@baselane/packs 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,40 @@
+export type { WorkflowPack, PackAgent, PackCommand, PackHook, Capability, BlockProvenance, FileMap, PackScope, OnboardingStep } from "./types.ts";
+export { validatePack, validateComponent, packScope, KNOWN_HOOK_EVENTS } from "./validate.ts";
+export { validateSkill, skillLints, SKILL_NAME_MAX, SKILL_DESC_MAX, SKILL_BODY_MAX_LINES, SKILL_BODY_WARN_LINES } from "./validate.ts";
+export type { SkillLint } from "./validate.ts";
+export type { SkillBlock, SkillReference } from "./types.ts";
+export { composeDraftPack } from "./compose-draft.ts";
+export type { DraftPackInput, DraftPackResult } from "./compose-draft.ts";
+export type { ComponentBlockType } from "./validate.ts";
+export { renderPack } from "./render/render-pack.ts";
+export { renderBundleFiles } from "./render/bundle.ts";
+export { renderBundleUnion } from "./render/bundle-union.ts";
+export type { BundleUnion } from "./render/bundle-union.ts";
+export { renderRepoFileUnion } from "./render/repo-union.ts";
+export type { RepoUnion } from "./render/repo-union.ts";
+export { renderRolloutFiles } from "./render/rollout-files.ts";
+export type { RolloutFiles } from "./render/rollout-files.ts";
+export { builtinPacksDir, listBuiltinPacks, loadBuiltinPack } from "./load.ts";
+export { PACK_ALIASES } from "./aliases.ts";
+export { ENTRY_FILES, isEntryFile, mergeManagedRegion, stripManagedRegion, strippedManagedPackIds, extractManagedRegions } from "./merge-region.ts";
+export type { ManagedRegion } from "./merge-region.ts";
+export type { MergeInput, MergeResult, AiConfig } from "./ai-merge.ts";
+export { aiMergeFile } from "./ai-merge.ts";
+export { loadSeedSkills, seedSkillsDir, FIRST_PARTY_SOURCE } from "./seed-skills.ts";
+export type { SeedSkill } from "./seed-skills.ts";
+export { computeSkillOverlaps, normalizeName } from "./overlap.ts";
+export type { SkillOverlap } from "./overlap.ts";
+export { buildWikiSeed } from "./seed/wiki-seed.ts";
+export type { WikiSeedOptions } from "./seed/wiki-seed.ts";
+export { buildGraphSeed } from "./seed/graph-seed.ts";
+export type { GraphSeedOptions } from "./seed/graph-seed.ts";
+export { ingestHarness } from "./ingest.ts";
+export type { IngestInput, IngestResult } from "./ingest.ts";
+export { packFromFileset } from "./pack-from-fileset.ts";
+export type { PackFromFilesetResult } from "./pack-from-fileset.ts";
+export { validateManifest, buildManifest, MANIFEST_PATH, LEGACY_MANIFEST_PATH, KNOWN_CAPABILITIES, type HarnessManifest, type CapabilityName, type CapabilityReceipt } from "./manifest.ts";
+export { materializeHarness, sha256Hex } from "./materialize-harness.ts";
+export type { MaterializeInput, MaterializeResult } from "./materialize-harness.ts";
+export { detectPackDrift } from "./drift-detect.ts";
+export type { DriftKind } from "./drift-detect.ts";
+export type { VendoredEntry, ManagedRegionEntry, RegionReceipt, Resolution } from "./manifest.ts";

package/dist/index.js

@@ -0,0 +1,21 @@
+export { validatePack, validateComponent, packScope, KNOWN_HOOK_EVENTS } from "./validate.js";
+export { validateSkill, skillLints, SKILL_NAME_MAX, SKILL_DESC_MAX, SKILL_BODY_MAX_LINES, SKILL_BODY_WARN_LINES } from "./validate.js";
+export { composeDraftPack } from "./compose-draft.js";
+export { renderPack } from "./render/render-pack.js";
+export { renderBundleFiles } from "./render/bundle.js";
+export { renderBundleUnion } from "./render/bundle-union.js";
+export { renderRepoFileUnion } from "./render/repo-union.js";
+export { renderRolloutFiles } from "./render/rollout-files.js";
+export { builtinPacksDir, listBuiltinPacks, loadBuiltinPack } from "./load.js";
+export { PACK_ALIASES } from "./aliases.js";
+export { ENTRY_FILES, isEntryFile, mergeManagedRegion, stripManagedRegion, strippedManagedPackIds, extractManagedRegions } from "./merge-region.js";
