@forgeax/engine-pack 0.1.3 → 0.1.6

package/src/scanner.ts

@@ -1,6 +1,13 @@
+import { createHash } from 'node:crypto';
 import { readdir, readFile, stat } from 'node:fs/promises';
 import { basename, join } from 'node:path';
-import type { ImportedOutputDeclaration, PackErrorCode } from '@forgeax/engine-types';
+import type {
+  CatalogDiagnostic,
+  PackErrorCode,
+  ProviderProvenance,
+  ResourceRevision,
+  SourceOverrideDescriptor,
+} from '@forgeax/engine-types';
 import { PACK_ERROR_HINTS } from '@forgeax/engine-types';
 import { loadAssetConfig } from './config.js';
 import { PackError } from './errors.js';
@@ -8,13 +15,16 @@ import { isValidAssetGuidString } from './guid.js';
 import { validateProducerContract, validateProducerOutputs } from './producer-contract.js';
 import { resolveAssetSource } from './resolve-asset-source.js';
 import { validateMeta, validatePack } from './schema-compiled.js';
-import { projectScriptablePackMeta, type ScriptablePackMetaJson } from './scriptable-pack.js';
 import {
-  createScriptablePackModuleExecutorPool,
+  projectScriptablePackMeta,
+  type ScriptablePackDefinition,
+  type ScriptablePackMetaJson,
+  type ScriptablePackSourceClosureEntry,
+} from './scriptable-pack.js';
+import {
   inventoryScriptablePackSource,
-  type LoadScriptablePackOptions,
   loadScriptablePack,
-  type ScriptablePackSourceClosureEntry,
+  type ScriptablePackModuleExecutor,
 } from './scriptable-pack-node.js';
 
 // Minimal Result<T, E> — structurally compatible with @forgeax/engine-rhi Result
@@ -34,58 +44,117 @@ function packErr<E>(error: E): ScanResult<never, E> {
 /** Host-owned source paths that should not enter the Pack catalog. */
 export interface ScanOptions {
   readonly ignorePath?: (path: string) => boolean;
-  /** Timeout/executor owner for ScriptablePack metadata loading. */
-  readonly scriptablePackLoad?: LoadScriptablePackOptions;
+  readonly scriptablePack?: ScriptablePackScanOptions;
+}
+
+/** One bounded executor policy shared by ScriptablePack inventory and production. */
+export interface ScriptablePackScanOptions {
+  readonly timeoutMs?: number;
+  readonly buildTimeoutMs?: number;
+  readonly executor?: ScriptablePackModuleExecutor;
+  /** Path-only scans must release the isolated loader before returning. */
+  readonly metadataOnly?: boolean;
 }
 
-export type AssetInventoryProducerKind = 'direct-pack' | 'source-meta' | 'scriptable-pack';
+/** Stable default policy shared by inventory and production owners. */
+export const STANDARD_SCRIPTABLE_PACK_SCAN_OPTIONS = Object.freeze(
+  {},
+) satisfies ScriptablePackScanOptions;
 
-export interface AssetInventoryOutput {
+export interface InventoryDeclaration {
   readonly guid: string;
+  readonly kind: string;
+  readonly sourcePath: string;
+  readonly sourceRevision: string;
   readonly sourceKey?: string;
   readonly sourceIndex?: number;
-  readonly kind: string;
-  readonly name?: string;
-  readonly execution?: 'direct' | 'cooked';
-  readonly refs: readonly string[];
 }
 
