@detergent-software/atk 8.9.0-dev.3 → 8.9.0-dev.30

package/build/lib/publish-flow.js

@@ -1,17 +1,17 @@
 import { writeFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
+import { compare as semverCompare, valid as semverValid } from 'semver';
 import { loadAllAdapters, resolveInstalledPaths } from './adapter.js';
 import { isApiError } from './api-client.js';
 import { getCredential } from './auth.js';
-import { hashFile } from './checksum.js';
 import { errorGuidance, errorMessage } from './errors.js';
-import { detectCompatibleTools, getSignedInUserName } from './init.js';
-import { addAssetToLockfile, findInstalledAsset, readLockfile, withLockfileLock, writeLockfile } from './lockfile.js';
+import { detectCompatibleTools, getEntrypointName, getSignedInUserName } from './init.js';
+import { findInstalledAsset, readLockfile } from './lockfile.js';
 import { diffManifests, fetchExistingManifest } from './manifest-diff.js';
 import { parseOrgFromName } from './org.js';
 import { findProjectRoot } from './paths.js';
-import { buildPublishPlan, buildStagingArea, checkRegistryVersion, detectAssetFromPath, detectPublishType, executePublish, findSiblingDependencies, loadPublishBatch, loadPublishEntries, mapPublishError, missingDependencies, resolvePlanDependencies, unknownToolsError, updateManifestField, updateManifestVersion, validatePublishTarget, } from './publisher.js';
-import { clearCache, fetchAssetManifest, fetchRegistry, findAsset, findBundle } from './registry.js';
+import { buildPublishPlan, buildStagingArea, bumpVersion, checkRegistryVersion, detectAssetFromPath, detectPublishType, executePublish, filledManifestFields, findSiblingDependencies, isOrgScopedTarget, loadPublishBatch, loadPublishEntries, mapPublishError, missingDependencies, readManifestFile, resolvePlanDependencies, unknownToolsError, updateManifestField, updateManifestVersion, validatePublishTarget, } from './publisher.js';
+import { clearCache, fetchAssetFileBytes, fetchAssetReadme, fetchRegistry, findAsset } from './registry.js';
 import { parseReviewersInput, validateGithubUsername } from './reviewers.js';
 import { stageInstalledFiles } from './staging.js';
 import { resolveTools } from './tool-resolver.js';
@@ -63,7 +63,6 @@ export function createInitialState(flags) {
         target: undefined,
         token: undefined,
         toolAdapters: [],
-        toolCursorIndex: 0,
         toolsDetected: [],
         validation: undefined,
         versionCheck: undefined,
@@ -163,6 +162,64 @@ async function firstFailure(edits) {
     }
     return undefined;
 }
+/**
+ * The metadata step of a raw publish, for a raw folder or an installed asset, whose `source`
+ * gives its org and any description of its own: the signed-in author, the description from
+ * --description or the source, the tags from --tags, and the tools from --tools or detection.
+ * An interactive run goes on to ask for what is missing; a non-interactive one stages the
+ * manifest now, or fails without a description or tools.
+ */
+async function gatherRawMetadata(state, ctx, detection, source) {
+    const [signedIn, tools] = await Promise.all([
+        getSignedInUserName(),
+        state.flags.toolsFlag ? splitList(state.flags.toolsFlag) : detectCompatibleTools(detection.assetType),
+    ]);
+    if (ctx.cancelled())
+        return;
+    const author = signedIn ?? '';
+    const description = state.flags.descriptionFlag?.trim() || source.description;
+    if (!state.nonInteractive) {
+        ctx.dispatch({
+            authorValue: author,
+            ...(description ? { description } : {}),
+            orgValue: source.org ?? '',
+            rawDetection: detection,
+            toolsDetected: tools,
+            type: 'RAW_DETECT_DONE',
+        });
+        return;
+    }
+    if (!description) {
+        ctx.dispatch({
+            message: state.flags.fromInstalled
+                ? `description required: provide --description (the lockfile has none for '${detection.name}')`
+                : 'description required: provide --description or include in manifest.json',
+            type: 'ERROR',
+        });
+        return;
+    }
+    if (tools.length === 0) {
+        ctx.dispatch({
+            message: `--tools <comma-separated> required: no tools detected for type ${detection.assetType}`,
+            type: 'ERROR',
+        });
+        return;
+    }
+    const stagingDir = await buildStagingArea(detection, {
+        author,
+        description,
+        ...(source.org ? { org: source.org } : {}),
+        tags: splitList(state.flags.tagsFlag),
+        tools,
+    });
+    ctx.stage(stagingDir);
+    if (ctx.cancelled())
+        return;
+    const detected = await detectPublishType(stagingDir);
+    if (ctx.cancelled())
+        return;
+    ctx.dispatch({ rawDetection: detection, target: detected, type: 'RAW_DETECT_DONE_NON_INTERACTIVE' });
+}
 function stepFor(state) {
     switch (state.phase) {
         case 'building-plan':
@@ -175,8 +232,6 @@ function stepFor(state) {
             return detecting;
         case 'gathering-metadata':
             return state.metadataSubPhase === 'building-staging' ? buildingStaging : undefined;
-        case 'installing':
-            return installing;
         case 'loading-tools':
             return loadingTools;
         case 'publishing':
@@ -229,10 +284,10 @@ function toErrorAction(err, override) {
 }
 /**
  * Write what the run changed in memory to the manifests on disk: the root's bump and each
- * entry's, and the tags and tools the prompts asked for. Only once the publish has opened its
- * PR, so a cancelled or failed one leaves every manifest as it was. A file whose write fails
- * takes none of its later edits and comes back as one warning naming the fields it lacks; the
- * other files are still written.
