@skaile/workspaces 0.29.1 → 0.31.0

package/dist/{chunk-MIH45XPY.js → chunk-LA2YSXEE.js}

@@ -1,15 +1,15 @@
-import { readManifestSourceConfig, discoverAssetsInTree } from './chunk-JIQLLZ65.js';
-import { installFromManifest } from './chunk-Z3XXKR5E.js';
-import { parseAssetRef } from './chunk-IEJ5IOC3.js';
-import { PresetManifestSchema } from './chunk-QDJKE557.js';
+import { readManifestSourceConfig, discoverAssetsInTree } from './chunk-7MANNJ3U.js';
+import { installFromManifest } from './chunk-WDMH4UMD.js';
+import { parseAssetRef } from './chunk-LFDZYCEO.js';
+import { PresetManifestSchema } from './chunk-HRKB2ATT.js';
 import { __export } from './chunk-NSBPE2FW.js';
-import * as crypto from 'crypto';
-import * as fs11 from 'fs';
-import * as path4 from 'path';
-import { eq, like, and } from 'drizzle-orm';
-import * as z2 from 'zod';
+import * as fs10 from 'fs';
 import * as os from 'os';
+import * as path5 from 'path';
 import { stringify, parse, parseDocument } from 'yaml';
+import * as z3 from 'zod';
+import * as crypto from 'crypto';
+import { eq, like, and } from 'drizzle-orm';
 import { createClient } from '@libsql/client';
 import { drizzle } from 'drizzle-orm/libsql';
 import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
@@ -74,46 +74,48 @@ var InstanceHasConsumersError = class extends LibraryError {
     this.name = "InstanceHasConsumersError";
   }
 };
+
+// library/src/config.ts
 var LOCAL_CATALOG_URL = "local";
 function isLocalCatalogUrl(url) {
   return typeof url === "string" && url.trim().toLowerCase() === LOCAL_CATALOG_URL;
 }
-var CatalogConfigSchema = z2.object({
+var CatalogConfigSchema = z3.object({
   /** Catalog base URL, or `"local"` (case-insensitive) to disable the remote catalog. Default: https://skaile.store */
-  url: z2.union([
-    z2.string().url(),
+  url: z3.union([
+    z3.string().url(),
     // Accept any casing/whitespace variant of "local", normalise to canonical.
-    z2.string().refine((s) => s.trim().toLowerCase() === LOCAL_CATALOG_URL, {
+    z3.string().refine((s) => s.trim().toLowerCase() === LOCAL_CATALOG_URL, {
       message: `Expected a valid URL or "${LOCAL_CATALOG_URL}"`
     }).transform(() => LOCAL_CATALOG_URL)
   ]).optional(),
   /** Cache TTL in seconds. 0 = air-gapped (manual `skaile update` only). */
-  cache_ttl: z2.number().int().min(0).optional(),
+  cache_ttl: z3.number().int().min(0).optional(),
   /**
    * Wire framing to use when talking to a remote catalog.
    * `"trpc"` — skaile.store tRPC backend (default for `https://skaile.store`).
    * `"rest"` — forge-store REST backend (default for any other URL).
    */
-  framing: z2.enum(["trpc", "rest"]).optional()
+  framing: z3.enum(["trpc", "rest"]).optional()
 });
-var LibraryConfigSchema = z2.object({
+var LibraryConfigSchema = z3.object({
   /** Library storage directory. Default: ~/.skaile/libraries */
-  dir: z2.string().optional(),
+  dir: z3.string().optional(),
   /** Default pin policy for new instances/assignments. */
-  pin_policy: z2.enum(PIN_POLICIES).optional()
+  pin_policy: z3.enum(PIN_POLICIES).optional()
 });
-var SkaileConfigSchema = z2.object({
+var SkaileConfigSchema = z3.object({
   catalog: CatalogConfigSchema.optional(),
   library: LibraryConfigSchema.optional()
 });
 function skaileHomeDir() {
-  return path4.join(os.homedir(), ".skaile");
+  return path5.join(os.homedir(), ".skaile");
 }
 function defaultLibraryDir() {
-  return path4.join(skaileHomeDir(), "libraries");
+  return path5.join(skaileHomeDir(), "libraries");
 }
 function defaultIndexPath() {
-  return path4.join(skaileHomeDir(), "index.db");
+  return path5.join(skaileHomeDir(), "index.db");
 }
 function resolveLibraryDir() {
   if (process.env.SKAILE_LIBRARIES_DIR) return process.env.SKAILE_LIBRARIES_DIR;
@@ -131,15 +133,15 @@ function getConfigDefaults() {
 }
 var CONFIG_FILENAME = "config.yaml";
 function userConfigPath() {
-  return path4.join(os.homedir(), ".skaile", CONFIG_FILENAME);
+  return path5.join(os.homedir(), ".skaile", CONFIG_FILENAME);
 }
 function projectConfigPath(projectDir) {
-  return path4.join(projectDir, ".skaile", CONFIG_FILENAME);
+  return path5.join(projectDir, ".skaile", CONFIG_FILENAME);
 }
 function loadConfigFile(filePath) {
-  if (!fs11.existsSync(filePath)) return null;
+  if (!fs10.existsSync(filePath)) return null;
   try {
-    const content = fs11.readFileSync(filePath, "utf-8");
+    const content = fs10.readFileSync(filePath, "utf-8");
     const raw = parse(content);
     if (!raw || typeof raw !== "object") return null;
     return SkaileConfigSchema.partial().parse(raw);
@@ -187,12 +189,76 @@ function resolveConfig(opts) {
   return resolved;
 }
 function saveConfig(filePath, config) {
-  const dir = path4.dirname(filePath);
-  if (!fs11.existsSync(dir)) {
-    fs11.mkdirSync(dir, { recursive: true });
+  const dir = path5.dirname(filePath);
+  if (!fs10.existsSync(dir)) {
+    fs10.mkdirSync(dir, { recursive: true });
+  }
+  fs10.writeFileSync(filePath, stringify(config, { indent: 2 }), "utf-8");
+}
+var KnowledgeManifestSchema = z3.looseObject({
+  name: z3.string().optional(),
+  description: z3.string().optional(),
+  version: z3.string().optional(),
+  files: z3.array(z3.string()).optional(),
+  keywords: z3.array(z3.string()).optional(),
+  license: z3.string().optional()
+});
+function validateKnowledge(data) {
+  const result = KnowledgeManifestSchema.safeParse(data);
+  if (result.success) {
+    return { ok: true, data: result.data };
+  }
+  return {
+    ok: false,
+    errors: result.error.issues.map((issue) => ({
+      path: issue.path.join("."),
+      message: issue.message
+    }))
+  };
+}
+
+// library/src/knowledge/knowledge-kind-provider.ts
+function collectDirRecursive(baseDir, relativeDir) {
+  const full = path5.join(baseDir, relativeDir);
+  if (!fs10.existsSync(full) || !fs10.statSync(full).isDirectory()) return [];
+  const results = [];
+  for (const entry of fs10.readdirSync(full, { withFileTypes: true })) {
+    const rel = path5.posix.join(relativeDir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...collectDirRecursive(baseDir, rel));
+    } else if (entry.isFile()) {
+      results.push(rel);
+    }
   }
-  fs11.writeFileSync(filePath, stringify(config, { indent: 2 }), "utf-8");
+  return results;
 }
+var knowledgeKindProvider = {
+  kind: "knowledge",
+  displayName: "Knowledge",
+  providerVersion: "1.0.0",
+  discoveryPatterns: ["**/knowledge.yaml", "**/knowledge/index.yaml"],
+  matchesPath(relativePath) {
+    const parts = relativePath.split("/");
+    const filename = parts[parts.length - 1] ?? "";
+    if (filename === "knowledge.yaml") return true;
+    if (filename === "index.yaml" && parts.length >= 2 && parts[parts.length - 2] === "knowledge") {
+      return true;
+    }
+    return false;
+  },
+  validateManifest(data) {
+    return validateKnowledge(data);
+  },
+  defaultFileFilter(manifestPath) {
+    const dir = path5.dirname(manifestPath);
+    const manifestName = path5.basename(manifestPath);
+    const files = [manifestName];
+    files.push(...collectDirRecursive(dir, "documents"));
+    files.sort();
+    return { assetRoot: dir, files };
+  }
+  // Knowledge has no cross-asset dependency edges — omit extractRequires
+};
 
 // library/src/local/schema.ts
 var schema_exports = {};
@@ -265,23 +331,23 @@ var assignments = sqliteTable("assignments", {
 });
 var SKAILE_HOME_ENV = "SKAILE_HOME";
 function getSidecarRoot() {
-  const home = process.env[SKAILE_HOME_ENV] ?? path4.join(os.homedir(), ".skaile");
-  return path4.join(home, "sources");
+  const home = process.env[SKAILE_HOME_ENV] ?? path5.join(os.homedir(), ".skaile");
+  return path5.join(home, "sources");
 }
 function resolveSidecarPaths(slug) {
   const rootDir = getSidecarRoot();
-  const sidecarDir = path4.join(rootDir, slug);
+  const sidecarDir = path5.join(rootDir, slug);
   return {
     rootDir,
     sidecarDir,
-    manifestFile: path4.join(sidecarDir, "skaile.manifest.yaml"),
-    readmeFile: path4.join(sidecarDir, "README.md"),
-    lockFile: path4.join(sidecarDir, "skaile.manifest.lock.json")
+    manifestFile: path5.join(sidecarDir, "skaile.manifest.yaml"),
+    readmeFile: path5.join(sidecarDir, "README.md"),
+    lockFile: path5.join(sidecarDir, "skaile.manifest.lock.json")
   };
 }
 function deriveSlug(sourceConfig, sourcePath, existingSlugs) {
   const fromConfig = sourceConfig && typeof sourceConfig.name === "string" ? sourceConfig.name : void 0;
-  const base = fromConfig && fromConfig.length > 0 ? slugify(fromConfig) : slugify(path4.basename(sourcePath || "")) || "unnamed-source";
+  const base = fromConfig && fromConfig.length > 0 ? slugify(fromConfig) : slugify(path5.basename(sourcePath || "")) || "unnamed-source";
   const taken = new Set(existingSlugs);
   if (!taken.has(base)) return base;
   for (let i = 2; i < 1e3; i++) {
@@ -292,9 +358,9 @@ function deriveSlug(sourceConfig, sourcePath, existingSlugs) {
 }
 function listSidecarSlugsOnDisk() {
   const root = getSidecarRoot();
-  if (!fs11.existsSync(root)) return [];
+  if (!fs10.existsSync(root)) return [];
   const out = [];
-  for (const entry of fs11.readdirSync(root, { withFileTypes: true })) {
+  for (const entry of fs10.readdirSync(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith(".")) continue;
     out.push(entry.name);
@@ -307,40 +373,37 @@ function slugify(input) {
 
 // library/src/local/store-paths.ts
 function getStoreRoot() {
-  const home = process.env.SKAILE_HOME ?? path4.join(os.homedir(), ".skaile");
-  return path4.join(home, "store");
+  const home = process.env.SKAILE_HOME ?? path5.join(os.homedir(), ".skaile");
+  return path5.join(home, "store");
 }
 function getStoreManifestsDir() {
-  return path4.join(getStoreRoot(), "manifests");
+  return path5.join(getStoreRoot(), "manifests");
 }
 function migratedMarkerPath() {
-  return path4.join(getStoreRoot(), ".migrated");
+  return path5.join(getStoreRoot(), ".migrated");
 }
-function migrateSidecarsToStoreIfNeeded() {
-  const storeRoot = getStoreRoot();
-  const marker = migratedMarkerPath();
-  if (fs11.existsSync(marker)) return { migrated: 0, storeRoot };
-  const sidecarRoot = getSidecarRoot();
-  const manifestsDir = getStoreManifestsDir();
+function collectSidecarMigrationCandidates(sidecarRoot) {
   const candidates = [];
-  if (fs11.existsSync(sidecarRoot)) {
-    for (const entry of fs11.readdirSync(sidecarRoot, { withFileTypes: true })) {
+  if (fs10.existsSync(sidecarRoot)) {
+    for (const entry of fs10.readdirSync(sidecarRoot, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       if (entry.name.startsWith(".")) continue;
-      const sidecarDir = path4.join(sidecarRoot, entry.name);
-      const current = path4.join(sidecarDir, "skaile.manifest.yaml");
-      const legacy = path4.join(sidecarDir, ".skaile-source.yaml");
-      const src = fs11.existsSync(current) ? current : fs11.existsSync(legacy) ? legacy : void 0;
+      const sidecarDir = path5.join(sidecarRoot, entry.name);
+      const current = path5.join(sidecarDir, "skaile.manifest.yaml");
+      const legacy = path5.join(sidecarDir, ".skaile-source.yaml");
+      const src = fs10.existsSync(current) ? current : fs10.existsSync(legacy) ? legacy : void 0;
       if (src) candidates.push({ src, slug: entry.name });
     }
   }
-  fs11.mkdirSync(manifestsDir, { recursive: true });
+  return candidates;
+}
+function moveSidecarManifests(candidates, manifestsDir) {
   let migrated = 0;
   for (const { src, slug } of candidates) {
-    const dest = path4.join(manifestsDir, `${slug}.yaml`);
-    if (fs11.existsSync(dest)) continue;
+    const dest = path5.join(manifestsDir, `${slug}.yaml`);
+    if (fs10.existsSync(dest)) continue;
     try {
-      fs11.renameSync(src, dest);
+      fs10.renameSync(src, dest);
       migrated++;
     } catch (err) {
       process.stderr.write(
@@ -349,18 +412,31 @@ function migrateSidecarsToStoreIfNeeded() {
       );
     }
   }
-  if (!fs11.existsSync(path4.join(storeRoot, ".git"))) {
-    try {
-      spawnSync("git", ["init", "--quiet"], { cwd: storeRoot, stdio: "ignore" });
-      fs11.writeFileSync(
-        path4.join(storeRoot, ".gitignore"),
-        "# Remote-store cache \u2014 local to this machine.\nremote-cache/\n",
-        "utf8"
-      );
-    } catch {
-    }
+  return migrated;
+}
+function initStoreGitRepo(storeRoot) {
+  if (fs10.existsSync(path5.join(storeRoot, ".git"))) return;
+  try {
+    spawnSync("git", ["init", "--quiet"], { cwd: storeRoot, stdio: "ignore" });
+    fs10.writeFileSync(
+      path5.join(storeRoot, ".gitignore"),
+      "# Remote-store cache \u2014 local to this machine.\nremote-cache/\n",
+      "utf8"
+    );
+  } catch {
   }
-  fs11.writeFileSync(marker, (/* @__PURE__ */ new Date()).toISOString(), "utf8");
+}
+function migrateSidecarsToStoreIfNeeded() {
+  const storeRoot = getStoreRoot();
+  const marker = migratedMarkerPath();
+  if (fs10.existsSync(marker)) return { migrated: 0, storeRoot };
+  const sidecarRoot = getSidecarRoot();
+  const manifestsDir = getStoreManifestsDir();
+  const candidates = collectSidecarMigrationCandidates(sidecarRoot);
+  fs10.mkdirSync(manifestsDir, { recursive: true });
+  const migrated = moveSidecarManifests(candidates, manifestsDir);
+  initStoreGitRepo(storeRoot);
+  fs10.writeFileSync(marker, (/* @__PURE__ */ new Date()).toISOString(), "utf8");
   return { migrated, storeRoot };
 }
 
@@ -441,7 +517,7 @@ async function librariesPresent(client) {
   return rs.rows.length > 0;
 }
 function slugify2(p) {
-  const base = path4.basename(p) || "lib";
+  const base = path5.basename(p) || "lib";
   return base.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-|-$/g, "") || "lib";
 }
 async function runLibrariesMigration(client) {
@@ -527,23 +603,23 @@ async function runAssignmentsMigration(client) {
   ]);
 }
 function assertNoLegacyLibDb(newDbPath) {
-  if (fs11.existsSync(newDbPath)) return;
-  const parent = path4.dirname(newDbPath);
-  const skaileHome = path4.join(os.homedir(), ".skaile");
-  const defaultIndexPath2 = path4.join(skaileHome, "index.db");
+  if (fs10.existsSync(newDbPath)) return;
+  const parent = path5.dirname(newDbPath);
+  const skaileHome = path5.join(os.homedir(), ".skaile");
+  const defaultIndexPath2 = path5.join(skaileHome, "index.db");
   const candidates = [];
-  if (path4.basename(newDbPath) === "index.db") {
-    candidates.push(path4.join(parent, "lib.db"));
+  if (path5.basename(newDbPath) === "index.db") {
+    candidates.push(path5.join(parent, "lib.db"));
   }
   if (newDbPath === defaultIndexPath2) {
-    candidates.push(path4.join(skaileHome, "libraries", "lib.db"));
-    candidates.push(path4.join(skaileHome, "library", "lib.db"));
+    candidates.push(path5.join(skaileHome, "libraries", "lib.db"));
+    candidates.push(path5.join(skaileHome, "library", "lib.db"));
   }
-  if (path4.basename(parent) === "libraries") {
-    candidates.push(path4.join(path4.dirname(parent), "library", "lib.db"));
+  if (path5.basename(parent) === "libraries") {
+    candidates.push(path5.join(path5.dirname(parent), "library", "lib.db"));
   }
   for (const legacy of candidates) {
-    if (!fs11.existsSync(legacy)) continue;
+    if (!fs10.existsSync(legacy)) continue;
     throw new Error(
       `Found legacy index database at ${legacy}. The lib.db \u2192 index.db relocation ran for one release and has been removed. Move the file manually to ${newDbPath} (and any -wal / -shm siblings), then retry.`
     );
@@ -683,26 +759,26 @@ var LocalIndex = class {
     let dbPath;
     if (typeof optionsOrDir === "string") {
       dir = optionsOrDir;
-      dbPath = path4.join(dir, "index.db");
+      dbPath = path5.join(dir, "index.db");
     } else if (optionsOrDir?.indexPath) {
       dbPath = optionsOrDir.indexPath;
       dir = optionsOrDir.libraryDir ?? resolveLibraryDir();
       this._kindRegistry = optionsOrDir.kindRegistry;
     } else if (optionsOrDir?.libraryDir) {
       dir = optionsOrDir.libraryDir;
-      dbPath = path4.join(dir, "index.db");
+      dbPath = path5.join(dir, "index.db");
       this._kindRegistry = optionsOrDir.kindRegistry;
     } else {
       dir = resolveLibraryDir();
       dbPath = resolveIndexPath();
       this._kindRegistry = optionsOrDir?.kindRegistry;
     }
-    if (!fs11.existsSync(dir)) {
-      fs11.mkdirSync(dir, { recursive: true });
+    if (!fs10.existsSync(dir)) {
+      fs10.mkdirSync(dir, { recursive: true });
     }
-    const dbParent = path4.dirname(dbPath);
-    if (!fs11.existsSync(dbParent)) {
-      fs11.mkdirSync(dbParent, { recursive: true });
+    const dbParent = path5.dirname(dbPath);
+    if (!fs10.existsSync(dbParent)) {
+      fs10.mkdirSync(dbParent, { recursive: true });
     }
     this.libraryDir = dir;
     this.dbPath = dbPath;
@@ -900,7 +976,7 @@ var LocalIndex = class {
    * @returns The created Instance plus its on-disk install path.
    */
   async install(manifest, opts) {
-    const libraryRoot = opts?.libraryRoot ?? path4.join(this.libraryDir, "installed");
+    const libraryRoot = opts?.libraryRoot ?? path5.join(this.libraryDir, "installed");
     const { installPath } = await installFromManifest({
       manifest,
       libraryRoot,
@@ -1329,8 +1405,8 @@ var LibraryManager = class {
     const lib = await this.requireLibrary(nameOrId);
     const db = await this.lib.dbHandle();
     await db.delete(libraries).where(eq(libraries.id, lib.id)).run();
-    if (opts.purge && fs11.existsSync(lib.path)) {
-      fs11.rmSync(lib.path, { recursive: true, force: true });
+    if (opts.purge && fs10.existsSync(lib.path)) {
+      fs10.rmSync(lib.path, { recursive: true, force: true });
     }
   }
   /**
@@ -1346,8 +1422,8 @@ var LibraryManager = class {
       (l) => l.isDefault && (l.ownership === "owner" || l.ownership === "contributor")
     );
     if (writableDefault) return { library: writableDefault, created: false };
-    const personalPath = path4.join(librariesDir, "personal");
-    fs11.mkdirSync(personalPath, { recursive: true });
+    const personalPath = path5.join(librariesDir, "personal");
+    fs10.mkdirSync(personalPath, { recursive: true });
     const lib = await this.addLibrary({
       name: "personal",
       path: personalPath,
@@ -1365,6 +1441,121 @@ var LibraryManager = class {
     return { library: lib, created: true };
   }
 };
+
+// library/src/local/local-catalog-source.ts
+var LocalCatalogSource = class {
+  constructor(library, sourceId, rootPath, registry, options) {
+    this.library = library;
+    this.sourceId = sourceId;
+    this.rootPath = rootPath;
+    this.registry = registry;
+    this.id = `local:${sourceId}`;
+    this.sidecarPath = options?.sidecarPath;
+  }
+  library;
+  sourceId;
+  rootPath;
+  registry;
+  id;
+  sidecarPath;
+  async resolve(ref) {
+    const def = await this.library.getAssetDef(ref);
+    if (!def || def.libraryId !== this.sourceId) return null;
+    return defToCatalogAsset(def);
+  }
+  async listAssets(filter) {
+    const libraryFilter = { libraryId: this.sourceId };
+    if (filter?.kind) libraryFilter.kind = filter.kind;
+    if (filter?.publisher) libraryFilter.publisher = filter.publisher;
+    if (filter?.prefix) libraryFilter.prefix = filter.prefix;
+    const defs = await this.library.listAssetDefs(libraryFilter);
+    return defs.map(defToCatalogAsset);
+  }
+  async listVersions(ref) {
+    const parsed = parseAssetRef(ref);
+    const defs = await this.library.listAssetDefs({
+      libraryId: this.sourceId,
+      kind: parsed.kind
+    });
+    const wantPublisher = parsed.publisher?.replace(/^@/, "");
+    return defs.filter(
+      (d) => d.name === parsed.name && (wantPublisher === void 0 || d.publisher.replace(/^@/, "") === wantPublisher)
+    ).map((d) => d.version);
+  }
+  async fetchTarball(_ref, _sha256) {
+    throw new Error(
+      "LocalCatalogSource does not support tarball delivery. Assets are available on disk."
