@heroiclands/package-build 0.2.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,97 @@
 # @heroiclands/package-build
 
+## 0.4.0
+
+### Minor Changes
+
+- 2c2fc37: **`package-build bundle check` — the last capability that had no command.**
+  
+  The bundle-loading check was exported as a library function and reachable no
+  other way, so a consumer that wanted it had to write the script the command line
+  exists to remove: read the manifest, read the bundle, call the function, decide
+  how to print findings, choose an exit code. It now runs from configuration like
+  every other job.
+  
+  It catches three ways a package builds successfully and still does not load,
+  none of which a bundler can see, because each is a disagreement between two
+  files rather than a fault in either:
+  
+  | The manifest says                                                         | What Foundry does                                                                  |
+  | ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
+  | the entry under both `esmodules` and `scripts`                            | loads the bundle twice                                                             |
+  | the entry under neither                                                   | never loads it at all                                                              |
+  | the entry under `esmodules`, but the file only parses as a classic script | fails at load, naming whichever `import` came first and nothing about the manifest |
+  
+  Both files are read from the stage, because the stage is what ships.
+  
+  **The entry is derived, not stated.** `packageBuild.bundle.entry` defaults to
+  `<packageId>.mjs`, which is already derived from `package.json` `name`; a
+  repository states it only when its bundler emits something else. It is
+  deliberately _not_ read back out of the generated manifest — a value taken from
+  there would agree with itself by construction, and the check's whole question is
+  whether the manifest declares this file the way Foundry needs it.
+  
+  **Reporting is now decided once.** `lang check` had the diagnostic contract —
+  `file:line:column: severity: message`, the path starting the line, a field
+  dropped rather than guessed — spelled out inline in its handler. Both commands
+  now report through one seam that maps findings onto the format
+  `@heroiclands/content-build` already owns, so the two packages cannot drift into
+  two nearly-identical formats. `lang check`'s output is unchanged.
+  
+  **The command surface has a stated shape.** A capability with a single operation
+  is a bare command (`clean`, `assets`, `manifest`, `release`, `deploy <stage>`);
+  one with more than a single operation takes a positional action, so a second can
+  be added without renaming the first (`lang check`, `bundle check`).
+  
+  Closes #12
+
+## 0.3.0
+
+### Minor Changes
+
+- 0a2ef1e: **The Foundry manifest is generated from configuration. The template is
+  retired.**
+  
+  `package-build manifest` writes `system.json` / `module.json` from
+  `packageBuild.manifest` plus the facts the build already holds. There is no
+  `assets/templates/*.template.json`, and the template-reading path is removed
+  rather than left as a fallback: `writeFoundryManifest`, `stampManifest` and
+  `artifactFromTemplate` are gone, replaced by `buildManifest`, `writeManifest`
+  and `manifestPacks`.
+  
+  The manifest was the one build input still hand-authored JSON, per repository,
+  with no schema and nothing checking it — and it declared facts the configuration
+  already declared. SoHL's pack list was written twice, in two formats, with
+  nothing checking the pairs agreed; `sohl-kethira-basic` hand-maintained its whole
+  `module.json`, and its `download` named an older version than the module claimed.
+  
+  Three kinds of key end up in the result:
+  
+  - **Declared** — `packageBuild.manifest`, emitted unchanged, so a key Foundry
+    adds in a later version needs no release of this package. The block is
+    deliberately not key-checked; pass-through and unknown-key checking cannot
+    coexist, which is why it is its own block rather than spread across
+    `packageBuild:` where the keys around it are still checked.
+  - **Derived** — `id`, `version`, `url`, `bugs`, `manifest`, `download`,
+    `compatibility`, `relationships`, `packs`. Declaring one is an **error**
+    naming the key and where the value actually comes from, not an override: an
+    authored copy would be silently overwritten and the two would disagree with
+    nothing to say so.
+  - **Computed** — namespaced `flags` from a module named in
+    `packageBuild.manifestFlags`, merged over any declared. That is for a value a
+    repository must work out rather than state — SoHL's credits `@UUID` only
+    exists once the content tree has been walked.
+  
+  `packs` comes from the **one** pack list at the top level of
+  `content-build.config.yaml`, with companions flattened in. Give each pack the
+  `label` Foundry should show; everything else is derived.
+  
+  Requires `@heroiclands/content-build` **1.0.0**, which moved `compatibility` and
+  `relationships` to the top level (content-build#50).
+  
+  Verified against SoHL's real package: the generated manifest is **byte-identical**
+  to what its template pipeline produces today, all 24 keys, key order included.
+
 ## 0.2.1
 