+export { aiMergeFile } from "./ai-merge.js";
+export { loadSeedSkills, seedSkillsDir, FIRST_PARTY_SOURCE } from "./seed-skills.js";
+export { computeSkillOverlaps, normalizeName } from "./overlap.js";
+export { buildWikiSeed } from "./seed/wiki-seed.js";
+export { buildGraphSeed } from "./seed/graph-seed.js";
+export { ingestHarness } from "./ingest.js";
+export { packFromFileset } from "./pack-from-fileset.js";
+export { validateManifest, buildManifest, MANIFEST_PATH, LEGACY_MANIFEST_PATH, KNOWN_CAPABILITIES } from "./manifest.js";
+export { materializeHarness, sha256Hex } from "./materialize-harness.js";
+export { detectPackDrift } from "./drift-detect.js";

package/dist/ingest.d.ts

@@ -0,0 +1,25 @@
+import type { WorkflowPack } from "./types.ts";
+/**
+ * ingest.ts — the INVERSE of render/render-pack.ts + render/claude.ts: read a repo's already-
+ * rendered harness files (AGENTS.md + .claude/{skills,agents,commands,settings.json}) back into
+ * a validatePack-passing WorkflowPack, so a team's own harness can flow through the same
+ * preview→apply funnel as a baselane-authored pack.
+ *
+ * Every part is optional — a repo may have only an AGENTS.md, or only a .claude/ dir, or both.
+ * Never throws for one bad file: each file is parsed/validated independently and a failure is
+ * caught and recorded in `skipped`, not propagated.
+ */
+export interface IngestInput {
+    repoName: string;
+    listFiles(): Promise<string[]>;
+    readFile(path: string): Promise<string | null>;
+}
+export interface IngestResult {
+    pack: WorkflowPack;
+    sources: string[];
+    skipped: string[];
+}
+/** Reads an existing repo's rendered harness (AGENTS.md region + .claude/{skills,agents,commands,
+ * settings.json}) back into a validated WorkflowPack — the inverse of renderPack. Every part is
+ * optional; a single bad file is caught and recorded in `skipped`, never aborting the ingest. */
+export declare function ingestHarness(input: IngestInput): Promise<IngestResult>;

package/dist/ingest.js

@@ -0,0 +1,262 @@
+import { validateComponent, validatePack, validateSkill } from "./validate.js";
+import { stripManagedRegion, strippedManagedPackIds } from "./merge-region.js";
+const SKILL_MD_RE = /^\.claude\/skills\/([^/]+)\/SKILL\.md$/;
+const AGENT_MD_RE = /^\.claude\/agents\/([^/]+)\.md$/;
+const COMMAND_MD_RE = /^\.claude\/commands\/([^/]+)\.md$/;
+const SETTINGS_JSON_PATH = ".claude/settings.json";
+const AGENTS_MD_PATH = "AGENTS.md";
+/** Lowercase slug (letters/digits/dashes) matching validate.ts's SLUG — used both for the pack id
+ * (from repoName) and for skill/agent/command names recovered from a filename or frontmatter. */
+function slugify(value) {
+    const s = value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return s.length > 0 ? s : "x";
+}
+/** Minimal single-line `key: value` frontmatter split — same shape import-skills.ts/import-
+ * bundle.ts already parse (the render templates in render/claude.ts only ever emit simple
+ * single-line frontmatter values, so this is sufficient to invert them). */
+function parseFrontmatter(md) {
+    const m = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(md);
+    if (!m)
+        return { fm: {}, body: md };
+    const fm = {};
+    for (const raw of m[1].split("\n")) {
+        const kv = /^([a-zA-Z0-9_-]+):\s*(.*)$/.exec(raw.trim());
+        if (kv)
+            fm[kv[1]] = kv[2].replace(/^["']|["']$/g, "").trim();
+    }
+    return { fm, body: m[2] };
+}
+function placeholderMarkdown(repoName) {
+    return `# ${repoName}\n\nNo AGENTS.md was found in this repo; this pack was ingested from its .claude/ harness only.\n`;
+}
+/** Strips every baselane managed region present in `content` (there can be more than one pack's
+ * region in a single AGENTS.md), leaving the developer's own prose untouched — the read-side twin