+    );
+  }
+  async listSources() {
+    return [{ id: this.sourceId, type: "local", url: this.rootPath }];
+  }
+  /**
+   * Sync: discover assets in the source directory and cache them in the library.
+   *
+   * Runs the discovery pipeline (glob -> parse -> filter -> hash -> requires)
+   * and upserts each discovered asset into the LocalIndex cache.
+   *
+   * @param syncOpts - When `includeDev` is set, assets under the source
+   *   config's `dev_paths` (e.g. `ai-assets-dev/`) are discovered and cached
+   *   too. Defaults to excluding them (a normal run).
+   * @returns Discovery statistics and any errors encountered.
+   */
+  async sync(syncOpts) {
+    const opts = {
+      registry: this.registry,
+      sidecarPath: this.sidecarPath,
+      includeDev: syncOpts?.includeDev ?? false
+    };
+    if (!this.sidecarPath) {
+      opts.sourceConfig = readManifestSourceConfig(this.rootPath);
+    }
+    const result = discoverAssetsInTree(this.rootPath, opts);
+    let assetsUpdated = 0;
+    const errors = [];
+    for (const asset of result.assets) {
+      if (asset.kind === "preset") continue;
+      try {
+        await this.library.upsertAssetDef({
+          id: asset.ref,
+          kind: asset.kind,
+          publisher: asset.publisher,
+          name: asset.name,
+          version: asset.version,
+          sha256: asset.sha256,
+          description: typeof asset.manifest.description === "string" ? asset.manifest.description : void 0,
+          license: typeof asset.manifest.license === "string" ? asset.manifest.license : void 0,
+          category: typeof asset.manifest.category === "string" ? asset.manifest.category : void 0,
+          manifest: asset.manifest,
+          libraryId: this.sourceId,
+          cachedAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+        assetsUpdated++;
+      } catch (err) {
+        errors.push(`${asset.ref}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    for (const err of result.errors) {
+      errors.push(`${err.path}: ${err.error}`);
+    }
+    return { assetsFound: result.assets.length, assetsUpdated, errors };
+  }
+};
+function defToCatalogAsset(def) {
+  return {
+    id: def.id,
+    kind: def.kind,
+    publisher: def.publisher,
+    name: def.name,
+    version: def.version,
+    sha256: def.sha256,
+    description: def.description,
+    license: def.license,
+    category: def.category,
+    manifest: def.manifest
+  };
+}
 var FALLBACK_USER_NAME = "Skaile CLI";
 var FALLBACK_USER_EMAIL = "skaile-cli@local";
 var ROOT_README = `# Skaile Sidecar Manifests
@@ -1409,21 +1600,21 @@ var SidecarGit = class {
    * @docLink packages/library/concepts#sidecar-git
    */
   async ensureInitialized() {
-    if (!fs11.existsSync(this.rootDir)) {
-      fs11.mkdirSync(this.rootDir, { recursive: true });
+    if (!fs10.existsSync(this.rootDir)) {
+      fs10.mkdirSync(this.rootDir, { recursive: true });
     }
-    const gitDir = path4.join(this.rootDir, ".git");
-    const freshRepo = !fs11.existsSync(gitDir);
+    const gitDir = path5.join(this.rootDir, ".git");
+    const freshRepo = !fs10.existsSync(gitDir);
     if (freshRepo) {
       const init = this.spawn(["init", "-b", "main"]);
       if (init.exitCode !== 0) {
         throw new Error(`git init failed: ${init.stderr || init.stdout}`);
       }
     }
-    const attrsPath = path4.join(this.rootDir, ".gitattributes");
-    if (!fs11.existsSync(attrsPath)) fs11.writeFileSync(attrsPath, GITATTRIBUTES, "utf-8");
-    const readmePath = path4.join(this.rootDir, "README.md");
-    if (!fs11.existsSync(readmePath)) fs11.writeFileSync(readmePath, ROOT_README, "utf-8");
+    const attrsPath = path5.join(this.rootDir, ".gitattributes");
+    if (!fs10.existsSync(attrsPath)) fs10.writeFileSync(attrsPath, GITATTRIBUTES, "utf-8");
+    const readmePath = path5.join(this.rootDir, "README.md");
+    if (!fs10.existsSync(readmePath)) fs10.writeFileSync(readmePath, ROOT_README, "utf-8");
     if (!this.hasGlobalGitConfig("user.name")) {
       this.spawn(["config", "user.name", FALLBACK_USER_NAME]);
     }
@@ -1448,8 +1639,8 @@ var SidecarGit = class {
    */
   async commit(slug, message, opts) {
     if (opts?.skip) return;
-    const slugDir = path4.join(this.rootDir, slug);
-    if (fs11.existsSync(slugDir)) {
+    const slugDir = path5.join(this.rootDir, slug);
+    if (fs10.existsSync(slugDir)) {
       this.spawn(["add", "--", slug]);
     } else {
       this.spawn(["add", "-A"]);
@@ -1507,181 +1698,30 @@ ${result.stderr}`;
     return result.exitCode === 0;
   }
 };
-var PinPolicySchema = z2.enum(PIN_POLICIES);
-var LibraryInstanceRefSchema = z2.object({
-  id: z2.string().uuid(),
-  alias: z2.string().optional()
-});
-var LibrarySectionSchema = z2.object({
-  pin_policy: PinPolicySchema.default("minor-track"),
-  instances: z2.array(LibraryInstanceRefSchema).default([])
-});
-var PresetAppliedItemSchema = z2.object({
-  instance_id: z2.string().uuid(),
-  def_ref: z2.string()
-});
-var PresetAppliedSchema = z2.object({
-  ref: z2.string(),
-  applied_at: z2.string(),
-  items: z2.array(PresetAppliedItemSchema).default([])
-});
-var WorkspaceConfigV2Schema = z2.object({
-  version: z2.literal(2),
-  library: LibrarySectionSchema.optional(),
-  presets_applied: z2.array(PresetAppliedSchema).optional()
-});
-var LockAssignmentSchema = z2.object({
-  assignment_id: z2.string().uuid(),
-  instance_id: z2.string().uuid(),
-  def_ref: z2.string(),
-  resolved_version: z2.string(),
-  resolved_sha256: z2.string().optional(),
-  pin_policy: PinPolicySchema
-});
-var RequiresEdgeSchema = z2.object({
-  from: z2.string(),
-  to: z2.string(),
-  kind: z2.string().optional()
-});
-var PresetExpandedSchema = z2.object({
-  preset_ref: z2.string(),
-  instance_ids: z2.array(z2.string().uuid())
-});
-var LockFileSchema = z2.object({
-  version: z2.literal(2),
-  generated_at: z2.string(),
-  assignments: z2.array(LockAssignmentSchema).default([]),
-  requires_graph: z2.array(RequiresEdgeSchema).default([]),
-  presets_expanded: z2.array(PresetExpandedSchema).default([])
-});
-function parseWorkspaceV2(raw) {
-  if (raw.version !== 2) return null;
-  return WorkspaceConfigV2Schema.parse(raw);
-}
-function loadWorkspaceV2(dir, filename = "skaile.yaml") {
-  const filePath = path4.join(dir, filename);
-  if (!fs11.existsSync(filePath)) return null;
-  const content = fs11.readFileSync(filePath, "utf-8");
+function migrateWorkspaceConfig(dir, opts) {
+  const filename = opts?.filename ?? "skaile.yaml";
+  const filePath = path5.join(dir, filename);
+  if (!fs10.existsSync(filePath)) {
+    return { migrated: false, version: 1, warnings: ["No skaile.yaml found"] };
+  }
+  const content = fs10.readFileSync(filePath, "utf-8");
   const raw = parse(content);
-  if (!raw || typeof raw !== "object") return null;
-  return parseWorkspaceV2(raw);
-}
-function saveWorkspaceV2(dir, v2, filename = "skaile.yaml") {
-  const filePath = path4.join(dir, filename);
-  let existing = {};
-  if (fs11.existsSync(filePath)) {
-    const content = fs11.readFileSync(filePath, "utf-8");
-    existing = parse(content) ?? {};
+  if (!raw || typeof raw !== "object") {
+    return { migrated: false, version: 1, warnings: ["Invalid YAML content"] };
   }
-  existing.version = 2;
-  if (v2.library !== void 0) existing.library = v2.library;
-  if (v2.presets_applied !== void 0) existing.presets_applied = v2.presets_applied;
-  if (!fs11.existsSync(dir)) {
-    fs11.mkdirSync(dir, { recursive: true });
+  if (raw.version === 2) {
+    return { migrated: false, version: 2, warnings: [] };
   }
-  fs11.writeFileSync(filePath, stringify(existing, { indent: 2 }), "utf-8");
-}
-var LOCK_FILENAME = "skaile.lock.yaml";
-function loadLockFile(dir) {
-  const filePath = path4.join(dir, LOCK_FILENAME);
-  if (!fs11.existsSync(filePath)) return null;
-  const content = fs11.readFileSync(filePath, "utf-8");
-  const raw = parse(content);
-  if (raw !== null && !("assignments" in raw) && "subscriptions" in raw) {
-    const legacySubs = raw["subscriptions"];
-    raw["assignments"] = Array.isArray(legacySubs) ? legacySubs.map((s) => {
-      if (s !== null && typeof s === "object" && "subscription_id" in s && !("assignment_id" in s)) {
-        const { subscription_id, ...rest } = s;
-        return { assignment_id: subscription_id, ...rest };
-      }
-      return s;
-    }) : [];
-    delete raw["subscriptions"];
+  const warnings = [];
+  if (raw.dependencies && Array.isArray(raw.dependencies)) {
+    warnings.push(
+      "v1 'dependencies' field found. In v2, use 'library.instances' to reference configured asset instances. Manual migration recommended."
+    );
   }
-  return LockFileSchema.parse(raw);
-}
-function saveLockFile(dir, lock) {
-  const filePath = path4.join(dir, LOCK_FILENAME);
-  if (!fs11.existsSync(dir)) {
-    fs11.mkdirSync(dir, { recursive: true });
-  }
-  fs11.writeFileSync(
-    filePath,
-    `# Auto-generated by skaile. Do not edit manually.
-${stringify(lock, { indent: 2 })}`,
-    "utf-8"
-  );
-}
-function createEmptyLockFile() {
-  return {
-    version: 2,
-    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
-    assignments: [],
-    requires_graph: [],
-    presets_expanded: []
-  };
-}
-function detectWorkspaceVersion(dir, filename = "skaile.yaml") {
-  const filePath = path4.join(dir, filename);
-  if (!fs11.existsSync(filePath)) return null;
-  const content = fs11.readFileSync(filePath, "utf-8");
-  const raw = parse(content);
-  if (!raw || typeof raw !== "object") return null;
-  return raw.version === 2 ? 2 : 1;
-}
-var MANIFEST_FILENAME = "skaile.manifest.yaml";
-async function writeManifestIfMissing(input) {
-  const manifestPath = path4.join(input.libraryPath, MANIFEST_FILENAME);
-  if (fs11.existsSync(manifestPath)) return { wrote: false, manifestPath };
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const yaml = `# Generated by skaile library add on ${now} (structure: ${input.structure})
-# Edit by hand to inline discovered assets; or run \`skaile library refresh-manifest\`.
-publisher: ""
-assets: []
-`;
-  fs11.writeFileSync(manifestPath, yaml, "utf-8");
-  if (input.ownership !== "owner") {
-    const excludePath = path4.join(input.libraryPath, ".git", "info", "exclude");
-    if (fs11.existsSync(path4.dirname(excludePath))) {
-      const current = fs11.existsSync(excludePath) ? fs11.readFileSync(excludePath, "utf-8") : "";
-      if (!current.includes(MANIFEST_FILENAME)) {
-        fs11.writeFileSync(
-          excludePath,
-          (current.endsWith("\n") || current === "" ? current : `${current}
-`) + `# skaile-managed local-overlay manifest
-${MANIFEST_FILENAME}
-`,
-          "utf-8"
-        );
-      }
-    }
-  }
-  return { wrote: true, manifestPath };
-}
-function migrateWorkspaceConfig(dir, opts) {
-  const filename = opts?.filename ?? "skaile.yaml";
-  const filePath = path4.join(dir, filename);
-  if (!fs11.existsSync(filePath)) {
-    return { migrated: false, version: 1, warnings: ["No skaile.yaml found"] };
-  }
-  const content = fs11.readFileSync(filePath, "utf-8");
-  const raw = parse(content);
-  if (!raw || typeof raw !== "object") {
-    return { migrated: false, version: 1, warnings: ["Invalid YAML content"] };
-  }
-  if (raw.version === 2) {
-    return { migrated: false, version: 2, warnings: [] };
-  }
-  const warnings = [];
-  if (raw.dependencies && Array.isArray(raw.dependencies)) {
-    warnings.push(
-      "v1 'dependencies' field found. In v2, use 'library.instances' to reference configured asset instances. Manual migration recommended."
-    );
-  }
-  if (raw.ai_resources) {
-    warnings.push(
-      "v1 'ai_resources' field found. In v2, sources are managed via 'skaile source add'. The field still works but is deprecated."
-    );
+  if (raw.ai_resources) {
+    warnings.push(
+      "v1 'ai_resources' field found. In v2, sources are managed via 'skaile source add'. The field still works but is deprecated."
+    );
   }
   if (!opts?.dryRun) {
     const doc = parseDocument(content);
@@ -1696,7 +1736,7 @@ function migrateWorkspaceConfig(dir, opts) {
     } else {
       doc.set("version", 2);
     }
-    fs11.writeFileSync(filePath, doc.toString(), "utf-8");
+    fs10.writeFileSync(filePath, doc.toString(), "utf-8");
   }
   return {
     migrated: !opts?.dryRun,
@@ -1714,37 +1754,50 @@ function resolvePin(pin, availableVersions) {
     return { version: parsed[0].raw, match: "latest" };
   }
   if (pin.startsWith("exact:")) {
-    const target = pin.slice(6);
-    const found = parsed.find((v) => v.raw === target);
-    return found ? { version: found.raw, match: "exact" } : null;
+    return resolveExactPin(pin, parsed);
   }
   if (pin.startsWith("^")) {
-    const target = parseRangeTarget(pin.slice(1));
-    if (!target) return null;
-    const match = parsed.find(
-      (v) => v.major === target.major && (v.minor > target.minor || v.minor === target.minor && v.patch >= target.patch)
-    );
-    return match ? { version: match.raw, match: "range" } : null;
+    return resolveCaretPin(pin, parsed);
   }
   if (pin.startsWith("~")) {
-    const target = parseRangeTarget(pin.slice(1));
-    if (!target) return null;
-    const match = parsed.find(
-      (v) => v.major === target.major && v.minor === target.minor && v.patch >= target.patch
-    );
-    return match ? { version: match.raw, match: "range" } : null;
+    return resolveTildePin(pin, parsed);
   }
   if (pin.endsWith(".x")) {
-    const base = pin.slice(0, -2);
-    const parts = base.split(".");
-    const major = Number.parseInt(parts[0], 10);
-    const minor = parts.length > 1 ? Number.parseInt(parts[1], 10) : void 0;
-    if (Number.isNaN(major)) return null;
-    const match = parsed.find(
-      (v) => v.major === major && (minor === void 0 || v.minor === minor)
-    );
-    return match ? { version: match.raw, match: "range" } : null;
+    return resolveWildcardPin(pin, parsed);
   }
+  return resolveBarePin(pin, parsed);
+}
+function resolveExactPin(pin, parsed) {
+  const target = pin.slice(6);
+  const found = parsed.find((v) => v.raw === target);
+  return found ? { version: found.raw, match: "exact" } : null;
+}
+function resolveCaretPin(pin, parsed) {
+  const target = parseRangeTarget(pin.slice(1));
+  if (!target) return null;
+  const match = parsed.find(
+    (v) => v.major === target.major && (v.minor > target.minor || v.minor === target.minor && v.patch >= target.patch)
+  );
+  return match ? { version: match.raw, match: "range" } : null;
+}
+function resolveTildePin(pin, parsed) {
+  const target = parseRangeTarget(pin.slice(1));
+  if (!target) return null;
+  const match = parsed.find(
+    (v) => v.major === target.major && v.minor === target.minor && v.patch >= target.patch
+  );
+  return match ? { version: match.raw, match: "range" } : null;
+}
+function resolveWildcardPin(pin, parsed) {
+  const base = pin.slice(0, -2);
+  const parts = base.split(".");
+  const major = Number.parseInt(parts[0], 10);
+  const minor = parts.length > 1 ? Number.parseInt(parts[1], 10) : void 0;
+  if (Number.isNaN(major)) return null;
+  const match = parsed.find((v) => v.major === major && (minor === void 0 || v.minor === minor));
+  return match ? { version: match.raw, match: "range" } : null;
+}
+function resolveBarePin(pin, parsed) {
   const bareSemver = parseSemVer(pin);
   if (bareSemver) {
     const found = parsed.find((v) => v.raw === pin);
@@ -1780,1793 +1833,1795 @@ function parseRangeTarget(range) {
   };
 }
 
-// library/src/local/local-catalog-source.ts
-var LocalCatalogSource = class {
-  constructor(library, sourceId, rootPath, registry, options) {
-    this.library = library;
-    this.sourceId = sourceId;
-    this.rootPath = rootPath;
-    this.registry = registry;
-    this.id = `local:${sourceId}`;
-    this.sidecarPath = options?.sidecarPath;
-  }
-  library;
-  sourceId;
-  rootPath;
-  registry;
-  id;
-  sidecarPath;
-  async resolve(ref) {
-    const def = await this.library.getAssetDef(ref);
-    if (!def || def.libraryId !== this.sourceId) return null;
-    return defToCatalogAsset(def);
-  }
-  async listAssets(filter) {
-    const libraryFilter = { libraryId: this.sourceId };
-    if (filter?.kind) libraryFilter.kind = filter.kind;
-    if (filter?.publisher) libraryFilter.publisher = filter.publisher;
-    if (filter?.prefix) libraryFilter.prefix = filter.prefix;
-    const defs = await this.library.listAssetDefs(libraryFilter);
-    return defs.map(defToCatalogAsset);
+// library/src/preset/interpolate.ts
+var InterpolationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InterpolationError";
   }
-  async listVersions(ref) {
-    const parsed = parseAssetRef(ref);
-    const defs = await this.library.listAssetDefs({
-      libraryId: this.sourceId,
-      kind: parsed.kind
-    });
-    const wantPublisher = parsed.publisher?.replace(/^@/, "");
-    return defs.filter(
-      (d) => d.name === parsed.name && (wantPublisher === void 0 || d.publisher.replace(/^@/, "") === wantPublisher)
-    ).map((d) => d.version);
+};
+function interpolate(materialize, baseConfig, context, credentialRefPrefix) {
+  const config = { ...baseConfig ?? {} };
+  const secretsToStore = [];
+  let credentialRef;
+  if (!materialize) {
+    for (const [key, value] of Object.entries(context.inputs)) {
+      config[key] = value;
+    }
+    if (Object.keys(context.secrets).length > 0) {
+      credentialRef = `${credentialRefPrefix}/creds`;
+      for (const [key, value] of Object.entries(context.secrets)) {
+        secretsToStore.push({ ref: `${credentialRef}/${key}`, value });
+      }
+    }
+    return { config, credentialRef, secretsToStore };
   }
-  async fetchTarball(_ref, _sha256) {
-    throw new Error(
-      "LocalCatalogSource does not support tarball delivery. Assets are available on disk."
