},d??=y}let p=c[o]??{};await xe(t.paths.mcpConfigPath,{version:1,baseUrl:t.baseUrl,mcpUrl:r,clientId:o,clientIds:a.clientIds,environment:n,selectionSource:a.selectionSource,detectedClientIds:a.detectedClientIds,...p,tokens:c,brokerPath:l.brokerPath,brokerSocketPath:l.brokerSocketPath,savedAt:t.now()});let f=l.targets.filter(g=>g.status==="automatic"&&a.clientIds.includes(g.agentId));for(let g of f)await g.apply?.();return await Tt(t.paths.mcpPreferencePath,{force:!0}),{...Ae(d??{}),status:"mcp_configured",clientId:o,clientIds:a.clientIds,selectionSource:a.selectionSource,detectedClientIds:a.detectedClientIds,environment:n,mcpUrl:r,bridgePath:l.bridgePath,brokerPath:l.brokerPath,brokerSocketPath:l.brokerSocketPath,nodePath:l.nodePath,bridgeChecksum:l.bridgeChecksum,brokerChecksum:l.brokerChecksum,saved:!0,readiness:{status:"configured_needs_agent_reload",verifyCommand:`skills-layer mcp verify --client ${o}`,nextStep:"Open a fresh agent session so the host can load the updated MCP configuration. Run verify or repair if Skills Layer tools are still not visible."},registrations:{status:"mcp_registration_plan",automaticCount:l.automaticCount,manualCount:l.manualCount,skillsOnlyCount:l.skillsOnlyCount,unsupportedCount:l.unsupportedCount,appliedCount:f.length,appliedClients:f.map(g=>g.agentId),targets:l.targets.map(g=>({agentId:g.agentId,displayName:g.displayName,tier:g.tier,status:g.status,transport:g.transport,configPath:g.configPath,bridgePath:g.bridgePath,restartRequired:g.restartRequired,reason:g.reason,instructions:g.instructions}))}}}async function Vx(e,t,n){let i=k(e.client)??k(e.agent),r=n.targets.filter(l=>l.status==="automatic").map(l=>l.agentId);if(i)return{clientIds:[i],detectedClientIds:[],selectionSource:"explicit"};if(e.all)return{clientIds:r,detectedClientIds:r,selectionSource:"all"};let s=await ja({env:t.env,platform:t.platform,cwd:t.cwd,pathExists:st}),a=new Set(r),o=s.map(l=>l.id).filter(l=>a.has(l));return o.length>0?{clientIds:o,detectedClientIds:o,selectionSource:"detected"}:{clientIds:["codex"],detectedClientIds:[],selectionSource:"fallback"}}async function Gx(e,t){if(!e.credentialStore)return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"};let n=Kx({baseUrl:e.baseUrl,userId:e.config?.userId,email:e.config?.email,clientId:t.clientId,environment:t.environment});try{return await e.credentialStore.set(Ji,n,t.token),{tokenRef:n,credentialStorage:"macos_keychain",credentialService:Ji,tokenStorage:"macos_keychain"}}catch{return{token:t.token,credentialStorage:"local_file_locked",tokenStorage:"local_file_locked"}}}async function by(e,t){if(!e||!t.credentialStore)return;let n=zx(e,Ji);for(let i of n)await t.credentialStore.delete(i.service,i.tokenRef)}function zx(e,t){let n=new Map;Sh(e,t,n);let i=e.tokens;if(L(i))for(let r of Object.values(i))L(r)&&Sh(r,t,n);return[...n.values()]}function Sh(e,t,n){let i=u(e,"tokenRef");if(!i||u(e,"credentialStorage")!=="macos_keychain")return;let r=u(e,"credentialService")??t;n.set(`${r}:${i}`,{service:r,tokenRef:i})}function Kx(e){let t=[e.baseUrl,e.userId??e.email??"unknown-user",e.clientId,e.environment,"mcpToken"].join(`
+`);return`skills-layer-cli:mcp-token:${qn("sha256").update(t).digest("base64url").slice(0,32)}`}async function Gc(e,t){if(e.noMcp)return{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."};let n=await le(t.paths.mcpConfigPath),i=n?u(n,"baseUrl"):void 0,r=n?u(n,"clientId")??"codex":"codex";if(!e.withMcp&&i===t.baseUrl&&r)return{data:{status:"mcp_already_configured",configured:!0,clientId:r,mcpUrl:n?u(n,"mcpUrl")??`${t.baseUrl}/mcp`:`${t.baseUrl}/mcp`},message:"MCP is already configured for this machine."};let s=e.withMcp===!0;if(!s&&!e.json)try{let o=await t.promptSelect("Set up Skills Layer MCP for your AI tools on this machine?",[{value:"yes",label:"Yes, set up MCP",description:"Mint a scoped token and write local MCP configuration"},{value:"no",label:"Not now",description:"You can run skills-layer mcp setup later"}]);if(s=o==="yes",o==="no")return await Tt(t.paths.mcpPreferencePath,{force:!0}),{data:{status:"mcp_skipped",configured:!1,nextCommand:"skills-layer mcp setup"},message:"MCP setup skipped. Run `skills-layer mcp setup` later when you want AI-tool access."}}catch{return{}}if(!s)return{};let a=await gu(e,t);return Z(a)?a:{data:a,message:"MCP configuration written for this machine. Open a fresh agent session so your AI tools can load it."}}async function zc(e,t){if(t.config?.edition==="community")return{};let n;try{n=await C(t,"/api/v1/me/working-modes",{headers:V(t.apiKey,t.authBlockedMessage)})}catch{return{}}await Zt(t,n);let i=Array.isArray(n.modes)?n.modes.filter(L):[];if(n.selectionRequired!==!0){let l=u(n,"selectedModeId"),c=i.find(p=>u(p,"modeId")===l),d=c?u(c,"label")??l:l;return l?{data:{status:"working_mode_selected",selectedModeId:l,...c?{mode:c}:{}},message:`Active workspace selection: ${d}.`}:{}}let r=Hx(i);if(r.length===0)return{};if(e.json)return P({status:"working_mode_selection_required",reasonCode:"working_mode_selection_required",selectedModeId:null,modes:i,nextAction:"workspace.use",nextStep:"Run `skills-layer workspace list`, then `skills-layer workspace use <workspace-id>` to choose the Enterprise workspace."},"Workspace selection is required for this enterprise account.",!0,"working_mode_selection_required");let s;try{s=await t.promptSelect("Choose your Skills Layer working mode:",r)}catch{return P({status:"working_mode_selection_required",reasonCode:"working_mode_selection_required",selectedModeId:null,modes:i,nextAction:"workspace.use",nextStep:"Run `skills-layer workspace list`, then `skills-layer workspace use <workspace-id>` to choose the Enterprise workspace."},"Workspace selection is required for this enterprise account.",e.json,"working_mode_selection_required")}let a=await C(t,"/api/v1/me/working-mode",{method:"PUT",headers:j(t.apiKey,t.authBlockedMessage),body:JSON.stringify({modeId:s})});await Zt(t,a);let o=r.find(l=>l.value===s)?.label??s;return{data:a,message:`Working mode selected: ${o}.`}}function Hx(e){let t=new Map;for(let r of e){let s=u(r,"modeId"),a=u(r,"type");!s||a!=="personal"&&a!=="enterprise_workspace"||t.has(s)||t.set(s,r)}let n=[...t.values()],i=new Map;for(let r of n){let s=u(r,"modeId"),o=(u(r,"label")??s).trim().toLocaleLowerCase();i.set(o,[...i.get(o)??[],r])}return n.map(r=>{let s=u(r,"modeId"),a=u(r,"type"),o=u(r,"label")??s;if(a==="personal")return{value:s,label:o,description:"Your personal library and public catalog"};let l=i.get(o.trim().toLocaleLowerCase())??[];if(l.length===1)return{value:s,label:o};let c=new Set(l.map(g=>u(g,"enterpriseId")).filter(Boolean)),d=c.size>1?u(r,"enterpriseId"):u(r,"workspaceId"),p=c.size>1?"Enterprise":"Workspace",f=Jx(d??s);return{value:s,label:`${o} (${p} ${f})`}})}function Jx(e){return e.replace(/^(?:enterprise|workspace)_/u,"").slice(0,8)}function Wx(e){if(!e)return null;let t=e.mode??e.workingMode,n=L(t)?t:e,i=u(n,"modeId")??u(e,"selectedModeId"),r=u(n,"type");return!i||r!=="personal"&&r!=="enterprise_workspace"?null:{workingModeId:i,workingModeType:r,workingModeEnterpriseId:u(n,"enterpriseId"),workingModeWorkspaceId:u(n,"workspaceId"),workingModeLabel:u(n,"label")}}async function Zt(e,t){let n=Wx(t);if(!n||!e.config)return e.config;let i={...e.config,...n,workingModeSavedAt:e.now()};return await Ru(e.paths.configPath,i,e),e.config=i,i}async function _h(e,t,n){let i=[...new Set(t.map(r=>r.trim()).filter(Boolean))];for(let r of i){let s=await mu(e,r,n);if(s)return s}return null}async function mu(e,t,n){if(!e.apiKey)return null;let i=e.config?.workingModeType;if(i!=="personal"&&i!=="enterprise_workspace"){let r;try{r=await C(e,"/api/v1/me/install-policy",{headers:V(e.apiKey,e.authBlockedMessage)})}catch(s){if(s instanceof D&&(s.status===403||s.status===409))return Ic(s.details??{error:s.message},t,n.json);throw s}if(await Zt(e,r),r.requiresWorkingModeSelection===!0)return P({status:"working_mode_selection_required",skillSlug:t,reasonCode:"working_mode_selection_required",nextAction:u(r,"nextAction")??"select_working_mode",nextStep:u(r,"nextStep")??"Choose a working mode before installing."},`Install blocked for ${t} (working_mode_selection_required). ${u(r,"nextStep")??"Choose a working mode before installing."}`,n.json,"working_mode_selection_required");i=e.config?.workingModeType}if(i!=="enterprise_workspace")return null;try{let r=await C(e,`/api/v1/skills/${encodeURIComponent(t)}/install-authorize`,{method:"POST",headers:j(e.apiKey,e.authBlockedMessage),body:JSON.stringify({})});return await Zt(e,r),u(r,"status")==="authorized"?null:Ic(r,t,n.json)}catch(r){if(r instanceof D&&(r.status===403||r.status===409))return Ic(r.details??{error:r.message},t,n.json);throw r}}function Ic(e,t,n){let i=L(e.data)?e.data:e,r=u(e,"reasonCode")??u(i,"reasonCode"),s=u(e,"nextAction")??u(i,"nextAction"),a=u(e,"nextStep")??u(i,"nextStep"),o=u(i,"status")??"blocked";return P({...i,status:o,skillSlug:t,...r?{reasonCode:r}:{},...s?{nextAction:s}:{},...a?{nextStep:a}:{}},`Install blocked for ${t}${r?` (${r})`:""}.${a?` ${a}`:""}`,n,r)}function Yx(e){let t=k(e);if(t)return t.split(",").map(n=>n.trim()).filter(Boolean)}async function Zx(e,t,n){let i=e.join(" ").trim()||k(t.search)||"",r=new URLSearchParams;i&&r.set("query",i);let s=k(t.runtimeRisk);if(s&&!Ph.includes(s))return fa("runtime-risk",s,Ph,t);let a=k(t.agent);if(a&&!er(a))return P({status:"error",reasonCode:"unknown_agent",filter:"agent",value:a,acceptedValues:Te,nextAction:"search",nextStep:"Use --agent with a supported Skills Layer agent id."},`Unknown search --agent "${a}". Run \`skills-layer agents list\` to inspect supported agents.`,t.json,"unknown_agent");let o=k(t.trust);if(o&&!Ah.includes(o))return fa("trust",o,Ah,t);let l=k(t.securityCapability),c=dI(l);if(l&&!c)return fa("security-capability",l,Sy,t);let d=k(t.limit);if(d){let f=Number(d);if(!Number.isInteger(f)||f<1||f>100)return fa("limit",d,["1-100"],t);r.set("limit",String(f))}ie(r,"agent",t.agent),ie(r,"capability",t.capability),ie(r,"trust",o),ie(r,"runtime-risk",s),ie(r,"security-capability",c);let p=await C(n,`/api/v1/search${ye(r)}`);if(t.install!==void 0){let f=k(t.install);if(!f){if(t.json)return _("search --install requires an explicit skill slug in the public CLI package.",!0);let h=dt(p);if(h.length===0)return _("Search results do not include any installable skills. Run search again with a broader query.",!1);if(h.length===1)f=h[0].value;else try{f=await n.promptSelect("Select a search result to install:",h)}catch{return _("No search result was selected for install.",!1)}}let g=fL(p);return g.includes(f)?await Ca([f],t,n):_(g.length===0?`Search results do not include "${f}". Run search again with a matching query first.`:`Search results do not include "${f}". Run search again with a matching query or choose one of: ${g.join(", ")}.`,t.json)}return b(p,"Search complete.",t.json,n)}var Ph=["low","elevated","high"],Ah=["high","medium","low","published","published_with_findings","publishable","publishable_with_findings","blocked","unknown"],Sy=["filesystem_read","filesystem_write","network_access","api_access","browser_access","device_control","generated_code_execution","secret_handling","model_context","shell_access"],Xx={network:"network_access",filesystem:"filesystem_read",files:"filesystem_read",file_read:"filesystem_read",file_write:"filesystem_write",shell:"shell_access",browser:"browser_access",device:"device_control",api:"api_access",secrets:"secret_handling",model:"model_context"},Tc=["local","project","global","workspace"],tr=["private","public","unlisted"],Fn=["private","public","unlisted"],Rh=["github","gitlab","local","generic_git","domain"],Qx=["owner","maintainer"],eI=["submitted","published","draft","pending_review","suspended","blocked","archived","unlisted"],tI=["open","acknowledged","fixed","closed","rejected","abusive","reopened","resolved"],nI=["visible","flagged","hidden"],iI=["bug","quality","safety","other"],rI=["approved","denied"],sI=["email","google","github","gitlab","microsoft"],aI=["email","google","github","gitlab","microsoft"],Ch=["catalog:read","library:read","creator:read","creator:submit","guardian:check","guardian:incident","workspace:read","workspace:write","workspace:approve","mcp:use"],Eh=["automation","mcp","agent"],xh=["active","expired","revoked","all"],Ih=["created-desc","created-asc","expires-desc","expires-asc","name-asc","name-desc","last-used-desc","last-used-asc"],Th=10,_y=["json","sarif"],pa=["featured","trending","newest","name","relevance"],oI=/^(?:card(?:_[A-Za-z0-9]+)*|pm_[A-Za-z0-9_]+)$/u,lI=/^[a-z0-9]+(?:-[a-z0-9]+)*$/u,cI=/^[a-f0-9]{6,64}$/iu,uI=new Set(["http:","https:"]);function Py(e,t,n,i){let r=k(t);if(!r)return{};if(!/^\d+$/u.test(r))return{failure:P({status:"error",reasonCode:"invalid_limit",command:e,value:r,acceptedRange:`1-${n}`,nextAction:e,nextStep:`Use --limit with a whole number from 1 to ${n}.`},`${e} --limit must be a whole number from 1 to ${n}.`,i.json,"invalid_limit")};let s=Number.parseInt(r,10);return!Number.isInteger(s)||s<1||s>n?{failure:P({status:"error",reasonCode:"invalid_limit",command:e,value:r,acceptedRange:`1-${n}`,nextAction:e,nextStep:`Use --limit with a whole number from 1 to ${n}.`},`${e} --limit must be between 1 and ${n}.`,i.json,"invalid_limit")}:{value:String(s)}}function fa(e,t,n,i){return P({status:"error",reasonCode:"invalid_search_filter",filter:e,value:t,acceptedValues:n,nextAction:"search",nextStep:e==="runtime-risk"?"Use --runtime-risk low, elevated, or high.":e==="limit"?"Use --limit with a whole number from 1 to 100.":`Use --${e} with one of: ${n.join(", ")}.`},e==="runtime-risk"?`Invalid runtime risk "${t}". Use one of: ${n.join(", ")}.`:e==="limit"?`Invalid search limit "${t}". Use a whole number from 1 to 100.`:`Invalid search --${e} "${t}". Use one of: ${n.join(", ")}.`,i.json,"invalid_search_filter")}function dI(e){if(e)return Sy.includes(e)?e:Xx[e]}function Wt(e,t,n,i,r,s,a=t){return P({status:"error",reasonCode:s,[t]:n,acceptedValues:i,nextAction:e,nextStep:`Use --${a} with one of: ${i.join(", ")}.`},`Invalid ${e} --${a} "${n}". Use one of: ${i.join(", ")}.`,r.json,s)}function Je(e,t,n,i,r,s,a=t){let o=k(n);if(!(!o||i.includes(o)))return Wt(e,t,o,i,r,s,a)}function xt(e,t){let n=k(t.version);return n&&!Ea(n)?yu(e,n,t):void 0}function pI(e,t,n){return P({status:"error",reasonCode:"invalid_slug",value:t,acceptedFormat:"lowercase words separated by hyphens",nextAction:e,nextStep:"Use a lowercase skill slug such as project-planner or year9-history-study-guide."},`Invalid skill slug "${t}". Use lowercase letters, numbers, and single hyphens.`,n.json,"invalid_slug")}function Ay(e,t,n){return t&&!lI.test(t)?pI(e,t,n):void 0}function fI(e,t,n){return P({status:"error",reasonCode:"invalid_format",format:t,acceptedValues:_y,nextAction:e,nextStep:"Use --format json or --format sarif."},`Invalid ${e} --format "${t}". Use json or sarif.`,n.json,"invalid_format")}function Ry(e,t){let n=k(t.format);return n&&!_y.includes(n.toLowerCase())?fI(e,n,t):void 0}function gI(e,t,n){return P({status:"error",reasonCode:"invalid_commit_sha",commitSha:t,nextAction:e,nextStep:"Use --commit-sha with a 6 to 64 character hexadecimal commit SHA."},`Invalid --commit-sha "${t}". Use a hexadecimal commit SHA.`,n.json,"invalid_commit_sha")}function mI(e,t){let n=k(t.commitSha);return n&&!cI.test(n)?gI(e,n,t):void 0}function $h(e,t){return P({status:"error",reasonCode:"invalid_base_url",baseUrl:e,nextAction:"backend",nextStep:"Use --base-url with an http or https URL, for example https://api.skills-layer.com."},`Invalid backend base URL "${e}". Use an http or https URL.`,t.json,"invalid_base_url")}function hI(e,t){try{let n=new URL(e);return!uI.has(n.protocol)||!n.hostname?$h(e,t):void 0}catch{return $h(e,t)}}function Lh(e,t,n){return P({status:"error",reasonCode:"unexpected_argument",command:e,argument:t,nextAction:e,nextStep:`Run \`skills-layer ${e} --help\` to see supported arguments for this command.`},`Unexpected argument "${t}" for ${e}.`,n.json,"unexpected_argument")}function hu(e,t){let n=k(t.scope);if(n&&!Tc.includes(n))return{failure:P({status:"error",reasonCode:"invalid_install_filter",filter:"scope",value:n,acceptedValues:Tc,nextAction:e,nextStep:"Use --scope local, project, global, or workspace."},`Invalid ${e} --scope "${n}". Use one of: ${Tc.join(", ")}.`,t.json,"invalid_install_filter")};let i=k(t.agent);return i&&!er(i)?{failure:P({status:"error",reasonCode:"unknown_agent",filter:"agent",value:i,acceptedValues:Te,nextAction:e,nextStep:"Use --agent with a supported Skills Layer agent id."},`Unknown ${e} --agent "${i}". Run \`skills-layer agents\` to inspect supported agents.`,t.json,"unknown_agent")}:{scope:n,agent:i}}function Cy(e,t){let n=hu(e,t);if(n.failure)return n.failure;let i=k(t.version);if(e==="install"&&i&&!Ea(i))return yu("install",i,t)}function yu(e,t,n){return P({status:"error",reasonCode:"invalid_version",command:e,version:t,nextAction:e,nextStep:"Use a semver version such as 1.2.3 or an external-<digest> Skills Layer version."},`Invalid --version "${t}". Use a semver version or an external-<digest> version.`,n.json,"invalid_version")}function yI(e,t,n){return P({status:"error",reasonCode:"invalid_expiry",command:e,expiresIn:t,acceptedFormat:"<positive whole number>d",nextAction:e,nextStep:"Use --expires with a day duration such as 7d, 30d, or 90d."},`Invalid --expires "${t}". Use a day duration such as 7d, 30d, or 90d.`,n.json,"invalid_expiry")}function kI(e,t,n){let i=k(t);if(i&&!/^[1-9]\d*d$/iu.test(i))return yI(e,i,n)}function Xt(e,t,n,i,r,s){let a=k(e);if(!a)return{};if(!/^\d+$/u.test(a))return{failure:P({status:"error",reasonCode:i,[n]:a,nextAction:t.includes("price")?"creator.pricing":"creator.withdraw",nextStep:`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`},`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`,r.json,i)};let o=Number(a);return!Number.isSafeInteger(o)||o<s.minimum?{failure:P({status:"error",reasonCode:i,[n]:a,nextAction:t.includes("price")?"creator.pricing":"creator.withdraw",nextStep:`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`},`${t} must be a whole number ${s.minimum===0?"zero or greater":"greater than zero"}.`,r.json,i)}:{value:o}}function Oh(e,t,n,i,r,s){let a=Xt(e,t,n,`invalid_${n.replace(/[A-Z]/gu,o=>`_${o.toLowerCase()}`)}`,r,s);return a.failure?a.failure:a.value===void 0?_(`${i} requires ${t} <count>.`,r.json):a.value}function wI(e){let t=k(e.paymentMethod)??"card";return oI.test(t)?{value:t}:{failure:P({status:"error",reasonCode:"invalid_payment_method",paymentMethod:t,acceptedValues:["card","card_<test-card>","pm_<provider-method-id>"],nextAction:"buy",nextStep:"Use --payment-method card or a provider token such as pm_<id>."},`Invalid payment method "${t}". Use card or a provider token such as pm_<id>.`,e.json,"invalid_payment_method")}}async function vI(e,t,n){let i=new URLSearchParams,r=Py(e,t.limit,20,t);if(r.failure)return r.failure;let s=k(t.sort);return s&&!pa.includes(s)?P({status:"error",reasonCode:"invalid_sort",sort:s,acceptedValues:pa,nextAction:e,nextStep:`Use --sort with one of: ${pa.join(", ")}.`},`${e} --sort must be one of: ${pa.join(", ")}.`,t.json,"invalid_sort"):(ie(i,"limit",r.value),ie(i,"search",t.search),ie(i,"sort",s),await F(`/api/v1/${e}${ye(i)}`,t,n,`${Ta(e)} skills loaded.`))}async function bI(e,t,n){let i=e.join(" ").trim();if(!i)return _("recommend requires a task.",t.json);let r=Py("recommend",t.limit,20,t);if(r.failure)return r.failure;let s=new URLSearchParams({task:i});return ie(s,"limit",r.value),await F(`/api/v1/recommend?${s.toString()}`,t,n,"Recommendations loaded.")}async function SI(e,t,n){if(e.length<2)return _("compare requires two or more skill slugs.",t.json);if(e.length>5)return P({status:"error",reasonCode:"too_many_compare_slugs",requestedCount:e.length,maxItems:5,nextAction:"compare",nextStep:"Compare up to 5 skills at a time."},"compare supports up to 5 skill slugs at a time.",t.json,"too_many_compare_slugs");let i=new URLSearchParams({slugs:e.join(",")}),r=await C(n,`/api/v1/skills/compare?${i.toString()}`),s=Array.isArray(r.missing)?r.missing.filter(a=>typeof a=="string"):[];return s.length>0?P({...r,status:"not_found",reasonCode:"compare_missing_skills",missing:s,nextAction:"search",nextStep:`Run \`skills-layer search ${s[0]}\` to find the correct slug, then retry compare.`},`Comparison could not find: ${s.join(", ")}.`,t.json,"compare_missing_skills"):t.json?b(r,"Comparison loaded.",!0,n):{exitCode:0,stdout:R$(r,"Comparison loaded.",ce(n),t.verbose),stderr:""}}async function _I(e,t,n){let i=R(e[0],"show requires a skill slug."),r=await C(n,`/api/v1/skills/${encodeURIComponent(i)}`);return b(B0(r),"Skill loaded.",t.json,n)}async function PI(e,t,n){let i=R(e[0],"trust requires a skill slug."),r=Ry("trust",t);if(r)return r;let s=new URLSearchParams;ie(s,"format",t.format),ie(s,"version",t.version);let a=await C(n,`/api/v1/skills/${encodeURIComponent(i)}/trust${ye(s)}`);return k(t.format)?.toLowerCase()==="sarif"&&!t.json?{exitCode:0,stdout:F0(a,i,n),stderr:""}:b(a,"Trust report loaded.",t.json,n)}async function AI(e,t,n){if(t.json){let s=e[0]==="full"?Nn():e[0]==="topic"?Nn(e[1]):Nn(e[0],e.slice(1));if(s)return b(s,"Help loaded.",!0,n);if(e[0]!=="topic"&&!gx.has(e[0]??""))return Kc(e,!0)}let i=Yi(e[0],e.slice(1));if(i)return $c(i,e.filter(Boolean).join(" "),t,n);let r=e[0];if(!r)return{exitCode:0,stdout:Wi,stderr:""};if(r==="full")return $c(Wi,"full",t,n);if(r==="topic"){let s=Yi(e[1]);if(s)return $c(s,e[1]??"overview",t,n);let a=new URLSearchParams;return e[1]&&a.set("topic",e[1]),await F(`/api/v1/help${ye(a)}`,t,n,"Help topic loaded.")}if(r==="standards")return await F("/api/v1/standards",t,n,"Marketplace standards loaded.");if(r==="marketplace-status"){let s=await C(n,"/api/v1/marketplace/status");return t.json?b(s,"Marketplace status loaded.",!0,n):b($$(s),"Marketplace status loaded.",!1,n)}if(r==="capabilities"){let s=await C(n,"/api/v1/capabilities");return b(O$(s),"Edition capabilities loaded.",t.json,n)}if(r==="schema-plan")return _("help schema-plan is not included in the public npm CLI.",t.json);if(r==="optimize-tokens"){let s=R(t.text,"help optimize-tokens requires --text."),a=N$(t.maxCharacters,t.json);if(Z(a))return a;let o=await C(n,"/api/v1/optimize-tokens",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({text:s,...a?{maxCharacters:a}:{}})});return b(o,"Token optimization complete.",t.json,n)}return _(`Unknown help command "${r}".`,t.json)}function $c(e,t,n,i){return n.json?b({status:"ok",topic:t,content:e},"Help topic loaded.",!0,i):{exitCode:0,stdout:e,stderr:""}}function Kc(e,t){let n=e.filter(Boolean).join(" ").trim()||"help";return P({status:"not_found",reasonCode:"help_topic_not_found",topic:n,nextAction:"help",nextStep:"Run `skills-layer --help`, `skills-layer help full`, or `skills-layer <command> --help` for a supported command."},`Help topic not found: ${n}.`,t,"help_topic_not_found")}async function RI(e,t,n){let i=R(e[0]??t.path,"validate requires a file or directory."),r=Pe(n.cwd,i);if(!await st(r))return tk("validate",i,t,n);let s=(await xn({cwd:n.cwd,sourcePath:i})).files;s=await CI({files:s,resolvedTarget:r,flags:t,backend:n});let a=qt(s),o={files:s,sourceIntakeContext:k(t.sourceIntakeContext),publicationStatus:k(t.publicationStatus),dependencyAuditStatus:k(t.dependencyAuditStatus),category:k(t.category),discloseSource:!!t.discloseSource,allowFindingsFeatured:!!t.allowFindingsFeatured},l;try{l=await C(n,"/api/v1/validation/preview",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(B(o))})}catch(d){if(d instanceof D&&d.status===422&&d.details)l=mL(d.details);else throw d}let c=EI({...l,license:a.license,licenseIssues:a.issues.filter(d=>d.code.startsWith("license_"))},s);return t.json?b(c,"Validation complete.",!0,n):{exitCode:0,stdout:j$(c,i,n),stderr:""}}async function CI(e){if(qt(e.files).license?.status==="verified"||e.flags.json||!e.backend.stdoutIsTty)return e.files;let n=await Wl({cwd:e.backend.cwd,files:e.files,skip:!1,interactive:!0,prompt:Ey(e.backend)});if(n.selection.mode==="skip"||await e.backend.promptSelect("Apply this licence change to the local bundle?",[{value:"apply",label:"Apply the reviewed change"},{value:"cancel",label:"Cancel without changing files"}])!=="apply")return e.files;let s=(await lu(e.resolvedTarget)).isDirectory()?e.resolvedTarget:ge(e.resolvedTarget);return await Kl({targetDir:s,files:Hg(e.files,n.selection),confirmed:!0}),(await xn({cwd:e.backend.cwd,sourcePath:s})).files}function EI(e,t){return{...e,evalReadiness:im(t)}}function xI(e,t){let n=II(e);return En({status:n?"not_run":"generated_only",skillSlug:t.skillSlug,version:t.version,artifactDigest:Re(e),...n?{evalPackDigest:n}:{},generatedAt:t.generatedAt,runnerVersion:Ht,counts:{cases:0,assertions:0,passed:0,failed:0,skipped:0}})}function II(e){let t=e.find(n=>{let i=Mt(n.path,e);return i.type==="evidence"&&typeof n.content=="string"&&(i.relativePath.startsWith("evals/")||i.relativePath.endsWith(".eval.json")||i.relativePath.endsWith(".eval.yaml"))});if(t?.content)try{return Cn(JSON.parse(t.content))}catch{return}}async function TI(e,t,n){let i=R(e[0]??t.path,"preview-trigger requires a file or directory."),r=Pe(n.cwd,i);if(!await st(r))return tk("preview-trigger",i,t,n);let s=(await xn({cwd:n.cwd,sourcePath:i})).files,a=await C(n,"/api/v1/validation/trigger-preview",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({files:s,shouldTriggerPrompts:t.shouldTrigger,shouldNotTriggerPrompts:t.shouldNotTrigger,paraphrasePrompts:t.paraphrase})});return t.json?b(a,"Trigger preview complete.",!0,n):{exitCode:0,stdout:B$(a,i,n),stderr:""}}async function $I(e,t,n){let i=e[0];if(i==="init")return await LI(e.slice(1),t,n);if(i==="rules")return await F("/api/v1/creator/rules",t,n,"Creator rules loaded.");if(i==="submissions")return await F("/api/v1/me/submissions",t,n,"Submissions loaded.",{authenticated:!0});if(i==="status"){let r=R(e[1],"creator status requires a skill slug.");try{return await F(`/api/v1/me/submissions/${encodeURIComponent(r)}/status`,t,n,"Submission status loaded.",{authenticated:!0})}catch(s){if(s instanceof D&&s.status===404)return qI(r,t);throw s}}if(i==="charge-status"){let r=R(e[1],"creator charge-status requires a charge id.");return await F(`/api/v1/me/private-skill-charges/${encodeURIComponent(r)}`,t,n,"Charge status loaded.",{authenticated:!0})}if(i==="submit")return await Nh(e.slice(1),t,n,!1);if(i==="submit-version")return await Nh(e.slice(1),t,n,!0);if(i==="check-slug"){let r=R(e[1],"creator check-slug requires a slug.");return await FI(r,t,n)}if(i==="rename"){let r=R(e[1],"creator rename requires the current slug."),s=R(e[2],"creator rename requires the new slug."),a=Ay("creator.rename",s,t);return a||await Yt(`/api/v1/me/submissions/${encodeURIComponent(r)}/slug`,{nextSkillSlug:s},t,n,"Skill renamed.")}if(i==="pricing")return await UI(e,t,n);if(i==="update-listing"){let r=R(e[1],"creator update-listing requires a skill slug.");return await VI(r,t,n)}if(i==="visibility"){let r=R(e[1],"creator visibility requires a skill slug."),s=xt("creator.visibility",t);if(s)return s;let a=k(t.visibility)??e[2],o=ca(a);if(!o||!tr.includes(o))return P({status:"error",reasonCode:"invalid_visibility",skillSlug:r,visibility:a??null,acceptedValues:tr,nextAction:"creator.visibility",nextStep:"Use --visibility private, public, or unlisted."},`Invalid creator visibility "${a??""}". Use one of: ${tr.join(", ")}.`,t.json,"invalid_visibility");let l=await C(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/visibility`,{method:"PATCH",headers:j(n.apiKey),body:JSON.stringify(B({visibility:o,dryRun:t.dryRun}))});return X0(l)?P(l,Q0(l,r),t.json,u(l,"reasonCode")??u(l,"status")):b(l,t.dryRun?"Visibility preview loaded.":"Visibility updated.",t.json,n)}if(i==="security-report"){let r=R(e[1],"creator security-report requires a skill slug."),s=Ry("creator.security-report",t);if(s)return s;let a=xt("creator.security-report",t);if(a)return a;let o=new URLSearchParams;ie(o,"format",t.format),ie(o,"version",t.version),ie(o,"versionId",t.versionId);let l=await C(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/trust${ye(o)}`,{headers:V(n.apiKey,n.authBlockedMessage)});return t.json||t.verbose?b(l,"Creator security report loaded.",t.json,n):{exitCode:0,stdout:Q$(l,r,n),stderr:""}}if(i==="rescan-security"){let r=R(e[1],"creator rescan-security requires a skill slug."),s=xt("creator.rescan-security",t);if(s)return s;let a=await C(n,`/api/v1/me/submissions/${encodeURIComponent(r)}/trust/rescan`,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(B(he(t,["version","versionId"])))});return t.json?b(a,"Security rescan requested.",!0,n):{exitCode:0,stdout:eL(a,r,n),stderr:""}}if(i==="provenance"){let r=R(e[1],"creator provenance requires a skill slug.");return await F(`/api/v1/me/submissions/${encodeURIComponent(r)}/provenance`,t,n,"Provenance loaded.",{authenticated:!0})}if(i==="claim"||i==="verify"||i==="dispute")return await GI(i,e,t,n);if(i==="issues"||i==="reviews"||i==="update-issue"||i==="moderate-review")return await ZI(i,e,t,n);if(i==="analytics"){let r=R(e[1],"creator analytics requires a skill slug.");return await zI(r,t,n)}if(i==="earnings")return await F("/api/v1/me/earnings",t,n,"Creator earnings loaded.",{authenticated:!0});if(i==="payout-profile")return await KI(t,n);if(i==="payout-link")return await HI(t,n);if(i==="payouts")return await F("/api/v1/me/payouts",t,n,"Creator payouts loaded.",{authenticated:!0});if(i==="withdraw"){if(!k(t.amountCents))return _("creator withdraw requires --amount-cents.",t.json);let r=Xt(t.amountCents,"--amount-cents","amountCents","invalid_amount_cents",t,{minimum:1});if(r.failure)return r.failure;let s=k(t.idempotencyKey)??u$();if(t.json||!n.stdoutIsTty)return P({status:"blocked",reasonCode:"payout_human_confirmation_required",nextAction:"creator.withdraw",nextStep:"Use an interactive terminal. MCP returns a browser handoff, and automation credentials cannot withdraw."},"Creator withdrawal requires an interactive human confirmation. Use an interactive terminal; MCP returns a browser handoff and automation credentials cannot withdraw.",t.json,"payout_human_confirmation_required");let a=B({amountCents:r.value,reason:k(t.reason)}),o={...j(n.apiKey),"idempotency-key":s},l=await C(n,"/api/v1/me/payouts",{method:"POST",headers:o,body:JSON.stringify(a)});if(l.status!=="confirmation_required"||typeof l.confirmationId!="string"||typeof l.confirmationToken!="string"||typeof l.confirmationPhrase!="string")throw new Error("The payout service did not return a valid action-bound confirmation challenge.");let c=l.impact&&typeof l.impact=="object"?l.impact:{};if(await n.promptText(`Withdrawal impact: ${String(c.amountCents??r.value)} ${String(c.currency??"gbp").toUpperCase()}, remaining withdrawable balance ${String(c.withdrawableAfterCents??"unknown")} cents.
