@skaile/workspaces 0.8.5 → 0.9.1

package/dist/{chunk-DOMCYP7D.js → chunk-42OQF7UU.js}

@@ -1,9 +1,11 @@
-import { discoverAssetsInTree, loadSourceConfig } from './chunk-46T37EBP.js';
-import { PresetManifestSchema } from './chunk-Z3RER6YZ.js';
+import { discoverAssetsInTree, loadSourceConfig } from './chunk-GKIA2PU5.js';
+import { PresetManifestSchema } from './chunk-NELZIQ2E.js';
 import { __export, __require } from './chunk-NSBPE2FW.js';
 import * as crypto from 'crypto';
+import { createHash } from 'crypto';
 import * as fs10 from 'fs';
 import * as path5 from 'path';
+import { resolve, join, sep, dirname, isAbsolute } from 'path';
 import { eq, like, and } from 'drizzle-orm';
 import * as z2 from 'zod';
 import * as os from 'os';
@@ -11,6 +13,7 @@ import { stringify, parse, parseDocument } from 'yaml';
 import { createClient } from '@libsql/client';
 import { drizzle } from 'drizzle-orm/libsql';
 import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
+import { rm, mkdir, writeFile } from 'fs/promises';
 import { spawnSync } from 'child_process';
 
 // library/src/library.ts
@@ -247,7 +250,8 @@ var instances = sqliteTable("instances", {
   credentialRef: text("credential_ref"),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull(),
-  createdBy: text("created_by")
+  createdBy: text("created_by"),
+  sourceCommitSha: text("source_commit_sha")
 });
 var subscriptions = sqliteTable("subscriptions", {
   id: text("id").primaryKey(),
@@ -298,14 +302,15 @@ CREATE INDEX IF NOT EXISTS idx_asset_defs_publisher   ON asset_definitions(publi
 CREATE INDEX IF NOT EXISTS idx_asset_defs_library_id  ON asset_definitions(library_id);
 
 CREATE TABLE IF NOT EXISTS instances (
-  id             TEXT PRIMARY KEY,
-  def_ref        TEXT NOT NULL,
-  def_pin        TEXT NOT NULL,
-  config         TEXT NOT NULL DEFAULT '{}',
-  credential_ref TEXT,
-  created_at     TEXT NOT NULL,
-  updated_at     TEXT NOT NULL,
-  created_by     TEXT
+  id                TEXT PRIMARY KEY,
+  def_ref           TEXT NOT NULL,
+  def_pin           TEXT NOT NULL,
+  config            TEXT NOT NULL DEFAULT '{}',
+  credential_ref    TEXT,
+  created_at        TEXT NOT NULL,
+  updated_at        TEXT NOT NULL,
+  created_by        TEXT,
+  source_commit_sha TEXT
 );
 CREATE INDEX IF NOT EXISTS idx_instances_def_ref ON instances(def_ref);
 
