@skaile/workspaces 0.8.5

package/dist/chunk-DOMCYP7D.js

@@ -0,0 +1,3229 @@
+import { discoverAssetsInTree, loadSourceConfig } from './chunk-46T37EBP.js';
+import { PresetManifestSchema } from './chunk-Z3RER6YZ.js';
+import { __export, __require } from './chunk-NSBPE2FW.js';
+import * as crypto from 'crypto';
+import * as fs10 from 'fs';
+import * as path5 from 'path';
+import { eq, like, and } from 'drizzle-orm';
+import * as z2 from 'zod';
+import * as os from 'os';
+import { stringify, parse, parseDocument } from 'yaml';
+import { createClient } from '@libsql/client';
+import { drizzle } from 'drizzle-orm/libsql';
+import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
+import { spawnSync } from 'child_process';
+
+// library/src/library.ts
+var KNOWN_ASSET_KINDS = [
+  "skill",
+  "agent",
+  "connector",
+  "mount",
+  "flow",
+  "contract",
+  "prompt",
+  "mcp-server",
+  "knowledge",
+  "persona",
+  "ruleset"
+];
+var PIN_POLICIES = ["exact", "minor-track", "latest"];
+var LibraryError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "LibraryError";
+  }
+  code;
+};
+var SourceNotFoundError = class extends LibraryError {
+  constructor(id) {
+    super(`Source not found: ${id}`, "SOURCE_NOT_FOUND");
+    this.name = "SourceNotFoundError";
+  }
+};
+var InstanceNotFoundError = class extends LibraryError {
+  constructor(id) {
+    super(`Instance not found: ${id}`, "INSTANCE_NOT_FOUND");
+    this.name = "InstanceNotFoundError";
+  }
+};
+var SubscriptionNotFoundError = class extends LibraryError {
+  constructor(id) {
+    super(`Subscription not found: ${id}`, "SUBSCRIPTION_NOT_FOUND");
+    this.name = "SubscriptionNotFoundError";
+  }
+};
+var DuplicateSubscriptionError = class extends LibraryError {
+  constructor(workspaceId, instanceId) {
+    super(
+      `Workspace "${workspaceId}" already subscribes to instance "${instanceId}"`,
+      "DUPLICATE_SUBSCRIPTION"
+    );
+    this.name = "DuplicateSubscriptionError";
+  }
+};
+var InstanceHasConsumersError = class extends LibraryError {
+  constructor(instanceId, count) {
+    super(
+      `Instance "${instanceId}" has ${count} active subscription(s). Use { cascade: true } to force delete.`,
+      "INSTANCE_HAS_CONSUMERS"
+    );
+    this.name = "InstanceHasConsumersError";
+  }
+};
+var LOCAL_CATALOG_URL = "local";
+function isLocalCatalogUrl(url) {
+  return typeof url === "string" && url.trim().toLowerCase() === LOCAL_CATALOG_URL;
+}
+var CatalogConfigSchema = z2.object({
+  /** Catalog base URL, or `"local"` (case-insensitive) to disable the remote catalog. Default: https://skaile.store */
+  url: z2.union([
+    z2.string().url(),
+    // Accept any casing/whitespace variant of "local", normalise to canonical.
+    z2.string().refine((s) => s.trim().toLowerCase() === LOCAL_CATALOG_URL, {
+      message: `Expected a valid URL or "${LOCAL_CATALOG_URL}"`
+    }).transform(() => LOCAL_CATALOG_URL)
+  ]).optional(),
+  /** Cache TTL in seconds. 0 = air-gapped (manual `skaile update` only). */
+  cache_ttl: z2.number().int().min(0).optional(),
+  /**
+   * Wire framing to use when talking to a remote catalog.
+   * `"trpc"` — skaile.store tRPC backend (default for `https://skaile.store`).
+   * `"rest"` — forge-store REST backend (default for any other URL).
