@skaile/workspaces 0.33.0 → 0.35.0

package/dist/{chunk-H5YXL4KI.js → chunk-SAXDHVJZ.js}

@@ -1,4 +1,4 @@
-import { parseAssetRef } from './chunk-LFDZYCEO.js';
+import { parseAssetRef } from './chunk-BM7XANVN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, resolve } from 'path';
 import { stringify, parse } from 'yaml';
@@ -225,5 +225,5 @@ function saveSkPublishManifest(dir, manifest) {
 }
 
 export { SKAILE_MANIFEST_FILENAME, decodeSkaileManifest, encodeSkaileManifest, loadSkPublishManifest, saveSkPublishManifest };
-//# sourceMappingURL=chunk-H5YXL4KI.js.map
-//# sourceMappingURL=chunk-H5YXL4KI.js.map
+//# sourceMappingURL=chunk-SAXDHVJZ.js.map
+//# sourceMappingURL=chunk-SAXDHVJZ.js.map

package/dist/{chunk-H5YXL4KI.js.map → chunk-SAXDHVJZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../core/src/publish-manifest.ts"],"names":[],"mappings":";;;;;AAmJO,IAAM,wBAAA,GAA2B;AAIxC,SAAS,YAAY,GAAA,EAA0C;AAC7D,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,GAAA,KAAQ,QAAA,IAAY,EAAE,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,MAAA;AAC5D,EAAA,MAAM,GAAA,GAAsB,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAI;AACzC,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAA,CAAE,OAAO,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,MAAA,GAAS,CAAA,CAAE,MAAA;AACxE,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,gBAAgB,GAAA,EAA8C;AACrE,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,OAAA,KAAY,QAAA,IAAY,EAAE,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAO,MAAA;AACpE,EAAA,MAAM,GAAA,GAA0B,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,SAAA,KAAc,QAAA,IAAY,CAAA,CAAE,UAAU,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,SAAA,GAAY,CAAA,CAAE,SAAA;AACjF,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,WAAW,GAAA,EAA0D;AAC5E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,MAAA;AAChC,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,IACnB,CAAA,MAAA,IAAW,QAAQ,OAAO,IAAA,KAAS,YAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACnE,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,YAAY,OAAO,CAAA,CAAE,WAAW,QAAA,EAAU;AAC9D,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,IAAA,EAAM,CAAA,CAAE,MAAM,MAAA,EAAQ,CAAA,CAAE,QAAQ,CAAA;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG,OAAO,QAAA;AAChC,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,kBACP,IAAA,EACoF;AACpF,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAA,CAAM,IAAI,CAAA,IAAK,EAAC;AAAA,EAC3B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,aAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS,iBAAiB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAC5E,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC1E,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,iBAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS;AAAA;AACX,KACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,MAAA,EAAkC;AAC5D;AAGA,SAAS,oBAAA,CAAqB,KAA8B,QAAA,EAAmC;AAC7F,EAAA,IAAI,OAAO,GAAA,CAAI,SAAA,KAAc,YAAY,GAAA,CAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACjE,IAAA,QAAA,CAAS,YAAY,GAAA,CAAI,SAAA;AAAA,EAC3B;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,QAAA,KAAa,YAAY,GAAA,CAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/D,IAAA,QAAA,CAAS,WAAW,GAAA,CAAI,QAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG;AAChC,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,SAAA,CAAU,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AAC5F,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,SAAA,GAAY,KAAA;AAAA,EAC7C;AACA,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,IAAI,MAAA,WAAiB,MAAA,GAAS,MAAA;AAC9B,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,GAAA,CAAI,UAAU,CAAA;AACjD,EAAA,IAAI,UAAA,WAAqB,UAAA,GAAa,UAAA;AACxC;AAMA,SAAS,uBAAA,CACP,GAAA,EACA,IAAA,EACA,IAAA,EACA,WAAA,EACU;AACV,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,IAAA;AAChC,EAAA,KAAA,MAAW,OAAO,GAAA,EAAK;AACrB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,aAAA,CAAc,GAAG,CAAA;AACjB,MAAA,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,IACf,SAAS,GAAA,EAAK;AACZ,MAAA,WAAA,CAAY,IAAA,CAAK;AAAA,QACf,IAAA,EAAM,sBAAA;AAAA,QACN,QAAA,EAAU,SAAA;AAAA,QACV,OAAA,EAAS,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,gBAAA,EAC7B,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,QACA,IAAA,EAAM,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,aAAA;AAAA,OAC7B,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAOA,SAAS,gBAAA,CAAiB,MAAe,WAAA,EAAmD;AAC1F,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG,OAAO,MAAA;AACrE,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM,OAAO,MAAA;AAC3B,EAAA,MAAM,KAAA,GAAoB,EAAE,IAAA,EAAM,IAAA,EAAK;AACvC,EAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,EAAU,KAAA,CAAM,OAAO,CAAA,CAAE,IAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,CAAE,KAAK,CAAA;AAChC,EAAA,IAAI,KAAA,QAAa,KAAA,GAAQ,KAAA;AACzB,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,SAAA,KAAc,QAAA,EAAU,KAAA,CAAM,YAAY,CAAA,CAAE,SAAA;AACzD,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,KAAA,CAAM,SAAS,CAAA,CAAE,MAAA;AACnD,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,CAAA,CAAE,MAAM,CAAA;AACxC,EAAA,IAAI,WAAA,QAAmB,MAAA,GAAS,WAAA;AAEhC,EAAA,MAAM,OAAO,uBAAA,CAAwB,CAAA,CAAE,YAAA,EAAc,IAAA,EAAM,MAAM,WAAW,CAAA;AAC5E,EAAA,IAAI,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,YAAA,GAAe,IAAA;AAE1C,EAAA,IAAI,OAAO,CAAA,CAAE,WAAA,KAAgB,QAAA,EAAU,KAAA,CAAM,cAAc,CAAA,CAAE,WAAA;AAC7D,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,EAAG;AAC7B,IAAA,MAAM,EAAA,GAAK,EAAE,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,MAAM,QAAQ,CAAA;AACtE,IAAA,IAAI,EAAA,CAAG,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,QAAA,GAAW,EAAA;AAAA,EACtC;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AACvD,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AAEvD,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,oBAAA,CACP,GAAA,EACA,QAAA,EACA,WAAA,EACM;AACN,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG;AAChC,EAAA,MAAM,UAAwB,EAAC;AAC/B,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAI,MAAA,EAAQ;AAC7B,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,IAAA,EAAM,WAAW,CAAA;AAChD,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,MAAA,GAAS,OAAA;AAC5C;AAYO,SAAS,qBAAqB,IAAA,EAAoC;AACvE,EAAA,MAAM,IAAA,GAAO,kBAAkB,IAAI,CAAA;AACnC,EAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,UAAU,EAAC,EAAG,aAAa,CAAC,IAAA,CAAK,UAAU,CAAA,EAAE;AAAA,EACxD;AAEA,EAAA,MAAM,WAA8B,EAAC;AACrC,EAAA,MAAM,cAA4B,EAAC;AACnC,EAAA,oBAAA,CAAqB,IAAA,CAAK,KAAK,QAAQ,CAAA;AACvC,EAAA,oBAAA,CAAqB,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,WAAW,CAAA;AAEpD,EAAA,OAAO,EAAE,UAAU,WAAA,EAAY;AACjC;AAKA,IAAM,kBAAA,GAAkD;AAAA,EACtD,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAGA,IAAM,eAAA,GAAwC;AAAA,EAC5C,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,aAAa,CAAA,EAAwC;AAC5D,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,eAAA,EAAiB;AACjC,IAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,CAAA;AACnB,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,EACtC;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,qBAAqB,QAAA,EAAqC;AACxE,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,kBAAA,EAAoB;AACpC,IAAA,MAAM,KAAA,GAAQ,SAAS,GAAG,CAAA;AAC1B,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAI,GAAA,KAAQ,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5C,MAAA,GAAA,CAAI,MAAA,GAAU,KAAA,CAAuB,GAAA,CAAI,YAAY,CAAA;AAAA,IACvD,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,KAAK,CAAA;AAC1C;AASO,SAAS,sBAAsB,GAAA,EAAuC;AAC3E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,GAAG,wBAAwB,CAAA;AAC5D,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,YAAA,CAAa,UAAU,OAAO,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,qBAAqB,GAAG,CAAA;AAC1D,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,aAAA,IAAiB,CAAA,CAAE,IAAA,KAAS,iBAAiB,CAAA,EAAG;AACrF,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,QAAA;AACT;AAOO,SAAS,qBAAA,CAAsB,KAAa,QAAA,EAAqC;AACtF,EAAA,MAAM,WAAA,GAAc,QAAQ,GAAG,CAAA;AAC/B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,EAAa,wBAAwB,CAAA;AAC3D,EAAA,IAAI,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG;AAC5B,IAAA,SAAA,CAAU,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,EAC5C;AACA,EAAA,aAAA,CAAc,QAAA,EAAU,oBAAA,CAAqB,QAAQ,CAAC,CAAA;AACtD,EAAA,OAAO,QAAA;AACT","file":"chunk-H5YXL4KI.js","sourcesContent":["/**\n * Publish manifest — `skaile.manifest.yaml`\n *\n * What a repo PUBLISHES: the `publisher` / `version` / `assets[]` that used to\n * live in the publication half of `skaile.yaml`, plus a per-asset dependency\n * graph, store-listing metadata, and an optional curator `source:` pointer.