-    );
+  for (const [configPath, template] of Object.entries(materialize)) {
+    const resolved = resolveTemplate(template, context);
+    if (resolved.hasSecret) {
+      if (!credentialRef) {
+        credentialRef = `${credentialRefPrefix}/creds`;
+      }
+      const secretRef = `${credentialRef}/${configPath}`;
+      secretsToStore.push({ ref: secretRef, value: resolved.value });
+      setNestedValue(config, configPath, `secret://${secretRef}`);
+    } else {
+      setNestedValue(config, configPath, resolved.value);
+    }
   }
-  async listSources() {
-    return [{ id: this.sourceId, type: "local", url: this.rootPath }];
+  return { config, credentialRef, secretsToStore };
+}
+async function storeSecrets(router, secretsToStore) {
+  for (const { ref, value } of secretsToStore) {
+    const encoded = new TextEncoder().encode(value);
+    await router.setSecret(ref, encoded);
   }
-  /**
-   * Sync: discover assets in the source directory and cache them in the library.
-   *
-   * Runs the discovery pipeline (glob -> parse -> filter -> hash -> requires)
-   * and upserts each discovered asset into the LocalIndex cache.
-   *
-   * @param syncOpts - When `includeDev` is set, assets under the source
-   *   config's `dev_paths` (e.g. `ai-assets-dev/`) are discovered and cached
-   *   too. Defaults to excluding them (a normal run).
-   * @returns Discovery statistics and any errors encountered.
-   */
-  async sync(syncOpts) {
-    const opts = {
-      registry: this.registry,
-      sidecarPath: this.sidecarPath,
-      includeDev: syncOpts?.includeDev ?? false
-    };
-    if (!this.sidecarPath) {
-      opts.sourceConfig = readManifestSourceConfig(this.rootPath);
+}
+function hasInterpolationTokens(template) {
+  return INTERPOLATION_PATTERN.test(template);
+}
+function extractReferencedKeys(materialize) {
+  const inputKeys = /* @__PURE__ */ new Set();
+  const secretKeys = /* @__PURE__ */ new Set();
+  for (const template of Object.values(materialize)) {
+    const pattern = new RegExp(INTERPOLATION_PATTERN.source, "g");
+    for (const match of template.matchAll(pattern)) {
+      const namespace = match[1];
+      const key = match[2];
+      if (namespace === "INPUT") inputKeys.add(key);
+      else if (namespace === "SECRET") secretKeys.add(key);
     }
-    const result = discoverAssetsInTree(this.rootPath, opts);
-    let assetsUpdated = 0;
-    const errors = [];
-    for (const asset of result.assets) {
-      if (asset.kind === "preset") continue;
-      try {
-        await this.library.upsertAssetDef({
-          id: asset.ref,
-          kind: asset.kind,
-          publisher: asset.publisher,
-          name: asset.name,
-          version: asset.version,
-          sha256: asset.sha256,
-          description: typeof asset.manifest.description === "string" ? asset.manifest.description : void 0,
-          license: typeof asset.manifest.license === "string" ? asset.manifest.license : void 0,
-          category: typeof asset.manifest.category === "string" ? asset.manifest.category : void 0,
-          manifest: asset.manifest,
-          libraryId: this.sourceId,
-          cachedAt: /* @__PURE__ */ new Date(),
-          updatedAt: /* @__PURE__ */ new Date()
-        });
-        assetsUpdated++;
-      } catch (err) {
-        errors.push(`${asset.ref}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return { inputKeys: [...inputKeys], secretKeys: [...secretKeys] };
+}
+var INTERPOLATION_PATTERN = /\$\{(INPUT|SECRET):([^}]+)\}/;
+function resolveTemplate(template, context) {
+  const singleMatch = template.match(/^\$\{(INPUT|SECRET):([^}]+)\}$/);
+  if (singleMatch) {
+    const [, namespace, key] = singleMatch;
+    if (namespace === "SECRET") {
+      if (!(key in context.secrets)) {
+        throw new InterpolationError(`Missing secret key "${key}" in interpolation context`);
       }
+      return { value: context.secrets[key], hasSecret: true };
     }
-    for (const err of result.errors) {
-      errors.push(`${err.path}: ${err.error}`);
+    if (!(key in context.inputs)) {
+      throw new InterpolationError(`Missing input key "${key}" in interpolation context`);
     }
-    return { assetsFound: result.assets.length, assetsUpdated, errors };
+    return { value: context.inputs[key], hasSecret: false };
   }
-};
-function defToCatalogAsset(def) {
-  return {
-    id: def.id,
-    kind: def.kind,
-    publisher: def.publisher,
-    name: def.name,
-    version: def.version,
-    sha256: def.sha256,
-    description: def.description,
-    license: def.license,
-    category: def.category,
-    manifest: def.manifest
-  };
-}
-function defaultCacheDir() {
-  return path4.join(os.homedir(), ".skaile", "catalog-cache");
+  const tokens = [...template.matchAll(/\$\{(INPUT|SECRET):([^}]+)\}/g)];
+  const hasSecretToken = tokens.some(([, ns]) => ns === "SECRET");
+  if (hasSecretToken) {
+    throw new InterpolationError(
+      `Template "${template}" mixes \${SECRET:...} with other tokens. SECRET must be the sole token in a template value.`
+    );
+  }
+  const result = template.replace(/\$\{INPUT:([^}]+)\}/g, (_, key) => {
+    if (!(key in context.inputs)) {
+      throw new InterpolationError(`Missing input key "${key}" in interpolation context`);
+    }
+    return String(context.inputs[key] ?? "");
+  });
+  return { value: result, hasSecret: false };
 }
-var INDEX_FILE = "index.json";
-var TARBALL_DIR = "tarballs";
-var CatalogCache = class {
-  dir;
-  ttlMs;
-  nowFn;
-  index = null;
-  constructor(opts) {
-    this.dir = opts.dir ?? defaultCacheDir();
-    this.ttlMs = opts.ttlMs;
-    this.nowFn = opts.now ?? Date.now;
-    this.ensureDir();
-  }
-  // ── public: resolve cache ───────────────────────────────────────────────
-  /**
-   * Return a fresh resolve-cache entry for `ref`, or `null` if absent / stale.
-   *
-   * When `ttlMs === 0` (air-gapped), all entries are considered fresh
-   * regardless of `fetchedAt`.
-   */
-  getResolve(ref) {
-    const idx = this.loadIndex();
-    const entry = idx.resolve[ref];
-    if (!entry) return null;
-    if (this.ttlMs === 0) return entry;
-    if (this.nowFn() - entry.fetchedAt > this.ttlMs) return null;
-    return entry;
-  }
-  /**
-   * Return a stale resolve-cache entry regardless of TTL — for stale-while-revalidate.
-   */
-  getResolveStale(ref) {
-    const idx = this.loadIndex();
-    return idx.resolve[ref] ?? null;
-  }
-  /** Persist a resolve-cache entry (use `null` to negatively cache misses). */
-  setResolve(ref, value) {
-    const idx = this.loadIndex();
-    idx.resolve[ref] = { fetchedAt: this.nowFn(), value };
-    this.writeIndex(idx);
-  }
-  // ── public: list cache ──────────────────────────────────────────────────
-  /**
-   * Return a fresh list-cache entry for `filter`, or `null` if absent / stale.
-   */
-  getList(filter) {
-    const key = filterKey(filter);
-    const idx = this.loadIndex();
-    const entry = idx.list[key];
-    if (!entry) return null;
-    if (this.ttlMs === 0) return entry;
-    if (this.nowFn() - entry.fetchedAt > this.ttlMs) return null;
-    return entry;
-  }
-  /** Return a stale list-cache entry regardless of TTL — for stale-while-revalidate. */
-  getListStale(filter) {
-    const key = filterKey(filter);
-    const idx = this.loadIndex();
-    return idx.list[key] ?? null;
-  }
-  /** Persist a list-cache entry. */
-  setList(filter, items) {
-    const key = filterKey(filter);
-    const idx = this.loadIndex();
-    idx.list[key] = { fetchedAt: this.nowFn(), items };
-    this.writeIndex(idx);
-  }
-  // ── public: tarball cache ───────────────────────────────────────────────
-  /** Absolute path where a tarball with `sha256` would be cached. */
-  tarballPath(sha256) {
-    return path4.join(this.dir, TARBALL_DIR, `${sha256}.tgz`);
-  }
-  /** Read a cached tarball from disk if present, otherwise `null`. */
-  readTarball(sha256) {
-    const p = this.tarballPath(sha256);
-    if (!fs11.existsSync(p)) return null;
-    return fs11.readFileSync(p);
+function setNestedValue(obj, path13, value) {
+  const parts = path13.split(".");
+  let current = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const key = parts[i];
+    if (current[key] === void 0 || current[key] === null || typeof current[key] !== "object") {
+      current[key] = {};
+    }
+    current = current[key];
   }
-  /** Persist a tarball blob to disk (atomic write). */
-  writeTarball(sha256, bytes) {
-    const dir = path4.join(this.dir, TARBALL_DIR);
-    if (!fs11.existsSync(dir)) fs11.mkdirSync(dir, { recursive: true });
-    const finalPath = this.tarballPath(sha256);
-    const tmpPath = `${finalPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-    fs11.writeFileSync(tmpPath, bytes);
-    fs11.renameSync(tmpPath, finalPath);
+  current[parts[parts.length - 1]] = value;
+}
+function parsePreset(data) {
+  const zodResult = PresetManifestSchema.safeParse(data);
+  if (!zodResult.success) {
+    return {
+      ok: false,
+      errors: zodResult.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`)
+    };
   }
-  // ── public: invalidation ────────────────────────────────────────────────
-  /**
-   * Wipe all cached metadata (resolve + list). Tarballs are content-addressed
-   * and remain valid — they are not invalidated.
-   *
-   * Called by `skaile update`.
-   */
-  invalidateAll() {
-    const idx = { version: 1, resolve: {}, list: {} };
-    this.index = idx;
-    this.writeIndex(idx);
+  const preset = zodResult.data;
+  const errors = [];
+  const ids = validateUniqueIds(preset, errors);
+  validateCrossItemRefs(preset, ids, errors);
+  validatePlaceholderItems(preset, errors);
+  if (errors.length > 0) {
+    return { ok: false, preset, errors };
   }
-  /**
-   * Wipe all cached metadata **and** delete tarball blobs. Used for full reset.
-   */
-  invalidateEverything() {
-    this.invalidateAll();
-    const tarballDir = path4.join(this.dir, TARBALL_DIR);
-    if (fs11.existsSync(tarballDir)) {
-      fs11.rmSync(tarballDir, { recursive: true, force: true });
+  return { ok: true, preset, errors: [] };
+}
+function validateUniqueIds(preset, errors) {
+  const ids = /* @__PURE__ */ new Set();
+  const refCounts = /* @__PURE__ */ new Map();
+  for (const item of preset.items) {
+    if (item.id) {
+      if (ids.has(item.id)) {
+        errors.push(`Duplicate item id: "${item.id}"`);
+      }
+      ids.add(item.id);
+    } else {
+      refCounts.set(item.ref, (refCounts.get(item.ref) ?? 0) + 1);
     }
   }
-  /** Return whether `ttlMs` is zero (air-gapped mode). */
-  get airGapped() {
-    return this.ttlMs === 0;
-  }
-  // ── private ─────────────────────────────────────────────────────────────
-  ensureDir() {
-    if (!fs11.existsSync(this.dir)) fs11.mkdirSync(this.dir, { recursive: true });
-    const tarballDir = path4.join(this.dir, TARBALL_DIR);
-    if (!fs11.existsSync(tarballDir)) fs11.mkdirSync(tarballDir, { recursive: true });
-  }
-  indexPath() {
-    return path4.join(this.dir, INDEX_FILE);
+  for (const [ref, count] of refCounts) {
+    if (count > 1) {
+      errors.push(
+        `${count} items share ref "${ref}" without distinct "id" fields \u2014 upgrade matching will be ambiguous`
+      );
+    }
   }
-  loadIndex() {
-    if (this.index) return this.index;
-    const p = this.indexPath();
-    if (!fs11.existsSync(p)) {
-      this.index = { version: 1, resolve: {}, list: {} };
-      return this.index;
+  return ids;
+}
+function validateCrossItemRefs(preset, ids, errors) {
+  for (const item of preset.items) {
+    if (item.composes) {
+      for (const compose of item.composes) {
+        if (compose.ref.startsWith("#")) {
+          const targetId = compose.ref.slice(1);
+          if (!ids.has(targetId)) {
+            errors.push(
+              `Cross-item ref "${compose.ref}" in item "${item.id ?? item.ref}" references undeclared id "${targetId}"`
+            );
+          }
+        }
+      }
     }
-    try {
-      const raw = JSON.parse(fs11.readFileSync(p, "utf-8"));
-      if (raw && typeof raw === "object" && raw.version === 1) {
-        this.index = {
-          version: 1,
-          resolve: raw.resolve ?? {},
-          list: raw.list ?? {}
-        };
-        return this.index;
+  }
+}
+function validatePlaceholderItems(preset, errors) {
+  for (const item of preset.items) {
+    if (item.placeholders) {
+      const keys = /* @__PURE__ */ new Set();
+      for (const ph of item.placeholders) {
+        if (keys.has(ph.key)) {
+          errors.push(`Duplicate placeholder key "${ph.key}" in item "${item.id ?? item.ref}"`);
+        }
+        keys.add(ph.key);
+        if (ph.type === "enum" && (!ph.values || ph.values.length === 0)) {
+          errors.push(`Placeholder "${ph.key}" has type "enum" but no values defined`);
+        }
       }
-    } catch {
     }
-    this.index = { version: 1, resolve: {}, list: {} };
-    return this.index;
   }
-  writeIndex(idx) {
-    this.index = idx;
-    const p = this.indexPath();
-    const tmp = `${p}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-    fs11.writeFileSync(tmp, JSON.stringify(idx, null, 2), "utf-8");
-    fs11.renameSync(tmp, p);
+}
+function parsePresetYaml(yamlContent) {
+  let data;
+  try {
+    data = parse(yamlContent);
+  } catch (err) {
+    return {
+      ok: false,
+      errors: [`YAML parse error: ${err instanceof Error ? err.message : String(err)}`]
+    };
   }
-};
-function filterKey(filter) {
-  if (!filter) return "__all__";
-  const keys = Object.keys(filter).sort();
-  const norm = {};
-  for (const k of keys) {
-    const v = filter[k];
-    if (v !== void 0) norm[k] = v;
+  return parsePreset(data);
+}
+function detectNestedPresetRefs(preset, knownPresetRefs) {
+  const nested = [];
+  for (const item of preset.items) {
+    if (item.ref.startsWith("library://") || item.ref.startsWith("#")) continue;
+    if (knownPresetRefs?.has(item.ref)) {
+      nested.push(item.ref);
+    }
   }
-  return Object.keys(norm).length === 0 ? "__all__" : JSON.stringify(norm);
+  return nested;
 }
-function sha256Hex(bytes) {
-  const h = crypto.createHash("sha256");
-  h.update(bytes);
-  return h.digest("hex");
+function validateNestingDepth(presetRef, currentDepth) {
+  const MAX_DEPTH = 3;
+  if (currentDepth >= MAX_DEPTH) {
+    return `Preset "${presetRef}" exceeds maximum nesting depth (${MAX_DEPTH} levels allowed, depth ${currentDepth} reached)`;
+  }
+  return void 0;
 }
 
-// library/src/remote/remote-catalog-source.ts
-var TarballHashMismatchError = class extends Error {
-  constructor(expected, actual) {
-    super(`SHA256 mismatch: expected ${expected}, got ${actual}`);
-    this.expected = expected;
-    this.actual = actual;
-    this.name = "TarballHashMismatchError";
-  }
-  expected;
-  actual;
-};
-var OfflineError = class extends Error {
-  constructor(message) {
-    super(`${message} (air-gapped mode; run \`skaile update\` to refresh the cache)`);
-    this.name = "OfflineError";
+// library/src/preset/placeholders.ts
+function validatePlaceholder(placeholder, value) {
+  const { key, type = "text", required } = placeholder;
+  if (value === void 0 || value === null || value === "") {
+    if (placeholder.default !== void 0) {
+      return { valid: true, errors: [], value: placeholder.default };
+    }
+    if (required === true || required === void 0) {
+      return { valid: false, errors: [`Placeholder "${key}" is required`] };
+    }
+    return { valid: true, errors: [], value: void 0 };
   }
-};
-var CatalogHttpError = class extends Error {
-  constructor(message, status, url) {
-    super(message);
-    this.status = status;
-    this.url = url;
-    this.name = "CatalogHttpError";
-  }
-  status;
-  url;
-};
-var DEFAULT_TTL_MS = 864e5;
-var RemoteCatalogSource = class {
-  id;
-  baseUrl;
-  cache;
-  cacheTtlMs;
-  httpClient;
-  silentBackgroundErrors;
-  /** Tracks in-flight background revalidations so callers can `await` them in tests. */
-  inFlight = /* @__PURE__ */ new Map();
-  constructor(opts) {
-    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    this.id = `remote:${this.baseUrl}`;
-    this.cacheTtlMs = opts.cacheTtlMs ?? DEFAULT_TTL_MS;
-    this.httpClient = opts.httpClient ?? defaultFetch;
-    this.silentBackgroundErrors = opts.silentBackgroundErrors ?? false;
-    this.cache = opts.cache ?? new CatalogCache({
-      dir: opts.cacheDir,
-      ttlMs: this.cacheTtlMs,
-      now: opts.now
-    });
+  switch (type) {
+    case "text":
+      return validateText(key, value);
+    case "multiline":
+      return validateMultiline(key, value);
+    case "secret":
+      return validateSecret(key, value);
+    case "number":
+      return validateNumber(key, value);
+    case "boolean":
+      return validateBoolean(key, value);
+    case "enum":
+      return validateEnum(key, value, placeholder.values);
+    case "oauth":
+      return validateOauth(key, value);
+    case "instance-picker":
+      return validateInstancePicker(key, value);
   }
-  // ── ICatalogSource ──────────────────────────────────────────────────────
-  /**
-   * Resolve a single asset by canonical ref (`<publisher>/<name>@<version>`).
-   *
-   * Cache: hit returns immediately. Miss fetches `/trpc/catalog.get`. Stale
-   * entry serves the cached value and triggers a background refresh.
-   *
-   * Air-gapped: throws {@link OfflineError} on cache miss.
-   */
-  async resolve(ref) {
-    const fresh = this.cache.getResolve(ref);
-    if (fresh) return fresh.value;
-    if (this.cache.airGapped) {
-      const stale2 = this.cache.getResolveStale(ref);
-      if (stale2) return stale2.value;
-      throw new OfflineError(`Asset '${ref}' not in cache`);
-    }
-    const stale = this.cache.getResolveStale(ref);
-    if (stale) {
-      this.scheduleBackground(`resolve:${ref}`, () => this.fetchAndStoreResolve(ref));
-      return stale.value;
+}
+function validateAllPlaceholders(placeholders, inputs) {
+  const values = {};
+  const errors = [];
+  for (const ph of placeholders) {
+    const result = validatePlaceholder(ph, inputs[ph.key]);
+    if (!result.valid) {
+      errors.push(...result.errors);
+    } else if (result.value !== void 0) {
+      values[ph.key] = result.value;
     }
-    return this.fetchAndStoreResolve(ref);
   }
-  /**
-   * List assets matching `filter`.
-   *
-   * Cache: hit returns immediately. Miss fetches `/trpc/catalog.list`. Stale
-   * entry serves the cached array and triggers a background refresh.
-   *
-   * Air-gapped: throws {@link OfflineError} on cache miss.
-   */
-  async listAssets(filter) {
-    const fresh = this.cache.getList(filter);
-    if (fresh) return fresh.items;
-    if (this.cache.airGapped) {
-      const stale2 = this.cache.getListStale(filter);
-      if (stale2) return stale2.items;
-      throw new OfflineError("Catalog list not in cache");
-    }
-    const stale = this.cache.getListStale(filter);
-    if (stale) {
-      const filterKey2 = JSON.stringify(filter ?? null);
-      this.scheduleBackground(`list:${filterKey2}`, () => this.fetchAndStoreList(filter));
-      return stale.items;
-    }
-    return this.fetchAndStoreList(filter);
+  return { valid: errors.length === 0, values, errors };
+}
+async function queryInstancePickerChoices(library, options) {
+  const filter = {};
+  if (options?.kind) {
+    filter.kind = options.kind;
   }
-  /**
-   * Fetch the content-addressed tarball for an asset. The bytes are downloaded
-   * via the REST endpoint `GET /tarball/:sha256` (which 307-redirects to the
-   * storage tier), then verified against `sha256` on the client side.
-   *
-   * Cache: tarballs are content-addressed and cached forever once written.
-   *
-   * Air-gapped: throws {@link OfflineError} on cache miss.
-   *
-   * @throws {@link TarballHashMismatchError} when the downloaded SHA256 does not match.