+   */
+  framing: z2.enum(["trpc", "rest"]).optional()
+});
+var LibraryConfigSchema = z2.object({
+  /** Library storage directory. Default: ~/.skaile/libraries */
+  dir: z2.string().optional(),
+  /** Default pin policy for new instances/subscriptions. */
+  pin_policy: z2.enum(PIN_POLICIES).optional()
+});
+var SkaileConfigSchema = z2.object({
+  catalog: CatalogConfigSchema.optional(),
+  library: LibraryConfigSchema.optional()
+});
+function defaultLibraryDir() {
+  return path5.join(os.homedir(), ".skaile", "libraries");
+}
+function resolveLibraryDir() {
+  if (process.env.SKAILE_LIBRARIES_DIR) return process.env.SKAILE_LIBRARIES_DIR;
+  if (process.env.SKAILE_LIBRARY_DIR) {
+    process.stderr.write(
+      "[skaile/library] SKAILE_LIBRARY_DIR is deprecated \u2014 use SKAILE_LIBRARIES_DIR.\n"
+    );
+    return process.env.SKAILE_LIBRARY_DIR;
+  }
+  return defaultLibraryDir();
+}
+function getConfigDefaults() {
+  return {
+    catalog: { url: "https://skaile.store", cache_ttl: 86400, framing: "trpc" },
+    library: { dir: defaultLibraryDir(), pin_policy: "minor-track" }
+  };
+}
+var CONFIG_FILENAME = "config.yaml";
+function userConfigPath() {
+  return path5.join(os.homedir(), ".skaile", CONFIG_FILENAME);
+}
+function projectConfigPath(projectDir) {
+  return path5.join(projectDir, ".skaile", CONFIG_FILENAME);
+}
+function loadConfigFile(filePath) {
+  if (!fs10.existsSync(filePath)) return null;
+  try {
+    const content = fs10.readFileSync(filePath, "utf-8");
+    const raw = parse(content);
+    if (!raw || typeof raw !== "object") return null;
+    return SkaileConfigSchema.partial().parse(raw);
+  } catch (err) {
+    process.stderr.write(
+      `[skaile/config] Warning: ignoring invalid config at ${filePath}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return null;
+  }
+}
+function deepMerge(base, overlay) {
+  const result = { ...base };
+  for (const key of Object.keys(overlay)) {
+    const val = overlay[key];
+    if (val === void 0) continue;
+    if (typeof val === "object" && val !== null && !Array.isArray(val) && typeof result[key] === "object" && result[key] !== null) {
+      result[key] = deepMerge(
+        result[key],
+        val
+      );
+    } else {
+      result[key] = val;
+    }
+  }
+  return result;
+}
+function resolveConfig(opts) {
+  const defaults = getConfigDefaults();
+  let config = { ...defaults };
+  const userPath = opts?.userConfigFile ?? userConfigPath();
+  const userCfg = loadConfigFile(userPath);
+  if (userCfg) config = deepMerge(config, userCfg);
+  let projCfg = null;
+  if (opts?.projectDir) {
+    projCfg = loadConfigFile(projectConfigPath(opts.projectDir));
+    if (projCfg) config = deepMerge(config, projCfg);
+  }
+  if (opts?.overrides) config = deepMerge(config, opts.overrides);
+  const resolved = config;
+  const explicitFraming = userCfg?.catalog?.framing !== void 0 || projCfg?.catalog?.framing !== void 0 || opts?.overrides?.catalog?.framing !== void 0;
+  if (!explicitFraming && resolved.catalog.url !== "https://skaile.store") {
+    resolved.catalog.framing = "rest";
+  }
+  return resolved;
+}
+function saveConfig(filePath, config) {
+  const dir = path5.dirname(filePath);
+  if (!fs10.existsSync(dir)) {
+    fs10.mkdirSync(dir, { recursive: true });
+  }
+  fs10.writeFileSync(filePath, stringify(config, { indent: 2 }), "utf-8");
+}
+
+// library/src/local/schema.ts
+var schema_exports = {};
+__export(schema_exports, {
+  assetDefinitions: () => assetDefinitions,
+  instances: () => instances,
+  libraries: () => libraries,
+  subscriptions: () => subscriptions