+ * entry's, and the tags and tools the publish sent on top of the root's manifest (from flags,
+ * prompts or detection). Only once the publish has opened its PR, so a cancelled or failed one
+ * leaves every manifest as it was. A file whose write fails takes none of its later edits and
+ * comes back as one warning naming the fields it lacks; the other files are still written.
  */
 async function writeManifestEdits(state) {
     const target = state.target;
@@ -244,19 +299,14 @@ async function writeManifestEdits(state) {
         files.set(path, [...(files.get(path) ?? []), { field, value, write }]);
     };
     const version = (dir, file, value) => edit(dir, file, 'version', value, () => updateManifestVersion(dir, file, value));
-    const field = (name, value) => edit(target.sourceDir, 'manifest.json', name, value, () => updateManifestField(target.sourceDir, 'manifest.json', name, value));
+    const manifestFile = target.type === 'asset' ? 'manifest.json' : 'bundle.json';
     if (state.versionCheck?.status === 'needs-bump' && state.resolvedVersion) {
-        version(target.sourceDir, target.type === 'asset' ? 'manifest.json' : 'bundle.json', state.resolvedVersion);
+        version(target.sourceDir, manifestFile, state.resolvedVersion);
     }
-    // Only an asset's manifest.json takes the prompted tags and tools, as the target (and so the plan) has them.
-    if (target.type === 'asset') {
-        const { tags, tools } = target.data;
-        if (state.promptTagsValue && tags && tags.length > 0) {
-            field('tags', tags);
-        }
-        if (state.selectedPromptTools.length > 0) {
-            field('tools', tools);
-        }
+    // A manifest that can't be read now takes no field edits; its version edit, if any, warns.
+    const written = await readManifestFile(target).catch(() => undefined);
+    for (const [name, value] of Object.entries(written ? filledManifestFields(written, target) : {})) {
+        edit(target.sourceDir, manifestFile, name, value, () => updateManifestField(target.sourceDir, manifestFile, name, value));
     }
     for (const entry of state.entries) {
         if (entry.versionCheck?.status === 'needs-bump' && entry.resolvedVersion) {
@@ -269,7 +319,7 @@ async function writeManifestEdits(state) {
         if (!failed)
             continue;
         const missing = edits.slice(failed.index);
-        // Only the version matters to the next publish: it asks for missing tags and tools again.
+        // Only the version matters to the next publish: it fills missing tags and tools again.
         const again = missing.some((e) => e.field === 'version') ? ' before you publish it again' : '';
         unwritten.push(`The PR is open, but ${path} wasn't updated (${errorMessage(failed.error)}): set ${missing.map((e) => `"${e.field}" to ${JSON.stringify(e.value)}`).join(', ')}${again}.`);
     }
@@ -278,29 +328,45 @@ async function writeManifestEdits(state) {
 // ---------------------------------------------------------------------------
 // Steps, one per phase that waits on work
 // ---------------------------------------------------------------------------
+/**
+ * The installed asset's files, at their source paths, through a raw publish's metadata step,
+ * with the version, entrypoint, dependencies, org and description its lockfile entry records.
+ */
 const resolvingInstalled = {
     async run(state, ctx) {
         const source = await findInstalledSource(state, ctx);
         if (!source)
             return;
         const { adapter, installed, projectRoot } = source;
-        // Copy the installed files into a temp directory, preserving their source paths
-        const tempDir = await stageInstalledFiles(installed, adapter, projectRoot);
-        ctx.stage(tempDir);
-        if (ctx.cancelled())
-            return;
-        // Generate manifest.json in the temp dir
-        const manifest = {
-            author: 'unknown',
-            description: `Published from installed asset ${installed.name}`,
-            entrypoint: installed.files[0]?.sourcePath ?? 'index.md',
+        const { files } = resolveInstalledPaths(installed, adapter, projectRoot);
+        // An older lockfile entry has no entrypoint: the type's usual one when it was installed, else its first file.
+        const usual = getEntrypointName(installed.type, installed.name);
+        const entrypoint = installed.entrypoint ?? (files.some((file) => file.sourcePath === usual) ? usual : files[0]?.sourcePath);
+        const dependencies = (installed.dependencies ?? []).map(({ name, type, version }) => ({
+            name,
+            type,
+            ...(version ? { version } : {}),
+        }));
+        const detection = {
+            assetType: installed.type,
+            ...(dependencies.length > 0 ? { dependencies } : {}),
+            ...(entrypoint ? { entrypoint } : {}),
+            files: files.map((file) => ({
+                absolutePath: join(projectRoot, file.installedPath),
+                relativePath: file.sourcePath,
+            })),
             name: installed.name,
-            ...(installed.org ? { org: installed.org } : {}),
-            type: installed.type,
+            sourceDir: projectRoot,
             version: installed.version,
         };
-        await writeFile(join(tempDir, 'manifest.json'), JSON.stringify(manifest, null, 2) + '\n', 'utf-8');
-        ctx.dispatch({ resolvedPath: tempDir, type: 'RESOLVED_INSTALLED' });
+        // A --with folder that is missing, a bundle or a repeat fails here, before any prompt, as in detecting.