+ * of mergeManagedRegion. */
+function stripAllManagedRegions(content) {
+    let out = content;
+    for (const packId of strippedManagedPackIds(content))
+        out = stripManagedRegion(out, packId);
+    return out;
+}
+async function ingestContextMarkdown(input, files, sources, skipped) {
+    if (!files.includes(AGENTS_MD_PATH))
+        return placeholderMarkdown(input.repoName);
+    try {
+        const content = await input.readFile(AGENTS_MD_PATH);
+        if (content === null) {
+            skipped.push(AGENTS_MD_PATH);
+            return placeholderMarkdown(input.repoName);
+        }
+        const stripped = stripAllManagedRegions(content).trim();
+        sources.push(AGENTS_MD_PATH);
+        return stripped.length > 0 ? stripped : placeholderMarkdown(input.repoName);
+    }
+    catch {
+        skipped.push(AGENTS_MD_PATH);
+        return placeholderMarkdown(input.repoName);
+    }
+}
+async function ingestSkills(input, files, sources, skipped) {
+    const skills = [];
+    for (const path of files) {
+        const m = SKILL_MD_RE.exec(path);
+        if (!m)
+            continue;
+        const dirName = m[1];
+        try {
+            const content = await input.readFile(path);
+            if (content === null) {
+                skipped.push(path);
+                continue;
+            }
+            const { fm, body } = parseFrontmatter(content);
+            const name = slugify(fm.name || dirName);
+            // Sibling reference files: every other *.md directly under the same skill dir.
+            const refPrefix = `.claude/skills/${dirName}/`;
+            const references = [];
+            for (const refPath of files) {
+                if (refPath === path || !refPath.startsWith(refPrefix) || !refPath.endsWith(".md"))
+                    continue;
+                if (refPath.slice(refPrefix.length).includes("/"))
+                    continue; // one level deep only
+                try {
+                    const refContent = await input.readFile(refPath);
+                    if (refContent === null) {
+                        skipped.push(refPath);
+                        continue;
+                    }
+                    references.push({ name: slugify(refPath.slice(refPrefix.length).replace(/\.md$/, "")), body: refContent });
+                    sources.push(refPath);
+                }
+                catch {
+                    skipped.push(refPath);
+                }
+            }
+            const trimmedBody = body.trim();
+            const candidate = {
+                name,
+                description: (fm.description || `Imported skill ${name}.`).trim(),
+                body: (trimmedBody.length > 0 ? trimmedBody : `Imported skill ${name}.`) + "\n",
+                category: fm.category || "write",
+                ...(references.length > 0 ? { references } : {}),
+            };
+            skills.push(validateSkill(candidate));
+            sources.push(path);
+        }
+        catch {
+            skipped.push(path);
+        }
+    }
+    return skills;
+}
+async function ingestAgents(input, files, sources, skipped) {
+    const agents = [];
+    for (const path of files) {
+        const m = AGENT_MD_RE.exec(path);
+        if (!m)
+            continue;
+        const fileBase = m[1];
+        try {
+            const content = await input.readFile(path);
+            if (content === null) {
+                skipped.push(path);
+                continue;
+            }
+            const { fm, body } = parseFrontmatter(content);
+            const name = slugify(fm.name || fileBase);
+            const tools = fm.tools ? fm.tools.split(",").map((t) => t.trim()).filter(Boolean) : [];
+            const trimmedBody = body.trim();
+            const candidate = {
+                name,