-   */
-  async fetchTarball(_ref, sha256) {
-    const cached = this.cache.readTarball(sha256);
-    if (cached) {
-      const actual2 = sha256Hex(cached);
-      if (actual2 !== sha256) {
-        throw new TarballHashMismatchError(sha256, actual2);
-      }
-      return cached;
-    }
-    if (this.cache.airGapped) {
-      throw new OfflineError(`Tarball '${sha256}' not in cache`);
-    }
-    const url = `${this.baseUrl}/tarball/${encodeURIComponent(sha256)}`;
-    const res = await this.httpClient(url, { method: "GET", redirect: "follow" });
-    if (!res.ok) {
-      throw new CatalogHttpError(
-        `Failed to fetch tarball ${sha256}: ${res.status} ${res.statusText}`,
-        res.status,
-        url
-      );
-    }
-    const buf = new Uint8Array(await res.arrayBuffer());
-    const actual = sha256Hex(buf);
-    if (actual !== sha256) {
-      throw new TarballHashMismatchError(sha256, actual);
-    }
-    this.cache.writeTarball(sha256, buf);
-    return buf;
+  if (options?.defRefPrefix) {
+    filter.defRef = options.defRefPrefix;
   }
-  /**
-   * Enumerate available versions for a version-less ref. The Catalog has no
-   * dedicated version-list route, so this derives versions from `listAssets`
-   * (filtered to the publisher) and keeps only the matching kind+name. Reuses
-   * the cached list path, so repeated calls are cheap.
-   */
-  async listVersions(ref) {
-    const parsed = parseAssetRef(ref);
-    const wantPublisher = parsed.publisher?.replace(/^@/, "");
-    const assets = await this.listAssets(wantPublisher ? { publisher: wantPublisher } : void 0);
-    return assets.filter(
-      (a) => a.kind === parsed.kind && a.name === parsed.name && (wantPublisher === void 0 || a.publisher.replace(/^@/, "") === wantPublisher)
-    ).map((a) => a.version);
+  const instances2 = await library.listInstances(filter);
+  return instances2.map((inst) => ({
+    instanceId: inst.id,
+    defRef: inst.defRef,
+    label: `${inst.defRef} (${inst.id.slice(0, 8)})`
+  }));
+}
+function getDefaultValue(placeholder) {
+  return placeholder.default;
+}
+function isSecretPlaceholder(placeholder) {
+  return placeholder.type === "secret" || placeholder.type === "oauth";
+}
+function validateText(key, value) {
+  if (typeof value !== "string") {
+    return { valid: false, errors: [`Placeholder "${key}" must be a string`] };
   }
-  /**
-   * Single synthetic Source pointing at the configured Catalog URL. Phase 2
-   * is single-Source per spec; multi-source federation is Phase 4.8.
-   */
-  async listSources() {
-    return [{ id: this.id, type: "remote-catalog", url: this.baseUrl }];
+  return { valid: true, errors: [], value };
+}
+function validateMultiline(key, value) {
+  if (typeof value !== "string") {
+    return { valid: false, errors: [`Placeholder "${key}" must be a string`] };
   }
-  // ── extension API ───────────────────────────────────────────────────────
-  /**
-   * Force a metadata-cache refresh. Wipes all resolve/list entries and
-   * re-fetches `listAssets()` (no filter) to pre-warm the canonical query.
-   *
-   * Driven by `skaile update`. Tarballs (content-addressed) are not touched
-   * — they remain valid across refreshes.
-   *
-   * In air-gapped mode this method **does** make a network call (bypassing
-   * the TTL=0 gate); it is the only way to repopulate the cache.
-   */
-  async refresh() {
-    this.cache.invalidateAll();
-    const items = await this.fetchListNetwork(void 0);
-    this.cache.setList(void 0, items);
-    for (const item of items) {
-      this.cache.setResolve(item.id, item);
+  return { valid: true, errors: [], value };
+}
+function validateSecret(key, value) {
+  if (typeof value !== "string") {
+    return { valid: false, errors: [`Placeholder "${key}" must be a string`] };
+  }
+  if (value.length === 0) {
+    return { valid: false, errors: [`Placeholder "${key}" (secret) cannot be empty`] };
+  }
+  return { valid: true, errors: [], value };
+}
+function validateNumber(key, value) {
+  if (typeof value === "number" && !Number.isNaN(value)) {
+    return { valid: true, errors: [], value };
+  }
+  if (typeof value === "string") {
+    const parsed = Number(value);
+    if (!Number.isNaN(parsed)) {
+      return { valid: true, errors: [], value: parsed };
     }
-    return { assetsCached: items.length };
   }
-  /**
-   * Fetch the pointer-only install manifest for an asset ref.
-   *
-   * The install manifest is the Pointer Triple: the immutable upstream
-   * `source.url` + `source.commitSha`, the per-file `files[].sha256` list, a
-   * composite `sha256` rollup, plus `kind` and `tier`. Callers fetch the asset
-   * bytes directly from the upstream repo at that commit and verify each file
-   * against the recorded hashes — the Catalog itself never serves asset bytes.
-   *
-   * Wire surface: `GET /trpc/catalog.getInstallManifest?input=<superjson({ ref })>`.
-   *
-   * This is a `RemoteCatalogSource`-only method — it is not part of the
-   * `ICatalogSource` contract. `LocalCatalogSource` has the asset bytes on disk
-   * and has no pointer-triple concept, so adding it to the shared interface
-   * would force a meaningless implementation there.
-   *
-   * Not cached: the install path is a one-shot read driven by `skaile install`.
-   *
-   * @throws {@link CatalogHttpError} on a non-2xx response or malformed envelope.
-   */
-  async getInstallManifest(ref) {
-    const url = trpcGetUrl(this.baseUrl, "catalog.getInstallManifest", { ref });
-    const res = await this.httpClient(url, {
-      method: "GET",
-      headers: { Accept: "application/json" }
-    });
-    if (!res.ok) {
-      throw new CatalogHttpError(
-        `catalog.getInstallManifest ${ref} failed: ${res.status} ${res.statusText}`,
-        res.status,
-        url
-      );
+  return { valid: false, errors: [`Placeholder "${key}" must be a valid number`] };
+}
+function validateBoolean(key, value) {
+  if (typeof value === "boolean") {
+    return { valid: true, errors: [], value };
+  }
+  if (typeof value === "string") {
+    const lower = value.toLowerCase();
+    if (lower === "true" || lower === "1" || lower === "yes") {
+      return { valid: true, errors: [], value: true };
     }
-    const data = await parseTrpcGet(res);
-    if (data === null || data === void 0 || typeof data !== "object") {
-      throw new CatalogHttpError(
-        `catalog.getInstallManifest ${ref} returned a non-object payload (got ${typeof data})`,
-        200,
-        url
-      );
+    if (lower === "false" || lower === "0" || lower === "no") {
+      return { valid: true, errors: [], value: false };
     }
-    return data;
   }
-  /**
-   * Cheap probe used during cross-check when both a source-side and a store-side
-   * candidate at the same version need to be verified for sha256 equality.
-   * Returns only the composite sha256 — no source URL, no file list.
-   *
-   * Wire: `GET /trpc/catalog.getCanonicalDigest?input=<superjson({ ref })>`.
-   *
-   * Not cached: one-shot read during install resolution.
-   *
-   * @param ref - Canonical asset ref `<publisher>/<kind>:<name>@<version>`.
-   * @returns `{ sha256 }` on a 200, or `null` on a 404.
-   * @throws {@link CatalogHttpError} on a non-2xx/non-404 response or malformed payload.
-   * @docLink packages/library/api-reference#remote-catalog-source
-   */
-  async getCanonicalDigest(ref) {
-    const url = trpcGetUrl(this.baseUrl, "catalog.getCanonicalDigest", { ref });
-    const res = await this.httpClient(url, {
-      method: "GET",
-      headers: { Accept: "application/json" }
-    });
-    if (res.status === 404) return null;
-    if (!res.ok) {
-      throw new CatalogHttpError(
-        `catalog.getCanonicalDigest ${ref} failed: ${res.status} ${res.statusText}`,
-        res.status,
-        url
-      );
-    }
-    const data = await parseTrpcGet(res);
-    if (!data || typeof data !== "object") {
-      throw new CatalogHttpError(
-        `catalog.getCanonicalDigest ${ref} returned a non-object payload`,
-        200,
-        url
-      );
+  return { valid: false, errors: [`Placeholder "${key}" must be a boolean`] };
+}
+function validateEnum(key, value, allowedValues) {
+  if (!allowedValues || allowedValues.length === 0) {
+    return { valid: false, errors: [`Placeholder "${key}" (enum) has no allowed values defined`] };
+  }
+  const stringValue = String(value);
+  const matches = allowedValues.some((v) => String(v) === stringValue);
+  if (!matches) {
+    return {
+      valid: false,
+      errors: [
+        `Placeholder "${key}" value "${stringValue}" is not in allowed values: [${allowedValues.join(", ")}]`
+      ]
+    };
+  }
+  const matched = allowedValues.find((v) => String(v) === stringValue);
+  return { valid: true, errors: [], value: matched };
+}
+function validateOauth(key, value) {
+  if (typeof value !== "string") {
+    return { valid: false, errors: [`Placeholder "${key}" (oauth) must be a string`] };
+  }
+  if (value.length === 0) {
+    return { valid: false, errors: [`Placeholder "${key}" (oauth) cannot be empty`] };
+  }
+  return { valid: true, errors: [], value };
+}
+function validateInstancePicker(key, value) {
+  if (typeof value !== "string") {
+    return {
+      valid: false,
+      errors: [`Placeholder "${key}" (instance-picker) must be a string UUID`]
+    };
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuidPattern.test(value)) {
+    return {
+      valid: false,
+      errors: [`Placeholder "${key}" (instance-picker) must be a valid UUID`]
+    };
+  }
+  return { valid: true, errors: [], value };
+}
+
+// library/src/preset/resolve-item.ts
+function classifyRef(ref) {
+  if (ref.startsWith("library://")) return "library-instance";
+  if (ref.startsWith("#")) return "cross-item";
+  return "asset";
+}
+function extractLibraryInstanceId(ref) {
+  const match = ref.match(/^library:\/\/[^/]+\/instances\/([a-f0-9-]+)$/i);
+  return match ? match[1] : null;
+}
+async function resolveItem(item, library, knownPresetRefs) {
+  const ref = item.ref;
+  if (ref.startsWith("#")) {
+    return { kind: "cross-item", item, targetId: ref.slice(1) };
+  }
+  if (ref.startsWith("library://")) {
+    const instanceId = extractLibraryInstanceId(ref);
+    if (!instanceId) {
+      return { kind: "library-instance", item, instanceId: "", instance: null };
     }
-    const d = data;
-    if (typeof d.sha256 !== "string") {
-      throw new CatalogHttpError(
-        `catalog.getCanonicalDigest ${ref} missing sha256 string`,
-        200,
-        url
-      );
+    const instance = await library.getInstance(instanceId);
+    return { kind: "library-instance", item, instanceId, instance };
+  }
+  if (knownPresetRefs?.has(ref)) {
+    return { kind: "nested-preset", item, presetRef: ref };
+  }
+  const assetDef = await library.getAssetDef(ref);
+  return { kind: "asset", item, defRef: ref, assetDef };
+}
+async function resolveAllItems(items, library, knownPresetRefs) {
+  return Promise.all(items.map((item) => resolveItem(item, library, knownPresetRefs)));
+}
+
+// library/src/preset/apply.ts
+async function applyPreset(presetRef, manifest, inputs, opts) {
+  const depth = opts._depth ?? 0;
+  const pinPolicy = opts.pinPolicy ?? "minor-track";
+  const depthError = validateNestingDepth(presetRef, depth);
+  if (depthError) {
+    return { instances: [], assignments: [], errors: [depthError] };
+  }
+  const result = { instances: [], assignments: [], errors: [] };
+  const itemResults = /* @__PURE__ */ new Map();
+  for (const item of manifest.items) {
+    const itemResult = await applyItemImpl(
+      presetRef,
+      item,
+      inputs,
+      opts,
+      depth,
+      pinPolicy,
+      itemResults
+    );
+    result.errors.push(...itemResult.errors);
+    result.instances.push(...itemResult.instances);
+    if (item.id && itemResult.instances.length > 0) {
+      itemResults.set(item.id, itemResult.instances[0]);
     }
-    return { sha256: d.sha256 };
+    result.assignments.push(...itemResult.assignments);
+  }
+  return result;
+}
+async function applyPresetFromData(presetRef, data, inputs, opts) {
+  const parseResult = parsePreset(data);
+  if (!parseResult.ok || !parseResult.preset) {
+    return {
+      instances: [],
+      assignments: [],
+      errors: parseResult.errors.map((e) => `Parse: ${e}`)
+    };
   }
-  /**
-   * Wait for any in-flight stale-while-revalidate background fetches to settle.
-   * Test-only escape hatch.
-   */
-  async waitForBackground() {
-    const promises = Array.from(this.inFlight.values());
-    await Promise.allSettled(promises);
+  return applyPreset(presetRef, parseResult.preset, inputs, opts);
+}
+async function applyItemImpl(presetRef, item, inputs, opts, depth, pinPolicy, itemResults) {
+  const { library } = opts;
+  const resolved = await resolveItem(item, library, opts.knownPresetRefs);
+  switch (resolved.kind) {
+    case "cross-item":
+      return applyCrossItem(resolved, itemResults);
+    case "library-instance":
+      return applyLibraryInstance(resolved, opts, pinPolicy);
+    case "nested-preset":
+      return applyNestedPreset(resolved, item, inputs, opts, depth);
+    case "asset":
+      return applyAssetItem(presetRef, resolved, item, inputs, opts, pinPolicy);
+  }
+}
+function applyCrossItem(resolved, itemResults) {
+  const target = itemResults.get(resolved.targetId);
+  if (!target) {
+    return {
+      instances: [],
+      assignments: [],
+      errors: [`Cross-item ref "#${resolved.targetId}" not yet resolved (items must be ordered)`]
+    };
   }
-  // ── private ─────────────────────────────────────────────────────────────
-  scheduleBackground(key, fn) {
-    if (this.inFlight.has(key)) return;
-    const p = (async () => {
-      try {
-        await fn();
-      } catch (err) {
-        if (!this.silentBackgroundErrors) {
-          process.stderr.write(
-            `[skaile/catalog] Background refresh failed for ${key}: ${err instanceof Error ? err.message : String(err)}
-`
-          );
-        }
-      } finally {
-        this.inFlight.delete(key);
-      }
-    })();
-    this.inFlight.set(key, p);
+  return { instances: [target], assignments: [], errors: [] };
+}
+async function applyLibraryInstance(resolved, opts, pinPolicy) {
+  if (!resolved.instance) {
+    return {
+      instances: [],
+      assignments: [],
+      errors: [`Library instance "${resolved.instanceId}" not found`]
+    };
   }
-  async fetchAndStoreResolve(ref) {
-    const value = await this.fetchResolveNetwork(ref);
-    this.cache.setResolve(ref, value);
-    return value;
+  try {
+    const asgn = await opts.library.assign(opts.workspaceId, resolved.instanceId, pinPolicy);
+    return { instances: [resolved.instance], assignments: [asgn], errors: [] };
+  } catch {
+    return { instances: [resolved.instance], assignments: [], errors: [] };
   }
-  async fetchAndStoreList(filter) {
-    const items = await this.fetchListNetwork(filter);
-    this.cache.setList(filter, items);
-    return items;
+}
+async function applyNestedPreset(resolved, item, inputs, opts, depth) {
+  if (!opts.loadPreset) {
+    return {
+      instances: [],
+      assignments: [],
+      errors: [`Cannot resolve nested preset "${resolved.presetRef}" \u2014 no loader provided`]
+    };
   }
-  /** Raw network call: GET /trpc/catalog.get?input=<superjson> */
-  async fetchResolveNetwork(ref) {
-    const url = trpcGetUrl(this.baseUrl, "catalog.get", { ref });
-    const res = await this.httpClient(url, {
-      method: "GET",
-      headers: { Accept: "application/json" }
-    });
-    if (!res.ok) {
-      throw new CatalogHttpError(
-        `catalog.get ${ref} failed: ${res.status} ${res.statusText}`,
-        res.status,
-        url
-      );
+  const nestedData = await opts.loadPreset(resolved.presetRef);
+  if (!nestedData) {
+    return {
+      instances: [],
+      assignments: [],
+      errors: [`Nested preset "${resolved.presetRef}" not found`]
+    };
+  }
+  const parseResult = parsePreset(nestedData);
+  if (!parseResult.ok || !parseResult.preset) {
+    return { instances: [], assignments: [], errors: parseResult.errors };
+  }
+  const nestedInputs = {
+    ...item.inputs ?? {},
+    ...inputs
+  };
+  const nestedResult = await applyPreset(resolved.presetRef, parseResult.preset, nestedInputs, {
+    ...opts,
+    _depth: depth + 1
+  });
+  return {
+    instances: nestedResult.instances,
+    assignments: nestedResult.assignments,
+    errors: nestedResult.errors
+  };
+}
+function validateAssetPlaceholders(item, inputs) {
+  const itemInputs = { ...inputs };
+  let validatedValues = {};
+  const secretValues = {};
+  if (item.placeholders && item.placeholders.length > 0) {
+    const nonSecretPhs = item.placeholders.filter((ph) => !isSecretPlaceholder(ph));
+    const secretPhs = item.placeholders.filter((ph) => isSecretPlaceholder(ph));
+    const validation = validateAllPlaceholders(nonSecretPhs, itemInputs);
+    if (!validation.valid) {
+      return { validatedValues: {}, secretValues: {}, errors: validation.errors };
+    }
+    validatedValues = validation.values;
+    const secretValidation = validateAllPlaceholders(secretPhs, itemInputs);
+    if (!secretValidation.valid) {
+      return { validatedValues: {}, secretValues: {}, errors: secretValidation.errors };
+    }
+    for (const [key, value] of Object.entries(secretValidation.values)) {
+      secretValues[key] = String(value);
     }
-    const data = await parseTrpcGet(res);
-    if (data === null || data === void 0) return null;
-    return normalizeCatalogAsset(data);
   }
-  /** Raw network call: GET /trpc/catalog.list?input=<superjson> */
-  async fetchListNetwork(filter) {
-    const input = filter ? { filter } : {};
-    const url = trpcGetUrl(this.baseUrl, "catalog.list", input);
-    const res = await this.httpClient(url, {
-      method: "GET",
-      headers: { Accept: "application/json" }
+  return { validatedValues, secretValues, errors: [] };
+}
+async function applyAssetItem(presetRef, resolved, item, inputs, opts, pinPolicy) {
+  const { library } = opts;
+  const validated = validateAssetPlaceholders(item, inputs);
+  if (validated.errors.length > 0) {
+    return { instances: [], assignments: [], errors: validated.errors };
+  }
+  const credentialRefPrefix = `preset/${presetRef}/${item.id ?? resolved.defRef}`;
+  const context = {
+    inputs: validated.validatedValues,
+    secrets: validated.secretValues
+  };
+  const interpolated = interpolate(
+    item.materialize,
+    item.config,
+    context,
+    credentialRefPrefix
+  );
+  if (opts.secretsRouter && interpolated.secretsToStore.length > 0) {
+    try {
+      await storeSecrets(opts.secretsRouter, interpolated.secretsToStore);
+    } catch (err) {
+      return {
+        instances: [],
+        assignments: [],