+Type exactly "${l.confirmationPhrase}" to confirm: `)!==l.confirmationPhrase)return _("Withdrawal cancelled; the confirmation phrase did not match.",!1);let p=await C(n,"/api/v1/me/payouts",{method:"POST",headers:o,body:JSON.stringify({...a,confirmationId:l.confirmationId,confirmationToken:l.confirmationToken,confirmationPhrase:l.confirmationPhrase})});return b(p,"Withdrawal requested.",!1,n)}return i==="source"?await e0(e.slice(1),t,n):_(`Unknown creator command "${i??""}".`,t.json)}async function LI(e,t,n){let i=k(t.skill)??e[0]??"my-skill",r=Ay("creator.init",i,t);if(r)return r;let s=Pe(n.cwd,k(t.dir)??i),a;try{a=Og(k(t.type))}catch(m){return _(X(m),t.json)}let o=k(t.category),l=await Mg(s),c=await Wl({cwd:n.cwd,files:l.files,explicitIdentifier:k(t.license),explicitLicenseFile:k(t.licenseFile),skip:!!t.skipLicense,interactive:!t.json&&n.stdoutIsTty,prompt:Ey(n)}),d=Ng({skillSlug:i,description:k(t.description)??"Describe what this skill helps an agent do.",skillType:a,category:o,licenseSelection:c.selection}),p=await Kl({targetDir:s,files:d,confirmed:t.confirmed});if(p.status==="confirmation_required"){let m={status:"confirmation_required",reasonCode:"scaffold_overwrite_confirmation_required",targetDir:p.plan.targetDir,changes:p.plan.changes,preservedEntryCount:p.plan.preservedEntryCount,nextAction:"creator.init",nextStep:"Review the reported create/replace diff, then rerun with --confirm only if every replacement is intended."};return P(m,OI(p.plan),t.json,"scaffold_overwrite_confirmation_required")}let f=qt(d),g=K(p.plan.targetDir,"SKILL.md"),h=B({status:p.status,path:g,skillSlug:i,skillType:a,category:o,fileCount:d.length,licenseStatus:f.license?.status??"unspecified",licenseIdentifier:f.license?.identifier??void 0,licenseSource:c.source,warnings:f.issues.filter(m=>m.severity==="warning"),validation:f});return t.json?b(h,`Created ${g}.`,!0,n):{exitCode:0,stdout:G$(h,p.plan.targetDir,g,n),stderr:""}}function Ey(e){return{select:(t,n)=>e.promptSelect(t,n),text:t=>e.promptText(t)}}function OI(e){let t=e.changes.map(n=>`- ${n.action} ${n.path} (${n.previousBytes??0} -> ${n.nextBytes} bytes)`);return[`Creator init target already contains files at ${e.targetDir}.`,...t,"Re-run with --confirm only after reviewing every replacement."].join(`
+`)}async function st(e){try{return await fy(e),!0}catch{return!1}}async function Nh(e,t,n,i){let r=k(t.visibility);if(r){let y=ca(r);if(!y||!tr.includes(y))return Wt(i?"creator.submit-version":"creator.submit","visibility",r,tr,t,"invalid_visibility")}let s=Xt(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(s.failure)return s.failure;let a=i?R(k(t.skill)??e[0],"creator submit-version requires a skill slug."):k(t.skill),o=R(k(t.source)??(i?e[1]:e[0])??t.path,`creator ${i?"submit-version":"submit"} requires a <path-or-source> or --source <source>.`),l=await Sa(o,n.cwd);if(t.list)return await NI(o,l,a,t,n);let c=xt(i?"creator.submit-version":"creator.submit",t);if(c)return c;if(k(t.source)&&!l&&$k(o))return jI(o,t);let d=l?.files??(await xn({cwd:n.cwd,sourcePath:o})).files;if(!i&&!t.dryRun){let y=await BI(d,t,n);if(y)return y}let p=B({files:d,version:k(t.version),dryRun:t.dryRun,evalSummary:xI(d,{skillSlug:a??Iy(d)??"unknown",version:k(t.version)??"0.0.0",generatedAt:n.now()}),allowFindingsFeatured:t.allowFindingsFeatured,pricing:s.value!==void 0?{priceCents:s.value}:void 0,...l?{sourceMetadata:l.sourceMetadata}:{},...he(t,["displayName","skillType","category","visibility","source","skill"])}),f=i&&a?`/api/v1/me/submissions/${encodeURIComponent(a)}/versions`:"/api/v1/me/submissions",g=await C(n,f,{method:"POST",headers:j(n.apiKey),body:JSON.stringify(p)});if(t.json||t.noOpen||g.status!=="checkout_required"||typeof g.checkoutUrl!="string"||typeof g.chargeId!="string")return b(g,i?"Version submitted.":"Submission uploaded.",t.json,n);n.emitInfo("Opening payment setup for skill submission. Complete the payment in your browser, then come back here."),await n.openUrl(g.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${g.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let m=await s$(g.chargeId,n);return Z(m)?m:m.status!=="submitted"?b({...g,chargeStatus:m.status},`Payment is still ${m.status}. You can rerun \`skills-layer creator charge-status ${g.chargeId}\` to continue tracking it.`,t.json,n):b(m,i?"Version submitted.":"Submission uploaded.",t.json,n)}async function NI(e,t,n,i,r){if(t)return b(jh(Uy(e,t,n)),"Source skills loaded.",i.json,r);let s=await Jy(r,e,{source:e,skillSlug:n,listOnly:!0,operation:"creator.submit"},i);return s.kind==="failure"?s.result:b(jh(s.inspection),"Source skills loaded.",i.json,r)}function jh(e){return{...e,sourceSubmissionSupported:!0}}function jI(e,t){let i=`skills-layer source connection start --provider ${Zy(e)} --source ${e} --visibility private --provenance-intent private_source_import`;return P({status:"source_connection_required",reasonCode:"source_connection_required",source:e,nextAction:"source.connection.start",nextStep:i},`Creator submit can list ${e} safely, but publishing from a remote source requires a source connection. Run \`${i}\`.`,t.json,"source_connection_required")}async function BI(e,t,n){let i=k(t.skill)??Iy(e);if(!i)return null;let r;try{r=await C(n,`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(i)}`,{headers:V(n.apiKey,n.authBlockedMessage)})}catch(s){if(s instanceof D&&s.status===404)return xy(i,t);throw s}if(r.available===!1||u(r,"reasonCode")==="unavailable"||u(r,"reasonCode")==="reserved"){let s=u(r,"assignedSlug"),a=B({status:"duplicate_candidate",reasonCode:u(r,"reasonCode")??"slug_unavailable",requestedSlug:i,assignedSlug:s,nextAction:"creator.status",nextStep:`Run \`skills-layer creator status ${i}\`, \`skills-layer creator submissions\`, or submit a new version of the existing skill instead of creating a duplicate listing.`});return P(a,`A public skill slug "${i}" already exists or is not available. Run \`skills-layer creator status ${i}\`, check your creator submissions, or submit a new version instead of creating a duplicate listing.`,t.json,u(a,"reasonCode"))}return null}async function FI(e,t,n){try{let i=await C(n,`/api/v1/me/creator/slug-check?slug=${encodeURIComponent(e)}`,{headers:V(n.apiKey,n.authBlockedMessage)});return b(DI(i),"Slug status loaded.",t.json,n)}catch(i){if(i instanceof D&&i.status===404)return xy(e,t);throw i}}function xy(e,t){let n={status:"slug_check_unavailable",reasonCode:"slug_check_route_unavailable",requestedSlug:e,nextAction:"creator.status",nextStep:`Slug availability could not be checked on the selected backend. Run \`skills-layer creator submissions\`, \`skills-layer creator status ${e}\`, or retry after selecting a compatible Skills Layer backend.`};return P(n,`Slug availability could not be checked for ${e} on the selected backend. Run \`skills-layer creator submissions\` or retry after selecting a compatible Skills Layer backend.`,t.json,"slug_check_route_unavailable")}function DI(e){let t=e.available===!0,n=u(e,"assignedSlug");if(t)return B({requestedSlug:u(e,"requestedSlug"),available:!0,reasonCode:u(e,"reasonCode")??"available",assignedSlug:n});let i=E(e,"slugAssignment"),r=Array.isArray(i?.candidateSlugs)?i.candidateSlugs.filter(s=>typeof s=="string").slice(0,5):void 0;return B({...e,...i?{slugAssignment:{...i,...r?{candidateSlugs:r}:{}}}:{},...r?{candidateSlugs:r}:{}})}function qI(e,t){return P({status:"not_submitted",reasonCode:"creator_submission_not_found",skillSlug:e,nextAction:"creator.submit",nextStep:"Run `skills-layer creator submit <path> --dry-run` to validate a local skill before submitting it, or run `skills-layer creator submissions` to see your existing submissions."},`No creator submission was found for ${e}. Run \`skills-layer creator submit <path> --dry-run\` before checking status.`,t.json,"creator_submission_not_found")}function Iy(e){let t=e.find(i=>i.path.split("/").pop()?.toLowerCase()==="skill.md");if(!t)return;let n=/^---\s*\n(?<body>[\s\S]*?)\n---/u.exec(t.content??"")?.groups?.body?.split(/\r?\n/u).map(i=>i.match(/^name\s*:\s*(?<name>.+?)\s*$/u)?.groups?.name?.trim().replace(/^["']|["']$/gu,"")).find(i=>!!i);return MI(n??me(ge(t.path)))}function MI(e){return e?.toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||void 0}async function UI(e,t,n){let i=R(e[1],"creator pricing requires a skill slug."),r=xt("creator.pricing",t);if(r)return r;let s=new URLSearchParams;if(ie(s,"version",t.version),!t.priceCents)return await F(`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing${ye(s)}`,t,n,"Pricing loaded.",{authenticated:!0});let a=Xt(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(a.failure)return a.failure;let o=a.value??0,l=await C(n,`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing${ye(s)}`,{headers:V(n.apiKey,n.authBlockedMessage)}),c=U(l,"priceCents")??0;if(o>c){let d=B({status:"pending_approval",reasonCode:c===0?"paid_activation_requires_approval":"price_increase_requires_approval",skillSlug:i,version:u(l,"version"),currentPriceCents:c,requestedPriceCents:o,currency:u(l,"currency")??"gbp",nextStep:"Pricing changes that increase buyer-facing cost require approval. Keep the current price for now, then retry after approval is available."});return b(d,"Pricing change requires approval before it can affect buyers.",t.json,n)}return await Yt(`/api/v1/me/submissions/${encodeURIComponent(i)}/pricing`,{priceCents:o,version:k(t.version)},t,n,"Pricing updated.")}async function VI(e,t,n){let i=Je("creator.update-listing","listingStatus",t.listingStatus,eI,t,"invalid_listing_status","listing-status");if(i)return i;try{return await Yt(`/api/v1/me/submissions/${encodeURIComponent(e)}`,he(t,["displayName","summary","description","category","skillType","license","listingStatus"]),t,n,"Listing updated.")}catch(r){if(r instanceof D&&r.status===404){let s={status:"listing_not_found_or_not_editable",reasonCode:"creator_listing_not_found_or_not_owned",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see editable listings, or \`skills-layer show ${e}\` to inspect the public catalog entry.`};return P(s,`No editable creator listing was found for ${e}. Run \`skills-layer creator submissions\` to see listings you can update.`,t.json,"creator_listing_not_found_or_not_owned")}throw r}}async function GI(e,t,n,i){let r=R(t[1],`creator ${e} requires a skill slug.`);if(e==="claim"){let s=Je("creator.claim","requestedRole",n.requestedRole,Qx,n,"invalid_requested_role","requested-role");if(s)return s}try{if(e==="claim")return await H(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/claim`,he(n,["requestedRole","message"]),n,i,"Ownership claim submitted.");if(e==="verify"){let s=R(n.claimId,"creator verify requires --claim-id.");return await H(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/verify`,{claimId:s},n,i,"Ownership claim verified.")}return R(n.message,"creator dispute requires --message."),await H(`/api/v1/me/skills/${encodeURIComponent(r)}/ownership/dispute`,he(n,["message"]),n,i,"Ownership dispute submitted.")}catch(s){if(s instanceof D&&s.status===404){let a={status:"ownership_action_unavailable",reasonCode:e==="claim"?"skill_not_found_or_not_claimable":"ownership_claim_not_found",skillSlug:r,requestedRole:k(n.requestedRole),nextAction:e==="claim"?"search":"creator.claim",nextStep:e==="claim"?`Run \`skills-layer search ${r}\`, \`skills-layer show ${r}\`, or submit/source-install the skill before claiming it.`:`Run \`skills-layer creator claim ${r}\` to start a new claim if the skill is claimable.`};return P(a,e==="claim"?`No claimable skill was found for ${r}. Search or show the skill first, then claim it only when it exists and is claimable.`:`No matching ownership claim was found for ${r}. Start a new claim if the skill is claimable.`,n.json,u(a,"reasonCode")??"ownership_action_unavailable")}throw s}}async function zI(e,t,n){try{return await F(`/api/v1/me/submissions/${encodeURIComponent(e)}/analytics`,t,n,"Analytics loaded.",{authenticated:!0})}catch(i){if(i instanceof D&&i.status===404){let r={status:"no_creator_submission",reasonCode:"creator_submission_not_found",skillSlug:e,nextAction:"creator.submissions",nextStep:`Run \`skills-layer creator submissions\` to see skills you own, \`skills-layer show ${e}\` to inspect the catalog listing, or \`skills-layer creator claim ${e}\` if it is a claimable public-source skill.`};return P(r,`No creator-owned analytics submission was found for ${e}. Run \`skills-layer creator submissions\`, \`skills-layer show ${e}\`, or \`skills-layer creator claim ${e}\` if you should manage it.`,t.json,"creator_submission_not_found")}throw i}}async function KI(e,t){let n=await C(t,"/api/v1/me/payout-profile",{headers:V(t.apiKey,t.authBlockedMessage)});return b(n,"Creator payout profile loaded.",e.json,t)}async function HI(e,t){let n=JI(k(e.mode));if(e.mode&&n===null)return _("creator payout-link --mode must be account_onboarding|account_update|onboarding|update.",e.json);let i;try{i=await C(t,"/api/v1/me/payout-profile/link",{method:"POST",headers:j(t.apiKey),body:JSON.stringify(n?{mode:n}:{})})}catch(s){if(s instanceof D&&YI(s))return P({status:"payout_setup_already_submitted",reasonCode:"payout_update_link_unavailable",nextAction:"creator.payout-profile",nextStep:"Run `skills-layer creator payout-profile` to confirm readiness, then use `skills-layer creator earnings` or `skills-layer creator withdraw --amount-cents <amount>`."},"Payout setup is already submitted for this account. Run `skills-layer creator payout-profile` to confirm readiness before requesting a withdrawal.",e.json,"payout_update_link_unavailable");throw s}let r=a$(i);return r&&WI(e)&&e.showUrl!==!0&&(t.emitInfo("Opening payout setup in your browser. Finish the flow there, then come back here."),await t.openUrl(r)||t.emitInfo(`Open this payout setup URL manually to continue: ${r}`)),b(i,"Payout setup link created.",e.json,t)}function JI(e){if(!e)return null;let t=e.trim().toLowerCase();return t==="account_onboarding"||t==="onboarding"?"account_onboarding":t==="account_update"||t==="update"?"account_update":null}function WI(e){return!e.json&&!e.noOpen}function YI(e){let t=`${e.message} ${u(e.details??{},"error")??""}`.toLowerCase();return t.includes("account_update")&&t.includes("account_onboarding")&&t.includes("account link")}async function ZI(e,t,n,i){let r=R(t[1],`creator ${e} requires a skill slug.`);if(e==="issues")return await F(`/api/v1/me/library/${encodeURIComponent(r)}/issues`,n,i,"Issues loaded.",{authenticated:!0});if(e==="reviews")return await F(`/api/v1/me/submissions/${encodeURIComponent(r)}/reviews`,n,i,"Reviews loaded.",{authenticated:!0});if(e==="update-issue"){let l=R(n.issueId,"creator update-issue requires --issue-id."),c=R(n.status,"creator update-issue requires --status."),d=Je("creator.update-issue","status",c,tI,n,"invalid_issue_status");if(d)return d;let p=xt("creator.update-issue",{...n,version:n.fixedVersion});if(p)return p;try{return await Yt(`/api/v1/me/skills/${encodeURIComponent(r)}/issues/${encodeURIComponent(l)}`,he(n,["status","fixedVersion","note"]),n,i,"Issue updated.")}catch(f){if(f instanceof D&&f.status===404)return XI(r,l,n);throw f}}let s=R(n.reviewId,"creator moderate-review requires --review-id."),a=R(n.status,"creator moderate-review requires --status."),o=Je("creator.moderate-review","status",a,nI,n,"invalid_review_status");if(o)return o;try{return await H(`/api/v1/me/submissions/${encodeURIComponent(r)}/reviews/${encodeURIComponent(s)}/moderate`,he(n,["status","reason"]),n,i,"Review updated.")}catch(l){if(l instanceof D&&l.status===404)return QI(r,s,n);throw l}}function XI(e,t,n){return P({status:"not_found",reasonCode:"issue_not_found",skillSlug:e,issueId:t,nextAction:"creator.issues",nextStep:`Run \`skills-layer creator issues ${e}\` to inspect open issues before updating one.`},`Issue ${t} was not found for ${e}. Run \`skills-layer creator issues ${e}\` first.`,n.json,"issue_not_found")}function QI(e,t,n){return P({status:"not_found",reasonCode:"review_not_found",skillSlug:e,reviewId:t,nextAction:"creator.reviews",nextStep:`Run \`skills-layer creator reviews ${e}\` to inspect review ids before moderating one.`},`Review ${t} was not found for ${e}. Run \`skills-layer creator reviews ${e}\` first.`,n.json,"review_not_found")}async function e0(e,t,n){let i=e[0],r=R(e[1],`creator source ${i??""} requires a source connection id.`),s=k(t.skill)??e[2];if(i==="prepare"){let a=xt("creator.source.prepare",t);if(a)return a;let o=Je("creator.source.prepare","visibility",t.visibility,Fn,t,"invalid_visibility");if(o)return o;let l=Xt(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});return l.failure?l.failure:await H(`/api/v1/me/source-connections/${encodeURIComponent(r)}/prepare`,B({...he(t,["skill","source","version","displayName","skillType","category","visibility"]),...l.value!==void 0?{priceCents:l.value}:{},source:k(t.source)??e[2]}),t,n,"Source release prepared.")}if(i==="publish-request"){let a=xt("creator.source.publish-request",t);if(a)return a;let o=Je("creator.source.publish-request","visibility",t.visibility,Fn,t,"invalid_visibility");if(o)return o;let l=Xt(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(l.failure)return l.failure;let c=t.approvalRequestId.length>0?t.approvalRequestId:k(t.approvalRequestId)?[String(t.approvalRequestId)]:[];return await H(`/api/v1/me/source-connections/${encodeURIComponent(r)}/publish-request`,B({skillSlug:s,approvalRequestIds:c,version:k(t.version),...he(t,["visibility","license","discloseSource"]),...l.value!==void 0?{priceCents:l.value}:{}}),t,n,"Source publish requested.")}if(i==="release-status"){let a=new URLSearchParams;return s&&a.set("skill",s),await F(`/api/v1/me/source-connections/${encodeURIComponent(r)}/release-status${ye(a)}`,t,n,"Source release status loaded.",{authenticated:!0})}return _(`Unknown creator source command "${i??""}".`,t.json)}async function Ca(e,t,n){let i=Cy("install",t);if(i)return i;let r=k(t.source);if(r){let p=k(t.skill),f=Dh(r,p,t);if(f)return f;let g=await Sa(r,n.cwd);if(g)return await Fh(r,g,p,t,n);let h=qh(r,t);if(h)return h;let m=t.list||t.dryRun||!p&&!t.json&&!t.all,y=await Vh(n,r,{source:r,skillSlug:p,listOnly:m},t);if(y.kind==="failure")return y.result;let w=y.inspection;if(t.list)return b(w,"Source skills loaded.",t.json,n);let v=Zc(r,w,t);if(v)return v;let S=await ya({source:r,inspection:w,requestedSkillSlug:p,mode:"install",flags:t,backend:n});if(S.kind==="failure")return S.result;if(t.dryRun)return b(Yc(r,w,S.skillSlug,t),"Source install preview ready.",t.json,n);let A=t.all?dt(w).map(O=>O.value):[S.skillSlug??dt(w)[0]?.value??me(r)],x=await _h(n,A,t);if(x)return x;let $;try{$=await Uh({source:r,skillSlug:S.skillSlug,flags:t,backend:n,sourceAccess:y.sourceAccess})}catch(O){if(O instanceof D)return Gh(r,O,t);throw O}return await Hc({backend:n,result:$,fallbackSlug:S.skillSlug??u($,"skillSlug")??r,source:r,sourceAccess:y.sourceAccess,flags:t})}let s=R(e[0]??t.install,"install requires a skill slug or --source.");if($k(s)){let p=Dh(s,k(t.skill),t);if(p)return p;let f=await Sa(s,n.cwd);if(f)return await Fh(s,f,k(t.skill),t,n);let g=qh(s,t);if(g)return g;let h=k(t.skill),m,y="unknown",w=async O=>{if(m)return null;let I=await Vh(n,s,{source:s,skillSlug:h,listOnly:O},t);return I.kind==="failure"?I.result:(m=I.inspection,y=I.sourceAccess,null)};if(t.list){let O=await w(!0);return O||b(m,"Source skills loaded.",t.json,n)}if(!h&&!t.json&&!t.all){let O=await w(!0);if(O)return O;let I=m,G=Zc(s,I,t);if(G)return G;let se=await ya({source:s,inspection:I,requestedSkillSlug:h,mode:"install",flags:t,backend:n});if(se.kind==="failure")return se.result;h=se.skillSlug}if(t.dryRun){let O=await w(!0);if(O)return O;let I=m,G=await ya({source:s,inspection:I,requestedSkillSlug:h,mode:"install",flags:t,backend:n});return G.kind==="failure"?G.result:(h=G.skillSlug,b(Yc(s,I,h,t),"Source install preview ready.",t.json,n))}let v=await w(!1);if(v)return v;let S=m,A=t.all?dt(S).map(O=>O.value):[h??dt(S)[0]?.value??me(s)],x=await _h(n,A,t);if(x)return x;let $;try{$=await Uh({source:s,skillSlug:h,flags:t,backend:n,sourceAccess:y})}catch(O){if(O instanceof D)return Gh(s,O,t);throw O}return await Hc({backend:n,result:$,fallbackSlug:h??u($,"skillSlug")??me(s),source:s,sourceAccess:y,flags:t})}if(k(t.scope)==="workspace"){let p=R(t.workspace,"workspace installs require --workspace <workspace-id>."),f=await C(n,`/api/v1/workspaces/${encodeURIComponent(p)}/skills/${encodeURIComponent(s)}/approve`,{method:"POST",headers:j(n.apiKey),body:JSON.stringify({dryRun:t.dryRun})});return t.dryRun?await j0(f,"Workspace approval preview ready.",t,n):b(f,"Workspace approval requested.",t.json,n)}if(!t.dryRun){let p=await mu(n,s,t);if(p)return p}let a=await t0(s,t,n);if("result"in a)return a.result;let o=a.flags,l=await C(n,"/api/v1/install",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(B({skillSlug:s,version:k(o.version),scope:k(o.scope),agent:k(o.agent),dryRun:t.dryRun}))});if(t.dryRun)return await O0(l,t,n);let c=await Ty(n,l,s,o);if(Z(c))return c;let d=await jy(n,c,s,o);return await wk(n,d,s),Qc(d,"Skill installed.",t.json,n)}async function t0(e,t,n){let i=k(t.scope),r=k(t.agent);if(t.json||t.dryRun||!n.stdoutIsTty||i==="workspace"||i==="local"||i!==void 0&&r!==void 0)return{flags:t};let s=We(n.env,n.platform,n.cwd),a=n0(n),o=await i0(n.paths.installTargetPreferencePath),l=o?.workingModeId===a,c=l&&o?.agent?s.find(S=>S.id===o.agent):void 0,d=c&&o?.scope?o.scope==="global"?c.targets.globalSkillsPath:c.targets.projectSkillsPath:void 0;if(r===void 0&&i===void 0&&o?.policy==="recheck_every_5"&&l&&c!==void 0&&(o.scope==="project"||o.scope==="global")&&d!==void 0&&o.usesSinceConfirmation>0&&o.usesSinceConfirmation<4)return await xe(n.paths.installTargetPreferencePath,{...o,usesSinceConfirmation:o.usesSinceConfirmation+1,savedAt:n.now()}),{flags:{...t,agent:c.id,scope:o.scope}};let f=await ja({env:n.env,platform:n.platform,cwd:n.cwd,pathExists:st}),g=f.filter(S=>S.detectionSources.includes("project")),h=r??J(n.env.SKILLS_LAYER_AGENT),m=h?s.find(S=>S.id===h):void 0;if(h&&!m)return{result:_(`Unsupported agent "${h}". Run \`skills-layer agents list\` to choose a supported install target.`,t.json)};if(!m&&g.length===1&&(m=g[0]),!m){let S=J(n.config?.lastSelectedAgent);m=S?f.find(A=>A.id===S)??s.find(A=>A.id===S):void 0}if(!m&&f.length===1&&(m=f[0]),!m&&f.length>1){let S=await n.promptSelect("Multiple supported agents were detected. Select one to install for:",f.map(A=>({value:A.id,label:`${A.displayName} (${A.detectionSources.join(", ")})`})));m=f.find(A=>A.id===S)}if(!m)return{result:_("No supported local agent was detected. Run `skills-layer agents list`, then retry with --agent <agent> and --scope <project|global>.",t.json)};let y=i;if(!y){let S=[{value:"project",label:"Project (this folder)"}];m.targets.globalSkillsPath&&S.push({value:"global",label:"Global (all projects)"}),y=S.length===1?S[0].value:await n.promptSelect(`Install ${e} for ${m.displayName} where?`,S)}let w=r!==void 0||i!==void 0,v=o?.policy==="ask_every_time"&&l;if(!w&&!v&&(y==="project"||y==="global")){let S=y==="project"?"Project":"Global",x=await n.promptSelect(`Remember ${m.displayName} / ${S} for future installs?`,[{value:"recheck_every_5",label:"Yes - recheck on every 5th install"},{value:"ask_every_time",label:"No - ask every time"}])==="recheck_every_5"?{version:1,policy:"recheck_every_5",agent:m.id,scope:y,usesSinceConfirmation:1,workingModeId:a,savedAt:n.now()}:{version:1,policy:"ask_every_time",usesSinceConfirmation:0,workingModeId:a,savedAt:n.now()};await xe(n.paths.installTargetPreferencePath,x)}return{flags:{...t,agent:m.id,scope:y}}}function n0(e){return e.apiKey?J(e.config?.workingModeId)??"personal":"anonymous"}async function i0(e){let t=await le(e);return!L(t)||t.version!==1||t.policy!=="recheck_every_5"&&t.policy!=="ask_every_time"||typeof t.workingModeId!="string"||typeof t.savedAt!="string"||typeof t.usesSinceConfirmation!="number"||!Number.isInteger(t.usesSinceConfirmation)||t.usesSinceConfirmation<0||t.agent!==void 0&&typeof t.agent!="string"||t.scope!==void 0&&t.scope!=="project"&&t.scope!=="global"?null:t}async function Ty(e,t,n,i,r={}){let s=r0(e,t,n,i);if(s.status==="skip")return t;if(s.status==="failure")return P({status:"materialization_target_invalid",reasonCode:"materialization_target_invalid",skillSlug:s.skillSlug,nextStep:s.nextStep},s.message,i.json,"materialization_target_invalid");let a=await s0(e,t,s.skillSlug,s.version,r),o=await Ly({backend:e,exportResult:a,flags:i,skillSlug:s.skillSlug});if(Z(o))return o;let l=await f0({backend:e,skillSlug:s.skillSlug,scope:s.scope,agent:s.agent,skillsPath:s.skillsPath,bytes:o.bytes,files:o.files,envelope:o.envelope,approval:o.approval});return{...t,...c0(a),archiveSha256:o.archiveSha256,archiveHashFormat:o.archiveHashFormat,scope:s.scope,agent:s.agent.id,targetAgent:s.agent.id,materializationPlan:{scope:s.scope,agent:s.agent.id},...l}}function r0(e,t,n,i){let r=E(t,"materializationPlan")??E(t,"installPlan"),s=k(i.scope)??u(t,"scope")??(r?u(r,"scope"):void 0);if(s!=="project"&&s!=="global")return{status:"skip"};let a=u(t,"skillSlug")??u(t,"slug")??n,o=k(i.agent)??u(t,"agent")??u(t,"targetAgent")??(r?u(r,"agent")??u(r,"targetAgent"):void 0)??J(e.config?.lastSelectedAgent)??"codex",l=We(e.env,e.platform,e.cwd).find(d=>d.id===o);if(!l)return{status:"failure",skillSlug:a,message:`Unsupported agent "${o}". Run \`skills-layer agents list\` to choose a supported local install target.`,nextStep:"Run `skills-layer agents list` and retry with a supported --agent value."};let c=s==="global"?l.targets.globalSkillsPath:l.targets.projectSkillsPath;return c?{status:"ok",scope:s,agent:l,skillsPath:c,skillSlug:a,version:u(t,"version")??u(t,"currentVersion")}:{status:"failure",skillSlug:a,message:`${l.displayName} does not expose a ${s} skills path on this machine.`,nextStep:"Retry with --scope project, or choose another agent from `skills-layer agents list`."}}async function s0(e,t,n,i,r={}){if(typeof t.downloadUrl=="string"&&L(t.artifactEnvelope)&&L(t.artifactApproval))return t;let s=new URLSearchParams;i&&s.set("version",i);let a=r.exportMode==="public"||!e.apiKey,o=a?`/api/v1/skills/${encodeURIComponent(n)}/export${ye(s)}`:`/api/v1/me/library/${encodeURIComponent(n)}/export${ye(s)}`,l=await C(e,o,{headers:a?{}:V(e.apiKey,e.authBlockedMessage)});return a?{...l,downloadUrl:a0(n,u(l,"version")??i)}:l}function a0(e,t){let n=new URLSearchParams;return t&&n.set("version",t),`/api/v1/skills/${encodeURIComponent(e)}/download${ye(n)}`}function o0(e){let t=u(e,"visibility")??u(e,"versionVisibility"),n=u(e,"publicationStatus");return $y(e)&&(t==="public"||n==="clean_publishable"||n==="publishable_with_findings")}function l0(e){return $y(e)}async function Hc(e){let t=wa(e.result),n=u(t,"skillSlug")??u(t,"slug")??e.fallbackSlug,i=e.requestedVisibility??(u(t,"visibility")==="public"||u(t,"versionVisibility")==="public"||u(t,"releaseVisibility")==="public"?"public":"private");if(!l0(t)){let a=E(t,"publication"),o=u(t,"reasonCode")??(a?u(a,"reasonCode"):void 0)??"security_review_pending",l=B({status:"install_pending_review",sourceItemStatus:u(t,"status")??"submitted",skillId:u(t,"skillId"),versionId:u(t,"versionId"),skillSlug:n,version:u(t,"version"),visibility:i,publication:a?wa(a):void 0,activationStatus:"held",reasonCode:o,materializedWrites:[],materializationPlan:{scope:k(e.flags.scope)??"project",agent:k(e.flags.agent)??"codex",activation:"approved_artifact_only"},nextStep:`Wait for the exact ${n} generation to pass mandatory security review and active Eval, then rerun the install. The submitted source bytes are never activated directly.`});return Qc(l,"Source item created; local activation is held pending approval.",e.flags.json,e.backend)}let r=await Ty(e.backend,t,n,e.flags,{exportMode:o0(t)?"public":"auto"});if(Z(r))return r;let s=await jy(e.backend,r,n,e.flags);return await wk(e.backend,s,n),Qc(s,x0(e.source,e.flags,e.backend,s,e.sourceAccess),e.flags.json,e.backend)}function wa(e){return Object.fromEntries(Object.entries(e).flatMap(([t,n])=>t==="localWrites"||t==="files"||t==="content"||t==="archiveBytes"?[]:Array.isArray(n)?[[t,n.map(i=>L(i)?wa(i):i)]]:L(n)?[[t,wa(n)]]:[[t,n]]))}function $y(e){if(Oy(e.artifactApproval).status==="ok"&&e.artifactEnvelope!==void 0&&typeof e.downloadUrl=="string")return!0;let n=E(e,"publication"),i=n?u(n,"status")==="published":!1,r=u(e,"listingStatus")==="published",s=u(e,"versionStatus")==="published",a=u(e,"status");return r&&s&&(i||a==="published"||a==="reused"||a==="source_approved")}function c0(e){return B({version:u(e,"version"),storageKey:u(e,"storageKey"),expiresAt:u(e,"expiresAt")})}async function Ly(e){let t=Oy(e.exportResult.artifactApproval);if(t.status!=="ok"){let d=t.status==="missing";return jn(e,d?"artifact_v1_approval_missing":"artifact_v1_approval_invalid",d?`Export for ${e.skillSlug} did not include an authoritative approved Artifact Format v1 identity.`:`Export for ${e.skillSlug} included malformed Artifact Format v1 approval metadata.`)}let n=t.approval;if(e.exportResult.artifactEnvelope===void 0)return jn(e,"artifact_v1_envelope_missing",`Export for ${e.skillSlug} did not include an Artifact Format v1 envelope.`);let i=u(e.exportResult,"downloadUrl");if(!i)return P({status:"export_download_unavailable",reasonCode:"export_download_unavailable",skillSlug:e.skillSlug,nextStep:"Retry after the backend returns a signed bundle download URL."},`Export for ${e.skillSlug} did not include a signed download URL.`,e.flags.json,"export_download_unavailable");let r=await e.backend.fetchFn(d0(e.backend.baseUrl,i));if(!r.ok)throw new D(r.status,`Unable to download exported bundle (${r.status}).`);let s;try{s=await p0(r)}catch(d){return jn(e,"artifact_v1_archive_bounds_failed",`Downloaded ${e.skillSlug} exceeded Artifact Format v1 archive bounds.`,{verificationError:X(d)})}let a,o;try{a=ln({archiveBytes:s,envelope:e.exportResult.artifactEnvelope}),o=cn({archiveBytes:s,envelope:a})}catch(d){return jn(e,"artifact_v1_verification_failed",`Downloaded ${e.skillSlug} failed Artifact Format v1 verification.`,{verificationError:X(d)})}if(!u0(n,a))return jn(e,"artifact_v1_identity_mismatch",`Downloaded ${e.skillSlug} did not match the authoritative approved generation.`);let l=u(e.exportResult,"skillSlug"),c=u(e.exportResult,"version");return a.generation.skillSlug!==e.skillSlug||l!==void 0&&l!==a.generation.skillSlug||c!==void 0&&c!==a.generation.semanticVersion?jn(e,"artifact_v1_target_mismatch",`Downloaded ${e.skillSlug} was approved for a different skill or version.`):{status:"ok",bytes:s,files:o,envelope:a,approval:n,archiveSha256:a.archive.sha256,archiveBytesSha256:a.archive.sha256,archiveHashFormat:"artifact_v1_zip"}}function Oy(e){return e==null?{status:"missing"}:!L(e)||e.status!=="approved"||!L(e.generation)||typeof e.generation.skillSlug!="string"||typeof e.generation.semanticVersion!="string"||typeof e.generation.generationId!="string"||typeof e.archiveSha256!="string"||typeof e.manifestSha256!="string"?{status:"invalid"}:{status:"ok",approval:{status:"approved",generation:{skillSlug:e.generation.skillSlug,semanticVersion:e.generation.semanticVersion,generationId:e.generation.generationId},archiveSha256:e.archiveSha256,manifestSha256:e.manifestSha256}}}function u0(e,t){return e.generation.skillSlug===t.generation.skillSlug&&e.generation.semanticVersion===t.generation.semanticVersion&&e.generation.generationId===t.generation.generationId&&e.archiveSha256===t.archive.sha256&&e.manifestSha256===t.manifest.sha256}function jn(e,t,n,i={}){return P({status:"download_integrity_failed",reasonCode:t,skillSlug:e.skillSlug,version:u(e.exportResult,"version"),archiveHashFormat:"artifact_v1_zip",...i,nextStep:"Retry after the catalog serving generation is refreshed, or contact Skills Layer support if this repeats."},n,e.flags.json,t)}function d0(e,t){return/^https?:\/\//iu.test(t)?t:`${nt(e)}${t.startsWith("/")?"":"/"}${t}`}async function p0(e){let t=e.headers.get("content-length");if(t!==null){let o=Number(t);if(!Number.isSafeInteger(o)||o<0)throw new Error("Artifact response Content-Length is invalid.");if(o>oe.maxArchiveBytes)throw new Error("Artifact response exceeds the v1 archive byte limit.")}if(!e.body)throw new Error("Artifact response body is unavailable.");let n=e.body.getReader(),i=[],r=0;try{for(;;){let o=await n.read();if(o.done)break;if(r+=o.value.byteLength,r>oe.maxArchiveBytes)throw await n.cancel("Artifact response exceeds the v1 archive byte limit."),new Error("Artifact response exceeds the v1 archive byte limit.");i.push(Uint8Array.from(o.value))}}finally{n.releaseLock()}let s=new Uint8Array(r),a=0;for(let o of i)s.set(o,a),a+=o.byteLength;return s}async function f0(e){let t=e.backend.platform==="win32"?rt:Qt,n=t.join(e.backend.paths.bundlesDir,e.skillSlug,e.envelope.generation.semanticVersion,encodeURIComponent(e.envelope.generation.generationId),"bundle.zip"),i=t.join(e.skillsPath,e.skillSlug),r=`activation_${it(16).toString("hex")}`,s={targetDir:i,generation:e.envelope.generation,archiveSha256:e.envelope.archive.sha256,manifestSha256:e.envelope.manifest.sha256,files:e.envelope.manifest.files},o=(await pe(e.backend)).installs[e.skillSlug],l=JSON.stringify(o??null),c=or({state:"pending_activation",operationId:r,receipt:s,backend:e.backend}),d=or({state:"active",operationId:r,receipt:s,backend:e.backend}),p={...o??{},skillSlug:e.skillSlug,version:e.envelope.generation.semanticVersion,scope:e.scope,agent:e.agent.id,targetAgent:e.agent.id,materializedPath:i,materializedSkillRoot:i,bundlePath:n,archiveSha256:e.envelope.archive.sha256,manifestSha256:e.envelope.manifest.sha256,generationId:e.envelope.generation.generationId,localLifecycle:c,savedAt:e.backend.now()};await Ik(n,e.bytes);let f=e.files.find(A=>me(A.path).toLowerCase()==="skill.md"),g=f?await YT({backend:e.backend,skillSlug:e.skillSlug,version:e.envelope.generation.semanticVersion,generationId:e.envelope.generation.generationId,skillDocumentPath:t.join(i,...Bh(f.path)),skillDocumentContent:f.content??""}):void 0,h,m=!1,y;try{y=await Rm({targetDir:i,archiveBytes:e.bytes,envelope:e.envelope,approval:e.approval,preActivate:async({stageDir:A})=>{let x=await m0({backend:e.backend,stageDir:A,envelope:e.envelope});return x.status==="passed"?(h=x.evalRun,{status:"passed",evidenceId:x.evidenceId}):{status:"failed",reasonCode:x.reasonCode}},checkpoint:async A=>{if(A==="after_static_eval"){let O=await pe(e.backend);if(JSON.stringify(O.installs[e.skillSlug]??null)!==l)throw new Error(`Local install record for ${e.skillSlug} changed during atomic activation.`);O.installs[e.skillSlug]=p,await It(e.backend,O),m=!0;return}if(A!=="after_stage_activated")return;let x=await pe(e.backend),$=x.installs[e.skillSlug]?qe(x.installs[e.skillSlug]):null;if(!$||$.state!=="pending_activation"||$.operationId!==r)throw new Error(`Atomic activation receipt reservation for ${e.skillSlug} was lost before commit.`);x.installs[e.skillSlug]={...p,localLifecycle:d,savedAt:e.backend.now()},await It(e.backend,x)}})}catch(A){throw m&&await g$({backend:e.backend,skillSlug:e.skillSlug,operationId:r,baselineRecord:o}),A}if(!h)throw new Error("Static pre-activation Eval did not produce generation-bound evidence.");let w=await pe(e.backend),v=w.installs[e.skillSlug]?qe(w.installs[e.skillSlug]):null;if(!v||v.state!=="active"||v.operationId!==r)throw new Error(`Atomic activation receipt for ${e.skillSlug} was not committed.`);let S=y.receipt.files.map(A=>({path:zy(e.backend.cwd,t.join(i,...Bh(A.path))),bytes:A.sizeBytes}));return{bundlePath:n,materializedPath:i,materializedSkillRoot:i,archiveSha256:e.envelope.archive.sha256,manifestSha256:e.envelope.manifest.sha256,generationId:e.envelope.generation.generationId,materializedWrites:S,...g?{guardianRuntimeMetadata:g}:{},localLifecycle:d,atomicActivation:{status:y.status,receipt:y.receipt,generation:y.receipt.generation,archiveSha256:y.receipt.archiveSha256,manifestSha256:y.receipt.manifestSha256,staticEvaluation:y.staticEvaluation,cleanupPending:y.cleanupPending,...y.cleanupPath?{cleanupPath:y.cleanupPath}:{}},[Ny]:h}}var Ny=Symbol("skills-layer.pre-activation-eval"),g0=new Set(["file_exists","json_valid","schema_match","section_exists","regex_match","artifact_valid"]);async function m0(e){let t=await By(e.stageDir),n=Re(t),i=qy(t,n),r=l=>rm({pack:l,files:t,activationState:"inactive_staging",skillSlug:e.envelope.generation.skillSlug,version:e.envelope.generation.semanticVersion,generationId:e.envelope.generation.generationId,generatedAt:e.backend.now(),runnerVersion:Jc()}),s=r(i.pack);if(s.outcome!