 ### Patch Changes

package/README.md

@@ -95,8 +95,82 @@ packageBuild:
   deploy:
     # Prefix of the shared SFTP override variables. Default `SOHL`.
     envPrefix: SOHL
+
+  bundle:
+    # The file Foundry loads, as the manifest spells it, relative to the stage.
+    # Defaults to `<packageId>.mjs`; state it only when the bundler emits
+    # something else. Deliberately not read back out of the manifest — a value
+    # taken from there would agree with itself by construction, and `bundle
+    # check` asks whether the manifest declares this file correctly.
+    entry: sohl.mjs
+
+  # Optional. A module exporting `flags(config)` returning namespaced Foundry
+  # flags the repository has to *compute* — an address that only exists once
+  # the content tree has been walked, say. Merged over any declared below.
+  manifestFlags: ./utils/manifest-flags.mjs
+
+  # The Foundry package manifest. Emitted as declared, so a key Foundry adds in
+  # a later version needs no release of this package.
+  manifest:
+    title: Song of Heroic Lands
+    description: <p>…</p>
+    license: LICENSE.md
+    readme: README.md
+    authors:
+      - { name: Toasty, discord: "toasty#8538" }
+    esmodules: [sohl.js]
+    styles: [css/sohl.css]
+    languages:
+      - { lang: en, name: English, path: lang/en.json }
+    documentTypes:
+      Item:
+        skill: { htmlFields: [notes, docHtml] }
+    packFolders:
+      - name: Song of Heroic Lands
+        sorting: m
+        color: "#094fcb"
+        packs: [items, journals, actors, macros, scenes, adventures]
+    media:
+      - { type: logo, url: systems/sohl/assets/ui/logo.webp }
+    socket: true
+    grid: { distance: 5, units: ft }
+    primaryTokenAttribute: health
 ```
 
+### The manifest is generated, not stamped
+
+`package-build manifest` writes `system.json` / `module.json` into the stage.
+**There is no template file.** A manifest used to be hand-authored JSON that the
+build stamped a few fields into — the one build input still written by hand, per
+repository, with no schema and nothing checking it. It also declared facts the
+configuration already declared: the pack list twice, in two formats, with
+nothing checking the pairs agreed.
+
+Three kinds of key end up in the result:
+
+| Kind         | Where it comes from                                                                               |
+| ------------ | ------------------------------------------------------------------------------------------------- |
+| **Declared** | `packageBuild.manifest`, emitted unchanged                                                        |
+| **Derived**  | `id`, `version`, `url`, `bugs`, `manifest`, `download`, `compatibility`, `relationships`, `packs` |
+| **Computed** | namespaced `flags` from `manifestFlags`, merged over any declared                                 |
+
+**Declaring a derived key is an error, not an override.** An authored `version`
+would look authoritative, sit there unread, and disagree with the shipped
+package forever; the build says so, naming the key and where the value actually
+comes from.
+
+`packs` is derived from the **one** pack list at the top level of
+`content-build.config.yaml` — each entry's `label`, `type`, `name` and
+`private`, plus a `system` from `stats.systemId` and a `path` of
+`packs/<name>`. Companions are flattened in, because Foundry sees no difference:
+a companion is only a pack written by another pass rather than one of its own.
+Give each pack the `label` you want Foundry to show.
+
+`compatibility` and `relationships` are read from the **top level** of the
+shared configuration, not from this section — content-build consumes them
+(`supportedCoreVersion`, and a module'''s `stats.systemVersion`) and the
+dependency runs one way.
+
 **Why one file and not two.** Two of the values this package needs —
 `packageKind` and `foundryPackage` — are already declared for `content-build`. A
 second config file would restate them, which is two places for one fact; that is
@@ -110,18 +184,21 @@ other's schema — they split by input, and the dependency runs one way.
 
 **What is derived, not stated:**
 
-| Field                      | Derived from                                                         |
-| -------------------------- | -------------------------------------------------------------------- |
-| the repository root        | the configuration file's own location                                |
-| `packageKind`, `packageId` | the shared configuration's top level                                 |
-| the release artifact       | `packageKind` — a system ships `system.json`, a module `module.json` |
+| Field                      | Derived from                                                                |
+| -------------------------- | --------------------------------------------------------------------------- |
+| the repository root        | the configuration file's own location                                       |
+| `packageKind`, `packageId` | the shared configuration's top level                                        |
+| the release artifact       | `packageKind` — a system ships `system.json`, a module `module.json`        |
+| the bundle entry           | `packageId` — `<id>.mjs`, unless `packageBuild.bundle.entry` says otherwise |
 
 ## Command line
 
 ```
 npx package-build clean [--distclean]
 npx package-build assets
+npx package-build manifest
 npx package-build lang check
+npx package-build bundle check
 npx package-build release
 npx package-build deploy <stage>
 ```
@@ -134,11 +211,34 @@ Wrapped as npm scripts — SoHL spells them:
   "distclean": "package-build clean --distclean",
   "build:assets": "package-build assets",
   "lint:lang": "package-build lang check",
+  "lint:bundle-globals": "package-build bundle check",
   "build:pack-release": "package-build release",
   "push:qa": "package-build deploy qa"
 }
 ```
 
+**The shape of the surface.** A capability with a single operation is a bare
+command (`clean`, `assets`, `manifest`, `release`, `deploy <stage>`); one with
+more than a single operation takes a positional action, so a second can be added
+without renaming the first (`lang check`, `bundle check`). Flat `lang:check`
+names would make every operation a new top-level command and hide which ones
+belong together.
+
+**What `bundle check` checks.** Three ways a package builds successfully and
+still does not load, none of which a bundler can see, because each is a
+disagreement between two files rather than a fault in either:
+
+| The manifest says                                                         | What Foundry does                                                                  |
+| ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
+| the entry under both `esmodules` and `scripts`                            | loads the bundle twice                                                             |
+| the entry under neither                                                   | never loads it at all                                                              |
+| the entry under `esmodules`, but the file only parses as a classic script | fails at load, naming whichever `import` came first and nothing about the manifest |
+
+It reads both files from the stage, because the stage is what ships — checking
+sources would answer for a package nobody installs. Findings are emitted as
+`file:line:column: severity: message`, and the command exits non-zero when any
+of them is an error.
+
 **Why the CLI exists.** This package was library-only, so every consuming
 repository wrote a wrapper script per job — six of them in the SoHL repository,
 441 lines that between them contained no logic. `clean.mjs` was 47 lines that

package/bin/package-build.mjs

@@ -34,6 +34,13 @@
  * stay import-safe, so a consuming repository's build — or a test — can call
  * them without any of it happening.
  *
+ * **The shape of the command surface.** A capability with a single operation is
+ * a bare command (`clean`, `assets`, `manifest`, `release`, `deploy <stage>`);
+ * one with more than a single operation takes a positional action, so it can
+ * grow another without renaming the first (`lang check`, `bundle check`). The
+ * alternative — flat `lang:check`-style names — makes the second operation a
+ * new top-level command and the relationship between them invisible.
+ *
  * The side effects that need *configuration* live inside the command handlers,
  * never at module scope, so `--version` and `--help` answer in a directory with
  * no configuration at all. Running an actual command still resolves it, and
@@ -42,7 +49,9 @@
  * Usage:
  *   npx package-build clean [--distclean]
  *   npx package-build assets
+ *   npx package-build manifest
  *   npx package-build lang check
+ *   npx package-build bundle check
  *   npx package-build release
  *   npx package-build deploy <stage>
  *
@@ -50,6 +59,7 @@
  *   npm run clean                          // → … clean
  *   npm run build:assets                   // → … assets
  *   npm run lint:lang                      // → … lang check
+ *   npm run lint:bundle-globals            // → … bundle check
  *   npm run build:pack-release             // → … release
  *   npm run push:qa                        // → … deploy qa
  */
@@ -62,10 +72,14 @@ import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
 import { loadPackageBuildConfig } from "../config.mjs";
+import { loadPackConfig } from "@heroiclands/content-build/engine/pack-config";
 import { cleanBuildArtifacts, stageAssets } from "../stage.mjs";
 import { validateLangSource } from "../lang.mjs";
+import { checkBundleLoading } from "../bundle.mjs";
 import { packRelease } from "../release.mjs";
+import { writeManifest } from "../manifest.mjs";
 import { deployStage } from "../deploy.mjs";
+import { reportFindings } from "./report.mjs";
 