+        errors: [
+          `Secret storage failed for "${item.ref}": ${err instanceof Error ? err.message : String(err)}`
+        ]
+      };
+    }
+  }
+  try {
+    const instance = await library.createInstance({
+      defRef: resolved.defRef,
+      defPin: pinPolicy,
+      config: interpolated.config,
+      credentialRef: interpolated.credentialRef,
+      createdBy: opts.createdBy ?? `preset:${presetRef}`
     });
-    if (!res.ok) {
-      throw new CatalogHttpError(
-        `catalog.list failed: ${res.status} ${res.statusText}`,
-        res.status,
-        url
-      );
+    const assignments2 = [];
+    try {
+      const asgn = await library.assign(opts.workspaceId, instance.id, pinPolicy);
+      assignments2.push(asgn);
+    } catch {
     }
-    const data = await parseTrpcGet(res);
-    if (!Array.isArray(data)) {
-      throw new CatalogHttpError(
-        `catalog.list returned non-array payload (got ${typeof data})`,
-        200,
-        url
-      );
+    return { instances: [instance], assignments: assignments2, errors: [] };
+  } catch (err) {
+    return {
+      instances: [],
+      assignments: [],
+      errors: [
+        `Instance creation failed for "${item.ref}": ${err instanceof Error ? err.message : String(err)}`
+      ]
+    };
+  }
+}
+
+// library/src/preset/upgrade.ts
+function detectChanges(oldManifest, newManifest) {
+  const oldItems = indexItems(oldManifest.items);
+  const newItems = indexItems(newManifest.items);
+  const addedItems = [];
+  const removedItems = [];
+  const changedRefItems = [];
+  const configChangedItems = [];
+  for (const [key, oldItem] of oldItems) {
+    if (!newItems.has(key)) {
+      removedItems.push(oldItem);
     }
-    return data.map(normalizeCatalogAsset);
   }
-};
-function trpcGetUrl(baseUrl, procedure, input) {
-  const wrapped = JSON.stringify({ json: input });
-  return `${baseUrl.replace(/\/+$/, "")}/trpc/${procedure}?input=${encodeURIComponent(wrapped)}`;
+  for (const [key, newItem] of newItems) {
+    if (!oldItems.has(key)) {
+      addedItems.push(newItem);
+    }
+  }
+  for (const [key, newItem] of newItems) {
+    const oldItem = oldItems.get(key);
+    if (!oldItem) continue;
+    if (oldItem.ref !== newItem.ref) {
+      changedRefItems.push({ old: oldItem, new: newItem });
+    } else if (!deepEqual(oldItem.placeholders, newItem.placeholders) || !deepEqual(oldItem.materialize, newItem.materialize)) {
+      changedRefItems.push({ old: oldItem, new: newItem });
+    } else if (!deepEqual(oldItem.config, newItem.config)) {
+      configChangedItems.push({ old: oldItem, new: newItem });
+    }
+  }
+  const isStructural = addedItems.length > 0 || removedItems.length > 0 || changedRefItems.length > 0;
+  const kind = isStructural ? "structural" : "non-structural";
+  const summaryParts = [];
+  if (addedItems.length > 0) summaryParts.push(`+${addedItems.length} items`);
+  if (removedItems.length > 0) summaryParts.push(`-${removedItems.length} items`);
+  if (changedRefItems.length > 0) summaryParts.push(`${changedRefItems.length} ref changes`);
+  if (configChangedItems.length > 0)
+    summaryParts.push(`${configChangedItems.length} config changes`);
+  const summary = summaryParts.length > 0 ? `${kind}: ${summaryParts.join(", ")}` : "no changes";
+  return {
+    kind,
+    addedItems,
+    removedItems,
+    changedRefItems,
+    configChangedItems,
+    summary
+  };
 }
-async function parseTrpcGet(res) {
-  const text2 = await res.text();
-  let body;
-  try {
-    body = text2.length > 0 ? JSON.parse(text2) : null;
-  } catch {
-    throw new CatalogHttpError(
-      `tRPC response is not valid JSON: ${text2.slice(0, 200)}`,
-      res.status
-    );
+function evaluateUpgrade(oldManifest, newManifest) {
+  const diff = detectChanges(oldManifest, newManifest);
+  if (diff.kind === "non-structural") {
+    return { autoUpgradable: true, diff };
   }
-  if (body && typeof body === "object" && "error" in body) {
-    const err = body.error;
-    throw new CatalogHttpError(
-      `tRPC error: ${err.message ?? "unknown"}${err.data?.code ? ` (${err.data.code})` : ""}`,
-      res.status
+  const requiredActions = [];
+  if (diff.addedItems.length > 0) {
+    requiredActions.push(
+      `Create ${diff.addedItems.length} new instance(s): ${diff.addedItems.map((i) => i.ref).join(", ")}`
     );
   }
-  const result = body?.result;
-  if (!result || !("data" in result)) {
-    throw new CatalogHttpError(`tRPC response missing result.data envelope`, res.status);
+  if (diff.removedItems.length > 0) {
+    requiredActions.push(
+      `Remove ${diff.removedItems.length} instance(s): ${diff.removedItems.map((i) => i.ref).join(", ")}`
+    );
   }
-  const data = result.data;
-  if (data && typeof data === "object" && !Array.isArray(data) && "json" in data) {
-    return data.json;
+  if (diff.changedRefItems.length > 0) {
+    requiredActions.push(`Replace ${diff.changedRefItems.length} instance(s) with new refs`);
   }
-  return data;
+  return { autoUpgradable: false, diff, requiredActions };
 }
-function normalizeCatalogAsset(raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new CatalogHttpError("Catalog response item is not an object", 200);
-  }
-  const r = raw;
-  const publisher = pickString(r, "publisher") ?? pickString(r, "publisherSlug") ?? "";
-  const name = pickString(r, "name") ?? "";
-  const version = pickString(r, "version") ?? "";
-  const id = pickString(r, "id") ?? `${publisher}/${name}@${version}`;
-  const kind = pickString(r, "kind") ?? "";
-  const manifest = typeof r.manifest === "object" && r.manifest !== null ? r.manifest : typeof r.manifestJson === "object" && r.manifestJson !== null ? r.manifestJson : {};
-  const asset = {
-    id,
-    kind,
-    publisher,
-    name,
-    version,
-    manifest
-  };
-  const sha = pickString(r, "sha256") ?? pickString(r, "tarballSha256");
-  if (sha) asset.sha256 = sha;
-  const description = pickString(r, "description");
-  if (description) asset.description = description;
-  const license = pickString(r, "license");
-  if (license) asset.license = license;
-  const category = pickString(r, "category");
-  if (category) asset.category = category;
-  const repo = pickString(r, "repo");
-  if (repo) asset.repo = repo;
-  return asset;
+async function applyNonStructuralUpgrade(newManifest, existingInstances, library) {
+  let updated = 0;
+  const errors = [];
+  for (const item of newManifest.items) {
+    const key = itemKey(item);
+    const instanceId = existingInstances.get(key);
+    if (!instanceId) continue;
+    if (item.config) {
+      try {
+        await library.updateInstance(instanceId, {
+          config: item.config
+        });
+        updated++;
+      } catch (err) {
+        errors.push(
+          `Failed to update instance "${instanceId}": ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  }
+  return { updated, errors };
 }
-function pickString(r, key) {
-  const v = r[key];
-  return typeof v === "string" ? v : void 0;
+function itemKey(item) {
+  return item.id ?? item.ref;
 }
-var CATALOG_REQUEST_TIMEOUT_MS = 1e4;
-var defaultFetch = async (url, init) => {
-  if (typeof fetch === "undefined") {
-    throw new Error("global fetch is not available; pass an httpClient explicitly");
+function indexItems(items) {
+  const map = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    map.set(itemKey(item), item);
   }
-  const requestInit = init ?? {};
-  return fetch(url, {
-    ...requestInit,
-    signal: requestInit.signal ?? AbortSignal.timeout(CATALOG_REQUEST_TIMEOUT_MS)
-  });
-};
-
-// library/src/remote/rest-catalog-source.ts
-var DEFAULT_TTL_MS2 = 864e5;
-var RestCatalogSource = class {
-  id;
-  baseUrl;
-  cache;
-  cacheTtlMs;
-  httpClient;
-  silentBackgroundErrors;
-  /** Tracks in-flight background revalidations so callers can `await` them in tests. */
-  inFlight = /* @__PURE__ */ new Map();
+  return map;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === void 0 && b === void 0) return true;
+  if (a === null && b === null) return true;
+  if (a === void 0 || b === void 0) return false;
+  if (a === null || b === null) return false;
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function defaultCacheDir() {
+  return path5.join(os.homedir(), ".skaile", "catalog-cache");
+}
+var INDEX_FILE = "index.json";
+var TARBALL_DIR = "tarballs";
+var CatalogCache = class {
+  dir;
+  ttlMs;
+  nowFn;
+  index = null;
   constructor(opts) {
-    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    this.id = `rest:${this.baseUrl}`;
-    this.cacheTtlMs = opts.cacheTtlMs ?? DEFAULT_TTL_MS2;
-    this.httpClient = opts.httpClient ?? defaultFetch2;
-    this.silentBackgroundErrors = opts.silentBackgroundErrors ?? false;
-    this.cache = opts.cache ?? new CatalogCache({
-      dir: opts.cacheDir,
-      ttlMs: this.cacheTtlMs,
-      now: opts.now
-    });
+    this.dir = opts.dir ?? defaultCacheDir();
+    this.ttlMs = opts.ttlMs;
+    this.nowFn = opts.now ?? Date.now;
+    this.ensureDir();
   }
-  // ── ICatalogSource ──────────────────────────────────────────────────────
+  // ── public: resolve cache ───────────────────────────────────────────────
   /**
-   * Resolve a single asset by canonical ref (`<publisher>/<name>@<version>`).
-   *
-   * Cache: hit returns immediately. Miss fetches `/api/catalog/get?ref=<ref>`. Stale
-   * entry serves the cached value and triggers a background refresh.
+   * Return a fresh resolve-cache entry for `ref`, or `null` if absent / stale.
    *
-   * Air-gapped: throws {@link OfflineError} on cache miss.
+   * When `ttlMs === 0` (air-gapped), all entries are considered fresh
+   * regardless of `fetchedAt`.
    */
-  async resolve(ref) {
-    const fresh = this.cache.getResolve(ref);
-    if (fresh) return fresh.value;
-    if (this.cache.airGapped) {
-      const stale2 = this.cache.getResolveStale(ref);
-      if (stale2) return stale2.value;
-      throw new OfflineError(`Asset '${ref}' not in cache`);
-    }
-    const stale = this.cache.getResolveStale(ref);
-    if (stale) {
-      this.scheduleBackground(`resolve:${ref}`, () => this.fetchAndStoreResolve(ref));
-      return stale.value;
-    }
-    return this.fetchAndStoreResolve(ref);
+  getResolve(ref) {
+    const idx = this.loadIndex();
+    const entry = idx.resolve[ref];
+    if (!entry) return null;
+    if (this.ttlMs === 0) return entry;
+    if (this.nowFn() - entry.fetchedAt > this.ttlMs) return null;
+    return entry;
   }
   /**
-   * List assets matching `filter`.
-   *
-   * Cache: hit returns immediately. Miss fetches `/api/catalog/list`. Stale
-   * entry serves the cached array and triggers a background refresh.
-   *
-   * Air-gapped: throws {@link OfflineError} on cache miss.
-   *
-   * Note: `filter.prefix` is not supported by the forge-store REST API and is silently ignored.
+   * Return a stale resolve-cache entry regardless of TTL — for stale-while-revalidate.
    */
-  async listAssets(filter) {
-    const fresh = this.cache.getList(filter);
-    if (fresh) return fresh.items;
-    if (this.cache.airGapped) {
-      const stale2 = this.cache.getListStale(filter);
-      if (stale2) return stale2.items;
-      throw new OfflineError("Catalog list not in cache");
-    }
-    const stale = this.cache.getListStale(filter);
-    if (stale) {
-      const filterKey2 = JSON.stringify(filter ?? null);
-      this.scheduleBackground(`list:${filterKey2}`, () => this.fetchAndStoreList(filter));
-      return stale.items;
-    }
-    return this.fetchAndStoreList(filter);
+  getResolveStale(ref) {
+    const idx = this.loadIndex();
+    return idx.resolve[ref] ?? null;
   }
-  /**
-   * Fetch the content-addressed tarball for an asset.
-   *
-   * Steps:
-   * 1. `GET /api/tarball/manifest?sha256=<sha256>` → JSON with `{ url, ... }`
-   * 2. `GET <manifest.url>` following redirects → raw bytes
-   * 3. Verify SHA256 client-side — hard fail on mismatch
-   * 4. Write to cache on success
-   *
-   * Cache: tarballs are content-addressed and cached forever once written.
-   *
-   * Air-gapped: throws {@link OfflineError} on cache miss.
-   *
-   * @throws {@link TarballHashMismatchError} when the downloaded SHA256 does not match.
-   */
-  async fetchTarball(_ref, sha256) {
-    const cached = this.cache.readTarball(sha256);
-    if (cached) {
-      const actual2 = sha256Hex(cached);
-      if (actual2 !== sha256) {
-        throw new TarballHashMismatchError(sha256, actual2);
-      }
-      return cached;
-    }
-    if (this.cache.airGapped) {
-      throw new OfflineError(`Tarball '${sha256}' not in cache`);
-    }
-    const manifestUrl = `${this.baseUrl}/api/tarball/manifest?sha256=${encodeURIComponent(sha256)}`;
-    const manifestRes = await this.httpClient(manifestUrl, {
-      method: "GET",
-      headers: { Accept: "application/json" }
-    });
-    if (!manifestRes.ok) {
-      throw new CatalogHttpError(
-        `Failed to fetch tarball manifest for ${sha256}: ${manifestRes.status} ${manifestRes.statusText}`,
-        manifestRes.status,
-        manifestUrl
-      );
-    }
-    const manifestText = await manifestRes.text();
-    let manifest;
-    try {
-      manifest = JSON.parse(manifestText);
-    } catch {
-      throw new CatalogHttpError(
-        `Tarball manifest response is not valid JSON: ${manifestText.slice(0, 200)}`,
-        manifestRes.status,
-        manifestUrl
-      );
-    }
-    const downloadUrl = manifest && typeof manifest === "object" && "url" in manifest ? manifest.url : void 0;
-    if (typeof downloadUrl !== "string") {
-      throw new CatalogHttpError(
-        `Tarball manifest missing 'url' field`,
-        manifestRes.status,
-        manifestUrl
-      );
-    }
-    const tarballRes = await this.httpClient(downloadUrl, { method: "GET", redirect: "follow" });
-    if (!tarballRes.ok) {
-      throw new CatalogHttpError(
-        `Failed to fetch tarball ${sha256}: ${tarballRes.status} ${tarballRes.statusText}`,
-        tarballRes.status,
-        downloadUrl
-      );
-    }
-    const buf = new Uint8Array(await tarballRes.arrayBuffer());
-    const actual = sha256Hex(buf);
-    if (actual !== sha256) {
-      throw new TarballHashMismatchError(sha256, actual);
-    }
-    this.cache.writeTarball(sha256, buf);
-    return buf;
+  /** Persist a resolve-cache entry (use `null` to negatively cache misses). */
+  setResolve(ref, value) {
+    const idx = this.loadIndex();
+    idx.resolve[ref] = { fetchedAt: this.nowFn(), value };
+    this.writeIndex(idx);
   }
+  // ── public: list cache ──────────────────────────────────────────────────
   /**
-   * Enumerate available versions for a version-less ref. The forge-store REST
-   * API has no version-list route, so this derives versions from `listAssets`
-   * (filtered to the publisher) and keeps only the matching kind+name. Reuses
-   * the cached list path, so repeated calls are cheap.
+   * Return a fresh list-cache entry for `filter`, or `null` if absent / stale.
    */
-  async listVersions(ref) {
-    const parsed = parseAssetRef(ref);
-    const wantPublisher = parsed.publisher?.replace(/^@/, "");
-    const assets = await this.listAssets(wantPublisher ? { publisher: wantPublisher } : void 0);
-    return assets.filter(
-      (a) => a.kind === parsed.kind && a.name === parsed.name && (wantPublisher === void 0 || a.publisher.replace(/^@/, "") === wantPublisher)
-    ).map((a) => a.version);
+  getList(filter) {
+    const key = filterKey(filter);
+    const idx = this.loadIndex();
+    const entry = idx.list[key];
+    if (!entry) return null;
+    if (this.ttlMs === 0) return entry;
+    if (this.nowFn() - entry.fetchedAt > this.ttlMs) return null;
+    return entry;
+  }
+  /** Return a stale list-cache entry regardless of TTL — for stale-while-revalidate. */
+  getListStale(filter) {
+    const key = filterKey(filter);
+    const idx = this.loadIndex();
+    return idx.list[key] ?? null;
+  }
+  /** Persist a list-cache entry. */
+  setList(filter, items) {
+    const key = filterKey(filter);
+    const idx = this.loadIndex();
+    idx.list[key] = { fetchedAt: this.nowFn(), items };
+    this.writeIndex(idx);
+  }
+  // ── public: tarball cache ───────────────────────────────────────────────
+  /** Absolute path where a tarball with `sha256` would be cached. */
+  tarballPath(sha256) {
+    return path5.join(this.dir, TARBALL_DIR, `${sha256}.tgz`);
+  }
+  /** Read a cached tarball from disk if present, otherwise `null`. */
+  readTarball(sha256) {
+    const p = this.tarballPath(sha256);
+    if (!fs10.existsSync(p)) return null;
+    return fs10.readFileSync(p);
+  }
+  /** Persist a tarball blob to disk (atomic write). */
+  writeTarball(sha256, bytes) {
+    const dir = path5.join(this.dir, TARBALL_DIR);
+    if (!fs10.existsSync(dir)) fs10.mkdirSync(dir, { recursive: true });
+    const finalPath = this.tarballPath(sha256);
+    const tmpPath = `${finalPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    fs10.writeFileSync(tmpPath, bytes);
+    fs10.renameSync(tmpPath, finalPath);
   }
+  // ── public: invalidation ────────────────────────────────────────────────
   /**
-   * Single synthetic Source pointing at the configured forge-store URL.
+   * Wipe all cached metadata (resolve + list). Tarballs are content-addressed
+   * and remain valid — they are not invalidated.
+   *
+   * Called by `skaile update`.
    */
-  async listSources() {
-    return [{ id: this.id, type: "rest-catalog", url: this.baseUrl }];
+  invalidateAll() {
+    const idx = { version: 1, resolve: {}, list: {} };
+    this.index = idx;
+    this.writeIndex(idx);
   }
-  // ── extension API ───────────────────────────────────────────────────────
   /**
-   * Force a metadata-cache refresh. Wipes all resolve/list entries and
-   * re-fetches `listAssets()` (no filter) to pre-warm the canonical query.
-   *
-   * Driven by `skaile update`. Tarballs (content-addressed) are not touched.
-   *
-   * In air-gapped mode this method **does** make a network call (bypassing
-   * the TTL=0 gate); it is the only way to repopulate the cache.
+   * Wipe all cached metadata **and** delete tarball blobs. Used for full reset.
    */
-  async refresh() {
-    this.cache.invalidateAll();
-    const items = await this.fetchListNetwork(void 0);
-    this.cache.setList(void 0, items);
-    for (const item of items) {
-      this.cache.setResolve(item.id, item);
+  invalidateEverything() {
+    this.invalidateAll();
+    const tarballDir = path5.join(this.dir, TARBALL_DIR);
+    if (fs10.existsSync(tarballDir)) {
+      fs10.rmSync(tarballDir, { recursive: true, force: true });
     }
-    return { assetsCached: items.length };
   }
-  /**
-   * Wait for any in-flight stale-while-revalidate background fetches to settle.
-   * Test-only escape hatch.