=="completed")return{status:"failed",reasonCode:s.reasonCode};let a=s.result.summary.status==="not_run"||s.result.summary.status==="runner_unavailable"?r(My(t,n)):s;if(a.outcome!=="completed")return{status:"failed",reasonCode:a.reasonCode};if(a.result.summary.status!=="passed")return{status:"failed",reasonCode:`static_eval_${a.result.summary.status}`};let o=Dy({files:t,skillSlug:e.envelope.generation.skillSlug,version:e.envelope.generation.semanticVersion,generationId:e.envelope.generation.generationId,generatedAt:e.backend.now()});return{status:"passed",evidenceId:`${a.result.summary.evalPackDigest??"eval-pack-unavailable"}:${a.result.summary.artifactDigest}`,evalRun:o}}async function jy(e,t,n,i){let r=u(t,"materializedSkillRoot");if(!r)return t;let s=u(t,"skillSlug")??u(t,"slug")??n,a=u(t,"version")??u(t,"currentVersion")??k(i.version)??"local";try{let o=t[Ny],l;if(h0(o))l=o;else{let d=await By(Pe(e.cwd,r));if(d.length===0)return ga(t,i,{status:"runner_unavailable",summaryStatus:"runner_unavailable",reasonCode:"installed_files_unreadable"});l=Dy({files:d,skillSlug:s,version:a,generatedAt:e.now()})}let c=await A0(e,l.summary);return c.status==="recorded"?ga({...t,...c.effectiveness?{effectiveness:c.effectiveness}:{}},i,{status:"recorded",source:l.source,summaryStatus:l.summary.status,evalPackDigest:l.summary.evalPackDigest,evidenceRevision:c.evidenceRevision}):ga(t,i,{status:c.status,source:l.source,summaryStatus:l.summary.status,evalPackDigest:l.summary.evalPackDigest,reasonCode:c.reasonCode})}catch(o){return ga(t,i,{status:"runner_unavailable",summaryStatus:"runner_unavailable",reasonCode:"local_eval_failed",message:X(o)})}}function h0(e){return L(e)&&(e.source==="submitted"||e.source==="inferred"||e.source==="invalid_submitted")&&L(e.summary)&&e.summary.schemaVersion==="skills-layer.eval.summary.v1"}async function By(e){let t=[];return await Fy(e,e,t),t.sort((n,i)=>n.path.localeCompare(i.path))}async function Fy(e,t,n){for(let i of await ux(t,{withFileTypes:!0})){if(y0(i.name))continue;let r=K(t,i.name);if(i.isDirectory()){await Fy(e,r,n);continue}if(!(!i.isFile()||w0(i.name)))try{n.push({path:ka(e,r).split("\\").join("/"),content:await ur(r,"utf8")})}catch{continue}}}function y0(e){return e===".git"||e==="node_modules"||e==="coverage"||e===k0()||e==="dist"}function k0(){return[46,68,83,95,83,116,111,114,101].map(e=>String.fromCharCode(e)).join("")}function w0(e){return e==="bundle.zip"||/^\.skills-layer-.*\.json$/u.test(e)}function Dy(e){let t=Re(e.files),n=qy(e.files,t);if(!Hs(n.pack).valid)return{source:"invalid_submitted",summary:En({status:"runner_unavailable",skillSlug:e.skillSlug,version:e.version,generationId:e.generationId,artifactDigest:t,evalPackDigest:Cn(n.pack),generatedAt:e.generatedAt,runnerVersion:Jc(),counts:{cases:0,assertions:0,passed:0,failed:0,skipped:0}})};let r=b0(n.pack).map(a=>({id:a.id,assertions:a.assertions.map(o=>S0(o,e.files))})),s=_0(r);return{source:n.source,summary:En({status:P0(s),skillSlug:e.skillSlug,version:e.version,generationId:e.generationId,artifactDigest:typeof n.pack.artifactDigest=="string"?n.pack.artifactDigest:t,evalPackDigest:Cn(n.pack),generatedAt:e.generatedAt,runnerVersion:Jc(),counts:{cases:r.length,assertions:s.total,passed:s.passed,failed:s.failed,skipped:s.skipped}})}}function qy(e,t){let n=v0(e);return n?{pack:n,source:"submitted"}:{pack:My(e,t),source:"inferred"}}function v0(e){for(let t of e){let n=Mt(t.path,e);if(!(n.type!=="evidence"||!t.content||!n.relativePath.toLowerCase().endsWith(".eval.json")))try{let i=JSON.parse(t.content);if(L(i))return i}catch{return{schemaVersion:"invalid",artifactDigest:Re(e),origin:"submitted",confidence:"starter",creatorReviewed:!1,redaction:{mode:"content_free"},cases:[]}}}}function My(e,t){let i=e.find(r=>r.path.replaceAll("\\","/").split("/").at(-1)?.toLowerCase()==="skill.md")?.path??"SKILL.md";return{schemaVersion:"skills-layer.eval.pack.v1",artifactDigest:t,origin:"inferred",confidence:"starter",creatorReviewed:!1,redaction:{mode:"content_free"},cases:[{id:"starter-runtime-shape",assertions:[{type:"file_exists",path:i},{type:"regex_match",path:i,pattern:"name:"},{type:"artifact_valid",artifactDigest:t}]}]}}function b0(e){return Array.isArray(e.cases)?e.cases.flatMap(t=>!L(t)||typeof t.id!="string"||!Array.isArray(t.assertions)?[]:[{id:t.id,assertions:t.assertions.filter(L)}]):[]}function S0(e,t){return typeof e.type=="string"&&!g0.has(e.type)?{status:"skipped",reasonCode:"runner_unavailable"}:zs(e,{files:t})}function _0(e){return e.reduce((t,n)=>{for(let i of n.assertions)t.total+=1,i.status==="passed"&&(t.passed+=1),i.status==="failed"&&(t.failed+=1),i.status==="skipped"&&(t.skipped+=1);return t},{total:0,passed:0,failed:0,skipped:0})}function P0(e){return e.failed>0?"failed":e.passed>0?"passed":e.skipped>0?"runner_unavailable":"not_run"}function Jc(){return`skills-layer-public-cli:${Ht}:local-install`}async function A0(e,t){if(!e.apiKey)return{status:"local_only",reasonCode:"not_authenticated"};try{let n=await C(e,"/api/v1/me/evals/results",{method:"POST",headers:{"content-type":"application/json",...V(e.apiKey,e.authBlockedMessage)},body:JSON.stringify({evalSummary:t})}),i=E(n,"evalEvidence");return{status:"recorded",effectiveness:E(n,"effectiveness"),evidenceRevision:i?U(i,"revision"):void 0}}catch(n){return{status:"submit_failed",reasonCode:n instanceof D?`http_${n.status}`:"request_failed"}}}function ga(e,t,n){return t.json?{...e,localEval:n}:e}function Bh(e){let n=e.replaceAll("\\","/").replace(/^\/+/u,"").trim().split("/").filter(i=>i.length>0);if(n.length===0||n.some(i=>i==="."||i===".."))throw new Error(`Unsafe bundle path "${e}".`);return n}async function Fh(e,t,n,i,r){let s=k(i.visibility)??"private";if(s!=="private"&&s!=="public")return P({status:"invalid_visibility",reasonCode:"invalid_visibility",source:e,requestedVisibility:s,nextStep:`Use \`skills-layer install ${e} --visibility private\` or \`--visibility public\`.`},"Local path install visibility must be private or public.",i.json,"invalid_visibility");let a=Uy(e,t,n);if(i.list)return b(a,"Local source skills loaded.",i.json,r);let o=Zc(e,a,i);if(o)return o;let l=await ya({source:e,inspection:a,requestedSkillSlug:n,mode:"install",flags:i,backend:r});if(l.kind==="failure")return l.result;let c=l.skillSlug??dt(a)[0]?.value??Gy(e);if(i.dryRun)return b({...Yc(e,a,c,i),installKind:"local_source_submission",visibility:s,publicationStatus:"preview",catalogRecord:s,activationStatus:"not_started",nextStep:`Re-run without --dry-run to create or reuse the ${s} central item. Local activation remains held until the exact generation completes security review and Artifact-v1 approval.`},"Local source submission preview ready.",i.json,r);let d=await mu(r,c,i);if(d)return d;let p=await C(r,"/api/v1/me/submissions",{method:"POST",headers:{"content-type":"application/json",...V(r.apiKey,r.authBlockedMessage)},body:JSON.stringify(B({files:t.files,version:k(i.version),visibility:s,category:k(i.category),displayName:k(i.displayName),skillType:k(i.skillType),sourceMetadata:t.sourceMetadata}))});return await Hc({backend:r,result:p,fallbackSlug:u(p,"skillSlug")??c,source:e,sourceAccess:"authenticated",flags:i,requestedVisibility:s})}function Uy(e,t,n){let i=R0(t.files),r=n?i.find(s=>s.skillSlug===n)??null:i.length===1?i[0]??null:null;return{status:"ok",source:t.sourceMetadata,selectedSkill:r,results:i,issues:[],sourceInstallSupported:!0,sourceInstallMode:"local_private",publicationStatus:"none",originalSource:e}}function R0(e){return e.filter(t=>t.path.split("/").at(-1)?.toLowerCase()==="skill.md").map(t=>{let n=ge(t.path).replaceAll("\\","/"),i=n==="."?".":n,r=Vy(t.content??"")??Gy(i==="."?t.path:i),s=C0(t.content??"");return{skillSlug:r,name:r,...s?{description:s}:{},relativeSkillRoot:i,relativeSkillFile:t.path,sourceKind:"local",discoveryRoute:"local_bundle",validation:{valid:!0,issueCount:0}}})}function Vy(e){return/^---\s*[\s\S]*?\nname:\s*["']?([^"'\n]+)["']?\s*(?:\n|$)/u.exec(e)?.[1]?.trim()}function C0(e){return/^---\s*[\s\S]*?\ndescription:\s*["']?([^"'\n]+)["']?\s*(?:\n|$)/u.exec(e)?.[1]?.trim()}function Gy(e){return(e.replaceAll("\\","/").replace(/\/+$/u,"").split("/").filter(Boolean).at(-1)??"local-skill").toLowerCase().replace(/[^a-z0-9]+/gu,"-").replace(/^-+|-+$/gu,"")||"local-skill"}function zy(e,t){let n=ka(e,t);return n&&!n.startsWith("..")&&!rt.isAbsolute(n)?n.split("\\").join("/"):t}function Ky(e,t,n,i="unknown"){let r=k(t.visibility);return r==="public"||r==="private"?r:i==="anonymous"&&Wc(e)?"public":i==="authenticated"?"private":!n.apiKey&&Wc(e)?"public":"private"}function Wc(e){try{let t=qi(e).kind;return t==="github"||t==="gitlab"}catch{return/^https:\/\/(?:github|gitlab)\.com\//iu.test(e.trim())}}function Hy(e,t,n,i="unknown"){return Ky(e,t,n,i)==="private"||i==="authenticated"?"/api/v1/me/source-installs":"/api/v1/source-imports"}function E0(e,t,n,i="unknown"){return{"content-type":"application/json",...Hy(e,t,n,i)==="/api/v1/me/source-installs"?V(n.apiKey,n.authBlockedMessage):{}}}function x0(e,t,n,i,r="unknown"){let s=i?u(i,"visibility")??u(i,"versionVisibility"):void 0,a=i?u(i,"publicationStatus"):void 0,o=i?u(i,"catalogRecord"):void 0,l=i?u(i,"status"):void 0;return s==="public"||a==="clean_publishable"||a==="publishable_with_findings"||l==="published"?"Public source install planned.":s==="private"||a==="private"||o==="private"||l==="private_source_installed"?"Private source skill installed.":Ky(e,t,n,r)==="public"?"Public source install planned.":"Private source skill installed."}async function ya(e){let t=dt(e.inspection);if(e.requestedSkillSlug)return t.length>0&&!t.some(n=>n.value===e.requestedSkillSlug)?{kind:"failure",result:I0(e.source,e.requestedSkillSlug,t.map(n=>n.value),e.flags)}:{kind:"selected",skillSlug:e.requestedSkillSlug};if(e.flags.json||e.flags.all)return{kind:"selected",skillSlug:e.requestedSkillSlug};if(t.length<=1)return{kind:"selected",skillSlug:t[0]?.value};try{return{kind:"selected",skillSlug:await e.backend.promptSelect(`${e.source} exposes multiple skills. Select one to ${e.mode}:`,t)}}catch{return{kind:"failure",result:_(`Source "${e.source}" exposes multiple skills. Re-run with --list or --skill <skill-slug>. Available skills: ${t.map(n=>n.value).join(", ")}.`,e.flags.json)}}}function Dh(e,t,n){if(n.all&&t)return P({status:"error",reasonCode:"conflicting_source_selection",source:e,selectedSkillSlug:t,all:!0,nextAction:"install",nextStep:"Use either --all to install every discovered skill or --skill <skill-slug> to install one skill, not both."},"Source install cannot combine --all with --skill. Choose one selection mode before retrying.",n.json,"conflicting_source_selection")}function qh(e,t){try{if(qi(e).kind!=="local")return}catch{return}return P({status:"error",reasonCode:"invalid_source",source:e,nextAction:"install",nextStep:va(e)?"Check that the local path exists and contains SKILL.md, or pass a supported GitHub/GitLab/source URL.":"Use an existing local path such as ./my-skill, a GitHub/GitLab source URL, or run `skills-layer install --source <source> --list` with a supported source."},va(e)?`Install source ${e} was not found or is not readable.`:`Install source "${e}" is not a supported remote source and no local path was found.`,t.json,"invalid_source")}function I0(e,t,n,i){return P({status:"not_found",reasonCode:"source_skill_not_found",source:e,requestedSkillSlug:t,availableSkills:n,nextAction:"install.source.list",nextStep:`Run \`skills-layer install --source ${e} --list\` to inspect discovered skills, then retry with one of the listed slugs.`},`Source ${e} does not contain a discovered skill named ${t}. Run with --list to inspect available skills.`,i.json,"source_skill_not_found")}function dt(e){let t=[e.results,e.skills,e.discoveredSkills,E(e,"source")?.results,E(e,"inspection")?.results],n=new Set,i=[];for(let r of t)if(Array.isArray(r))for(let s of r){let a=T0(s);!a||n.has(a.value)||(n.add(a.value),i.push(a))}return i}function T0(e){if(!L(e))return;let t=u(e,"skillSlug")??u(e,"slug")??u(e,"name");if(!t)return;let n=u(e,"displayName")??u(e,"title")??u(e,"name"),i=n&&n!==t?`${t} - ${n}`:t,r=E(e,"parsedSkill"),s=E(e,"frontmatter")??(r?E(r,"frontmatter"):void 0),a=u(e,"shortDescription")??u(e,"summary")??u(e,"description")??(s?u(s,"description"):void 0)??u(e,"relativeSkillRoot")??u(e,"path")??u(e,"discoveryRoute")??u(e,"sourceKind");return a?{value:t,label:i,description:a}:{value:t,label:i}}function Mh(e,t,n,i,r,s={}){return B({...t,skillSlug:n,scope:k(i.scope),agent:k(i.agent),workspace:k(i.workspace),version:k(i.version),visibility:s.visibility??k(i.visibility),category:k(i.category),displayName:k(i.displayName),skillType:k(i.skillType),all:i.all,quarantine:i.quarantine,acceptCapability:i.acceptCapability})}async function Uh(e){let t=e.sourceAccess??"unknown",n=Hy(e.source,e.flags,e.backend,t);try{return await C(e.backend,n,{method:"POST",headers:E0(e.source,e.flags,e.backend,t),body:JSON.stringify(Mh(e.source,{source:e.source},e.skillSlug,e.flags,e.backend,{sourceAccess:t}))})}catch(i){if(i instanceof D&&i.status===401&&k(e.flags.visibility)!=="private"&&t!=="authenticated"&&Wc(e.source))return await C(e.backend,"/api/v1/source-imports",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(Mh(e.source,{source:e.source},e.skillSlug,e.flags,e.backend))});throw i}}function Yc(e,t,n,i){return B({status:"dry_run",source:e,selectedSkillSlug:n,all:i.all,scope:k(i.scope)??"local",agent:k(i.agent),workspace:k(i.workspace),quarantine:i.quarantine,acceptCapability:i.acceptCapability,candidates:dt(t).map(r=>({skillSlug:r.value,name:r.label,description:r.description})),nextStep:i.all?`Re-run without --dry-run to install every discovered skill from ${e}.`:`Re-run without --dry-run${n?"":" and add --skill <skill-slug> if needed"} to install from ${e}.`})}async function Jy(e,t,n,i,r={}){try{return{kind:"ok",inspection:await C(e,"/api/v1/source-inspect",{method:"POST",headers:Wy(e,r.authMode??"auto"),body:JSON.stringify(B(n))})}}catch(s){if(s instanceof D)return{kind:"failure",result:Xc(t,s,i)};throw s}}function Wy(e,t){return t==="anonymous"?{"content-type":"application/json"}:j(e.apiKey)}async function Vh(e,t,n,i){try{return{kind:"ok",inspection:await C(e,"/api/v1/source-inspect",{method:"POST",headers:Wy(e,"anonymous"),body:JSON.stringify(B(n))}),sourceAccess:"anonymous"}}catch(s){if(!(s instanceof D))throw s;let a=s.details??{},o=u(a,"error")??s.message;if(!ku(s.status,o))return{kind:"failure",result:Xc(t,s,i)};if(!e.apiKey)return{kind:"failure",result:Xc(t,s,i)}}let r=await Jy(e,t,n,i,{authMode:"authenticated"});return r.kind==="failure"?r:{kind:"ok",inspection:r.inspection,sourceAccess:"authenticated"}}function Zc(e,t,n){if(dt(t).length>0)return null;let r=$0(t);return P({status:"unsupported_source_layout",source:e,reasonCode:"source_no_discoverable_skills",issues:r,nextStep:"Run with --list to inspect the source, use a subfolder containing SKILL.md, or install from a Skills Layer-compatible source layout."},L0(e,r),n.json)}function $0(e){return(Array.isArray(e.issues)?e.issues:[]).filter(L).map(n=>({...u(n,"code")?{code:u(n,"code")}:{},...u(n,"message")?{message:u(n,"message")}:{},...u(n,"path")?{path:u(n,"path")}:{}}))}function Xc(e,t,n){let i=t.details??{},r=u(i,"error")??t.message;if(ku(t.status,r))return Yy(e,t,n,"inspect");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(r)))return dr(t,n.json);let a={status:"unsupported_source_layout",source:e,reasonCode:"source_not_inspectable",backendStatus:t.status,backendMessage:r,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return P(a,`Source ${e} could not be inspected as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function Gh(e,t,n){let i=t.details??{},r=u(i,"error")??t.message;if(ku(t.status,r))return Yy(e,t,n,"install");if(!(t.status===404||/not found|does not contain any discoverable skills|no discoverable skills/iu.test(r)))return dr(t,n.json);let a={status:"unsupported_source_layout",source:e,reasonCode:"source_not_installable",backendStatus:t.status,backendMessage:r,nextStep:"Try --list, a specific subfolder containing SKILL.md, or a Skills Layer-compatible source URL."};return P(a,`Source ${e} could not be installed as a Skills Layer-compatible source. Try --list, a specific subfolder containing SKILL.md, or a supported source layout.`,n.json)}function ku(e,t){return e===401||e===403||/private source|provider authorization|unauthorized|forbidden|access denied/iu.test(t)}function Yy(e,t,n,i){let r=t.details??{},s=u(r,"error")??t.message,o=`skills-layer source connection start --provider ${Zy(e)} --source ${e} --visibility private --provenance-intent private_source_import`,l={status:"private_source_access_required",source:e,reasonCode:"private_source_access_required",backendStatus:t.status,backendMessage:s,nextStep:o};return P(l,`Cloud could not ${i} ${e} directly. If this is a private source, start a private source connection first:
+${o}`,n.json,"private_source_access_required")}function Zy(e){return/gitlab\./iu.test(e)?"gitlab":/github\./iu.test(e)||/^gh:/iu.test(e)?"github":"generic_git"}function L0(e,t){let n=[`No Skills Layer-compatible skills were found in ${e}.`];if(t.length>0){n.push("Detected issues:");for(let i of t.slice(0,5)){let r=i.code??"source-inspection";n.push(`- ${r}: ${i.message??"No details returned."}${i.path?` (${i.path})`:""}`)}}return n.push("Try --list, a subfolder containing SKILL.md, or a Skills Layer-compatible source layout."),n.join(`
+`)}async function O0(e,t,n){if(Xy(e)){let s=u(e,"reasonCode")??u(e,"reason")??"install_not_ready",a=u(e,"why")??u(e,"summary")??"The requested skill is not ready to install from this backend.";return P(e,`Install preview is not ready: ${a}`,t.json,s)}let i=await Qy(e,n),r=Array.isArray(i.warnings)&&i.warnings.length>0;return N0(i,r?"Install preview ready with warnings.":"Install preview ready.",t,n)}function N0(e,t,n,i){return n.json?b(e,t,!0,i):{exitCode:0,stdout:wu(e,t,i),stderr:""}}async function j0(e,t,n,i){if(Xy(e)){let s=u(e,"reasonCode")??u(e,"reason")??"workspace_approval_not_ready",a=u(e,"why")??u(e,"summary")??u(e,"nextStep")??"The requested workspace approval is not ready.";return P(e,`Workspace approval preview is not ready: ${a}`,n.json,s)}let r=await Qy(e,i);return n.json?b(r,t,!0,i):{exitCode:0,stdout:wu(r,t,i),stderr:""}}function Xy(e){let t=u(e,"status")?.toLowerCase(),n=u(e,"reasonCode")?.toLowerCase();return t==="not_found"||t==="missing"||t==="blocked"||t==="not_ready"||n==="skill_not_found"||n==="not_found"}async function Qy(e,t){let n=zh(e);if(n)return{...e,...n};let i=u(e,"skillSlug")??u(e,"slug");if(!i)return e;try{let r=await C(t,`/api/v1/skills/${encodeURIComponent(i)}/trust`),s=zh(r);return s?{...e,...s}:e}catch{return e}}function zh(e){let t=E(e,"securityReport")??E(e,"report")??e,n=E(e,"trust")??E(t,"trust")??t,i=E(e,"securityPosture")??E(t,"securityPosture"),r=E(e,"capabilityProfile")??E(t,"capabilityProfile"),s=B({securityScore:U(n,"securityScore")??U(n,"score")??U(e,"securityScore")??(i?U(i,"securityScore"):void 0),runtimeRisk:u(n,"runtimeRisk")??u(e,"runtimeRisk")??(i?u(i,"runtimeRisk"):void 0)??(r?u(r,"runtimeRisk"):void 0),recommendation:u(n,"recommendation")??u(e,"recommendation")??(i?u(i,"recommendation"):void 0),detectedCapabilities:He(n,"detectedCapabilities")??He(e,"detectedCapabilities")??(r?He(r,"detectedCapabilities"):void 0),capabilityMismatches:He(n,"capabilityMismatches")??He(e,"capabilityMismatches")??(r?He(r,"capabilityMismatches"):void 0),organizationPolicyDecision:u(n,"organizationPolicyDecision")??u(n,"policyDecision")??u(e,"organizationPolicyDecision")??u(e,"policyDecision")??(i?u(i,"organizationPolicyDecision"):void 0)});if(Object.keys(s).length!==0)return B({trust:s,runtimeRisk:u(s,"runtimeRisk"),detectedCapabilities:Array.isArray(s.detectedCapabilities)?s.detectedCapabilities:void 0,capabilityMismatches:Array.isArray(s.capabilityMismatches)?s.capabilityMismatches:void 0,organizationPolicyDecision:u(s,"organizationPolicyDecision"),warnings:He(e,"warnings")??He(t,"warnings")??He(n,"warnings")})}function B0(e){let t=E(e,"securityPosture"),n=E(e,"trust"),i=t?U(t,"securityScore"):void 0,r=n?U(n,"securityScore")??U(n,"score"):void 0;return i===void 0&&r===void 0?e:B({...e,...t?{securityPosture:{...t,scoreLabel:"published_ledger_score"}}:{},...n?{trust:{...n,scoreLabel:"effective_buyer_trust_score"}}:{},publishedLedgerScore:i,effectiveBuyerTrustScore:r})}function Qc(e,t,n,i){return n?b(e,t,!0,i):{exitCode:0,stdout:wu(e,t,i),stderr:""}}function F0(e,t,n){let i=ce(n),r=Array.isArray(e.runs)?e.runs.filter(L):[],s=r.flatMap(l=>Array.isArray(l.results)?l.results.filter(L):[]),a=r.flatMap(l=>{let c=E(l,"tool"),d=c?E(c,"driver"):void 0;return d&&Array.isArray(d.rules)?d.rules.filter(L):[]}),o=[`${i.ok("OK")} Trust report loaded.`,"",i.section("SARIF")];if(o.push(`  ${i.label("Skill")}: ${t}`),o.push(`  ${i.label("Runs")}: ${r.length}`),o.push(`  ${i.label("Rules")}: ${a.length}`),o.push(`  ${i.label("Results")}: ${s.length}`),s.length===0)o.push(`  ${i.muted("No SARIF findings found.")}`);else{o.push("",i.section("Findings"));for(let[l,c]of s.slice(0,re).entries()){let d=u(c,"ruleId")??"unknown-rule",p=E(c,"message");o.push(`${l+1}. ${d}${p?` - ${u(p,"text")??""}`:""}`)}}return o.push("",i.section("Next")),o.push(`  ${i.arrow} skills-layer trust ${t} --format sarif --json`),o.join(`
+`)}function wu(e,t,n){let i=ce(n),r=[`${i.ok("OK")} ${t}`],s=u(e,"skillSlug")??u(e,"slug"),a=u(e,"version")??u(e,"currentVersion");(s||a)&&(r.push("",i.section("Skill")),s&&r.push(`  ${i.label("Slug")}: ${s}`),a&&r.push(`  ${i.label("Version")}: ${a}`));let o=u(e,"visibility")??u(e,"versionVisibility"),l=u(e,"publicationStatus"),c=u(e,"catalogRecord");(o||l||c)&&(r.push("",i.section("Privacy")),o&&r.push(`  ${i.label("Visibility")}: ${o}`),l&&r.push(`  ${i.label("Publication")}: ${l}`),c&&r.push(`  ${i.label("Catalog record")}: ${c}`));let d=E(e,"materializationPlan")??E(e,"installPlan"),p=u(e,"scope")??(d?u(d,"scope"):void 0),f=u(e,"agent")??u(e,"targetAgent")??(d?u(d,"agent")??u(d,"targetAgent"):void 0),g=Array.isArray(e.materializedWrites)?e.materializedWrites.filter(L):[];if(p||f||g.length>0)if(r.push("",i.section("Local Materialization")),p&&r.push(`  ${i.label("Scope")}: ${p}`),f&&r.push(`  ${i.label("Agent")}: ${f}`),g.length===0)r.push(`  ${i.muted("No local files were written by this command.")}`);else for(let y of g.slice(0,re)){let w=u(y,"path");w&&r.push(`  ${i.arrow} ${w}`)}let h=Pk(e,i).filter(y=>!y.includes("materialized writes:"));h.length>0&&r.push("",...h);let m=xk(e);return m.length>0&&r.push("",i.section("Next"),...m.map(y=>`  ${i.arrow} ${y}`)),r.join(`
+`)}function D0(e,t){let n=E(e,"trust"),i=E(e,"securityPosture"),r=E(e,"capabilityProfile"),s=n?.securityScore??n?.score??e.securityScore??i?.securityScore,a=ee(n,"runtimeRisk")??u(e,"runtimeRisk")??ee(i,"runtimeRisk")??ee(r,"runtimeRisk"),o=ee(n,"recommendation")??u(e,"recommendation")??ee(i,"recommendation"),l=ee(n,"label")??ee(n,"trust")??u(e,"trustStatus")??u(e,"trust")??ee(i,"label");if(s===void 0&&!a&&!o&&!l)return[];let c=[t.section("Trust")];return s!==void 0&&c.push(`  ${t.label("Security score")}: ${fe("securityScore",s)}`),a&&c.push(`  ${t.label("Runtime risk")}: ${a}`),o&&c.push(`  ${t.label("Recommendation")}: ${o}`),l&&c.push(`  ${t.label("Status")}: ${l}`),c.push(`  ${t.label("Source")}: skills-layer trust`),c}async function q0(e,t){let n=hu("installed",e);if(n.failure)return n.failure;let i=await pe(t),r=Object.values(i.installs).filter(s=>{let a=u(s,"scope"),o=u(s,"agent");return(!n.scope||a===n.scope)&&(!n.agent||o===n.agent)});return b({status:"ok",results:r},`Found ${r.length} local install records.`,e.json,t)}async function M0(e,t,n){let i=R(e[0],"remove requires a skill slug."),r=Cy("remove",t);if(r)return r;let a=(await pe(n)).installs[i];if(!a)return P({status:"not_installed",reasonCode:"local_install_not_found",skillSlug:i},`${i} is not installed locally. Run \`skills-layer installed\` or \`skills-layer sync\` to inspect local records.`,t.json,"local_install_not_found");let o=k(t.scope),l=k(t.agent);if(o&&u(a,"scope")!==o||l&&(u(a,"agent")??u(a,"targetAgent"))!==l)return P({status:"not_installed",reasonCode:"local_install_target_not_found",skillSlug:i,requestedScope:o,requestedAgent:l},`${i} is not installed for the requested local target.`,t.json,"local_install_target_not_found");let c=qe(a);if(!c)return P({status:"blocked",reasonCode:"exact_install_receipt_missing",skillSlug:i,nextAction:"install",nextStep:`Reinstall ${i} from an approved Artifact Format v1 export before removing or quarantining it.`},`Skills Layer cannot safely remove ${i} because its exact-generation receipt is missing or invalid.`,t.json,"exact_install_receipt_missing");if(c.state==="quarantined"){let f={status:"removed",skillSlug:i,removedRecord:a,localLifecycle:c};return t.json?b(f,`${i} is already removed from discovery.`,!0,n):{exitCode:0,stdout:Kh(i,n),stderr:""}}if(c.state!=="active"&&c.state!=="pending_activation")return P({status:"blocked",reasonCode:"local_lifecycle_busy",skillSlug:i,localLifecycle:c},`${i} cannot be removed while its local lifecycle is ${c.state}.`,t.json,"local_lifecycle_busy");let d;try{d=await ek({backend:n,skillSlug:i,record:a,lifecycle:c,reasonCode:"user_removed",purpose:"quarantine_revoked",status:"removed"})}catch(f){return P({status:"blocked",reasonCode:"exact_generation_quarantine_failed",skillSlug:i,error:X(f),nextAction:"guardian.incident.review",nextStep:"Do not run the skill. Inspect local drift or permissions, then retry removal after the exact tree is restored."},`Skills Layer could not atomically remove the exact installed generation for ${i}.`,t.json,"exact_generation_quarantine_failed")}let p={status:"removed",skillSlug:i,removedRecord:d.record,localLifecycle:d.lifecycle};return t.json?b(p,`Removed ${i}.`,!0,n):{exitCode:0,stdout:Kh(i,n),stderr:""}}async function ek(e){if(e.lifecycle.receipt.generation.skillSlug!==e.skillSlug)throw new Error("Install receipt skill identity does not match the indexed slug.");let t=`quarantine_${it(16).toString("hex")}`,n={status:"authorized",authorizationId:`${e.purpose}_${it(16).toString("hex")}`,purpose:e.purpose,generation:e.lifecycle.receipt.generation,archiveSha256:e.lifecycle.receipt.archiveSha256,manifestSha256:e.lifecycle.receipt.manifestSha256},i=await Em({receipt:e.lifecycle.receipt,reasonCode:e.reasonCode,quarantineRoot:K(e.backend.paths.stateDir,"quarantine"),discoveryRoots:U0(e.backend,e.lifecycle.receipt.targetDir),authorizeQuarantine:async()=>n}),r=await pe(e.backend),s=r.installs[e.skillSlug],a=s?qe(s):null;if(!s||!a||a.operationId!==e.lifecycle.operationId)throw new Error("Local install record changed while its exact generation was quarantined.");let o=or({state:"quarantined",operationId:t,receipt:e.lifecycle.receipt,quarantine:i,backend:e.backend}),l={...s,status:e.status,localLifecycle:o,savedAt:e.backend.now()};return r.installs[e.skillSlug]=l,await It(e.backend,r),{record:l,lifecycle:o,quarantine:i}}function U0(e,t){let n=new Set([ge(t)]);for(let i of We(e.env,e.platform,e.cwd)){n.add(i.targets.projectSkillsPath),i.targets.globalSkillsPath&&n.add(i.targets.globalSkillsPath);for(let r of[i.pathContracts.project,i.pathContracts.global]){r.preferredPath&&n.add(r.preferredPath);for(let s of[...r.compatibleReadOnlyPaths,...r.legacyReadOnlyPaths])n.add(s.path)}}return[...n]}async function V0(e,t,n){let i=R(e[0],"update requires a skill slug."),r=new URLSearchParams,s=k(t.pin);if(s&&!Ea(s))return P({status:"error",reasonCode:"invalid_pin",skillSlug:i,requestedPin:s,nextAction:"update",nextStep:"Use --pin with a semver version such as 1.2.3 or an external-<digest> Skills Layer version."},`Invalid --pin "${s}". Use a semver version or an external-<digest> version.`,t.json,"invalid_pin");ie(r,"pin",s),t.dryRun&&r.set("dryRun","true");let o=(await pe(n)).installs[i],l;try{l=await C(n,`/api/v1/skills/${encodeURIComponent(i)}${ye(r)}`,{headers:V(n.apiKey,n.authBlockedMessage)})}catch(d){if(d instanceof D&&d.status===404&&o){let p={status:"backend_missing",reasonCode:"local_install_backend_missing",skillSlug:i,localInstall:o,installedVersion:u(o,"version")??u(o,"currentVersion"),selectedBackend:n.baseUrl,nextStep:`This skill is installed locally, but no catalog update source was found on ${n.baseUrl}. Reinstall from its source, run \`skills-layer search ${i}\`, or run \`skills-layer remove ${i}\` if you no longer need it.`};return P(p,`${i} is installed locally, but no catalog update source was found on this backend. Reinstall from its source, search for a replacement, or remove the local install.`,t.json,"local_install_backend_missing")}if(d instanceof D)return dr(d,t.json);throw d}let c=K0(i,l,o,n);if(s&&!G0(c,s))return P({status:"not_found",reasonCode:"pin_not_resolved",skillSlug:i,requestedPin:s,installedVersion:u(o,"version")??u(o,"currentVersion"),currentVersion:u(c,"currentVersion"),nextAction:"update",nextStep:`Choose a version returned by \`skills-layer show ${i} --json\` or omit --pin to check the latest available version.`},`${i} does not have a resolvable version for --pin ${s}.`,t.json,"pin_not_resolved");if(!t.dryRun&&o){let d=u(o,"version")??u(o,"currentVersion"),p=u(c,"latestAvailableVersion"),f=s??p;if(!!(f&&f!==d)){let h={...t,dryRun:!1,pin:void 0,version:f,scope:k(t.scope)??u(o,"scope")??"project",agent:k(t.agent)??u(o,"agent")??u(o,"targetAgent")??"codex"};return await Ca([i],h,n)}}return t.json?b(c,"Update check complete.",!0,n):{exitCode:0,stdout:W0(c,n),stderr:""}}function Ea(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(e)||/^external-[0-9A-Za-z][0-9A-Za-z._-]*$/u.test(e)}function G0(e,t){let n=[u(e,"version"),u(e,"currentVersion"),u(e,"latestVersion"),u(e,"targetVersion"),u(e,"availableVersion")].filter(Boolean),i=E(e,"update");return i&&n.push(u(i,"version"),u(i,"currentVersion"),u(i,"latestVersion"),u(i,"targetVersion"),u(i,"availableVersion")),n.some(r=>r===t)}async function z0(e,t){let n=hu("sync",e);if(n.failure)return n.failure;let i=await pe(t),r=Object.values(i.installs).filter(o=>{let l=u(o,"scope"),c=u(o,"agent");return(!n.scope||l===n.scope)&&(!n.agent||c===n.agent)}),a={status:"synced",results:await Promise.all(r.map(async o=>H0(o,t)))};return e.json?b(a,"Local install records synced.",!0,t):{exitCode:0,stdout:Y0(a,t),stderr:""}}function K0(e,t,n,i){let r=n?u(n,"version")??u(n,"currentVersion"):void 0,s=u(t,"currentVersion")??u(t,"version"),a=n?r&&s&&r!==s?"update_available":"up_to_date":"not_installed";return B({...t,skillSlug:u(t,"skillSlug")??u(t,"slug")??e,updateStatus:a,installedVersion:r,latestAvailableVersion:s,selectedBackend:i.baseUrl,localInstall:n,nextStep:a==="not_installed"?`Run \`skills-layer install ${e}\` to install this skill locally.`:a==="update_available"?`Run \`skills-layer install ${e}\` to apply the latest available version.`:`No update is needed for ${e}.`})}async function H0(e,t){let n=u(e,"skillSlug")??u(e,"slug");if(!n)return{...e,syncStatus:"local_only",backendStatus:"unchecked"};try{let i=await C(t,`/api/v1/skills/${encodeURIComponent(n)}`,{headers:xa(t.apiKey)}),s=(u(i,"claimedOrigin")??u(i,"sourceKind")??u(e,"sourceKind"))==="public_source"||u(e,"sourceKind")==="external";return{...e,syncStatus:s?"source_backed":"catalog_backed",backendStatus:"found",latestAvailableVersion:u(i,"currentVersion")??u(i,"version"),catalog:J0(i)}}catch(i){return i instanceof D&&i.status===404?{...e,syncStatus:"backend_missing",backendStatus:"not_found",selectedBackend:t.baseUrl}:{...e,syncStatus:"unchecked",backendStatus:"error",backendError:X(i)}}}function J0(e){return B({slug:u(e,"slug")??u(e,"skillSlug"),currentVersion:u(e,"currentVersion")??u(e,"version"),claimedOrigin:u(e,"claimedOrigin"),trust:u(e,"trust")??u(e,"publicationStatus")})}function W0(e,t){let n=ce(t),i=u(e,"skillSlug")??u(e,"slug")??"skill",r=u(e,"updateStatus")??"checked",s=[`${n.ok("OK")} Update check complete.`,"",n.section("Update")];s.push(`  ${n.label("Skill")}: ${i}`),s.push(`  ${n.label("Status")}: ${r.replaceAll("_"," ")}`);let a=u(e,"installedVersion"),o=u(e,"latestAvailableVersion");a&&s.push(`  ${n.label("Installed version")}: ${a}`),o&&s.push(`  ${n.label("Latest available version")}: ${o}`);let l=E(e,"localInstall"),c=l?u(l,"materializedPath")??u(l,"path"):void 0,d=l?u(l,"scope"):void 0,p=l?u(l,"targetAgent")??u(l,"agent"):void 0;l&&(s.push("",n.section("Local Install")),d&&s.push(`  ${n.label("Scope")}: ${d}`),p&&s.push(`  ${n.label("Agent")}: ${p}`),c&&s.push(`  ${n.label("Path")}: ${c}`));let f=u(e,"nextStep");return f&&s.push("",n.section("Next"),`  ${n.arrow} ${f}`),s.join(`
+`)}function Y0(e,t){let n=ce(t),i=[`${n.ok("OK")} Local install records synced.`,"",n.section(`Results (${e.results.length})`)];return e.results.length===0?(i.push(`  ${n.muted("No local install records found.")}`),i.join(`
+`)):(e.results.slice(0,re).forEach((r,s)=>{let a=u(r,"skillSlug")??u(r,"slug")??`item-${s+1}`,o=u(r,"syncStatus")??"unchecked",l=u(r,"version")??u(r,"currentVersion");i.push(`${s+1}. ${a}`),i.push(`   status: ${o.replaceAll("_"," ")}${l?`; version: ${l}`:""}`),o==="backend_missing"&&i.push(`   ${n.muted("Installed locally, but missing from the selected backend catalog.")}`)}),e.results.length>re&&i.push(`  ${n.muted(`... ${e.results.length-re} more`)}`),i.push("",n.section("Next")),i.push(`  ${n.arrow} skills-layer installed`),i.push(`  ${n.arrow} skills-layer update <skill-slug>`),i.join(`
+`))}function Kh(e,t){let n=ce(t);return[`${n.ok("OK")} Removed ${e}.`,"",n.section("Local Install"),`  ${n.label("Skill")}: ${e}`,`  ${n.label("Status")}: removed locally`,"",n.section("Next"),`  ${n.arrow} skills-layer installed`,`  ${n.arrow} skills-layer sync`].join(`
+`)}function Z0(e,t,n){let i=ce(n),r=u(t,"version")??u(t,"currentVersion"),s=u(t,"scope");return[`${i.ok("OK")} Restore record found for ${e}.`,"",i.section("Local Install"),`  ${i.label("Skill")}: ${e}`,...r?[`  ${i.label("Version")}: ${r}`]:[],...s?[`  ${i.label("Scope")}: ${s}`]:[],"",i.section("Next"),`  ${i.arrow} skills-layer installed`,`  ${i.arrow} skills-layer sync`,`  ${i.arrow} skills-layer update ${e}`].join(`
+`)}function X0(e){let t=u(e,"status"),n=u(e,"reasonCode");return t==="invalid_transition"||t==="forbidden"||t==="not_found"||n==="invalid_transition"}function Q0(e,t){let n=u(e,"why")??u(e,"reason")??u(e,"error"),i=u(e,"currentVisibility"),r=u(e,"nextVisibility")??u(e,"visibility"),s=i||r?` Current visibility: ${i??"unknown"}; requested visibility: ${r??"unknown"}.`:"",a=u(e,"nextStep")??`Run \`skills-layer creator status ${t}\` and choose a valid visibility transition.`;return`Visibility was not changed for ${t}.${s}${n?` ${n}`:""}