 /**
  * This package's own version, for `--version`.
@@ -212,6 +226,70 @@ function assetsCommand() {
     };
 }
 
+/**
+ * `manifest` — generate `system.json` / `module.json` into the build stage.
+ *
+ * There is no template to read. Everything the manifest needs is either
+ * declared in `packageBuild.manifest`, derived from configuration this
+ * repository already carries, or computed by a module the repository names in
+ * `packageBuild.manifestFlags` — for a namespaced flag it has to work out, such
+ * as the compendium address of a document that only exists once the content
+ * tree has been walked.
+ *
+ * @returns {object} The yargs command module.
+ */
+function manifestCommand() {
+    return {
+        command: "manifest",
+        describe: "Generate the Foundry package manifest",
+        builder: (y) => y,
+        handler: handler(async () => {
+            const config = loadPackageBuildConfig();
+            const shared = loadPackConfig();
+            const packageJson = JSON.parse(
+                fs.readFileSync(
+                    path.join(config.rootDir, "package.json"),
+                    "utf8",
+                ),
+            );
+
+            let flags;
+            if (config.manifestFlags) {
+                const module = await import(
+                    `file://${config.manifestFlags}`
+                ).catch((err) =>
+                    die(
+                        `cannot load \`packageBuild.manifestFlags\` ` +
+                            `(${config.manifestFlags}): ${err.message}`,
+                    ),
+                );
+                if (typeof module.flags !== "function") {
+                    die(
+                        `\`packageBuild.manifestFlags\` ` +
+                            `(${config.manifestFlags}) exports no \`flags\` ` +
+                            `function. It must export ` +
+                            `\`flags(config) -> Record<string, object>\`.`,
+                    );
+                }
+                flags = await module.flags(shared);
+            }
+
+            const { path: written, manifest } = await writeManifest({
+                config: shared,
+                packageJson,
+                artifact: config.artifact,
+                outDir: path.join(config.rootDir, config.stageDir),
+                flags,
+            });
+            console.log(
+                `✅ Wrote ${path.relative(config.rootDir, written)} ` +
+                    `(${Object.keys(manifest).length} keys, ` +
+                    `${manifest.packs.length} packs).`,
+            );
+        }),
+    };
+}
+
 /**
  * `lang check` — verify every localization file survives `expandObject`.
  *
@@ -245,20 +323,10 @@ function langCommand() {
 
             let total = 0;
             for (const file of files.sort()) {
-                const relative = path.relative(config.rootDir, file);
-                for (const finding of validateLangSource(
-                    fs.readFileSync(file, "utf8"),
-                )) {
-                    total++;
-                    // The diagnostics contract: the path starts the line, and a
-                    // field is dropped rather than guessed.
-                    const at = [relative, finding.line, finding.column]
-                        .filter((part) => part !== undefined && part !== null)
-                        .join(":");
-                    console.error(
-                        `${at}: ${finding.severity ?? "error"}: ${finding.message}`,
-                    );
-                }
+                total += reportFindings(
+                    validateLangSource(fs.readFileSync(file, "utf8")),
+                    { file: path.relative(config.rootDir, file) },
+                );
             }
 
             if (total) {
@@ -273,6 +341,72 @@ function langCommand() {
     };
 }
 
+/**
+ * `bundle check` — does the manifest agree with the bundle it points at?
+ *
+ * Three ways a package can be built successfully and still not load, none of
+ * which the bundler can see because each is a disagreement between two files:
+ * the entry listed under both `esmodules` and `scripts` (Foundry loads it
+ * twice), under neither (Foundry never loads it), or under `esmodules` while
+ * the emitted file only parses as a classic script. The last fails at runtime
+ * with a message about whichever `import` came first and says nothing about the
+ * manifest, which is the kind of error that costs an afternoon.
+ *
+ * Both files are read from the stage, because the stage is what ships. Checking
+ * sources would answer for a package nobody installs.
+ *
+ * @returns {object} The yargs command module.
+ */
+function bundleCommand() {
+    return {
+        command: "bundle <action>",
+        describe: "Code-bundle checks",
+        builder: (y) =>
+            y.positional("action", {
+                choices: ["check"],
+                describe:
+                    "check: verify the manifest and the staged bundle agree",
+            }),
+        handler: handler(() => {
+            const config = loadPackageBuildConfig();
+            const stageDir = path.join(config.rootDir, config.stageDir);
+            const manifestPath = path.join(stageDir, `${config.artifact}.json`);
+            const bundlePath = path.join(stageDir, config.bundleEntry);
+
+            // Named explicitly rather than left to a missing-file stack trace:
+            // both absences mean "the stage was not built", and a reader who
+            // sees the path knows which step to run.
+            for (const [what, where] of [
+                ["manifest", manifestPath],
+                ["bundle", bundlePath],
+            ]) {
+                if (!fs.existsSync(where)) {
+                    die(
+                        `no staged ${what} at ` +
+                            `${path.relative(config.rootDir, where)} — build ` +
+                            `the stage before checking it.`,
+                    );
+                }
+            }
+
+            const relative = path.relative(config.rootDir, bundlePath);
+            const { findings, declaredAs } = checkBundleLoading({
+                manifest: JSON.parse(fs.readFileSync(manifestPath, "utf8")),
+                source: fs.readFileSync(bundlePath, "utf8"),
+                entry: config.bundleEntry,
+                manifestName: path.relative(config.rootDir, manifestPath),
+            });
+
+            if (reportFindings(findings, { file: relative })) process.exit(1);
+
+            console.log(
+                `package-build: ${config.bundleEntry} is declared under ` +
+                    `"${declaredAs}" and loads as one.`,
+            );
+        }),
+    };
+}
+
 /**
  * `release` — zip the staged package for a GitHub release.
  *
@@ -352,7 +486,9 @@ yargs(hideBin(process.argv))
     .scriptName("package-build")
     .command(cleanCommand())
     .command(assetsCommand())
+    .command(manifestCommand())
     .command(langCommand())
+    .command(bundleCommand())
     .command(releaseCommand())
     .command(deployCommand())
     .demandCommand(1, "Name a command.")