-   */
-  async waitForBackground() {
-    const promises = Array.from(this.inFlight.values());
-    await Promise.allSettled(promises);
+  /** Return whether `ttlMs` is zero (air-gapped mode). */
+  get airGapped() {
+    return this.ttlMs === 0;
   }
   // ── private ─────────────────────────────────────────────────────────────
-  scheduleBackground(key, fn) {
-    if (this.inFlight.has(key)) return;
-    const p = (async () => {
-      try {
-        await fn();
-      } catch (err) {
-        if (!this.silentBackgroundErrors) {
-          process.stderr.write(
-            `[skaile/catalog] Background refresh failed for ${key}: ${err instanceof Error ? err.message : String(err)}
-`
-          );
-        }
-      } finally {
-        this.inFlight.delete(key);
-      }
-    })();
-    this.inFlight.set(key, p);
-  }
-  async fetchAndStoreResolve(ref) {
-    const value = await this.fetchResolveNetwork(ref);
-    this.cache.setResolve(ref, value);
-    return value;
-  }
-  async fetchAndStoreList(filter) {
-    const items = await this.fetchListNetwork(filter);
-    this.cache.setList(filter, items);
-    return items;
+  ensureDir() {
+    if (!fs10.existsSync(this.dir)) fs10.mkdirSync(this.dir, { recursive: true });
+    const tarballDir = path5.join(this.dir, TARBALL_DIR);
+    if (!fs10.existsSync(tarballDir)) fs10.mkdirSync(tarballDir, { recursive: true });
   }
-  /** Raw network call: GET /api/catalog/get?ref=<ref> */
-  async fetchResolveNetwork(ref) {
-    const url = `${this.baseUrl}/api/catalog/get?ref=${encodeURIComponent(ref)}`;
-    const res = await this.httpClient(url, {
-      method: "GET",
-      headers: { Accept: "application/json" }
-    });
-    if (!res.ok) {
-      throw new CatalogHttpError(
-        `catalog/get ${ref} failed: ${res.status} ${res.statusText}`,
-        res.status,
-        url
-      );
-    }
-    const data = await parseRestResponse(res, url);
-    if (data === null || data === void 0) return null;
-    return normalizeRestAsset(data);
+  indexPath() {
+    return path5.join(this.dir, INDEX_FILE);
   }
-  /** Raw network call: GET /api/catalog/list?publisher=&kind=&category= */
-  async fetchListNetwork(filter) {
-    const params = new URLSearchParams();
-    if (filter?.publisher) params.set("publisher", filter.publisher);
-    if (filter?.kind) params.set("kind", filter.kind);
-    const qs = params.toString();
-    const url = `${this.baseUrl}/api/catalog/list${qs ? `?${qs}` : ""}`;
-    const res = await this.httpClient(url, {
-      method: "GET",
-      headers: { Accept: "application/json" }
-    });
-    if (!res.ok) {
-      throw new CatalogHttpError(
-        `catalog/list failed: ${res.status} ${res.statusText}`,
-        res.status,
-        url
-      );
-    }
-    const data = await parseRestResponse(res, url);
-    if (!Array.isArray(data)) {
-      throw new CatalogHttpError(
-        `catalog/list returned non-array payload (got ${typeof data})`,
-        200,
-        url
-      );
+  loadIndex() {
+    if (this.index) return this.index;
+    const p = this.indexPath();
+    if (!fs10.existsSync(p)) {
+      this.index = { version: 1, resolve: {}, list: {} };
+      return this.index;
     }
-    return data.map(normalizeRestAsset);
-  }
-};
-async function parseRestResponse(res, url) {
-  const text2 = await res.text();
-  if (text2.length === 0) return null;
-  try {
-    return JSON.parse(text2);
-  } catch {
-    throw new CatalogHttpError(
-      `REST response is not valid JSON: ${text2.slice(0, 200)}`,
-      res.status,
-      url
-    );
-  }
-}
-function normalizeRestAsset(raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new CatalogHttpError("Catalog REST response item is not an object", 200);
-  }
-  const r = raw;
-  const publisher = pickString2(r, "publisherNamespace") ?? pickString2(r, "publisher") ?? "";
-  const name = pickString2(r, "name") ?? "";
-  const version = pickString2(r, "version") ?? "";
-  const kind = pickString2(r, "kind") ?? "";
-  const id = `${publisher}/${name}@${version}`;
-  const requiresParsed = tryParseJson(pickString2(r, "requiresJson"));
-  const filesParsed = tryParseJson(pickString2(r, "filesJson"));
-  const manifest = { ...requiresParsed, ...filesParsed };
-  const asset = {
-    id,
-    kind,
-    publisher,
-    name,
-    version,
-    manifest
-  };
-  const sha = pickString2(r, "sha256");
-  if (sha) asset.sha256 = sha;
-  const description = pickString2(r, "description");
-  if (description) asset.description = description;
-  const license = pickString2(r, "license");
-  if (license) asset.license = license;
-  const category = pickString2(r, "category");
-  if (category) asset.category = category;
-  return asset;
-}
-function pickString2(r, key) {
-  const v = r[key];
-  return typeof v === "string" ? v : void 0;
-}
-function tryParseJson(s) {
-  if (!s) return {};
-  try {
-    const parsed = JSON.parse(s);
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      return parsed;
+    try {
+      const raw = JSON.parse(fs10.readFileSync(p, "utf-8"));
+      if (raw && typeof raw === "object" && raw.version === 1) {
+        this.index = {
+          version: 1,
+          resolve: raw.resolve ?? {},
+          list: raw.list ?? {}
+        };
+        return this.index;
+      }
+    } catch {
     }
-  } catch {
+    this.index = { version: 1, resolve: {}, list: {} };
+    return this.index;
   }
-  return {};
-}
-var CATALOG_REQUEST_TIMEOUT_MS2 = 1e4;
-var defaultFetch2 = async (url, init) => {
-  if (typeof fetch === "undefined") {
-    throw new Error("global fetch is not available; pass an httpClient explicitly");
+  writeIndex(idx) {
+    this.index = idx;
+    const p = this.indexPath();
+    const tmp = `${p}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    fs10.writeFileSync(tmp, JSON.stringify(idx, null, 2), "utf-8");
+    fs10.renameSync(tmp, p);
   }
-  const requestInit = init ?? {};
-  return fetch(url, {
-    ...requestInit,
-    signal: requestInit.signal ?? AbortSignal.timeout(CATALOG_REQUEST_TIMEOUT_MS2)
-  });
 };
-var KnowledgeManifestSchema = z2.looseObject({
-  name: z2.string().optional(),
-  description: z2.string().optional(),
-  version: z2.string().optional(),
-  files: z2.array(z2.string()).optional(),
-  keywords: z2.array(z2.string()).optional(),
-  license: z2.string().optional()
-});
-function validateKnowledge(data) {
-  const result = KnowledgeManifestSchema.safeParse(data);
-  if (result.success) {
-    return { ok: true, data: result.data };
-  }
-  return {
-    ok: false,
-    errors: result.error.issues.map((issue) => ({
-      path: issue.path.join("."),
-      message: issue.message
-    }))
-  };
-}
-function collectDirRecursive(baseDir, relativeDir) {
-  const full = path4.join(baseDir, relativeDir);
-  if (!fs11.existsSync(full) || !fs11.statSync(full).isDirectory()) return [];
-  const results = [];
-  for (const entry of fs11.readdirSync(full, { withFileTypes: true })) {
-    const rel = path4.posix.join(relativeDir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...collectDirRecursive(baseDir, rel));
-    } else if (entry.isFile()) {
-      results.push(rel);
-    }
+function filterKey(filter) {
+  if (!filter) return "__all__";
+  const keys = Object.keys(filter).sort();
+  const norm = {};
+  for (const k of keys) {
+    const v = filter[k];
+    if (v !== void 0) norm[k] = v;
   }
-  return results;
-}
-var knowledgeKindProvider = {
-  kind: "knowledge",
-  displayName: "Knowledge",
-  providerVersion: "1.0.0",
-  discoveryPatterns: ["**/knowledge.yaml", "**/knowledge/index.yaml"],
-  matchesPath(relativePath) {
-    const parts = relativePath.split("/");
-    const filename = parts[parts.length - 1] ?? "";
-    if (filename === "knowledge.yaml") return true;
-    if (filename === "index.yaml" && parts.length >= 2 && parts[parts.length - 2] === "knowledge") {
-      return true;
-    }
-    return false;
-  },
-  validateManifest(data) {
-    return validateKnowledge(data);
-  },
-  defaultFileFilter(manifestPath) {
-    const dir = path4.dirname(manifestPath);
-    const manifestName = path4.basename(manifestPath);
-    const files = [manifestName];
-    files.push(...collectDirRecursive(dir, "documents"));
-    files.sort();
-    return { assetRoot: dir, files };
+  return Object.keys(norm).length === 0 ? "__all__" : JSON.stringify(norm);
+}
+function sha256Hex(bytes) {
+  const h = crypto.createHash("sha256");
+  h.update(bytes);
+  return h.digest("hex");
+}
+
+// library/src/remote/remote-catalog-source.ts
+var TarballHashMismatchError = class extends Error {
+  constructor(expected, actual) {
+    super(`SHA256 mismatch: expected ${expected}, got ${actual}`);
+    this.expected = expected;
+    this.actual = actual;
+    this.name = "TarballHashMismatchError";
   }
-  // Knowledge has no cross-asset dependency edges — omit extractRequires
+  expected;
+  actual;
 };
-function parsePreset(data) {
-  const zodResult = PresetManifestSchema.safeParse(data);
-  if (!zodResult.success) {
-    return {
-      ok: false,
-      errors: zodResult.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`)
-    };
+var OfflineError = class extends Error {
+  constructor(message) {
+    super(`${message} (air-gapped mode; run \`skaile update\` to refresh the cache)`);
+    this.name = "OfflineError";
   }
-  const preset = zodResult.data;
-  const errors = [];
-  const ids = /* @__PURE__ */ new Set();
-  const refCounts = /* @__PURE__ */ new Map();
-  for (const item of preset.items) {
-    if (item.id) {
-      if (ids.has(item.id)) {
-        errors.push(`Duplicate item id: "${item.id}"`);
-      }
-      ids.add(item.id);
-    } else {
-      refCounts.set(item.ref, (refCounts.get(item.ref) ?? 0) + 1);
-    }
+};
+var CatalogHttpError = class extends Error {
+  constructor(message, status, url) {
+    super(message);
+    this.status = status;
+    this.url = url;
+    this.name = "CatalogHttpError";
   }
-  for (const [ref, count] of refCounts) {
-    if (count > 1) {
-      errors.push(
-        `${count} items share ref "${ref}" without distinct "id" fields \u2014 upgrade matching will be ambiguous`
-      );
+  status;
+  url;
+};
+var DEFAULT_TTL_MS = 864e5;
+var RemoteCatalogSource = class {
+  id;
+  baseUrl;
+  cache;
+  cacheTtlMs;
+  httpClient;
+  silentBackgroundErrors;
+  /** Tracks in-flight background revalidations so callers can `await` them in tests. */
+  inFlight = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.id = `remote:${this.baseUrl}`;
+    this.cacheTtlMs = opts.cacheTtlMs ?? DEFAULT_TTL_MS;
+    this.httpClient = opts.httpClient ?? defaultFetch;
+    this.silentBackgroundErrors = opts.silentBackgroundErrors ?? false;
+    this.cache = opts.cache ?? new CatalogCache({
+      dir: opts.cacheDir,
+      ttlMs: this.cacheTtlMs,
+      now: opts.now
+    });
+  }
+  // ── ICatalogSource ──────────────────────────────────────────────────────
+  /**
+   * Resolve a single asset by canonical ref (`<publisher>/<name>@<version>`).
+   *
+   * Cache: hit returns immediately. Miss fetches `/trpc/catalog.get`. Stale
+   * entry serves the cached value and triggers a background refresh.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   */
+  async resolve(ref) {
+    const fresh = this.cache.getResolve(ref);
+    if (fresh) return fresh.value;
+    if (this.cache.airGapped) {
+      const stale2 = this.cache.getResolveStale(ref);
+      if (stale2) return stale2.value;
+      throw new OfflineError(`Asset '${ref}' not in cache`);
+    }
+    const stale = this.cache.getResolveStale(ref);
+    if (stale) {
+      this.scheduleBackground(`resolve:${ref}`, () => this.fetchAndStoreResolve(ref));
+      return stale.value;
     }
+    return this.fetchAndStoreResolve(ref);
   }
-  for (const item of preset.items) {
-    if (item.composes) {
-      for (const compose of item.composes) {
-        if (compose.ref.startsWith("#")) {
-          const targetId = compose.ref.slice(1);
-          if (!ids.has(targetId)) {
-            errors.push(
-              `Cross-item ref "${compose.ref}" in item "${item.id ?? item.ref}" references undeclared id "${targetId}"`
-            );
-          }
-        }
-      }
+  /**
+   * List assets matching `filter`.
+   *
+   * Cache: hit returns immediately. Miss fetches `/trpc/catalog.list`. Stale
+   * entry serves the cached array and triggers a background refresh.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   */
+  async listAssets(filter) {
+    const fresh = this.cache.getList(filter);
+    if (fresh) return fresh.items;
+    if (this.cache.airGapped) {
+      const stale2 = this.cache.getListStale(filter);
+      if (stale2) return stale2.items;
+      throw new OfflineError("Catalog list not in cache");
+    }
+    const stale = this.cache.getListStale(filter);
+    if (stale) {
+      const filterKey2 = JSON.stringify(filter ?? null);
+      this.scheduleBackground(`list:${filterKey2}`, () => this.fetchAndStoreList(filter));
+      return stale.items;
     }
+    return this.fetchAndStoreList(filter);
   }
-  for (const item of preset.items) {
-    if (item.placeholders) {
-      const keys = /* @__PURE__ */ new Set();
-      for (const ph of item.placeholders) {
-        if (keys.has(ph.key)) {
-          errors.push(`Duplicate placeholder key "${ph.key}" in item "${item.id ?? item.ref}"`);
-        }
-        keys.add(ph.key);
-        if (ph.type === "enum" && (!ph.values || ph.values.length === 0)) {
-          errors.push(`Placeholder "${ph.key}" has type "enum" but no values defined`);
-        }
+  /**
+   * Fetch the content-addressed tarball for an asset. The bytes are downloaded
+   * via the REST endpoint `GET /tarball/:sha256` (which 307-redirects to the
+   * storage tier), then verified against `sha256` on the client side.
+   *
+   * Cache: tarballs are content-addressed and cached forever once written.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   *
+   * @throws {@link TarballHashMismatchError} when the downloaded SHA256 does not match.
+   */
+  async fetchTarball(_ref, sha256) {
+    const cached = this.cache.readTarball(sha256);
+    if (cached) {
+      const actual2 = sha256Hex(cached);
+      if (actual2 !== sha256) {
+        throw new TarballHashMismatchError(sha256, actual2);
       }
+      return cached;
     }
-  }
-  if (errors.length > 0) {
-    return { ok: false, preset, errors };
-  }
-  return { ok: true, preset, errors: [] };
-}
-function parsePresetYaml(yamlContent) {
-  let data;
-  try {
-    data = parse(yamlContent);
-  } catch (err) {
-    return {
-      ok: false,
-      errors: [`YAML parse error: ${err instanceof Error ? err.message : String(err)}`]
-    };
-  }
-  return parsePreset(data);
-}
-function detectNestedPresetRefs(preset, knownPresetRefs) {
-  const nested = [];
-  for (const item of preset.items) {
-    if (item.ref.startsWith("library://") || item.ref.startsWith("#")) continue;
-    if (knownPresetRefs?.has(item.ref)) {
-      nested.push(item.ref);
+    if (this.cache.airGapped) {
+      throw new OfflineError(`Tarball '${sha256}' not in cache`);
+    }
+    const url = `${this.baseUrl}/tarball/${encodeURIComponent(sha256)}`;
+    const res = await this.httpClient(url, { method: "GET", redirect: "follow" });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `Failed to fetch tarball ${sha256}: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
+    }
+    const buf = new Uint8Array(await res.arrayBuffer());
+    const actual = sha256Hex(buf);
+    if (actual !== sha256) {
+      throw new TarballHashMismatchError(sha256, actual);
     }
+    this.cache.writeTarball(sha256, buf);
+    return buf;
   }
-  return nested;
-}
-function validateNestingDepth(presetRef, currentDepth) {
-  const MAX_DEPTH = 3;
-  if (currentDepth >= MAX_DEPTH) {
-    return `Preset "${presetRef}" exceeds maximum nesting depth (${MAX_DEPTH} levels allowed, depth ${currentDepth} reached)`;
+  /**
+   * Enumerate available versions for a version-less ref. The Catalog has no
+   * dedicated version-list route, so this derives versions from `listAssets`
+   * (filtered to the publisher) and keeps only the matching kind+name. Reuses
+   * the cached list path, so repeated calls are cheap.
+   */
+  async listVersions(ref) {
+    const parsed = parseAssetRef(ref);
+    const wantPublisher = parsed.publisher?.replace(/^@/, "");
+    const assets = await this.listAssets(wantPublisher ? { publisher: wantPublisher } : void 0);
+    return assets.filter(
+      (a) => a.kind === parsed.kind && a.name === parsed.name && (wantPublisher === void 0 || a.publisher.replace(/^@/, "") === wantPublisher)
+    ).map((a) => a.version);
   }
-  return void 0;
-}
-
-// library/src/preset/resolve-item.ts
-function classifyRef(ref) {
-  if (ref.startsWith("library://")) return "library-instance";
-  if (ref.startsWith("#")) return "cross-item";
-  return "asset";
-}
-function extractLibraryInstanceId(ref) {
-  const match = ref.match(/^library:\/\/[^/]+\/instances\/([a-f0-9-]+)$/i);
-  return match ? match[1] : null;
-}
-async function resolveItem(item, library, knownPresetRefs) {
-  const ref = item.ref;
-  if (ref.startsWith("#")) {
-    return { kind: "cross-item", item, targetId: ref.slice(1) };
+  /**
+   * Single synthetic Source pointing at the configured Catalog URL. Phase 2
+   * is single-Source per spec; multi-source federation is Phase 4.8.
+   */
+  async listSources() {
+    return [{ id: this.id, type: "remote-catalog", url: this.baseUrl }];
   }
-  if (ref.startsWith("library://")) {
-    const instanceId = extractLibraryInstanceId(ref);
-    if (!instanceId) {
-      return { kind: "library-instance", item, instanceId: "", instance: null };
+  // ── extension API ───────────────────────────────────────────────────────
+  /**
+   * Force a metadata-cache refresh. Wipes all resolve/list entries and
+   * re-fetches `listAssets()` (no filter) to pre-warm the canonical query.
+   *
+   * Driven by `skaile update`. Tarballs (content-addressed) are not touched
+   * — they remain valid across refreshes.
+   *
+   * In air-gapped mode this method **does** make a network call (bypassing
+   * the TTL=0 gate); it is the only way to repopulate the cache.
+   */
+  async refresh() {
+    this.cache.invalidateAll();
+    const items = await this.fetchListNetwork(void 0);
+    this.cache.setList(void 0, items);
+    for (const item of items) {
+      this.cache.setResolve(item.id, item);
     }
-    const instance = await library.getInstance(instanceId);
-    return { kind: "library-instance", item, instanceId, instance };
-  }
-  if (knownPresetRefs?.has(ref)) {
-    return { kind: "nested-preset", item, presetRef: ref };
+    return { assetsCached: items.length };
   }
-  const assetDef = await library.getAssetDef(ref);
-  return { kind: "asset", item, defRef: ref, assetDef };
-}
-async function resolveAllItems(items, library, knownPresetRefs) {
-  return Promise.all(items.map((item) => resolveItem(item, library, knownPresetRefs)));
-}
-
-// library/src/preset/placeholders.ts
-function validatePlaceholder(placeholder, value) {
-  const { key, type = "text", required } = placeholder;
-  if (value === void 0 || value === null || value === "") {
-    if (placeholder.default !== void 0) {
-      return { valid: true, errors: [], value: placeholder.default };
+  /**
+   * Fetch the pointer-only install manifest for an asset ref.
+   *
+   * The install manifest is the Pointer Triple: the immutable upstream
+   * `source.url` + `source.commitSha`, the per-file `files[].sha256` list, a
+   * composite `sha256` rollup, plus `kind` and `tier`. Callers fetch the asset
+   * bytes directly from the upstream repo at that commit and verify each file
+   * against the recorded hashes — the Catalog itself never serves asset bytes.
+   *
+   * Wire surface: `GET /trpc/catalog.getInstallManifest?input=<superjson({ ref })>`.
+   *
+   * This is a `RemoteCatalogSource`-only method — it is not part of the
+   * `ICatalogSource` contract. `LocalCatalogSource` has the asset bytes on disk
+   * and has no pointer-triple concept, so adding it to the shared interface
+   * would force a meaningless implementation there.
+   *
+   * Not cached: the install path is a one-shot read driven by `skaile install`.
+   *
+   * @throws {@link CatalogHttpError} on a non-2xx response or malformed envelope.
+   */
+  async getInstallManifest(ref) {
+    const url = trpcGetUrl(this.baseUrl, "catalog.getInstallManifest", { ref });
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog.getInstallManifest ${ref} failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
     }
-    if (required === true || required === void 0) {
-      return { valid: false, errors: [`Placeholder "${key}" is required`] };
+    const data = await parseTrpcGet(res);
+    if (data === null || data === void 0 || typeof data !== "object") {
+      throw new CatalogHttpError(
+        `catalog.getInstallManifest ${ref} returned a non-object payload (got ${typeof data})`,
+        200,
+        url
+      );
     }
-    return { valid: true, errors: [], value: void 0 };
-  }
-  switch (type) {
-    case "text":
-      return validateText(key, value);
-    case "multiline":
-      return validateMultiline(key, value);
-    case "secret":
-      return validateSecret(key, value);
-    case "number":
-      return validateNumber(key, value);
-    case "boolean":
-      return validateBoolean(key, value);
-    case "enum":
-      return validateEnum(key, value, placeholder.values);
-    case "oauth":
-      return validateOauth(key, value);
-    case "instance-picker":
-      return validateInstancePicker(key, value);
+    return data;
   }
-}
-function validateAllPlaceholders(placeholders, inputs) {
-  const values = {};
-  const errors = [];
-  for (const ph of placeholders) {
-    const result = validatePlaceholder(ph, inputs[ph.key]);
-    if (!result.valid) {
-      errors.push(...result.errors);
-    } else if (result.value !== void 0) {
-      values[ph.key] = result.value;
+  /**
+   * Cheap probe used during cross-check when both a source-side and a store-side
+   * candidate at the same version need to be verified for sha256 equality.
+   * Returns only the composite sha256 — no source URL, no file list.
+   *
+   * Wire: `GET /trpc/catalog.getCanonicalDigest?input=<superjson({ ref })>`.
+   *
+   * Not cached: one-shot read during install resolution.
+   *
+   * @param ref - Canonical asset ref `<publisher>/<kind>:<name>@<version>`.
+   * @returns `{ sha256 }` on a 200, or `null` on a 404.
+   * @throws {@link CatalogHttpError} on a non-2xx/non-404 response or malformed payload.