+Next step: ${a}`}async function eT(e,t,n){let i=await pe(n),r=R(e[0],"restore requires a skill slug."),s=i.installs[r];if(!s)return P({status:"missing_record",reasonCode:"restore_record_not_found",skillSlug:r,record:null,nextAction:"installed",nextStep:`Run \`skills-layer installed\` to see local records, \`skills-layer sync\` to refresh status, or \`skills-layer search ${r}\` if you want to find a catalog/source replacement.`},`No restorable local install record was found for ${r}. Run \`skills-layer installed\`, \`skills-layer sync\`, or \`skills-layer search ${r}\` next.`,t.json,"restore_record_not_found");let a=qe(s);if(!a)return P({status:"blocked",reasonCode:"exact_install_receipt_missing",skillSlug:r,nextAction:"install",nextStep:`Reinstall ${r} from the approved catalog; legacy records cannot authorize an exact-generation restore.`},`Skills Layer cannot restore ${r} because its exact-generation lifecycle record is missing or invalid.`,t.json,"exact_install_receipt_missing");if(a.state!=="quarantined"||!a.quarantine)return P({status:"blocked",reasonCode:"restore_not_quarantined",skillSlug:r,localLifecycle:a,nextAction:"installed",nextStep:"Only a physically quarantined exact generation can be restored."},`${r} does not have a quarantined exact generation to restore.`,t.json,"restore_not_quarantined");let o=new URLSearchParams({version:a.receipt.generation.semanticVersion,operation:"restore",generationId:a.receipt.generation.generationId}),l;try{l=await C(n,`/api/v1/me/library/${encodeURIComponent(r)}/export${ye(o)}`,{headers:V(n.apiKey,n.authBlockedMessage)})}catch(m){if(m instanceof D)return dr(m,t.json);throw m}if(l.restoreAuthorization===void 0)return P({status:"blocked",reasonCode:"restore_authorization_missing",skillSlug:r,generation:a.receipt.generation,nextAction:"restore",nextStep:"Retry after the Skills Layer API returns a fresh restoreAuthorization bound to this exact generation."},`The backend did not authorize restoration of ${r}'s exact quarantined generation.`,t.json,"restore_authorization_missing");let c=kk(l.restoreAuthorization);if(!c||c.purpose!=="restore_fresh_approval"||!tT(c,a.receipt))return P({status:"blocked",reasonCode:"restore_authorization_invalid",skillSlug:r,generation:a.receipt.generation,nextAction:"restore",nextStep:"Do not restore. Refresh backend approval for this exact artifact generation."},`The backend returned an invalid or mismatched restore authorization for ${r}.`,t.json,"restore_authorization_invalid");let d=`restore_${it(16).toString("hex")}`,p=or({state:"restore_pending",operationId:d,receipt:a.receipt,quarantine:a.quarantine,backend:n});i.installs[r]={...s,localLifecycle:p,savedAt:n.now()},await It(n,i);let f;try{await xm({quarantine:a.quarantine,authorizeRestore:async()=>c,finalizeRestore:async()=>{let m=await pe(n),y=m.installs[r],w=y?qe(y):null;if(!y||!w||w.state!=="restore_pending"||w.operationId!==d)return{status:"denied",reasonCode:"restore_reservation_lost"};let v=or({state:"active",operationId:d,receipt:a.receipt,backend:n});return f={...y,status:"restored",localLifecycle:v,savedAt:n.now()},m.installs[r]=f,await It(n,m),{status:"released",releaseId:`local_restore_${it(16).toString("hex")}`}}})}catch(m){let y=await pe(n),w=y.installs[r],v=w?qe(w):null;return w&&v?.operationId===d&&(y.installs[r]={...s,localLifecycle:a,savedAt:n.now()},await It(n,y)),P({status:"blocked",reasonCode:"exact_generation_restore_failed",skillSlug:r,error:X(m),nextAction:"restore",nextStep:"Keep the generation quarantined. Resolve local path, drift, or permission problems before retrying."},`Skills Layer could not atomically restore ${r}.`,t.json,"exact_generation_restore_failed")}if(!f)throw new Error(`Atomic restore for ${r} completed without committing its local lifecycle record.`);let g=qe(f),h={status:"restored",skillSlug:r,record:f,localLifecycle:g};return t.json?b(h,`Restored ${r}.`,!0,n):{exitCode:0,stdout:Z0(r,f,n),stderr:""}}function tT(e,t){return e.generation.skillSlug===t.generation.skillSlug&&e.generation.semanticVersion===t.generation.semanticVersion&&e.generation.generationId===t.generation.generationId&&e.archiveSha256===t.archiveSha256&&e.manifestSha256===t.manifestSha256}async function nT(e,t,n){let i=R(e[0],"check requires a skill slug.");return await F(`/api/v1/skills/${encodeURIComponent(i)}/trust`,t,n,"Install trust checked.",{authenticated:!!n.apiKey})}async function iT(e,t,n){let i=R(e[0]??t.source,"import requires a source."),r=Je("import","visibility",t.visibility,Fn,t,"invalid_visibility");if(r)return r;let s=await Sa(i,n.cwd);if(!s){let o=rT(i,t);if(o)return o}let a=await C(n,"/api/v1/source-imports",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(B({...s??{source:i},quarantine:t.quarantine,skillSlug:k(t.skill),visibility:k(t.visibility)}))});return await xe(n.paths.importsPath,{version:1,lastImport:a,savedAt:n.now()}),b(a,"Source import submitted.",t.json,n)}function rT(e,t){try{return qi(e).kind!=="local"?null:P({status:"error",reasonCode:"invalid_source",source:e,nextAction:"import",nextStep:va(e)?"Check that the local path exists and contains SKILL.md, or pass a supported GitHub/GitLab/source URL.":"Use an existing local path such as ./my-skill, a GitHub/GitLab source, or --help for import examples."},va(e)?`Import source ${e} was not found or is not readable.`:`Import source "${e}" is not a supported source. Use a local path, GitHub/GitLab source, or URL.`,t.json,"invalid_source")}catch(n){return P({status:"error",reasonCode:"invalid_source",source:e,error:X(n),nextAction:"import",nextStep:"Use an existing local path such as ./my-skill, a GitHub/GitLab source, or URL."},`Import source "${e}" is invalid. ${X(n)}`,t.json,"invalid_source")}}function va(e){return/^(?:\.{1,2}(?:[\\/]|$)|[\\/]|[A-Za-z]:[\\/])/u.test(e)}function tk(e,t,n,i){let r=Pe(i.cwd,t);return P({status:"error",reasonCode:"source_path_not_found",path:r,nextAction:e,nextStep:`Check that ${t} exists and contains a readable SKILL.md, then retry.`},`${e} source path does not exist: ${r}`,n.json,"source_path_not_found")}async function sT(e,t,n){let i=e[0];if(i==="reference"&&e[1]==="resolve"){let r=R(e[2],"source reference resolve requires a reference."),s=await C(n,`/api/v1/source-references/resolve?reference=${encodeURIComponent(r)}`);return s.status==="not_found"?P({...s,status:"not_found",reasonCode:"source_reference_not_found",reference:r,nextAction:"source.connection.start",nextStep:"Start or complete the source connection before resolving this reference."},`Source reference ${r} was not found.`,t.json,"source_reference_not_found"):b(s,"Source reference resolved.",t.json,n)}return i==="connection"?await aT(e.slice(1),t,n):_(`Unknown source command "${e.join(" ")}".`,t.json)}async function aT(e,t,n){let i=e[0];if(i==="start"){let s=k(t.provider),a=k(t.source),o=k(t.visibility),l=s?.replace(/-/gu,"_");if(l&&!Rh.includes(l))return Wt("source.connection.start","provider",s??"",Rh,t,"invalid_source_provider");let c=Xt(t.priceCents,"--price-cents","priceCents","invalid_price_cents",t,{minimum:0});if(c.failure)return c.failure;let d=oT(s,a,o,t);return d||await H("/api/v1/me/source-connections",he(t,["provider","source","skill","mode","visibility","priceCents","license","provenanceIntent","discloseSource"]),t,n,"Source connection started.")}let r=R(e[1],`source connection ${i??""} requires a connection id.`);if(i==="status")return await F(`/api/v1/me/source-connections/${encodeURIComponent(r)}`,t,n,"Source connection loaded.",{authenticated:!0});if(i==="complete"){let s=mI("source.connection.complete",t);return s||await H(`/api/v1/me/source-connections/${encodeURIComponent(r)}/complete`,he(t,["providerOwnerId","providerRepoId","providerProjectId","providerInstallationId","commitSha"]),t,n,"Source connection completed.")}return i==="cancel"?await H(`/api/v1/me/source-connections/${encodeURIComponent(r)}/cancel`,{},t,n,"Source connection cancelled."):_(`Unknown source connection command "${i??""}".`,t.json)}function oT(e,t,n,i){if(n){let r=ca(n);if(!r||!Fn.includes(r))return P({status:"error",reasonCode:"invalid_visibility",visibility:n,acceptedValues:Fn,nextAction:"source.connection.start",nextStep:"Use --visibility private, public, or unlisted."},`Invalid source connection visibility "${n}". Use one of: ${Fn.join(", ")}.`,i.json,"invalid_visibility")}if(!e||!t)return null;try{let r=qi(t);if((e==="github"||e==="gitlab")&&r.kind!==e)return Lc(e,t,i);if(e==="domain"){let s=new URL(t);if(s.protocol!=="https:"||!s.hostname)return Lc(e,t,i)}}catch{return Lc(e,t,i)}return null}function Lc(e,t,n){return P({status:"error",reasonCode:"invalid_source",provider:e,source:t,nextAction:"source.connection.start",nextStep:e==="github"?"Use a GitHub source such as https://github.com/OWNER/REPO or github:OWNER/REPO.":e==="gitlab"?"Use a GitLab source such as https://gitlab.com/GROUP/REPO or gitlab:GROUP/REPO.":"Use a valid source URL or provider-specific source."},`Invalid ${e} source "${t}".`,n.json,"invalid_source")}async function lT(e,t,n){if(e[0]!=="request")return _(`Unknown approval command "${e[0]??""}".`,t.json);let i=e[1];if(i!=="status"&&i!=="complete")return _("approval request requires `status <approval-request-id>` or `complete <approval-request-id> --decision <approved|denied>`.",t.json);let r=R(e[2],`approval request ${i??""} requires an approval id.`);if(i==="status")return await F(`/api/v1/me/approvals/${encodeURIComponent(r)}`,t,n,"Approval status loaded.",{authenticated:!0});let s=R(t.decision,"approval request complete requires --decision."),a=Je("approval.request.complete","decision",s,rI,t,"invalid_decision");return a||await H(`/api/v1/me/approvals/${encodeURIComponent(r)}/complete`,B({decision:s,evidence:Cu(t.decisionEvidenceJson,"decision-evidence-json")}),t,n,"Approval completed.")}async function cT(e,t,n){let i=e[0]??"list";if(i==="list")return await F("/api/v1/me/workspaces",t,n,"Workspaces loaded.",{authenticated:!0});if(i==="current"){let s=await C(n,"/api/v1/me/working-mode",{headers:V(n.apiKey,n.authBlockedMessage)});return await Zt(n,s),b(s,"Active workspace selection loaded.",t.json,n)}if(i==="use"){let s=R(e[1],"workspace use requires a workspace id."),a=await C(n,"/api/v1/me/working-modes",{headers:V(n.apiKey,n.authBlockedMessage)}),o=(Array.isArray(a.modes)?a.modes:[]).filter(L).filter(p=>u(p,"type")==="enterprise_workspace"&&u(p,"workspaceId")===s);if(o.length===0)return P({status:"not_found_or_forbidden",reasonCode:"workspace_working_mode_not_found",workspaceId:s,nextAction:"workspace.list",nextStep:"Run `skills-layer workspace list` to find a workspace you can access, then retry with that workspace id."},`Workspace ${s} was not found in your enterprise workspace access.`,t.json,"workspace_working_mode_not_found");if(o.length>1)return P({status:"ambiguous_workspace",reasonCode:"workspace_working_mode_ambiguous",workspaceId:s,nextAction:"workspace.list",nextStep:"Workspace ids should be unique. Run `skills-layer workspace list` and use the exact workspace id shown there."},`Workspace ${s} matched more than one enterprise workspace.`,t.json,"workspace_working_mode_ambiguous");let l=u(o[0],"modeId");if(!l)return P({status:"error",reasonCode:"workspace_working_mode_invalid",workspaceId:s,nextAction:"workspace.list",nextStep:"Run `skills-layer workspace list` and retry with a workspace id that includes an enterprise working selection."},`Workspace ${s} is missing a selectable enterprise working mode.`,t.json,"workspace_working_mode_invalid");let c=await C(n,"/api/v1/me/working-mode",{method:"PUT",headers:j(n.apiKey,n.authBlockedMessage),body:JSON.stringify({modeId:l})});await Zt(n,c);let d=u(o[0],"label");return b(c,`Workspace selected: ${d?`${d} (${s})`:s}.`,t.json,n)}if(!["request","approve","reject","skills","guide"].includes(i))return _(`Unknown workspace command "${i}".`,t.json);let r=R(e[1],`workspace ${i} requires a workspace id.`);if(i==="request"||i==="approve"||i==="reject"){let s=R(e[2],`workspace ${i} requires a skill slug.`);try{return i==="request"?await H(`/api/v1/workspaces/${encodeURIComponent(r)}/skill-requests`,{skillSlug:s,reason:k(t.reason)},t,n,"Workspace skill request captured."):await H(`/api/v1/workspaces/${encodeURIComponent(r)}/skills/${encodeURIComponent(s)}/${i}`,{},t,n,i==="approve"?"Workspace skill approval evaluated.":"Workspace skill rejected.")}catch(a){if(a instanceof D&&(a.status===403||a.status===404))return i==="reject"&&uT(a)?Jh(r,s,t):i==="approve"&&dT(a)?pT(r,s,t,a):Hh(r,t);throw a}}if(i==="skills")try{return await F(`/api/v1/workspaces/${encodeURIComponent(r)}/skills`,t,n,"Workspace skills loaded.",{authenticated:!0})}catch(s){if(s instanceof D&&(s.status===403||s.status===404))return Hh(r,t);throw s}if(i==="guide"){let s=R(e[2],"workspace guide requires a skill slug.");try{return await F(`/api/v1/workspaces/${encodeURIComponent(r)}/skills/${encodeURIComponent(s)}/install-guide`,t,n,"Workspace install guide loaded.",{authenticated:!0})}catch(a){if(a instanceof D&&a.status===404)return Jh(r,s,t);throw a}}return _(`Unknown workspace command "${i}".`,t.json)}function Hh(e,t){return P({status:"not_found_or_forbidden",reasonCode:"workspace_not_found_or_forbidden",workspaceId:e,nextAction:"workspace.list",nextStep:"Run `skills-layer workspace list` to find a workspace you can access, then retry with that workspace id."},`Workspace ${e} was not found or you do not have access. Run \`skills-layer workspace list\` to inspect accessible workspaces.`,t.json,"workspace_not_found_or_forbidden")}function Jh(e,t,n){let i={status:"approval_not_found",reasonCode:"workspace_skill_approval_not_found",workspaceId:e,skillSlug:t,nextAction:"workspace.approve",nextStep:`Run \`skills-layer workspace approve ${e} ${t}\` first, then run \`skills-layer workspace guide ${e} ${t}\` after the approval exists.`};return P(i,`Workspace approval not found for ${t}. Run \`skills-layer workspace approve ${e} ${t}\` first.`,n.json,"workspace_skill_approval_not_found")}function uT(e){let t=e.details??{},n=u(t,"reasonCode")?.toLowerCase(),i=`${u(t,"error")??e.message}`.toLowerCase();return n==="workspace_skill_approval_not_found"||i.includes("workspace")&&i.includes("approval")&&i.includes("not found")}function dT(e){let t=e.details??{},n=u(t,"reasonCode")?.toLowerCase(),i=`${u(t,"error")??e.message}`.toLowerCase();return n==="skill_not_found"||i.includes("skill")&&i.includes("not found")}function pT(e,t,n,i){let r=i.details??{},s={status:"not_found",reasonCode:"skill_not_found",workspaceId:e,skillSlug:t,nextAction:"search",nextStep:u(r,"nextStep")??`Run \`skills-layer search ${t}\` to find the public skill before approving it for workspace ${e}.`};return P(s,`Skill ${t} was not found. Run \`skills-layer search ${t}\` before approving it for the workspace.`,n.json,"skill_not_found")}async function fT(e,t,n){let i=R(e[0],"buy requires a skill slug."),r=wI(t);if(r.failure)return r.failure;let s=await C(n,"/api/v1/buy",{method:"POST",headers:j(n.apiKey),body:JSON.stringify({skillSlug:i,paymentMethod:r.value})});if(s.status==="already_owned")return b(s,`You already own ${i}. Run \`skills-layer install ${i}\` to install or update it.`,t.json,n);if(t.json||t.noOpen||s.status!=="checkout_required"||typeof s.checkoutUrl!="string"||typeof s.purchaseId!="string")return b(s,`Purchase flow started for ${i}.`,t.json,n);n.emitInfo(`Opening checkout for ${i}. Complete the payment in your browser, then come back here.`),await n.openUrl(s.checkoutUrl)||n.emitInfo(`Open this checkout URL manually to continue: ${s.checkoutUrl}`),n.emitInfo("Waiting for payment confirmation...");let o=await i$(s.purchaseId,n);return Z(o)?o:o.status!=="succeeded"&&o.status!=="refund_requested"?b({...s,purchaseStatus:o.status},`Checkout is still ${o.status} for ${i}. You can rerun install after payment reconciliation completes.`,t.json,n):(n.emitInfo("Payment confirmed. Continuing with install."),await Ca([i],t,n))}async function gT(e,t,n){let i=e[0]??"list";if(i==="list")return await F("/api/v1/purchases",t,n,"Purchases loaded.",{authenticated:!0});if(i==="spending")return await F("/api/v1/spending",t,n,"Spending loaded.",{authenticated:!0});let r=R(e[1],`purchases ${i} requires a purchase id.`);return i==="invoice"?await F(`/api/v1/purchases/${encodeURIComponent(r)}/invoice`,t,n,"Invoice loaded.",{authenticated:!0}):i==="refund-quote"?await F(`/api/v1/purchases/${encodeURIComponent(r)}/refund-quote`,t,n,"Refund quote loaded.",{authenticated:!0}):i==="refund"?await H(`/api/v1/purchases/${encodeURIComponent(r)}/refund`,he(t,["reason"]),t,n,"Refund requested."):_(`Unknown purchases command "${i}".`,t.json)}async function mT(e,t,n){let i=e[0];if(i==="search"){let r=new URLSearchParams;return ie(r,"query",e.slice(1).join(" ").trim()||k(t.query)),ie(r,"limit",k(t.limit)),await F(`/api/v1/me/search${ye(r)}`,t,n,"Authenticated library search complete.",{authenticated:!0})}if(i==="add"){let r=R(e[1],"library add requires a skill slug.");return await H("/api/v1/install",{skillSlug:r},t,n,"Skill added to library.")}return _(`Unknown library command "${i}".`,t.json)}async function hT(e,t,n){let i=R(e[0],"export requires a skill slug.");if(t.showUrl&&k(t.output))return P({status:"error",reasonCode:"conflicting_export_output",nextAction:"export",nextStep:"Use either --show-url to inspect the signed URL or --output <file> to download the bundle, not both."},"export cannot use --show-url and --output together.",t.json,"conflicting_export_output");let r=new URLSearchParams,s=k(t.version);if(s&&!Ea(s))return yu("export",s,t);ie(r,"version",s);let a=await C(n,`/api/v1/me/library/${encodeURIComponent(i)}/export${ye(r)}`,{headers:V(n.apiKey,n.authBlockedMessage)}),o=k(t.output);if(o){let l=await Ly({backend:n,exportResult:a,flags:t,skillSlug:i});if(Z(l))return l;let c=Pe(n.cwd,o);await Ik(c,l.bytes);let d={...a};return delete d.downloadUrl,b({...d,archiveSha256:l.archiveSha256,archiveSha256Meaning:"artifact_v1_exact_zip_bytes_sha256",downloadedArchiveSha256:l.archiveBytesSha256,downloadedFileSha256:l.archiveBytesSha256,archiveHashFormat:l.archiveHashFormat,generationId:l.envelope.generation.generationId,manifestSha256:l.envelope.manifest.sha256,outputPath:c,downloaded:!0},`Exported ${i} to ${c}. Downloaded file SHA-256: ${l.archiveBytesSha256}.`,t.json,n)}return b(a,o?`Exported ${i} to ${o}.`:"Export prepared.",t.json,n)}async function Wh(e,t,n,i){let r=R(t[0],`${e==="add"?"add-review":"show-reviews"} requires a skill slug.`);if(e==="show")return await F(`/api/v1/me/library/reviews?skillSlug=${encodeURIComponent(r)}`,n,i,"Reviews loaded.",{authenticated:!0});let s=R(n.rating,"add-review requires --rating.");if(!/^[1-5]$/u.test(s))return P({status:"error",reasonCode:"invalid_rating",rating:s,acceptedValues:["1","2","3","4","5"],nextAction:"add-review",nextStep:"Use --rating with a whole number from 1 to 5."},`Invalid review rating "${s}". Use a whole number from 1 to 5.`,n.json,"invalid_rating");let a=he(n,["rating","feedback"]);if(typeof n.evalSummary=="string"){let o=await le(Ra(i.cwd,n.evalSummary));if(o===null)return P({status:"error",reasonCode:"invalid_eval_summary_file",path:n.evalSummary,nextAction:"add-review",nextStep:"Pass --eval-summary with a readable JSON redacted eval summary envelope."},`Could not read eval summary JSON from ${n.evalSummary}.`,n.json,"invalid_eval_summary_file");a.evalSummary=o}return await H(`/api/v1/me/library/${encodeURIComponent(r)}/review`,a,n,i,"Review added.")}async function Yh(e,t,n,i){let r=R(t[0],`${e==="add"?"add-issue":"show-issues"} requires a skill slug.`);if(e==="show")return await F(`/api/v1/me/library/${encodeURIComponent(r)}/issues`,n,i,"Issues loaded.",{authenticated:!0});R(n.message,"add-issue requires --message.");let s=Je("add-issue","issueType",n.issueType,iI,n,"invalid_issue_type","issue-type");return s||await H(`/api/v1/me/library/${encodeURIComponent(r)}/report-issue`,he(n,["issueType","message"]),n,i,"Issue reported.")}async function yT(e,t,n){let i=e[0];if(i==="hook"){let r=e[1];return r==="install"?await ik(t,n):r==="status"?await bT(t,n):_(`Unknown guardian hook command "${r??""}".`,t.json)}if(i==="enable")return e[1]||t.skill?await Oc("enforce",e,t,n):_("guardian enable requires a skill slug.",t.json);if(i==="disable")return await Oc("disabled",e,t,n);if(i==="enable-warnings-only")return await Oc("warning_only",e,t,n);if(i==="status")return await wT(e,t,n);if(i==="exec")return await kT(e,t,n);if(i==="check"){let r=R(e[1]??t.skill,"guardian check requires a skill slug."),s=sy(t,"check"),a=t.grantJson.map(h=>Tk(h,"grant-json")),o=gL(t.cloudTrustLedger);if(o.status==="invalid")return _(o.message,t.json);let l=eu(t.telemetryMode,o.policy==="off"?"local_only":"cloud_managed");if(l.status==="invalid")return _(l.message,t.json);let c=await sk({skillSlug:r,version:k(t.version),action:s,flags:t,backend:n,telemetryMode:l.mode});if(c.status!=="ok")return c.result;let d=c.context.installedPath,p=k(t.version)??c.context.version,f=B({skillSlug:r,version:p,action:s,authorizationGrants:a,path:d,guardianPreference:await bu(n,r),unmanagedPolicy:c.context.unmanagedPolicy,allowUnmanagedOnce:t.allowUnmanagedOnce,telemetryMode:l.mode,localPreflight:Jt(c.context)}),g=await C(n,"/api/v1/guardian/enforce",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(f)});return await nr(n,{skillSlug:r,version:p,action:s,decisionStatus:ba(g),reasonCode:nu(g),telemetryMode:l.mode,path:d}),b({...g,localPreflight:Jt(c.context)},"Guardian check complete.",t.json,n)}if(i==="incident"){let r=R(e[1]??t.skill,"guardian incident requires a skill slug."),s=R(t.version,"guardian incident requires --version."),a=eu(t.telemetryMode,"cloud_managed");if(a.status==="invalid")return _(a.message,t.json);let o=k(t.path);if(o&&!await st(Pe(n.cwd,o)))return P({status:"error",reasonCode:"invalid_incident_path",path:o,nextAction:"guardian.incident",nextStep:"Use --path with an installed skill directory, or omit --path so Skills Layer resolves the local install record."},`Guardian incident path does not exist: ${o}`,t.json,"invalid_incident_path");let l=o??(await ak({skillSlug:r,flags:t,backend:n})).installedPath,c=sy(t,"incident"),d=Cu(t.evidenceJson,"evidence-json"),p=a.mode==="cloud_managed"&&!n.apiKey?"local_only":a.mode,f=B({skillSlug:r,version:s,action:c,evidence:d,path:l,telemetryMode:p,incident:!0,reason:k(t.reason)});if(p==="local_only"){if(!l)return _("guardian incident --telemetry-mode local_only requires --path <installed-skill-path>.",t.json);let y=await ny({backend:n,skillSlug:r,version:s,installedPath:l,action:c,reason:k(t.reason)??"Guardian local-only incident"});if(u(y,"status")!=="quarantined"){let v=u(y,"reasonCode")??"guardian_exact_quarantine_failed";return P(y,`Guardian could not physically quarantine the exact installed generation for ${r}.`,t.json,v)}await nr(n,{skillSlug:r,version:s,action:c,decisionStatus:"blocked",reasonCode:"incident_recorded",telemetryMode:p,path:l});let w=iy(n,r);return await uy(w,JSON.stringify({request:f,response:null,localResponse:y,savedAt:n.now()},null,2)),b({status:"written",skillSlug:r,version:s,telemetryMode:p,cloudTelemetry:n.apiKey?"not_requested":"login_required",localResponse:y,incidentStatePath:w,incidentPath:y.incidentPath},n.apiKey?"Guardian incident recorded locally.":"Guardian incident recorded locally. Log in to submit Cloud incident evidence.",t.json,n)}let g=await C(n,"/api/v1/guardian/enforce",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(f)}),h=l?await ny({backend:n,skillSlug:r,version:s,installedPath:l,action:c,reason:k(t.reason)??"Guardian Cloud-managed incident"}):null;if(h&&u(h,"status")!=="quarantined"){let y=u(h,"reasonCode")??"guardian_exact_quarantine_failed";return P({...h,cloudResponse:g},`Guardian recorded the Cloud incident but could not physically quarantine the exact local generation for ${r}.`,t.json,y)}await Mn(n.paths.incidentsDir,{recursive:!0});let m=iy(n,r);return await uy(m,JSON.stringify({request:f,response:g,localResponse:h,savedAt:n.now()},null,2)),await nr(n,{skillSlug:r,version:s,action:c,decisionStatus:ba(g),reasonCode:nu(g),telemetryMode:a.mode,path:l}),b({...g,telemetryMode:a.mode,localResponse:h,incidentPath:m},"Guardian incident recorded.",t.json,n)}return _(`Unknown guardian command "${i??""}".`,t.json)}async function kT(e,t,n){let i=k(t.skill),r=R(i??e[1],"guardian exec requires a skill slug."),s=i?e.slice(1):e.slice(2);if(s.length===0)return _("guardian exec requires a command after --.",t.json);let a=eu(t.telemetryMode,"cloud_managed");if(a.status==="invalid")return _(a.message,t.json);let o=Xh(s),l=await sk({skillSlug:r,version:k(t.version),action:o,flags:t,backend:n,telemetryMode:a.mode});if(l.status!=="ok")return l.result;let c=l.context.installedPath,d=k(t.version)??l.context.version;if(!d)return P({status:"blocked",reasonCode:"guardian_exact_version_required",skillSlug:r,nextStep:"Install the skill through Skills Layer or pass its exact --version before guarded execution."},"Guardian guarded execution requires an exact installed skill version.",t.json,"guardian_exact_version_required");let p=await IT({commandArgs:s,skillSlug:r,version:d,flags:t,backend:n,localContext:l.context});if(p.status==="blocked")return p.result;let f=Xh(s,p.request),g=B({skillSlug:r,version:d,action:f,path:c,guardianPreference:await bu(n,r),telemetryMode:a.mode,localPreflight:Jt(l.context)}),h=await C(n,"/api/v1/guardian/enforce",{method:"POST",headers:j(n.apiKey),body:JSON.stringify(g)}),m=ba(h),y=nu(h);if(await nr(n,{skillSlug:r,version:d,action:f,decisionStatus:m,reasonCode:y,telemetryMode:a.mode,path:c}),!xT(h))return P({status:"blocked",reasonCode:y,skillSlug:r,guardian:h,localPreflight:Jt(l.context),command:{executable:me(s[0]??""),executed:!1}},"Guardian blocked guarded execution.",t.json,y);if(t.dryRun)return b({status:"allowed",skillSlug:r,guardian:h,localPreflight:Jt(l.context),command:{executable:me(p.request.executableRealPath),executableSha256:p.request.executableSha256,argvSha256:lk(p.request.argv),cwdRealPath:p.request.cwdRealPath,executed:!1,dryRun:!0}},"Guardian guarded execution allowed.",t.json,n);let w=await C(n,"/api/v1/guardian/execution-grants",{method:"POST",headers:j(n.apiKey,n.authBlockedMessage),body:JSON.stringify({request:p.request})}),v=u(w,"token"),S=E(w,"plan"),A=E(w,"binding");if(!v||!S||!A)return P({status:"blocked",reasonCode:"guardian_grant_response_invalid",skillSlug:r},"Guardian returned an invalid execution grant.",t.json,"guardian_grant_response_invalid");await C(n,"/api/v1/guardian/execution-grants/consume",{method:"POST",headers:j(n.apiKey,n.authBlockedMessage),body:JSON.stringify({token:v,plan:S,binding:A})});let x;try{x=await Xm({plan:S,ambientEnvironment:n.env,approvedSecrets:p.approvedSecrets})}catch(O){let I=O instanceof Y?O.reasonCode:"guardian_process_failed";return P({status:"blocked",reasonCode:I,skillSlug:r,planHash:A.planHash},"Guardian refused the contained process launch.",t.json,I)}let $={executable:me(S.executableRealPath),argsCount:S.argv.length,exitCode:x.exitCode??1,reason:x.reason,signal:x.signal,stdout:x.stdout,stderr:x.stderr,outputTruncated:x.outputTruncated,planHash:x.planHash};return{exitCode:$.exitCode,stdout:t.json?JSON.stringify({status:$.exitCode===0?"executed":"command_failed",summary:"Guardian guarded execution complete.",why:null,nextAction:null,nextStep:null,data:{skillSlug:r,guardian:h,localPreflight:Jt(l.context),command:$},warnings:[],links:[],reasonCode:$.exitCode===0?null:"command_failed",handoff:null},null,2):qT($),stderr:$.stderr}}async function Oc(e,t,n,i){let r=R(t[1]??n.skill,`guardian ${t[0]??"mode"} requires a skill slug.`),s=await C(i,"/api/v1/guardian/mode",{method:"POST",headers:j(i.apiKey),body:JSON.stringify({skillSlug:r,requestedPreference:e,source:"public-cli"})});return s.preferenceAccepted===!0&&await MT(i,r,s),b(s,s.preferenceAccepted===!0?"Guardian mode updated.":"Guardian mode resolved by policy.",n.json,i)}async function wT(e,t,n){let i=k(t.skill)??k(e[1]),r;try{r=await nk(n,i)}catch(d){r={status:"unavailable",skillSlug:i,policySource:"cloud",reasonCode:"guardian_policy_status_unavailable",message:X(d),nextAction:"guardian.status",nextStep:"Cloud Guardian policy could not be loaded. Local hook and preference posture are still shown below."}}let s=await Vn(n),a=i?await UT(n,i):void 0,o=u(r,"status")==="unavailable",c=u(s,"enforcementLayer")!=="not_installed"&&!!s.strictPreActionBlocking?{status:"installed",reasonCode:"guardian_hook_installed",strictPreActionBlocking:!0,nextAction:"guardian.check",nextStep:"Cloud Guardian policy is enforced when checked, and the local host hook can block supported risky actions before execution."}:{status:"not_installed",reasonCode:"guardian_hook_not_installed",strictPreActionBlocking:!1,nextAction:"guardian.hook.install",nextStep:"Cloud Guardian policy is enforced when checked, but local pre-action blocking is not installed for this host. Run `skills-layer guardian hook install --agent codex --scope global` or `skills-layer setup`."};return b(B({status:o?"degraded":"ok",skillSlug:u(r,"skillSlug")??i,policy:r,localPreference:a,hook:s,cloudPolicy:{status:u(r,"effectiveMode")??u(r,"status")??"unknown",reasonCode:u(r,"reasonCode"),enforcementBoundary:"cloud_policy_when_checked",nextAction:u(r,"nextAction"),nextStep:u(r,"nextStep")},localEnforcement:c,nextAction:u(c,"nextAction"),nextStep:u(c,"nextStep")}),o?"Guardian status loaded with limited Cloud policy data.":"Guardian status loaded.",t.json,n)}async function nk(e,t){let n=t?await bu(e,t):void 0;return await C(e,"/api/v1/guardian/status",{method:"POST",headers:j(e.apiKey),body:JSON.stringify(B({skillSlug:t,requestedPreference:n,source:"public-cli"}))})}async function vT(e){if(!e.apiKey)return{status:"unknown",policySource:"cloud",reasonCode:"login_required",nextAction:"skills-layer login",nextStep:"Sign in to read the Cloud Guardian policy that applies to your account."};try{return await nk(e)}catch(t){return{status:"unavailable",policySource:"cloud",reasonCode:"guardian_policy_status_unavailable",message:X(t),nextAction:"skills-layer guardian status",nextStep:"Retry Guardian status after backend connectivity or authentication is healthy."}}}async function ik(e,t){let n=k(e.agent)??"codex",i=ck(e.scope);if(i.status==="invalid")return _(i.message,e.json);let r=We(t.env,t.platform,t.cwd).find(g=>g.id===n);if(!r)return P({status:"error",reasonCode:"unknown_agent",agent:n,nextAction:"agents.list",nextStep:"Run `skills-layer agents list` to see supported agents, then retry Guardian hook install with a supported --agent value."},`Unsupported Guardian agent "${n}". Run skills-layer agents list to see supported agents.`,e.json,"unknown_agent");let s=VT(r,i.scope,t);if(!s)return _(`Guardian ${i.scope} hooks are not available for ${r.displayName}.`,e.json);let a=pk(t,i.scope),o=ry(ka(t.cwd,s.hookPath)),l=ry(ka(t.cwd,s.configPath)),c=await fk(a),d=c.hooks.find(g=>u(g,"agent")===r.id&&u(g,"scope")===i.scope),p=await GT(s,t,d),f=[...c.hooks.filter(g=>u(g,"agent")!==r.id||u(g,"scope")!==i.scope),{hookId:Ct,hookName:Et,agent:r.id,agentName:r.displayName,scope:i.scope,hookPath:o.startsWith("..")?s.hookPath:o,configPath:l.startsWith("..")?s.configPath:l,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,hookFileOwnership:p.hookFileOwnership,...p.configEntryOwnership?{configEntryOwnership:p.configEntryOwnership}:{},...p.configFileOwnership?{configFileOwnership:p.configFileOwnership}:{},absoluteCliPath:p.absoluteCliPath,enabledAt:t.now()}];return await xe(a,{version:1,hooks:f}),b({status:"enabled",hookId:Ct,hookName:Et,agent:r.id,agentName:r.displayName,scope:i.scope,hookPath:s.hookPath,configPath:s.configPath,enforcementLayer:s.enforcementLayer,strictPreActionBlocking:s.strictPreActionBlocking,agentCommandMatrix:bc({purpose:"materialize_skill",command:"skills-layer install <skill-slug>",jsonCommand:"skills-layer install <skill-slug> --json"}),nextStep:"Guardian is installed into the selected host configuration. Local hooks call `skills-layer guardian check`; shell agents can route risky commands through `skills-layer guardian exec`; MCP-capable agents can call `guardian.check` or `guardian.enforce` before risky tool use.",warnings:["This hook is installed as a candidate integration and is not counted as strict Guardian enforcement until a real host-version allow/deny canary proves the exact adapter, script, config, and CLI binding."]},"Guardian hook enabled.",e.json,t)}async function bT(e,t){let n=k(e.scope),i=n?ck(n):null;if(i?.status==="invalid")return _(i.message,e.json);let r=await Vn(t,i?.status==="valid"?i.scope:void 0);return b(r,"Guardian status loaded.",e.json,t)}async function Vn(e,t){let n=t?[t]:["project","global"],i=[],r=new Set;for(let l of n){let c=pk(e,l);if(r.has(c))continue;r.add(c);let d=await fk(c);for(let p of d.hooks){let f=u(p,"hookPath"),g=f?ey(e,l,f):null,h=u(p,"configPath"),m=h?ey(e,l,h):null,y=g?await st(g):!1,w=m?await st(m):null,v=y?w===!1?"active_missing_config":"active":"stale_missing_hook";i.push({hookId:u(p,"hookId")??Ct,hookName:u(p,"hookName")??Et,...p,scope:u(p,"scope")??l,hookPath:g??f??null,configPath:m??h??null,active:y,configActive:w,hookState:v})}}let s=i.filter(l=>l.active===!0).length,a=i.filter(l=>l.active===!1).length,o=s>0?0:a;return{status:"ok",enforcementLayer:i.some(l=>l.active===!0&&l.strictPreActionBlocking===!0)?"native_hook":s>0?"native_hook_candidate":"not_installed",strictPreActionBlocking:i.some(l=>l.active===!0&&l.strictPreActionBlocking===!0),activeHookCount:s,missingHookCount:o,staleHookCount:a,hooks:i,setup:await Su(e),warnings:a>0?s>0?["One or more stale Guardian hook records were found, but an active Skills Layer Security Hook is installed."]:["One or more configured Guardian hooks are missing from disk. Run skills-layer guardian hook install --agent <agent> again to repair them."]:[]}}async function rk(e,t){if(e.json){let c=await le(t.paths.mcpConfigPath);return b({setup:await Su(t),mcp:{status:c?"mcp_configured":"mcp_not_configured",configured:!!c,clientId:c?u(c,"clientId")??"codex":void 0,clientIds:c&&Array.isArray(c.clientIds)?c.clientIds:void 0,mcpUrl:c?u(c,"mcpUrl"):void 0,readiness:c?{status:"configured_needs_agent_reload",verifyCommand:`skills-layer mcp verify --client ${u(c,"clientId")??"codex"}`,nextStep:"Open a fresh agent session if Skills Layer tools are not visible yet."}:void 0,nextCommand:c?"skills-layer mcp verify":"skills-layer mcp setup"},guardian:await Vn(t)},"Setup status loaded.",!0,t)}if(!t.stdoutIsTty)return b({status:"setup_needs_terminal",mcp:{nextCommand:"skills-layer mcp setup"},security:{nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Setup needs an interactive terminal. Run `skills-layer setup`, or use `skills-layer mcp setup` and `skills-layer guardian hook install --agent codex --scope project`.",!1,t);let n=await t.promptSelect("Set up Skills Layer on this machine?",[{value:"mcp",label:"Setup Skills-Layer MCP",description:"Configure Skills Layer MCP for AI tools"},{value:"security",label:"Setup Skills-Layer Security Guardian",description:"Install Guardian hooks for this workspace"},{value:"both",label:"Setup both - MCP & Security Guardian",description:"Connect supported AI tools and install Guardian hooks"},{value:"not_now",label:"Remind me Later",description:"Skip setup for now; you can run skills-layer setup later"}]);if(n==="not_now"){let c={version:1,setupChoice:"not_now",mcpChoice:"not_now",mcpPromptedAt:t.now(),guardianHookChoice:"not_now",guardianHookPromptedAt:t.now(),remindAfter:PT(t.now(),7)};return await Qh(t,c),b({status:"setup_skipped",mcp:{status:"not_configured",nextCommand:"skills-layer mcp setup"},security:{status:"not_configured",nextCommand:"skills-layer guardian hook install --agent codex --scope project"}},"Skills Layer setup skipped for now. Run `skills-layer setup` when you want MCP and Security hooks on this machine.",!1,t)}if(n!=="both"&&n!=="mcp"&&n!=="security")return _(`Unknown setup option "${n}".`,e.json);let i=n==="both"||n==="mcp",r=n==="both"||n==="security",s={status:"setup_complete",setupChoice:n},a={version:1,setupChoice:n,mcpChoice:i?"configured":"not_requested",mcpPromptedAt:t.now(),guardianHookChoice:r?k(e.scope)??"project":"not_requested",guardianHookPromptedAt:t.now()};if(i)if(!t.apiKey)s.mcp={status:"login_required",configured:!1,nextCommand:"skills-layer login"},a.mcpChoice="login_required";else{let c=await gu(e,t);if(Z(c))return c;s.mcp=c}if(r){let c={...e,json:!0,scope:k(e.scope)??"project",agent:k(e.agent)??"codex"},d=await ik(c,t);if(d.exitCode!==0)return d;s.security=e$(d.stdout)??{status:"enabled",agent:k(c.agent),scope:k(c.scope)}}await Qh(t,a);let l=(L(s.mcp)?u(s.mcp,"status"):void 0)==="login_required"?"Skills Layer Security setup complete. MCP setup needs login; run `skills-layer login`, then `skills-layer setup`.":"Skills Layer setup complete. Open a fresh agent session if MCP tools are not visible yet.";return b(s,l,e.json,t)}async function ST(e,t){let n=await Vn(t),i=await Su(t),r=U(n,"activeHookCount")??0;if(t.stdoutIsTty&&r===0&&!i)return await rk(e,t);let s=r>0?"Guardian host hooks are already configured. Run `skills-layer guardian hook status` to inspect them.":"Guardian is enabled for Skills Layer runtime checks. Run `skills-layer setup` when you want MCP and Security hooks on this machine.";return{exitCode:0,stdout:`${Wi}
+