+        if (state.flags.withPaths?.length) {
+            const entries = await loadPublishEntries(state.flags.withPaths, projectRoot);
+            if (ctx.cancelled())
+                return;
+            ctx.dispatch({ entries, type: 'ENTRIES_LOADED' });
+        }
+        await gatherRawMetadata(state, ctx, detection, { description: installed.description, org: installed.org });
     },
 };
 const resolvingUpdate = {
@@ -310,21 +376,35 @@ const resolvingUpdate = {
             return;
         const { adapter, installed, org, projectRoot } = source;
         const assetName = state.flags.rawPath;
-        // Fetch the registry to find the latest version
+        // Fetch the registry to find the latest version. An installed entry is always an asset.
         const registry = await fetchRegistry({ force: state.flags.refresh });
         if (ctx.cancelled())
             return;
-        // Look up the asset in the registry: try findAsset first, then findBundle
         const resolvedAsset = findAsset(registry, installed.name, installed.type, undefined, installed.org ?? org);
-        const resolvedBundle = resolvedAsset ? undefined : findBundle(registry, installed.name, installed.org ?? org);
-        if (!resolvedAsset && !resolvedBundle) {
+        if (!resolvedAsset) {
             ctx.dispatch({ message: `Asset '${assetName}' not found in the registry.`, type: 'ERROR' });
             return;
         }
-        const latestVersion = resolvedAsset ? resolvedAsset.version : resolvedBundle.version;
-        const assetType = resolvedAsset ? resolvedAsset.asset.type : 'bundle';
-        // Fetch the authoritative manifest (and optional README) from the registry
-        const fetched = await fetchAssetManifest({ name: installed.name, org: installed.org ?? org, type: assetType }, latestVersion);
+        // The installed files go out on top of the latest's manifest, so they must not be older
+        // than it: they would publish the next version without the changes made since.
+        const latestVersion = resolvedAsset.version;
+        if (!semverValid(installed.version) || semverCompare(installed.version, latestVersion) < 0) {
+            ctx.dispatch({
+                command: `atk diff ${assetName}`,
+                hint: `See what changed since v${installed.version} with \`atk diff ${assetName}\`, get the latest into a folder with \`atk checkout ${assetName}\`, carry your edits into it, and publish that folder.`,
+                message: `'${assetName}' is installed at v${installed.version}, but the registry's latest is v${latestVersion}. --update would publish your copy, built on v${installed.version}, as the next version and undo the changes made since.`,
+                type: 'ERROR',
+            });
+            return;
+        }
+        // The latest's manifest as the registry has it, byte for byte, so a field this CLI's schema
+        // doesn't know (from a newer publisher) is published again; and its README, if any.
+        const { org: assetOrg, type } = resolvedAsset.asset;
+        const ref = { name: installed.name, ...(assetOrg ? { org: assetOrg } : {}), type };
+        const [manifest, readme] = await Promise.all([
+            fetchAssetFileBytes(ref, latestVersion, 'manifest.json'),
+            fetchAssetReadme(ref, latestVersion),
+        ]);
         if (ctx.cancelled())
             return;
         // Copy the user's locally modified files into a temp staging directory
@@ -332,13 +412,9 @@ const resolvingUpdate = {
         ctx.stage(tempDir);
         if (ctx.cancelled())
             return;
-        // Write the fetched manifest into the staging directory. It is the manifest as this
-        // CLI's schema parsed it: a field the schema does not know (from a newer publisher)
-        // is dropped here and so is missing from the re-published version.
-        await writeFile(join(tempDir, fetched.manifestFileName), fetched.manifestContent, 'utf-8');
-        // Write README if present
-        if (fetched.readmeContent) {
-            await writeFile(join(tempDir, 'README.md'), fetched.readmeContent, 'utf-8');
+        await writeFile(join(tempDir, 'manifest.json'), manifest);
+        if (readme) {
+            await writeFile(join(tempDir, 'README.md'), readme, 'utf-8');
         }
         ctx.dispatch({ resolvedPath: tempDir, type: 'RESOLVED_UPDATE' });
     },
@@ -389,66 +465,11 @@ const detecting = {
         const detection = await detectAssetFromPath(state.resolvedPath, adapter, projectRoot);
         if (ctx.cancelled())
             return;
-        // Pre-fill metadata
-        const author = (await getSignedInUserName()) ?? '';
-        if (ctx.cancelled())
-            return;
+        // No manifest exists yet, so the project's org and the flags and prompts give the metadata.
         const lockfile = await readLockfile(projectRoot);
         if (ctx.cancelled())
             return;
-        const tools = await detectCompatibleTools(detection.assetType);
-        if (ctx.cancelled())
-            return;
-        // Non-interactive mode (raw publish — no manifest exists yet, so the only
-        // sources for description are --description flag or exit-1; tags come from
-        // --tags or default to empty). Tool detection runs for both modes above.