+                description: (fm.description || `Imported agent ${name}.`).trim(),
+                tools,
+                model: fm.model || "sonnet",
+                prompt: trimmedBody.length > 0 ? trimmedBody : `Agent ${name}.`,
+            };
+            agents.push(validateComponent("agent", candidate));
+            sources.push(path);
+        }
+        catch {
+            skipped.push(path);
+        }
+    }
+    return agents;
+}
+async function ingestCommands(input, files, sources, skipped) {
+    const commands = [];
+    for (const path of files) {
+        const m = COMMAND_MD_RE.exec(path);
+        if (!m)
+            continue;
+        const fileBase = m[1];
+        try {
+            const content = await input.readFile(path);
+            if (content === null) {
+                skipped.push(path);
+                continue;
+            }
+            const { fm, body } = parseFrontmatter(content);
+            const name = slugify(fm.name || fileBase);
+            const trimmedBody = body.trim();
+            // PackCommand.prompt must be a single line (validate.ts's line()); a hand-edited command
+            // can have a multi-line body, so collapse it rather than fail the whole file.
+            const prompt = trimmedBody.length > 0 ? trimmedBody.replace(/\s*\n\s*/g, " ").trim() : `Run ${name}.`;
+            const candidate = {
+                name,
+                description: (fm.description || `Imported command ${name}.`).trim(),
+                argument_hint: (fm["argument-hint"] || "[arguments]").trim(),
+                prompt,
+            };
+            commands.push(validateComponent("command", candidate));
+            sources.push(path);
+        }
+        catch {
+            skipped.push(path);
+        }
+    }
+    return commands;
+}
+/** Inverts `command = echo ${JSON.stringify(message)}` (render/claude.ts's settingsJson) back into
+ * the original message. Returns null when `command` doesn't match that exact shape, so it's
+ * classified as a real run-command instead. */
+function decodePrintReminder(command) {
+    if (!command.startsWith("echo "))
+        return null;
+    try {
+        const parsed = JSON.parse(command.slice("echo ".length));
+        return typeof parsed === "string" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function ingestHooks(input, files, sources, skipped) {
+    const hooks = [];
+    if (!files.includes(SETTINGS_JSON_PATH))
+        return hooks;
+    try {
+        const content = await input.readFile(SETTINGS_JSON_PATH);
+        if (content === null) {
+            skipped.push(SETTINGS_JSON_PATH);
+            return hooks;
+        }
+        const parsed = JSON.parse(content);
+        for (const [event, entries] of Object.entries(parsed.hooks ?? {})) {
+            if (!Array.isArray(entries))
+                continue;
+            for (const entry of entries) {
+                const matcher = typeof entry.matcher === "string" ? entry.matcher : "";
+                for (const h of entry.hooks ?? []) {
+                    if (typeof h.command !== "string" || h.command.length === 0)
+                        continue;
+                    const reminder = decodePrintReminder(h.command);
+                    const suffix = matcher ? ` (${matcher})` : "";
+                    const candidate = reminder !== null
+                        ? { event, matcher, description: `Reminder on ${event}${suffix}.`, action: "print-reminder", message: reminder }
+                        : { event, matcher, description: `Runs a command on ${event}${suffix}.`, action: "run-command", command: h.command };
+                    try {
+                        hooks.push(validateComponent("hook", candidate));
+                    }
+                    catch {
+                        // One malformed hook entry doesn't sink the rest of settings.json.