package/bin/report.mjs

@@ -0,0 +1,108 @@
+/*
+ * This file is part of the Song of Heroic Lands (SoHL) system for Foundry VTT.
+ * Copyright (c) 2024-2026 Tom Rodriguez ("Toasty") — <toasty@heroiclands.org>
+ *
+ * This work is licensed under the GNU General Public License v3.0 (GPLv3).
+ * You may copy, modify, and distribute it under the terms of that license.
+ *
+ * For full terms, see the LICENSE.md file in the project root or visit:
+ * https://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * How the command line reports what a rule found.
+ *
+ * The package's rules are pure: they take source text and return findings,
+ * leaving discovery, I/O and reporting to whoever called them. That is what
+ * makes them testable, but it also means every caller has to decide the same
+ * two things — what a finding looks like once emitted, and what a run's exit
+ * code should be. Before there was a command line, every consumer decided them
+ * separately, and no two agreed.
+ *
+ * This module is where the binary decides them once. It lives under `bin/`
+ * rather than beside the rules deliberately: it is the *caller's* half, not
+ * part of the pure surface, and nothing importing this package as a library
+ * should reach it.
+ *
+ * The emitted form is the toolchain's diagnostic contract —
+ * `file:line:column: severity: message`, the path starting the line, a field
+ * dropped rather than guessed — which `@heroiclands/content-build` already
+ * owns. This module maps findings onto it rather than restating it, so the two
+ * packages cannot drift into two nearly-identical formats.
+ *
+ * @module
+ */
+
+import { emitDiagnostic } from "@heroiclands/content-build/engine/diagnostics";
+
+/**
+ * A finding as the pure rules report one.
+ *
+ * @typedef {object} Finding
+ * @property {string} message                 What is wrong, in one sentence.
+ * @property {"warning"|"error"} [severity]   Defaults to `error`.
+ * @property {number} [line]                  1-based line, when known.
+ * @property {number} [column]                1-based column, when known.
+ */
+
+/**
+ * Turn a rule's findings into diagnostics, attaching the file they are about.
+ *
+ * A rule is handed source text and never learns the path it came from, so the
+ * caller is the only one who can say it — and a finding without a file is one
+ * nothing can navigate to.
+ *
+ * **A field is dropped, never guessed.** A finding that knows no line emits as
+ * `file: severity: message`, because defaulting to `1:1` sends a reader to the
+ * top of the file every time and reads exactly like a real position. A column
+ * without a line is dropped for the same reason: it locates nothing on its own.
+ *
+ * @param {Finding[]} findings - What the rule returned.
+ * @param {object} opts
+ * @param {string} opts.file - Path to the file, relative to the working
+ *   directory, so the emitted line is one an editor or `cc`-style parser can
+ *   open.
+ * @returns {Array<{file: string, line?: number, column?: number,
+ *   severity: "warning"|"error", message: string}>} The diagnostics, in the
+ *   order the rule reported them.
+ */
+export function toDiagnostics(findings, { file }) {
+    return findings.map((finding) => {
+        const hasLine = finding.line !== undefined && finding.line !== null;
+        const hasColumn =
+            finding.column !== undefined && finding.column !== null;
+        return {
+            file,
+            ...(hasLine ? { line: finding.line } : {}),
+            // Only alongside a line: `formatLocator` ignores a lone column, and
+            // carrying it anyway would invite a reader to trust it.
+            ...(hasLine && hasColumn ? { column: finding.column } : {}),
+            severity: finding.severity ?? "error",
+            message: finding.message,
+        };
+    });
+}
+
+/**
+ * Emit a rule's findings and say how many of them fail the run.
+ *
+ * Warnings are emitted and counted separately from the return value, so a
+ * command can report something worth reading without failing a build over it.
+ *
+ * @param {Finding[]} findings - What the rule returned.
+ * @param {object} opts
+ * @param {string} opts.file - Path to the file, relative to the working dir.
+ * @param {(d: object) => void} [opts.emit] - How to emit one diagnostic.
+ *   Injectable so a test can capture the emitted shape without reaching for
+ *   the console; defaults to content-build's `emitDiagnostic`, which writes
+ *   both severities to stderr.
+ * @returns {number} How many diagnostics were errors — the count a command
+ *   turns into its exit code.
+ */
+export function reportFindings(findings, { file, emit = emitDiagnostic }) {
+    const diagnostics = toDiagnostics(findings, { file });
+    for (const diagnostic of diagnostics) emit(diagnostic);
+    return diagnostics.filter((d) => d.severity === "error").length;
+}

package/config.mjs

@@ -63,16 +63,43 @@ const SECTION_KEYS = [
     "stageDir",
     "assets",
     "assetTransform",
+    "manifest",
+    "manifestFlags",
     "clean",
     "lang",
     "deploy",
     "release",
+    "bundle",
 ];
+
+/**
+ * Manifest keys a repository may **not** declare, because the build derives
+ * them and would only overwrite what was written.
+ *
+ * Silently overwriting is the failure this list exists to prevent: a
+ * `version` typed into the configuration would look authoritative, sit there
+ * unread, and disagree with the shipped package forever. Declaring one is an
+ * error naming the key and where the value actually comes from.
+ *
+ * @type {Readonly<Record<string, string>>}
+ */
+export const DERIVED_MANIFEST_KEYS = Object.freeze({
+    id: "`foundryPackage`, itself derived from package.json `name`",
+    version: "package.json `version`",
+    url: "package.json `repository`",
+    bugs: "package.json `repository`",
+    manifest: "package.json `repository` and the release tag",
+    download: "package.json `repository` and the release tag",
+    compatibility: "the top level of content-build.config.yaml",
+    relationships: "the top level of content-build.config.yaml",
+    packs: "the `packs` list at the top level of content-build.config.yaml",
+});
 const ASSET_KEYS = ["from", "to"];
 const CLEAN_KEYS = ["extra"];
 const LANG_KEYS = ["sources", "help"];
 const DEPLOY_KEYS = ["envPrefix"];
 const RELEASE_KEYS = ["artifact"];
+const BUNDLE_KEYS = ["entry"];
 
 /**
  * The artifact name each package kind ships, so no repository states it.
@@ -156,6 +183,41 @@ function normalizeAsset(value, index) {
     });
 }
 