-        if (!state.nonInteractive) {
-            // Interactive mode — gather metadata from the user
-            ctx.dispatch({
-                authorValue: author,
-                orgValue: lockfile.org ?? '',
-                rawDetection: detection,
-                toolsDetected: tools,
-                type: 'RAW_DETECT_DONE',
-            });
-            return;
-        }
-        if (!state.flags.descriptionFlag) {
-            ctx.dispatch({
-                message: 'description required: provide --description or include in manifest.json',
-                type: 'ERROR',
-            });
-            return;
-        }
-        // Tools resolution: --tools flag -> detected (already populated above)
-        let toolsList;
-        if (state.flags.toolsFlag) {
-            toolsList = splitList(state.flags.toolsFlag);
-        }
-        else if (tools.length > 0) {
-            toolsList = tools;
-        }
-        else {
-            ctx.dispatch({
-                message: `--tools <comma-separated> required: no tools detected for type ${detection.assetType}`,
-                type: 'ERROR',
-            });
-            return;
-        }
-        const stagingDir = await buildStagingArea(detection, {
-            author,
-            description: state.flags.descriptionFlag,
-            ...(lockfile.org ? { org: lockfile.org } : {}),
-            tags: splitList(state.flags.tagsFlag),
-            tools: toolsList,
-        });
-        ctx.stage(stagingDir);
-        if (ctx.cancelled())
-            return;
-        const detected = await detectPublishType(stagingDir);
-        if (ctx.cancelled())
-            return;
-        ctx.dispatch({ rawDetection: detection, target: detected, type: 'RAW_DETECT_DONE_NON_INTERACTIVE' });
+        await gatherRawMetadata(state, ctx, detection, { org: lockfile.org });
     },
 };
 /** The `building-staging` sub-phase of `gathering-metadata`: the manifest from the prompts' answers. */
@@ -529,14 +550,13 @@ const validating = {
     },
 };
 /**
- * In interactive mode, loads adapters for the multi-select prompt. In non-interactive
- * mode, resolves tools via manifest -> --tools flag -> detectCompatibleTools(assetType)
- * -> exit 1, then dispatches RESOLVE_TOOLS_NONINTERACTIVE to advance directly to
- * checking-registry.
+ * In interactive mode without --tools, loads adapters for the multi-select prompt. Otherwise
+ * resolves tools via manifest -> --tools flag -> detectCompatibleTools(assetType) -> exit 1,
+ * then dispatches RESOLVE_TOOLS_NONINTERACTIVE to advance past the prompt.
  */
 const loadingTools = {
     async run(state, ctx) {
-        if (!state.nonInteractive) {
+        if (!state.nonInteractive && !state.flags.toolsFlag) {
             const adapters = await loadAllAdapters();
             if (ctx.cancelled())
                 return;
@@ -690,8 +710,8 @@ const buildingPlan = {
         const localPlan = await buildPublishPlan(currentTarget, currentVersion, state.isUpdate, state.flags.message, reviewers, entries, ...(isBatch(state.flags) ? [state.flags.rawPath] : []));
         if (ctx.cancelled())
             return;
-        // Resolve declared dependencies against the registry now, so the preview and
-        // --dry-run show them and an unresolvable one stops before the confirm prompt.
+        // Ask the API for its plan now, so the preview and --dry-run show its dependencies
+        // and reviewers, and anything it rejects stops before the confirm prompt.
         const publishPlan = await resolvePlanDependencies(localPlan);
         if (ctx.cancelled())
             return;
@@ -728,75 +748,511 @@ const publishing = {
         catch {
             // Best-effort — don't fail publish over cache
         }
-        // Update lockfile in-place when publishing from an installed asset
-        if (state.flags.fromInstalled || state.flags.update) {
-            try {
-                const projectRoot = findProjectRoot(state.flags.projectRoot);
-                const pubTools = await resolveTools(state.flags.tool);
-                const pubAdapter = pubTools[0].adapter;
-                await withLockfileLock(projectRoot, async () => {
-                    const lockfile = await readLockfile(projectRoot);
-                    const { name, org } = parseOrgFromName(state.flags.rawPath);
-                    const installed = findInstalledAsset(lockfile, name, undefined, org);
-                    if (installed) {
-                        const resolved = resolveInstalledPaths(installed, pubAdapter, projectRoot);
-                        const updatedFiles = await Promise.all(resolved.files.map(async (file) => ({
-                            checksum: await hashFile(join(projectRoot, file.installedPath)),
-                            sourcePath: file.sourcePath,
-                        })));
-                        const updatedLockfile = addAssetToLockfile(lockfile, {
-                            ...installed,
-                            files: updatedFiles,
-                            version: state.resolvedVersion,
-                        });
-                        await writeLockfile(projectRoot, updatedLockfile);
+        // The lockfile is left as it was, even for an installed asset or a raw folder: the registry
+        // has the new version only once the PR merges, and a fresh clone installs the version the
+        // lockfile names (ATK-592). `atk update` (or `atk install`) records it after the merge.