+${s}`,stderr:""}}function _T(e,t){let n=U(e,"activeHookCount")??0,i=U(e,"missingHookCount")??0,r=u(t,"status")??"unknown",s=u(t,"effectiveMode"),a=u(t,"adminPolicy"),o=u(t,"nextAction"),l=u(t,"nextStep");return n>0&&i===0?{id:"guardian-local-hook",title:"Guardian local hook",status:"pass",summary:`Guardian native hook active count: ${n}.`,enforcementLayer:u(e,"enforcementLayer")??"native_hook",strictPreActionBlocking:e.strictPreActionBlocking===!0,policyStatus:r,adminPolicy:a,effectiveMode:s,policyNextAction:o,policyNextStep:l,recommendedCommand:"skills-layer guardian hook status"}:{id:"guardian-local-hook",title:"Guardian local hook",status:"warn",summary:`Guardian native hook setup needs attention. Active hooks: ${n}; missing hooks: ${i}.`,enforcementLayer:u(e,"enforcementLayer")??"not_installed",strictPreActionBlocking:e.strictPreActionBlocking===!0,policyStatus:r,adminPolicy:a,effectiveMode:s,policyNextAction:o,policyNextStep:l,recommendedCommand:"skills-layer guardian hook install --agent codex --scope project",nextStep:"Install a Guardian host hook for automatic checks, or route risky shell actions through `skills-layer guardian exec` for strict pre-execution blocking."}}function PT(e,t){let n=new Date(e);return Number.isNaN(n.getTime())?e:(n.setUTCDate(n.getUTCDate()+t),n.toISOString())}async function sk(e){let t=ok(k(e.flags.unmanagedPolicy)??e.backend.env.SKILLS_LAYER_UNMANAGED_SKILL_POLICY);if(t.status==="invalid")return{status:"invalid",result:_(t.message,e.flags.json)};let n=await ak({skillSlug:e.skillSlug,flags:e.flags,backend:e.backend,unmanagedPolicy:t.policy});if(n.unmanaged&&n.unmanagedPolicy==="block")return Xi({...e,context:n,reasonCode:"unmanaged_skill_blocked",message:"Guardian blocked unmanaged local skill execution.",why:"The skill path is not backed by a public install index or lockfile entry and unmanaged policy is block.",nextStep:"Install the skill with `skills-layer install <path>` or choose --unmanaged-policy warn/allow for a one-off diagnostic check."});let i=n.record?qe(n.record):null;if(i&&i.state!=="active"){let a=i.state==="quarantined"?"skill_quarantined":i.state==="restore_pending"?"skill_restore_pending":"skill_activation_pending";return Xi({...e,context:n,reasonCode:a,message:"Guardian blocked the action because this exact local generation is not active.",why:`The atomic local lifecycle state is ${i.state}.`,nextAction:i.state==="quarantined"?"guardian.incident.review":"installed",nextStep:i.state==="quarantined"?"Review the quarantine evidence and request a fresh exact-generation restore approval before re-enabling the skill.":"Complete or repair the local lifecycle transaction before running this skill."})}if(!n.installedPath)return{status:"ok",context:n};if(await ZT(n.installedPath))return Xi({...e,context:n,reasonCode:"skill_disabled",message:"Guardian blocked the action because this local skill is disabled.",why:"A local Guardian incident marker is present for this skill.",nextAction:"guardian.incident.review",nextStep:"Review the local incident report before running this skill again."});if(n.unmanaged)return{status:"ok",context:n};let r=await CT(e.skillSlug,n.installedPath);if(n.identityAssessment=r,r.reattestationRequired===!0)return Xi({...e,context:n,reasonCode:u(r,"reasonCode")??"skill_identity_mismatch",message:"Guardian blocked the action because the installed skill identity changed.",why:"The visible SKILL.md identity no longer matches the installed skill record.",nextStep:"Reinstall or re-attest the skill before running it again."});let s=await ET(e.skillSlug,n.installedPath,e.backend,n.record);return n.driftAssessment=s,s.reattestationRequired===!0?Xi({...e,context:n,reasonCode:u(s,"reasonCode")??"installed_artifact_changed",message:"Guardian blocked the action because local runtime metadata detected installed artifact drift.",why:"The installed SKILL.md hash no longer matches the materialized runtime metadata.",nextStep:"Reinstall or re-attest the skill before running it again."}):{status:"ok",context:n}}async function Xi(e){return await nr(e.backend,{skillSlug:e.skillSlug,version:e.version??e.context.version,action:e.action,decisionStatus:"blocked",reasonCode:e.reasonCode,telemetryMode:e.telemetryMode,path:e.context.installedPath}),{status:"blocked",result:P({status:"blocked",skillSlug:e.skillSlug,version:e.version??e.context.version,reasonCode:e.reasonCode,localPreflight:Jt(e.context),unmanaged:e.context.unmanaged,unmanagedPolicy:e.context.unmanagedPolicy,allowUnmanagedOnce:e.context.allowUnmanagedOnce,why:e.why,nextAction:e.nextAction,nextStep:e.nextStep},e.message,e.flags.json,e.reasonCode)}}async function ak(e){let t=ok(k(e.flags.unmanagedPolicy)),n=e.unmanagedPolicy??(t.status==="valid"?t.policy:"warn"),i=k(e.flags.path),r=await AT(e.skillSlug,e.backend),s=i?Pe(e.backend.cwd,i):r?.installedPath;return{source:i?"explicit_path":r?.source??"install_index",status:i?"ok":r?.status,reasonCode:i?void 0:r?.reasonCode,installedPath:s,archivePath:i?void 0:r?.archivePath,installedPathSource:i?"explicit_path":r?.installedPathSource,version:k(e.flags.version)??r?.version,record:r?.record,unmanaged:!!(i&&!r),unmanagedPolicy:n,allowUnmanagedOnce:e.flags.allowUnmanagedOnce}}async function AT(e,t){let i=(await pe(t)).installs[e];if(i){let r=Zh(i,t);return{source:"install_index",installedPath:r.installedPath,archivePath:r.archivePath,installedPathSource:r.installedPathSource,status:r.status,reasonCode:r.reasonCode,version:u(i,"version"),record:i}}for(let r of RT(t)){let s=await le(r);if(!L(s)||!L(s.installs))continue;let a=s.installs[e];if(L(a)){let o=Zh(a,t);return{source:"lockfile",installedPath:o.installedPath,archivePath:o.archivePath,installedPathSource:o.installedPathSource,status:o.status,reasonCode:o.reasonCode,version:u(a,"version"),record:a}}}return null}function RT(e){return Array.from(new Set([K(e.cwd,"skills-layer-lock.json"),K(e.paths.stateDir,"skills-layer-lock.json")]))}function Zh(e,t){let n=u(e,"materializedSkillRoot");if(n)return{installedPath:ma(Pe(t.cwd,n)),installedPathSource:"materializedSkillRoot",status:"ok"};let i=u(e,"canonicalPath");if(i)return{installedPath:ma(Pe(t.cwd,i)),installedPathSource:"canonicalPath",status:"ok"};let r=u(e,"path");if(r)return{installedPath:ma(Pe(t.cwd,r)),installedPathSource:"path",status:"ok"};let s=u(e,"materializedPath")??u(e,"bundlePath");if(s){let c=Pe(t.cwd,s),d=me(c).toLowerCase()==="bundle.zip"||c.toLowerCase().endsWith(".zip");return{installedPath:d?ge(ge(c)):ma(c),archivePath:d?c:void 0,installedPathSource:u(e,"materializedPath")?"materializedPath":"bundlePath",status:d?"degraded":"ok",reasonCode:d?"installed_skill_root_missing":void 0}}let o=(Array.isArray(e.materializedWrites)?e.materializedWrites.filter(L):[]).find(c=>{let d=u(c,"path");return d?.toLowerCase().endsWith("/skill.md")||d?.toLowerCase()==="skill.md"}),l=o?u(o,"path"):void 0;return{installedPath:l?ge(Pe(t.cwd,l)):void 0,installedPathSource:l?"materializedWrites":void 0,status:l?"ok":void 0}}function ma(e){return me(e).toLowerCase()==="skill.md"?ge(e):e}async function CT(e,t){let n=K(t,"SKILL.md");if(!await st(n))return{status:"not_checked",reasonCode:"skill_document_unavailable",expectedSkillSlug:e,reattestationRequired:!1};try{let i=Vy(await ur(n,"utf8"));return i?i!==e?{status:"mismatch",reasonCode:"skill_identity_mismatch",expectedSkillSlug:e,observedSkillName:i,skillDocumentPath:n,reattestationRequired:!0}:{status:"matched",expectedSkillSlug:e,observedSkillName:i,skillDocumentPath:n,reattestationRequired:!1}:{status:"not_checked",reasonCode:"skill_identity_metadata_unavailable",expectedSkillSlug:e,skillDocumentPath:n,reattestationRequired:!1}}catch(i){return{status:"invalid",reasonCode:"skill_identity_unreadable",expectedSkillSlug:e,skillDocumentPath:n,message:X(i),reattestationRequired:!0}}}async function ET(e,t,n,i){let r=i?qe(i):null,s=r?K(n.paths.stateDir,"runtime",encodeURIComponent(e),`${encodeURIComponent(r.receipt.generation.generationId)}.json`):K(t,".skills-layer-runtime.json"),a=await le(s),o=a?E(a,"materialization"):void 0,l=o?u(o,"skillDocumentSha256"):void 0;if(!a||!l)return{status:"not_checked",reasonCode:"runtime_metadata_unavailable",skillSlug:e,reattestationRequired:!1};let c=K(t,"SKILL.md");if(!await st(c))return{status:"changed",reasonCode:"installed_artifact_changed",skillSlug:e,expectedSkillDocumentSha256:l,reattestationRequired:!0};let d=mk(await ur(c,"utf8")),p=d===l;return{status:p?"unchanged":"changed",reasonCode:p?"installed_artifact_matches":"installed_artifact_changed",skillSlug:e,expectedSkillDocumentSha256:l,observedSkillDocumentSha256:d,reattestationRequired:!p}}function Jt(e){return B({source:e.source,status:e.status,reasonCode:e.reasonCode,installedPath:e.installedPath,archivePath:e.archivePath,installedPathSource:e.installedPathSource,version:e.version,unmanaged:e.unmanaged,unmanagedPolicy:e.unmanagedPolicy,allowUnmanagedOnce:e.allowUnmanagedOnce,identityAssessment:e.identityAssessment,driftAssessment:e.driftAssessment})}function ok(e){if(e===void 0||e.trim()==="")return{status:"valid",policy:"warn"};let t=e.trim().toLowerCase();return t==="allow"||t==="warn"||t==="block"?{status:"valid",policy:t}:{status:"invalid",message:"guardian check --unmanaged-policy must be one of: allow, warn, block."}}function eu(e,t){let n=k(e)??t;return n==="cloud_managed"||n==="local_only"?{status:"valid",mode:n}:{status:"invalid",message:"guardian --telemetry-mode must be one of: cloud_managed, local_only."}}function Xh(e,t){return{type:"shell_command",command:me(t?.executableRealPath??e[0]??"command"),...t?{metadata:{executableRealPath:t.executableRealPath,executableSha256:t.executableSha256,argvSha256:lk(t.argv),cwdRealPath:t.cwdRealPath,fileTargets:t.fileTargets,networkTargets:t.networkTargets,environmentKeys:t.environmentKeys,callerActionJsonIgnored:!0,callerGrantJsonIgnored:!0}}:{}}}function xT(e){let t=E(e,"enforcement");return typeof t?.canExecute=="boolean"?t.canExecute:ba(e)!=="blocked"}async function IT(e){let t=TT(e.backend.platform);if(!t)return Qi(e,"guardian_platform_unsupported","Guardian guarded execution is unavailable on this platform.");if(t==="win32")return Qi(e,"windows_process_tree_isolation_unavailable","Guardian strict execution on Windows requires a verified Job Object process-tree adapter.");if(e.commandArgs.some(DT))return Qi(e,"guardian_secret_in_argv","Guardian refuses likely credentials in command arguments; pass only explicitly brokered named environment secrets.");try{let[n,i]=await Promise.all([$T(e.commandArgs[0],e.backend,t),rr(e.backend.cwd)]),r=await lu(n);if(!r.isFile()||r.size<=0||r.size>256*1024*1024)return Qi(e,"guardian_executable_invalid","Guardian requires a bounded regular executable file.");let s=`sha256:${qn("sha256").update(await ur(n)).digest("hex")}`,a=BT(e.flags,e.backend.env),o=await OT(e.commandArgs.slice(1),i,e.backend,t),l=k(e.flags.agent)??(e.localContext.record?u(e.localContext.record,"agent")??u(e.localContext.record,"targetAgent"):void 0)??J(e.backend.config?.lastSelectedAgent)??"skills-layer-cli";return{status:"ok",approvedSecrets:a,request:{platform:t,actionFamily:"shell_execution",executableRealPath:n,executableSha256:s,argv:e.commandArgs.slice(1),cwdRealPath:i,fileTargets:o.fileTargets,networkTargets:o.networkTargets,environmentKeys:FT(t,Object.keys(a)),skillSlug:e.skillSlug,version:e.version,...k(e.flags.workspaceId)?{workspaceId:k(e.flags.workspaceId)}:{},agentId:l,hostVersion:Ht,sessionId:`guardian_session_${it(16).toString("hex")}`}}}catch(n){let i=n instanceof Y?n.reasonCode:"guardian_plan_resolution_failed";return Qi(e,i,`Guardian could not resolve the exact execution plan: ${X(n)}`)}}function Qi(e,t,n){return{status:"blocked",result:P({status:"blocked",reasonCode:t,skillSlug:e.skillSlug},n,e.flags.json,t)}}function TT(e){return e==="darwin"||e==="linux"||e==="win32"?e:null}async function $T(e,t,n){if(!e||/[\u0000-\u001f\u007f]/u.test(e))throw new Error("Executable name is invalid.");let i=n==="win32"?rt:Qt,s=i.isAbsolute(e)||e.includes("/")||e.includes("\\")?[i.isAbsolute(e)?e:i.resolve(t.cwd,e)]:LT(e,t,n);for(let a of s.slice(0,128))try{await fy(a,n==="win32"?fh.F_OK:fh.X_OK);let o=await rr(a);if((await lu(o)).isFile())return o}catch{}throw new Error(`Executable ${me(e)} was not found as an accessible regular file.`)}function LT(e,t,n){let i=n==="win32"?rt:Qt,s=(J(t.env.PATH)??(n==="win32"?"C:\\Windows\\System32":"/usr/local/bin:/usr/bin:/bin")).split(n==="win32"?";":":").filter(Boolean).slice(0,64),a=n==="win32"&&!rt.extname(e)?(J(t.env.PATHEXT)??".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean).slice(0,8):[""];return s.flatMap(o=>a.map(l=>i.join(o,`${e}${l}`)))}async function OT(e,t,n,i){let r=new Set,s=new Set;for(let a of e){let o=a.startsWith("--")&&a.includes("=")?a.slice(a.indexOf("=")+1):a;if(/^[a-z][a-z0-9+.-]*:\/\//iu.test(o)){let l=new URL(o);if(l.protocol!=="https:")throw new Error("Guardian network targets must use HTTPS.");s.add(l.toString());continue}NT(o,i)&&r.add(await jT(o,t,n,i))}return{fileTargets:[...r].sort(tu),networkTargets:[...s].sort(tu)}}function NT(e,t){return!e||e.startsWith("-")?!1:(t==="win32"?rt:Qt).isAbsolute(e)||e.startsWith("./")||e.startsWith("../")||e.startsWith("~/")||e.includes("/")||e.includes("\\")}async function jT(e,t,n,i){let r=i==="win32"?rt:Qt,s=i==="win32"?J(n.env.USERPROFILE)??J(n.env.HOME):J(n.env.HOME),a=e.startsWith("~/")&&s?r.join(s,e.slice(2)):e,o=r.normalize(r.isAbsolute(a)?a:r.resolve(t,a));try{return await rr(o)}catch{let l=await rr(r.dirname(o));return r.join(l,r.basename(o))}}function BT(e,t){let n=Array.isArray(e.secretEnv)?e.secretEnv:typeof e.secretEnv=="string"?[e.secretEnv]:[],i={};for(let r of[...new Set(n)]){if(!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u.test(r))throw new Error(`Secret environment key ${r} is invalid.`);let s=t[r];if(typeof s!="string"||s.length===0)throw new Error(`Secret environment key ${r} is unavailable.`);i[r]=s}return i}function FT(e,t){let n=e==="win32"?["PATH","SystemRoot","TEMP","TMP","USERPROFILE"]:["HOME","PATH","TMPDIR"];return[...new Set([...n,...t])].sort(tu)}function DT(e){return/(?:mktplace_|slg_exec_|github_pat_|gh[opusr]_|sk-)[A-Za-z0-9_-]{8,}/u.test(e)||/(?:password|passwd|secret|token|api[_-]?key)\s*[=:]\s*[^\s]+/iu.test(e)||/-----BEGIN [^-\r\n]{1,64} PRIVATE KEY-----/u.test(e)}function lk(e){return`sha256:${qn("sha256").update(JSON.stringify(e),"utf8").digest("hex")}`}function tu(e,t){return e<t?-1:e>t?1:0}function qT(e){let t=[e.exitCode===0?"OK Guardian guarded execution complete.":"Guardian guarded execution finished with a command error.","","Command",`  executable: ${e.executable}`,`  args count: ${e.argsCount}`,`  exit code: ${e.exitCode}`];return e.stdout&&t.push("","Stdout",e.stdout),e.stderr&&t.push("","Stderr",e.stderr),t.join(`
+`)}function ck(e){let t=k(e)??"project";return t==="project"||t==="global"?{status:"valid",scope:t}:{status:"invalid",message:"guardian hooks --scope must be one of: project, global."}}function uk(e){return K(e.paths.stateDir,"guardian-modes.json")}function dk(e){return K(e.paths.stateDir,"setup-state.json")}async function vu(e){let t=await le(uk(e));return{version:1,skills:L(t?.skills)?t.skills:{}}}async function MT(e,t,n){let i=await vu(e);await xe(uk(e),{version:1,skills:{...i.skills,[t]:{requestedPreference:u(n,"requestedPreference")??"enforce",effectiveMode:u(n,"effectiveMode")??"enforce",reasonCode:u(n,"reasonCode"),auditId:u(n,"auditId"),updatedAt:e.now()}}})}async function bu(e,t){let i=(await vu(e)).skills[t];return i?u(i,"requestedPreference"):void 0}async function UT(e,t){return(await vu(e)).skills[t]}async function Su(e){let t=await le(dk(e));return L(t)?{version:1,setupChoice:u(t,"setupChoice"),mcpChoice:u(t,"mcpChoice"),mcpPromptedAt:u(t,"mcpPromptedAt"),guardianHookChoice:u(t,"guardianHookChoice"),guardianHookPromptedAt:u(t,"guardianHookPromptedAt"),remindAfter:u(t,"remindAfter")}:null}async function Qh(e,t){await xe(dk(e),t)}function VT(e,t,n){let i=t==="global"?e.targets.globalRoot:e.targets.projectRoot;return i?e.id==="codex"?{agent:e.id,agentName:e.displayName,scope:t,hookId:Ct,hookName:Et,configPath:K(i,"hooks.json"),hookPath:K(i,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook_candidate",strictPreActionBlocking:!1}:e.id==="claude-code"?{agent:e.id,agentName:e.displayName,scope:t,hookId:Ct,hookName:Et,configPath:K(i,"settings.json"),hookPath:K(i,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook_candidate",strictPreActionBlocking:!1}:e.id==="cline"?{agent:e.id,agentName:e.displayName,scope:t,hookId:Ct,hookName:Et,configPath:K(i,"guardian-hooks.json"),hookPath:K(i,"hooks","skills-layer-guardian-hook.mjs"),enforcementLayer:"native_hook_candidate",strictPreActionBlocking:!1}:null:null}async function GT(e,t,n){await Mn(ge(e.hookPath),{recursive:!0,mode:448}),await Mn(ge(e.configPath),{recursive:!0,mode:448});let i=ty(n?.hookFileOwnership),r=await HT(t),s=await Ha({operation:i?"update":"install",filePath:e.hookPath,content:KT(e.agentName,r),...i?{previousOwnership:i}:{}});if(e.agent==="codex"||e.agent==="claude-code"){let l=JT(n?.configEntryOwnership,e.agent),c=await sd({configPath:e.configPath,update:{operation:l?"update":"install",agentId:e.agent,absoluteScriptPath:e.hookPath,...l?{previousOwnership:l}:{}}});return{hookFileOwnership:s.ownership,configEntryOwnership:c.ownership,absoluteCliPath:r}}let a=ty(n?.configFileOwnership),o=await Ha({operation:a?"update":"install",filePath:e.configPath,content:`${JSON.stringify(zT(e,t),null,2)}
+`,...a?{previousOwnership:a}:{}});return{hookFileOwnership:s.ownership,configFileOwnership:o.ownership,absoluteCliPath:r}}function pk(e,t){return t==="global"?K(e.paths.stateDir,"guardian-hooks.json"):K(e.cwd,".skills-layer","guardian-hooks.json")}async function fk(e){let t=await le(e);return{version:1,hooks:Array.isArray(t?.hooks)?t.hooks.filter(L):[]}}function ey(e,t,n){return rt.isAbsolute(n)||n.startsWith("/")?n:Ra(t==="global"?e.paths.stateDir:e.cwd,n)}function zT(e,t){return{version:1,hookId:Ct,hookName:Et,agent:e.agent,agentName:e.agentName,scope:e.scope,enforcementLayer:e.enforcementLayer,strictPreActionBlocking:e.strictPreActionBlocking,installedAt:t.now(),hooks:[{name:Et,id:Ct,event:"PreToolUse",command:`node ${WT(e.hookPath)}`,status:"candidate"}]}}function KT(e,t){return`#!/usr/bin/env node
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 
@@ -1265,6 +1492,7 @@ try {
 
 const skillSlug = payload.skillSlug || payload.skill || payload.skill_slug || process.env.SKILLS_LAYER_GUARDIAN_SKILL;
 if (!skillSlug) {
+  console.error("Skills Layer Guardian candidate hook: no signed skill attribution was supplied; this event is not counted as strict enforcement.");
   process.exit(0);
 }
 
@@ -1276,7 +1504,8 @@ const action = {
   rawEventKeys: Object.keys(payload).sort()
 };
 
-const result = spawnSync("skills-layer", [
+const result = spawnSync(process.execPath, [
+  ${JSON.stringify(t)},
   "guardian",
   "check",
   String(skillSlug),
@@ -1286,41 +1515,41 @@ const result = spawnSync("skills-layer", [
 ], { stdio: ["ignore", "inherit", "inherit"] });
 
 process.exit(result.status ?? 1);
-`}function Pi(e){return JSON.stringify(e)}async function Ci(e){let t=U(ae(e.skillDocumentPath),".skills-layer-runtime.json"),n={version:1,generatedAt:e.backend.now(),skillSlug:e.skillSlug,sourceProvider:{id:"skills-layer",name:"Skills Layer",managedBy:"skills-layer-cli"},...e.version?{skillVersion:e.version}:{},guardian:{required:!0,enforcementLayer:"cloud_guardian_with_local_preflight",strictPreActionBlocking:!1,checkCommand:`skills-layer guardian check --skill ${e.skillSlug} --json`,incidentCommand:`skills-layer guardian incident ${e.skillSlug} --path <installed-skill-path> --telemetry-mode local_only --json`,guardedExecutorCommand:`skills-layer guardian exec ${e.skillSlug} --json -- <command>`,mcpCheckTool:"guardian.check",mcpEnforceTool:"guardian.enforce",agentCommandMatrix:vn({purpose:"materialize_skill",command:`skills-layer install ${e.skillSlug}`,jsonCommand:`skills-layer install ${e.skillSlug} --json`,skillSlug:e.skillSlug}),agentGuidance:"MCP-capable agents should call guardian.check or guardian.enforce before risky tool use. Local host hooks should call skills-layer guardian check, and shell actions that need strict wrapping should use skills-layer guardian exec.",sensitiveActionFamilies:["shell_command","network_request","file_read","file_write","secret_read","browser_action","device_action","api_call","generated_code_execution","model_context_promotion"]},materialization:{skillDocumentPath:"SKILL.md",skillDocumentSha256:lo(e.skillDocumentContent)}},i=`${JSON.stringify(n,null,2)}
-`;return await ge(t,i),{path:qt(e.backend.cwd,t),bytes:new TextEncoder().encode(i).length}}async function _d(e){return await me(U(e,".skills-layer-disabled.json"))}async function ls(e){let t=e.backend.now(),n=U(e.installedPath,".skills-layer-disabled.json"),i=U(e.installedPath,".skills-layer-quarantine.json"),r=U(e.installedPath,"incident.md"),s=l(e.action,"type")??"unknown";return await ge(n,`${JSON.stringify({disabled:!0,generatedAt:t,skillSlug:e.skillSlug,version:e.version,reason:"Skills Layer Guardian incident response"},null,2)}
-`),await ge(i,`${JSON.stringify({generatedAt:t,skillSlug:e.skillSlug,version:e.version,actions:["disable_skill","quarantine_files","preserve_evidence","generate_incident_report","rescan_before_reenable"],quarantineTargets:[e.installedPath]},null,2)}
-`),await ge(r,["# Skills Layer Guardian Incident Report","",`Generated: ${t}`,`Skill: ${e.skillSlug}`,`Version: ${e.version}`,"","## Summary","",ao(e.reason),"","## Evidence","",`- ${t}: ${s} -> blocked (incident_recorded)`].join(`
-`)),{status:"written",generatedAt:t,incidentPath:r,writtenFiles:[n,i,r]}}function cs(e,t){let n=e.now().replace(/[:.]/gu,"-");return U(e.paths.incidentsDir,`${t}-${n}.json`)}async function dt(e,t){let n=U(e.paths.stateDir,"guardian-audit.jsonl");await _o(ae(n));let i={version:1,generatedAt:e.now(),skillSlug:t.skillSlug,...t.version?{skillVersion:t.version}:{},actionType:l(t.action,"type")??"unknown",actionTarget:xd(t.action),decisionStatus:t.decisionStatus,reasonCode:t.reasonCode,telemetryMode:t.telemetryMode,...t.path?{localPath:oo(t.path)}:{}};await hl(n,`${JSON.stringify(i)}
-`,{encoding:"utf8",mode:384}),await $i(n,384)}function Kt(e){let t=C(e,"decision"),n=C(e,"enforcement"),i=l(t??{},"status")??l(n??{},"status")??l(e,"status");return i==="allowed"||i==="advisory"?i:"blocked"}function Yn(e){let t=C(e,"decision");return l(t??{},"reasonCode")??l(e,"reasonCode")??l(e,"status")??"cloud_guardian_decision"}function xd(e){let t=l(e,"type");if(t==="secret_read")return"redacted_secret";if(t==="shell_command")return"redacted_command";let n=l(e,"url");if(n)try{return new URL(n).origin}catch{return"redacted_url"}let i=l(e,"target");if(i)return ao(i);let r=l(e,"path");return r?oo(r):null}function oo(e){let t=D(e.trim());return t?`<local-path>/${t}`:"<local-path>"}function ao(e){return e.replace(/sk-[A-Za-z0-9_-]+/gu,"[redacted-secret]").replace(/[A-Z0-9_]*SECRET[A-Z0-9_]*/gu,"[redacted-secret]").replace(/[A-Z0-9_]*TOKEN[A-Z0-9_]*/gu,"[redacted-token]").replace(/[A-Z0-9_]*KEY[A-Z0-9_]*/gu,"[redacted-key]")}function us(e){return e.split(/[\\/]+/u).join("/")}function lo(e){return ni("sha256").update(e).digest("hex")}async function co(e,t,n,i,r){let s=await S(i,"/api/v1/verify",{method:"POST",headers:I(),body:JSON.stringify({email:e,code:t,clientDelivery:"cli_secure_storage"})});if(n.json){let o=l(s,"apiKey");return o?(await pt(i,o,{expectedEmail:e,knownEmail:l(s,"email")??e,knownRole:l(s,"role")??"user",knownRoles:ue(s,"roles"),knownUserId:l(s,"userId")}),h(Y({...s,loggedIn:!0}),"Email verified and login completed.",!0,i)):h(Y({...s,email:e,loggedIn:!1,nextCommand:`skills-layer login --method email --email ${e}`,nextAction:"login"}),"Email verified. Login still needs to be completed.",!0,i)}return await Wt(e,s,n,i,r)}async function Wt(e,t,n,i,r){let s=l(t,"apiKey"),o=l(t,"role")??"user",a=ue(t,"roles"),c=l(t,"userId"),u=s;if(!u&&n.json)return h(Y({...t,email:e,role:o,...a?{roles:a}:{},loggedIn:!1}),`${r} Login still needs to be completed through a human handoff.`,!0,i);if(!u)try{u=(await i.promptSecret(`Enter the API key emailed to ${e} (check spam/junk folder if missing): `)).trim()}catch{return h(Y({...t,email:e,role:o,...a?{roles:a}:{},loggedIn:!1}),`${r} Check your email (including spam/junk folder) for the API key, then run \`skills-layer login\` to finish signing in.`,n.json,i)}if(!u)return k("No API key was entered. Run `skills-layer login` once you have the emailed key.",n.json);let d=await pt(i,u,{expectedEmail:e,knownEmail:e,knownRole:o,knownRoles:a,knownUserId:c,forceProfileValidation:!s}),g=await Kn(n,{...i,config:d,apiKey:u});return H(g)?g:h(Y({...t,status:l(t,"status")??"verified",email:d.email,role:d.role,...d.roles?{roles:d.roles}:{},loggedIn:!0,...g.data?{mcp:g.data}:{}}),[`${r} Logged in as ${d.email}.`,g.message??""].filter(Boolean).join(" "),n.json,i)}async function _i(e,t,n,i,r){let s=l(t,"authorizationUrl"),o=b(l(t,"state"),"Social auth did not return a state."),a=Kp(e);if(n.noOpen)return h({...t,status:"human_handoff",handoff:{kind:"browser_auth",provider:e,authorizationUrl:s,state:o,nextAction:"open_browser",nextStep:`Open the ${a} sign-in URL, finish authentication, then run \`skills-layer login\` again if needed.`}},`${a} sign-in started. Open the browser handoff URL to continue.`,n.json,i);if(s){let u=await i.openUrl(s);i.emitInfo(u?`${a} sign-in started. Finish the login in your browser, then come back here. Waiting for browser sign-in to finish...`:`${a} sign-in started. Open this URL in your browser, then come back here once it is done:
-${s}
-Waiting for browser sign-in to finish...`)}else i.emitInfo(`${a} sign-in started. Finish the login in your browser, then come back here. Waiting for browser sign-in to finish...`);let c=await Ad(o,i);return H(c)?c:c.status==="verified"||c.status==="recovered"?await Wt(c.email,{...c},n,i,r==="recovery"?`Recovered access for ${c.email} through ${a}.`:`Verified ${c.email} through ${a}.`):c.status==="already_registered"?h(c,c.linkedAccount===!0?`${a} is now linked to ${c.email}. Run \`skills-layer login\` to sign in.`:`${c.email} is already registered. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,n.json,i):c.status==="linked"?h(c,`${a} sign-in is now connected.`,n.json,i):$d(c)?k(Ld(c),n.json):k("Social auth completed with an unexpected response.",n.json)}function H(e){return x(e)&&typeof e.exitCode=="number"&&typeof e.stdout=="string"&&typeof e.stderr=="string"}function Rd(e){try{let t=JSON.parse(e);return x(t)?t.data:void 0}catch{return}}function $d(e){return e.status==="registration_required"||e.status==="state_expired"||e.status==="provider_mismatch"||e.status==="identity_conflict"||e.status==="email_required"||e.status==="failed"}async function Ad(e,t){for(let n=0;n<120;n+=1)try{let i=await S(t,`/api/v1/identity/social/status/${encodeURIComponent(e)}`),r=l(i,"status")??"failed";if(r==="pending"){await t.sleep(1500);continue}return(r==="verified"||r==="recovered")&&l(i,"email")&&l(i,"role")?{status:r,email:l(i,"email"),role:l(i,"role"),roles:ue(i,"roles"),userId:l(i,"userId"),apiKey:l(i,"apiKey"),keyPrefix:l(i,"keyPrefix"),emailDelivery:l(i,"emailDelivery")}:r==="already_registered"&&l(i,"email")&&l(i,"role")?{status:r,email:l(i,"email"),role:l(i,"role"),roles:ue(i,"roles"),linkedAccount:typeof i.linkedAccount=="boolean"?i.linkedAccount:void 0}:r==="linked"?{status:r}:r==="registration_required"||r==="state_expired"||r==="provider_mismatch"||r==="identity_conflict"||r==="email_required"||r==="failed"?{status:r,error:l(i,"error")}:k("Social auth completed with an unexpected response.",!1)}catch(i){if(i instanceof A&&(i.status===404||i.status===429)){await t.sleep(1500);continue}return k(te(i),!1)}return k("Timed out while waiting for social auth to complete.",!1)}async function Ed(e,t){for(let n=0;n<120;n+=1)try{let r=(await S(t,"/api/v1/purchases",{headers:F(t.apiKey,t.authBlockedMessage)})).results?.find(s=>s.purchaseId===e);if(!r?.status||r.status==="pending"||r.status==="requires_action"){await t.sleep(1500);continue}return{status:r.status,purchaseId:e}}catch(i){if(i instanceof A&&i.status===429){await t.sleep(1500);continue}return k(te(i),!1)}return k("Timed out while waiting for purchase confirmation.",!1)}async function Id(e,t){for(let n=0;n<120;n+=1)try{let i=await S(t,`/api/v1/me/private-skill-charges/${encodeURIComponent(e)}`,{headers:F(t.apiKey,t.authBlockedMessage)}),r=l(i,"status");if(!r||r==="checkout_required"||r==="pending"||r==="requires_action"){await t.sleep(1500);continue}return{...i,status:r}}catch(i){if(i instanceof A&&i.status===429){await t.sleep(1500);continue}return k(te(i),!1)}return k("Timed out while waiting for payment confirmation.",!1)}function jd(e){let t=C(e,"accountLink");return(t?l(t,"url"):void 0)??l(e,"url")??l(e,"setupUrl")}function Ld(e){return e.status==="registration_required"?e.error??"No verified account exists for this social identity. Use `skills-layer register` first.":e.status==="state_expired"?"Social auth expired before completion. Start the flow again.":e.status==="provider_mismatch"?"The browser completed a different social provider than the one the CLI started.":e.status==="identity_conflict"?e.error??"This social identity is already linked to another account.":e.status==="email_required"?e.error??"This social profile did not provide an email address.":e.error??"Social auth could not be completed."}async function pt(e,t,n={}){let r=n.forceProfileValidation===!0||!n.knownEmail||!n.knownRole?await S({...e,apiKey:t},"/api/v1/me",{headers:{...F(t),...n.notifyLogin?{"x-skills-layer-session-intent":"login"}:{}}}):{userId:n.knownUserId,email:n.knownEmail,role:n.knownRole,roles:n.knownRoles},s=l(r,"email")??n.knownEmail??"unknown";if(n.expectedEmail&&s.toLowerCase()!==n.expectedEmail.toLowerCase())throw new Error(`The entered API key belongs to ${s}, not ${n.expectedEmail}. Use the API key emailed to ${n.expectedEmail}.`);let o=await S({...e,apiKey:t},"/api/v1/capabilities",{headers:F(t)}),a={version:bs,baseUrl:e.baseUrl,apiKey:t,edition:l(o,"edition")??l(r,"edition")??"saas",userId:l(r,"userId")??n.knownUserId,email:s,role:l(r,"role")??n.knownRole??"user",roles:ue(r,"roles")??n.knownRoles,lastSelectedAgent:e.config?.lastSelectedAgent,savedAt:e.now()};return await Ri(e.paths.configPath,a,e),await ee(e.paths.backendPreferencePath,{version:ci,preferredBaseUrl:e.baseUrl,savedAt:e.now()}),a}function ds(e,t){let n=Xt(e.actionJson,"action-json");if(n&&typeof n=="object"&&!Array.isArray(n))return n;let i=p(e.action);return t==="incident"?{type:"file_write",path:p(e.path)??".skills-layer/incidents/guardian-incident.json"}:i==="file_read"||i==="file_write"?{type:i,path:p(e.path)??"."}:i==="shell_command"?{type:"shell_command",command:"unspecified"}:{type:"api_call",...i?{target:i}:{}}}async function $(e,t,n,i,r={}){let s=r.authenticated?F(n.apiKey,n.authBlockedMessage):yt(n.apiKey);return await Yt(e,{headers:s},t,n,i)}async function Ud(e,t){if(e.deep)return await Td(e,t);let n=await S(t,"/api/v1/doctor",{headers:yt(t.apiKey)}),i=await We(t),r=await rd(t),s=[...ho(n),ad(i,r)];return h({...n,guardian:{...i,policy:r},checks:s},"Doctor checks loaded.",e.json,t)}async function Td(e,t){let n;try{let c=await S(t,"/api/v1/status",{headers:yt(t.apiKey)});n=ke("ok","backend_reachable","status","Backend status loaded.",{baseUrl:t.baseUrl,edition:l(c,"edition"),capabilityCount:Array.isArray(c.capabilities)?c.capabilities.length:void 0})}catch(c){n=ke("error","backend_unreachable","backend.status","Selected backend could not be reached.",{baseUrl:t.baseUrl,error:te(c)})}let i=t.config?.credentialStorage??(t.apiKey?"local_file_locked":"none"),r=await W(t.paths.mcpConfigPath),s=await We(t),o=Pe(t.env,t.platform,t.cwd).map(c=>({id:c.id,displayName:c.displayName,capabilities:c.capabilities})),a={backend:n,auth:t.apiKey?ke("ok","authenticated","whoami","A local session is available for the selected backend.",{email:t.config?.email,role:t.config?.role,savedLoginMatchesSelectedBackend:!0}):ke("login_required","login_required","login","No usable local session is available for the selected backend.",{savedLoginMatchesSelectedBackend:t.config?.baseUrl?mt(t.config.baseUrl,t.baseUrl):!0}),credentialStorage:ke(i==="none"?"not_configured":"ok",i==="none"?"credential_storage_not_configured":"credential_storage_ready",i==="none"?"login":"auth.status",i==="none"?"Run `skills-layer login` to create a secure local session.":"Credential storage metadata is present.",{credentialStorage:i,configPath:t.paths.configPath}),mcp:r?ke("configured","mcp_configured","mcp.verify","MCP is configured locally; verify from a fresh agent session if tools are not visible.",{clientId:l(r,"clientId"),clientIds:Array.isArray(r.clientIds)?r.clientIds:void 0,mcpUrl:l(r,"mcpUrl")}):ke("not_configured","mcp_not_configured","mcp.setup","Run `skills-layer mcp setup` or `skills-layer setup` to configure MCP."),guardianHooks:ke(l(s,"enforcementLayer")==="not_installed"?"not_installed":"ok",l(s,"enforcementLayer")==="not_installed"?"guardian_hook_not_installed":"guardian_hook_installed","guardian.hook.status",l(s,"enforcementLayer")==="not_installed"?"Cloud Guardian checks work when called, but local pre-action hooks are not installed.":"At least one Skills Layer Security Hook is installed.",s),localPaths:ke("ok","local_paths_resolved","doctor.deep","Local Skills Layer paths resolved.",{stateDir:t.paths.stateDir,configPath:t.paths.configPath,installsPath:t.paths.installsPath,mcpConfigPath:t.paths.mcpConfigPath}),agentTargets:ke("ok","agent_targets_loaded","agents.list","Supported local agent targets loaded.",{count:o.length,results:o})};return h({status:"ok",deep:!0,sections:a,nextAction:t.apiKey?"status":"login",nextStep:t.apiKey?"Run `skills-layer status --json` for Cloud journey readiness.":"Run `skills-layer login` to sign in, then rerun `skills-layer doctor --deep --json`."},"Deep doctor diagnostics loaded.",e.json,t)}function ke(e,t,n,i,r={}){return _({status:e,reasonCode:t,nextAction:n,nextStep:i,...r})}async function z(e,t,n,i,r){return await Yt(e,{method:"POST",headers:I(i.apiKey),body:JSON.stringify(_(t))},n,i,r)}async function Jt(e,t,n,i,r){return await Yt(e,{method:"PATCH",headers:I(i.apiKey),body:JSON.stringify(_(t))},n,i,r)}async function Yt(e,t,n,i,r){let s=await S(i,e,t);return h(s,r,n.json,i)}async function S(e,t,n={}){let i=await e.fetchFn(`${e.baseUrl}${t}`,n).catch(o=>{throw new Error(`Unable to reach ${e.baseUrl}. ${te(o)}`)});if(!i.ok)throw await Fd(i);let r=await i.text();if(!r)return{};let s=JSON.parse(r);return s&&typeof s=="object"&&!Array.isArray(s)&&"data"in s?s.data:s}async function Fd(e){let t=await e.text();if(t)try{let n=JSON.parse(t);return new A(e.status,l(n,"error")??(e.statusText||"Request failed"),n)}catch{return new A(e.status,t)}return new A(e.status,e.statusText||"Request failed")}function F(e,t){if(t)throw new A(401,t,{error:t,nextAction:"backend.status",nextStep:t});if(!e)throw new A(401,"Login required.",{error:"Login required.",nextAction:"login",nextStep:"Run `skills-layer login` to sign in, then retry this command."});return{authorization:`Bearer ${e}`}}function yt(e){return e?{authorization:`Bearer ${e}`}:{}}function I(e){return{"content-type":"application/json",...yt(e)}}async function Zt(e){let t=await yl(e);if(t.isFile())return[{path:D(e),content:await He(e,"utf8")}];if(!t.isDirectory())throw new Error(`Unsupported path: ${e}`);let n=[];if(await uo(e,e,n),n.length===0)throw new Error(`No readable files found in ${e}.`);return n.sort((i,r)=>i.path.localeCompare(r.path))}async function uo(e,t,n){for(let i of await ii(t,{withFileTypes:!0})){if(po(i.name))continue;let r=U(t,i.name);if(i.isDirectory()){await uo(e,r,n);continue}if(!i.isFile())continue;let s=Ke(e,r).split("\\").join("/");try{n.push({path:s,content:await He(r,"utf8")})}catch{continue}}}function po(e){return e===".git"||e==="node_modules"||e==="coverage"||e===Nd()||e==="dist"}function Nd(){return[46,68,83,95,83,116,111,114,101].map(e=>String.fromCharCode(e)).join("")}async function Vt(e,t){if(/^https?:\/\//u.test(e)||/^[a-z]+:/iu.test(e))return;let n=V(t,e);try{return await ws(n),{sourceMetadata:{kind:"local",input:e,canonicalSource:`local:${e}`},files:await Zt(n)}}catch{return}}async function Tn(e,t){let n=Md(t);if(n.length===0)return t;let i=[];for(let r of n){let s=go(r.path),o=V(e.cwd,s),a=Ke(e.cwd,o);if(!a||a.startsWith("..")||ze.isAbsolute(a))throw new Error(`Cloud install plan attempted to write outside the current workspace: ${r.path}`);if(await ge(o,r.content),i.push({path:s,bytes:new TextEncoder().encode(r.content).length}),D(s).toLowerCase()==="skill.md"){let c=l(t,"skillSlug")??l(t,"slug")??D(ae(s)),u=await Ci({backend:e,skillSlug:c,version:l(t,"version"),skillDocumentPath:o,skillDocumentContent:r.content});i.push(u)}}return{...t,materializedWrites:i}}function Md(e){return[...Fn(e.localWrites),...Fn(C(e,"installPlan")?.localWrites),...Fn(C(e,"materializationPlan")?.localWrites)]}function Fn(e){return Array.isArray(e)?e.flatMap(t=>{if(!t||typeof t!="object"||Array.isArray(t))return[];let n=t,i=p(n.path),r=typeof n.content=="string"?n.content:void 0;return i&&r!==void 0?[{path:i,content:r}]:[]}):[]}function go(e){let t=e.replaceAll("\\","/").replace(/^\.\/+/u,"");if(!t||t.includes("\0")||oi.isAbsolute(t)||ze.isAbsolute(e)||t.split("/").includes(".."))throw new Error(`Cloud install plan returned an unsafe local write path: ${e}`);return t}async function Bd(e,t){let n=l(e,"apiKey");if(!n)return;let i={version:bs,baseUrl:t.baseUrl,apiKey:n,edition:l(e,"edition")??t.config?.edition??"saas",userId:l(e,"userId")??t.config?.userId,email:l(e,"email")??t.config?.email??"unknown",role:l(e,"role")??t.config?.role??"user",roles:ue(e,"roles")??t.config?.roles,lastSelectedAgent:t.config?.lastSelectedAgent,savedAt:t.now()};await Ri(t.paths.configPath,i,t)}async function Le(e){let t=await W(e.paths.installsPath);if(!x(t))return{version:Sr,installs:{}};let n=x(t.installs)?ps(t.installs):x(t.skills)?ps(t.skills):{};return{version:typeof t.version=="number"?t.version:Sr,installs:n}}async function mo(e,t){await ee(e.paths.installsPath,t)}async function Ot(e,t,n){let i=l(t,"skillSlug")??l(t,"slug")??n,r=await Le(e);r.installs[i]={skillSlug:i,...t,savedAt:e.now()},await mo(e,r)}function ps(e){let t={};for(let[n,i]of Object.entries(e))t[n]=x(i)?i:{skillSlug:n,value:i};return t}var O=5;function h(e,t,n,i){let r=e&&typeof e=="object"&&!Array.isArray(e)&&typeof e.status=="string"?String(e.status):"ok",s=Gt(e),o={schemaVersion:ui,status:r,statusFamily:Od(r,s),summary:t,why:null,nextAction:null,nextStep:null,data:s,warnings:[],links:[],reasonCode:null,handoff:null};return{exitCode:0,stdout:n?JSON.stringify(o,null,2):Vd(s,t,i),stderr:""}}function Od(e,t){let n=e.toLowerCase();return n==="pass"||n.includes("dry")?"dry_run_passed":n.includes("created")?"created":n.includes("updated")||n.includes("configured")||n.includes("synced")?"updated":n.includes("revoked")||n.includes("removed")||n.includes("disconnected")?"removed":n.includes("approval")||n.includes("handoff")||x(t)&&t.handoff?"human_handoff":"ok"}function qd(e){return e?e==="login_required"||e==="unauthorized"?"login_required":e==="confirmation_required"?"confirmation_required":e.includes("not_found")||e==="missing_record"?"not_found":e.includes("payment")||e.includes("checkout")||e.includes("purchase")?"payment_required":e.includes("source")?"source_required":e.includes("backend")||e.includes("unreachable")||e.includes("network")?"backend_unreachable":e.includes("agent")||e.includes("client")||e.includes("unsupported")?"unsupported_client":e.includes("blocked")||e.includes("policy")||e.includes("guardian")?"policy_blocked":e.includes("not_allowed")||e.includes("permission_denied")||e.includes("invalid_transition")?"operation_not_allowed":"invalid_input":null}var Dd="<redacted>";function Gt(e){if(Array.isArray(e))return e.map(n=>Gt(n));if(!x(e))return e;let t={};for(let[n,i]of Object.entries(e))t[n]=Kd(n)?Dd:Gt(i);return t}function Kd(e){let t=e.replace(/[^a-z0-9]/giu,"").toLowerCase();return t==="devicecode"||t==="usercode"||t==="verificationcode"||t==="recoverycode"||t==="onetimecode"||t==="password"||t==="clientsecret"||t==="privatekey"||t==="apikey"||t==="rawapikey"||t==="accesstoken"||t==="refreshtoken"||t==="bearertoken"||t==="mcptoken"||t.endsWith("secret")?!0:t.endsWith("token")&&t!=="tokenprefix"}function Vd(e,t,n){let i=re(n);if(x(e)){if(t==="Status loaded."&&gs(e))return Jd(e,t,i);if(t==="Doctor checks loaded."&&gs(e))return Yd(e,t,i);if(t==="Creator payout profile loaded.")return hp(e,t,i);if(t==="Creator earnings loaded."||t==="Earnings loaded.")return yp(e,"Creator earnings loaded.",i);if(t==="Creator payouts loaded."||t==="Payouts loaded.")return kp(e,"Creator payouts loaded.",i);if(t==="Guardian check complete.")return zd(e,t,i);if(t==="Reviews loaded.")return Hd(e,t,i);if(t==="Categories loaded.")return Gd(e,t,i)}let r=[`${i.ok("OK")} ${t}`];if(x(e)){let s=wo(e,i);s.length>0&&r.push("",...s);let o=Co(e);o.length>0&&r.push("",i.section("Next"),...o.map(a=>`  ${i.arrow} ${a}`))}return r.join(`