\n *\n * ── Two files, two codecs ──────────────────────────────────────────────────\n *\n *   skaile.yaml             → SkWorkspaceConfig   (workspace + consumption)\n *   skaile.manifest.yaml    → SkPublishManifest   (publication)            ← this module\n *\n * A repo can have either file, both, or neither: a pure workspace has only\n * `skaile.yaml`; a pure asset repo (e.g. `ai-assets`) has only\n * `skaile.manifest.yaml`; a repo that is both has both.\n *\n * ── One format, three roles ────────────────────────────────────────────────\n *\n *   First-party    `source:` absent  → bytes live in this repo (`root`/`files`).\n *   Curator/sidecar `source:` present → bytes come from the referenced upstream,\n *                                       verified by `sha256`.\n *\n * `decodeSkaileManifest` mirrors `decodeSkaileYaml`: total (never throws),\n * returns {@link Diagnostic}s. Dep-ref strings are validated with `parseAssetRef`.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { parse, stringify } from \"yaml\";\nimport { parseAssetRef } from \"./models.js\";\nimport type { Diagnostic } from \"./workspace-config.js\";\n\n// ── Types ───────────────────────────────────────────────────────────────────\n\n/** One file inside a curated asset, pinned to an exact upstream blob hash. */\nexport interface ManifestFileEntry {\n  path: string;\n  /** 64-hex sha256 of the upstream blob. */\n  sha256: string;\n}\n\n/**\n * One entry in a manifest's `assets:` list. Either `root:` (recursive walk) or\n * `files:` (explicit list, supports globs for first-party; the granular\n * `{path, sha256}` form for curated upstream verification) declares which paths\n * constitute the asset. `version:` overrides the manifest-level version.\n *\n * @docLink packages/core/publish-manifest#asset-entry\n */\nexport interface AssetEntry {\n  kind: string;\n  name: string;\n  root?: string;\n  /**\n   * Explicit file listing. First-party manifests use bare `string[]` (globs,\n   * fast-glob). Curated entries may use the granular `{path, sha256}` form so\n   * the resolver fetches + verifies exact upstream blobs without a full clone.\n   */\n  files?: string[] | ManifestFileEntry[];\n  version?: string;\n  /** Per-asset publisher override (e.g. for curator/mirror repos). */\n  publisher?: string;\n\n  /**\n   * Canonical dep refs (`kind:@<publisher>/name[#version]`) — same grammar as\n   * `SkWorkspaceConfig.dependencies`. Authoritative for this asset's resolved\n   * deps. (Was `requires` in `.skaile-source.yaml`.)\n   */\n  dependencies?: string[];\n\n  /**\n   * Author-pinned composite sha256 over the asset's `files`/`root` (same\n   * deterministic algorithm as the walker + discovery). Optional locally;\n   * REQUIRED on store publish. (Was `.skaile-source.yaml` `assets[].sha256`.)\n   */\n  sha256?: string;\n\n  /**\n   * Curator override: this single asset's bytes come from a different upstream\n   * than the manifest-level `source`. Absent → inherit manifest `source` (or\n   * first-party when that is also absent).\n   */\n  source?: ManifestSource;\n\n  // ── Store-listing metadata (all optional; fall back to content frontmatter) ──\n  description?: string;\n  keywords?: string[];\n  category?: string;\n  license?: string;\n  homepage?: string;\n}\n\n/**\n * Upstream the bytes come from when a manifest curates a repo it does not own.\n * Absent → first-party (bytes live in the manifest's own repo).\n *\n * @docLink packages/core/publish-manifest#manifest-source\n */\nexport interface ManifestSource {\n  url: string;\n  /** 40-char commit the curated bytes are pinned to. */\n  commit?: string;\n}\n\n/**\n * Signing/attribution recorded when a manifest is published on behalf of others.\n *\n * @docLink packages/core/publish-manifest#manifest-provenance\n */\nexport interface ManifestProvenance {\n  curator: string;\n  signed_by?: string;\n}\n\n/**\n * Parsed `skaile.manifest.yaml` — what a repo publishes.\n *\n * @docLink packages/core/publish-manifest#sk-publish-manifest\n */\nexport interface SkPublishManifest {\n  publisher?: string;\n  version?: string;\n  /** Repo-level store defaults inherited by assets unless overridden per-entry. */\n  license?: string;\n  homepage?: string;\n  /**\n   * Repo-relative path prefixes holding dev-only assets — excluded from\n   * discovery/publish unless `--dev`. (Was `.skaile-source.yaml` `dev_paths`.)\n   */\n  dev_paths?: string[];\n  /**\n   * Curator mode: the single upstream all assets in this file come from. A\n   * per-asset `source` overrides it. Absent → first-party (own repo).\n   */\n  source?: ManifestSource;\n  /** Present when this manifest is curated/published on behalf of another author. */\n  provenance?: ManifestProvenance;\n  assets?: AssetEntry[];\n}\n\n/** Result of {@link decodeSkaileManifest}: the manifest plus any notes. */\nexport interface ManifestDecodeResult {\n  manifest: SkPublishManifest;\n  diagnostics: Diagnostic[];\n}\n\n/** The single fixed filename for a publish manifest. */\nexport const SKAILE_MANIFEST_FILENAME = \"skaile.manifest.yaml\";\n\n// ── Decode ──────────────────────────────────────────────────────────────────\n\nfunction parseSource(raw: unknown): ManifestSource | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const s = raw as Record<string, unknown>;\n  if (typeof s.url !== \"string\" || s.url.length === 0) return undefined;\n  const out: ManifestSource = { url: s.url };\n  if (typeof s.commit === \"string\" && s.commit.length > 0) out.commit = s.commit;\n  return out;\n}\n\nfunction parseProvenance(raw: unknown): ManifestProvenance | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const p = raw as Record<string, unknown>;\n  if (typeof p.curator !== \"string\" || p.curator.length === 0) return undefined;\n  const out: ManifestProvenance = { curator: p.curator };\n  if (typeof p.signed_by === \"string\" && p.signed_by.length > 0) out.signed_by = p.signed_by;\n  return out;\n}\n\n/** Parse `files:` as either `string[]` (globs) or `{path, sha256}[]` (granular). */\nfunction parseFiles(raw: unknown): string[] | ManifestFileEntry[] | undefined {\n  if (!Array.isArray(raw)) return undefined;\n  const strings: string[] = [];\n  const granular: ManifestFileEntry[] = [];\n  for (const item of raw) {\n    if (typeof item === \"string\") {\n      strings.push(item);\n    } else if (item && typeof item === \"object\" && !Array.isArray(item)) {\n      const f = item as Record<string, unknown>;\n      if (typeof f.path === \"string\" && typeof f.sha256 === \"string\") {\n        granular.push({ path: f.path, sha256: f.sha256 });\n      }\n    }\n  }\n  // A manifest uses one form per entry; if both somehow appear, granular wins\n  // (it is the verifiable form). Empty → undefined.