+        if (ctx.cancelled())
+            return;
+        ctx.dispatch({ result, type: 'PUBLISH_DONE' });
+    },
+};
+// ---------------------------------------------------------------------------
+// Reducer
+// ---------------------------------------------------------------------------
+export function publishReducer(state, action) {
+    switch (action.type) {
+        case 'BUMP_DONE': {
+            const bumped = {
+                ...state,
+                errorMessage: action.message ? action.message : state.errorMessage,
+                resolvedVersion: action.version,
+                target: action.updatedTarget,
+            };
+            return action.message ? { ...bumped, phase: 'error' } : advanceToPlan(bumped);
+        }
+        case 'CONFIRM_PROMPT_TOOLS': {
+            if (action.tools.length === 0)
+                return state;
+            const updatedToolsTarget = state.target
+                ? {
+                    ...state.target,
+                    data: { ...state.target.data, tools: action.tools },
+                }
+                : undefined;
+            return {
+                ...state,
+                phase: phaseAfterMetadata(updatedToolsTarget),
+                selectedPromptTools: action.tools,
+                target: updatedToolsTarget,
+            };
+        }
+        case 'DETECT_DONE':
+            if (action.target.type === 'bundle' && state.entries.length > 0) {
+                return {
+                    ...state,
+                    errorMessage: 'A bundle is published on its own. Remove --with, and publish its new assets first.',
+                    phase: 'error',
+                    target: action.target,
+                };
+            }
+            return {
+                ...state,
+                phase: 'validating',
+                target: action.target,
+            };
+        case 'ENTRIES_CHECKED':
+            return advanceToPlan({ ...state, entries: action.entries });
+        case 'ENTRIES_LOADED':
+            return { ...state, entries: action.entries };
+        case 'ERROR':
+            return {
+                ...state,
+                errorCode: action.code,
+                errorCommand: action.command,
+                errorHint: action.hint,
+                errorMessage: action.message,
+                phase: 'error',
+            };
+        case 'PLAN_DONE': {
+            // dry-run always shows the dry-run result; --yes / non-TTY skip the confirm prompt
+            // and proceed directly to publishing.
+            let nextPhase;
+            if (state.flags.dryRun) {
+                nextPhase = 'dry-run-result';
+            }
+            else if (state.nonInteractive) {
+                nextPhase = 'publishing';
+            }
+            else {
+                nextPhase = 'confirm-publish';
+            }
+            return {
+                ...state,
+                manifestDiff: action.manifestDiff,
+                phase: nextPhase,
+                plan: action.plan,
+            };
+        }
+        case 'PUBLISH_DONE':
+            return { ...state, phase: 'done', publishResult: action.result };
+        case 'PUBLISH_PROGRESS':
+            return { ...state, progressMessage: action.message };
+        case 'RAW_DETECT_DONE':
+            // Ask only for what neither a flag nor the installed asset gave.
+            return {
+                ...state,
+                authorValue: action.authorValue,
+                descriptionValue: action.description ?? '',
+                isRawPublish: !state.flags.fromInstalled,
+                metadataSubPhase: action.description === undefined ? 'description' : metadataAfterDescription(state),
+                orgValue: action.orgValue,
+                phase: 'gathering-metadata',
+                rawDetection: action.rawDetection,
+                tagsValue: state.flags.tagsFlag ?? '',
+                toolsDetected: action.toolsDetected,
+            };
+        case 'RAW_DETECT_DONE_NON_INTERACTIVE':
+            return {
+                ...state,
+                isRawPublish: !state.flags.fromInstalled,
+                phase: 'validating',
+                rawDetection: action.rawDetection,
+                target: action.target,
+            };
+        case 'REGISTRY_CHECK_DONE': {
+            const { isUpdate, resolvedVersion, token, versionCheck } = action;
+            let nextPhase;
+            let errorMessage = state.errorMessage;
+            let bumpedVersion = resolvedVersion;
+            let bumpedTarget = state.target;
+            if (versionCheck.status === 'new-asset') {
+                nextPhase = 'building-plan';
+            }
+            else if (versionCheck.status === 'version-already-bumped') {
+                // --yes / non-TTY implicitly confirm the update
+                nextPhase = state.nonInteractive ? 'building-plan' : 'confirm-update';
+            }
+            else {
+                // needs-bump
+                if (state.flags.bump && state.target) {
+                    // --bump applies in any run; a successful publish writes it to the manifest
+                    try {
+                        bumpedVersion = bumpVersion(versionCheck.latestVersion, state.flags.bump);
+                        bumpedTarget = {
+                            ...state.target,
+                            data: { ...state.target.data, version: bumpedVersion },
+                        };
+                        nextPhase = 'building-plan';
+                    }
+                    catch {
+                        errorMessage = 'Failed to compute bumped version.';
+                        nextPhase = 'error';
                     }
+                }
+                else if (!state.nonInteractive) {
+                    nextPhase = 'bump-prompt';
+                }
+                else if (isBatch(state.flags)) {
+                    // advanceToPlan lists every asset of the batch that needs --bump, once the entries are checked.
+                    nextPhase = 'building-plan';
+                }
+                else {
+                    errorMessage = `--bump <patch|minor|major> required: registry has v${versionCheck.latestVersion} but manifest is not newer`;
+                    nextPhase = 'error';
+                }
+            }
+            const checked = {
+                ...state,
+                errorMessage,
+                isUpdate,
+                phase: nextPhase,
+                resolvedVersion: bumpedVersion,
+                target: bumpedTarget,
+                token,
+                versionCheck,
+            };
+            return nextPhase === 'building-plan' ? advanceToPlan(checked) : checked;
+        }
+        case 'RESOLVE_TOOLS_NONINTERACTIVE': {
+            const updatedTarget = state.target
+                ? {
+                    ...state.target,
+                    data: { ...state.target.data, tools: action.tools },
+                }
+                : undefined;
+            return {
+                ...state,
+                // An interactive run's --tools stood in for the tools prompt; the reviewer prompt may still follow.