-export interface AssetInventoryProjectedMeta {
-  readonly schemaVersion?: string;
+export interface ScanInventory {
+  readonly paths: readonly string[];
+  readonly inventory: readonly InventoryDeclaration[];
+  /** Complete parsed source declarations captured by the validated scan pass. */
+  readonly declarations: ReadonlyMap<string, ScanSourceDeclaration>;
+}
+
+export interface ScriptablePackInventoryDeclaration {
+  readonly sourcePath: string;
+  readonly sourceRevision: string;
+  readonly meta: ScriptablePackMetaJson;
+  readonly definition: Readonly<ScriptablePackDefinition>;
+  readonly sourceClosure: readonly ScriptablePackSourceClosureEntry[];
+}
+
+export interface MetaInventoryDocument {
+  readonly schemaVersion: string | number;
+  readonly kind: 'external-asset-package';
   readonly packageId?: string;
-  readonly importer?: string;
-  readonly source?: string;
   readonly name?: string;
-  readonly outputs: readonly AssetInventoryOutput[];
-  readonly externalGuids: readonly string[];
+  readonly provenance?: ProviderProvenance;
+  readonly revision?: ResourceRevision;
+  readonly diagnostics?: readonly CatalogDiagnostic[];
+  readonly importer: string;
+  readonly source?: string;
+  readonly importSettings: Readonly<Record<string, unknown>>;
+  readonly sourceOverrides?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+  readonly sourceOverrideDescriptors?: readonly SourceOverrideDescriptor[];
+  readonly paramSchema?: readonly Readonly<Record<string, unknown>>[];
+  readonly subAssets: readonly MetaInventorySubAsset[];
 }
 
-export interface AssetInventoryDiagnostic {
-  readonly code: string;
-  readonly message: string;
+export interface MetaInventorySubAsset {
+  readonly guid: string;
+  readonly sourceIndex: number;
+  readonly sourceKey?: string;
+  readonly name?: string;
+  readonly kind: string;
 }
 
-export interface AssetInventoryDeclaration {
-  readonly sourcePath: string;
-  readonly canonicalSourcePath: string;
-  readonly producer: AssetInventoryProducerKind;
+export interface PackInventoryDocument {
+  readonly schemaVersion: '1.0.0' | '2.0.0';
+  readonly kind: 'internal-text-package';
   readonly packageId?: string;
-  readonly projectedMeta: AssetInventoryProjectedMeta;
-  readonly outputs: readonly AssetInventoryOutput[];
-  readonly externalGuids: readonly string[];
-  readonly sourceClosure?: readonly ScriptablePackSourceClosureEntry[];
-  readonly diagnostics: readonly AssetInventoryDiagnostic[];
+  readonly provenance?: ProviderProvenance;
+  readonly revision?: ResourceRevision;
+  readonly diagnostics?: readonly CatalogDiagnostic[];
+  readonly assets: readonly PackInventoryAsset[];
 }
 
-export interface AssetInventory {
-  readonly paths: readonly string[];
-  readonly scriptablePackMeta: ReadonlyMap<string, ScriptablePackMetaJson>;
-  /** One declaration record per authored package/source, keyed by source path. */
-  readonly declarations: readonly AssetInventoryDeclaration[];
-  readonly declarationsByPath: ReadonlyMap<string, AssetInventoryDeclaration>;
-  /** Producer ownership map used by Catalog, watcher, and demand cook. */
-  readonly sourceByGuid: ReadonlyMap<string, string>;
-  readonly metaByGuid: ReadonlyMap<string, string>;
+export interface PackInventoryAsset {
+  readonly guid: string;
+  readonly kind: string;
+  readonly name?: string;
+  readonly execution?: 'direct' | 'cooked';
+  readonly sourceKey?: string;
+  readonly sourceIndex?: number;
+  readonly payload: Readonly<Record<string, unknown>>;
+  readonly refs: readonly string[];
+  readonly artifacts?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+}
+
+export type ScanSourceDeclaration =
+  | {
+      readonly format: 'meta.json';
+      readonly sourcePath: string;
+      readonly sourceRevision: string;
+      readonly value: MetaInventoryDocument;
+    }
+  | {
+      readonly format: 'pack.json';
+      readonly sourcePath: string;
+      readonly sourceRevision: string;
+      readonly sourceText: string;
+      readonly value: PackInventoryDocument;
+    }
+  | ({
+      readonly format: 'pack.ts';
+      readonly sourcePath: string;
+      readonly sourceRevision: string;
+      readonly value: ScriptablePackMetaJson;
+    } & ScriptablePackInventoryDeclaration);
+
+interface ScanCapture {
+  readonly declarations: Map<string, ScanSourceDeclaration>;
 }
 
 /**
@@ -111,6 +180,45 @@ const BLACKLIST = new Set([
 
 export const SCANNER_BLACKLIST: ReadonlySet<string> = BLACKLIST;
 