\n  if (granular.length > 0) return granular;\n  if (strings.length > 0) return strings;\n  return undefined;\n}\n\n/** Parse the YAML root, returning either the mapping or an error diagnostic. */\nfunction parseManifestRoot(\n  text: string,\n): { ok: true; raw: Record<string, unknown> } | { ok: false; diagnostic: Diagnostic } {\n  let parsed: unknown;\n  try {\n    parsed = parse(text) ?? {};\n  } catch (err) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"yaml_syntax\",\n        severity: \"error\",\n        message: `Invalid YAML: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    };\n  }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"non_object_root\",\n        severity: \"error\",\n        message: \"skaile.manifest.yaml must be a mapping at the top level.\",\n      },\n    };\n  }\n  return { ok: true, raw: parsed as Record<string, unknown> };\n}\n\n/** Decode the manifest-level scalar/array/object fields onto `manifest`. */\nfunction decodeManifestFields(raw: Record<string, unknown>, manifest: SkPublishManifest): void {\n  if (typeof raw.publisher === \"string\" && raw.publisher.length > 0) {\n    manifest.publisher = raw.publisher;\n  }\n  if (typeof raw.version === \"string\" && raw.version.length > 0) {\n    manifest.version = raw.version;\n  }\n  if (typeof raw.license === \"string\" && raw.license.length > 0) {\n    manifest.license = raw.license;\n  }\n  if (typeof raw.homepage === \"string\" && raw.homepage.length > 0) {\n    manifest.homepage = raw.homepage;\n  }\n  if (Array.isArray(raw.dev_paths)) {\n    const paths = raw.dev_paths.filter((p): p is string => typeof p === \"string\" && p.length > 0);\n    if (paths.length > 0) manifest.dev_paths = paths;\n  }\n  const source = parseSource(raw.source);\n  if (source) manifest.source = source;\n  const provenance = parseProvenance(raw.provenance);\n  if (provenance) manifest.provenance = provenance;\n}\n\n/**\n * Validate an asset's `dependencies` via `parseAssetRef`, pushing a `warning`\n * for each malformed ref. Returns the kept (valid) refs.\n */\nfunction decodeAssetDependencies(\n  raw: unknown,\n  kind: string,\n  name: string,\n  diagnostics: Diagnostic[],\n): string[] {\n  const deps: string[] = [];\n  if (!Array.isArray(raw)) return deps;\n  for (const dep of raw) {\n    if (typeof dep !== \"string\") continue;\n    try {\n      parseAssetRef(dep);\n      deps.push(dep);\n    } catch (err) {\n      diagnostics.push({\n        code: \"malformed_dependency\",\n        severity: \"warning\",\n        message: `assets[${kind}:${name}].dependencies: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n        path: `assets.${kind}:${name}.dependencies`,\n      });\n    }\n  }\n  return deps;\n}\n\n/**\n * Decode one `assets[]` item into an {@link AssetEntry}, or `undefined` when the\n * item is not a mapping or lacks both `kind` and `name`. Pushes dependency\n * warnings to `diagnostics`.\n */\nfunction decodeAssetEntry(item: unknown, diagnostics: Diagnostic[]): AssetEntry | undefined {\n  if (!item || typeof item !== \"object\" || Array.isArray(item)) return undefined;\n  const a = item as Record<string, unknown>;\n  const kind = typeof a.kind === \"string\" ? a.kind : \"\";\n  const name = typeof a.name === \"string\" ? a.name : \"\";\n  if (!kind || !name) return undefined;\n  const entry: AssetEntry = { kind, name };\n  if (typeof a.root === \"string\") entry.root = a.root;\n  const files = parseFiles(a.files);\n  if (files) entry.files = files;\n  if (typeof a.version === \"string\") entry.version = a.version;\n  if (typeof a.publisher === \"string\") entry.publisher = a.publisher;\n  if (typeof a.sha256 === \"string\") entry.sha256 = a.sha256;\n  const assetSource = parseSource(a.source);\n  if (assetSource) entry.source = assetSource;\n\n  const deps = decodeAssetDependencies(a.dependencies, kind, name, diagnostics);\n  if (deps.length > 0) entry.dependencies = deps;\n\n  if (typeof a.description === \"string\") entry.description = a.description;\n  if (Array.isArray(a.keywords)) {\n    const kw = a.keywords.filter((k): k is string => typeof k === \"string\");\n    if (kw.length > 0) entry.keywords = kw;\n  }\n  if (typeof a.category === \"string\") entry.category = a.category;\n  if (typeof a.license === \"string\") entry.license = a.license;\n  if (typeof a.homepage === \"string\") entry.homepage = a.homepage;\n\n  return entry;\n}\n\n/** Decode the `assets[]` list onto `manifest`, collecting dependency warnings. */\nfunction decodeManifestAssets(\n  raw: Record<string, unknown>,\n  manifest: SkPublishManifest,\n  diagnostics: Diagnostic[],\n): void {\n  if (!Array.isArray(raw.assets)) return;\n  const entries: AssetEntry[] = [];\n  for (const item of raw.assets) {\n    const entry = decodeAssetEntry(item, diagnostics);\n    if (entry) entries.push(entry);\n  }\n  if (entries.length > 0) manifest.assets = entries;\n}\n\n/**\n * Decode `skaile.manifest.yaml` text into a {@link SkPublishManifest} plus\n * {@link Diagnostic}s. Total — never throws: a YAML syntax error or non-object\n * root is reported as an `error`-severity diagnostic with an empty manifest.\n * Malformed `assets[].dependencies` refs are reported as `warning`s (validated\n * via `parseAssetRef`) rather than silently dropped.\n *\n * Pair with {@link encodeSkaileManifest} for round-tripping.\n * @docLink packages/core/publish-manifest#decode-skaile-manifest\n */\nexport function decodeSkaileManifest(text: string): ManifestDecodeResult {\n  const root = parseManifestRoot(text);\n  if (!root.ok) {\n    return { manifest: {}, diagnostics: [root.diagnostic] };\n  }\n\n  const manifest: SkPublishManifest = {};\n  const diagnostics: Diagnostic[] = [];\n  decodeManifestFields(root.raw, manifest);\n  decodeManifestAssets(root.raw, manifest, diagnostics);\n\n  return { manifest, diagnostics };\n}\n\n// ── Encode ──────────────────────────────────────────────────────────────────\n\n/** Fixed top-level key order for {@link encodeSkaileManifest}. */\nconst MANIFEST_KEY_ORDER: (keyof SkPublishManifest)[] = [\n  \"publisher\",\n  \"version\",\n  \"license\",\n  \"homepage\",\n  \"dev_paths\",\n  \"source\",\n  \"provenance\",\n  \"assets\",\n];\n\n/** Fixed per-asset key order for {@link encodeSkaileManifest}. */\nconst ASSET_KEY_ORDER: (keyof AssetEntry)[] = [\n  \"kind\",\n  \"name\",\n  \"source\",\n  \"root\",\n  \"files\",\n  \"version\",\n  \"publisher\",\n  \"sha256\",\n  \"dependencies\",\n  \"description\",\n  \"keywords\",\n  \"category\",\n  \"license\",\n  \"homepage\",\n];\n\nfunction orderedAsset(a: AssetEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const key of ASSET_KEY_ORDER) {\n    const value = a[key];\n    if (value !== undefined) out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Encode a {@link SkPublishManifest} to canonical `skaile.manifest.yaml` text:\n * deterministic key order, only defined fields, `lineWidth: 120` (mirrors\n * `encodeSkaileYaml`).\n * @docLink packages/core/publish-manifest#encode-skaile-manifest\n */\nexport function encodeSkaileManifest(manifest: SkPublishManifest): string {\n  const out: Record<string, unknown> = {};\n  for (const key of MANIFEST_KEY_ORDER) {\n    const value = manifest[key];\n    if (value === undefined) continue;\n    if (key === \"assets\" && Array.isArray(value)) {\n      out.assets = (value as AssetEntry[]).map(orderedAsset);\n    } else {\n      out[key] = value;\n    }\n  }\n  return stringify(out, { lineWidth: 120 });\n}\n\n// ── File I/O ──────────────────────────────────────────────────────────────────\n\n/**\n * Load and decode `<dir>/skaile.manifest.yaml`. Returns `null` when the file is\n * absent or unparseable (mirrors `loadSkWorkspaceConfig`'s tolerant contract).