+                    }
+                }
+            }
+        }
+        sources.push(SETTINGS_JSON_PATH);
+    }
+    catch {
+        skipped.push(SETTINGS_JSON_PATH);
+    }
+    return hooks;
+}
+/** Reads an existing repo's rendered harness (AGENTS.md region + .claude/{skills,agents,commands,
+ * settings.json}) back into a validated WorkflowPack — the inverse of renderPack. Every part is
+ * optional; a single bad file is caught and recorded in `skipped`, never aborting the ingest. */
+export async function ingestHarness(input) {
+    const files = await input.listFiles();
+    const sources = [];
+    const skipped = [];
+    const markdown = await ingestContextMarkdown(input, files, sources, skipped);
+    const skills = await ingestSkills(input, files, sources, skipped);
+    const agents = await ingestAgents(input, files, sources, skipped);
+    const commands = await ingestCommands(input, files, sources, skipped);
+    const hooks = await ingestHooks(input, files, sources, skipped);
+    const id = slugify(input.repoName);
+    const candidate = {
+        id,
+        version: "0.1.0",
+        title: `${input.repoName} — ingested harness`,
+        summary: `Ingested from ${input.repoName}'s existing AGENTS.md/.claude harness.`,
+        context: { markdown },
+        ...(skills.length > 0 ? { skills } : {}),
+        agents,
+        commands,
+        hooks,
+    };
+    const pack = validatePack(candidate);
+    return { pack, sources, skipped };
+}

package/dist/load.d.ts

@@ -0,0 +1,7 @@
+import type { WorkflowPack } from "./types.ts";
+/** Absolute path of the packs/ directory shipped inside this package. */
+export declare function builtinPacksDir(): string;
+/** Sorted ids of every shipped pack (directories containing pack.json). */
+export declare function listBuiltinPacks(): Promise<string[]>;
+/** Load one shipped pack by id; resolves retired-id aliases, validates before returning. */
+export declare function loadBuiltinPack(id: string): Promise<WorkflowPack>;

package/dist/load.js

@@ -0,0 +1,29 @@
+import { readdir, readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { join } from "node:path";
+import { validatePack } from "./validate.js";
+import { PACK_ALIASES } from "./aliases.js";
+const SLUG = /^[a-z0-9][a-z0-9-]*$/;
+/** Absolute path of the packs/ directory shipped inside this package. */
+export function builtinPacksDir() {
+    return fileURLToPath(new URL("../packs", import.meta.url));
+}
+/** Sorted ids of every shipped pack (directories containing pack.json). */
+export async function listBuiltinPacks() {
+    const entries = await readdir(builtinPacksDir(), { withFileTypes: true });
+    return entries
+        .filter((e) => e.isDirectory())
+        .map((e) => e.name)
+        .sort();
+}
+/** Load one shipped pack by id; resolves retired-id aliases, validates before returning. */
+export async function loadBuiltinPack(id) {
+    if (!SLUG.test(id))
+        throw new Error(`unknown pack: ${id}`);
+    const target = PACK_ALIASES[id] ?? id;
+    if (!(await listBuiltinPacks()).includes(target)) {
+        throw new Error(`unknown pack: ${id}`);
+    }
+    const raw = await readFile(join(builtinPacksDir(), target, "pack.json"), "utf8");
+    return validatePack(JSON.parse(raw));
+}

package/dist/manifest.d.ts

@@ -0,0 +1,71 @@
+export interface VendoredEntry {
+    path: string;
+    sha256: string | null;
+}
+export interface RegionReceipt {
+    packId: string;
+    version: string;
+    sha256: string;
+}
+export interface ManagedRegionEntry {
+    path: string;
+    regions: RegionReceipt[];
+}
+export interface Resolution {
+    ref: string;
+    sha: string;
+    packId: string;
+}
+/** Capabilities a pack can declare as materialized (centrally computed, then distributed). */
+export declare const KNOWN_CAPABILITIES: readonly ["system-map", "wiki", "graph"];
+export type CapabilityName = (typeof KNOWN_CAPABILITIES)[number];
+/** Receipt for one materialized capability: what it was generated from and what it wrote. */
+export interface CapabilityReceipt {
+    sourceSha: string | null;
+    generatedTs: string;
+    paths: {
+        path: string;
+        sha256: string;
+    }[];
+}
+/** The per-target contract: what a repo/machine uses. Source of truth lives IN the target
+ * (committed root `harness.json`, beside package.json — npm's manifest-as-front-door convention).