+/**
+ * Validate the manifest specification.
+ *
+ * **Deliberately not key-checked.** Everything a repository declares here is
+ * emitted into the manifest unchanged, so a key Foundry adds in a later version
+ * can be declared without waiting for a release of this package. The only rule
+ * is the one that has a wrong answer rather than an unknown one: a key the
+ * build *derives* must not also be authored, because the authored value would
+ * be silently overwritten.
+ *
+ * That is also why it is its own block rather than being spread across
+ * `packageBuild:` directly — pass-through and unknown-key checking cannot
+ * coexist in one mapping, and the keys around it are worth checking.
+ *
+ * @param {unknown} value - The `manifest` block, or `undefined`.
+ * @returns {Readonly<Record<string, unknown>>} It, frozen; `{}` when absent.
+ */
+function normalizeManifest(value) {
+    if (value === undefined) return Object.freeze({});
+    if (!isMapping(value)) fail("packageBuild.manifest", "must be a mapping");
+    const input = /** @type {Record<string, unknown>} */ (value);
+
+    for (const [key, source] of Object.entries(DERIVED_MANIFEST_KEYS)) {
+        if (input[key] !== undefined) {
+            fail(
+                `packageBuild.manifest.${key}`,
+                `is derived from ${source} and must not be declared — it ` +
+                    `would be overwritten, and the two would disagree with ` +
+                    `nothing to say so`,
+            );
+        }
+    }
+    return Object.freeze(structuredClone(input));
+}
+
 /**
  * The resolved `packageBuild` section, every optional half filled in.
  *
@@ -167,6 +229,11 @@ function normalizeAsset(value, index) {
  * @property {string} stageDir      The staged package root, relative to
  *                                   `rootDir`. Every asset `to:` lands under it.
  * @property {readonly Readonly<AssetSpec>[]} assets
+ * @property {Readonly<Record<string, unknown>>} manifest  The manifest
+ *                                   specification, emitted as declared.
+ * @property {string|null} manifestFlags  Module to load a `flags` function
+ *                                   from, for namespaced flags a repository has
+ *                                   to compute. `null` when it declares none.
  * @property {string|null} assetTransform  Module to load a `transform` from,
  *                                   resolved against `rootDir`. `null` when
  *                                   the repository stages assets verbatim.
@@ -175,6 +242,8 @@ function normalizeAsset(value, index) {
  * @property {string} langSources    Glob for the localization files to check.
  * @property {string|null} langHelp  Extra guidance printed after a failure.
  * @property {string} envPrefix      Prefix of the deploy environment variables.
+ * @property {string} bundleEntry   The bundle file Foundry loads, as the
+ *   manifest spells it. Derived from the package id.
  */
 
 /**
@@ -243,6 +312,15 @@ export function resolvePackageBuildConfig(shared) {
     );
     const releaseInput = /** @type {Record<string, unknown>} */ (release);
 
+    const bundle = section.bundle ?? {};
+    if (!isMapping(bundle)) fail("packageBuild.bundle", "must be a mapping");
+    rejectUnknownKeys(
+        /** @type {Record<string, unknown>} */ (bundle),
+        BUNDLE_KEYS,
+        "packageBuild.bundle.",
+    );
+    const bundleInput = /** @type {Record<string, unknown>} */ (bundle);
+
     return Object.freeze({
         rootDir: shared.rootDir,
         // Where the package is assembled before it is zipped or deployed. Every
@@ -280,6 +358,17 @@ export function resolvePackageBuildConfig(shared) {
                         "packageBuild.assetTransform",
                     ),
                 ),
+        manifest: normalizeManifest(section.manifest),
+        manifestFlags:
+            section.manifestFlags === undefined ?
+                null
+            :   path.resolve(
+                    shared.rootDir,
+                    requireNonEmptyString(
+                        section.manifestFlags,
+                        "packageBuild.manifestFlags",
+                    ),
+                ),
         cleanExtra: Object.freeze(cleanExtra),
         langSources:
             langInput.sources === undefined ?
@@ -299,6 +388,22 @@ export function resolvePackageBuildConfig(shared) {
                     deployInput.envPrefix,
                     "packageBuild.deploy.envPrefix",
                 ),
+        // The file Foundry loads, as the manifest spells it. Named after the
+        // package by convention, and the id is already derived from
+        // package.json `name` — so a repository states this only when its
+        // bundler emits something else.
+        //
+        // Deliberately *not* read back out of the generated manifest: the
+        // check's question is whether the manifest declares this file the way
+        // Foundry needs it, and a value taken from the manifest could never
+        // answer that — it would agree with itself by construction.
+        bundleEntry:
+            bundleInput.entry === undefined ?
+                `${shared.foundryPackage}.mjs`
+            :   requireNonEmptyString(
+                    bundleInput.entry,
+                    "packageBuild.bundle.entry",
+                ),
     });
 }
 

package/manifest.mjs

@@ -15,26 +15,35 @@
  * Building the Foundry package manifest — `system.json` or `module.json`.
  *
  * Foundry defines exactly two package kinds, and a repository is one of them,
- * so there is one job here with two spellings: read the repository's manifest
- * *template*, stamp the facts that must not be transcribed, and write the
- * result into the build stage.
- *
- * **The stamped fields are the ones a human copy rots.** A manifest carries the
- * version, the repository addresses, and the two release URLs Foundry fetches
- * to check for and install an update. Every one of them is already stated
- * somewhere that owns it — `package.json` — and a second, hand-maintained copy
- * in the template drifts the moment a release is cut. `sohl-kethira-basic`
- * hand-maintains its whole `module.json`, and its `download` still names an
- * older version than the module claims.
+ * so there is one job here with two spellings: assemble the manifest from the
+ * repository's configuration and write it into the build stage.
+ *
+ * **There is no template any more.** A manifest used to be a hand-authored
+ * `system.template.json` that this module stamped a few fields into — which
+ * made it the one build input still written as JSON, by hand, per repository,
+ * with no schema and nothing checking it. Worse, it declared facts the
+ * configuration also declared: the pack list twice, in two formats, with
+ * nothing checking that the pairs agreed. `sohl-kethira-basic` hand-maintained
+ * its whole `module.json`, and its `download` named an older version than the
+ * module claimed.
+ *
+ * So the manifest is generated (#9). Three kinds of key end up in it:
+ *
+ * - **Declared** — the `packageBuild.manifest` block, emitted unchanged, so a
+ *   key Foundry adds in a later version needs no release of this package.
+ * - **Derived** — the identity, the version, the release addresses, the
+ *   compatibility ranges and the pack list. Declaring one of these is an error
+ *   rather than an override: the authored copy would be silently overwritten.
+ * - **Computed** — namespaced `flags` a repository works out for itself.
  *
  * **Nothing here invents an address.** The repository URL is read from
- * `package.json`'s `repository` field, normalised, and everything else is
- * derived from it. A manifest that advertised another package's URLs would send
- * Foundry to the wrong release on every update check — which is exactly what a
- * template copied between repositories produces.
+ * `package.json`'s `repository` field, normalised, and everything else derived
+ * from it. A manifest advertising another package's URLs would send Foundry to
+ * the wrong release on every update check — exactly what a template copied
+ * between repositories produced.
  *
  * The rules are pure functions over data. I/O is confined to
- * {@link writeFoundryManifest}, which is the only export that touches disk.
+ * {@link writeManifest}, which is the only export that touches disk.
  *
  * @module
  */
@@ -52,34 +61,6 @@ import path from "node:path";
  */
 export const ARTIFACTS = Object.freeze(["system", "module"]);
 