+                phase: state.nonInteractive ? 'checking-registry' : phaseAfterMetadata(updatedTarget),
+                target: updatedTarget,
+            };
+        }
+        case 'RESOLVED_UPDATE':
+            return {
+                ...state,
+                phase: 'detecting',
+                resolvedPath: action.resolvedPath,
+            };
+        case 'SET_BUMP_SELECTION':
+            return { ...state, bumpSelection: action.value };
+        case 'SET_CONFIRM_VALUE':
+            return { ...state, confirmValue: action.value };
+        case 'SET_DESCRIPTION':
+            return { ...state, descriptionValue: action.value };
+        case 'SET_PROMPT_TAGS':
+            return { ...state, promptTagsValue: action.value };
+        case 'SET_PUBLISH_CONFIRM_VALUE':
+            return { ...state, publishConfirmValue: action.value };
+        case 'SET_REVIEWER':
+            return { ...state, reviewerValue: action.value };
+        case 'SET_TAGS':
+            return { ...state, tagsValue: action.value };
+        case 'SET_WITH_CONFIRM_VALUE':
+            return { ...state, withConfirmValue: action.value };
+        case 'STAGING_DONE':
+            return {
+                ...state,
+                phase: 'validating',
+                target: action.target,
+            };
+        case 'SUBMIT_BUMP': {
+            const trimmed = state.bumpSelection.trim().toLowerCase();
+            if (trimmed !== 'patch' && trimmed !== 'minor' && trimmed !== 'major') {
+                return state; // Ignore invalid input
+            }
+            // The prompt is for an entry: bump it, then on to the next pending bump or the plan.
+            if (state.bumpEntry !== undefined) {
+                const entry = state.entries[state.bumpEntry];
+                if (entry?.versionCheck?.status !== 'needs-bump')
+                    return state;
+                return bumpEntryAt({ ...state, bumpSelection: '' }, state.bumpEntry, trimmed);
+            }
+            if (!state.target || !state.versionCheck || state.versionCheck.status !== 'needs-bump') {
+                return state;
+            }
+            // Compute the bumped version in the reducer (pure, synchronous)
+            const bumpType = trimmed;
+            try {
+                const newVersion = bumpVersion(state.versionCheck.latestVersion, bumpType);
+                // The bump is only on the target until the publish succeeds, which writes it to
+                // the manifest; entries still to check or bump come first.
+                return advanceToPlan({
+                    ...state,
+                    bumpSelection: '',
+                    resolvedVersion: newVersion,
+                    target: { ...state.target, data: { ...state.target.data, version: newVersion } },
                 });
             }
             catch {
-                // Best-effort — don't fail publish over lockfile update
+                return {
+                    ...state,
+                    errorMessage: 'Failed to compute bumped version.',
+                    phase: 'error',
+                };
             }
         }
-        if (ctx.cancelled())
-            return;
-        ctx.dispatch({ result, type: 'PUBLISH_DONE' });
-    },
-};
-/** A raw publish records the asset it published in the lockfile, as installed from the project's own files. */
-const installing = {
-    async run(state, ctx) {
-        try {
-            const projectRoot = findProjectRoot(state.flags.projectRoot);
-            await withLockfileLock(projectRoot, async () => {
-                // Read current lockfile
-                const lockfile = await readLockfile(projectRoot);
-                // Compute checksums from actual project files (not staging copies)
-                const files = [];
-                for (const file of state.rawDetection.files) {
-                    const checksum = await hashFile(file.absolutePath);
-                    files.push({
-                        checksum,
-                        sourcePath: file.relativePath,
-                    });
+        case 'SUBMIT_CONFIRM': {
+            const trimmed = state.confirmValue.trim().toLowerCase();
+            if (trimmed === 'y' || trimmed === 'yes') {
+                return advanceToPlan(state);
+            }
+            else if (trimmed === 'n' || trimmed === 'no') {
+                return { ...state, errorMessage: 'Publish cancelled.', phase: 'error' };
+            }
+            // Otherwise ignore (wait for valid input)
+            return state;
+        }
+        case 'SUBMIT_DESCRIPTION': {
+            const trimmed = state.descriptionValue.trim();
+            if (!trimmed)
+                return state; // Don't allow empty description
+            return {
+                ...state,
+                descriptionValue: trimmed,
+                metadataSubPhase: metadataAfterDescription(state),
+            };
+        }
+        case 'SUBMIT_PROMPT_TAGS': {
+            const parsedTags = splitList(state.promptTagsValue);
+            // Update the target's data with the new tags
+            const updatedTagsTarget = state.target
+                ? {
+                    ...state.target,
+                    data: { ...state.target.data, tags: parsedTags.length > 0 ? parsedTags : undefined },
                 }
-                // Build InstalledAsset entry
-                const installedAsset = {
-                    files,
-                    installReason: 'direct',
-                    name: state.rawDetection.name,
-                    org: state.orgValue || undefined,
-                    type: state.rawDetection.assetType,
-                    version: state.resolvedVersion || state.target?.data.version || '1.0.0',
+                : undefined;
+            // Check if tools are also missing (only for assets)