+ * Machine manifest stays at `~/.baselane/harness.json`. Exact pins only in v1. */
+export interface HarnessManifest {
+    version: 1;
+    registry: string | null;
+    target: {
+        kind: "repo" | "machine";
+        id: string;
+    };
+    packs: Record<string, string>;
+    capabilities: Record<string, unknown>;
+    materialized: {
+        vendored: VendoredEntry[];
+        managedRegions: ManagedRegionEntry[];
+        derivedCommitted: string[];
+        resolutions: Record<string, Resolution>;
+        capabilities: Record<string, CapabilityReceipt>;
+    };
+}
+export declare const MANIFEST_PATH = "harness.json";
+/** Pre-2026-07-16 repo manifest location. `readManifestWithFallback` (packages/materialize)
+ * reads from here when the root manifest is absent; `install` migrates it forward. */
+export declare const LEGACY_MANIFEST_PATH = ".baselane/harness.json";
+/** Sole authority on what a HarnessManifest is (mirror of validatePack). Returns a NEW
+ * normalized object — absent registry → null, absent capabilities → {}, absent materialized
+ * lists → []. Throws with a reason on anything invalid. Never mutates `raw`. */
+export declare function validateManifest(raw: unknown): HarnessManifest;
+/** Builds the manifest an install writes. If a `receipt` is supplied (hashed vendored files,
+ * managed-region receipts, resolutions), it is used verbatim. Otherwise the receipt half is
+ * derived from the file paths the materializer produced — entry files become managedRegions,
+ * everything else vendored (sorted, deterministic), null hashes, no resolutions — this is the
+ * S1 behavior, kept unchanged for callers that don't pass a receipt (e.g. install-job.ts). */
+export declare function buildManifest(input: {
+    target: HarnessManifest["target"];
+    packs: Record<string, string>;
+    registry?: string | null;
+    capabilities?: Record<string, unknown>;
+    materializedPaths?: string[];
+    receipt?: HarnessManifest["materialized"];
+}): HarnessManifest;

package/dist/manifest.js

@@ -0,0 +1,208 @@
+// packages/packs/src/manifest.ts
+import { isEntryFile } from "./merge-region.js";
+/** Capabilities a pack can declare as materialized (centrally computed, then distributed). */
+export const KNOWN_CAPABILITIES = ["system-map", "wiki", "graph"];
+export const MANIFEST_PATH = "harness.json";
+/** Pre-2026-07-16 repo manifest location. `readManifestWithFallback` (packages/materialize)
+ * reads from here when the root manifest is absent; `install` migrates it forward. */
+export const LEGACY_MANIFEST_PATH = ".baselane/harness.json";
+function fail(msg) {
+    throw new Error(`invalid manifest: ${msg}`);
+}
+function strList(v, label) {
+    if (v === undefined)
+        return [];
+    if (!Array.isArray(v) || !v.every((x) => typeof x === "string" && x.length > 0))
+        fail(`${label} must be a list of non-empty strings`);
+    return [...v];
+}
+function nonEmpty(v, label) {
+    if (typeof v !== "string" || v.length === 0)
+        fail(`${label} must be a non-empty string`);
+    return v;
+}
+/** Accepts the S1 legacy shape (string) and the v2 shape ({path, sha256}). */
+function vendoredList(v) {
+    if (v === undefined)
+        return [];
+    if (!Array.isArray(v))
+        fail("materialized.vendored must be a list");
+    return v.map((e) => {
+        if (typeof e === "string") {
+            if (e.length === 0)
+                fail("materialized.vendored paths must be non-empty");
+            return { path: e, sha256: null };
+        }
+        if (e === null || typeof e !== "object")
+            fail("materialized.vendored entries must be strings or {path, sha256}");
+        const o = e;
+        const path = nonEmpty(o.path, "materialized.vendored path");
+        if (o.sha256 !== null && typeof o.sha256 !== "string")