-`)}function Gd(e,t,n){let i=ve(e.results??e.categories??e.data),r=[`${n.ok("OK")} ${t}`,"",n.section(`Categories (${i.length})`)];return i.length===0?(r.push(`  ${n.muted("No categories returned.")}`),r.join(`
-`)):(i.slice(0,O).forEach((s,o)=>{let a=l(s,"slug")??l(s,"category")??l(s,"name")??`category-${o+1}`,c=l(s,"name")??a,u=s.count;r.push(`${o+1}. ${Po(c)}`);let d=[a?`slug: ${a}`:void 0,u!==void 0?`count: ${G("count",u)}`:void 0].filter(g=>!!g);d.length>0&&r.push(`   ${d.join("; ")}`)}),i.length>O&&r.push(`  ${n.muted(`... ${i.length-O} more`)}`),r.join(`
-`))}function Hd(e,t,n){let i=ve(e.reviews??e.results),r=[`${n.ok("OK")} ${t}`,"",n.section(`Reviews (${i.length})`)];return i.length===0&&r.push(`  ${n.muted("No reviews yet.")}`),i.forEach((s,o)=>{let a=l(s,"reviewId")??l(s,"id"),u=l(s,"skillSlug")??l(s,"slug")??l(s,"skill")??a??`Review ${o+1}`,d=s.rating??s.score,g=l(s,"status"),f=l(s,"updatedAt")??l(s,"createdAt"),m=[a?`review: ${a}`:void 0,d!=null?`rating: ${G("rating",d)}`:void 0,g?`status: ${g}`:void 0,f?`updated: ${f}`:void 0].filter(v=>!!v);r.push(`${o+1}. ${u}`),m.length>0&&r.push(`   ${m.join("; ")}`);let y=l(s,"feedback")??l(s,"comment")??l(s,"message");y&&r.push(`   ${n.label("feedback")}: ${Ge(y)}`)}),r.join(`
-`)}function zd(e,t,n){let i=C(e,"decision"),r=C(e,"enforcement"),s=C(e,"auditEvent"),o=N(i,"status")??N(r,"status")??"unknown",a=N(r,"actionType")??N(s,"actionType")??"action",c=N(i,"capability")??N(r,"capability")??"not specified",u=N(i,"reasonCode")??N(r,"reasonCode")??"not specified",d=N(i,"message")??N(r,"message")??"Guardian policy resolved this action.",g=N(s,"skillSlug")??"unknown",f=N(s,"version")??"unknown",m=Nn(r,"canExecute"),y=Nn(r,"auditRequired"),v=Nn(r,"telemetryRequired"),P=o==="blocked"?"BLOCKED":o==="allowed"?"ALLOWED":"WARNING",R=[`${n.ok("OK")} ${t}`,"",n.section(`${P} ${Wd(a)}`),`  ${n.label("Skill")}: ${g}`,`  ${n.label("Version")}: ${f}`,`  ${n.label("Capability")}: ${c}`,`  ${n.label("Reason")}: ${d}`,`  ${n.label("Reason code")}: ${u}`,`  ${n.label("Can execute")}: ${m===!0?"yes":"no"}`,`  ${n.label("Audit required")}: ${y===!1?"no":"yes"}`,`  ${n.label("Cloud telemetry")}: ${v===!0?"yes":"no"}`,"",n.section("Next")];return o==="blocked"?R.push(`  ${n.arrow} Do not run this action.`,`  ${n.arrow} Review \`skills-layer trust ${g}\`.`,`  ${n.arrow} Run \`skills-layer guardian incident --skill ${g} --version ${f} --path <installed-skill-path> --reason "<reason>"\` if this was unexpected.`):R.push(`  ${n.arrow} Continue only with the action Guardian evaluated.`,`  ${n.arrow} Re-run guardian check if the action changes.`),R.join(`
-`)}function Nn(e,t){if(x(e))return typeof e[t]=="boolean"?e[t]:void 0}function N(e,t){return x(e)?l(e,t):void 0}function Wd(e){return e.split(/[_-]+/u).filter(Boolean).map(t=>`${t[0]?.toUpperCase()??""}${t.slice(1)}`).join(" ")}function gs(e){return!!(C(e,"backend")&&C(e,"auth")&&Array.isArray(e.checks))}function Jd(e,t,n){let i=[`${n.ok("OK")} ${t}`,"",n.section("Readiness")],r=l(e,"summary");r&&i.push(`  ${r}`);let s=C(e,"backend"),o=s?ep(s):void 0;o&&i.push(`  ${n.label("Backend")}: ${o}`);let a=C(e,"auth"),c=a?tp(a):void 0;c&&i.push(`  ${n.label("Account")}: ${c}`);let u=a?T(a,"workspaceCount"):void 0;u!==void 0&&i.push(`  ${n.label("Workspaces")}: ${u}`);let d=a?T(a,"libraryCount"):void 0;d!==void 0&&i.push(`  ${n.label("Owned skills")}: ${d}`);let g=fo(e);return g.length>0&&i.push("",n.section("Next"),...g.map(f=>`  ${n.arrow} ${f}`)),i.push(`  ${n.arrow} Run \`skills-layer doctor\` for diagnostics.`),i.join(`
-`)}function Yd(e,t,n){let i=[`${n.ok("OK")} ${t}`,"",n.section("Diagnostics")],r=l(e,"summary");r&&i.push(`  ${r}`);let s=l(e,"status");s&&i.push(`  ${n.label("Status")}: ${s}`);let o=ho(e),a=o.filter(d=>np(l(d,"status"))),c=o.filter(d=>l(d,"status")!=="pass");i.push(a.length===0?"  No blocking issues found.":`  ${a.length} check${a.length===1?"":"s"} need attention.`),a.length===0&&c.length>0&&i.push(`  Advisory checks needing attention: ${c.length}.`),i.push("",n.section(`Checks (${o.length})`)),o.length===0&&i.push(`  ${n.muted("No checks returned by the backend.")}`),o.forEach((d,g)=>{let f=l(d,"status")??"unknown",m=l(d,"title")??l(d,"id")??`Check ${g+1}`;i.push(`${g+1}. ${n.label(`[${f}] ${m}`)}`);let y=l(d,"summary");y&&i.push(`   ${y}`);let v=l(d,"why");if(v&&i.push(`   ${n.label("Why")}: ${v}`),f!=="pass"){let P=l(d,"nextStep");P&&i.push(`   ${n.label("Fix")}: ${P}`);let R=l(d,"recommendedCommand");R&&i.push(`   ${n.label("Try")}: ${R}`)}});let u=fo(e);return u.length>0&&i.push("",n.section(a.length>0?"Recommended Fix":"Next"),...u.map(d=>`  ${n.arrow} ${d}`)),i.join(`
-`)}function Zd(e,t,n,i){let r=[`${n.ok("OK")} ${t}`],s=ue(e,"requestedSlugs");s&&s.length>0&&r.push("",n.section("Requested"),`  ${s.join(", ")}`);let o=ve(e.results);r.push("",n.section(`Comparison (${o.length})`)),o.length===0&&r.push(`  ${n.muted("No comparable skills returned.")}`),o.forEach((d,g)=>{let f=Qn(d)??`Skill ${g+1}`;r.push(`${g+1}. ${f}`);let m=Qd(d);m&&r.push(`   ${m}`);let y=So(d);y&&r.push(`   ${n.label("summary")}: ${i?y.replace(/\s+/gu," ").trim():Ge(y)}`)});let a=ve(e.missing);a.length>0&&(r.push("",n.section(`Missing (${a.length})`)),a.forEach((d,g)=>{let f=l(d,"slug")??l(d,"skillSlug")??Qn(d)??`Entry ${g+1}`,m=l(d,"reason")??l(d,"status");r.push(`${g+1}. ${m?`${f} - ${m}`:f}`)}));let c=ue(e,"guidance")??De(e.guidance);c.length>0&&r.push("",n.section("Guidance"),...c.slice(0,3).map(d=>`  ${n.arrow} ${Ge(d)}`));let u=Xd(o);return u.length>0&&r.push("",n.section("Next"),...u.map(d=>`  ${n.arrow} ${d}`)),r.join(`
-`)}function Qd(e){let t=C(e,"securityPosture"),n=l(e,"trust")??l(e,"trustStatus")??l(e,"trustLabel")??(t?l(t,"label"):void 0),i=e.score??e.securityScore??(t?t.securityScore:void 0),r=l(e,"risk")??l(e,"runtimeRisk")??(t?l(t,"runtimeRisk"):void 0);return[["slug",l(e,"slug")??l(e,"skillSlug")],["version",l(e,"version")??l(e,"currentVersion")],["category",l(e,"category")],["type",l(e,"type")??l(e,"skillType")],["trust",n],["score",i],["risk",r]].flatMap(([o,a])=>a==null||a===""?[]:[`${o}: ${G(String(o),a)}`]).join("; ")}function Xd(e){let t=[];for(let n of e.slice(0,5)){let i=l(n,"slug")??l(n,"skillSlug");i&&t.push(`skills-layer show ${i}`,`skills-layer trust ${i}`,`skills-layer install ${i}`)}return t}function ep(e){let t=l(e,"edition"),n=l(e,"baseUrl");return t&&n?`${t} at ${n}`:t??n}function tp(e){let t=l(e,"state");if(t&&t!=="authenticated")return t==="anonymous"?"not signed in":t;let n=l(e,"email"),i=ue(e,"roles");return n&&i&&i.length>0?`${n} (${i.join(", ")})`:n??l(e,"role")}function fo(e){let t=[],n=l(e,"recommendedCommand");n&&t.push(n);let i=l(e,"nextStep");return i&&t.push(i),t}function ho(e){return Array.isArray(e.checks)?e.checks.filter(x):[]}function np(e){return e!==void 0&&e!=="pass"&&e!=="warn"&&e!=="advisory"}function ve(e){return Array.isArray(e)?e.filter(x):[]}function De(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}function ip(e){let t=e.commerce===!0;return{status:t?"available":"unavailable",summary:t?"Marketplace purchases, invoices, refunds, and creator commerce flows are available.":"Marketplace commerce is not available on this backend.",availableWorkflows:t?["Browse skills with `skills-layer featured` or `skills-layer search <query>`.","Start purchase handoff with `skills-layer buy <skill-slug>`.","Review account purchases with `skills-layer purchases list`."]:["Browse and install available free skills.","Use `skills-layer help topic install` for install guidance."]}}var rp={"core.identity":"Account and sign-in","core.catalog":"Catalog discovery","core.validation":"Creator validation","core.creator":"Creator submissions","core.library":"Owned skills","core.workspace":"Workspace rollout","core.guardian":"Runtime trust checks","core.source":"Source installs","core.discovery":"Catalog discovery","marketplace.commerce":"Marketplace commerce","marketplace.reviews":"Reviews and issues","marketplace.payouts":"Creator earnings"};function sp(e){let t=De(e.capabilities);return{status:"ok",edition:l(e,"edition")??"unknown",summary:"Public product capabilities available on the selected backend.",capabilities:t.map(n=>({name:rp[n]??en(n.replace(/^[^.]+\./u,"").replace(/[._-]+/gu," ")),available:!0})),count:t.length}}function op(e,t){let n=p(e);if(!n)return;let i=Number(n);return!Number.isInteger(i)||i<=0?k("help optimize-tokens --max-characters must be a positive integer.",t):i<120||i>4e3?k("help optimize-tokens --max-characters must be between 120 and 4000.",t):i}function ap(e,t,n){let i=re(n),r=C(e,"validation")??e,s=C(r,"parsedSkill")??C(e,"parsedSkill"),o=s?C(s,"frontmatter"):void 0,a=l(e,"skillSlug")??(o?l(o,"name"):void 0),c=r.valid===!0||e.valid===!0,u=Mn(r,e,"issues"),d=Mn(r,e,"warnings"),g=Mn(r,e,"advice"),f=C(r,"stats")??C(e,"stats"),m=[`${i.ok("OK")} Validation complete.`,"",i.section("Bundle")];m.push(`  ${i.label("Path")}: ${t}`),a&&m.push(`  ${i.label("Skill")}: ${a}`),m.push(`  ${i.label("Readiness")}: ${c?"ready for dry-run submission":"needs changes before submission"}`),m.push("",i.section("Checks")),m.push(`  ${i.arrow} SKILL.md structure and frontmatter`),m.push(`  ${i.arrow} Required bundle files and supported directories`),m.push(`  ${i.arrow} Secret hygiene, unsafe script signals, and trust-review readiness`),m.push(`  ${i.arrow} Trigger quality inputs for should-trigger / should-not-trigger testing`);let y=C(e,"evalReadiness");if(y){let v=C(y,"summaryEnvelope"),P=Array.isArray(v?.statuses)?v.statuses.map(j=>String(j)).join(", "):void 0,R=C(y,"score"),L=R?T(R,"effectiveScorePercent"):void 0,K=R?T(R,"overallScore"):void 0;m.push("",i.section("Effectiveness Eval")),m.push(`  ${i.label("Posture")}: ${l(y,"label")??l(y,"status")??"limited"}`),m.push(`  ${i.label("Origin")}: ${l(y,"origin")??"inferred"}`),L!==void 0?m.push(`  ${i.label("Effective score")}: ${Ht(L)}`):K!==void 0&&m.push(`  ${i.label("Effective score")}: ${Ht(K*100)}`),m.push(`  ${i.label("Artifact digest")}: ${l(y,"artifactDigest")??"unavailable"}`),y.runtimeFileCount!==void 0&&m.push(`  ${i.label("Runtime files")}: ${G("runtimeFileCount",y.runtimeFileCount)}`),y.evidenceFileCount!==void 0&&m.push(`  ${i.label("Evidence files excluded")}: ${G("evidenceFileCount",y.evidenceFileCount)}`),m.push(`  ${i.label("Submit envelope")}: mandatory${P?` (${P})`:""}`)}if(f){let v=f.fileCount??f.files??e.fileCount,P=f.bodyWordCount??f.bodyWords??e.bodyWordCount;m.push("",i.section("File Summary")),v!==void 0&&m.push(`  ${i.label("File count")}: ${G("fileCount",v)}`),P!==void 0&&m.push(`  ${i.label("Body words")}: ${G("bodyWordCount",P)}`)}return m.push("",...Bn("Issues",u,i,"No blocking issues found.")),m.push("",...Bn("Warnings",d,i,"No warnings returned.")),m.push("",...Bn("Advice",g,i,"No extra advice returned.")),m.push("",i.section("Next")),m.push(`  ${i.arrow} skills-layer preview-trigger ${t} --should-trigger "<prompt>" --should-not-trigger "<prompt>"`),m.push(`  ${i.arrow} skills-layer creator submit ${t} --dry-run`),m.join(`
-`)}function Mn(e,t,n){let i=Array.isArray(e[n])?e[n]:[],r=Array.isArray(t[n])?t[n]:[];return i.length>0?i:r}function Bn(e,t,n,i){let r=[n.section(`${e} (${t.length})`)];return t.length===0?(r.push(`  ${n.muted(i)}`),r):(t.slice(0,O).forEach((s,o)=>{r.push(`${o+1}. ${yo(s)}`)}),r)}function yo(e){return x(e)?(l(e,"message")??l(e,"title")??l(e,"code")??l(e,"path")??gt(e))||"Details available with --json":G("",e)}function lp(e,t,n){let i=re(n),r=cp(e),s=up(e),o=[`${i.ok("OK")} Trigger preview complete.`,"",i.section("Bundle"),`  ${i.label("Path")}: ${t}`],a=l(e,"skillSlug")??l(e,"slug");return a&&o.push(`  ${i.label("Skill")}: ${a}`),o.push("",i.section(`Prompt Results (${r.length})`)),r.length===0&&o.push(`  ${i.muted("No prompt results returned. Use --json to inspect the raw backend response.")}`),r.slice(0,O).forEach((c,u)=>{o.push(`${u+1}. ${dp(c,u)}`)}),o.push("",i.section(`Guidance (${s.length})`)),s.length===0&&o.push(`  ${i.muted("No extra trigger guidance returned.")}`),s.slice(0,O).forEach((c,u)=>{o.push(`${u+1}. ${c}`)}),o.push("",i.section("Next")),o.push(`  ${i.arrow} skills-layer validate ${t}`),o.push(`  ${i.arrow} skills-layer creator submit ${t} --dry-run`),o.join(`
-`)}function cp(e){return[...ve(e.promptResults),...ve(e.results),...ve(e.shouldTriggerResults),...ve(e.shouldNotTriggerResults),...ve(e.paraphraseResults)]}function up(e){let t=De(e.guidance),n=ve(e.guidance).map(i=>yo(i));return[...t,...n]}function dp(e,t){let n=l(e,"prompt")??l(e,"text")??l(e,"input")??`Prompt ${t+1}`,i=pp(e),r=gp(e),s=mp(e),o=e.score??e.confidence,a=l(e,"reason")??l(e,"explanation")??l(e,"message");return[`"${Ge(n)}"`,i?`expected: ${i}`:void 0,r?`actual: ${r}`:void 0,s,o!==void 0?`score: ${G("score",o)}`:void 0,a?`reason: ${Ge(a)}`:void 0].filter(c=>!!c).join("; ")}function pp(e){return typeof e.shouldTrigger=="boolean"?e.shouldTrigger?"should trigger":"should not trigger":typeof e.expectedTrigger=="boolean"?e.expectedTrigger?"should trigger":"should not trigger":l(e,"expected")??l(e,"kind")??l(e,"type")}function gp(e){return typeof e.triggered=="boolean"?e.triggered?"triggered":"did not trigger":typeof e.actualTrigger=="boolean"?e.actualTrigger?"triggered":"did not trigger":l(e,"actual")??l(e,"classification")??l(e,"decision")}function mp(e){return typeof e.passed=="boolean"?e.passed?"pass":"fail":typeof e.pass=="boolean"?e.pass?"pass":"fail":l(e,"status")}function fp(e,t,n,i){let r=re(i),s=l(e,"skillSlug")??D(t),o=[`${r.ok("OK")} Created ${n}.`,"",r.section("Local Skill")];o.push(`  ${r.label("Path")}: ${n}`),o.push(`  ${r.label("Skill")}: ${s}`);let a=l(e,"skillType"),c=l(e,"category");return a&&o.push(`  ${r.label("Type")}: ${a}`),c&&o.push(`  ${r.label("Category")}: ${c}`),o.push("",r.section("Next")),o.push(`  ${r.arrow} Edit ${n}`),o.push(`  ${r.arrow} skills-layer validate ${t}`),o.push(`  ${r.arrow} skills-layer preview-trigger ${t} --should-trigger "<prompt>" --should-not-trigger "<prompt>"`),o.push(`  ${r.arrow} skills-layer creator submit ${t} --dry-run`),o.join(`
-`)}function hp(e,t,n){let i=C(e,"profile")??e,r=On(i,"requirementsCurrentlyDue"),s=On(i,"requirementsPastDue"),o=On(i,"requirementsPendingVerification"),a=["payouts","Enabled"].join(""),c=i.readyForPayouts??i[a],u=c===!0,d=[`${n.ok("OK")} ${t}`,"",n.section("Payout Profile")];return d.push(`  ${n.label("Status")}: ${Ft(l(i,"status"))}`),d.push(`  ${n.label("Ready for payouts")}: ${fs(c)}`),d.push(`  ${n.label("Account details submitted")}: ${fs(i.detailsSubmitted)}`),d.push(`  ${n.label("Currency")}: ${Ft(l(i,"currency")?.toUpperCase())}`),d.push(`  ${n.label("Country")}: ${Ft(l(i,"country")?.toUpperCase())}`),d.push(`  ${n.label("Minimum withdrawal")}: ${wp(i)}`),d.push(`  ${n.label("Updated at")}: ${Ft(l(i,"updatedAt"))}`),d.push("",n.section("Requirements")),d.push(`  ${n.label("Currently due")}: ${qn(r)}`),d.push(`  ${n.label("Past due")}: ${qn(s)}`),d.push(`  ${n.label("Pending verification")}: ${qn(o)}`),d.push("",n.section("Next")),u?(d.push(`  ${n.arrow} skills-layer creator earnings`),d.push(`  ${n.arrow} skills-layer creator withdraw --amount-cents <amount>`),d.push(`  ${n.arrow} skills-layer creator payouts`)):(d.push(`  ${n.arrow} skills-layer creator payout-link`),d.push(`  ${n.arrow} skills-layer creator earnings`)),d.join(`
-`)}function yp(e,t,n){let i=Zn(e),r=xi(e,"withdrawableBalanceCents"),s=[`${n.ok("OK")} ${t}`,"",n.section("Earnings Summary")];return s.push(`  ${n.label("Gross sales")}: ${X(e,"successfulSalesCents",i)}`),s.push(`  ${n.label("Platform fees")}: ${X(e,"platformFeeCents",i)}`),s.push(`  ${n.label("Refunds requested")}: ${X(e,"refundRequestedCents",i)}`),s.push(`  ${n.label("Refunded")}: ${X(e,"refundedCents",i)}`),s.push(`  ${n.label("Estimated available")}: ${X(e,"estimatedAvailableCents",i)}`),s.push(`  ${n.label("Withdrawable now")}: ${X(e,"withdrawableBalanceCents",i)}`),s.push(`  ${n.label("Held balance")}: ${X(e,"heldBalanceCents",i)}`),s.push(`  ${n.label("Refund exposure")}: ${X(e,"refundExposureCents",i)}`),s.push("",n.section("Activity")),s.push(`  ${n.label("Successful purchases")}: ${ms(e,"successfulPurchaseCount")}`),s.push(`  ${n.label("Refund requests")}: ${ms(e,"refundRequestedCount")}`),s.push(`  ${n.label("Pending payouts")}: ${X(e,"pendingPayoutCents",i)}`),s.push(`  ${n.label("Completed payouts")}: ${X(e,"completedPayoutCents",i)}`),s.push("",n.section("Guidance")),r>0?(s.push("1. You have a withdrawable balance available."),s.push("2. Confirm payout setup is ready before requesting withdrawal.")):(s.push("1. No withdrawable balance yet."),s.push("2. Sales will appear here after paid purchases settle.")),s.push("",n.section("Next")),r>0&&s.push(`  ${n.arrow} skills-layer creator withdraw --amount-cents ${r}`),s.push(`  ${n.arrow} skills-layer creator payout-profile`),s.push(`  ${n.arrow} skills-layer creator payouts`),s.join(`
-`)}function kp(e,t,n){let i=Array.isArray(e.results)?e.results:[],r=Zn(e,i),s=xi(e,"withdrawableBalanceCents"),o=[`${n.ok("OK")} ${t}`,"",n.section("Payout History")];return o.push(`  ${n.label("Withdrawable now")}: ${X(e,"withdrawableBalanceCents",r)}`),o.push(`  ${n.label("Pending payouts")}: ${X(e,"pendingPayoutCents",r)}`),o.push(`  ${n.label("Completed payouts")}: ${X(e,"completedPayoutCents",r)}`),o.push("",n.section(`Requests (${i.length})`)),i.length===0?o.push(`  ${n.muted("No payout requests yet.")}`):(i.slice(0,O).forEach((a,c)=>{if(!x(a)){o.push(`${c+1}. ${G("",a)}`);return}let u=Zn(a,void 0,r),d=l(a,"payoutId")??l(a,"id")??`Payout ${c+1}`,g=l(a,"status")??"unknown",f=X(a,"amountCents",u),m=l(a,"requestedAt"),y=l(a,"completedAt"),v=l(a,"reason");o.push(`${c+1}. ${d}`),o.push(`   ${n.label("Amount")}: ${f}; ${n.label("Status")}: ${g}`),m&&o.push(`   ${n.label("Requested")}: ${m}`),y&&o.push(`   ${n.label("Completed")}: ${y}`),v&&o.push(`   ${n.label("Reason")}: ${v}`)}),i.length>O&&o.push(`  ${n.muted(`... ${i.length-O} more`)}`)),o.push("",n.section("Guidance")),i.length===0?o.push("1. Payouts appear here after you request a withdrawal."):o.push("1. Use this history to track requested, processing, paid, or failed payouts."),o.push("2. Check payout profile if setup or verification looks incomplete."),o.push("",n.section("Next")),s>0&&o.push(`  ${n.arrow} skills-layer creator withdraw --amount-cents ${s}`),o.push(`  ${n.arrow} skills-layer creator earnings`),o.push(`  ${n.arrow} skills-layer creator payout-profile`),o.join(`
-`)}function Zn(e,t,n="GBP"){let i=l(e,"currency");if(i)return i.toUpperCase();let r=t?.find(x);if(r){let s=l(r,"currency");if(s)return s.toUpperCase()}return n}function xi(e,t){return T(e,t)??0}function ms(e,t){return T(e,t)??0}function X(e,t,n){return`${ko(xi(e,t))} ${n}`}function On(e,t){return(ue(e,t)??[]).map(n=>n.replace(/[._-]+/gu," "))}function qn(e){return e.length>0?e.join(", "):"none"}function fs(e){return e===!0?"yes":e===!1?"no":"unknown"}function Ft(e){return e??"none"}function wp(e){let t=T(e,"minimumWithdrawalAmountCents"),n=l(e,"currency")?.toUpperCase()??"minor units";return t===void 0?"none":`${ko(t)} ${n}`}function ko(e){return(e/100).toFixed(2).replace(/\.00$/u,"").replace(/(\.\d)0$/u,"$1")}function re(e){let t=vp(e);return{ok:n=>t?Oe(32,n):n,section:n=>t?Oe(1,Oe(36,n)):n,label:n=>t?Oe(1,n):n,muted:n=>t?Oe(2,n):n,arrow:t?Oe(36,"->"):"->"}}function vp(e){let t=e?.env??{};if(t.NO_COLOR)return!1;let n=t.FORCE_COLOR;return n&&n!=="0"?!0:!!e?.stdoutIsTty&&t.TERM!=="dumb"&&n!=="0"}function Oe(e,t){return`\x1B[${e}m${t}\x1B[0m`}function wo(e,t){let n=[],i=Pp(e,t);i.length>0&&n.push(...i);let r=bp(e,t);r.length>0&&n.push(...r);for(let[s,o]of xp(e))if(Array.isArray(o))n.push(...Sp(s,o,t));else if(x(o)){let a=gt(o);a&&n.push(`  ${t.label(Xn(s))}: ${a}`)}else n.push(`  ${t.label(Xn(s))}: ${G(s,o)}`);return n}function bp(e,t){let n=C(e,"effectiveness");if(!n)return[];let i=l(n,"label"),r=l(n,"latestSummaryStatus"),s=T(n,"evidenceCount"),o=C(n,"score"),a=o?T(o,"overallScore"):void 0,c=o?T(o,"effectiveScorePercent"):void 0,u=o?C(o,"components"):void 0,d=u?T(u,"passRate"):void 0,g=u?T(u,"coverageRatio"):void 0;if(!i&&r===void 0&&s===void 0&&a===void 0)return[];let f=[t.section("Effectiveness")];return i&&f.push(`  ${t.label("Label")}: ${i}`),r&&f.push(`  ${t.label("Latest summary")}: ${r}`),s!==void 0&&f.push(`  ${t.label("Evidence count")}: ${s}`),c!==void 0?f.push(`  ${t.label("Effective score")}: ${Ht(c)}`):a!==void 0&&f.push(`  ${t.label("Effective score")}: ${Ht(a*100)}`),d!==void 0&&f.push(`  ${t.label("Pass rate")}: ${d}`),g!==void 0&&f.push(`  ${t.label("Coverage")}: ${g}`),f}function Ht(e){let t=Math.round(e*10)/10;return`${Number.isInteger(t)?t.toFixed(0):t.toFixed(1)}%`}function Sp(e,t,n){let i=Rp(e),r=[n.section(`${i} (${t.length})`)];return t.length===0?(r.push(`  ${n.muted("No entries.")}`),r):(t.slice(0,O).forEach((s,o)=>{r.push(...vo(s,o,n))}),t.length>O&&r.push(`  ${n.muted(`... ${t.length-O} more`)}`),r)}function vo(e,t,n){if(!x(e))return[`${t+1}. ${G("",e)}`];let i=Qn(e)??oe(gt(e))??`Item ${t+1}`,r=[`${t+1}. ${i}`],s=So(e);s&&r.push(`   ${s}`);let o=gt(e);return o&&r.push(`   ${o}`),r}function Pp(e,t){let n=Ru(e,t);if(n.length>0)return n;let i=C(e,"capabilityProfile"),r=i?l(i,"runtimeRisk"):void 0;return r?[t.section("Trust"),`  ${t.label("Runtime risk")}: ${r}`]:[]}function Cp(e,t,n){let i=re(n),r=l(e,"skillSlug")??t,s=l(e,"runtimeRisk")??(C(e,"capabilityProfile")?l(C(e,"capabilityProfile"),"runtimeRisk"):void 0),o=[`${i.ok("OK")} Creator security report loaded.`,"",i.section("Creator Security")];e.securityScore!==void 0&&o.push(`  ${i.label("Security score")}: ${G("securityScore",e.securityScore)}`),s&&o.push(`  ${i.label("Runtime risk")}: ${s}`);let a=l(e,"recommendation");a&&o.push(`  ${i.label("Recommendation")}: ${a}`),o.push(`  ${i.label("Skill")}: ${r}`);let c=l(e,"version");c&&o.push(`  ${i.label("Version")}: ${c}`);let u=["semantic","review","no","reviewable","findings"].join("_"),d=De(e.reviewDegradedReasons).includes(u),g=De(e.trustBadges).filter(y=>y==="capability-mismatch"),f=De(e.trustBadges).filter(y=>y!=="capability-mismatch");(d||g.length>0)&&(o.push("",i.section("Creator Notes")),d&&o.push("1. Semantic review was not needed because there were no reviewable findings."),g.forEach((y,v)=>{o.push(`${d?v+2:v+1}. ${y==="capability-mismatch"?"Capability declaration needs review.":y}`)})),f.length>0&&(o.push("",i.section(`Trust badges (${f.length})`)),f.slice(0,O).forEach((y,v)=>o.push(`${v+1}. ${y}`)));let m=Array.isArray(e.findings)?e.findings:[];return o.push("",i.section(`Findings (${m.length})`)),m.length===0?o.push(`  ${i.muted("No entries.")}`):m.slice(0,O).forEach((y,v)=>{o.push(...vo(y,v,i))}),o.push("",i.section("Next")),o.push(`  ${i.arrow} skills-layer creator rescan-security ${r}`),o.push(`  ${i.arrow} skills-layer creator status ${r}`),o.push(`  ${i.arrow} skills-layer trust ${r}`),o.join(`
-`)}function _p(e,t,n){let r=C(e,"report")??e,s=re(n),o=r.securityScore,a=l(r,"generatedAt")??l(r,"reportGeneratedAt"),c=Array.isArray(r.findings)?r.findings:void 0,u=[`${s.ok("OK")} Security rescan requested.`,"",s.section("Creator Security")];return u.push(`  ${s.label("Skill")}: ${l(r,"skillSlug")??t}`),o!==void 0&&u.push(`  ${s.label("Security score")}: ${G("securityScore",o)}`),c&&u.push(`  ${s.label("Findings")}: ${c.length}`),a&&u.push(`  ${s.label("Generated at")}: ${a}`),u.push("",s.section("Next")),u.push(`  ${s.arrow} skills-layer creator security-report ${t}`),u.push(`  ${s.arrow} skills-layer creator status ${t}`),u.join(`
-`)}function xp(e){return Object.entries(e).filter(([t,n])=>bo(t,n))}function bo(e,t){let n=e.toLowerCase();return n==="status"||n==="securityscore"||n==="recommendation"||n==="capabilityprofile"||n==="securityposture"||n==="trust"||n==="effectiveness"||n.includes("apikey")||n.includes("secret")||n.includes("token")||n==="content"?!1:t!==void 0}function gt(e){let n=[["id","id"],["name","name"],["keyPrefix","prefix"],["slug","slug"],["skillSlug","skill"],["currentVersion","version"],["version","version"],["category","category"],["skillType","type"],["type","type"],["visibility","visibility"],["status","status"],["count","count"],["email","email"],["role","role"],["selectedBackend","backend"],["selectedBaseUrl","base url"],["path","path"],["downloadUrl","download url"],["authorizationUrl","authorization url"],["checkoutUrl","checkout url"],["url","url"],["issueId","issue"],["reviewId","review"],["purchaseId","purchase"],["workspaceId","workspace"],["clientId","client"],["environment","environment"],["expiresAt","expires"],["lastUsedAt","last used"],["revocable","revocable"],["revokeCommand","revoke"],["deploymentId","deployment"],["source","source"],["scope","scope"],["agent","agent"],["bytes","bytes"],["fileCount","file count"],["bodyWordCount","body words"]].flatMap(([r,s])=>{if(!bo(r,e[r]))return[];let o=e[r];return o===void 0?[]:[`${s}: ${G(r,o)}`]}),i=C(e,"securityPosture");if(i){let r=l(i,"label"),s=l(i,"runtimeRisk");r&&n.push(`trust: ${r}`),s&&n.push(`risk: ${s}`)}return n.join("; ")}function So(e){return l(e,"shortDescription")??l(e,"summary")??l(e,"description")??l(e,"message")}function Qn(e){return l(e,"displayName")??l(e,"name")??l(e,"title")??l(e,"slug")??l(e,"skillSlug")??l(e,"code")??l(e,"id")}function G(e,t){return e==="downloadUrl"?"<hidden; use --json or --output>":typeof t=="string"?e.toLowerCase()==="category"?Po(t):Ge(t):typeof t=="number"||typeof t=="boolean"?String(t):t===null?"none":Array.isArray(t)?`${t.length} item${t.length===1?"":"s"}`:x(t)?gt(t)||"details available with --json":String(t)}function Po(e){return Ji(e)}function Ge(e){let t=e.replace(/\s+/gu," ").trim();return t.length>160?`${t.slice(0,157)}...`:t}function Rp(e){return en(Xn(e))}function Xn(e){return e.replace(/([a-z0-9])([A-Z])/gu,"$1 $2").replace(/[_-]+/gu," ").toLowerCase()}function Co(e){let t=$p(e),n=t?[`skills-layer show ${t}`,`skills-layer trust ${t}`,`skills-layer install ${t}`]:[],i=typeof e.downloadUrl=="string",r=Array.isArray(e.materializedWrites)&&e.materializedWrites.length>0;return i&&n.push("Use --output <path> to write exports without printing temporary download URLs"),r&&n.push("Review the materialized files in this workspace"),e.valid===!0&&n.push("skills-layer creator submit <path> --dry-run"),n}function $p(e){let t=l(e,"skillSlug")??l(e,"slug");if(t)return t;let n=e.results;if(Array.isArray(n)){for(let i of n)if(x(i)){let r=l(i,"skillSlug")??l(i,"slug");if(r)return r}}}function x(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function k(e,t){let n=Ap(e);return n?w(n.payload,e,t,n.reasonCode):{exitCode:1,stdout:"",stderr:t?JSON.stringify({schemaVersion:ui,status:"error",reasonFamily:"invalid_input",summary:e,why:null,nextAction:null,nextStep:null,data:{error:e},warnings:[],links:[],reasonCode:null,handoff:null},null,2):e}}function Ap(e){let t=/^(?<code>EACCES|EPERM|EROFS):\s*(?<detail>.+)$/iu.exec(e);if(t?.groups){let d=t.groups.code.toUpperCase(),g=/'(?<path>[^']+)'/u.exec(e)?.groups?.path;return{reasonCode:"local_filesystem_permission_denied",payload:{status:"error",reasonCode:"local_filesystem_permission_denied",code:d,...g?{path:g}:{},nextAction:"check_local_permissions",nextStep:"Check the local path permissions, choose a writable installed skill directory, or rerun the command from a workspace you can write to."}}}let n=/^--(?<flag>[a-z0-9-]+) must be valid JSON\.$/iu.exec(e);if(n?.groups){let d=n.groups.flag;return{reasonCode:"invalid_json",payload:{status:"error",reasonCode:"invalid_json",flag:d,nextAction:"fix_json_flag",nextStep:`Provide valid JSON for --${d}.`}}}let i=/^Unknown flag --(?<flag>[a-z0-9-]+)\.$/iu.exec(e);if(i?.groups)return{reasonCode:"unknown_flag",payload:{status:"error",reasonCode:"unknown_flag",flag:i.groups.flag,nextAction:"help",nextStep:"Run `skills-layer <command> --help` to see supported flags for that command."}};let r=/^(?<command>.+?) --(?<flag>[a-z0-9-]+) must be one of: (?<accepted>.+?)\.$/iu.exec(e);if(r?.groups){let d=r.groups.flag,g=r.groups.accepted.split(",").map(f=>f.trim()).filter(Boolean);return{reasonCode:`invalid_${d.replace(/-/gu,"_")}`,payload:{status:"error",reasonCode:`invalid_${d.replace(/-/gu,"_")}`,command:r.groups.command,flag:d,acceptedValues:g,nextAction:r.groups.command.replace(/\s+/gu,"."),nextStep:`Use --${d} with one of: ${g.join(", ")}.`}}}let s=/^Unknown (?<namespace>.+?) command "(?<subcommand>.*?)"\.$/u.exec(e);if(s?.groups){let d=s.groups.namespace.trim(),g=s.groups.subcommand;return{reasonCode:"unknown_subcommand",payload:{status:"error",reasonCode:"unknown_subcommand",namespace:d,subcommand:g,nextAction:`${d.replace(/\s+/gu,".")}.help`,nextStep:`Run \`skills-layer ${d} --help\` to see supported ${d} commands.`}}}let o=/^(?<command>.+?) requires (?<argument>.+?)\.$/u.exec(e);if(!o?.groups)return;let a=o.groups.command.trim(),c=o.groups.argument.trim(),u=Ep(c);return{reasonCode:"missing_required_argument",payload:{status:"error",reasonCode:"missing_required_argument",command:a,argument:u,nextAction:a.replace(/\s+/gu,"."),nextStep:`Provide ${u.startsWith("--")?u:`<${u}>`} and retry.`}}}function Ep(e){let t=e.replace(/^(?:a|an|the)\s+/iu,"");if(/^two or more skill slugs$/iu.test(t))return"two-or-more-skill-slugs";let n=/--(?<name>[a-z0-9-]+)/iu.exec(t)?.groups?.name;return n||(/<(?<name>[^>]+)>/u.exec(t)?.groups?.name??t).replace(/\s+or\s+.*$/iu,"").replace(/[^a-z0-9]+/giu,"-").replace(/^-+|-+$/gu,"").toLowerCase()||"argument"}function w(e,t,n,i){let r=Gt(e),s=i??l(r,"reasonCode")??null,o={schemaVersion:ui,status:l(r,"status")??"error",summary:t,why:l(r,"why")??null,nextAction:l(r,"nextAction")??null,nextStep:l(r,"nextStep")??null,data:r,warnings:Array.isArray(r.warnings)?r.warnings:[],links:Array.isArray(r.links)?r.links:[],reasonCode:s,reasonFamily:qd(s),handoff:r.handoff??null};return{exitCode:1,stdout:"",stderr:n?JSON.stringify(o,null,2):t}}function Qt(e,t){let n=e.details??{};if(e.status===401){let s=l(n,"error")??"Login required.",o=l(n,"nextAction")??"login",a=l(n,"nextStep")??"Run `skills-layer login` to sign in, then retry this command.";return w({status:"login_required",reasonCode:"login_required",error:s,nextAction:o,nextStep:a},`${s==="Login required."?"Login required":s}. ${a}`,t,"login_required")}let i=l(n,"reasonCode");if(i){let s=x(n.data)?n.data:null,a=s!==null&&("summary"in n||"data"in n)?s:n,c=l(a,"error")??l(n,"error")??l(n,"summary")??e.message;return w({...a,status:l(n,"status")??l(a,"status")??(e.status===404?"not_found":"error"),nextAction:l(a,"nextAction")??l(n,"nextAction"),nextStep:l(a,"nextStep")??l(n,"nextStep"),warnings:Array.isArray(a.warnings)?a.warnings:n.warnings,links:Array.isArray(a.links)?a.links:n.links,handoff:a.handoff??n.handoff,reasonCode:i},c,t,i)}let r=Ip(e);return r?w(r.payload,r.message,t,r.reasonCode):k(l(n,"error")??e.message,t)}function Ip(e){let t=l(e.details??{},"error")??e.message,n=t.toLowerCase();return e.status===404&&n.includes("source connection")?{reasonCode:"source_connection_not_found",message:"Source connection not found.",payload:{status:"not_found",error:t,reasonCode:"source_connection_not_found",nextAction:"source.connection.start",nextStep:"Check the source connection id, or start a new source connection."}}:e.status===404&&n.includes("approval request")?{reasonCode:"approval_request_not_found",message:"Approval request not found.",payload:{status:"not_found",error:t,reasonCode:"approval_request_not_found",nextAction:"approval.request.status",nextStep:"Check the approval request id, or rerun the workflow that created the approval request."}}:e.status===404&&(n.includes("purchase")||n.includes("invoice"))?{reasonCode:"purchase_not_found",message:"Purchase not found.",payload:{status:"not_found",error:t,reasonCode:"purchase_not_found",nextAction:"purchases.list",nextStep:"Run `skills-layer purchases list` to find a valid purchase id."}}:e.status===404&&(n.includes("security report")||n.includes("trust report"))?{reasonCode:"trust_report_not_found",message:"Trust report not found.",payload:{status:"not_found",error:t,reasonCode:"trust_report_not_found",nextAction:"trust",nextStep:"Run `skills-layer show <skill-slug>` to confirm the skill exists, then retry trust after the security report is generated."}}:e.status===404&&n.includes("help topic")?{reasonCode:"help_topic_not_found",message:"Help topic not found.",payload:{status:"not_found",error:t,reasonCode:"help_topic_not_found",nextAction:"help",nextStep:"Run `skills-layer help full` or `skills-layer --help` to see available topics."}}:e.status===404&&n.includes("skill")?{reasonCode:"skill_not_found",message:"Skill not found.",payload:{status:"not_found",error:t,reasonCode:"skill_not_found",nextAction:"search",nextStep:"Run `skills-layer search <query>` to find a valid skill slug before retrying."}}:null}async function W(e){try{return JSON.parse(await He(e,"utf8"))}catch{return null}}async function jp(e,t){let n=await W(e);return n?gr(n,{env:t.env,platform:t.platform,store:t.credentialStore}):null}async function Ri(e,t,n){let i=await pr(t,{env:n.env,platform:n.platform,store:n.credentialStore});await ee(e,i)}async function ee(e,t){await _o(ae(e)),await si(e,`${JSON.stringify(t,null,2)}