+            const needsToolsPrompt = updatedTagsTarget?.type === 'asset' &&
+                (!('tools' in updatedTagsTarget.data) ||
+                    !Array.isArray(updatedTagsTarget.data.tools) ||
+                    (updatedTagsTarget.data.tools?.length ?? 0) === 0);
+            const nextTagsPhase = needsToolsPrompt ? 'loading-tools' : phaseAfterMetadata(updatedTagsTarget);
+            return {
+                ...state,
+                phase: nextTagsPhase,
+                target: updatedTagsTarget,
+            };
+        }
+        case 'SUBMIT_PUBLISH_CONFIRM': {
+            const trimmed = state.publishConfirmValue.trim().toLowerCase();
+            if (trimmed === 'y' || trimmed === 'yes') {
+                return { ...state, phase: 'publishing' };
+            }
+            else if (trimmed === 'n' || trimmed === 'no') {
+                return { ...state, errorMessage: 'Publish cancelled.', phase: 'error' };
+            }
+            // Otherwise ignore (wait for valid input)
+            return state;
+        }
+        case 'SUBMIT_REVIEWER':
+            return { ...state, phase: 'checking-registry' };
+        case 'SUBMIT_TAGS':
+            return {
+                ...state,
+                metadataSubPhase: 'building-staging',
+            };
+        case 'SUBMIT_WITH_CONFIRM': {
+            const trimmed = state.withConfirmValue.trim().toLowerCase();
+            if (trimmed === 'y' || trimmed === 'yes') {
+                return advanceToPlan({
+                    ...state,
+                    entries: [...state.entries, ...state.suggestedEntries],
+                    missingDependencies: [],
+                    pendingError: undefined,
+                    suggestedEntries: [],
+                    withConfirmValue: '',
+                });
+            }
+            if ((trimmed === 'n' || trimmed === 'no') && state.pendingError) {
+                return publishReducer({ ...state, suggestedEntries: [], withConfirmValue: '' }, state.pendingError);
+            }
+            return state;
+        }
+        case 'SUGGEST_ENTRIES':
+            return {
+                ...state,
+                missingDependencies: action.missing,
+                pendingError: action.error,
+                phase: 'confirm-with',
+                suggestedEntries: action.suggested,
+                withConfirmValue: '',
+            };
+        case 'TOOLS_LOADED':
+            return {
+                ...state,
+                phase: 'prompting-tools',
+                toolAdapters: action.adapters,
+            };
+        case 'VALIDATE_DONE': {
+            if (!action.validation.valid) {
+                return {
+                    ...state,
+                    errorMessage: `Validation failed:\n${action.validation.errors.map((e) => `  - ${e}`).join('\n')}`,
+                    phase: 'error',
+                    validation: action.validation,
                 };
-                // Add to lockfile and write
-                const updatedLockfile = addAssetToLockfile(lockfile, installedAsset);
-                await writeLockfile(projectRoot, updatedLockfile);
-            });
+            }
+            // Seed the reviewers field: the --reviewer flag wins over the project's
+            // lockfile-configured default (org.ts's CLI-flag > lockfile priority chain).
+            const reviewerValue = state.flags.reviewerFlag ?? (action.lockfileOrgReviewers ?? []).join(', ');
+            // Determine next phase based on missing tags/tools. A batch asks for neither: as for
+            // a --with entry, a missing one is only a warning.
+            const batch = isBatch(state.flags);
+            const manifest = state.target?.data;
+            const hasTags = batch || (manifest && 'tags' in manifest && Array.isArray(manifest.tags) && manifest.tags.length > 0);
+            const hasTools = batch ||
+                // Only assets have tools; bundles skip the tools prompt
+                state.target?.type !== 'asset' ||
+                (manifest && 'tools' in manifest && Array.isArray(manifest.tools) && manifest.tools.length > 0);
+            const isOrgScoped = batch
+                ? [state.target, ...state.entries.map((entry) => entry.target)].some((t) => t && isOrgScopedTarget(t))
+                : Boolean(state.target && isOrgScopedTarget(state.target));
+            // Reviewers only apply to org-scoped assets (non-org PRs always go to the registry
+            // maintainer) — fail fast rather than silently ignoring the flag.
+            if (!isOrgScoped && state.flags.reviewerFlag && parseReviewersInput(state.flags.reviewerFlag).length > 0) {
+                return {
+                    ...state,
+                    errorMessage: 'The --reviewer flag only applies to org-scoped assets. Remove the flag to publish this asset.',
+                    phase: 'error',
+                    validation: action.validation,
+                };
+            }
+            // A manifest without tags takes them from --tags right here, in any run: a non-interactive
+            // one without the flag publishes none, an interactive one asks. Manifest tags always win.
+            const tagsFromFlag = !hasTags && (state.nonInteractive || state.flags.tagsFlag !== undefined);
+            let nextTarget = state.target;
+            if (tagsFromFlag && nextTarget) {
+                const flagTags = splitList(state.flags.tagsFlag);
+                nextTarget = {
+                    ...nextTarget,
+                    data: { ...nextTarget.data, tags: flagTags.length > 0 ? flagTags : undefined },
+                };
+            }
+            // Non-interactive path: either route to loading-tools (effect resolves tools async) or
+            // directly to checking-registry. The reviewer prompt never applies here — non-interactive
+            // mode always skips it.