\n * @docLink packages/core/publish-manifest#load-sk-publish-manifest\n */\nexport function loadSkPublishManifest(dir: string): SkPublishManifest | null {\n  const filePath = join(resolve(dir), SKAILE_MANIFEST_FILENAME);\n  if (!existsSync(filePath)) return null;\n  let raw: string;\n  try {\n    raw = readFileSync(filePath, \"utf-8\");\n  } catch {\n    return null;\n  }\n  const { manifest, diagnostics } = decodeSkaileManifest(raw);\n  if (diagnostics.some((d) => d.code === \"yaml_syntax\" || d.code === \"non_object_root\")) {\n    return null;\n  }\n  return manifest;\n}\n\n/**\n * Encode and write a manifest to `<dir>/skaile.manifest.yaml`, creating the\n * directory if needed. Returns the absolute path written.\n * @docLink packages/core/publish-manifest#save-sk-publish-manifest\n */\nexport function saveSkPublishManifest(dir: string, manifest: SkPublishManifest): string {\n  const resolvedDir = resolve(dir);\n  const filePath = join(resolvedDir, SKAILE_MANIFEST_FILENAME);\n  if (!existsSync(resolvedDir)) {\n    mkdirSync(resolvedDir, { recursive: true });\n  }\n  writeFileSync(filePath, encodeSkaileManifest(manifest));\n  return filePath;\n}\n"]}
+{"version":3,"sources":["../core/src/publish-manifest.ts"],"names":[],"mappings":";;;;;AAmJO,IAAM,wBAAA,GAA2B;AAIxC,SAAS,YAAY,GAAA,EAA0C;AAC7D,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,GAAA,KAAQ,QAAA,IAAY,EAAE,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,MAAA;AAC5D,EAAA,MAAM,GAAA,GAAsB,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAI;AACzC,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAA,CAAE,OAAO,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,MAAA,GAAS,CAAA,CAAE,MAAA;AACxE,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,gBAAgB,GAAA,EAA8C;AACrE,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,OAAA,KAAY,QAAA,IAAY,EAAE,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAO,MAAA;AACpE,EAAA,MAAM,GAAA,GAA0B,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,SAAA,KAAc,QAAA,IAAY,CAAA,CAAE,UAAU,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,SAAA,GAAY,CAAA,CAAE,SAAA;AACjF,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,WAAW,GAAA,EAA0D;AAC5E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,MAAA;AAChC,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,IACnB,CAAA,MAAA,IAAW,QAAQ,OAAO,IAAA,KAAS,YAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACnE,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,YAAY,OAAO,CAAA,CAAE,WAAW,QAAA,EAAU;AAC9D,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,IAAA,EAAM,CAAA,CAAE,MAAM,MAAA,EAAQ,CAAA,CAAE,QAAQ,CAAA;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG,OAAO,QAAA;AAChC,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,kBACP,IAAA,EACoF;AACpF,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAA,CAAM,IAAI,CAAA,IAAK,EAAC;AAAA,EAC3B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,aAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS,iBAAiB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAC5E,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC1E,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,iBAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS;AAAA;AACX,KACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,MAAA,EAAkC;AAC5D;AAGA,SAAS,oBAAA,CAAqB,KAA8B,QAAA,EAAmC;AAC7F,EAAA,IAAI,OAAO,GAAA,CAAI,SAAA,KAAc,YAAY,GAAA,CAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACjE,IAAA,QAAA,CAAS,YAAY,GAAA,CAAI,SAAA;AAAA,EAC3B;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,QAAA,KAAa,YAAY,GAAA,CAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/D,IAAA,QAAA,CAAS,WAAW,GAAA,CAAI,QAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG;AAChC,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,SAAA,CAAU,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AAC5F,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,SAAA,GAAY,KAAA;AAAA,EAC7C;AACA,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,IAAI,MAAA,WAAiB,MAAA,GAAS,MAAA;AAC9B,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,GAAA,CAAI,UAAU,CAAA;AACjD,EAAA,IAAI,UAAA,WAAqB,UAAA,GAAa,UAAA;AACxC;AAMA,SAAS,uBAAA,CACP,GAAA,EACA,IAAA,EACA,IAAA,EACA,WAAA,EACU;AACV,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,IAAA;AAChC,EAAA,KAAA,MAAW,OAAO,GAAA,EAAK;AACrB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,aAAA,CAAc,GAAG,CAAA;AACjB,MAAA,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,IACf,SAAS,GAAA,EAAK;AACZ,MAAA,WAAA,CAAY,IAAA,CAAK;AAAA,QACf,IAAA,EAAM,sBAAA;AAAA,QACN,QAAA,EAAU,SAAA;AAAA,QACV,OAAA,EAAS,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,gBAAA,EAC7B,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,QACA,IAAA,EAAM,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,aAAA;AAAA,OAC7B,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAOA,SAAS,gBAAA,CAAiB,MAAe,WAAA,EAAmD;AAC1F,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG,OAAO,MAAA;AACrE,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM,OAAO,MAAA;AAC3B,EAAA,MAAM,KAAA,GAAoB,EAAE,IAAA,EAAM,IAAA,EAAK;AACvC,EAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,EAAU,KAAA,CAAM,OAAO,CAAA,CAAE,IAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,CAAE,KAAK,CAAA;AAChC,EAAA,IAAI,KAAA,QAAa,KAAA,GAAQ,KAAA;AACzB,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,SAAA,KAAc,QAAA,EAAU,KAAA,CAAM,YAAY,CAAA,CAAE,SAAA;AACzD,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,KAAA,CAAM,SAAS,CAAA,CAAE,MAAA;AACnD,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,CAAA,CAAE,MAAM,CAAA;AACxC,EAAA,IAAI,WAAA,QAAmB,MAAA,GAAS,WAAA;AAEhC,EAAA,MAAM,OAAO,uBAAA,CAAwB,CAAA,CAAE,YAAA,EAAc,IAAA,EAAM,MAAM,WAAW,CAAA;AAC5E,EAAA,IAAI,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,YAAA,GAAe,IAAA;AAE1C,EAAA,IAAI,OAAO,CAAA,CAAE,WAAA,KAAgB,QAAA,EAAU,KAAA,CAAM,cAAc,CAAA,CAAE,WAAA;AAC7D,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,EAAG;AAC7B,IAAA,MAAM,EAAA,GAAK,EAAE,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,MAAM,QAAQ,CAAA;AACtE,IAAA,IAAI,EAAA,CAAG,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,QAAA,GAAW,EAAA;AAAA,EACtC;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AACvD,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AAEvD,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,oBAAA,CACP,GAAA,EACA,QAAA,EACA,WAAA,EACM;AACN,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG;AAChC,EAAA,MAAM,UAAwB,EAAC;AAC/B,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAI,MAAA,EAAQ;AAC7B,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,IAAA,EAAM,WAAW,CAAA;AAChD,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,MAAA,GAAS,OAAA;AAC5C;AAYO,SAAS,qBAAqB,IAAA,EAAoC;AACvE,EAAA,MAAM,IAAA,GAAO,kBAAkB,IAAI,CAAA;AACnC,EAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,UAAU,EAAC,EAAG,aAAa,CAAC,IAAA,CAAK,UAAU,CAAA,EAAE;AAAA,EACxD;AAEA,EAAA,MAAM,WAA8B,EAAC;AACrC,EAAA,MAAM,cAA4B,EAAC;AACnC,EAAA,oBAAA,CAAqB,IAAA,CAAK,KAAK,QAAQ,CAAA;AACvC,EAAA,oBAAA,CAAqB,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,WAAW,CAAA;AAEpD,EAAA,OAAO,EAAE,UAAU,WAAA,EAAY;AACjC;AAKA,IAAM,kBAAA,GAAkD;AAAA,EACtD,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAGA,IAAM,eAAA,GAAwC;AAAA,EAC5C,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,aAAa,CAAA,EAAwC;AAC5D,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,eAAA,EAAiB;AACjC,IAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,CAAA;AACnB,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,EACtC;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,qBAAqB,QAAA,EAAqC;AACxE,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,kBAAA,EAAoB;AACpC,IAAA,MAAM,KAAA,GAAQ,SAAS,GAAG,CAAA;AAC1B,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAI,GAAA,KAAQ,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5C,MAAA,GAAA,CAAI,MAAA,GAAU,KAAA,CAAuB,GAAA,CAAI,YAAY,CAAA;AAAA,IACvD,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,KAAK,CAAA;AAC1C;AASO,SAAS,sBAAsB,GAAA,EAAuC;AAC3E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,GAAG,wBAAwB,CAAA;AAC5D,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,YAAA,CAAa,UAAU,OAAO,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,qBAAqB,GAAG,CAAA;AAC1D,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,aAAA,IAAiB,CAAA,CAAE,IAAA,KAAS,iBAAiB,CAAA,EAAG;AACrF,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,QAAA;AACT;AAOO,SAAS,qBAAA,CAAsB,KAAa,QAAA,EAAqC;AACtF,EAAA,MAAM,WAAA,GAAc,QAAQ,GAAG,CAAA;AAC/B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,EAAa,wBAAwB,CAAA;AAC3D,EAAA,IAAI,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG;AAC5B,IAAA,SAAA,CAAU,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,EAC5C;AACA,EAAA,aAAA,CAAc,QAAA,EAAU,oBAAA,CAAqB,QAAQ,CAAC,CAAA;AACtD,EAAA,OAAO,QAAA;AACT","file":"chunk-SAXDHVJZ.js","sourcesContent":["/**\n * Publish manifest — `skaile.manifest.yaml`\n *\n * What a repo PUBLISHES: the `publisher` / `version` / `assets[]` that used to\n * live in the publication half of `skaile.yaml`, plus a per-asset dependency\n * graph, store-listing metadata, and an optional curator `source:` pointer.\n *\n * ── Two files, two codecs ──────────────────────────────────────────────────\n *\n *   skaile.yaml             → SkWorkspaceConfig   (workspace + consumption)\n *   skaile.manifest.yaml    → SkPublishManifest   (publication)            ← this module\n *\n * A repo can have either file, both, or neither: a pure workspace has only\n * `skaile.yaml`; a pure asset repo (e.g. `ai-assets`) has only\n * `skaile.manifest.yaml`; a repo that is both has both.\n *\n * ── One format, three roles ────────────────────────────────────────────────\n *\n *   First-party    `source:` absent  → bytes live in this repo (`root`/`files`).\n *   Curator/sidecar `source:` present → bytes come from the referenced upstream,\n *                                       verified by `sha256`.\n *\n * `decodeSkaileManifest` mirrors `decodeSkaileYaml`: total (never throws),\n * returns {@link Diagnostic}s. Dep-ref strings are validated with `parseAssetRef`.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { parse, stringify } from \"yaml\";\nimport { parseAssetRef } from \"./models.js\";\nimport type { Diagnostic } from \"./workspace-config.js\";\n\n// ── Types ───────────────────────────────────────────────────────────────────\n\n/** One file inside a curated asset, pinned to an exact upstream blob hash. */\nexport interface ManifestFileEntry {\n  path: string;\n  /** 64-hex sha256 of the upstream blob. */\n  sha256: string;\n}\n\n/**\n * One entry in a manifest's `assets:` list. Either `root:` (recursive walk) or\n * `files:` (explicit list, supports globs for first-party; the granular\n * `{path, sha256}` form for curated upstream verification) declares which paths\n * constitute the asset. `version:` overrides the manifest-level version.\n *\n * @docLink packages/core/publish-manifest#asset-entry\n */\nexport interface AssetEntry {\n  kind: string;\n  name: string;\n  root?: string;\n  /**\n   * Explicit file listing. First-party manifests use bare `string[]` (globs,\n   * fast-glob). Curated entries may use the granular `{path, sha256}` form so\n   * the resolver fetches + verifies exact upstream blobs without a full clone.\n   */\n  files?: string[] | ManifestFileEntry[];\n  version?: string;\n  /** Per-asset publisher override (e.g. for curator/mirror repos). */\n  publisher?: string;\n\n  /**\n   * Canonical dep refs (`kind:@<publisher>/name[#version]`) — same grammar as\n   * `SkWorkspaceConfig.dependencies`. Authoritative for this asset's resolved\n   * deps. (Was `requires` in `.skaile-source.yaml`.)\n   */\n  dependencies?: string[];\n\n  /**\n   * Author-pinned composite sha256 over the asset's `files`/`root` (same\n   * deterministic algorithm as the walker + discovery). Optional locally;\n   * REQUIRED on store publish. (Was `.skaile-source.yaml` `assets[].sha256`.)\n   */\n  sha256?: string;\n\n  /**\n   * Curator override: this single asset's bytes come from a different upstream\n   * than the manifest-level `source`. Absent → inherit manifest `source` (or\n   * first-party when that is also absent).\n   */\n  source?: ManifestSource;\n\n  // ── Store-listing metadata (all optional; fall back to content frontmatter) ──\n  description?: string;\n  keywords?: string[];\n  category?: string;\n  license?: string;\n  homepage?: string;\n}\n\n/**\n * Upstream the bytes come from when a manifest curates a repo it does not own.\n * Absent → first-party (bytes live in the manifest's own repo).\n *\n * @docLink packages/core/publish-manifest#manifest-source\n */\nexport interface ManifestSource {\n  url: string;\n  /** 40-char commit the curated bytes are pinned to. */\n  commit?: string;\n}\n\n/**\n * Signing/attribution recorded when a manifest is published on behalf of others.\n *\n * @docLink packages/core/publish-manifest#manifest-provenance\n */\nexport interface ManifestProvenance {\n  curator: string;\n  signed_by?: string;\n}\n\n/**\n * Parsed `skaile.manifest.yaml` — what a repo publishes.\n *\n * @docLink packages/core/publish-manifest#sk-publish-manifest\n */\nexport interface SkPublishManifest {\n  publisher?: string;\n  version?: string;\n  /** Repo-level store defaults inherited by assets unless overridden per-entry. */\n  license?: string;\n  homepage?: string;\n  /**\n   * Repo-relative path prefixes holding dev-only assets — excluded from\n   * discovery/publish unless `--dev`. (Was `.skaile-source.yaml` `dev_paths`.)\n   */\n  dev_paths?: string[];\n  /**\n   * Curator mode: the single upstream all assets in this file come from. A\n   * per-asset `source` overrides it. Absent → first-party (own repo).\n   */\n  source?: ManifestSource;\n  /** Present when this manifest is curated/published on behalf of another author. */\n  provenance?: ManifestProvenance;\n  assets?: AssetEntry[];\n}\n\n/** Result of {@link decodeSkaileManifest}: the manifest plus any notes. */\nexport interface ManifestDecodeResult {\n  manifest: SkPublishManifest;\n  diagnostics: Diagnostic[];\n}\n\n/** The single fixed filename for a publish manifest. */\nexport const SKAILE_MANIFEST_FILENAME = \"skaile.manifest.yaml\";\n\n// ── Decode ──────────────────────────────────────────────────────────────────\n\nfunction parseSource(raw: unknown): ManifestSource | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const s = raw as Record<string, unknown>;\n  if (typeof s.url !== \"string\" || s.url.length === 0) return undefined;\n  const out: ManifestSource = { url: s.url };\n  if (typeof s.commit === \"string\" && s.commit.length > 0) out.commit = s.commit;\n  return out;\n}\n\nfunction parseProvenance(raw: unknown): ManifestProvenance | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const p = raw as Record<string, unknown>;\n  if (typeof p.curator !