-/**
- * Which artifact a template file builds.
- *
- * Inferred from the template's own name so the usual case takes no
- * configuration: a repository that ships `system.template.json` is a system,
- * and one that ships `module.template.json` is a module. That is the same pair
- * `@heroiclands/content-build` resolves a package manifest from, so the two
- * cannot disagree about what a repository is.
- *
- * @param {string} templatePath - Path to the manifest template.
- * @returns {"system"|"module"} The artifact name.
- * @throws {TypeError} When the name identifies neither kind — a template called
- *   something else leaves nothing to infer from, and guessing would silently
- *   emit a manifest Foundry never looks for.
- */
-export function artifactFromTemplate(templatePath) {
-    const base = path.basename(String(templatePath ?? ""));
-    const artifact = ARTIFACTS.find((a) => base.startsWith(`${a}.`));
-    if (!artifact) {
-        throw new TypeError(
-            `Cannot tell whether "${base}" builds a system or a module. ` +
-                `Name it system.template.json or module.template.json, or pass ` +
-                `\`artifact\` explicitly.`,
-        );
-    }
-    return artifact;
-}
-
 /**
  * The repository's web address, from whatever spelling `package.json` carries.
  *
@@ -138,80 +119,155 @@ export function releaseUrls({ repoUrl, version, artifact }) {
 }
 
 /**
- * Stamp a manifest template with the facts that must not be transcribed.
+ * The order the manifest's keys are written in.
  *
- * Pure: the template is not mutated, and the result is a new object.
+ * Foundry does not care, but a human reading a diff does, and the generated
+ * file has to be comparable against the hand-authored template it replaces —
+ * which is only possible if the order is fixed rather than incidental to which
+ * keys a repository happened to declare. Anything not listed keeps its declared
+ * order, after these.
  *
- * `flags` is merged **per namespace**, not wholesale, so a template may carry
- * its own keys under the same namespace and keep them. A caller supplies
- * whatever its package needs there — the credits journal's UUID, the settings
- * sidebar's links — because those are facts about one package, not about being
- * a Foundry package.
+ * @type {readonly string[]}
+ */
+const MANIFEST_KEY_ORDER = Object.freeze([
+    "id",
+    "title",
+    "description",
+    "version",
+    "authors",
+    "license",
+    "readme",
+    "changelog",
+    "flags",
+    "compatibility",
+    "relationships",
+    "esmodules",
+    "styles",
+    "languages",
+    "documentTypes",
+    "packFolders",
+    "packs",
+    "media",
+    "socket",
+    "grid",
+    "primaryTokenAttribute",
+    "url",
+    "bugs",
+    "manifest",
+    "download",
+]);
+
+/**
+ * The manifest's `packs`, derived from the one pack list the build already has.
  *
- * @param {object} template - The parsed manifest template.
- * @param {object} opts
- * @param {string} opts.version - The version being built.
- * @param {string} opts.repoUrl - Normalised repository URL.
- * @param {"system"|"module"} opts.artifact - Which artifact is shipped.
- * @param {Record<string, object>} [opts.flags] - Namespaced flags to merge.
- * @returns {object} The stamped manifest.
+ * The two used to be written separately — `content-build.config.yaml` declared
+ * a pack's name and type, and the manifest template declared them again beside
+ * a label, a path and a system id, with nothing checking that the pairs agreed.
+ * They are one list now.
+ *
+ * Companions are flattened in, because Foundry sees no difference: a companion
+ * is only a pack written by another pass rather than one of its own, and it
+ * ships as an ordinary compendium. The order matches `packDirectories`, so the
+ * manifest lists packs in the order the build compiles them.
+ *
+ * @param {object} config - The resolved content-build configuration.
+ * @returns {object[]} The manifest's `packs` array.
  */
-export function stampManifest(template, { version, repoUrl, artifact, flags }) {
-    const stamped = {
-        ...template,
-        version,
-        ...releaseUrls({ repoUrl, version, artifact }),
+export function manifestPacks(config) {
+    const flatten = (pack) => [
+        pack,
+        ...(pack.companions ?? []).flatMap(flatten),
+    ];
+    return config.packs.flatMap(flatten).map((pack) => ({
+        label: pack.label,
+        type: pack.type,
+        name: pack.name,
+        system: config.stats.systemId,
+        path: `packs/${pack.name}`,
+        private: pack.private,
+    }));
+}
+
+/**
+ * Build a Foundry package manifest from the resolved configuration.
+ *
+ * Three kinds of key end up in the result:
+ *
+ * - **Declared** — everything in `packageBuild.manifest`, emitted unchanged, so
+ *   a key Foundry adds later needs no release of this package.
+ * - **Derived** — the identity, the release addresses, the version, the Foundry
+ *   and system compatibility ranges, and the pack list. These are refused if
+ *   also declared: an authored copy would be overwritten and the two would
+ *   disagree with nothing to say so.
+ * - **Computed** — namespaced `flags` a repository works out for itself, merged
+ *   over any it declared.
+ *
+ * @param {object} options - Inputs.
+ * @param {object} options.config - The resolved content-build configuration.
+ * @param {object} options.packageJson - The repository's `package.json`.
+ * @param {string} options.artifact - `system` or `module`.
+ * @param {Record<string, object>} [options.flags] - Namespaced flags to merge.
+ * @returns {object} The manifest, ready to serialise.
+ */
+export function buildManifest({ config, packageJson, artifact, flags }) {
+    const declared = config.packageBuild?.manifest ?? {};
+    const repoUrl = normalizeRepoUrl(packageJson.repository);
+
+    const derived = {
+        id: config.foundryPackage,
+        version: packageJson.version,
+        packs: manifestPacks(config),
+        ...releaseUrls({ repoUrl, version: packageJson.version, artifact }),
     };
+    if (config.compatibility) derived.compatibility = config.compatibility;
+    if (config.relationships && Object.keys(config.relationships).length) {
+        derived.relationships = config.relationships;
+    }
+
+    const merged = { ...declared, ...derived };
 