+type MalformedFileCode = Extract<PackErrorCode, 'pack-malformed-pack' | 'pack-malformed-meta'>;
+
+type JsonValidator = {
+  (value: unknown): boolean;
+  errors?: readonly { readonly instancePath?: string; readonly message?: string }[] | null;
+};
+
+async function readValidatedJson(
+  path: string,
+  code: MalformedFileCode,
+  validate: JsonValidator,
+): Promise<ScanResult<{ readonly raw: string; readonly parsed: unknown }, PackError>> {
+  let raw: string;
+  let parsed: unknown;
+  try {
+    raw = await readFile(path, 'utf-8');
+    parsed = JSON.parse(raw);
+  } catch {
+    return packErr(
+      makePackError(code, {
+        path,
+        ajvErrors: [{ instancePath: '', message: 'JSON parse failed' }],
+      }),
+    );
+  }
+  if (!validate(parsed)) {
+    return packErr(
+      makePackError(code, {
+        path,
+        ajvErrors: (validate.errors ?? []).map((error) => ({
+          instancePath: error.instancePath ?? '',
+          message: error.message ?? 'unknown ajv error',
+        })),
+      }),
+    );
+  }
+  return ok({ raw, parsed });
+}
+
 function makePackError(
   code: PackErrorCode,
   detail: ConstructorParameters<typeof PackError>[0]['detail'],
@@ -153,7 +261,7 @@ function* extractMountSourceGuids(asset: {
 /**
  * Scan one or more root directories for `.meta.json`, `.pack.json`, and `.pack.ts` files.
  * Runs a 7-step fail-fast validation chain (w17 + M7-T01):
- *   Step 1 - collect all .meta.json + .pack.json + .pack.ts paths (blacklist skipped)
+ *   Step 1 - collect all .meta.json + .pack.json paths (blacklist skipped)
  *   Step 2 - schema validation (ajv strict)
  *   Step 3 - GUID string format validation
  *   Step 4 - GUID collision detection
@@ -161,17 +269,18 @@ function* extractMountSourceGuids(asset: {
  *   Step 6 - cyclic reference detection (hand-written DFS)
  *   Step 7 - complete pack and source closure validation
  *
- * Returns one reusable `AssetInventory` or `Err(PackError)` on the first violation.
+ * Returns `Ok(paths)` or `Err(PackError)` on the first violation.
  *
  * NOTE: source files without a .meta.json are logged but not fatal (requirements §5).
  */
-export async function scanInventory(
+async function scanValidated(
   roots: readonly string[],
   opts: ScanOptions = {},
-): Promise<ScanResult<AssetInventory, PackError>> {
-  // Step 1: collect all authored package declarations. ScriptablePack metadata
-  // is projected once through the trusted loader; the resulting inventory is
-  // shared by CLI, Catalog, watcher, and producer adapters.
+  capture?: ScanCapture,
+): Promise<ScanResult<string[], PackError>> {
+  // Step 1: collect all authored package declarations. ScriptablePack runtime
+  // validation belongs to its trusted module loader; scanner only inventories
+  // the source path so CLI/Vite share one discovery set.
   const rawPaths: string[] = [];
   const explicitRootSet = new Set(roots);
 
@@ -240,36 +349,11 @@ export async function scanInventory(
   // kind stays in the path/detail evidence; identity is the normalized GUID.
   const guidToPath = new Map<string, string>();
   const packRefs = new Map<string, string[]>(); // guid -> refs[]
-  const scriptablePackMeta = new Map<string, ScriptablePackMetaJson>();
-  const metaByGuid = new Map<string, string>();
-  const declarations: AssetInventoryDeclaration[] = [];
 
   for (const packPath of packPaths) {
-    let parsed: unknown;
-    try {
-      const raw = await readFile(packPath, 'utf-8');
-      parsed = JSON.parse(raw);
-    } catch {
-      return packErr(
-        makePackError('pack-malformed-pack', {
-          path: packPath,
-          ajvErrors: [{ instancePath: '', message: 'JSON parse failed' }],
-        }),
-      );
-    }
-
-    const valid = validatePack(parsed);
-    if (!valid) {
-      return packErr(
-        makePackError('pack-malformed-pack', {
-          path: packPath,
-          ajvErrors: (validatePack.errors ?? []).map((e) => ({
-            instancePath: e.instancePath,
-            message: e.message ?? 'unknown ajv error',
-          })),
-        }),
-      );
-    }
+    const loaded = await readValidatedJson(packPath, 'pack-malformed-pack', validatePack);
+    if (!loaded.ok) return loaded;
+    const { raw, parsed } = loaded.value;
 
     const packageContract = validateProducerContract(parsed);
     if (!packageContract.ok) {
@@ -282,20 +366,7 @@ export async function scanInventory(
     }
 