-`,{encoding:"utf8",mode:384}),await $i(e,384)}async function _o(e){await ft(e,{recursive:!0,mode:448}),await $i(e,448)}async function $i(e,t){if(process.platform!=="win32")try{await vs(e,t)}catch{}}async function ge(e,t){await ft(ae(e),{recursive:!0}),await si(e,t,"utf8")}async function ei(e,t){await ft(ae(e),{recursive:!0}),await si(e,t)}function Lp(e=process.stdin,t=process.stdout,n=li){return async i=>{if(!e.isTTY||!t.isTTY)throw new Error("Interactive prompt is not available in this environment.");let r=n({input:e,output:t});try{return(await r.question(i)).trim()}finally{r.close()}}}function Up(e=process.stdin,t=process.stdout,n=li){return async i=>{if(!e.isTTY||!t.isTTY)throw new Error("Interactive secret prompt is not available in this environment.");if(typeof e.setRawMode=="function"&&typeof e.on=="function"&&typeof e.off=="function")return new Promise((s,o)=>{let a=e,c=a.isRaw===!0,u="",d=!1,g=m=>{d||(d=!0,a.off("data",f),a.setRawMode(c),a.pause?.(),t.write(`
-`),m())},f=m=>{let y=typeof m=="string"?m:m.toString("utf8");for(let v of y){if(v==="\r"||v===`
-`){g(()=>s(u.trim()));return}if(v===""){g(()=>o(new Error("Interactive secret prompt cancelled.")));return}if(v==="\b"||v==="\x7F"){u.length>0&&(u=u.slice(0,-1),t.write("\b \b"));continue}u+=v,t.write("*")}};t.write(i),a.resume?.(),a.on("data",f),a.setRawMode(!0)});let r=n({input:e,output:t,terminal:!0});r.stdoutMuted=!0,r._writeToOutput=function(o){if(!this.stdoutMuted){t.write(o);return}if(o==="\b"||o==="\x7F"){t.write("\b \b");return}if(o!=="\r"&&o!==`
-`){let a=[...o].filter(c=>c!=="\r"&&c!==`
-`).length;a>0&&t.write("*".repeat(a))}};try{t.write(i);let s=await r.question("");return t.write(`
-`),s.trim()}finally{r.close()}}}function Tp(e=process.stdin,t=process.stdout,n=li){return async(i,r)=>{if(r.length===0)throw new Error("Interactive selection has no available options.");if(!e.isTTY||!t.isTTY)throw new Error("Interactive selection is not available in this environment.");let s=e;if(typeof s.setRawMode=="function"&&typeof s.on=="function"&&typeof s.off=="function")return new Promise((a,c)=>{let u=0,d="",g=0,f=!1,m=s.isRaw===!0,y=()=>{g>0&&t.write(`\x1B[${g}F\x1B[J`),t.write(`${i}
-`);for(let[R,L]of r.entries())t.write(`${Fp(R===u)} ${R+1}. ${hs(L)}
+`}async function HT(e){let t=J(e.env.SKILLS_LAYER_CLI_PATH),n=Ra(t??process.argv[1]??""),i=await gy(n);if(!i.isFile()&&!i.isSymbolicLink())throw new Error("Guardian hook CLI path must resolve to the installed Skills Layer executable.");return await rr(n)}function ty(e){if(!(!L(e)||e.owner!=="skills-layer"||typeof e.fileSha256!="string"||!/^sha256:[a-f0-9]{64}$/u.test(e.fileSha256)))return{owner:"skills-layer",fileSha256:e.fileSha256}}function JT(e,t){if(!(!L(e)||e.owner!=="skills-layer"||e.agentId!==t||e.eventName!=="PreToolUse"||typeof e.entrySha256!="string"||!/^sha256:[a-f0-9]{64}$/u.test(e.entrySha256)))return{owner:"skills-layer",agentId:t,eventName:"PreToolUse",entrySha256:e.entrySha256}}function WT(e){return JSON.stringify(e)}async function YT(e){let t=e.generationId??e.version??"unversioned",n=K(e.backend.paths.stateDir,"runtime",encodeURIComponent(e.skillSlug),`${encodeURIComponent(t)}.json`),i={version:1,generatedAt:e.backend.now(),skillSlug:e.skillSlug,sourceProvider:{id:"skills-layer",name:"Skills Layer",managedBy:"skills-layer-cli"},...e.version?{skillVersion:e.version}:{},...e.generationId?{generationId:e.generationId}:{},guardian:{required:!0,enforcementLayer:"cloud_guardian_with_local_preflight",strictPreActionBlocking:!1,checkCommand:`skills-layer guardian check --skill ${e.skillSlug} --json`,incidentCommand:`skills-layer guardian incident ${e.skillSlug} --path <installed-skill-path> --telemetry-mode local_only --json`,guardedExecutorCommand:`skills-layer guardian exec ${e.skillSlug} --json -- <command>`,mcpCheckTool:"guardian.check",mcpEnforceTool:"guardian.enforce",agentCommandMatrix:bc({purpose:"materialize_skill",command:`skills-layer install ${e.skillSlug}`,jsonCommand:`skills-layer install ${e.skillSlug} --json`,skillSlug:e.skillSlug}),agentGuidance:"MCP-capable agents should call guardian.check or guardian.enforce before risky tool use. Local host hooks should call skills-layer guardian check, and shell actions that need strict wrapping should use skills-layer guardian exec.",sensitiveActionFamilies:["shell_command","network_request","file_read","file_write","secret_read","browser_action","device_action","api_call","generated_code_execution","model_context_promotion"]},materialization:{skillDocumentPath:"SKILL.md",skillDocumentSha256:mk(e.skillDocumentContent)}},r=`${JSON.stringify(i,null,2)}
+`;return await xe(n,i),{path:zy(e.backend.cwd,n),bytes:new TextEncoder().encode(r).length}}async function ZT(e){return await st(K(e,".skills-layer-disabled.json"))}async function ny(e){let t=e.backend.now(),i=(await pe(e.backend)).installs[e.skillSlug],r=i?qe(i):null;if(!i||!r)return{status:"blocked",reasonCode:"guardian_exact_install_receipt_missing",skillSlug:e.skillSlug,generatedAt:t,nextAction:"install",nextStep:"Install the approved skill through Skills Layer before using managed Guardian quarantine."};if(r.state!=="active"&&r.state!=="pending_activation")return{status:"blocked",reasonCode:"guardian_local_lifecycle_not_active",skillSlug:e.skillSlug,generatedAt:t,localLifecycle:r,nextAction:"guardian.incident.review",nextStep:"Review the existing quarantine or incomplete lifecycle before recording another incident."};if(!XT(e.installedPath,r.receipt.targetDir,e.backend.platform)||e.version!==r.receipt.generation.semanticVersion)return{status:"blocked",reasonCode:"guardian_incident_generation_mismatch",skillSlug:e.skillSlug,generatedAt:t,requestedVersion:e.version,receiptGeneration:r.receipt.generation,nextAction:"guardian.incident.review",nextStep:"Use the indexed exact path and version; Guardian will not quarantine a caller-selected mismatch."};let s;try{s=await ek({backend:e.backend,skillSlug:e.skillSlug,record:i,lifecycle:r,reasonCode:"guardian_incident",purpose:"quarantine_blocked",status:"quarantined"})}catch(p){return{status:"blocked",reasonCode:"guardian_exact_quarantine_failed",skillSlug:e.skillSlug,generatedAt:t,error:X(p),nextAction:"guardian.incident.review",nextStep:"Keep the skill blocked. Resolve exact-tree drift or filesystem permissions before retrying quarantine."}}let a=t.replace(/[:.]/gu,"-"),o=K(e.backend.paths.incidentsDir,`${e.skillSlug}-${a}.md`),l=K(e.backend.paths.incidentsDir,`${e.skillSlug}-${a}-evidence.json`),c=u(e.action,"type")??"unknown";await xe(l,{version:1,generatedAt:t,skillSlug:e.skillSlug,skillVersion:e.version,actionType:c,reason:iu(e.reason),localLifecycle:s.lifecycle});let d=["# Skills Layer Guardian Incident Report","",`Generated: ${t}`,`Skill: ${e.skillSlug}`,`Version: ${e.version}`,"","## Summary","",iu(e.reason),"","## Evidence","",`- ${t}: ${c} -> blocked and physically quarantined`].join(`
+`);return await Ia(ge(o)),await Aa(o,`${d}
+`,{encoding:"utf8",mode:384}),await pr(o,384),{status:"quarantined",generatedAt:t,incidentPath:o,evidencePath:l,quarantineDir:s.quarantine.quarantineDir,localLifecycle:s.lifecycle,writtenFiles:[o,l]}}function XT(e,t,n){let i=n==="win32"?rt:Qt,r=i.resolve(e).normalize("NFC"),s=i.resolve(t).normalize("NFC");return n==="linux"?r===s:r.toLocaleLowerCase("en-US")===s.toLocaleLowerCase("en-US")}function iy(e,t){let n=e.now().replace(/[:.]/gu,"-");return K(e.paths.incidentsDir,`${t}-${n}.json`)}async function nr(e,t){let n=K(e.paths.stateDir,"guardian-audit.jsonl");await Ia(ge(n));let i={version:1,generatedAt:e.now(),skillSlug:t.skillSlug,...t.version?{skillVersion:t.version}:{},actionType:u(t.action,"type")??"unknown",actionTarget:QT(t.action),decisionStatus:t.decisionStatus,reasonCode:t.reasonCode,telemetryMode:t.telemetryMode,...t.path?{localPath:gk(t.path)}:{}};await lx(n,`${JSON.stringify(i)}
+`,{encoding:"utf8",mode:384}),await pr(n,384)}function ba(e){let t=E(e,"decision"),n=E(e,"enforcement"),i=u(t??{},"status")??u(n??{},"status")??u(e,"status");return i==="allowed"||i==="advisory"?i:"blocked"}function nu(e){let t=E(e,"decision");return u(t??{},"reasonCode")??u(e,"reasonCode")??u(e,"status")??"cloud_guardian_decision"}function QT(e){let t=u(e,"type");if(t==="secret_read")return"redacted_secret";if(t==="shell_command")return"redacted_command";let n=u(e,"url");if(n)try{return new URL(n).origin}catch{return"redacted_url"}let i=u(e,"target");if(i)return iu(i);let r=u(e,"path");return r?gk(r):null}function gk(e){let t=me(e.trim());return t?`<local-path>/${t}`:"<local-path>"}function iu(e){return e.replace(/sk-[A-Za-z0-9_-]+/gu,"[redacted-secret]").replace(/[A-Z0-9_]*SECRET[A-Z0-9_]*/gu,"[redacted-secret]").replace(/[A-Z0-9_]*TOKEN[A-Z0-9_]*/gu,"[redacted-token]").replace(/[A-Z0-9_]*KEY[A-Z0-9_]*/gu,"[redacted-key]")}function ry(e){return e.split(/[\\/]+/u).join("/")}function mk(e){return qn("sha256").update(e).digest("hex")}async function hk(e,t,n,i,r){let s=en(),a=await C(i,"/api/v1/verify",{method:"POST",headers:j(),body:JSON.stringify({email:e,code:t,handoffCodeHash:s.authorizationCodeHash,handoffCodeChallenge:s.codeChallenge})});if(u(a,"status")!=="verified")return _("Email verification did not prepare a secure credential handoff. Restart verification.",n.json);let o=await C(i,"/api/v1/identity/credential-handoff/exchange",{method:"POST",headers:j(),body:JSON.stringify({authorizationCode:s.authorizationCode,codeVerifier:s.codeVerifier})});if(u(o,"status")!=="exchanged"||!u(o,"email")||!u(o,"role")||!u(o,"apiKey"))return _("Email verification credential handoff failed closed. Restart verification.",n.json);if(n.json){let l=u(o,"apiKey");return l?(await sr(i,l,{expectedEmail:e,knownEmail:u(o,"email")??e,knownRole:u(o,"role")??"user",knownRoles:at(o,"roles"),knownUserId:u(o,"userId")}),b(Ae({...o,loggedIn:!0}),"Email verified and login completed.",!0,i)):b(Ae({...o,email:e,loggedIn:!1,nextCommand:`skills-layer login --method email --email ${e}`,nextAction:"login"}),"Email verified. Login still needs to be completed.",!0,i)}return await _u(e,o,n,i,r)}async function _u(e,t,n,i,r){let s=u(t,"apiKey"),a=u(t,"role")??"user",o=at(t,"roles"),l=u(t,"userId"),c=s;if(!c&&n.json)return b(Ae({...t,email:e,role:a,...o?{roles:o}:{},loggedIn:!1}),`${r} Login still needs to be completed through a human handoff.`,!0,i);if(!c)try{c=(await i.promptSecret(`Enter the API key emailed to ${e} (check spam/junk folder if missing): `)).trim()}catch{return b(Ae({...t,email:e,role:a,...o?{roles:o}:{},loggedIn:!1}),`${r} Check your email (including spam/junk folder) for the API key, then run \`skills-layer login\` to finish signing in.`,n.json,i)}if(!c)return _("No API key was entered. Run `skills-layer login` once you have the emailed key.",n.json);let d=await sr(i,c,{expectedEmail:e,knownEmail:e,knownRole:a,knownRoles:o,knownUserId:l,forceProfileValidation:!s}),p=await zc(n,{...i,config:d,apiKey:c});if(Z(p))return p;let f=await Gc(n,{...i,config:d,apiKey:c});return Z(f)?f:b(Ae({...t,status:u(t,"status")??"verified",email:d.email,role:d.role,...d.roles?{roles:d.roles}:{},loggedIn:!0,...p.data?{workingMode:p.data}:{},...f.data?{mcp:f.data}:{}}),[`${r} Logged in as ${d.email}.`,p.message??"",f.message??""].filter(Boolean).join(" "),n.json,i)}function en(){let e=`social_handoff_${it(32).toString("base64url")}`,t=it(48).toString("base64url");return{authorizationCode:e,codeVerifier:t,authorizationCodeHash:qn("sha256").update(e).digest("base64url"),codeChallenge:qn("sha256").update(t).digest("base64url")}}async function Pu(e,t,n,i,r,s){let a=u(t,"authorizationUrl"),o=R(u(t,"state"),"Social auth did not return a state."),l=kL(e);if(a){let d=i.noOpen?!1:await r.openUrl(a);i.json||r.emitInfo(d?`${l} sign-in started. Finish the login in your browser, then come back here. Waiting for browser sign-in to finish...`:`${l} sign-in started. Open this URL in your browser, then come back here once it is done:
+${a}
+Waiting for browser sign-in to finish...`)}else i.json||r.emitInfo(`${l} sign-in started. Finish the login in your browser, then come back here. Waiting for browser sign-in to finish...`);let c=await n$(o,r);if(Z(c))return c;if(c.status==="verified"||c.status==="recovered"){if(!n)return _("Social credential handoff is unavailable. Start the login flow again.",i.json);let d=await C(r,"/api/v1/identity/social/exchange",{method:"POST",headers:j(),body:JSON.stringify({authorizationCode:n.authorizationCode,codeVerifier:n.codeVerifier})});return u(d,"status")!=="exchanged"||!u(d,"email")||!u(d,"role")||!u(d,"apiKey")?_("Social credential handoff failed closed. Start the login flow again.",i.json):await _u(u(d,"email"),d,i,r,s==="recovery"?`Recovered access for ${u(d,"email")} through ${l}.`:`Verified ${u(d,"email")} through ${l}.`)}return c.status==="already_registered"?b(c,`${l} belongs to an existing account. Run \`skills-layer login\` to sign in, or \`skills-layer auth recover\` if you need account recovery.`,i.json,r):c.status==="linked"?b(c,`${l} sign-in is now connected.`,i.json,r):t$(c)?_(o$(c),i.json):_("Social auth completed with an unexpected response.",i.json)}function Z(e){return L(e)&&typeof e.exitCode=="number"&&typeof e.stdout=="string"&&typeof e.stderr=="string"}function e$(e){try{let t=JSON.parse(e);return L(t)?t.data:void 0}catch{return}}function t$(e){return e.status==="registration_required"||e.status==="state_expired"||e.status==="provider_mismatch"||e.status==="identity_conflict"||e.status==="email_required"||e.status==="failed"}async function n$(e,t){for(let n=0;n<120;n+=1)try{let i=await C(t,`/api/v1/identity/social/status/${encodeURIComponent(e)}`),r=u(i,"status")??"failed";if(r==="pending"){await t.sleep(1500);continue}return(r==="verified"||r==="recovered")&&u(i,"credentialHandoff")==="ready"?{status:r,credentialHandoff:"ready"}:r==="already_registered"?{status:r}:r==="linked"?{status:r}:r==="registration_required"||r==="state_expired"||r==="provider_mismatch"||r==="identity_conflict"||r==="email_required"||r==="failed"?{status:r,error:u(i,"error")}:_("Social auth completed with an unexpected response.",!1)}catch(i){if(i instanceof D&&(i.status===404||i.status===429)){await t.sleep(1500);continue}return _(X(i),!1)}return _("Timed out while waiting for social auth to complete.",!1)}async function i$(e,t){for(let n=0;n<120;n+=1)try{let r=(await C(t,"/api/v1/purchases",{headers:V(t.apiKey,t.authBlockedMessage)})).results?.find(s=>s.purchaseId===e);if(!r?.status||r.status==="pending"||r.status==="requires_action"){await t.sleep(1500);continue}return{status:r.status,purchaseId:e}}catch(i){if(i instanceof D&&i.status===429){await t.sleep(1500);continue}return _(X(i),!1)}return _("Timed out while waiting for purchase confirmation.",!1)}async function r$(e,t){for(let n=0;n<120;n+=1)try{let i=await C(t,e,{headers:V(t.apiKey,t.authBlockedMessage)}),r=u(i,"status");if(!r||r==="checkout_required"||r==="pending"||r==="requires_action"||r==="finalizing"){await t.sleep(1500);continue}return i}catch(i){if(i instanceof D&&i.status===429){await t.sleep(1500);continue}return _(X(i),!1)}return _("Timed out while waiting for Enterprise checkout completion.",!1)}async function s$(e,t){for(let n=0;n<120;n+=1)try{let i=await C(t,`/api/v1/me/private-skill-charges/${encodeURIComponent(e)}`,{headers:V(t.apiKey,t.authBlockedMessage)}),r=u(i,"status");if(!r||r==="checkout_required"||r==="pending"||r==="requires_action"){await t.sleep(1500);continue}return{...i,status:r}}catch(i){if(i instanceof D&&i.status===429){await t.sleep(1500);continue}return _(X(i),!1)}return _("Timed out while waiting for payment confirmation.",!1)}function a$(e){let t=E(e,"accountLink");return(t?u(t,"url"):void 0)??u(e,"url")??u(e,"setupUrl")}function o$(e){return e.status==="registration_required"?e.error??"No verified account exists for this social identity. Use `skills-layer register` first.":e.status==="state_expired"?"Social auth expired before completion. Start the flow again.":e.status==="provider_mismatch"?"The browser completed a different social provider than the one the CLI started.":e.status==="identity_conflict"?e.error??"This social identity is already linked to another account.":e.status==="email_required"?e.error??"This social profile did not provide an email address.":e.error??"Social auth could not be completed."}async function sr(e,t,n={}){let r=n.forceProfileValidation===!0||!n.knownEmail||!n.knownRole?await C({...e,apiKey:t},"/api/v1/me",{headers:{...V(t),...n.notifyLogin?{"x-skills-layer-session-intent":"login"}:{}}}):{userId:n.knownUserId,email:n.knownEmail,role:n.knownRole,roles:n.knownRoles},s=u(r,"email")??n.knownEmail??"unknown";if(n.expectedEmail&&s.toLowerCase()!==n.expectedEmail.toLowerCase())throw new Error(`The entered API key belongs to ${s}, not ${n.expectedEmail}. Use the API key emailed to ${n.expectedEmail}.`);let a=await C({...e,apiKey:t},"/api/v1/capabilities",{headers:V(t)}),o={version:px,baseUrl:e.baseUrl,apiKey:t,edition:u(a,"edition")??u(r,"edition")??"saas",userId:u(r,"userId")??n.knownUserId,email:s,role:u(r,"role")??n.knownRole??"user",roles:at(r,"roles")??n.knownRoles,lastSelectedAgent:e.config?.lastSelectedAgent,savedAt:e.now()};return await Ru(e.paths.configPath,o,e),await xe(e.paths.backendPreferencePath,{version:uu,preferredBaseUrl:e.baseUrl,savedAt:e.now()}),o}function sy(e,t){let n=Cu(e.actionJson,"action-json");if(n&&typeof n=="object"&&!Array.isArray(n))return n;let i=k(e.action);return t==="incident"?{type:"file_write",path:k(e.path)??".skills-layer/incidents/guardian-incident.json"}:i==="file_read"||i==="file_write"?{type:i,path:k(e.path)??"."}:i==="shell_command"?{type:"shell_command",command:"unspecified"}:{type:"api_call",...i?{target:i}:{}}}async function F(e,t,n,i,r={}){let s=r.authenticated?V(n.apiKey,n.authBlockedMessage):xa(n.apiKey);return await ar(e,{headers:s},t,n,i)}async function l$(e,t){if(e.deep)return await c$(e,t);let n=await C(t,"/api/v1/doctor",{headers:xa(t.apiKey)}),i=await Vn(t),r=await vT(t),s=[...bk(n),_T(i,r)];return b({...n,guardian:{...i,policy:r},checks:s},"Doctor checks loaded.",e.json,t)}async function c$(e,t){let n;try{let l=await C(t,"/api/v1/status",{headers:xa(t.apiKey)});n=et("ok","backend_reachable","status","Backend status loaded.",{baseUrl:t.baseUrl,edition:u(l,"edition"),capabilityCount:Array.isArray(l.capabilities)?l.capabilities.length:void 0})}catch(l){n=et("error","backend_unreachable","backend.status","Selected backend could not be reached.",{baseUrl:t.baseUrl,error:X(l)})}let i=t.config?.credentialStorage??(t.apiKey?"local_file_locked":"none"),r=await le(t.paths.mcpConfigPath),s=await Vn(t),a=We(t.env,t.platform,t.cwd).map(l=>({id:l.id,displayName:l.displayName,capabilities:l.capabilities})),o={backend:n,auth:t.apiKey?et("ok","authenticated","whoami","A local session is available for the selected backend.",{email:t.config?.email,role:t.config?.role,savedLoginMatchesSelectedBackend:!0}):et("login_required","login_required","login","No usable local session is available for the selected backend.",{savedLoginMatchesSelectedBackend:t.config?.baseUrl?cr(t.config.baseUrl,t.baseUrl):!0}),credentialStorage:et(i==="none"?"not_configured":"ok",i==="none"?"credential_storage_not_configured":"credential_storage_ready",i==="none"?"login":"auth.status",i==="none"?"Run `skills-layer login` to create a secure local session.":"Credential storage metadata is present.",{credentialStorage:i,configPath:t.paths.configPath}),mcp:r?et("configured","mcp_configured","mcp.verify","MCP is configured locally; verify from a fresh agent session if tools are not visible.",{clientId:u(r,"clientId"),clientIds:Array.isArray(r.clientIds)?r.clientIds:void 0,mcpUrl:u(r,"mcpUrl")}):et("not_configured","mcp_not_configured","mcp.setup","Run `skills-layer mcp setup` or `skills-layer setup` to configure MCP."),guardianHooks:et(u(s,"enforcementLayer")==="not_installed"?"not_installed":"ok",u(s,"enforcementLayer")==="not_installed"?"guardian_hook_not_installed":"guardian_hook_installed","guardian.hook.status",u(s,"enforcementLayer")==="not_installed"?"Cloud Guardian checks work when called, but local pre-action hooks are not installed.":"At least one Skills Layer Security Hook is installed.",s),localPaths:et("ok","local_paths_resolved","doctor.deep","Local Skills Layer paths resolved.",{stateDir:t.paths.stateDir,configPath:t.paths.configPath,installsPath:t.paths.installsPath,mcpConfigPath:t.paths.mcpConfigPath}),agentTargets:et("ok","agent_targets_loaded","agents.list","Supported local agent targets loaded.",{count:a.length,results:a})};return b({status:"ok",deep:!0,sections:o,nextAction:t.apiKey?"status":"login",nextStep:t.apiKey?"Run `skills-layer status --json` for Cloud journey readiness.":"Run `skills-layer login` to sign in, then rerun `skills-layer doctor --deep --json`."},"Deep doctor diagnostics loaded.",e.json,t)}function et(e,t,n,i,r={}){return B({status:e,reasonCode:t,nextAction:n,nextStep:i,...r})}async function H(e,t,n,i,r,s={}){return await ar(e,{method:"POST",headers:{...j(i.apiKey),...s},body:JSON.stringify(B(t))},n,i,r)}function u$(){return`payout_request_${it(24).toString("base64url")}`}async function Yt(e,t,n,i,r){return await ar(e,{method:"PATCH",headers:j(i.apiKey),body:JSON.stringify(B(t))},n,i,r)}async function ar(e,t,n,i,r){let s=await C(i,e,t);return b(s,r,n.json,i)}async function C(e,t,n={}){let i=await e.fetchFn(`${e.baseUrl}${t}`,n).catch(a=>{throw new Error(`Unable to reach ${e.baseUrl}. ${X(a)}`)});if(!i.ok)throw await d$(i);let r=await i.text();if(!r)return{};let s=JSON.parse(r);return s&&typeof s=="object"&&!Array.isArray(s)&&"data"in s?s.data:s}async function d$(e){let t=await e.text();if(t)try{let n=JSON.parse(t);return new D(e.status,u(n,"error")??(e.statusText||"Request failed"),n)}catch{return new D(e.status,t)}return new D(e.status,e.statusText||"Request failed")}function V(e,t){if(t)throw new D(401,t,{error:t,nextAction:"backend.status",nextStep:t});if(!e)throw new D(401,"Login required.",{error:"Login required.",nextAction:"login",nextStep:"Run `skills-layer login` to sign in, then retry this command."});return{authorization:`Bearer ${e}`}}function xa(e){return e?{authorization:`Bearer ${e}`}:{}}function j(e,t){return{"content-type":"application/json",...e||t?V(e,t):{}}}async function Sa(e,t){if(/^[a-z][a-z0-9+.-]*:\/\//iu.test(e)||/^[a-z][a-z0-9+.-]*:(?![\\/])/iu.test(e))return;let n=Pe(t,e);try{await gy(n)}catch{return}let i=await xn({cwd:t,sourcePath:e});return{sourceMetadata:{kind:"local",input:e,canonicalSource:`local:${e}`},files:i.files}}var ir=/^sha256:[a-f0-9]{64}$/u;function or(e){return{version:1,state:e.state,operationId:e.operationId,receipt:e.receipt,...e.quarantine?{quarantine:e.quarantine}:{},updatedAt:e.backend.now()}}function qe(e){let t=E(e,"localLifecycle");if(!t||t.version!==1)return null;let n=u(t,"state"),i=u(t,"operationId"),r=u(t,"updatedAt"),s=yk(t.receipt);if(!n||!["pending_activation","active","quarantined","restore_pending"].includes(n)||!i||!r||!s)return null;let a=t.quarantine===void 0?void 0:p$(t.quarantine);return(n==="quarantined"||n==="restore_pending")&&!a?null:{version:1,state:n,operationId:i,receipt:s,...a?{quarantine:a}:{},updatedAt:r}}function yk(e){if(!L(e))return null;let t=u(e,"targetDir"),n=E(e,"generation"),i=n?u(n,"skillSlug"):void 0,r=n?u(n,"semanticVersion"):void 0,s=n?u(n,"generationId"):void 0,a=u(e,"archiveSha256"),o=u(e,"manifestSha256"),l=He(e,"files");if(!t||!i||!r||!s||!a||!ir.test(a)||!o||!ir.test(o)||!l||l.length===0)return null;let c=l.flatMap(d=>{if(!L(d))return[];let p=u(d,"path"),f=U(d,"sizeBytes"),g=u(d,"sha256");return p&&Number.isSafeInteger(f)&&f>=0&&g&&ir.test(g)?[{path:p,sizeBytes:f,sha256:g}]:[]});return c.length!==l.length?null:{targetDir:t,generation:{skillSlug:i,semanticVersion:r,generationId:s},archiveSha256:a,manifestSha256:o,files:c}}function kk(e){if(!L(e)||e.status!=="authorized")return null;let t=u(e,"authorizationId"),n=u(e,"purpose"),i=E(e,"generation"),r=i?u(i,"skillSlug"):void 0,s=i?u(i,"semanticVersion"):void 0,a=i?u(i,"generationId"):void 0,o=u(e,"archiveSha256"),l=u(e,"manifestSha256");return!t||!n||!["quarantine_blocked","quarantine_revoked","restore_fresh_approval","purge_quarantined"].includes(n)||!r||!s||!a||!o||!ir.test(o)||!l||!ir.test(l)?null:{status:"authorized",authorizationId:t,purpose:n,generation:{skillSlug:r,semanticVersion:s,generationId:a},archiveSha256:o,manifestSha256:l}}function p$(e){if(!L(e)||e.status!=="quarantined")return null;let t=u(e,"reasonCode"),n=u(e,"targetDir"),i=u(e,"quarantineRoot"),r=u(e,"quarantineDir"),s=at(e,"discoveryRoots"),a=kk(e.quarantineAuthorization),o=yk(e.receipt);return!t||!n||!i||!r||!s||s.length===0||!a||!o?null:{status:"quarantined",reasonCode:t,targetDir:n,quarantineRoot:i,quarantineDir:r,discoveryRoots:s,quarantineAuthorization:a,receipt:o}}async function pe(e){let t=await le(e.paths.installsPath);if(!L(t))return{version:gh,installs:{}};let n=L(t.installs)?ay(t.installs):L(t.skills)?ay(t.skills):{};return{version:typeof t.version=="number"?t.version:gh,installs:n}}async function It(e,t){let n=e.paths.installsPath,i=ge(n);await Ia(i);let r=K(i,`.${me(n)}.${it(12).toString("hex")}.tmp`),s;try{s=await my(r,"wx",384),await s.writeFile(`${JSON.stringify(t,null,2)}
+`,"utf8"),await s.sync(),await s.close(),s=void 0,await dx(r,n),await pr(n,384),await f$(i)}catch(a){throw await s?.close().catch(()=>{}),await Tt(r,{force:!0}).catch(()=>{}),a}}async function f$(e){if(process.platform!=="win32")try{let t=await my(e,"r");try{await t.sync()}finally{await t.close()}}catch{}}async function g$(e){let t=await pe(e.backend),n=t.installs[e.skillSlug],i=n?qe(n):null;!i||i.operationId!==e.operationId||(e.baselineRecord?t.installs[e.skillSlug]=e.baselineRecord:delete t.installs[e.skillSlug],await It(e.backend,t))}async function wk(e,t,n){let i=u(t,"skillSlug")??u(t,"slug")??n,r=await pe(e);r.installs[i]={skillSlug:i,...t,savedAt:e.now()},await It(e,r)}function ay(e){let t={};for(let[n,i]of Object.entries(e))t[n]=L(i)?i:{skillSlug:n,value:i};return t}var re=5;function b(e,t,n,i){let r=e&&typeof e=="object"&&!Array.isArray(e)&&typeof e.status=="string"?String(e.status):"ok",s=_a(e),a={schemaVersion:du,status:r,statusFamily:m$(r,s),summary:t,why:null,nextAction:null,nextStep:null,data:s,warnings:[],links:[],reasonCode:null,handoff:null};return{exitCode:0,stdout:n?JSON.stringify(a,null,2):w$(s,t,i),stderr:""}}function m$(e,t){let n=e.toLowerCase();return n==="pass"||n.includes("dry")?"dry_run_passed":n.includes("created")?"created":n.includes("updated")||n.includes("configured")||n.includes("synced")?"updated":n.includes("revoked")||n.includes("removed")||n.includes("disconnected")?"removed":n.includes("approval")||n.includes("handoff")||L(t)&&t.handoff?"human_handoff":"ok"}function h$(e){return e?e==="login_required"||e==="unauthorized"?"login_required":e==="confirmation_required"?"confirmation_required":e.includes("not_found")||e==="missing_record"?"not_found":e.includes("payment")||e.includes("checkout")||e.includes("purchase")?"payment_required":e.includes("source")?"source_required":e.includes("backend")||e.includes("unreachable")||e.includes("network")?"backend_unreachable":e.includes("agent")||e.includes("client")||e.includes("unsupported")?"unsupported_client":e.includes("blocked")||e.includes("policy")||e.includes("guardian")?"policy_blocked":e.includes("not_allowed")||e.includes("permission_denied")||e.includes("invalid_transition")?"operation_not_allowed":"invalid_input":null}var y$="<redacted>";function _a(e){if(Array.isArray(e))return e.map(n=>_a(n));if(!L(e))return e;let t={};for(let[n,i]of Object.entries(e))t[n]=k$(n)?y$:_a(i);return t}function k$(e){let t=e.replace(/[^a-z0-9]/giu,"").toLowerCase();return t==="devicecode"||t==="usercode"||t==="verificationcode"||t==="recoverycode"||t==="onetimecode"||t==="password"||t==="clientsecret"||t==="privatekey"||t==="apikey"||t==="rawapikey"||t==="accesstoken"||t==="refreshtoken"||t==="bearertoken"||t==="mcptoken"||t.endsWith("secret")?!0:t.endsWith("token")&&t!=="tokenprefix"}function w$(e,t,n){let i=ce(n);if(L(e)){if(t==="Status loaded."&&oy(e))return P$(e,t,i);if(t==="Doctor checks loaded."&&oy(e))return A$(e,t,i);if(t==="Creator payout profile loaded.")return z$(e,t,i);if(t==="Creator earnings loaded."||t==="Earnings loaded.")return K$(e,"Creator earnings loaded.",i);if(t==="Creator payouts loaded."||t==="Payouts loaded.")return H$(e,"Creator payouts loaded.",i);if(t==="Guardian check complete.")return S$(e,t,i);if(t==="Reviews loaded.")return b$(e,t,i);if(t==="Categories loaded.")return v$(e,t,i)}let r=[`${i.ok("OK")} ${t}`];if(L(e)){let s=Pk(e,i);s.length>0&&r.push("",...s);let a=xk(e);a.length>0&&r.push("",i.section("Next"),...a.map(o=>`  ${i.arrow} ${o}`))}return r.join(`
+`)}function v$(e,t,n){let i=tt(e.results??e.categories??e.data),r=[`${n.ok("OK")} ${t}`,"",n.section(`Categories (${i.length})`)];return i.length===0?(r.push(`  ${n.muted("No categories returned.")}`),r.join(`
+`)):(i.slice(0,re).forEach((s,a)=>{let o=u(s,"slug")??u(s,"category")??u(s,"name")??`category-${a+1}`,l=u(s,"name")??o,c=s.count;r.push(`${a+1}. ${Ek(l)}`);let d=[o?`slug: ${o}`:void 0,c!==void 0?`count: ${fe("count",c)}`:void 0].filter(p=>!!p);d.length>0&&r.push(`   ${d.join("; ")}`)}),i.length>re&&r.push(`  ${n.muted(`... ${i.length-re} more`)}`),r.join(`
+`))}function b$(e,t,n){let i=tt(e.reviews??e.results),r=[`${n.ok("OK")} ${t}`,"",n.section(`Reviews (${i.length})`)];return i.length===0&&r.push(`  ${n.muted("No reviews yet.")}`),i.forEach((s,a)=>{let o=u(s,"reviewId")??u(s,"id"),c=u(s,"skillSlug")??u(s,"slug")??u(s,"skill")??o??`Review ${a+1}`,d=s.rating??s.score,p=u(s,"status"),f=u(s,"updatedAt")??u(s,"createdAt"),g=[o?`review: ${o}`:void 0,d!=null?`rating: ${fe("rating",d)}`:void 0,p?`status: ${p}`:void 0,f?`updated: ${f}`:void 0].filter(m=>!!m);r.push(`${a+1}. ${c}`),g.length>0&&r.push(`   ${g.join("; ")}`);let h=u(s,"feedback")??u(s,"comment")??u(s,"message");h&&r.push(`   ${n.label("feedback")}: ${Un(h)}`)}),r.join(`
+`)}function S$(e,t,n){let i=E(e,"decision"),r=E(e,"enforcement"),s=E(e,"auditEvent"),a=ee(i,"status")??ee(r,"status")??"unknown",o=ee(r,"actionType")??ee(s,"actionType")??"action",l=ee(i,"capability")??ee(r,"capability")??"not specified",c=ee(i,"reasonCode")??ee(r,"reasonCode")??"not specified",d=ee(i,"message")??ee(r,"message")??"Guardian policy resolved this action.",p=ee(s,"skillSlug")??"unknown",f=ee(s,"version")??"unknown",g=Nc(r,"canExecute"),h=Nc(r,"auditRequired"),m=Nc(r,"telemetryRequired"),y=a==="blocked"?"BLOCKED":a==="allowed"?"ALLOWED":"WARNING",w=[`${n.ok("OK")} ${t}`,"",n.section(`${y} ${_$(o)}`),`  ${n.label("Skill")}: ${p}`,`  ${n.label("Version")}: ${f}`,`  ${n.label("Capability")}: ${l}`,`  ${n.label("Reason")}: ${d}`,`  ${n.label("Reason code")}: ${c}`,`  ${n.label("Can execute")}: ${g===!0?"yes":"no"}`,`  ${n.label("Audit required")}: ${h===!1?"no":"yes"}`,`  ${n.label("Cloud telemetry")}: ${m===!0?"yes":"no"}`,"",n.section("Next")];return a==="blocked"?w.push(`  ${n.arrow} Do not run this action.`,`  ${n.arrow} Review \`skills-layer trust ${p}\`.`,`  ${n.arrow} Run \`skills-layer guardian incident --skill ${p} --version ${f} --path <installed-skill-path> --reason "<reason>"\` if this was unexpected.`):w.push(`  ${n.arrow} Continue only with the action Guardian evaluated.`,`  ${n.arrow} Re-run guardian check if the action changes.`),w.join(`
+`)}function Nc(e,t){if(L(e))return typeof e[t]=="boolean"?e[t]:void 0}function ee(e,t){return L(e)?u(e,t):void 0}function _$(e){return e.split(/[_-]+/u).filter(Boolean).map(t=>`${t[0]?.toUpperCase()??""}${t.slice(1)}`).join(" ")}function oy(e){return!!(E(e,"backend")&&E(e,"auth")&&Array.isArray(e.checks))}function P$(e,t,n){let i=[`${n.ok("OK")} ${t}`,"",n.section("Readiness")],r=u(e,"summary");r&&i.push(`  ${r}`);let s=E(e,"backend"),a=s?x$(s):void 0;a&&i.push(`  ${n.label("Backend")}: ${a}`);let o=E(e,"auth"),l=o?I$(o):void 0;l&&i.push(`  ${n.label("Account")}: ${l}`);let c=o?U(o,"workspaceCount"):void 0;c!==void 0&&i.push(`  ${n.label("Workspaces")}: ${c}`);let d=o?U(o,"libraryCount"):void 0;d!==void 0&&i.push(`  ${n.label("Owned skills")}: ${d}`);let p=vk(e);return p.length>0&&i.push("",n.section("Next"),...p.map(f=>`  ${n.arrow} ${f}`)),i.push(`  ${n.arrow} Run \`skills-layer doctor\` for diagnostics.`),i.join(`
+`)}function A$(e,t,n){let i=[`${n.ok("OK")} ${t}`,"",n.section("Diagnostics")],r=u(e,"summary");r&&i.push(`  ${r}`);let s=u(e,"status");s&&i.push(`  ${n.label("Status")}: ${s}`);let a=bk(e),o=a.filter(d=>T$(u(d,"status"))),l=a.filter(d=>u(d,"status")!=="pass");i.push(o.length===0?"  No blocking issues found.":`  ${o.length} check${o.length===1?"":"s"} need attention.`),o.length===0&&l.length>0&&i.push(`  Advisory checks needing attention: ${l.length}.`),i.push("",n.section(`Checks (${a.length})`)),a.length===0&&i.push(`  ${n.muted("No checks returned by the backend.")}`),a.forEach((d,p)=>{let f=u(d,"status")??"unknown",g=u(d,"title")??u(d,"id")??`Check ${p+1}`;i.push(`${p+1}. ${n.label(`[${f}] ${g}`)}`);let h=u(d,"summary");h&&i.push(`   ${h}`);let m=u(d,"why");if(m&&i.push(`   ${n.label("Why")}: ${m}`),f!=="pass"){let y=u(d,"nextStep");y&&i.push(`   ${n.label("Fix")}: ${y}`);let w=u(d,"recommendedCommand");w&&i.push(`   ${n.label("Try")}: ${w}`)}});let c=vk(e);return c.length>0&&i.push("",n.section(o.length>0?"Recommended Fix":"Next"),...c.map(d=>`  ${n.arrow} ${d}`)),i.join(`
+`)}function R$(e,t,n,i){let r=[`${n.ok("OK")} ${t}`],s=at(e,"requestedSlugs");s&&s.length>0&&r.push("",n.section("Requested"),`  ${s.join(", ")}`);let a=tt(e.results);r.push("",n.section(`Comparison (${a.length})`)),a.length===0&&r.push(`  ${n.muted("No comparable skills returned.")}`),a.forEach((d,p)=>{let f=su(d)??`Skill ${p+1}`;r.push(`${p+1}. ${f}`);let g=C$(d);g&&r.push(`   ${g}`);let h=Ck(d);h&&r.push(`   ${n.label("summary")}: ${i?h.replace(/\s+/gu," ").trim():Un(h)}`)});let o=tt(e.missing);o.length>0&&(r.push("",n.section(`Missing (${o.length})`)),o.forEach((d,p)=>{let f=u(d,"slug")??u(d,"skillSlug")??su(d)??`Entry ${p+1}`,g=u(d,"reason")??u(d,"status");r.push(`${p+1}. ${g?`${f} - ${g}`:f}`)}));let l=at(e,"guidance")??Dn(e.guidance);l.length>0&&r.push("",n.section("Guidance"),...l.slice(0,3).map(d=>`  ${n.arrow} ${Un(d)}`));let c=E$(a);return c.length>0&&r.push("",n.section("Next"),...c.map(d=>`  ${n.arrow} ${d}`)),r.join(`