     if (flags && Object.keys(flags).length) {
-        stamped.flags = { ...(template.flags ?? {}) };
+        merged.flags = { ...(declared.flags ?? {}) };
         for (const [namespace, values] of Object.entries(flags)) {
-            stamped.flags[namespace] = {
-                ...(template.flags?.[namespace] ?? {}),
+            merged.flags[namespace] = {
+                ...(declared.flags?.[namespace] ?? {}),
                 ...values,
             };
         }
     }
 
-    return stamped;
+    // Ordered, so the generated file diffs against the template it replaces.
+    const ordered = {};
+    for (const key of MANIFEST_KEY_ORDER) {
+        if (merged[key] !== undefined) ordered[key] = merged[key];
+    }
+    for (const [key, value] of Object.entries(merged)) {
+        if (!(key in ordered)) ordered[key] = value;
+    }
+    return ordered;
 }
 
 /**
- * Read a manifest template, stamp it, and write the result into the stage.
+ * Write the generated manifest into the staged package.
  *
- * The only export here that touches disk. Everything it decides is decided by
- * the pure functions above, so the rules stay testable without a filesystem.
- *
- * @param {object} opts
- * @param {string} opts.templatePath - The manifest template to read.
- * @param {object} opts.packageJson - The parsed `package.json`, which owns the
- *   version and the repository address.
- * @param {string} opts.outDir - Directory to write the manifest into, created
- *   if absent.
- * @param {"system"|"module"} [opts.artifact] - Overrides the artifact inferred
- *   from the template's name.
- * @param {Record<string, object>} [opts.flags] - Namespaced flags to merge.
- * @returns {Promise<{path: string, manifest: object}>} Where it was written,
- *   and what was written.
+ * @param {object} options - As {@link buildManifest}, plus where to write.
+ * @param {object} options.config - The resolved content-build configuration.
+ * @param {object} options.packageJson - The repository's `package.json`.
+ * @param {string} options.artifact - `system` or `module`.
+ * @param {string} options.outDir - Directory to write into.
+ * @param {Record<string, object>} [options.flags] - Namespaced flags to merge.
+ * @returns {Promise<{path: string, manifest: object}>} Where it went, and what.
  */
-export async function writeFoundryManifest({
-    templatePath,
+export async function writeManifest({
+    config,
     packageJson,
+    artifact,
     outDir,
-    artifact = undefined,
-    flags = undefined,
+    flags,
 }) {
-    const kind = artifact ?? artifactFromTemplate(templatePath);
-    const template = JSON.parse(await fs.readFile(templatePath, "utf8"));
-    const manifest = stampManifest(template, {
-        version: packageJson.version,
-        repoUrl: normalizeRepoUrl(packageJson.repository),
-        artifact: kind,
-        flags,
-    });
-
+    const manifest = buildManifest({ config, packageJson, artifact, flags });
     await fs.mkdir(outDir, { recursive: true });
-    const outPath = path.join(outDir, `${kind}.json`);
+    const outPath = path.join(outDir, `${artifact}.json`);
     // Trailing newline: the file is committed to a release archive and read by
     // humans as often as by Foundry.
     await fs.writeFile(

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@heroiclands/package-build",
-    "version": "0.2.1",
+    "version": "0.4.0",
     "description": "Shared toolchain for building and shipping a HeroicLands Foundry VTT package \u2014 manifest, localization, staging, bundle, release and deployment.",
     "license": "GPL-3.0-or-later",
     "type": "module",
@@ -72,7 +72,7 @@
         "prepare": "git config core.hooksPath .githooks || true"
     },
     "dependencies": {
-        "@heroiclands/content-build": "^0.15.0",
+        "@heroiclands/content-build": "^1.0.0",
         "acorn": "^8.18.0",
         "archiver": "^8.0.0",
         "dotenv": "^17.2.3",

package/types/config.d.mts

@@ -9,6 +9,11 @@
  * @property {string} stageDir      The staged package root, relative to
  *                                   `rootDir`. Every asset `to:` lands under it.
  * @property {readonly Readonly<AssetSpec>[]} assets
+ * @property {Readonly<Record<string, unknown>>} manifest  The manifest
+ *                                   specification, emitted as declared.
+ * @property {string|null} manifestFlags  Module to load a `flags` function
+ *                                   from, for namespaced flags a repository has
+ *                                   to compute. `null` when it declares none.
  * @property {string|null} assetTransform  Module to load a `transform` from,
  *                                   resolved against `rootDir`. `null` when
  *                                   the repository stages assets verbatim.
@@ -17,6 +22,8 @@
  * @property {string} langSources    Glob for the localization files to check.
  * @property {string|null} langHelp  Extra guidance printed after a failure.
  * @property {string} envPrefix      Prefix of the deploy environment variables.
+ * @property {string} bundleEntry   The bundle file Foundry loads, as the
+ *   manifest spells it. Derived from the package id.
  */
 /**
  * Resolve a package-build configuration from an already-loaded shared one.
@@ -44,6 +51,18 @@ export function resolvePackageBuildConfig(shared: object): Readonly<PackageBuild
  *   declares something malformed.
  */
 export function loadPackageBuildConfig(): Readonly<PackageBuildConfig>;
+/**
+ * Manifest keys a repository may **not** declare, because the build derives
+ * them and would only overwrite what was written.
+ *
+ * Silently overwriting is the failure this list exists to prevent: a
+ * `version` typed into the configuration would look authoritative, sit there
+ * unread, and disagree with the shipped package forever. Declaring one is an
+ * error naming the key and where the value actually comes from.
+ *
+ * @type {Readonly<Record<string, string>>}
+ */
+export const DERIVED_MANIFEST_KEYS: Readonly<Record<string, string>>;
 /**
  * One staging copy: a source path in the repository, and where it lands under
  * the staged package root.
@@ -84,6 +103,17 @@ export type PackageBuildConfig = {
      */
     stageDir: string;
     assets: readonly Readonly<AssetSpec>[];
+    /**
+     * The manifest
+     * specification, emitted as declared.
+     */
+    manifest: Readonly<Record<string, unknown>>;
+    /**
+     * Module to load a `flags` function
+     * from, for namespaced flags a repository has
+     * to compute. `null` when it declares none.
+     */
+    manifestFlags: string | null;
     /**
      * Module to load a `transform` from,
      * resolved against `rootDir`. `null` when
@@ -107,4 +137,9 @@ export type PackageBuildConfig = {
      * Prefix of the deploy environment variables.
      */
     envPrefix: string;
+    /**
+     * The bundle file Foundry loads, as the
+     * manifest spells it. Derived from the package id.
+     */
+    bundleEntry: string;
 };