+});
+var libraries = sqliteTable("libraries", {
+  /** UUID primary key. */
+  id: text("id").primaryKey(),
+  /** User-visible handle; unique. */
+  name: text("name").notNull(),
+  /** Absolute on-disk root. */
+  path: text("path").notNull(),
+  /** Backend kind: `local | git | store`. */
+  backend: text("backend").notNull(),
+  /** Backend-specific JSON config; stored as text, parsed on read. */
+  backendConfig: text("backend_config").notNull().default("{}"),
+  /** Ownership: `owner | contributor | reader`. */
+  ownership: text("ownership").notNull(),
+  /** Layout: `flat | domain` or null when not yet detected. */
+  structure: text("structure"),
+  /** Boolean (0/1) — true iff this is the auto-target for `asset migrate`. */
+  isDefault: integer("is_default", { mode: "boolean" }).notNull().default(false),
+  /** Boolean (0/1) — true iff the CLI generated the on-disk manifest. */
+  manifestGenerated: integer("manifest_generated", { mode: "boolean" }).notNull().default(false),
+  /** Last sync ISO timestamp. */
+  lastSyncAt: text("last_sync_at"),
+  /** Creation ISO timestamp. */
+  createdAt: text("created_at").notNull(),
+  /** Last-update ISO timestamp. */
+  updatedAt: text("updated_at").notNull()
+});
+var assetDefinitions = sqliteTable("asset_definitions", {
+  id: text("id").primaryKey(),
+  kind: text("kind").notNull(),
+  publisher: text("publisher").notNull(),
+  name: text("name").notNull(),
+  version: text("version").notNull(),
+  sha256: text("sha256"),
+  description: text("description"),
+  license: text("license"),
+  category: text("category"),
+  manifest: text("manifest").notNull(),
+  /** FK to the library that provided this definition. */
+  libraryId: text("library_id"),
+  kindProviderVersion: text("kind_provider_version"),
+  cachedAt: text("cached_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+});
+var instances = sqliteTable("instances", {
+  id: text("id").primaryKey(),
+  defRef: text("def_ref").notNull(),
+  defPin: text("def_pin").notNull(),
+  config: text("config").notNull().default("{}"),
+  credentialRef: text("credential_ref"),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull(),
+  createdBy: text("created_by")
+});
+var subscriptions = sqliteTable("subscriptions", {
+  id: text("id").primaryKey(),
+  workspaceId: text("workspace_id").notNull(),
+  instanceId: text("instance_id").notNull(),
+  pinPolicy: text("pin_policy").notNull(),
+  subscribedAt: text("subscribed_at").notNull()
+});
+
+// library/src/local/db.ts
+var DDL = `
+CREATE TABLE IF NOT EXISTS libraries (
+  id                  TEXT    PRIMARY KEY,
+  name                TEXT    NOT NULL,
+  path                TEXT    NOT NULL,
+  backend             TEXT    NOT NULL,
+  backend_config      TEXT    NOT NULL DEFAULT '{}',
+  ownership           TEXT    NOT NULL,
+  structure           TEXT,
+  is_default          INTEGER NOT NULL DEFAULT 0,
+  manifest_generated  INTEGER NOT NULL DEFAULT 0,
+  last_sync_at        TEXT,
+  created_at          TEXT NOT NULL,
+  updated_at          TEXT NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_libraries_name ON libraries(name);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_libraries_default
+  ON libraries(is_default) WHERE is_default = 1;
+
+CREATE TABLE IF NOT EXISTS asset_definitions (
+  id                    TEXT PRIMARY KEY,
+  kind                  TEXT NOT NULL,
+  publisher             TEXT NOT NULL,
+  name                  TEXT NOT NULL,
+  version               TEXT NOT NULL,
+  sha256                TEXT,
+  description           TEXT,