== \"string\" || p.curator.length === 0) return undefined;\n  const out: ManifestProvenance = { curator: p.curator };\n  if (typeof p.signed_by === \"string\" && p.signed_by.length > 0) out.signed_by = p.signed_by;\n  return out;\n}\n\n/** Parse `files:` as either `string[]` (globs) or `{path, sha256}[]` (granular). */\nfunction parseFiles(raw: unknown): string[] | ManifestFileEntry[] | undefined {\n  if (!Array.isArray(raw)) return undefined;\n  const strings: string[] = [];\n  const granular: ManifestFileEntry[] = [];\n  for (const item of raw) {\n    if (typeof item === \"string\") {\n      strings.push(item);\n    } else if (item && typeof item === \"object\" && !Array.isArray(item)) {\n      const f = item as Record<string, unknown>;\n      if (typeof f.path === \"string\" && typeof f.sha256 === \"string\") {\n        granular.push({ path: f.path, sha256: f.sha256 });\n      }\n    }\n  }\n  // A manifest uses one form per entry; if both somehow appear, granular wins\n  // (it is the verifiable form). Empty → undefined.\n  if (granular.length > 0) return granular;\n  if (strings.length > 0) return strings;\n  return undefined;\n}\n\n/** Parse the YAML root, returning either the mapping or an error diagnostic. */\nfunction parseManifestRoot(\n  text: string,\n): { ok: true; raw: Record<string, unknown> } | { ok: false; diagnostic: Diagnostic } {\n  let parsed: unknown;\n  try {\n    parsed = parse(text) ?? {};\n  } catch (err) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"yaml_syntax\",\n        severity: \"error\",\n        message: `Invalid YAML: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    };\n  }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"non_object_root\",\n        severity: \"error\",\n        message: \"skaile.manifest.yaml must be a mapping at the top level.\",\n      },\n    };\n  }\n  return { ok: true, raw: parsed as Record<string, unknown> };\n}\n\n/** Decode the manifest-level scalar/array/object fields onto `manifest`. */\nfunction decodeManifestFields(raw: Record<string, unknown>, manifest: SkPublishManifest): void {\n  if (typeof raw.publisher === \"string\" && raw.publisher.length > 0) {\n    manifest.publisher = raw.publisher;\n  }\n  if (typeof raw.version === \"string\" && raw.version.length > 0) {\n    manifest.version = raw.version;\n  }\n  if (typeof raw.license === \"string\" && raw.license.length > 0) {\n    manifest.license = raw.license;\n  }\n  if (typeof raw.homepage === \"string\" && raw.homepage.length > 0) {\n    manifest.homepage = raw.homepage;\n  }\n  if (Array.isArray(raw.dev_paths)) {\n    const paths = raw.dev_paths.filter((p): p is string => typeof p === \"string\" && p.length > 0);\n    if (paths.length > 0) manifest.dev_paths = paths;\n  }\n  const source = parseSource(raw.source);\n  if (source) manifest.source = source;\n  const provenance = parseProvenance(raw.provenance);\n  if (provenance) manifest.provenance = provenance;\n}\n\n/**\n * Validate an asset's `dependencies` via `parseAssetRef`, pushing a `warning`\n * for each malformed ref. Returns the kept (valid) refs.\n */\nfunction decodeAssetDependencies(\n  raw: unknown,\n  kind: string,\n  name: string,\n  diagnostics: Diagnostic[],\n): string[] {\n  const deps: string[] = [];\n  if (!Array.isArray(raw)) return deps;\n  for (const dep of raw) {\n    if (typeof dep !== \"string\") continue;\n    try {\n      parseAssetRef(dep);\n      deps.push(dep);\n    } catch (err) {\n      diagnostics.push({\n        code: \"malformed_dependency\",\n        severity: \"warning\",\n        message: `assets[${kind}:${name}].dependencies: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n        path: `assets.${kind}:${name}.dependencies`,\n      });\n    }\n  }\n  return deps;\n}\n\n/**\n * Decode one `assets[]` item into an {@link AssetEntry}, or `undefined` when the\n * item is not a mapping or lacks both `kind` and `name`. Pushes dependency\n * warnings to `diagnostics`.\n */\nfunction decodeAssetEntry(item: unknown, diagnostics: Diagnostic[]): AssetEntry | undefined {\n  if (!item || typeof item !== \"object\" || Array.isArray(item)) return undefined;\n  const a = item as Record<string, unknown>;\n  const kind = typeof a.kind === \"string\" ? a.kind : \"\";\n  const name = typeof a.name === \"string\" ? a.name : \"\";\n  if (!kind || !name) return undefined;\n  const entry: AssetEntry = { kind, name };\n  if (typeof a.root === \"string\") entry.root = a.root;\n  const files = parseFiles(a.files);\n  if (files) entry.files = files;\n  if (typeof a.version === \"string\") entry.version = a.version;\n  if (typeof a.publisher === \"string\") entry.publisher = a.publisher;\n  if (typeof a.sha256 === \"string\") entry.sha256 = a.sha256;\n  const assetSource = parseSource(a.source);\n  if (assetSource) entry.source = assetSource;\n\n  const deps = decodeAssetDependencies(a.dependencies, kind, name, diagnostics);\n  if (deps.length > 0) entry.dependencies = deps;\n\n  if (typeof a.description === \"string\") entry.description = a.description;\n  if (Array.isArray(a.keywords)) {\n    const kw = a.keywords.filter((k): k is string => typeof k === \"string\");\n    if (kw.length > 0) entry.keywords = kw;\n  }\n  if (typeof a.category === \"string\") entry.category = a.category;\n  if (typeof a.license === \"string\") entry.license = a.license;\n  if (typeof a.homepage === \"string\") entry.homepage = a.homepage;\n\n  return entry;\n}\n\n/** Decode the `assets[]` list onto `manifest`, collecting dependency warnings. */\nfunction decodeManifestAssets(\n  raw: Record<string, unknown>,\n  manifest: SkPublishManifest,\n  diagnostics: Diagnostic[],\n): void {\n  if (!Array.isArray(raw.assets)) return;\n  const entries: AssetEntry[] = [];\n  for (const item of raw.assets) {\n    const entry = decodeAssetEntry(item, diagnostics);\n    if (entry) entries.push(entry);\n  }\n  if (entries.length > 0) manifest.assets = entries;\n}\n\n/**\n * Decode `skaile.manifest.yaml` text into a {@link SkPublishManifest} plus\n * {@link Diagnostic}s. Total — never throws: a YAML syntax error or non-object\n * root is reported as an `error`-severity diagnostic with an empty manifest.\n * Malformed `assets[].dependencies` refs are reported as `warning`s (validated\n * via `parseAssetRef`) rather than silently dropped.\n *\n * Pair with {@link encodeSkaileManifest} for round-tripping.\n * @docLink packages/core/publish-manifest#decode-skaile-manifest\n */\nexport function decodeSkaileManifest(text: string): ManifestDecodeResult {\n  const root = parseManifestRoot(text);\n  if (!root.ok) {\n    return { manifest: {}, diagnostics: [root.diagnostic] };\n  }\n\n  const manifest: SkPublishManifest = {};\n  const diagnostics: Diagnostic[] = [];\n  decodeManifestFields(root.raw, manifest);\n  decodeManifestAssets(root.raw, manifest, diagnostics);\n\n  return { manifest, diagnostics };\n}\n\n// ── Encode ──────────────────────────────────────────────────────────────────\n\n/** Fixed top-level key order for {@link encodeSkaileManifest}. */\nconst MANIFEST_KEY_ORDER: (keyof SkPublishManifest)[] = [\n  \"publisher\",\n  \"version\",\n  \"license\",\n  \"homepage\",\n  \"dev_paths\",\n  \"source\",\n  \"provenance\",\n  \"assets\",\n];\n\n/** Fixed per-asset key order for {@link encodeSkaileManifest}. */\nconst ASSET_KEY_ORDER: (keyof AssetEntry)[] = [\n  \"kind\",\n  \"name\",\n  \"source\",\n  \"root\",\n  \"files\",\n  \"version\",\n  \"publisher\",\n  \"sha256\",\n  \"dependencies\",\n  \"description\",\n  \"keywords\",\n  \"category\",\n  \"license\",\n  \"homepage\",\n];\n\nfunction orderedAsset(a: AssetEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const key of ASSET_KEY_ORDER) {\n    const value = a[key];\n    if (value !== undefined) out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Encode a {@link SkPublishManifest} to canonical `skaile.manifest.yaml` text:\n * deterministic key order, only defined fields, `lineWidth: 120` (mirrors\n * `encodeSkaileYaml`).