     // Step 3: validate GUIDs in pack
-    const packObj = parsed as {
-      packageId?: string;
-      assets: {
-        guid: string;
-        kind: string;
-        execution?: 'direct' | 'cooked';
-        name?: string;
-        payload: unknown;
-        refs: string[];
-        artifacts?: Readonly<Record<string, unknown>>;
-        sourceKey?: string;
-        sourceIndex?: number;
-      }[];
-    };
+    const packObj = parsed as unknown as PackInventoryDocument;
     for (const asset of packObj.assets) {
       if (
         asset.kind === 'particle-effect' &&
@@ -332,7 +403,12 @@ export async function scanInventory(
         }
       }
       const topologyContract = validateProducerOutputs(
-        producerAssets as unknown as readonly ImportedOutputDeclaration[],
+        producerAssets.map((asset, sourceIndex) => ({
+          guid: asset.guid,
+          kind: asset.kind,
+          sourceIndex: asset.sourceIndex ?? sourceIndex,
+          ...(asset.sourceKey === undefined ? {} : { sourceKey: asset.sourceKey }),
+        })),
       );
       if (!topologyContract.ok) {
         return packErr(
@@ -376,12 +452,6 @@ export async function scanInventory(
       }
       guidToPath.set(normalizedGuid, packPath);
 
-      // Accumulate refs for cycle detection
-      const existingRefs = packRefs.get(normalizedGuid) ?? [];
-      for (const ref of asset.refs) {
-        existingRefs.push(ref.toLowerCase());
-      }
-
       // feat-20260608-scene-nesting-ecs-fication M1 / w14 (D-1):
       // mount-payload-extract — for scene assets, redundantly inject the
       // mount.source -> resolved GUID edge into the cycle graph alongside
@@ -393,65 +463,26 @@ export async function scanInventory(
       // refs[]. The `kind: 'mount-asset'` tag on the resulting
       // pack-cyclic-reference detail is set by the cycle producer below
       // (R10).
-      for (const guid of extractMountSourceGuids(asset)) {
-        existingRefs.push(guid);
-      }
-      packRefs.set(normalizedGuid, existingRefs);
+      packRefs.set(normalizedGuid, [
+        ...asset.refs.map((ref) => ref.toLowerCase()),
+        ...extractMountSourceGuids(asset),
+      ]);
     }
-    const outputs = packObj.assets.map((asset) => ({
-      guid: asset.guid,
-      ...(asset.sourceKey === undefined ? {} : { sourceKey: asset.sourceKey }),
-      ...(asset.sourceIndex === undefined ? {} : { sourceIndex: asset.sourceIndex }),
-      kind: asset.kind,
-      ...(asset.name === undefined ? {} : { name: asset.name }),
-      ...(asset.execution === undefined ? {} : { execution: asset.execution }),
-      refs: asset.refs,
-    }));
-    declarations.push({
+    capture?.declarations.set(packPath, {
+      format: 'pack.json',
       sourcePath: packPath,
-      canonicalSourcePath: packPath.replace(/\\/g, '/'),
-      producer: 'direct-pack',
-      ...(packObj.packageId === undefined ? {} : { packageId: packObj.packageId }),
-      projectedMeta: {
-        schemaVersion: '2.0.0',
-        ...(packObj.packageId === undefined ? {} : { packageId: packObj.packageId }),
-        outputs,
-        externalGuids: outputs.flatMap((output) => output.refs),
-      },
-      outputs,
-      externalGuids: outputs.flatMap((output) => output.refs),
-      diagnostics: [],
+      sourceRevision: `sha256:${createHash('sha256').update(raw).digest('hex')}`,
+      sourceText: raw,
+      value: packObj,
     });
   }
 
