@baselane/materialize 0.1.6 → 0.1.8

package/dist/install.js

@@ -1,7 +1,7 @@
 import { readFile, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { buildManifest, materializeHarness, ENTRY_FILES, LEGACY_MANIFEST_PATH, MANIFEST_PATH, } from "@baselane/packs";
-import { parseInstallRef, resolveDefaultBranch } from "@baselane/distribute";
+import { parseInstallRef, resolveDefaultBranch, resolveWellKnownSource } from "@baselane/distribute";
 import { applyPlan, readCurrent } from "./fs-ops.js";
 import { planReconcile } from "./plan.js";
 import { mergeBaselaneHooks, SettingsParseError } from "./settings-merge.js";
@@ -80,6 +80,12 @@ export async function runInstall(opts) {
         if (parsed.kind === "git") {
             manifest = { ...base, packs: { ...base.packs, [parsed.name]: parsed.ref } };
         }
+        else if (parsed.kind === "docs") {
+            // Resolve once to fix the pin = sha256 of the host's well-known index.json; installFromManifest
+            // then re-resolves and re-verifies against it (index sha + per-artifact digests).
+            const { indexSha } = await resolveWellKnownSource({ url: parsed.url, fetchImpl: opts.fetchImpl, onNotice: log });
+            manifest = { ...base, packs: { ...base.packs, [`docs:${parsed.url}`]: indexSha } };
+        }
         else if (parsed.kind === "registry") {
             const registryBase = base.registry ?? opts.registryBase ?? DEFAULT_REGISTRY;
             let version = parsed.version;

package/dist/resolve-packs.d.ts

@@ -1,4 +1,5 @@
 import { type HarnessManifest, type Resolution, type WorkflowPack } from "@baselane/packs";
+import { type DnsLookup } from "@baselane/distribute";
 export interface ResolvedManifestPacks {
     packs: Record<string, WorkflowPack>;
     resolutions: Record<string, Resolution>;
@@ -41,4 +42,5 @@ export declare function resolveManifestPacks(manifest: HarnessManifest, opts?: {
     onNotice?: (m: string) => void;
     inlinePacks?: Record<string, WorkflowPack>;
     registryBase?: string;
+    lookupImpl?: DnsLookup;
 }): Promise<ResolvedManifestPacks>;

package/dist/resolve-packs.js

@@ -1,5 +1,5 @@
 import { packFromFileset, validatePack } from "@baselane/packs";
-import { isGitSourceName, parseGitSourceName, resolveGitSource } from "@baselane/distribute";
+import { isGitSourceName, parseGitSourceName, resolveGitSource, resolveWellKnownSource } from "@baselane/distribute";
 /** CLI default registry, overridden by `manifest.registry`, then a caller-supplied `registryBase`
  * (the CLI reads `BASELANE_REGISTRY` and passes it through — env access stays out of this
  * package, same as how `GITHUB_TOKEN` flows in as `opts.token`). Spec: RETURN DECISION 4. */
@@ -107,6 +107,18 @@ export async function resolveManifestPacks(manifest, opts = {}) {
             packs[name] = validatePack(inline);
             continue;
         }
+        if (name.startsWith("docs:")) {
+            // Well-known agent-skills source. `pin` is the sha256 of the host's index.json; the resolver
+            // re-fetches and re-verifies (index sha against the pin, each artifact against its digest) or
+            // hard-fails on drift/tamper. Reuses packFromFileset for validation.
+            const url = name.slice("docs:".length);
+            const { indexSha, files } = await resolveWellKnownSource({ url, pin, fetchImpl: opts.fetchImpl, onNotice: opts.onNotice, lookupImpl: opts.lookupImpl });
+            const host = new URL(url).hostname;
+            const result = await packFromFileset(files, { repoName: host, ref: "well-known", sha: indexSha });
+            packs[name] = result.pack;
+            resolutions[name] = { ref: pin, sha: indexSha, packId: result.pack.id };
+            continue;
+        }
         if (isGitSourceName(name)) {
             const { repo } = parseGitSourceName(name);
             const { ref, onlySkill } = decodeSkillPin(pin);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baselane/materialize",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "type": "module",
   "description": "Disk-reconcile and install engine (plan/apply/receipt/settings-merge/manifest-io/resolve/install) shared by the baselane CLI and desktop agent.",
   "main": "./dist/index.js",
@@ -19,8 +19,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@baselane/packs": "0.1.6",
-    "@baselane/distribute": "0.1.6"
+    "@baselane/packs": "0.1.8",
+    "@baselane/distribute": "0.1.8"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",