+`)}function C$(e){let t=E(e,"securityPosture"),n=u(e,"trust")??u(e,"trustStatus")??u(e,"trustLabel")??(t?u(t,"label"):void 0),i=e.score??e.securityScore??(t?t.securityScore:void 0),r=u(e,"risk")??u(e,"runtimeRisk")??(t?u(t,"runtimeRisk"):void 0);return[["slug",u(e,"slug")??u(e,"skillSlug")],["version",u(e,"version")??u(e,"currentVersion")],["category",u(e,"category")],["type",u(e,"type")??u(e,"skillType")],["trust",n],["score",i],["risk",r]].flatMap(([a,o])=>o==null||o===""?[]:[`${a}: ${fe(String(a),o)}`]).join("; ")}function E$(e){let t=[];for(let n of e.slice(0,5)){let i=u(n,"slug")??u(n,"skillSlug");i&&t.push(`skills-layer show ${i}`,`skills-layer trust ${i}`,`skills-layer install ${i}`)}return t}function x$(e){let t=u(e,"edition"),n=u(e,"baseUrl");return t&&n?`${t} at ${n}`:t??n}function I$(e){let t=u(e,"state");if(t&&t!=="authenticated")return t==="anonymous"?"not signed in":t;let n=u(e,"email"),i=at(e,"roles");return n&&i&&i.length>0?`${n} (${i.join(", ")})`:n??u(e,"role")}function vk(e){let t=[],n=u(e,"recommendedCommand");n&&t.push(n);let i=u(e,"nextStep");return i&&t.push(i),t}function bk(e){return Array.isArray(e.checks)?e.checks.filter(L):[]}function T$(e){return e!==void 0&&e!=="pass"&&e!=="warn"&&e!=="advisory"}function tt(e){return Array.isArray(e)?e.filter(L):[]}function Dn(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}function $$(e){let t=e.commerce===!0;return{status:t?"available":"unavailable",summary:t?"Marketplace purchases, invoices, refunds, and creator commerce flows are available.":"Marketplace commerce is not available on this backend.",availableWorkflows:t?["Browse skills with `skills-layer featured` or `skills-layer search <query>`.","Start purchase handoff with `skills-layer buy <skill-slug>`.","Review account purchases with `skills-layer purchases list`."]:["Browse and install available free skills.","Use `skills-layer help topic install` for install guidance."]}}var L$={"core.identity":"Account and sign-in","core.catalog":"Catalog discovery","core.validation":"Creator validation","core.creator":"Creator submissions","core.library":"Owned skills","core.workspace":"Workspace rollout","core.guardian":"Runtime trust checks","core.source":"Source installs","core.discovery":"Catalog discovery","marketplace.commerce":"Marketplace commerce","marketplace.reviews":"Reviews and issues","marketplace.payouts":"Creator earnings"};function O$(e){let t=Dn(e.capabilities);return{status:"ok",edition:u(e,"edition")??"unknown",summary:"Public product capabilities available on the selected backend.",capabilities:t.map(n=>({name:L$[n]??Ta(n.replace(/^[^.]+\./u,"").replace(/[._-]+/gu," ")),available:!0})),count:t.length}}function N$(e,t){let n=k(e);if(!n)return;let i=Number(n);return!Number.isInteger(i)||i<=0?_("help optimize-tokens --max-characters must be a positive integer.",t):i<120||i>4e3?_("help optimize-tokens --max-characters must be between 120 and 4000.",t):i}function j$(e,t,n){let i=ce(n),r=E(e,"validation")??e,s=E(r,"parsedSkill")??E(e,"parsedSkill"),a=s?E(s,"frontmatter"):void 0,o=u(e,"skillSlug")??(a?u(a,"name"):void 0),l=r.valid===!0||e.valid===!0,c=jc(r,e,"issues"),d=jc(r,e,"warnings"),p=jc(r,e,"advice"),f=E(r,"stats")??E(e,"stats"),g=[`${i.ok("OK")} Validation complete.`,"",i.section("Bundle")];g.push(`  ${i.label("Path")}: ${t}`),o&&g.push(`  ${i.label("Skill")}: ${o}`),g.push(`  ${i.label("Readiness")}: ${l?"ready for dry-run submission":"needs changes before submission"}`),g.push("",i.section("Checks")),g.push(`  ${i.arrow} SKILL.md structure and frontmatter`),g.push(`  ${i.arrow} Required bundle files and supported directories`),g.push(`  ${i.arrow} Secret hygiene, unsafe script signals, and trust-review readiness`),g.push(`  ${i.arrow} Trigger quality inputs for should-trigger / should-not-trigger testing`);let h=E(e,"evalReadiness");if(h){let m=E(h,"summaryEnvelope"),y=Array.isArray(m?.statuses)?m.statuses.map(A=>String(A)).join(", "):void 0,w=E(h,"score"),v=w?U(w,"effectiveScorePercent"):void 0,S=w?U(w,"overallScore"):void 0;g.push("",i.section("Effectiveness Eval")),g.push(`  ${i.label("Posture")}: ${u(h,"label")??u(h,"status")??"limited"}`),g.push(`  ${i.label("Origin")}: ${u(h,"origin")??"inferred"}`),v!==void 0?g.push(`  ${i.label("Effective score")}: ${Pa(v)}`):S!==void 0&&g.push(`  ${i.label("Effective score")}: ${Pa(S*100)}`),g.push(`  ${i.label("Artifact digest")}: ${u(h,"artifactDigest")??"unavailable"}`),h.runtimeFileCount!==void 0&&g.push(`  ${i.label("Runtime files")}: ${fe("runtimeFileCount",h.runtimeFileCount)}`),h.evidenceFileCount!==void 0&&g.push(`  ${i.label("Evidence files excluded")}: ${fe("evidenceFileCount",h.evidenceFileCount)}`),g.push(`  ${i.label("Submit envelope")}: mandatory${y?` (${y})`:""}`)}if(f){let m=f.fileCount??f.files??e.fileCount,y=f.bodyWordCount??f.bodyWords??e.bodyWordCount;g.push("",i.section("File Summary")),m!==void 0&&g.push(`  ${i.label("File count")}: ${fe("fileCount",m)}`),y!==void 0&&g.push(`  ${i.label("Body words")}: ${fe("bodyWordCount",y)}`)}return g.push("",...Bc("Issues",c,i,"No blocking issues found.")),g.push("",...Bc("Warnings",d,i,"No warnings returned.")),g.push("",...Bc("Advice",p,i,"No extra advice returned.")),g.push("",i.section("Next")),g.push(`  ${i.arrow} skills-layer preview-trigger ${t} --should-trigger "<prompt>" --should-not-trigger "<prompt>"`),g.push(`  ${i.arrow} skills-layer creator submit ${t} --dry-run`),g.join(`
+`)}function jc(e,t,n){let i=Array.isArray(e[n])?e[n]:[],r=Array.isArray(t[n])?t[n]:[];return i.length>0?i:r}function Bc(e,t,n,i){let r=[n.section(`${e} (${t.length})`)];return t.length===0?(r.push(`  ${n.muted(i)}`),r):(t.slice(0,re).forEach((s,a)=>{r.push(`${a+1}. ${Sk(s)}`)}),r)}function Sk(e){return L(e)?(u(e,"message")??u(e,"title")??u(e,"code")??u(e,"path")??lr(e))||"Details available with --json":fe("",e)}function B$(e,t,n){let i=ce(n),r=F$(e),s=D$(e),a=[`${i.ok("OK")} Trigger preview complete.`,"",i.section("Bundle"),`  ${i.label("Path")}: ${t}`],o=u(e,"skillSlug")??u(e,"slug");return o&&a.push(`  ${i.label("Skill")}: ${o}`),a.push("",i.section(`Prompt Results (${r.length})`)),r.length===0&&a.push(`  ${i.muted("No prompt results returned. Use --json to inspect the raw backend response.")}`),r.slice(0,re).forEach((l,c)=>{a.push(`${c+1}. ${q$(l,c)}`)}),a.push("",i.section(`Guidance (${s.length})`)),s.length===0&&a.push(`  ${i.muted("No extra trigger guidance returned.")}`),s.slice(0,re).forEach((l,c)=>{a.push(`${c+1}. ${l}`)}),a.push("",i.section("Next")),a.push(`  ${i.arrow} skills-layer validate ${t}`),a.push(`  ${i.arrow} skills-layer creator submit ${t} --dry-run`),a.join(`
+`)}function F$(e){return[...tt(e.promptResults),...tt(e.results),...tt(e.shouldTriggerResults),...tt(e.shouldNotTriggerResults),...tt(e.paraphraseResults)]}function D$(e){let t=Dn(e.guidance),n=tt(e.guidance).map(i=>Sk(i));return[...t,...n]}function q$(e,t){let n=u(e,"prompt")??u(e,"text")??u(e,"input")??`Prompt ${t+1}`,i=M$(e),r=U$(e),s=V$(e),a=e.score??e.confidence,o=u(e,"reason")??u(e,"explanation")??u(e,"message");return[`"${Un(n)}"`,i?`expected: ${i}`:void 0,r?`actual: ${r}`:void 0,s,a!==void 0?`score: ${fe("score",a)}`:void 0,o?`reason: ${Un(o)}`:void 0].filter(l=>!!l).join("; ")}function M$(e){return typeof e.shouldTrigger=="boolean"?e.shouldTrigger?"should trigger":"should not trigger":typeof e.expectedTrigger=="boolean"?e.expectedTrigger?"should trigger":"should not trigger":u(e,"expected")??u(e,"kind")??u(e,"type")}function U$(e){return typeof e.triggered=="boolean"?e.triggered?"triggered":"did not trigger":typeof e.actualTrigger=="boolean"?e.actualTrigger?"triggered":"did not trigger":u(e,"actual")??u(e,"classification")??u(e,"decision")}function V$(e){return typeof e.passed=="boolean"?e.passed?"pass":"fail":typeof e.pass=="boolean"?e.pass?"pass":"fail":u(e,"status")}function G$(e,t,n,i){let r=ce(i),s=u(e,"skillSlug")??me(t),a=[`${r.ok("OK")} Created ${n}.`,"",r.section("Local Skill")];a.push(`  ${r.label("Path")}: ${n}`),a.push(`  ${r.label("Skill")}: ${s}`);let o=u(e,"skillType"),l=u(e,"category");return o&&a.push(`  ${r.label("Type")}: ${o}`),l&&a.push(`  ${r.label("Category")}: ${l}`),a.push("",r.section("Next")),a.push(`  ${r.arrow} Edit ${n}`),a.push(`  ${r.arrow} skills-layer validate ${t}`),a.push(`  ${r.arrow} skills-layer preview-trigger ${t} --should-trigger "<prompt>" --should-not-trigger "<prompt>"`),a.push(`  ${r.arrow} skills-layer creator submit ${t} --dry-run`),a.join(`
+`)}function z$(e,t,n){let i=E(e,"profile")??e,r=Fc(i,"requirementsCurrentlyDue"),s=Fc(i,"requirementsPastDue"),a=Fc(i,"requirementsPendingVerification"),o=["payouts","Enabled"].join(""),l=i.readyForPayouts??i[o],c=l===!0,d=[`${n.ok("OK")} ${t}`,"",n.section("Payout Profile")];return d.push(`  ${n.label("Status")}: ${ha(u(i,"status"))}`),d.push(`  ${n.label("Ready for payouts")}: ${cy(l)}`),d.push(`  ${n.label("Account details submitted")}: ${cy(i.detailsSubmitted)}`),d.push(`  ${n.label("Currency")}: ${ha(u(i,"currency")?.toUpperCase())}`),d.push(`  ${n.label("Country")}: ${ha(u(i,"country")?.toUpperCase())}`),d.push(`  ${n.label("Minimum withdrawal")}: ${J$(i)}`),d.push(`  ${n.label("Updated at")}: ${ha(u(i,"updatedAt"))}`),d.push("",n.section("Requirements")),d.push(`  ${n.label("Currently due")}: ${Dc(r)}`),d.push(`  ${n.label("Past due")}: ${Dc(s)}`),d.push(`  ${n.label("Pending verification")}: ${Dc(a)}`),d.push("",n.section("Next")),c?(d.push(`  ${n.arrow} skills-layer creator earnings`),d.push(`  ${n.arrow} skills-layer creator withdraw --amount-cents <amount>`),d.push(`  ${n.arrow} skills-layer creator payouts`)):(d.push(`  ${n.arrow} skills-layer creator payout-link`),d.push(`  ${n.arrow} skills-layer creator earnings`)),d.join(`
+`)}function K$(e,t,n){let i=ru(e),r=Au(e,"withdrawableBalanceCents"),s=[`${n.ok("OK")} ${t}`,"",n.section("Earnings Summary")];return s.push(`  ${n.label("Gross sales")}: ${_e(e,"successfulSalesCents",i)}`),s.push(`  ${n.label("Platform fees")}: ${_e(e,"platformFeeCents",i)}`),s.push(`  ${n.label("Refunds requested")}: ${_e(e,"refundRequestedCents",i)}`),s.push(`  ${n.label("Refunded")}: ${_e(e,"refundedCents",i)}`),s.push(`  ${n.label("Estimated available")}: ${_e(e,"estimatedAvailableCents",i)}`),s.push(`  ${n.label("Withdrawable now")}: ${_e(e,"withdrawableBalanceCents",i)}`),s.push(`  ${n.label("Held balance")}: ${_e(e,"heldBalanceCents",i)}`),s.push(`  ${n.label("Refund exposure")}: ${_e(e,"refundExposureCents",i)}`),s.push("",n.section("Activity")),s.push(`  ${n.label("Successful purchases")}: ${ly(e,"successfulPurchaseCount")}`),s.push(`  ${n.label("Refund requests")}: ${ly(e,"refundRequestedCount")}`),s.push(`  ${n.label("Pending payouts")}: ${_e(e,"pendingPayoutCents",i)}`),s.push(`  ${n.label("Completed payouts")}: ${_e(e,"completedPayoutCents",i)}`),s.push("",n.section("Guidance")),r>0?(s.push("1. You have a withdrawable balance available."),s.push("2. Confirm payout setup is ready before requesting withdrawal.")):(s.push("1. No withdrawable balance yet."),s.push("2. Sales will appear here after paid purchases settle.")),s.push("",n.section("Next")),r>0&&s.push(`  ${n.arrow} skills-layer creator withdraw --amount-cents ${r}`),s.push(`  ${n.arrow} skills-layer creator payout-profile`),s.push(`  ${n.arrow} skills-layer creator payouts`),s.join(`
+`)}function H$(e,t,n){let i=Array.isArray(e.results)?e.results:[],r=ru(e,i),s=Au(e,"withdrawableBalanceCents"),a=[`${n.ok("OK")} ${t}`,"",n.section("Payout History")];return a.push(`  ${n.label("Withdrawable now")}: ${_e(e,"withdrawableBalanceCents",r)}`),a.push(`  ${n.label("Pending payouts")}: ${_e(e,"pendingPayoutCents",r)}`),a.push(`  ${n.label("Completed payouts")}: ${_e(e,"completedPayoutCents",r)}`),a.push("",n.section(`Requests (${i.length})`)),i.length===0?a.push(`  ${n.muted("No payout requests yet.")}`):(i.slice(0,re).forEach((o,l)=>{if(!L(o)){a.push(`${l+1}. ${fe("",o)}`);return}let c=ru(o,void 0,r),d=u(o,"payoutId")??u(o,"id")??`Payout ${l+1}`,p=u(o,"status")??"unknown",f=_e(o,"amountCents",c),g=u(o,"requestedAt"),h=u(o,"completedAt"),m=u(o,"reason");a.push(`${l+1}. ${d}`),a.push(`   ${n.label("Amount")}: ${f}; ${n.label("Status")}: ${p}`),g&&a.push(`   ${n.label("Requested")}: ${g}`),h&&a.push(`   ${n.label("Completed")}: ${h}`),m&&a.push(`   ${n.label("Reason")}: ${m}`)}),i.length>re&&a.push(`  ${n.muted(`... ${i.length-re} more`)}`)),a.push("",n.section("Guidance")),i.length===0?a.push("1. Payouts appear here after you request a withdrawal."):a.push("1. Use this history to track requested, processing, paid, or failed payouts."),a.push("2. Check payout profile if setup or verification looks incomplete."),a.push("",n.section("Next")),s>0&&a.push(`  ${n.arrow} skills-layer creator withdraw --amount-cents ${s}`),a.push(`  ${n.arrow} skills-layer creator earnings`),a.push(`  ${n.arrow} skills-layer creator payout-profile`),a.join(`
+`)}function ru(e,t,n="GBP"){let i=u(e,"currency");if(i)return i.toUpperCase();let r=t?.find(L);if(r){let s=u(r,"currency");if(s)return s.toUpperCase()}return n}function Au(e,t){return U(e,t)??0}function ly(e,t){return U(e,t)??0}function _e(e,t,n){return`${_k(Au(e,t))} ${n}`}function Fc(e,t){return(at(e,t)??[]).map(n=>n.replace(/[._-]+/gu," "))}function Dc(e){return e.length>0?e.join(", "):"none"}function cy(e){return e===!0?"yes":e===!1?"no":"unknown"}function ha(e){return e??"none"}function J$(e){let t=U(e,"minimumWithdrawalAmountCents"),n=u(e,"currency")?.toUpperCase()??"minor units";return t===void 0?"none":`${_k(t)} ${n}`}function _k(e){return(e/100).toFixed(2).replace(/\.00$/u,"").replace(/(\.\d)0$/u,"$1")}function ce(e){let t=W$(e);return{ok:n=>t?Bn(32,n):n,section:n=>t?Bn(1,Bn(36,n)):n,label:n=>t?Bn(1,n):n,muted:n=>t?Bn(2,n):n,arrow:t?Bn(36,"->"):"->"}}function W$(e){let t=e?.env??{};if(t.NO_COLOR)return!1;let n=t.FORCE_COLOR;return n&&n!=="0"?!0:!!e?.stdoutIsTty&&t.TERM!=="dumb"&&n!=="0"}function Bn(e,t){return`\x1B[${e}m${t}\x1B[0m`}function Pk(e,t){let n=[],i=X$(e,t);i.length>0&&n.push(...i);let r=Y$(e,t);r.length>0&&n.push(...r);for(let[s,a]of tL(e))if(Array.isArray(a))n.push(...Z$(s,a,t));else if(L(a)){let o=lr(a);o&&n.push(`  ${t.label(au(s))}: ${o}`)}else n.push(`  ${t.label(au(s))}: ${fe(s,a)}`);return n}function Y$(e,t){let n=E(e,"effectiveness");if(!n)return[];let i=u(n,"label"),r=u(n,"latestSummaryStatus"),s=U(n,"evidenceCount"),a=E(n,"score"),o=a?U(a,"overallScore"):void 0,l=a?U(a,"effectiveScorePercent"):void 0,c=a?E(a,"components"):void 0,d=c?U(c,"passRate"):void 0,p=c?U(c,"coverageRatio"):void 0;if(!i&&r===void 0&&s===void 0&&o===void 0)return[];let f=[t.section("Effectiveness")];return i&&f.push(`  ${t.label("Label")}: ${i}`),r&&f.push(`  ${t.label("Latest summary")}: ${r}`),s!==void 0&&f.push(`  ${t.label("Evidence count")}: ${s}`),l!==void 0?f.push(`  ${t.label("Effective score")}: ${Pa(l)}`):o!==void 0&&f.push(`  ${t.label("Effective score")}: ${Pa(o*100)}`),d!==void 0&&f.push(`  ${t.label("Pass rate")}: ${d}`),p!==void 0&&f.push(`  ${t.label("Coverage")}: ${p}`),f}function Pa(e){let t=Math.round(e*10)/10;return`${Number.isInteger(t)?t.toFixed(0):t.toFixed(1)}%`}function Z$(e,t,n){let i=nL(e),r=[n.section(`${i} (${t.length})`)];return t.length===0?(r.push(`  ${n.muted("No entries.")}`),r):(t.slice(0,re).forEach((s,a)=>{r.push(...Ak(s,a,n))}),t.length>re&&r.push(`  ${n.muted(`... ${t.length-re} more`)}`),r)}function Ak(e,t,n){if(!L(e))return[`${t+1}. ${fe("",e)}`];let i=su(e)??J(lr(e))??`Item ${t+1}`,r=[`${t+1}. ${i}`],s=Ck(e);s&&r.push(`   ${s}`);let a=lr(e);return a&&r.push(`   ${a}`),r}function X$(e,t){let n=D0(e,t);if(n.length>0)return n;let i=E(e,"capabilityProfile"),r=i?u(i,"runtimeRisk"):void 0;return r?[t.section("Trust"),`  ${t.label("Runtime risk")}: ${r}`]:[]}function Q$(e,t,n){let i=ce(n),r=u(e,"skillSlug")??t,s=u(e,"runtimeRisk")??(E(e,"capabilityProfile")?u(E(e,"capabilityProfile"),"runtimeRisk"):void 0),a=[`${i.ok("OK")} Creator security report loaded.`,"",i.section("Creator Security")];e.securityScore!==void 0&&a.push(`  ${i.label("Security score")}: ${fe("securityScore",e.securityScore)}`),s&&a.push(`  ${i.label("Runtime risk")}: ${s}`);let o=u(e,"recommendation");o&&a.push(`  ${i.label("Recommendation")}: ${o}`),a.push(`  ${i.label("Skill")}: ${r}`);let l=u(e,"version");l&&a.push(`  ${i.label("Version")}: ${l}`);let c=["semantic","review","no","reviewable","findings"].join("_"),d=Dn(e.reviewDegradedReasons).includes(c),p=Dn(e.trustBadges).filter(h=>h==="capability-mismatch"),f=Dn(e.trustBadges).filter(h=>h!=="capability-mismatch");(d||p.length>0)&&(a.push("",i.section("Creator Notes")),d&&a.push("1. Semantic review was not needed because there were no reviewable findings."),p.forEach((h,m)=>{a.push(`${d?m+2:m+1}. ${h==="capability-mismatch"?"Capability declaration needs review.":h}`)})),f.length>0&&(a.push("",i.section(`Trust badges (${f.length})`)),f.slice(0,re).forEach((h,m)=>a.push(`${m+1}. ${h}`)));let g=Array.isArray(e.findings)?e.findings:[];return a.push("",i.section(`Findings (${g.length})`)),g.length===0?a.push(`  ${i.muted("No entries.")}`):g.slice(0,re).forEach((h,m)=>{a.push(...Ak(h,m,i))}),a.push("",i.section("Next")),a.push(`  ${i.arrow} skills-layer creator rescan-security ${r}`),a.push(`  ${i.arrow} skills-layer creator status ${r}`),a.push(`  ${i.arrow} skills-layer trust ${r}`),a.join(`
+`)}function eL(e,t,n){let r=E(e,"report")??e,s=ce(n),a=r.securityScore,o=u(r,"generatedAt")??u(r,"reportGeneratedAt"),l=Array.isArray(r.findings)?r.findings:void 0,c=[`${s.ok("OK")} Security rescan requested.`,"",s.section("Creator Security")];return c.push(`  ${s.label("Skill")}: ${u(r,"skillSlug")??t}`),a!==void 0&&c.push(`  ${s.label("Security score")}: ${fe("securityScore",a)}`),l&&c.push(`  ${s.label("Findings")}: ${l.length}`),o&&c.push(`  ${s.label("Generated at")}: ${o}`),c.push("",s.section("Next")),c.push(`  ${s.arrow} skills-layer creator security-report ${t}`),c.push(`  ${s.arrow} skills-layer creator status ${t}`),c.join(`
+`)}function tL(e){return Object.entries(e).filter(([t,n])=>Rk(t,n))}function Rk(e,t){let n=e.toLowerCase();return n==="status"||n==="securityscore"||n==="recommendation"||n==="capabilityprofile"||n==="securityposture"||n==="trust"||n==="effectiveness"||n.includes("apikey")||n.includes("secret")||n.includes("token")||n==="content"?!1:t!==void 0}function lr(e){let n=[["id","id"],["name","name"],["keyPrefix","prefix"],["slug","slug"],["skillSlug","skill"],["currentVersion","version"],["version","version"],["category","category"],["skillType","type"],["type","type"],["visibility","visibility"],["status","status"],["count","count"],["email","email"],["role","role"],["selectedBackend","backend"],["selectedBaseUrl","base url"],["path","path"],["downloadUrl","download url"],["authorizationUrl","authorization url"],["checkoutUrl","checkout url"],["url","url"],["issueId","issue"],["reviewId","review"],["purchaseId","purchase"],["workspaceId","workspace"],["clientId","client"],["environment","environment"],["expiresAt","expires"],["lastUsedAt","last used"],["revocable","revocable"],["revokeCommand","revoke"],["approvalId","approval"],["source","source"],["scope","scope"],["agent","agent"],["bytes","bytes"],["fileCount","file count"],["bodyWordCount","body words"]].flatMap(([r,s])=>{if(!Rk(r,e[r]))return[];let a=e[r];return a===void 0?[]:[`${s}: ${fe(r,a)}`]}),i=E(e,"securityPosture");if(i){let r=u(i,"label"),s=u(i,"runtimeRisk");r&&n.push(`trust: ${r}`),s&&n.push(`risk: ${s}`)}return n.join("; ")}function Ck(e){return u(e,"shortDescription")??u(e,"summary")??u(e,"description")??u(e,"message")}function su(e){return u(e,"displayName")??u(e,"name")??u(e,"title")??u(e,"slug")??u(e,"skillSlug")??u(e,"code")??u(e,"id")}function fe(e,t){return e==="downloadUrl"?"<hidden; use --json or --output>":typeof t=="string"?e.toLowerCase()==="category"?Ek(t):Un(t):typeof t=="number"||typeof t=="boolean"?String(t):t===null?"none":Array.isArray(t)?`${t.length} item${t.length===1?"":"s"}`:L(t)?lr(t)||"details available with --json":String(t)}function Ek(e){return xg(e)}function Un(e){let t=e.replace(/\s+/gu," ").trim();return t.length>160?`${t.slice(0,157)}...`:t}function nL(e){return Ta(au(e))}function au(e){return e.replace(/([a-z0-9])([A-Z])/gu,"$1 $2").replace(/[_-]+/gu," ").toLowerCase()}function xk(e){let t=iL(e),n=t?[`skills-layer show ${t}`,`skills-layer trust ${t}`,`skills-layer install ${t}`]:[],i=typeof e.downloadUrl=="string",r=Array.isArray(e.materializedWrites)&&e.materializedWrites.length>0;return i&&n.push("Use --output <path> to write exports without printing temporary download URLs"),r&&n.push("Review the materialized files in this workspace"),e.valid===!0&&n.push("skills-layer creator submit <path> --dry-run"),n}function iL(e){let t=u(e,"skillSlug")??u(e,"slug");if(t)return t;let n=e.results;if(Array.isArray(n)){for(let i of n)if(L(i)){let r=u(i,"skillSlug")??u(i,"slug");if(r)return r}}}function L(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function _(e,t){let n=rL(e);return n?P(n.payload,e,t,n.reasonCode):{exitCode:1,stdout:"",stderr:t?JSON.stringify({schemaVersion:du,status:"error",reasonFamily:"invalid_input",summary:e,why:null,nextAction:null,nextStep:null,data:{error:e},warnings:[],links:[],reasonCode:null,handoff:null},null,2):e}}function rL(e){let t=/^(?<code>EACCES|EPERM|EROFS):\s*(?<detail>.+)$/iu.exec(e);if(t?.groups){let d=t.groups.code.toUpperCase(),p=/'(?<path>[^']+)'/u.exec(e)?.groups?.path;return{reasonCode:"local_filesystem_permission_denied",payload:{status:"error",reasonCode:"local_filesystem_permission_denied",code:d,...p?{path:p}:{},nextAction:"check_local_permissions",nextStep:"Check the local path permissions, choose a writable installed skill directory, or rerun the command from a workspace you can write to."}}}let n=/^--(?<flag>[a-z0-9-]+) must be valid JSON\.$/iu.exec(e);if(n?.groups){let d=n.groups.flag;return{reasonCode:"invalid_json",payload:{status:"error",reasonCode:"invalid_json",flag:d,nextAction:"fix_json_flag",nextStep:`Provide valid JSON for --${d}.`}}}let i=/^Unknown flag --(?<flag>[a-z0-9-]+)\.$/iu.exec(e);if(i?.groups)return{reasonCode:"unknown_flag",payload:{status:"error",reasonCode:"unknown_flag",flag:i.groups.flag,nextAction:"help",nextStep:"Run `skills-layer <command> --help` to see supported flags for that command."}};let r=/^(?<command>.+?) --(?<flag>[a-z0-9-]+) must be one of: (?<accepted>.+?)\.$/iu.exec(e);if(r?.groups){let d=r.groups.flag,p=r.groups.accepted.split(",").map(f=>f.trim()).filter(Boolean);return{reasonCode:`invalid_${d.replace(/-/gu,"_")}`,payload:{status:"error",reasonCode:`invalid_${d.replace(/-/gu,"_")}`,command:r.groups.command,flag:d,acceptedValues:p,nextAction:r.groups.command.replace(/\s+/gu,"."),nextStep:`Use --${d} with one of: ${p.join(", ")}.`}}}let s=/^Unknown (?<namespace>.+?) command "(?<subcommand>.*?)"\.$/u.exec(e);if(s?.groups){let d=s.groups.namespace.trim(),p=s.groups.subcommand;return{reasonCode:"unknown_subcommand",payload:{status:"error",reasonCode:"unknown_subcommand",namespace:d,subcommand:p,nextAction:`${d.replace(/\s+/gu,".")}.help`,nextStep:`Run \`skills-layer ${d} --help\` to see supported ${d} commands.`}}}let a=/^(?<command>.+?) requires (?<argument>.+?)\.$/u.exec(e);if(!a?.groups)return;let o=a.groups.command.trim(),l=a.groups.argument.trim(),c=sL(l);return{reasonCode:"missing_required_argument",payload:{status:"error",reasonCode:"missing_required_argument",command:o,argument:c,nextAction:o.replace(/\s+/gu,"."),nextStep:`Provide ${c.startsWith("--")?c:`<${c}>`} and retry.`}}}function sL(e){let t=e.replace(/^(?:a|an|the)\s+/iu,"");if(/^two or more skill slugs$/iu.test(t))return"two-or-more-skill-slugs";let n=/--(?<name>[a-z0-9-]+)/iu.exec(t)?.groups?.name;return n||(/<(?<name>[^>]+)>/u.exec(t)?.groups?.name??t).replace(/\s+or\s+.*$/iu,"").replace(/[^a-z0-9]+/giu,"-").replace(/^-+|-+$/gu,"").toLowerCase()||"argument"}function P(e,t,n,i){let r=_a(e),s=i??u(r,"reasonCode")??null,a={schemaVersion:du,status:u(r,"status")??"error",summary:t,why:u(r,"why")??null,nextAction:u(r,"nextAction")??null,nextStep:u(r,"nextStep")??null,data:r,warnings:Array.isArray(r.warnings)?r.warnings:[],links:Array.isArray(r.links)?r.links:[],reasonCode:s,reasonFamily:h$(s),handoff:r.handoff??null};return{exitCode:1,stdout:"",stderr:n?JSON.stringify(a,null,2):t}}function dr(e,t){let n=e.details??{};if(e.status===401){let s=u(n,"error")??"Login required.",a=u(n,"nextAction")??"login",o=u(n,"nextStep")??"Run `skills-layer login` to sign in, then retry this command.";return P({status:"login_required",reasonCode:"login_required",error:s,nextAction:a,nextStep:o},`${s==="Login required."?"Login required":s}. ${o}`,t,"login_required")}let i=u(n,"reasonCode");if(i){let s=L(n.data)?n.data:null,o=s!==null&&("summary"in n||"data"in n)?s:n,l=u(o,"error")??u(n,"error")??u(n,"summary")??e.message;return P({...o,status:u(n,"status")??u(o,"status")??(e.status===404?"not_found":"error"),nextAction:u(o,"nextAction")??u(n,"nextAction"),nextStep:u(o,"nextStep")??u(n,"nextStep"),warnings:Array.isArray(o.warnings)?o.warnings:n.warnings,links:Array.isArray(o.links)?o.links:n.links,handoff:o.handoff??n.handoff,reasonCode:i},l,t,i)}let r=aL(e);return r?P(r.payload,r.message,t,r.reasonCode):_(u(n,"error")??e.message,t)}function aL(e){let t=u(e.details??{},"error")??e.message,n=t.toLowerCase();return e.status===404&&n.includes("source connection")?{reasonCode:"source_connection_not_found",message:"Source connection not found.",payload:{status:"not_found",error:t,reasonCode:"source_connection_not_found",nextAction:"source.connection.start",nextStep:"Check the source connection id, or start a new source connection."}}:e.status===404&&n.includes("approval request")?{reasonCode:"approval_request_not_found",message:"Approval request not found.",payload:{status:"not_found",error:t,reasonCode:"approval_request_not_found",nextAction:"approval.request.status",nextStep:"Check the approval request id, or rerun the workflow that created the approval request."}}:e.status===404&&(n.includes("purchase")||n.includes("invoice"))?{reasonCode:"purchase_not_found",message:"Purchase not found.",payload:{status:"not_found",error:t,reasonCode:"purchase_not_found",nextAction:"purchases.list",nextStep:"Run `skills-layer purchases list` to find a valid purchase id."}}:e.status===404&&(n.includes("security report")||n.includes("trust report"))?{reasonCode:"trust_report_not_found",message:"Trust report not found.",payload:{status:"not_found",error:t,reasonCode:"trust_report_not_found",nextAction:"trust",nextStep:"Run `skills-layer show <skill-slug>` to confirm the skill exists, then retry trust after the security report is generated."}}:e.status===404&&n.includes("help topic")?{reasonCode:"help_topic_not_found",message:"Help topic not found.",payload:{status:"not_found",error:t,reasonCode:"help_topic_not_found",nextAction:"help",nextStep:"Run `skills-layer help full` or `skills-layer --help` to see available topics."}}:e.status===404&&n.includes("skill")?{reasonCode:"skill_not_found",message:"Skill not found.",payload:{status:"not_found",error:t,reasonCode:"skill_not_found",nextAction:"search",nextStep:"Run `skills-layer search <query>` to find a valid skill slug before retrying."}}:null}async function le(e){try{return JSON.parse(await ur(e,"utf8"))}catch{return null}}async function oL(e,t){let n=await le(e);return n?rh(n,{env:t.env,platform:t.platform,store:t.credentialStore}):null}async function Ru(e,t,n){let i=await ih(t,{env:n.env,platform:n.platform,store:n.credentialStore});await xe(e,i)}async function xe(e,t){await Ia(ge(e)),await Aa(e,`${JSON.stringify(t,null,2)}
+`,{encoding:"utf8",mode:384}),await pr(e,384)}async function Ia(e){await Mn(e,{recursive:!0,mode:448}),await pr(e,448)}async function pr(e,t){if(process.platform!=="win32")try{await cx(e,t)}catch{}}async function uy(e,t){await Mn(ge(e),{recursive:!0}),await Aa(e,t,"utf8")}async function Ik(e,t){await Mn(ge(e),{recursive:!0}),await Aa(e,t)}function lL(e=process.stdin,t=process.stdout,n=cu){return async i=>{if(!e.isTTY||!t.isTTY)throw new Error("Interactive prompt is not available in this environment.");let r=n({input:e,output:t});try{return(await r.question(i)).trim()}finally{r.close()}}}function cL(e=process.stdin,t=process.stdout,n=cu){return async i=>{if(!e.isTTY||!t.isTTY)throw new Error("Interactive secret prompt is not available in this environment.");if(typeof e.setRawMode=="function"&&typeof e.on=="function"&&typeof e.off=="function")return new Promise((s,a)=>{let o=e,l=o.isRaw===!0,c="",d=!1,p=g=>{d||(d=!0,o.off("data",f),o.setRawMode(l),o.pause?.(),t.write(`
+`),g())},f=g=>{let h=typeof g=="string"?g:g.toString("utf8");for(let m of h){if(m==="\r"||m===`
+`){p(()=>s(c.trim()));return}if(m===""){p(()=>a(new Error("Interactive secret prompt cancelled.")));return}if(m==="\b"||m==="\x7F"){c.length>0&&(c=c.slice(0,-1),t.write("\b \b"));continue}c+=m,t.write("*")}};t.write(i),o.resume?.(),o.on("data",f),o.setRawMode(!0)});let r=n({input:e,output:t,terminal:!0});r.stdoutMuted=!0,r._writeToOutput=function(a){if(!this.stdoutMuted){t.write(a);return}if(a==="\b"||a==="\x7F"){t.write("\b \b");return}if(a!=="\r"&&a!==`
+`){let o=[...a].filter(l=>l!=="\r"&&l!==`
+`).length;o>0&&t.write("*".repeat(o))}};try{t.write(i);let s=await r.question("");return t.write(`
+`),s.trim()}finally{r.close()}}}function uL(e=process.stdin,t=process.stdout,n=cu){return async(i,r)=>{if(r.length===0)throw new Error("Interactive selection has no available options.");if(!e.isTTY||!t.isTTY)throw new Error("Interactive selection is not available in this environment.");let s=e;if(typeof s.setRawMode=="function"&&typeof s.on=="function"&&typeof s.off=="function")return new Promise((o,l)=>{let c=0,d="",p=0,f=!1,g=s.isRaw===!0,h=()=>{p>0&&t.write(`\x1B[${p}F\x1B[J`),t.write(`${i}
+`);for(let[w,v]of r.entries())t.write(`${dL(w===c)} ${w+1}. ${dy(v)}
 `);t.write(`Choice: ${d}
 `),t.write(`Use up/down arrows, type a number, then press Enter.
-`),g=r.length+3},v=R=>{f||(f=!0,s.off?.("data",P),s.setRawMode?.(m),s.pause?.(),t.write(`
-`),R())},P=R=>{let L=typeof R=="string"?R:R.toString("utf8");if(L.includes("")){v(()=>c(new Error("Interactive selection cancelled.")));return}if(L.includes("\x1B[A")){d="",u=(u-1+r.length)%r.length,y();return}if(L.includes("\x1B[B")){d="",u=(u+1)%r.length,y();return}if(L.includes("\r")||L.includes(`
-`)){if(d){let j=Number.parseInt(d,10)-1;if(Number.isNaN(j)||j<0||j>=r.length){d="",t.write("\x07"),y();return}u=j}v(()=>a(r[u]?.value??r[0].value));return}if(L.includes("\b")||L.includes("\x7F")){d=d.slice(0,-1);let j=Number.parseInt(d,10)-1;!Number.isNaN(j)&&j>=0&&j<r.length&&(u=j),y();return}let K=[...L].filter(j=>/[0-9]/u.test(j));if(K.length>0){d=`${d}${K.join("")}`;let j=Number.parseInt(d,10)-1;!Number.isNaN(j)&&j>=0&&j<r.length&&(u=j),y()}};y(),s.resume?.(),s.on("data",P),s.setRawMode(!0)});let o=n({input:e,output:t});try{t.write(`${i}
-`);for(let[u,d]of r.entries())t.write(`${u+1}. ${hs(d)}
-`);let a=(await o.question("Choose a number and press enter: ")).trim(),c=Number.parseInt(a,10)-1;if(Number.isNaN(c)||c<0||c>=r.length)throw new Error("No valid option selected.");return r[c].value}finally{o.close()}}}function Fp(e){return e?"\x1B[36m>\x1B[0m":" "}function hs(e){return e.description?`${e.label} (${e.description})`:e.label}function Np(e){return async t=>{let n=e==="win32"?{file:"rundll32.exe",args:["url.dll,FileProtocolHandler",t]}:e==="darwin"?{file:"open",args:[t]}:{file:"xdg-open",args:[t]};return new Promise(i=>{try{let r=ks(n.file,n.args,{detached:!0,stdio:"ignore"});r.on("error",()=>i(!1)),r.unref(),i(!0)}catch{i(!1)}})}}function Z(e,t){let n={};for(let i of t){let r=e[i];r!==void 0&&r!==!1&&(i.endsWith("Cents")||i==="rating"?n[i]=Number(r):n[i]=r)}return _(n)}function Mp(e){let t=e.results;return Array.isArray(t)?t.flatMap(n=>{if(!n||typeof n!="object"||Array.isArray(n))return[];let i=l(n,"slug")??l(n,"skillSlug");return i?[i]:[]}):[]}function Bp(e){let t=p(e)??"auto";return t==="auto"||t==="required"||t==="optional"||t==="off"?{status:"ok",policy:t}:{status:"invalid",message:"guardian check --cloud-trust-ledger must be one of: auto, required, optional, off."}}function _(e){let t={};for(let[n,i]of Object.entries(e))i!==void 0&&(t[n]=i);return t}function Xt(e,t){let n=p(e);return n?Ai(n,t):void 0}function Ai(e,t){try{return JSON.parse(e)}catch{throw new Error(`--${t} must be valid JSON.`)}}function Y(e){if(!e||typeof e!="object"||Array.isArray(e))return e;let t={...e};return delete t.apiKey,delete t[["ad","min","Api","Key"].join("")],t}function ti(e){let t=Y(e);for(let n of["role","roles","verifiedAt","expiresAt","userId","tenantId","linkedAccount","linkedIdentity","createdUser"])delete t[n];return t}function b(e,t){let n=p(e);if(!n)throw new Error(t);return n}function p(e){return typeof e=="string"&&e.trim().length>0?e.trim():void 0}function oe(e){return typeof e=="string"&&e.trim().length>0?e.trim():void 0}function l(e,t){let n=e[t];return typeof n=="string"&&n.trim().length>0?n.trim():void 0}function T(e,t){let n=e[t];if(typeof n=="number"&&Number.isFinite(n))return n;if(typeof n=="string"&&n.trim().length>0){let i=Number(n);return Number.isFinite(i)?i:void 0}}function C(e,t){let n=e[t];return n&&typeof n=="object"&&!Array.isArray(n)?n:void 0}function ue(e,t){let n=e[t];return Array.isArray(n)?n.filter(i=>typeof i=="string"):void 0}function we(e,t){let n=e[t];return Array.isArray(n)?n:void 0}function Op(e){return C(e,"data")??e}function qp(e){let t=Array.isArray(e)?e:typeof e=="string"?[e]:[];return[...new Set(t.flatMap(n=>n.split(",")).map(n=>n.trim()).filter(Boolean))]}function q(e,t,n){let i=p(n);i&&e.set(t,i)}function ie(e){let t=e.toString();return t?`?${t}`:""}function Ce(e){return e.replace(/\/+$/u,"")}function ys(e){let t=Ce(e.trim());try{let n=new URL(t);if(n.protocol==="https:"&&(n.hostname==="staging.findfigg.co.uk"||n.hostname==="api.staging.findfigg.co.uk"))return"https://staging.findfigg.co.uk"}catch{return t}return t}function mt(e,t){return ys(e)===ys(t)}function pe(e){if(Ce(e)===di)return"cloud";try{let t=new URL(e);return t.hostname==="127.0.0.1"||t.hostname==="localhost"||t.hostname==="::1"||t.hostname==="[::1]"?"local":"custom"}catch{return"custom"}}function xo(e){return e.includes("/")||e.startsWith(".")||/^https?:\/\//u.test(e)||/^[a-z]+:/iu.test(e)}function V(e,t){return ai(e,t)}function en(e){return`${e[0]?.toUpperCase()??""}${e.slice(1)}`}var Dp={github:"GitHub",gitlab:"GitLab",google:"Google",microsoft:"Microsoft"};function Kp(e){return Dp[e.toLowerCase()]??en(e)}function te(e){return e instanceof Error?e.message:String(e)}export{rm as executePublicCli};
+`),p=r.length+3},m=w=>{f||(f=!0,s.off?.("data",y),s.setRawMode?.(g),s.pause?.(),t.write(`
+`),w())},y=w=>{let v=typeof w=="string"?w:w.toString("utf8");if(v.includes("")){m(()=>l(new Error("Interactive selection cancelled.")));return}if(v.includes("\x1B[A")){d="",c=(c-1+r.length)%r.length,h();return}if(v.includes("\x1B[B")){d="",c=(c+1)%r.length,h();return}if(v.includes("\r")||v.includes(`
+`)){if(d){let A=Number.parseInt(d,10)-1;if(Number.isNaN(A)||A<0||A>=r.length){d="",t.write("\x07"),h();return}c=A}m(()=>o(r[c]?.value??r[0].value));return}if(v.includes("\b")||v.includes("\x7F")){d=d.slice(0,-1);let A=Number.parseInt(d,10)-1;!Number.isNaN(A)&&A>=0&&A<r.length&&(c=A),h();return}let S=[...v].filter(A=>/[0-9]/u.test(A));if(S.length>0){d=`${d}${S.join("")}`;let A=Number.parseInt(d,10)-1;!Number.isNaN(A)&&A>=0&&A<r.length&&(c=A),h()}};h(),s.resume?.(),s.on("data",y),s.setRawMode(!0)});let a=n({input:e,output:t});try{t.write(`${i}
+`);for(let[c,d]of r.entries())t.write(`${c+1}. ${dy(d)}
+`);let o=(await a.question("Choose a number and press enter: ")).trim(),l=Number.parseInt(o,10)-1;if(Number.isNaN(l)||l<0||l>=r.length)throw new Error("No valid option selected.");return r[l].value}finally{a.close()}}}function dL(e){return e?"\x1B[36m>\x1B[0m":" "}function dy(e){return e.description?`${e.label} (${e.description})`:e.label}function pL(e){return async t=>{let n=e==="win32"?{file:"rundll32.exe",args:["url.dll,FileProtocolHandler",t]}:e==="darwin"?{file:"open",args:[t]}:{file:"xdg-open",args:[t]};return new Promise(i=>{try{let r=ox(n.file,n.args,{detached:!0,stdio:"ignore"});r.on("error",()=>i(!1)),r.unref(),i(!0)}catch{i(!1)}})}}function he(e,t){let n={};for(let i of t){let r=e[i];r!==void 0&&r!==!1&&(i.endsWith("Cents")||i==="rating"?n[i]=Number(r):n[i]=r)}return B(n)}function fL(e){let t=e.results;return Array.isArray(t)?t.flatMap(n=>{if(!n||typeof n!="object"||Array.isArray(n))return[];let i=u(n,"slug")??u(n,"skillSlug");return i?[i]:[]}):[]}function gL(e){let t=k(e)??"auto";return t==="auto"||t==="required"||t==="optional"||t==="off"?{status:"ok",policy:t}:{status:"invalid",message:"guardian check --cloud-trust-ledger must be one of: auto, required, optional, off."}}function B(e){let t={};for(let[n,i]of Object.entries(e))i!==void 0&&(t[n]=i);return t}function Cu(e,t){let n=k(e);return n?Tk(n,t):void 0}function Tk(e,t){try{return JSON.parse(e)}catch{throw new Error(`--${t} must be valid JSON.`)}}function Ae(e){if(!e||typeof e!="object"||Array.isArray(e))return e;let t={...e};return delete t.apiKey,delete t[["ad","min","Api","Key"].join("")],t}function ou(e){let t=Ae(e);for(let n of["role","roles","verifiedAt","expiresAt","userId","tenantId","linkedAccount","linkedIdentity","createdUser"])delete t[n];return t}function R(e,t){let n=k(e);if(!n)throw new Error(t);return n}function k(e){return typeof e=="string"&&e.trim().length>0?e.trim():void 0}function J(e){return typeof e=="string"&&e.trim().length>0?e.trim():void 0}function u(e,t){let n=e[t];return typeof n=="string"&&n.trim().length>0?n.trim():void 0}function U(e,t){let n=e[t];if(typeof n=="number"&&Number.isFinite(n))return n;if(typeof n=="string"&&n.trim().length>0){let i=Number(n);return Number.isFinite(i)?i:void 0}}function E(e,t){let n=e[t];return n&&typeof n=="object"&&!Array.isArray(n)?n:void 0}function at(e,t){let n=e[t];return Array.isArray(n)?n.filter(i=>typeof i=="string"):void 0}function He(e,t){let n=e[t];return Array.isArray(n)?n:void 0}function mL(e){return E(e,"data")??e}function hL(e){let t=Array.isArray(e)?e:typeof e=="string"?[e]:[];return[...new Set(t.flatMap(n=>n.split(",")).map(n=>n.trim()).filter(Boolean))]}function ie(e,t,n){let i=k(n);i&&e.set(t,i)}function ye(e){let t=e.toString();return t?`?${t}`:""}function nt(e){return e.replace(/\/+$/u,"")}function py(e){let t=nt(e.trim());try{let n=new URL(t);if(n.protocol==="https:"&&(n.hostname==="staging.findfigg.co.uk"||n.hostname==="api.staging.findfigg.co.uk"))return"https://staging.findfigg.co.uk"}catch{return t}return t}function cr(e,t){return py(e)===py(t)}function Ee(e){if(nt(e)===pu)return"cloud";try{let t=new URL(e);return t.hostname==="127.0.0.1"||t.hostname==="localhost"||t.hostname==="::1"||t.hostname==="[::1]"?"local":"custom"}catch{return"custom"}}function $k(e){return e.includes("/")||e.startsWith(".")||/^https?:\/\//u.test(e)||/^[a-z]+:/iu.test(e)}function Pe(e,t){return Ra(e,t)}function Ta(e){return`${e[0]?.toUpperCase()??""}${e.slice(1)}`}var yL={github:"GitHub",gitlab:"GitLab",google:"Google",microsoft:"Microsoft"};function kL(e){return yL[e.toLowerCase()]??Ta(e)}function X(e){return e instanceof Error?e.message:String(e)}export{CB as executePublicCli};