+   * @docLink packages/library/api-reference#remote-catalog-source
+   */
+  async getCanonicalDigest(ref) {
+    const url = trpcGetUrl(this.baseUrl, "catalog.getCanonicalDigest", { ref });
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (res.status === 404) return null;
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog.getCanonicalDigest ${ref} failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
     }
+    const data = await parseTrpcGet(res);
+    if (!data || typeof data !== "object") {
+      throw new CatalogHttpError(
+        `catalog.getCanonicalDigest ${ref} returned a non-object payload`,
+        200,
+        url
+      );
+    }
+    const d = data;
+    if (typeof d.sha256 !== "string") {
+      throw new CatalogHttpError(
+        `catalog.getCanonicalDigest ${ref} missing sha256 string`,
+        200,
+        url
+      );
+    }
+    return { sha256: d.sha256 };
   }
-  return { valid: errors.length === 0, values, errors };
-}
-async function queryInstancePickerChoices(library, options) {
-  const filter = {};
-  if (options?.kind) {
-    filter.kind = options.kind;
-  }
-  if (options?.defRefPrefix) {
-    filter.defRef = options.defRefPrefix;
-  }
-  const instances2 = await library.listInstances(filter);
-  return instances2.map((inst) => ({
-    instanceId: inst.id,
-    defRef: inst.defRef,
-    label: `${inst.defRef} (${inst.id.slice(0, 8)})`
-  }));
-}
-function getDefaultValue(placeholder) {
-  return placeholder.default;
-}
-function isSecretPlaceholder(placeholder) {
-  return placeholder.type === "secret" || placeholder.type === "oauth";
-}
-function validateText(key, value) {
-  if (typeof value !== "string") {
-    return { valid: false, errors: [`Placeholder "${key}" must be a string`] };
-  }
-  return { valid: true, errors: [], value };
-}
-function validateMultiline(key, value) {
-  if (typeof value !== "string") {
-    return { valid: false, errors: [`Placeholder "${key}" must be a string`] };
+  /**
+   * Wait for any in-flight stale-while-revalidate background fetches to settle.
+   * Test-only escape hatch.
+   */
+  async waitForBackground() {
+    const promises = Array.from(this.inFlight.values());
+    await Promise.allSettled(promises);
   }
-  return { valid: true, errors: [], value };
-}
-function validateSecret(key, value) {
-  if (typeof value !== "string") {
-    return { valid: false, errors: [`Placeholder "${key}" must be a string`] };
+  // ── private ─────────────────────────────────────────────────────────────
+  scheduleBackground(key, fn) {
+    if (this.inFlight.has(key)) return;
+    const p = (async () => {
+      try {
+        await fn();
+      } catch (err) {
+        if (!this.silentBackgroundErrors) {
+          process.stderr.write(
+            `[skaile/catalog] Background refresh failed for ${key}: ${err instanceof Error ? err.message : String(err)}
+`
+          );
+        }
+      } finally {
+        this.inFlight.delete(key);
+      }
+    })();
+    this.inFlight.set(key, p);
   }
-  if (value.length === 0) {
-    return { valid: false, errors: [`Placeholder "${key}" (secret) cannot be empty`] };
+  async fetchAndStoreResolve(ref) {
+    const value = await this.fetchResolveNetwork(ref);
+    this.cache.setResolve(ref, value);
+    return value;
   }
-  return { valid: true, errors: [], value };
-}
-function validateNumber(key, value) {
-  if (typeof value === "number" && !Number.isNaN(value)) {
-    return { valid: true, errors: [], value };
+  async fetchAndStoreList(filter) {
+    const items = await this.fetchListNetwork(filter);
+    this.cache.setList(filter, items);
+    return items;
   }
-  if (typeof value === "string") {
-    const parsed = Number(value);
-    if (!Number.isNaN(parsed)) {
-      return { valid: true, errors: [], value: parsed };
+  /** Raw network call: GET /trpc/catalog.get?input=<superjson> */
+  async fetchResolveNetwork(ref) {
+    const url = trpcGetUrl(this.baseUrl, "catalog.get", { ref });
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog.get ${ref} failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
     }
+    const data = await parseTrpcGet(res);
+    if (data === null || data === void 0) return null;
+    return normalizeCatalogAsset(data);
   }
-  return { valid: false, errors: [`Placeholder "${key}" must be a valid number`] };
-}
-function validateBoolean(key, value) {
-  if (typeof value === "boolean") {
-    return { valid: true, errors: [], value };
-  }
-  if (typeof value === "string") {
-    const lower = value.toLowerCase();
-    if (lower === "true" || lower === "1" || lower === "yes") {
-      return { valid: true, errors: [], value: true };
+  /** Raw network call: GET /trpc/catalog.list?input=<superjson> */
+  async fetchListNetwork(filter) {
+    const input = filter ? { filter } : {};
+    const url = trpcGetUrl(this.baseUrl, "catalog.list", input);
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog.list failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
     }
-    if (lower === "false" || lower === "0" || lower === "no") {
-      return { valid: true, errors: [], value: false };
+    const data = await parseTrpcGet(res);
+    if (!Array.isArray(data)) {
+      throw new CatalogHttpError(
+        `catalog.list returned non-array payload (got ${typeof data})`,
+        200,
+        url
+      );
     }
+    return data.map(normalizeCatalogAsset);
   }
-  return { valid: false, errors: [`Placeholder "${key}" must be a boolean`] };
+};
+function trpcGetUrl(baseUrl, procedure, input) {
+  const wrapped = JSON.stringify({ json: input });
+  return `${baseUrl.replace(/\/+$/, "")}/trpc/${procedure}?input=${encodeURIComponent(wrapped)}`;
 }
-function validateEnum(key, value, allowedValues) {
-  if (!allowedValues || allowedValues.length === 0) {
-    return { valid: false, errors: [`Placeholder "${key}" (enum) has no allowed values defined`] };
+async function parseTrpcGet(res) {
+  const text2 = await res.text();
+  let body;
+  try {
+    body = text2.length > 0 ? JSON.parse(text2) : null;
+  } catch {
+    throw new CatalogHttpError(
+      `tRPC response is not valid JSON: ${text2.slice(0, 200)}`,
+      res.status
+    );
   }
-  const stringValue = String(value);
-  const matches = allowedValues.some((v) => String(v) === stringValue);
-  if (!matches) {
-    return {
-      valid: false,
-      errors: [
-        `Placeholder "${key}" value "${stringValue}" is not in allowed values: [${allowedValues.join(", ")}]`
-      ]
-    };
+  if (body && typeof body === "object" && "error" in body) {
+    const err = body.error;
+    throw new CatalogHttpError(
+      `tRPC error: ${err.message ?? "unknown"}${err.data?.code ? ` (${err.data.code})` : ""}`,
+      res.status
+    );
   }
-  const matched = allowedValues.find((v) => String(v) === stringValue);
-  return { valid: true, errors: [], value: matched };
-}
-function validateOauth(key, value) {
-  if (typeof value !== "string") {
-    return { valid: false, errors: [`Placeholder "${key}" (oauth) must be a string`] };
+  const result = body?.result;
+  if (!result || !("data" in result)) {
+    throw new CatalogHttpError(`tRPC response missing result.data envelope`, res.status);
   }
-  if (value.length === 0) {
-    return { valid: false, errors: [`Placeholder "${key}" (oauth) cannot be empty`] };
+  const data = result.data;
+  if (data && typeof data === "object" && !Array.isArray(data) && "json" in data) {
+    return data.json;
   }
-  return { valid: true, errors: [], value };
+  return data;
 }
-function validateInstancePicker(key, value) {
-  if (typeof value !== "string") {
-    return {
-      valid: false,
-      errors: [`Placeholder "${key}" (instance-picker) must be a string UUID`]
-    };
-  }
-  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  if (!uuidPattern.test(value)) {
-    return {
-      valid: false,
-      errors: [`Placeholder "${key}" (instance-picker) must be a valid UUID`]
-    };
+function normalizeCatalogAsset(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new CatalogHttpError("Catalog response item is not an object", 200);
   }
-  return { valid: true, errors: [], value };
+  const r = raw;
+  const publisher = pickString(r, "publisher") ?? pickString(r, "publisherSlug") ?? "";
+  const name = pickString(r, "name") ?? "";
+  const version = pickString(r, "version") ?? "";
+  const id = pickString(r, "id") ?? `${publisher}/${name}@${version}`;
+  const kind = pickString(r, "kind") ?? "";
+  const manifest = typeof r.manifest === "object" && r.manifest !== null ? r.manifest : typeof r.manifestJson === "object" && r.manifestJson !== null ? r.manifestJson : {};
+  const asset = {
+    id,
+    kind,
+    publisher,
+    name,
+    version,
+    manifest
+  };
+  const sha = pickString(r, "sha256") ?? pickString(r, "tarballSha256");
+  if (sha) asset.sha256 = sha;
+  const description = pickString(r, "description");
+  if (description) asset.description = description;
+  const license = pickString(r, "license");
+  if (license) asset.license = license;
+  const category = pickString(r, "category");
+  if (category) asset.category = category;
+  const repo = pickString(r, "repo");
+  if (repo) asset.repo = repo;
+  const domainSlug = pickString(r, "domainSlug");
+  if (domainSlug) asset.domainSlug = domainSlug;
+  return asset;
 }
-
-// library/src/preset/interpolate.ts
-var InterpolationError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "InterpolationError";
+function pickString(r, key) {
+  const v = r[key];
+  return typeof v === "string" ? v : void 0;
+}
+var CATALOG_REQUEST_TIMEOUT_MS = 1e4;
+var defaultFetch = async (url, init) => {
+  if (typeof fetch === "undefined") {
+    throw new Error("global fetch is not available; pass an httpClient explicitly");
   }
+  const requestInit = init ?? {};
+  return fetch(url, {
+    ...requestInit,
+    signal: requestInit.signal ?? AbortSignal.timeout(CATALOG_REQUEST_TIMEOUT_MS)
+  });
 };
-function interpolate(materialize, baseConfig, context, credentialRefPrefix) {
-  const config = { ...baseConfig ?? {} };
-  const secretsToStore = [];
-  let credentialRef;
-  if (!materialize) {
-    for (const [key, value] of Object.entries(context.inputs)) {
-      config[key] = value;
+
+// library/src/remote/rest-catalog-source.ts
+var DEFAULT_TTL_MS2 = 864e5;
+var RestCatalogSource = class {
+  id;
+  baseUrl;
+  cache;
+  cacheTtlMs;
+  httpClient;
+  silentBackgroundErrors;
+  /** Tracks in-flight background revalidations so callers can `await` them in tests. */
+  inFlight = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.id = `rest:${this.baseUrl}`;
+    this.cacheTtlMs = opts.cacheTtlMs ?? DEFAULT_TTL_MS2;
+    this.httpClient = opts.httpClient ?? defaultFetch2;
+    this.silentBackgroundErrors = opts.silentBackgroundErrors ?? false;
+    this.cache = opts.cache ?? new CatalogCache({
+      dir: opts.cacheDir,
+      ttlMs: this.cacheTtlMs,
+      now: opts.now
+    });
+  }
+  // ── ICatalogSource ──────────────────────────────────────────────────────
+  /**
+   * Resolve a single asset by canonical ref (`<publisher>/<name>@<version>`).
+   *
+   * Cache: hit returns immediately. Miss fetches `/api/catalog/get?ref=<ref>`. Stale
+   * entry serves the cached value and triggers a background refresh.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   */
+  async resolve(ref) {
+    const fresh = this.cache.getResolve(ref);
+    if (fresh) return fresh.value;
+    if (this.cache.airGapped) {
+      const stale2 = this.cache.getResolveStale(ref);
+      if (stale2) return stale2.value;
+      throw new OfflineError(`Asset '${ref}' not in cache`);
     }
-    if (Object.keys(context.secrets).length > 0) {
-      credentialRef = `${credentialRefPrefix}/creds`;
-      for (const [key, value] of Object.entries(context.secrets)) {
-        secretsToStore.push({ ref: `${credentialRef}/${key}`, value });
-      }
+    const stale = this.cache.getResolveStale(ref);
+    if (stale) {
+      this.scheduleBackground(`resolve:${ref}`, () => this.fetchAndStoreResolve(ref));
+      return stale.value;
     }
-    return { config, credentialRef, secretsToStore };
+    return this.fetchAndStoreResolve(ref);
   }
-  for (const [configPath, template] of Object.entries(materialize)) {
-    const resolved = resolveTemplate(template, context);
-    if (resolved.hasSecret) {
-      if (!credentialRef) {
-        credentialRef = `${credentialRefPrefix}/creds`;
-      }
-      const secretRef = `${credentialRef}/${configPath}`;
-      secretsToStore.push({ ref: secretRef, value: resolved.value });
-      setNestedValue(config, configPath, `secret://${secretRef}`);
-    } else {
-      setNestedValue(config, configPath, resolved.value);
+  /**
+   * List assets matching `filter`.
+   *
+   * Cache: hit returns immediately. Miss fetches `/api/catalog/list`. Stale
+   * entry serves the cached array and triggers a background refresh.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   *
+   * Note: `filter.prefix` is not supported by the forge-store REST API and is silently ignored.
+   */
+  async listAssets(filter) {
+    const fresh = this.cache.getList(filter);
+    if (fresh) return fresh.items;
+    if (this.cache.airGapped) {
+      const stale2 = this.cache.getListStale(filter);
+      if (stale2) return stale2.items;
+      throw new OfflineError("Catalog list not in cache");
     }
-  }
-  return { config, credentialRef, secretsToStore };
-}
-async function storeSecrets(router, secretsToStore) {
-  for (const { ref, value } of secretsToStore) {
-    const encoded = new TextEncoder().encode(value);
-    await router.setSecret(ref, encoded);
-  }
-}
-function hasInterpolationTokens(template) {
-  return INTERPOLATION_PATTERN.test(template);
-}
-function extractReferencedKeys(materialize) {
-  const inputKeys = /* @__PURE__ */ new Set();
-  const secretKeys = /* @__PURE__ */ new Set();
-  for (const template of Object.values(materialize)) {
-    const pattern = new RegExp(INTERPOLATION_PATTERN.source, "g");
-    for (const match of template.matchAll(pattern)) {
-      const namespace = match[1];
-      const key = match[2];
-      if (namespace === "INPUT") inputKeys.add(key);
-      else if (namespace === "SECRET") secretKeys.add(key);
+    const stale = this.cache.getListStale(filter);
+    if (stale) {
+      const filterKey2 = JSON.stringify(filter ?? null);
+      this.scheduleBackground(`list:${filterKey2}`, () => this.fetchAndStoreList(filter));
+      return stale.items;
     }
-  }
-  return { inputKeys: [...inputKeys], secretKeys: [...secretKeys] };
-}
-var INTERPOLATION_PATTERN = /\$\{(INPUT|SECRET):([^}]+)\}/;
-function resolveTemplate(template, context) {
-  const singleMatch = template.match(/^\$\{(INPUT|SECRET):([^}]+)\}$/);
-  if (singleMatch) {
-    const [, namespace, key] = singleMatch;
-    if (namespace === "SECRET") {
-      if (!(key in context.secrets)) {
-        throw new InterpolationError(`Missing secret key "${key}" in interpolation context`);
+    return this.fetchAndStoreList(filter);
+  }
+  /**
+   * Fetch the content-addressed tarball for an asset.
+   *
+   * Steps:
+   * 1. `GET /api/tarball/manifest?sha256=<sha256>` → JSON with `{ url, ... }`
+   * 2. `GET <manifest.url>` following redirects → raw bytes
+   * 3. Verify SHA256 client-side — hard fail on mismatch
+   * 4. Write to cache on success
+   *
+   * Cache: tarballs are content-addressed and cached forever once written.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   *
+   * @throws {@link TarballHashMismatchError} when the downloaded SHA256 does not match.
+   */
+  async fetchTarball(_ref, sha256) {
+    const cached = this.cache.readTarball(sha256);
+    if (cached) {
+      const actual2 = sha256Hex(cached);
+      if (actual2 !== sha256) {
+        throw new TarballHashMismatchError(sha256, actual2);
       }
-      return { value: context.secrets[key], hasSecret: true };
+      return cached;
     }
-    if (!(key in context.inputs)) {
-      throw new InterpolationError(`Missing input key "${key}" in interpolation context`);
+    if (this.cache.airGapped) {
+      throw new OfflineError(`Tarball '${sha256}' not in cache`);
     }
-    return { value: context.inputs[key], hasSecret: false };
-  }
-  const tokens = [...template.matchAll(/\$\{(INPUT|SECRET):([^}]+)\}/g)];
-  const hasSecretToken = tokens.some(([, ns]) => ns === "SECRET");
-  if (hasSecretToken) {
-    throw new InterpolationError(
-      `Template "${template}" mixes \${SECRET:...} with other tokens. SECRET must be the sole token in a template value.`
-    );
-  }
-  const result = template.replace(/\$\{INPUT:([^}]+)\}/g, (_, key) => {
-    if (!(key in context.inputs)) {
-      throw new InterpolationError(`Missing input key "${key}" in interpolation context`);
+    const manifestUrl = `${this.baseUrl}/api/tarball/manifest?sha256=${encodeURIComponent(sha256)}`;
+    const manifestRes = await this.httpClient(manifestUrl, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!manifestRes.ok) {
+      throw new CatalogHttpError(
+        `Failed to fetch tarball manifest for ${sha256}: ${manifestRes.status} ${manifestRes.statusText}`,
+        manifestRes.status,
+        manifestUrl
+      );
     }
-    return String(context.inputs[key] ?? "");
-  });
-  return { value: result, hasSecret: false };
-}
-function setNestedValue(obj, path13, value) {
-  const parts = path13.split(".");
-  let current = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    const key = parts[i];
-    if (current[key] === void 0 || current[key] === null || typeof current[key] !== "object") {
-      current[key] = {};
+    const manifestText = await manifestRes.text();
+    let manifest;
+    try {
+      manifest = JSON.parse(manifestText);
+    } catch {
+      throw new CatalogHttpError(
+        `Tarball manifest response is not valid JSON: ${manifestText.slice(0, 200)}`,
+        manifestRes.status,
+        manifestUrl
+      );
     }
-    current = current[key];
+    const downloadUrl = manifest && typeof manifest === "object" && "url" in manifest ? manifest.url : void 0;
+    if (typeof downloadUrl !== "string") {
+      throw new CatalogHttpError(
+        `Tarball manifest missing 'url' field`,
+        manifestRes.status,
+        manifestUrl
+      );
+    }
+    const tarballRes = await this.httpClient(downloadUrl, { method: "GET", redirect: "follow" });
+    if (!tarballRes.ok) {
+      throw new CatalogHttpError(
+        `Failed to fetch tarball ${sha256}: ${tarballRes.status} ${tarballRes.statusText}`,
+        tarballRes.status,
+        downloadUrl
+      );
+    }
+    const buf = new Uint8Array(await tarballRes.arrayBuffer());
+    const actual = sha256Hex(buf);
+    if (actual !== sha256) {
+      throw new TarballHashMismatchError(sha256, actual);
+    }
+    this.cache.writeTarball(sha256, buf);
+    return buf;
   }
-  current[parts[parts.length - 1]] = value;
-}
-
-// library/src/preset/apply.ts
-async function applyPreset(presetRef, manifest, inputs, opts) {
-  const depth = opts._depth ?? 0;
-  const pinPolicy = opts.pinPolicy ?? "minor-track";
-  const depthError = validateNestingDepth(presetRef, depth);
-  if (depthError) {
-    return { instances: [], assignments: [], errors: [depthError] };
+  /**
+   * Enumerate available versions for a version-less ref. The forge-store REST
+   * API has no version-list route, so this derives versions from `listAssets`
+   * (filtered to the publisher) and keeps only the matching kind+name. Reuses
+   * the cached list path, so repeated calls are cheap.
+   */
+  async listVersions(ref) {
+    const parsed = parseAssetRef(ref);
+    const wantPublisher = parsed.publisher?.replace(/^@/, "");
+    const assets = await this.listAssets(wantPublisher ? { publisher: wantPublisher } : void 0);
+    return assets.filter(
+      (a) => a.kind === parsed.kind && a.name === parsed.name && (wantPublisher === void 0 || a.publisher.replace(/^@/, "") === wantPublisher)
+    ).map((a) => a.version);
   }
-  const result = { instances: [], assignments: [], errors: [] };
-  const itemResults = /* @__PURE__ */ new Map();
-  for (const item of manifest.items) {
-    const itemResult = await applyItemImpl(
-      presetRef,
-      item,
-      inputs,
-      opts,
-      depth,
-      pinPolicy,
-      itemResults
-    );
-    result.errors.push(...itemResult.errors);
-    result.instances.push(...itemResult.instances);
-    if (item.id && itemResult.instances.length > 0) {
-      itemResults.set(item.id, itemResult.instances[0]);
+  /**
+   * Single synthetic Source pointing at the configured forge-store URL.
+   */
+  async listSources() {
+    return [{ id: this.id, type: "rest-catalog", url: this.baseUrl }];
+  }
+  // ── extension API ───────────────────────────────────────────────────────
+  /**
+   * Force a metadata-cache refresh. Wipes all resolve/list entries and
+   * re-fetches `listAssets()` (no filter) to pre-warm the canonical query.
+   *
+   * Driven by `skaile update`. Tarballs (content-addressed) are not touched.
+   *
+   * In air-gapped mode this method **does** make a network call (bypassing
+   * the TTL=0 gate); it is the only way to repopulate the cache.