+            fail("materialized.vendored sha256 must be a string or null");
+        return { path, sha256: o.sha256 ?? null };
+    });
+}
+/** Accepts the S1 legacy shape (string) and the v2 shape ({path, regions}). */
+function managedRegionList(v) {
+    if (v === undefined)
+        return [];
+    if (!Array.isArray(v))
+        fail("materialized.managedRegions must be a list");
+    return v.map((e) => {
+        if (typeof e === "string") {
+            if (e.length === 0)
+                fail("materialized.managedRegions paths must be non-empty");
+            return { path: e, regions: [] };
+        }
+        if (e === null || typeof e !== "object")
+            fail("materialized.managedRegions entries must be strings or {path, regions}");
+        const o = e;
+        const path = nonEmpty(o.path, "materialized.managedRegions path");
+        const regionsRaw = o.regions === undefined ? [] : o.regions;
+        if (!Array.isArray(regionsRaw))
+            fail("materialized.managedRegions regions must be a list");
+        const regions = regionsRaw.map((r) => {
+            if (r === null || typeof r !== "object")
+                fail("materialized.managedRegions region must be an object");
+            const ro = r;
+            return {
+                packId: nonEmpty(ro.packId, "managedRegions region packId"),
+                version: nonEmpty(ro.version, "managedRegions region version"),
+                sha256: nonEmpty(ro.sha256, "managedRegions region sha256"),
+            };
+        });
+        return { path, regions };
+    });
+}
+function resolutionMap(v) {
+    if (v === undefined)
+        return {};
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        fail("materialized.resolutions must be an object");
+    const out = {};
+    for (const [name, raw] of Object.entries(v)) {
+        if (raw === null || typeof raw !== "object")
+            fail(`resolutions["${name}"] must be an object`);
+        const o = raw;
+        out[name] = {
+            ref: nonEmpty(o.ref, `resolutions["${name}"].ref`),
+            sha: nonEmpty(o.sha, `resolutions["${name}"].sha`),
+            packId: nonEmpty(o.packId, `resolutions["${name}"].packId`),
+        };
+    }
+    return out;
+}
+function capabilityReceiptMap(v) {
+    if (v === undefined)
+        return {};
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        fail("materialized.capabilities must be an object");
+    const out = {};
+    for (const [name, raw] of Object.entries(v)) {
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+            fail(`materialized.capabilities["${name}"] must be an object`);
+        const o = raw;
+        if (o.sourceSha !== null && typeof o.sourceSha !== "string")
+            fail(`materialized.capabilities["${name}"].sourceSha must be a string or null`);
+        const generatedTs = nonEmpty(o.generatedTs, `materialized.capabilities["${name}"].generatedTs`);
+        if (!Array.isArray(o.paths))
+            fail(`materialized.capabilities["${name}"].paths must be a list`);
+        const paths = o.paths.map((p, i) => {
+            if (p === null || typeof p !== "object")
+                fail(`materialized.capabilities["${name}"].paths[${i}] must be an object`);
+            const po = p;
+            return {
+                path: nonEmpty(po.path, `materialized.capabilities["${name}"].paths[${i}].path`),
+                sha256: nonEmpty(po.sha256, `materialized.capabilities["${name}"].paths[${i}].sha256`),
+            };
+        });
+        out[name] = { sourceSha: o.sourceSha ?? null, generatedTs, paths };
+    }
+    return out;
+}
+/** Sole authority on what a HarnessManifest is (mirror of validatePack). Returns a NEW
+ * normalized object — absent registry → null, absent capabilities → {}, absent materialized
+ * lists → []. Throws with a reason on anything invalid. Never mutates `raw`. */