@@ -420,9 +425,87 @@ async function createLibraryDb(dbPath) {
     await runLibrariesMigration(client);
   }
   await client.executeMultiple(DDL);
+  try {
+    await client.execute("ALTER TABLE instances ADD COLUMN source_commit_sha TEXT");
+  } catch (err) {
+    if (!/duplicate column/i.test(err instanceof Error ? err.message : String(err))) {
+      throw err;
+    }
+  }
   const db = drizzle(client, { schema: schema_exports });
   return { db, close: () => client.close() };
 }
+function assertSafeManifestPath(installPath, p) {
+  const bad = () => {
+    throw new Error(`unsafe path in manifest: ${p}`);
+  };
+  if (!p || p.length === 0) bad();
+  if (isAbsolute(p) || p.startsWith("/") || p.startsWith("\\")) bad();
+  const segments = p.split(/[/\\]/);
+  if (segments.some((s) => s === "..")) bad();
+  const resolved = resolve(installPath, p);
+  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();
+}
+function assertSafeRefComponent(kind, value) {
+  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 32);
+  if (!value || value.startsWith(".") || /[/\\]/.test(value) || hasControlChar) {
+    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);
+  }
+}
+async function installFromManifest(opts) {
+  const { manifest, libraryRoot } = opts;
+  const fetcher = opts.fetcher ?? (await import('./source-fetch-github-QN4LLTL5.js')).fetchAssetFilesFromGitHub;
+  const m = manifest.ref.match(/^@?([^/@\s]+)\/([^/@\s]+)@([^/@\s]+)$/);
+  if (!m) throw new Error(`invalid ref: ${manifest.ref}`);
+  const [, publisher, name, version] = m;
+  assertSafeRefComponent("publisher", publisher);
+  assertSafeRefComponent("name", name);
+  assertSafeRefComponent("version", version);
+  const root = resolve(libraryRoot);
+  const installPath = resolve(join(root, `@${publisher}`, name, version));
+  if (installPath !== root && !installPath.startsWith(root + sep)) {
+    throw new Error(
+      `unsafe install path: ref '${manifest.ref}' resolves outside the library root`
+    );
+  }
+  for (const f of manifest.files) {
+    assertSafeManifestPath(installPath, f.path);
+  }
+  const paths = manifest.files.map((f) => f.path);
+  const bytes = await fetcher({
+    url: manifest.source.url,
+    commitSha: manifest.source.commitSha,
+    paths
+  });
+  for (const f of manifest.files) {
+    assertSafeManifestPath(installPath, f.path);
+    const buf = bytes[f.path];
+    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);
+    const actual = createHash("sha256").update(buf).digest("hex");
+    if (actual !== f.sha256) {
+      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);
+    }
+  }
+  const sortedLines = manifest.files.slice().sort((a, b) => a.path.localeCompare(b.path)).map((e) => `${e.path}:${e.sha256}
+`).join("");
+  const actualComposite = createHash("sha256").update(sortedLines, "utf-8").digest("hex");
+  if (actualComposite !== manifest.sha256) {
+    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);
+  }
+  await rm(installPath, { recursive: true, force: true });
+  try {
+    for (const f of manifest.files) {
+      const target = join(installPath, f.path);
+      await mkdir(dirname(target), { recursive: true });
+      await writeFile(target, bytes[f.path]);
+    }
+  } catch (e) {
+    await rm(installPath, { recursive: true, force: true }).catch(() => {
+    });
+    throw e;
+  }
+  return { installPath };
+}
 