+            if (state.nonInteractive) {
+                let nextPhase;
+                if (!hasTools) {
+                    // The loading-tools effect detects whether we're non-interactive and
+                    // either resolves tools from the manifest/flag/inference or errors out.
+                    nextPhase = 'loading-tools';
+                }
+                else {
+                    nextPhase = 'checking-registry';
+                }
+                return {
+                    ...state,
+                    phase: nextPhase,
+                    reviewerValue,
+                    target: nextTarget,
+                    validation: action.validation,
+                };
+            }
+            let nextPhase;
+            if (!hasTags && !tagsFromFlag) {
+                nextPhase = 'prompting-tags';
+            }
+            else if (!hasTools) {
+                nextPhase = 'loading-tools';
+            }
+            else {
+                nextPhase = isOrgScoped ? 'prompting-reviewer' : 'checking-registry';
+            }
+            return {
+                ...state,
+                phase: nextPhase,
+                reviewerValue,
+                target: nextTarget,
+                validation: action.validation,
+            };
         }
-        catch {
-            // Publish already succeeded, so just warn and move to done
+        default:
+            return state;
+    }
+}
+/**
+ * The step before `building-plan`, once the root asset's own checks are done:
+ * check the entries not yet checked, then settle each entry that needs a bump
+ * (`--bump`; without it, the bump prompt, or an error when non-interactive), then plan.
+ */
+function advanceToPlan(state) {
+    if (state.entries.some((entry) => !entry.versionCheck)) {
+        return { ...state, bumpEntry: undefined, phase: 'checking-entries' };
+    }
+    // A batch without --bump names every asset that needs one, not just the first.
+    if (isBatch(state.flags) && state.nonInteractive && !state.flags.bump) {
+        const pending = [
+            ...(state.target && state.versionCheck?.status === 'needs-bump' && !state.resolvedVersion
+                ? [{ label: state.flags.rawPath, latestVersion: state.versionCheck.latestVersion, target: state.target }]
+                : []),
+            ...state.entries.flatMap((entry) => entry.versionCheck?.status === 'needs-bump' && entry.resolvedVersion === undefined
+                ? [{ label: entry.label, latestVersion: entry.versionCheck.latestVersion, target: entry.target }]
+                : []),
+        ];
+        if (pending.length > 0) {
+            const lines = pending.map((p) => `  ${p.label}: ${p.target.assetType}:${p.target.data.name} v${p.target.data.version}, registry has v${p.latestVersion}`);
+            return {
+                ...state,
+                errorMessage: `--bump <patch|minor|major> required: these manifests are not newer than the registry:\n${lines.join('\n')}`,
+                phase: 'error',
+            };
         }
-        ctx.dispatch({ type: 'INSTALL_DONE' });
-    },
-};
+    }
+    const index = state.entries.findIndex((entry) => entry.versionCheck?.status === 'needs-bump' && entry.resolvedVersion === undefined);
+    const entry = state.entries[index];
+    if (entry?.versionCheck?.status !== 'needs-bump') {
+        return { ...state, bumpEntry: undefined, phase: 'building-plan' };
+    }
+    if (state.flags.bump) {
+        return bumpEntryAt(state, index, state.flags.bump);
+    }
+    if (!state.nonInteractive) {
+        return { ...state, bumpEntry: index, bumpSelection: '', phase: 'bump-prompt' };
+    }
+    return {
+        ...state,
+        errorMessage: `--bump <patch|minor|major> required: registry has v${entry.versionCheck.latestVersion} of ${entry.target.assetType}:${entry.target.data.name} (from ${entry.label}) but its manifest is not newer`,
+        phase: 'error',
+    };
+}
+/**
+ * Bump the entry at `index` from its registry version, then go on toward the
+ * plan; an error state, as for the root, when the version can't be bumped.
+ */
+function bumpEntryAt(state, index, bump) {
+    const entry = state.entries[index];
+    if (entry?.versionCheck?.status !== 'needs-bump')
+        return state;
+    let version;
+    try {
+        version = bumpVersion(entry.versionCheck.latestVersion, bump);
+    }
+    catch {
+        return { ...state, errorMessage: `Failed to compute bumped version for ${entry.label}.`, phase: 'error' };
+    }
+    return advanceToPlan({ ...state, entries: replaceEntry(state.entries, index, withVersion(entry, version)) });
+}
+/** A raw publish's step after its description: the tags prompt, unless --tags answered it. */
+function metadataAfterDescription(state) {
+    return state.flags.tagsFlag === undefined ? 'tags' : 'building-staging';
+}
+/**
+ * Phase to enter once the tags/tools metadata prompts are resolved: org-scoped
+ * targets get the reviewer prompt, everything else proceeds to the registry check.
+ */
+function phaseAfterMetadata(target) {
+    return target && isOrgScopedTarget(target) ? 'prompting-reviewer' : 'checking-registry';
+}
+function replaceEntry(entries, index, entry) {
+    return entries.map((current, i) => (i === index ? entry : current));
+}
+/** The entry published at `version`; a successful publish writes it to the entry's manifest. */
+function withVersion(entry, version) {
+    return {
+        ...entry,
+        resolvedVersion: version,
+        target: { ...entry.target, data: { ...entry.target.data, version } },
+    };
+}
 //# sourceMappingURL=publish-flow.js.map