   // Step 2 + 3 + 5: parse + schema validate + GUID format validate + orphan check for meta files
   const { paths: assetPaths } = loadAssetConfig(process.cwd());
   for (const metaPath of metaPaths) {
-    let parsed: unknown;
-    try {
-      const raw = await readFile(metaPath, 'utf-8');
-      parsed = JSON.parse(raw);
-    } catch {
-      return packErr(
-        makePackError('pack-malformed-meta', {
-          path: metaPath,
-          ajvErrors: [{ instancePath: '', message: 'JSON parse failed' }],
-        }),
-      );
-    }
-
-    const valid = validateMeta(parsed);
-    if (!valid) {
-      return packErr(
-        makePackError('pack-malformed-meta', {
-          path: metaPath,
-          ajvErrors: (validateMeta.errors ?? []).map((e) => ({
-            instancePath: e.instancePath,
-            message: e.message ?? 'unknown ajv error',
-          })),
-        }),
-      );
-    }
+    const loaded = await readValidatedJson(metaPath, 'pack-malformed-meta', validateMeta);
+    if (!loaded.ok) return loaded;
+    const { raw, parsed } = loaded.value;
 
     const metaContract = validateProducerContract(parsed);
     if (!metaContract.ok) {
@@ -464,23 +495,13 @@ export async function scanInventory(
     }
 
     // Step 3: validate GUIDs in meta subAssets
-    const metaObj = parsed as {
-      packageId?: string;
-      importer?: string;
-      source?: string;
-      name?: string;
-      importSettings?: {
-        readonly externalAssets?: readonly { readonly guid?: unknown }[];
-      };
-      subAssets: {
-        guid: string;
-        sourceIndex: number;
-        sourceKey?: string;
-        kind: string;
-        name?: string;
-      }[];
-      sourceOverrides?: unknown;
-    };
+    const metaObj = parsed as unknown as MetaInventoryDocument;
+    capture?.declarations.set(metaPath, {
+      format: 'meta.json',
+      sourcePath: metaPath,
+      sourceRevision: `sha256:${createHash('sha256').update(raw).digest('hex')}`,
+      value: metaObj,
+    });
     for (const sub of metaObj.subAssets) {
       if (!isValidAssetGuidString(sub.guid)) {
         return packErr(
@@ -501,13 +522,10 @@ export async function scanInventory(
         );
       }
       guidToPath.set(normalizedGuid, metaPath);
-      metaByGuid.set(normalizedGuid, metaPath);
     }
     const producerSubAssets = metaObj.subAssets.length > 1 ? metaObj.subAssets : [];
     if (producerSubAssets.length > 0) {
-      const topologyContract = validateProducerOutputs(
-        producerSubAssets as unknown as readonly ImportedOutputDeclaration[],
-      );
+      const topologyContract = validateProducerOutputs(producerSubAssets);
       if (!topologyContract.ok) {
         return packErr(
           makePackError('pack-malformed-meta', {
@@ -536,122 +554,86 @@ export async function scanInventory(
         }),
       );
     }
-    const outputs = metaObj.subAssets.map((sub) => ({
-      guid: sub.guid,
-      ...(sub.sourceKey === undefined ? {} : { sourceKey: sub.sourceKey }),
-      sourceIndex: sub.sourceIndex,
-      kind: sub.kind,
-      ...(sub.name === undefined ? {} : { name: sub.name }),
-      refs: [],
-    }));
-    const externalGuids = (metaObj.importSettings?.externalAssets ?? []).flatMap((entry) =>
-      typeof entry.guid === 'string' ? [entry.guid] : [],
-    );
-    declarations.push({
-      sourcePath: metaPath,
-      canonicalSourcePath: metaPath.replace(/\\/g, '/'),
-      producer: 'source-meta',
-      ...(metaObj.packageId === undefined ? {} : { packageId: metaObj.packageId }),
-      projectedMeta: {
-        ...(metaObj.packageId === undefined ? {} : { packageId: metaObj.packageId }),
-        ...(metaObj.importer === undefined ? {} : { importer: metaObj.importer }),
-        ...(metaObj.source === undefined ? {} : { source: metaObj.source }),
-        ...(metaObj.name === undefined ? {} : { name: metaObj.name }),
-        outputs,
-        externalGuids,
-      },
-      outputs,
-      externalGuids,
-      diagnostics: [],
-    });
   }
 