 // library/src/local/library.ts
 function escapeLikePrefix(prefix) {
@@ -480,7 +563,8 @@ function rowToInstance(row) {
     credentialRef: row.credentialRef ?? void 0,
     createdAt: new Date(row.createdAt),
     updatedAt: new Date(row.updatedAt),
-    createdBy: row.createdBy ?? void 0
+    createdBy: row.createdBy ?? void 0,
+    sourceCommitSha: row.sourceCommitSha ?? void 0
   };
 }
 function rowToSubscription(row) {
@@ -497,6 +581,8 @@ var LocalLibrary = class {
   dbHandleRef = null;
   dbPromise = null;
   _kindRegistry;
+  /** Absolute path to the library storage directory. */
+  libraryDir;
   /**
    * Construct a LocalLibrary. Synchronous — does not open the DB.
    *
@@ -514,6 +600,7 @@ var LocalLibrary = class {
     if (!fs10.existsSync(dir)) {
       fs10.mkdirSync(dir, { recursive: true });
     }
+    this.libraryDir = dir;
     this.dbPath = path5.join(dir, "lib.db");
   }
   /**
@@ -666,7 +753,8 @@ var LocalLibrary = class {
       credentialRef: input.credentialRef ?? null,
       createdAt: now,
       updatedAt: now,
-      createdBy: input.createdBy ?? null
+      createdBy: input.createdBy ?? null,
+      sourceCommitSha: null
     }).run();
     return {
       id,
@@ -679,6 +767,70 @@ var LocalLibrary = class {
       createdBy: input.createdBy
     };
   }
+  /**
+   * Install an asset from a pointer-only {@link InstallManifest}.
+   *
+   * This is the pointer-only install path: the caller obtains the manifest
+   * from a catalog source (`RemoteCatalogSource.getInstallManifest(ref)` —
+   * a `RemoteCatalogSource`-only method, not on the `ICatalogSource`
+   * contract), and `install` then:
+   *
+   *   1. fetches the asset bytes directly from the upstream repo at the
+   *      pinned commit and verifies every per-file + the composite SHA256
+   *      (via {@link installFromManifest});
+   *   2. records an {@link Instance} row carrying `sourceCommitSha` so the
+   *      install is auditable and re-verifiable.
+   *
+   * Not part of the {@link ILibrary} interface — `LocalLibrary`-only, since
+   * the platform variant resolves install bytes differently.
+   *
+   * @param manifest - The pointer-only install manifest from the Catalog.
+   * @param opts.libraryRoot - Filesystem root to install asset bytes under.
+   *   Defaults to an `installed/` subdirectory of the library storage dir.
+   * @param opts.fetcher - Pluggable byte fetcher (tests inject a mock);
+   *   defaults to `fetchAssetFilesFromGitHub`.
+   * @param opts.config - Initial Instance config. Defaults to `{}`.
+   * @param opts.defPin - Pin policy for the Instance. Defaults to `exact`
+   *   (a pointer-only install is pinned to an immutable commit).
+   * @returns The created Instance plus its on-disk install path.
+   */
+  async install(manifest, opts) {
+    const libraryRoot = opts?.libraryRoot ?? path5.join(this.libraryDir, "installed");
+    const { installPath } = await installFromManifest({
+      manifest,
+      libraryRoot,
+      fetcher: opts?.fetcher
+    });
+    const id = crypto.randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const pin = opts?.defPin ?? "exact";
+    const config = opts?.config ?? {};
+    const db = await this.ensureDb();
+    await db.insert(instances).values({
+      id,
+      defRef: manifest.ref,
+      defPin: pin,
+      config: JSON.stringify(config),
+      credentialRef: null,
+      createdAt: now,
+      updatedAt: now,
+      createdBy: opts?.createdBy ?? null,
+      sourceCommitSha: manifest.source.commitSha
+    }).run();
+    return {
+      instance: {
+        id,
+        defRef: manifest.ref,
+        defPin: pin,
+        config,
+        createdAt: new Date(now),
+        updatedAt: new Date(now),
+        createdBy: opts?.createdBy,
+        sourceCommitSha: manifest.source.commitSha
+      },
+      installPath
+    };
+  }
   async getInstance(id) {
     const db = await this.ensureDb();
     const row = await db.select().from(instances).where(eq(instances.id, id)).get();
@@ -1440,7 +1592,8 @@ assets: []
       if (!current.includes(MANIFEST_FILENAME)) {
         fs10.writeFileSync(
           excludePath,
-          (current.endsWith("\n") || current === "" ? current : current + "\n") + `# skaile-managed local-overlay manifest
+          (current.endsWith("\n") || current === "" ? current : `${current}
+`) + `# skaile-managed local-overlay manifest
 ${MANIFEST_FILENAME}
 `,
           "utf-8"
@@ -2016,6 +2169,49 @@ var RemoteCatalogSource = class {
     }
     return { assetsCached: items.length };
   }
+  /**
+   * Fetch the pointer-only install manifest for an asset ref.
+   *
+   * The install manifest is the Pointer Triple: the immutable upstream
+   * `source.url` + `source.commitSha`, the per-file `files[].sha256` list, a
+   * composite `sha256` rollup, plus `kind` and `tier`. Callers fetch the asset
+   * bytes directly from the upstream repo at that commit and verify each file
+   * against the recorded hashes — the Catalog itself never serves asset bytes.
+   *
+   * Wire surface: `GET /trpc/catalog.getInstallManifest?input=<superjson({ ref })>`.
+   *
+   * This is a `RemoteCatalogSource`-only method — it is not part of the
+   * `ICatalogSource` contract. `LocalCatalogSource` has the asset bytes on disk
+   * and has no pointer-triple concept, so adding it to the shared interface
+   * would force a meaningless implementation there.
+   *
+   * Not cached: the install path is a one-shot read driven by `skaile install`.
+   *
+   * @throws {@link CatalogHttpError} on a non-2xx response or malformed envelope.
+   */
+  async getInstallManifest(ref) {
+    const url = trpcGetUrl(this.baseUrl, "catalog.getInstallManifest", { ref });
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog.getInstallManifest ${ref} failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
+    }
+    const data = await parseTrpcGet(res);
+    if (data === null || data === void 0 || typeof data !== "object") {
+      throw new CatalogHttpError(
+        `catalog.getInstallManifest ${ref} returned a non-object payload (got ${typeof data})`,
+        200,
+        url
+      );
+    }
+    return data;
+  }
   /**
    * Wait for any in-flight stale-while-revalidate background fetches to settle.
    * Test-only escape hatch.
@@ -2162,11 +2358,16 @@ function pickString(r, key) {
   const v = r[key];
   return typeof v === "string" ? v : void 0;
 }
+var CATALOG_REQUEST_TIMEOUT_MS = 1e4;
 var defaultFetch = async (url, init) => {
   if (typeof fetch === "undefined") {
     throw new Error("global fetch is not available; pass an httpClient explicitly");
   }
-  return fetch(url, init);
+  const requestInit = init ?? {};
+  return fetch(url, {
+    ...requestInit,
+    signal: requestInit.signal ?? AbortSignal.timeout(CATALOG_REQUEST_TIMEOUT_MS)
+  });
 };
 