+export function validateManifest(raw) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        fail("manifest must be an object");
+    const o = raw;
+    if (o.version !== 1)
+        fail(`unsupported version ${JSON.stringify(o.version)} (expected 1)`);
+    if (o.registry !== undefined && o.registry !== null && typeof o.registry !== "string")
+        fail("registry must be a string or null");
+    const t = o.target;
+    if (t === null || typeof t !== "object")
+        fail("target must be an object");
+    const target = t;
+    if (target.kind !== "repo" && target.kind !== "machine")
+        fail(`target.kind must be "repo" or "machine"`);
+    if (typeof target.id !== "string" || target.id.length === 0)
+        fail("target.id must be a non-empty string");
+    if (o.packs === null || typeof o.packs !== "object" || Array.isArray(o.packs))
+        fail("packs must be an object");
+    const packs = {};
+    for (const [name, pin] of Object.entries(o.packs)) {
+        if (name.length === 0)
+            fail("pack name must be non-empty");
+        if (typeof pin !== "string" || pin.length === 0)
+            fail(`pack "${name}" pin must be a non-empty string (exact pins only)`);
+        packs[name] = pin;
+    }
+    let capabilities = {};
+    if (o.capabilities !== undefined) {
+        if (o.capabilities === null || typeof o.capabilities !== "object" || Array.isArray(o.capabilities))
+            fail("capabilities must be an object");
+        try {
+            capabilities = structuredClone(o.capabilities);
+        }
+        catch {
+            fail("capabilities must be JSON-serializable");
+        }
+    }
+    let vendored = [], managedRegions = [], derivedCommitted = [];
+    let resolutions = {};
+    let materializedCapabilities = {};
+    if (o.materialized !== undefined) {
+        if (o.materialized === null || typeof o.materialized !== "object")
+            fail("materialized must be an object");
+        const m = o.materialized;
+        vendored = vendoredList(m.vendored);
+        managedRegions = managedRegionList(m.managedRegions);
+        derivedCommitted = strList(m.derivedCommitted, "materialized.derivedCommitted");
+        resolutions = resolutionMap(m.resolutions);
+        materializedCapabilities = capabilityReceiptMap(m.capabilities);
+    }
+    return {
+        version: 1,
+        registry: o.registry ?? null,
+        target: { kind: target.kind, id: target.id },
+        packs,
+        capabilities,
+        materialized: { vendored, managedRegions, derivedCommitted, resolutions, capabilities: materializedCapabilities },
+    };
+}
+/** Builds the manifest an install writes. If a `receipt` is supplied (hashed vendored files,
+ * managed-region receipts, resolutions), it is used verbatim. Otherwise the receipt half is
+ * derived from the file paths the materializer produced — entry files become managedRegions,
+ * everything else vendored (sorted, deterministic), null hashes, no resolutions — this is the
+ * S1 behavior, kept unchanged for callers that don't pass a receipt (e.g. install-job.ts). */
+export function buildManifest(input) {
+    const paths = [...(input.materializedPaths ?? [])].sort((a, b) => a.localeCompare(b));
+    const materialized = input.receipt ??
+        {
+            vendored: paths.filter((p) => !isEntryFile(p)).map((p) => ({ path: p, sha256: null })),
+            managedRegions: paths.filter((p) => isEntryFile(p)).map((p) => ({ path: p, regions: [] })),
+            derivedCommitted: [],
+            resolutions: {},
+            capabilities: {},
+        };
+    return validateManifest({
+        version: 1,
+        registry: input.registry ?? null,
+        target: input.target,
+        packs: input.packs,
+        capabilities: input.capabilities ?? {},
+        materialized,
+    });
+}