   // ScriptablePack identity enters the same topology and collision authority as JSON declarations.
-  const scriptablePackExecutorPool =
-    scriptablePaths.length === 0 || opts.scriptablePackLoad?.executor !== undefined
-      ? undefined
-      : createScriptablePackModuleExecutorPool();
-  try {
-    for (const sourcePath of scriptablePaths) {
-      const executor = await scriptablePackExecutorPool?.acquire();
-      const loaded = await loadScriptablePack(sourcePath, {
-        ...opts.scriptablePackLoad,
-        metadataOnly: true,
-        ...(executor === undefined ? {} : { executor }),
-      });
-      if (!loaded.ok) {
-        const diagnostic =
-          'diagnostic' in loaded.error.detail ? loaded.error.detail.diagnostic : undefined;
-        return packErr(
-          makePackError('pack-malformed-meta', {
-            path: sourcePath,
-            ajvErrors: [
-              {
-                instancePath: '',
-                message:
-                  diagnostic === undefined
-                    ? loaded.error.code
-                    : `${loaded.error.code}: ${diagnostic}`,
-              },
-            ],
-          }),
-        );
-      }
-      const meta = projectScriptablePackMeta(loaded.value, sourcePath);
-      scriptablePackMeta.set(sourcePath, meta);
-      const sourceClosure = await inventoryScriptablePackSource(sourcePath);
-      const topology = validateProducerOutputs(
-        meta.subAssets as unknown as readonly ImportedOutputDeclaration[],
+  for (const sourcePath of scriptablePaths) {
+    let source: string;
+    try {
+      source = await readFile(sourcePath, 'utf8');
+    } catch {
+      return packErr(
+        makePackError('pack-malformed-meta', {
+          path: sourcePath,
+          ajvErrors: [{ instancePath: '', message: 'ScriptablePack source read failed' }],
+        }),
+      );
+    }
+    const loaded = await loadScriptablePack(sourcePath, {
+      ...(opts.scriptablePack ?? {}),
+      ...(capture === undefined ? { metadataOnly: true } : {}),
+    });
+    if (!loaded.ok) {
+      const diagnostic =
+        'diagnostic' in loaded.error.detail ? loaded.error.detail.diagnostic : undefined;
+      return packErr(
+        makePackError('pack-malformed-meta', {
+          path: sourcePath,
+          ajvErrors: [
+            {
+              instancePath: '',
+              message:
+                diagnostic === undefined
+                  ? loaded.error.code
+                  : `${loaded.error.code}: ${diagnostic}`,
+            },
+          ],
+        }),
+      );
+    }
+    let sourceClosure: readonly ScriptablePackSourceClosureEntry[];
+    try {
+      sourceClosure = await inventoryScriptablePackSource(sourcePath, source);
+    } catch {
+      return packErr(
+        makePackError('pack-malformed-meta', {
+          path: sourcePath,
+          ajvErrors: [{ instancePath: '', message: 'ScriptablePack source closure read failed' }],
+        }),
       );
-      if (!topology.ok) {
+    }
+    const meta = projectScriptablePackMeta(loaded.value, sourcePath);
+    const topology = validateProducerOutputs(meta.subAssets);
+    if (!topology.ok) {
+      return packErr(
+        makePackError('pack-malformed-meta', {
+          path: sourcePath,
+          ajvErrors: [{ instancePath: '/subAssets', message: topology.error.code }],
+        }),
+      );
+    }
+    const declaration = {
+      sourcePath,
+      sourceRevision: `sha256:${createHash('sha256').update(source).digest('hex')}`,
+      meta,
+      definition: loaded.value,
+      sourceClosure,
+    } satisfies ScriptablePackInventoryDeclaration;
+    capture?.declarations.set(sourcePath, {
+      format: 'pack.ts',
+      ...declaration,
+      value: meta,
+    });
+    for (const sub of meta.subAssets) {
+      const guid = sub.guid.toLowerCase();
+      const existing = guidToPath.get(guid);
+      if (existing !== undefined) {
         return packErr(
-          makePackError('pack-malformed-meta', {
-            path: sourcePath,
-            ajvErrors: [{ instancePath: '/subAssets', message: topology.error.code }],
-          }),
+          makePackError('pack-guid-collision', { paths: [existing, sourcePath], guid }),
         );
       }
-      for (const sub of meta.subAssets) {
-        const guid = sub.guid.toLowerCase();
-        const existing = guidToPath.get(guid);
-        if (existing !== undefined) {
-          return packErr(
-            makePackError('pack-guid-collision', { paths: [existing, sourcePath], guid }),
-          );
-        }
-        guidToPath.set(guid, sourcePath);
-      }
-      const outputs = meta.subAssets.map((sub) => ({
-        guid: sub.guid,
-        sourceKey: sub.sourceKey,
-        sourceIndex: sub.sourceIndex,
-        kind: sub.kind,
-        ...(sub.name === undefined ? {} : { name: sub.name }),
-        refs: [],
-      }));
-      const externalGuids = meta.importSettings.externalAssets.map((entry) => entry.guid);
-      declarations.push({
-        sourcePath,
-        canonicalSourcePath: sourcePath.replace(/\\/g, '/'),
-        producer: 'scriptable-pack',
-        packageId: meta.packageId,
-        projectedMeta: {
-          schemaVersion: meta.schemaVersion,
-          packageId: meta.packageId,
-          importer: meta.importer,
-          source: meta.source,
-          ...(meta.name === undefined ? {} : { name: meta.name }),
-          outputs,
-          externalGuids,
-        },
-        outputs,
-        externalGuids,
-        sourceClosure,
-        diagnostics: [],
-      });
+      guidToPath.set(guid, sourcePath);
     }
-  } finally {
-    await scriptablePackExecutorPool?.dispose();
   }
 