 // library/src/remote/rest-catalog-source.ts
@@ -2484,20 +2685,25 @@ function tryParseJson(s) {
   }
   return {};
 }
+var CATALOG_REQUEST_TIMEOUT_MS2 = 1e4;
 var defaultFetch2 = async (url, init) => {
   if (typeof fetch === "undefined") {
     throw new Error("global fetch is not available; pass an httpClient explicitly");
   }
-  return fetch(url, init);
+  const requestInit = init ?? {};
+  return fetch(url, {
+    ...requestInit,
+    signal: requestInit.signal ?? AbortSignal.timeout(CATALOG_REQUEST_TIMEOUT_MS2)
+  });
 };
-var KnowledgeManifestSchema = z2.object({
+var KnowledgeManifestSchema = z2.looseObject({
   name: z2.string().optional(),
   description: z2.string().optional(),
   version: z2.string().optional(),
   files: z2.array(z2.string()).optional(),
   keywords: z2.array(z2.string()).optional(),
   license: z2.string().optional()
-}).passthrough();
+});
 function validateKnowledge(data) {
   const result = KnowledgeManifestSchema.safeParse(data);
   if (result.success) {
@@ -3224,6 +3430,6 @@ function deepEqual(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 
-export { CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateLibraryNameError, DuplicateSubscriptionError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KNOWN_ASSET_KINDS, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LIBRARY_STRUCTURES, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalLibrary, LocalSyncDriver, LockFileSchema, LockSubscriptionSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, SidecarGit, SkaileConfigSchema, SourceNotFoundError, StoreSyncDriver, SubscriptionNotFoundError, TarballHashMismatchError, UserLibraryManager, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, classifyRef, createEmptyLockFile, deriveSlug, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, hasInterpolationTokens, interpolate, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, migrateWorkspaceConfig, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, queryInstancePickerChoices, resolveAllItems, resolveConfig, resolveItem, resolveLibraryDir, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, sha256Hex, storeSecrets, trpcGetUrl, userConfigPath, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeManifestIfMissing };
-//# sourceMappingURL=chunk-DOMCYP7D.js.map
-//# sourceMappingURL=chunk-DOMCYP7D.js.map
+export { CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateLibraryNameError, DuplicateSubscriptionError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KNOWN_ASSET_KINDS, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LIBRARY_STRUCTURES, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalLibrary, LocalSyncDriver, LockFileSchema, LockSubscriptionSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, SidecarGit, SkaileConfigSchema, SourceNotFoundError, StoreSyncDriver, SubscriptionNotFoundError, TarballHashMismatchError, UserLibraryManager, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, classifyRef, createEmptyLockFile, deriveSlug, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, hasInterpolationTokens, installFromManifest, interpolate, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, migrateWorkspaceConfig, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, queryInstancePickerChoices, resolveAllItems, resolveConfig, resolveItem, resolveLibraryDir, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, sha256Hex, storeSecrets, trpcGetUrl, userConfigPath, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeManifestIfMissing };
+//# sourceMappingURL=chunk-42OQF7UU.js.map
+//# sourceMappingURL=chunk-42OQF7UU.js.map