+   */
+  async refresh() {
+    this.cache.invalidateAll();
+    const items = await this.fetchListNetwork(void 0);
+    this.cache.setList(void 0, items);
+    for (const item of items) {
+      this.cache.setResolve(item.id, item);
     }
-    result.assignments.push(...itemResult.assignments);
+    return { assetsCached: items.length };
   }
-  return result;
-}
-async function applyPresetFromData(presetRef, data, inputs, opts) {
-  const parseResult = parsePreset(data);
-  if (!parseResult.ok || !parseResult.preset) {
-    return {
-      instances: [],
-      assignments: [],
-      errors: parseResult.errors.map((e) => `Parse: ${e}`)
-    };
+  /**
+   * Wait for any in-flight stale-while-revalidate background fetches to settle.
+   * Test-only escape hatch.
+   */
+  async waitForBackground() {
+    const promises = Array.from(this.inFlight.values());
+    await Promise.allSettled(promises);
   }
-  return applyPreset(presetRef, parseResult.preset, inputs, opts);
-}
-async function applyItemImpl(presetRef, item, inputs, opts, depth, pinPolicy, itemResults) {
-  const { library } = opts;
-  const resolved = await resolveItem(item, library, opts.knownPresetRefs);
-  switch (resolved.kind) {
-    case "cross-item": {
-      const target = itemResults.get(resolved.targetId);
-      if (!target) {
-        return {
-          instances: [],
-          assignments: [],
-          errors: [
-            `Cross-item ref "#${resolved.targetId}" not yet resolved (items must be ordered)`
-          ]
-        };
-      }
-      return { instances: [target], assignments: [], errors: [] };
-    }
-    case "library-instance": {
-      if (!resolved.instance) {
-        return {
-          instances: [],
-          assignments: [],
-          errors: [`Library instance "${resolved.instanceId}" not found`]
-        };
-      }
+  // ── private ─────────────────────────────────────────────────────────────
+  scheduleBackground(key, fn) {
+    if (this.inFlight.has(key)) return;
+    const p = (async () => {
       try {
-        const asgn = await library.assign(opts.workspaceId, resolved.instanceId, pinPolicy);
-        return { instances: [resolved.instance], assignments: [asgn], errors: [] };
-      } catch {
-        return { instances: [resolved.instance], assignments: [], errors: [] };
-      }
-    }
-    case "nested-preset": {
-      if (!opts.loadPreset) {
-        return {
-          instances: [],
-          assignments: [],
-          errors: [`Cannot resolve nested preset "${resolved.presetRef}" \u2014 no loader provided`]
-        };
-      }
-      const nestedData = await opts.loadPreset(resolved.presetRef);
-      if (!nestedData) {
-        return {
-          instances: [],
-          assignments: [],
-          errors: [`Nested preset "${resolved.presetRef}" not found`]
-        };
-      }
-      const parseResult = parsePreset(nestedData);
-      if (!parseResult.ok || !parseResult.preset) {
-        return { instances: [], assignments: [], errors: parseResult.errors };
-      }
-      const nestedInputs = {
-        ...item.inputs ?? {},
-        ...inputs
-      };
-      const nestedResult = await applyPreset(resolved.presetRef, parseResult.preset, nestedInputs, {
-        ...opts,
-        _depth: depth + 1
-      });
-      return {
-        instances: nestedResult.instances,
-        assignments: nestedResult.assignments,
-        errors: nestedResult.errors
-      };
-    }
-    case "asset": {
-      const itemInputs = { ...inputs };
-      let validatedValues = {};
-      const secretValues = {};
-      if (item.placeholders && item.placeholders.length > 0) {
-        const nonSecretPhs = item.placeholders.filter((ph) => !isSecretPlaceholder(ph));
-        const secretPhs = item.placeholders.filter((ph) => isSecretPlaceholder(ph));
-        const validation = validateAllPlaceholders(nonSecretPhs, itemInputs);
-        if (!validation.valid) {
-          return { instances: [], assignments: [], errors: validation.errors };
-        }
-        validatedValues = validation.values;
-        const secretValidation = validateAllPlaceholders(secretPhs, itemInputs);
-        if (!secretValidation.valid) {
-          return { instances: [], assignments: [], errors: secretValidation.errors };
-        }
-        for (const [key, value] of Object.entries(secretValidation.values)) {
-          secretValues[key] = String(value);
+        await fn();
+      } catch (err) {
+        if (!this.silentBackgroundErrors) {
+          process.stderr.write(
+            `[skaile/catalog] Background refresh failed for ${key}: ${err instanceof Error ? err.message : String(err)}
+`
+          );
         }
+      } finally {
+        this.inFlight.delete(key);
       }
-      const credentialRefPrefix = `preset/${presetRef}/${item.id ?? resolved.defRef}`;
-      const context = {
-        inputs: validatedValues,
-        secrets: secretValues
-      };
-      const interpolated = interpolate(
-        item.materialize,
-        item.config,
-        context,
-        credentialRefPrefix
+    })();
+    this.inFlight.set(key, p);
+  }
+  async fetchAndStoreResolve(ref) {
+    const value = await this.fetchResolveNetwork(ref);
+    this.cache.setResolve(ref, value);
+    return value;
+  }
+  async fetchAndStoreList(filter) {
+    const items = await this.fetchListNetwork(filter);
+    this.cache.setList(filter, items);
+    return items;
+  }
+  /** Raw network call: GET /api/catalog/get?ref=<ref> */
+  async fetchResolveNetwork(ref) {
+    const url = `${this.baseUrl}/api/catalog/get?ref=${encodeURIComponent(ref)}`;
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog/get ${ref} failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
+    }
+    const data = await parseRestResponse(res, url);
+    if (data === null || data === void 0) return null;
+    return normalizeRestAsset(data);
+  }
+  /** Raw network call: GET /api/catalog/list?publisher=&kind=&category= */
+  async fetchListNetwork(filter) {
+    const params = new URLSearchParams();
+    if (filter?.publisher) params.set("publisher", filter.publisher);
+    if (filter?.kind) params.set("kind", filter.kind);
+    const qs = params.toString();
+    const url = `${this.baseUrl}/api/catalog/list${qs ? `?${qs}` : ""}`;
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog/list failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
       );
-      if (opts.secretsRouter && interpolated.secretsToStore.length > 0) {
-        try {
-          await storeSecrets(opts.secretsRouter, interpolated.secretsToStore);
-        } catch (err) {
-          return {
-            instances: [],
-            assignments: [],
-            errors: [
-              `Secret storage failed for "${item.ref}": ${err instanceof Error ? err.message : String(err)}`
-            ]
-          };
-        }
-      }
-      try {
-        const instance = await library.createInstance({
-          defRef: resolved.defRef,
-          defPin: pinPolicy,
-          config: interpolated.config,
-          credentialRef: interpolated.credentialRef,
-          createdBy: opts.createdBy ?? `preset:${presetRef}`
-        });
-        const assignments2 = [];
-        try {
-          const asgn = await library.assign(opts.workspaceId, instance.id, pinPolicy);
-          assignments2.push(asgn);
-        } catch {
-        }
-        return { instances: [instance], assignments: assignments2, errors: [] };
-      } catch (err) {
-        return {
-          instances: [],
-          assignments: [],
-          errors: [
-            `Instance creation failed for "${item.ref}": ${err instanceof Error ? err.message : String(err)}`
-          ]
-        };
-      }
     }
-  }
-}
-
-// library/src/preset/upgrade.ts
-function detectChanges(oldManifest, newManifest) {
-  const oldItems = indexItems(oldManifest.items);
-  const newItems = indexItems(newManifest.items);
-  const addedItems = [];
-  const removedItems = [];
-  const changedRefItems = [];
-  const configChangedItems = [];
-  for (const [key, oldItem] of oldItems) {
-    if (!newItems.has(key)) {
-      removedItems.push(oldItem);
+    const data = await parseRestResponse(res, url);
+    if (!Array.isArray(data)) {
+      throw new CatalogHttpError(
+        `catalog/list returned non-array payload (got ${typeof data})`,
+        200,
+        url
+      );
     }
+    return data.map(normalizeRestAsset);
   }
-  for (const [key, newItem] of newItems) {
-    if (!oldItems.has(key)) {
-      addedItems.push(newItem);
-    }
+};
+async function parseRestResponse(res, url) {
+  const text2 = await res.text();
+  if (text2.length === 0) return null;
+  try {
+    return JSON.parse(text2);
+  } catch {
+    throw new CatalogHttpError(
+      `REST response is not valid JSON: ${text2.slice(0, 200)}`,
+      res.status,
+      url
+    );
   }
-  for (const [key, newItem] of newItems) {
-    const oldItem = oldItems.get(key);
-    if (!oldItem) continue;
-    if (oldItem.ref !== newItem.ref) {
-      changedRefItems.push({ old: oldItem, new: newItem });
-    } else if (!deepEqual(oldItem.placeholders, newItem.placeholders) || !deepEqual(oldItem.materialize, newItem.materialize)) {
-      changedRefItems.push({ old: oldItem, new: newItem });
-    } else if (!deepEqual(oldItem.config, newItem.config)) {
-      configChangedItems.push({ old: oldItem, new: newItem });
-    }
+}
+function normalizeRestAsset(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new CatalogHttpError("Catalog REST response item is not an object", 200);
   }
-  const isStructural = addedItems.length > 0 || removedItems.length > 0 || changedRefItems.length > 0;
-  const kind = isStructural ? "structural" : "non-structural";
-  const summaryParts = [];
-  if (addedItems.length > 0) summaryParts.push(`+${addedItems.length} items`);
-  if (removedItems.length > 0) summaryParts.push(`-${removedItems.length} items`);
-  if (changedRefItems.length > 0) summaryParts.push(`${changedRefItems.length} ref changes`);
-  if (configChangedItems.length > 0)
-    summaryParts.push(`${configChangedItems.length} config changes`);
-  const summary = summaryParts.length > 0 ? `${kind}: ${summaryParts.join(", ")}` : "no changes";
-  return {
+  const r = raw;
+  const publisher = pickString2(r, "publisherNamespace") ?? pickString2(r, "publisher") ?? "";
+  const name = pickString2(r, "name") ?? "";
+  const version = pickString2(r, "version") ?? "";
+  const kind = pickString2(r, "kind") ?? "";
+  const id = `${publisher}/${name}@${version}`;
+  const requiresParsed = tryParseJson(pickString2(r, "requiresJson"));
+  const filesParsed = tryParseJson(pickString2(r, "filesJson"));
+  const manifest = { ...requiresParsed, ...filesParsed };
+  const asset = {
+    id,
     kind,
-    addedItems,
-    removedItems,
-    changedRefItems,
-    configChangedItems,
-    summary
+    publisher,
+    name,
+    version,
+    manifest
   };
+  const sha = pickString2(r, "sha256");
+  if (sha) asset.sha256 = sha;
+  const description = pickString2(r, "description");
+  if (description) asset.description = description;
+  const license = pickString2(r, "license");
+  if (license) asset.license = license;
+  const category = pickString2(r, "category");
+  if (category) asset.category = category;
+  const domainSlug = pickString2(r, "domainSlug");
+  if (domainSlug) asset.domainSlug = domainSlug;
+  return asset;
 }
-function evaluateUpgrade(oldManifest, newManifest) {
-  const diff = detectChanges(oldManifest, newManifest);
-  if (diff.kind === "non-structural") {
-    return { autoUpgradable: true, diff };
-  }
-  const requiredActions = [];
-  if (diff.addedItems.length > 0) {
-    requiredActions.push(
-      `Create ${diff.addedItems.length} new instance(s): ${diff.addedItems.map((i) => i.ref).join(", ")}`
-    );
-  }
-  if (diff.removedItems.length > 0) {
-    requiredActions.push(
-      `Remove ${diff.removedItems.length} instance(s): ${diff.removedItems.map((i) => i.ref).join(", ")}`
-    );
-  }
-  if (diff.changedRefItems.length > 0) {
-    requiredActions.push(`Replace ${diff.changedRefItems.length} instance(s) with new refs`);
+function pickString2(r, key) {
+  const v = r[key];
+  return typeof v === "string" ? v : void 0;
+}
+function tryParseJson(s) {
+  if (!s) return {};
+  try {
+    const parsed = JSON.parse(s);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
   }
-  return { autoUpgradable: false, diff, requiredActions };
+  return {};
 }
-async function applyNonStructuralUpgrade(newManifest, existingInstances, library) {
-  let updated = 0;
-  const errors = [];
-  for (const item of newManifest.items) {
-    const key = itemKey(item);
-    const instanceId = existingInstances.get(key);
-    if (!instanceId) continue;
-    if (item.config) {
-      try {
-        await library.updateInstance(instanceId, {
-          config: item.config
-        });
-        updated++;
-      } catch (err) {
-        errors.push(
-          `Failed to update instance "${instanceId}": ${err instanceof Error ? err.message : String(err)}`
+var CATALOG_REQUEST_TIMEOUT_MS2 = 1e4;
+var defaultFetch2 = async (url, init) => {
+  if (typeof fetch === "undefined") {
+    throw new Error("global fetch is not available; pass an httpClient explicitly");
+  }
+  const requestInit = init ?? {};
+  return fetch(url, {
+    ...requestInit,
+    signal: requestInit.signal ?? AbortSignal.timeout(CATALOG_REQUEST_TIMEOUT_MS2)
+  });
+};
+var MANIFEST_FILENAME = "skaile.manifest.yaml";
+async function writeManifestIfMissing(input) {
+  const manifestPath = path5.join(input.libraryPath, MANIFEST_FILENAME);
+  if (fs10.existsSync(manifestPath)) return { wrote: false, manifestPath };
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const yaml = `# Generated by skaile library add on ${now} (structure: ${input.structure})
+# Edit by hand to inline discovered assets; or run \`skaile library refresh-manifest\`.
+publisher: ""
+assets: []
+`;
+  fs10.writeFileSync(manifestPath, yaml, "utf-8");
+  if (input.ownership !== "owner") {
+    const excludePath = path5.join(input.libraryPath, ".git", "info", "exclude");
+    if (fs10.existsSync(path5.dirname(excludePath))) {
+      const current = fs10.existsSync(excludePath) ? fs10.readFileSync(excludePath, "utf-8") : "";
+      if (!current.includes(MANIFEST_FILENAME)) {
+        fs10.writeFileSync(
+          excludePath,
+          (current.endsWith("\n") || current === "" ? current : `${current}
+`) + `# skaile-managed local-overlay manifest
+${MANIFEST_FILENAME}
+`,
+          "utf-8"
         );
       }
     }
   }
-  return { updated, errors };
+  return { wrote: true, manifestPath };
 }
-function itemKey(item) {
-  return item.id ?? item.ref;
+var PinPolicySchema = z3.enum(PIN_POLICIES);
+var LibraryInstanceRefSchema = z3.object({
+  id: z3.string().uuid(),
+  alias: z3.string().optional()
+});
+var LibrarySectionSchema = z3.object({
+  pin_policy: PinPolicySchema.default("minor-track"),
+  instances: z3.array(LibraryInstanceRefSchema).default([])
+});
+var PresetAppliedItemSchema = z3.object({
+  instance_id: z3.string().uuid(),
+  def_ref: z3.string()
+});
+var PresetAppliedSchema = z3.object({
+  ref: z3.string(),
+  applied_at: z3.string(),
+  items: z3.array(PresetAppliedItemSchema).default([])
+});
+var WorkspaceConfigV2Schema = z3.object({
+  version: z3.literal(2),
+  library: LibrarySectionSchema.optional(),
+  presets_applied: z3.array(PresetAppliedSchema).optional()
+});
+var LockAssignmentSchema = z3.object({
+  assignment_id: z3.string().uuid(),
+  instance_id: z3.string().uuid(),
+  def_ref: z3.string(),
+  resolved_version: z3.string(),
+  resolved_sha256: z3.string().optional(),
+  pin_policy: PinPolicySchema
+});
+var RequiresEdgeSchema = z3.object({
+  from: z3.string(),
+  to: z3.string(),
+  kind: z3.string().optional()
+});
+var PresetExpandedSchema = z3.object({
+  preset_ref: z3.string(),
+  instance_ids: z3.array(z3.string().uuid())
+});
+var LockFileSchema = z3.object({
+  version: z3.literal(2),
+  generated_at: z3.string(),
+  assignments: z3.array(LockAssignmentSchema).default([]),
+  requires_graph: z3.array(RequiresEdgeSchema).default([]),
+  presets_expanded: z3.array(PresetExpandedSchema).default([])
+});
+function parseWorkspaceV2(raw) {
+  if (raw.version !== 2) return null;
+  return WorkspaceConfigV2Schema.parse(raw);
 }
-function indexItems(items) {
-  const map = /* @__PURE__ */ new Map();
-  for (const item of items) {
-    map.set(itemKey(item), item);
+function loadWorkspaceV2(dir, filename = "skaile.yaml") {
+  const filePath = path5.join(dir, filename);
+  if (!fs10.existsSync(filePath)) return null;
+  const content = fs10.readFileSync(filePath, "utf-8");
+  const raw = parse(content);
+  if (!raw || typeof raw !== "object") return null;
+  return parseWorkspaceV2(raw);
+}
+function saveWorkspaceV2(dir, v2, filename = "skaile.yaml") {
+  const filePath = path5.join(dir, filename);
+  let existing = {};
+  if (fs10.existsSync(filePath)) {
+    const content = fs10.readFileSync(filePath, "utf-8");
+    existing = parse(content) ?? {};
   }
-  return map;
+  existing.version = 2;
+  if (v2.library !== void 0) existing.library = v2.library;
+  if (v2.presets_applied !== void 0) existing.presets_applied = v2.presets_applied;
+  if (!fs10.existsSync(dir)) {
+    fs10.mkdirSync(dir, { recursive: true });
+  }
+  fs10.writeFileSync(filePath, stringify(existing, { indent: 2 }), "utf-8");
 }
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (a === void 0 && b === void 0) return true;
-  if (a === null && b === null) return true;
-  if (a === void 0 || b === void 0) return false;
-  if (a === null || b === null) return false;
-  return JSON.stringify(a) === JSON.stringify(b);
+var LOCK_FILENAME = "skaile.lock.yaml";
+function loadLockFile(dir) {
+  const filePath = path5.join(dir, LOCK_FILENAME);
+  if (!fs10.existsSync(filePath)) return null;
+  const content = fs10.readFileSync(filePath, "utf-8");
+  const raw = parse(content);
+  if (raw !== null && !("assignments" in raw) && "subscriptions" in raw) {
+    const legacySubs = raw.subscriptions;
+    raw.assignments = Array.isArray(legacySubs) ? legacySubs.map((s) => {
+      if (s !== null && typeof s === "object" && "subscription_id" in s && !("assignment_id" in s)) {
+        const { subscription_id, ...rest } = s;
+        return { assignment_id: subscription_id, ...rest };
+      }
+      return s;
+    }) : [];
+    delete raw.subscriptions;
+  }
+  return LockFileSchema.parse(raw);
+}
+function saveLockFile(dir, lock) {
+  const filePath = path5.join(dir, LOCK_FILENAME);
+  if (!fs10.existsSync(dir)) {
+    fs10.mkdirSync(dir, { recursive: true });
+  }
+  fs10.writeFileSync(
+    filePath,
+    `# Auto-generated by skaile. Do not edit manually.
+${stringify(lock, { indent: 2 })}`,
+    "utf-8"
+  );
+}
+function createEmptyLockFile() {
+  return {
+    version: 2,
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    assignments: [],
+    requires_graph: [],
+    presets_expanded: []
+  };
+}
+function detectWorkspaceVersion(dir, filename = "skaile.yaml") {
+  const filePath = path5.join(dir, filename);
+  if (!fs10.existsSync(filePath)) return null;
+  const content = fs10.readFileSync(filePath, "utf-8");
+  const raw = parse(content);
+  if (!raw || typeof raw !== "object") return null;
+  return raw.version === 2 ? 2 : 1;
 }
 
 export { AssignmentNotFoundError, CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateAssignmentError, DuplicateLibraryNameError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KNOWN_ASSET_KINDS, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LIBRARY_STRUCTURES, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibraryManager, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalIndex, LocalSyncDriver, LockAssignmentSchema, LockFileSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, SidecarGit, SkaileConfigSchema, SourceNotFoundError, TarballHashMismatchError, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, classifyRef, createEmptyLockFile, deriveSlug, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, getStoreManifestsDir, getStoreRoot, hasInterpolationTokens, interpolate, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, migrateSidecarsToStoreIfNeeded, migrateWorkspaceConfig, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, queryInstancePickerChoices, resolveAllItems, resolveConfig, resolveIndexPath, resolveItem, resolveLibraryDir, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, sha256Hex, skaileHomeDir, storeSecrets, trpcGetUrl, userConfigPath, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeManifestIfMissing };
-//# sourceMappingURL=chunk-MIH45XPY.js.map
-//# sourceMappingURL=chunk-MIH45XPY.js.map
+//# sourceMappingURL=chunk-LA2YSXEE.js.map
+//# sourceMappingURL=chunk-LA2YSXEE.js.map