\n * @docLink packages/core/publish-manifest#encode-skaile-manifest\n */\nexport function encodeSkaileManifest(manifest: SkPublishManifest): string {\n  const out: Record<string, unknown> = {};\n  for (const key of MANIFEST_KEY_ORDER) {\n    const value = manifest[key];\n    if (value === undefined) continue;\n    if (key === \"assets\" && Array.isArray(value)) {\n      out.assets = (value as AssetEntry[]).map(orderedAsset);\n    } else {\n      out[key] = value;\n    }\n  }\n  return stringify(out, { lineWidth: 120 });\n}\n\n// ── File I/O ──────────────────────────────────────────────────────────────────\n\n/**\n * Load and decode `<dir>/skaile.manifest.yaml`. Returns `null` when the file is\n * absent or unparseable (mirrors `loadSkWorkspaceConfig`'s tolerant contract).\n * @docLink packages/core/publish-manifest#load-sk-publish-manifest\n */\nexport function loadSkPublishManifest(dir: string): SkPublishManifest | null {\n  const filePath = join(resolve(dir), SKAILE_MANIFEST_FILENAME);\n  if (!existsSync(filePath)) return null;\n  let raw: string;\n  try {\n    raw = readFileSync(filePath, \"utf-8\");\n  } catch {\n    return null;\n  }\n  const { manifest, diagnostics } = decodeSkaileManifest(raw);\n  if (diagnostics.some((d) => d.code === \"yaml_syntax\" || d.code === \"non_object_root\")) {\n    return null;\n  }\n  return manifest;\n}\n\n/**\n * Encode and write a manifest to `<dir>/skaile.manifest.yaml`, creating the\n * directory if needed. Returns the absolute path written.\n * @docLink packages/core/publish-manifest#save-sk-publish-manifest\n */\nexport function saveSkPublishManifest(dir: string, manifest: SkPublishManifest): string {\n  const resolvedDir = resolve(dir);\n  const filePath = join(resolvedDir, SKAILE_MANIFEST_FILENAME);\n  if (!existsSync(resolvedDir)) {\n    mkdirSync(resolvedDir, { recursive: true });\n  }\n  writeFileSync(filePath, encodeSkaileManifest(manifest));\n  return filePath;\n}\n"]}

package/dist/{chunk-R2I7RHT7.js → chunk-SKVUDDHE.js}

@@ -1,4 +1,4 @@
-import { WorkspacePlugin } from './chunk-4ZVS6KV4.js';
+import { WorkspacePlugin } from './chunk-ZGJE4ZDP.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { PROTOCOL_VERSION } from './chunk-TDSRLMDB.js';
@@ -6,13 +6,13 @@ import { EventNormalizer } from './chunk-NSVAJWWQ.js';
 import { classifyClaudeSdkError } from './chunk-NGJ6E344.js';
 import { createDriver } from './chunk-CIFTUSBV.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-362QBS57.js';
-import { loadConnectorDeclarations, PreMintedSecretProvider, InMemorySecretProvider } from './chunk-LRFZNLB2.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-NAMD4AIK.js';
+import { loadConnectorDeclarations, PreMintedSecretProvider, InMemorySecretProvider } from './chunk-52HINMW4.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-DEYYRFQU.js';
-import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-PKPUVQJP.js';
-import { resolveRuntimeAssets } from './chunk-RQG5TXIR.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr } from './chunk-AZODLVKH.js';
-import { parseAssetRef } from './chunk-LFDZYCEO.js';
+import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-2Q6OY3SU.js';
+import { resolveRuntimeAssets } from './chunk-5DPQ766L.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr } from './chunk-56YT6CWS.js';
+import { parseAssetRef } from './chunk-BM7XANVN.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
 import { getLogStore, resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, registerLogStore, resetLogStore, createLogger } from './chunk-JB35MVBN.js';
 import { __require } from './chunk-NSBPE2FW.js';
@@ -24,7 +24,7 @@ import path4, { join, resolve, relative, sep, isAbsolute, dirname, basename } fr
 import { homedir } from 'os';
 import * as z5 from 'zod';
 import { z } from 'zod';
-import fs4, { mkdir, writeFile, rename } from 'fs/promises';
+import fs4, { mkdir, writeFile, rename, readFile } from 'fs/promises';
 import { createHash, randomUUID } from 'crypto';
 import { execFile, spawnSync } from 'child_process';
 import { promisify } from 'util';
@@ -983,6 +983,17 @@ function warnUnresolvedRecipeMarkers(recipeLog, declId, resolvedCommand, resolve
 var PASSTHROUGH_INPUT_ZOD = {
   parse: (v) => v
 };
+function isMcpAuthError(err) {
+  if (!err || typeof err !== "object") return false;
+  const code = err.code ?? err.status;
+  if (code === 401 || code === "401") return true;
+  const message = err.message;
+  if (typeof message !== "string") return false;
+  return /\b401\b|invalid[_ ]token|invalid[_ ]grant/i.test(message);
+}
+function errMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 function buildTransport(decl, secrets) {
   const transport = decl.transport ?? "stdio";
   if (transport === "stdio") {
@@ -1029,10 +1040,14 @@ var ExternalMcpManager = class {
    * @param connect   Optional connector override (tests inject a fake client so
    *                  no live subprocess is spawned). Defaults to the real SDK
    *                  client + transport.
+   * @param reauthorize Optional re-mint callback for `auth: backend` remote
+   *                  servers. When present, a 401 from a tool call (or the
+   *                  initial connect) triggers a re-mint + reconnect.
    */
-  constructor(registry, secrets, sessionId, connect) {
+  constructor(registry, secrets, sessionId, connect, reauthorize) {
     this.registry = registry;
     this.connect = connect ?? defaultMcpClientConnector(secrets);
+    this.reauthorize = reauthorize;
     this.log = createLogger({
       kind: "mcp",
       subkind: "runner-managed",
@@ -1043,6 +1058,7 @@ var ExternalMcpManager = class {
   servers = [];
   log;
   connect;
+  reauthorize;
   /** True when at least one external server connected and registered tools. */
   hasServers() {
     return this.servers.length > 0;
@@ -1064,12 +1080,13 @@ var ExternalMcpManager = class {
     }
   }
   async startServer(decl) {
-    const client = await this.connect(decl);
+    const client = await this.connectWithReauth(decl);
+    const server = { id: decl.id, decl, client, toolNames: [] };
     const toolNames = [];
     try {
       const { tools } = await client.listTools();
       for (const tool of tools) {
-        const cap = this.buildToolCapability(decl.id, tool, client);
+        const cap = this.buildToolCapability(server, tool);
         this.registry.register(cap, "agent");
         toolNames.push(cap.name);
       }
@@ -1081,7 +1098,8 @@ var ExternalMcpManager = class {
       }
       throw err;
     }
-    this.servers.push({ id: decl.id, client, toolNames });
+    server.toolNames = toolNames;
+    this.servers.push(server);
     this.log.info("MCP server registered (runner-managed)", {
       id: decl.id,
       transport: decl.transport ?? "stdio",
@@ -1089,14 +1107,72 @@ var ExternalMcpManager = class {
       tools: toolNames
     });
   }
+  /**
+   * Connect, re-minting once on an initial-connect 401: the provisioned bearer
+   * may already be stale by the time the server is reached. Only retries for
+   * `auth: backend` servers with a reauthorizer wired.
+   */
+  async connectWithReauth(decl) {
+    try {
+      return await this.connect(decl);
+    } catch (err) {
+      if (isMcpAuthError(err) && this.reauthorize && decl.auth === "backend") {
+        this.log.warn("MCP initial connect 401 \u2014 re-minting and retrying", { id: decl.id });
+        if (await this.reauthorize(decl)) {
+          return this.connect(decl);
+        }
+      }
+      throw err;
+    }
+  }
+  /**
+   * Re-mint the bearer and reconnect one server in place after a 401. Concurrent
+   * 401s for the same server share a single round-trip via `reauthInFlight`.