   // Step 6: cyclic reference detection via hand-written DFS (no graphlib dep)
@@ -693,24 +675,41 @@ export async function scanInventory(
     }
   }
 
-  const declarationsByPath = new Map(
-    declarations.map((declaration) => [declaration.sourcePath, declaration]),
-  );
-  return ok({
-    paths: rawPaths,
-    scriptablePackMeta,
-    declarations,
-    declarationsByPath,
-    sourceByGuid: new Map(guidToPath),
-    metaByGuid,
-  });
+  return ok(rawPaths);
 }
 
-/** Compatibility projection for callers that only need discovered paths. */
+/** Scan one complete Pack inventory while preserving the public path-only API. */
 export async function scan(
   roots: readonly string[],
   opts: ScanOptions = {},
 ): Promise<ScanResult<string[], PackError>> {
-  const inventory = await scanInventory(roots, opts);
-  return inventory.ok ? ok([...inventory.value.paths]) : inventory;
+  return scanValidated(roots, opts);
+}
+
+/** Return the validated source inventory without interpreting producer output kinds. */
+export async function scanInventory(
+  roots: readonly string[],
+  opts: ScanOptions = {},
+): Promise<ScanResult<ScanInventory, PackError>> {
+  const declarations = new Map<string, ScanSourceDeclaration>();
+  const scanned = await scanValidated(roots, opts, { declarations });
+  if (!scanned.ok) return scanned;
+  const inventory: InventoryDeclaration[] = [];
+  for (const sourcePath of scanned.value) {
+    const declaration = declarations.get(sourcePath);
+    if (declaration?.format !== 'pack.json') continue;
+    for (const [index, asset] of declaration.value.assets.entries()) {
+      inventory.push({
+        guid: asset.guid,
+        kind: asset.kind,
+        sourcePath,
+        sourceRevision: declaration.sourceRevision,
+        ...(asset.sourceKey === undefined ? {} : { sourceKey: asset.sourceKey }),
+        ...(asset.sourceIndex === undefined
+          ? { sourceIndex: index }
+          : { sourceIndex: asset.sourceIndex }),
+      });
+    }
+  }
+  return ok({ paths: scanned.value, inventory, declarations });
 }