package/types/manifest.d.mts

@@ -1,19 +1,3 @@
-/**
- * Which artifact a template file builds.
- *
- * Inferred from the template's own name so the usual case takes no
- * configuration: a repository that ships `system.template.json` is a system,
- * and one that ships `module.template.json` is a module. That is the same pair
- * `@heroiclands/content-build` resolves a package manifest from, so the two
- * cannot disagree about what a repository is.
- *
- * @param {string} templatePath - Path to the manifest template.
- * @returns {"system"|"module"} The artifact name.
- * @throws {TypeError} When the name identifies neither kind — a template called
- *   something else leaves nothing to infer from, and guessing would silently
- *   emit a manifest Foundry never looks for.
- */
-export function artifactFromTemplate(templatePath: string): "system" | "module";
 /**
  * The repository's web address, from whatever spelling `package.json` carries.
  *
@@ -59,53 +43,65 @@ export function releaseUrls({ repoUrl, version, artifact }: {
     download: string;
 };
 /**
- * Stamp a manifest template with the facts that must not be transcribed.
+ * The manifest's `packs`, derived from the one pack list the build already has.
  *
- * Pure: the template is not mutated, and the result is a new object.
+ * The two used to be written separately — `content-build.config.yaml` declared
+ * a pack's name and type, and the manifest template declared them again beside
+ * a label, a path and a system id, with nothing checking that the pairs agreed.
+ * They are one list now.
  *
- * `flags` is merged **per namespace**, not wholesale, so a template may carry
- * its own keys under the same namespace and keep them. A caller supplies
- * whatever its package needs there — the credits journal's UUID, the settings
- * sidebar's links — because those are facts about one package, not about being
- * a Foundry package.
+ * Companions are flattened in, because Foundry sees no difference: a companion
+ * is only a pack written by another pass rather than one of its own, and it
+ * ships as an ordinary compendium. The order matches `packDirectories`, so the
+ * manifest lists packs in the order the build compiles them.
  *
- * @param {object} template - The parsed manifest template.
- * @param {object} opts
- * @param {string} opts.version - The version being built.
- * @param {string} opts.repoUrl - Normalised repository URL.
- * @param {"system"|"module"} opts.artifact - Which artifact is shipped.
- * @param {Record<string, object>} [opts.flags] - Namespaced flags to merge.
- * @returns {object} The stamped manifest.
+ * @param {object} config - The resolved content-build configuration.
+ * @returns {object[]} The manifest's `packs` array.
  */
-export function stampManifest(template: object, { version, repoUrl, artifact, flags }: {
-    version: string;
-    repoUrl: string;
-    artifact: "system" | "module";
+export function manifestPacks(config: object): object[];
+/**
+ * Build a Foundry package manifest from the resolved configuration.
+ *
+ * Three kinds of key end up in the result:
+ *
+ * - **Declared** — everything in `packageBuild.manifest`, emitted unchanged, so
+ *   a key Foundry adds later needs no release of this package.
+ * - **Derived** — the identity, the release addresses, the version, the Foundry
+ *   and system compatibility ranges, and the pack list. These are refused if
+ *   also declared: an authored copy would be overwritten and the two would
+ *   disagree with nothing to say so.
+ * - **Computed** — namespaced `flags` a repository works out for itself, merged
+ *   over any it declared.
+ *
+ * @param {object} options - Inputs.
+ * @param {object} options.config - The resolved content-build configuration.
+ * @param {object} options.packageJson - The repository's `package.json`.
+ * @param {string} options.artifact - `system` or `module`.
+ * @param {Record<string, object>} [options.flags] - Namespaced flags to merge.
+ * @returns {object} The manifest, ready to serialise.
+ */
+export function buildManifest({ config, packageJson, artifact, flags }: {
+    config: object;
+    packageJson: object;
+    artifact: string;
     flags?: Record<string, object> | undefined;
 }): object;
 /**
- * Read a manifest template, stamp it, and write the result into the stage.
+ * Write the generated manifest into the staged package.
  *
- * The only export here that touches disk. Everything it decides is decided by
- * the pure functions above, so the rules stay testable without a filesystem.
- *
- * @param {object} opts
- * @param {string} opts.templatePath - The manifest template to read.
- * @param {object} opts.packageJson - The parsed `package.json`, which owns the
- *   version and the repository address.
- * @param {string} opts.outDir - Directory to write the manifest into, created
- *   if absent.
- * @param {"system"|"module"} [opts.artifact] - Overrides the artifact inferred
- *   from the template's name.
- * @param {Record<string, object>} [opts.flags] - Namespaced flags to merge.
- * @returns {Promise<{path: string, manifest: object}>} Where it was written,
- *   and what was written.
+ * @param {object} options - As {@link buildManifest}, plus where to write.
+ * @param {object} options.config - The resolved content-build configuration.
+ * @param {object} options.packageJson - The repository's `package.json`.
+ * @param {string} options.artifact - `system` or `module`.
+ * @param {string} options.outDir - Directory to write into.
+ * @param {Record<string, object>} [options.flags] - Namespaced flags to merge.
+ * @returns {Promise<{path: string, manifest: object}>} Where it went, and what.
  */
-export function writeFoundryManifest({ templatePath, packageJson, outDir, artifact, flags, }: {
-    templatePath: string;
+export function writeManifest({ config, packageJson, artifact, outDir, flags, }: {
+    config: object;
     packageJson: object;
+    artifact: string;
     outDir: string;
-    artifact?: "module" | "system" | undefined;
     flags?: Record<string, object> | undefined;
 }): Promise<{
     path: string;