+   * Returns `true` once `server.client` points at a freshly-authed connection.
+   */
+  reauthAndReconnect(server) {
+    server.reauthInFlight ??= this.doReauthAndReconnect(server).finally(() => {
+      server.reauthInFlight = void 0;
+    });
+    return server.reauthInFlight;
+  }
+  async doReauthAndReconnect(server) {
+    if (!this.reauthorize || server.decl.auth !== "backend") return false;
+    let provisioned;
+    try {
+      provisioned = await this.reauthorize(server.decl);
+    } catch (err) {
+      this.log.warn("MCP re-mint failed after 401", { id: server.id, error: errMessage(err) });
+      return false;
+    }
+    if (!provisioned) return false;
+    let next;
+    try {
+      next = await this.connect(server.decl);
+      await next.listTools();
+    } catch (err) {
+      this.log.warn("MCP reconnect after 401 failed", { id: server.id, error: errMessage(err) });
+      return false;
+    }
+    const old = server.client;
+    server.client = next;
+    try {
+      await old.close();
+    } catch {
+    }
+    this.log.info("MCP server reconnected after 401 re-mint", { id: server.id });
+    return true;
+  }
   /**
    * Wrap a single MCP tool as a {@link DefinedCapability}. The capability name
    * is `mcp__<server>__<tool>` (the naming claude-sdk wildcards and prompts
-   * depend on). The handler proxies the call to the live MCP client; a tool
-   * error (`isError`) is rethrown so the capability dispatch path surfaces it
-   * to the LLM as a tool failure.
+   * depend on). The handler proxies the call to the server's LIVE client (read
+   * lazily so a 401 reconnect is transparent); a tool error (`isError`) is
+   * rethrown so the capability dispatch path surfaces it to the LLM, and a 401
+   * triggers a re-mint + reconnect followed by a single retry.
    */
-  buildToolCapability(serverId, tool, client) {
+  buildToolCapability(server, tool) {
+    const serverId = server.id;
     const name = `mcp__${serverId}__${tool.name}`;
     const inputSchema = tool.inputSchema && typeof tool.inputSchema === "object" ? tool.inputSchema : { type: "object" };
     return {
@@ -1111,10 +1187,18 @@ var ExternalMcpManager = class {
       audience: ["llm"],
       inputZod: PASSTHROUGH_INPUT_ZOD,
       handler: async (input, ctx) => {
-        const result = await client.callTool({
-          name: tool.name,
-          arguments: input ?? {}
-        });
+        const call = { name: tool.name, arguments: input ?? {} };
+        let result;
+        try {
+          result = await server.client.callTool(call);
+        } catch (err) {
+          if (isMcpAuthError(err) && await this.reauthAndReconnect(server)) {
+            ctx.log.info("mcp tool retried after 401 re-mint", { tool: name });
+            result = await server.client.callTool(call);
+          } else {
+            throw err;
+          }
+        }
         const content = result.content ?? [];
         const text = content.filter((c) => c.type === "text" && typeof c.text === "string").map((c) => c.text).join("\n");
         if (result.isError) {
@@ -1128,8 +1212,14 @@ var ExternalMcpManager = class {
   /**
    * Deregister every tool and close every client (kills the subprocesses).
    * Best-effort: a failed close on one server does not prevent the rest.
+   *
+   * Drains any in-flight 401 reconnect first: a `doReauthAndReconnect` resolving
+   * after teardown would set `server.client` to a freshly-connected client that
+   * nothing then closes (leak). Awaiting `reauthInFlight` guarantees we close the
+   * LATEST client.
    */
   async dispose() {
+    await Promise.allSettled(this.servers.map((s) => s.reauthInFlight).filter(Boolean));
     for (const server of this.servers) {
       for (const toolName of server.toolNames) {
         this.registry.deregister(toolName);
@@ -1346,11 +1436,42 @@ async function startExternalMcpServers(capabilityRegistry, projectDir, secretPro
   const externalMcpManager = new ExternalMcpManager(
     capabilityRegistry,
     secretProvider,
-    sessionMeta?.sessionId
+    sessionMeta?.sessionId,
+    void 0,
+    buildMcpReauthorizer(capabilityRegistry, secretProvider, sessionMeta?.sessionId)
   );
   await externalMcpManager.start(resolvedDecls);
   return externalMcpManager;
 }
+function mcpAuthSecretKey(id) {
+  return `MCP__${id.replace(/[^A-Za-z0-9_]/g, "_")}__AUTH`;
+}
+function buildMcpReauthorizer(capabilityRegistry, secretProvider, sessionId) {
+  const provider = secretProvider;
+  const provision = provider?.provision?.bind(provider);
+  if (!provision) return void 0;
+  const log = createLogger({ kind: "mcp", subkind: "reauth", instance: sessionId ?? "no-session" });
+  return async (decl) => {
+    if (!decl.providerLinkId || decl.auth !== "backend") return false;
+    let mint;
+    try {
+      mint = await capabilityRegistry.invokeRemote("host.refresh_credential", {
+        kind: "mcp-server",
+        id: decl.providerLinkId,
+        reason: "retry-401"
+      });
+    } catch (err) {
+      log.warn("MCP credential re-mint round-trip failed", {
+        id: decl.id,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      return false;
+    }
+    if (!mint?.ok || !mint.token) return false;
+    provision({ [mcpAuthSecretKey(decl.id)]: `Bearer ${mint.token}` });
+    return true;
+  };
+}
 function wireExternalMcpServersForSdk(mcpServers, projectDir, secretProvider, sessionMeta) {
   const mcpLog = createLogger({
     kind: "mcp",
@@ -2746,6 +2867,29 @@ function buildLifecycleHandler(deps) {
     return { ok: true };
   };
 }
+function parseFleetHealthBody(body) {
+  return body.trim().toLowerCase() === "healthy" ? "healthy" : "error";
+}
+async function dispatchFleetHealthFlag(dir, fileName, manager, log) {
+  if (!manager) return;
+  const connectorId = fileName;
+  if (!connectorId || connectorId.startsWith(".")) return;
+  let verdict;
+  try {
+    verdict = parseFleetHealthBody(await readFile(join(dir, connectorId), "utf8"));
+  } catch {
+    verdict = "error";
+  }
+  try {
+    await manager.reportFleetHealth(connectorId, verdict);
+    log.debug("fleet-health flag dispatched", { connectorId, verdict });
+  } catch (err) {
+    log.warn("fleet-health flag dispatch failed", {
+      connectorId,
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
 
 // runner/src/refresh-flag-dispatcher.ts
 async function dispatchRefreshToExposedGitMounts(manager, log) {
@@ -3868,6 +4012,25 @@ async function startAgentServer(opts) {
       error: err instanceof Error ? err.message : String(err)
     });
   }
+  const fleetHealthDir = join(opts.projectDir, ".skaile", "fleet-health");
+  try {
+    mkdirSync(fleetHealthDir, { recursive: true });
+  } catch (err) {
+    serverLog.warn("failed to pre-create fleet-health dir \u2014 platform health signal disabled", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+  let fleetHealthWatcher = null;
+  try {
+    fleetHealthWatcher = watch(fleetHealthDir, (_event, fileName) => {
+      if (!fileName) return;
+      void dispatchFleetHealthFlag(fleetHealthDir, fileName.toString(), resourceManager, serverLog);
+    });
+  } catch (err) {
+    serverLog.warn("fs.watch on fleet-health dir failed \u2014 platform health signal disabled", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
   async function cleanup() {
     try {
       await Promise.race([
@@ -3894,6 +4057,11 @@ async function startAgentServer(opts) {
     } catch {
     }
     refreshFlagWatcher = null;
+    try {
+      fleetHealthWatcher?.close();
+    } catch {
+    }
+    fleetHealthWatcher = null;
     if (agentSession) {
       try {
         await agentSession.dispose();
@@ -4877,5 +5045,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-R2I7RHT7.js.map
-//# sourceMappingURL=chunk-R2I7RHT7.js.map
+//# sourceMappingURL=chunk-SKVUDDHE.js.map
+//# sourceMappingURL=chunk-SKVUDDHE.js.map