+  license               TEXT,
+  category              TEXT,
+  manifest              TEXT NOT NULL,
+  library_id            TEXT REFERENCES libraries(id) ON DELETE SET NULL,
+  kind_provider_version TEXT,
+  cached_at             TEXT NOT NULL,
+  updated_at            TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_asset_defs_kind        ON asset_definitions(kind);
+CREATE INDEX IF NOT EXISTS idx_asset_defs_publisher   ON asset_definitions(publisher);
+CREATE INDEX IF NOT EXISTS idx_asset_defs_library_id  ON asset_definitions(library_id);
+
+CREATE TABLE IF NOT EXISTS instances (
+  id             TEXT PRIMARY KEY,
+  def_ref        TEXT NOT NULL,
+  def_pin        TEXT NOT NULL,
+  config         TEXT NOT NULL DEFAULT '{}',
+  credential_ref TEXT,
+  created_at     TEXT NOT NULL,
+  updated_at     TEXT NOT NULL,
+  created_by     TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_instances_def_ref ON instances(def_ref);
+
+CREATE TABLE IF NOT EXISTS subscriptions (
+  id             TEXT PRIMARY KEY,
+  workspace_id   TEXT NOT NULL,
+  instance_id    TEXT NOT NULL REFERENCES instances(id) ON DELETE CASCADE,
+  pin_policy     TEXT NOT NULL,
+  subscribed_at  TEXT NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_subs_ws_instance
+  ON subscriptions(workspace_id, instance_id);
+CREATE INDEX IF NOT EXISTS idx_subs_instance_id ON subscriptions(instance_id);
+`;
+async function legacySourcesPresent(client) {
+  const rs = await client.execute(
+    "SELECT name FROM sqlite_master WHERE type='table' AND name='sources'"
+  );
+  return rs.rows.length > 0;
+}
+async function librariesPresent(client) {
+  const rs = await client.execute(
+    "SELECT name FROM sqlite_master WHERE type='table' AND name='libraries'"
+  );
+  return rs.rows.length > 0;
+}
+function slugify(p) {
+  const base = path5.basename(p) || "lib";
+  return base.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-|-$/g, "") || "lib";
+}
+async function runLibrariesMigration(client) {
+  const oldRows = (await client.execute("SELECT id, type, url, path, ref, last_synced_at, created_at FROM sources")).rows;
+  const stmts = [];
+  stmts.push({
+    sql: `
+    CREATE TABLE libraries (
+      id                  TEXT PRIMARY KEY,
+      name                TEXT NOT NULL,
+      path                TEXT NOT NULL,
+      backend             TEXT NOT NULL,
+      backend_config      TEXT NOT NULL DEFAULT '{}',
+      ownership           TEXT NOT NULL,
+      structure           TEXT,
+      is_default          INTEGER NOT NULL DEFAULT 0,
+      manifest_generated  INTEGER NOT NULL DEFAULT 0,
+      last_sync_at        TEXT,
+      created_at          TEXT NOT NULL,
+      updated_at          TEXT NOT NULL
+    );
+  `
+  });
+  const usedNames = /* @__PURE__ */ new Set();
+  for (const row of oldRows) {
+    const backend = row.type === "github" ? "git" : row.type === "catalog" ? "store" : "local";
+    const ownership = backend === "local" ? "owner" : "reader";
+    const baseSlug = slugify(row.path ?? row.url);
+    let name = baseSlug;
+    let i = 2;
+    while (usedNames.has(name)) name = `${baseSlug}-${i++}`;
+    usedNames.add(name);
+    const cfg = backend === "git" ? { url: row.url, branch: row.ref ?? "main", authHint: "ssh" } : backend === "store" ? { url: row.url, publisher: "", tokenRef: "" } : {};
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    stmts.push({
+      sql: `INSERT INTO libraries
+       (id, name, path, backend, backend_config, ownership, last_sync_at, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        row.id,
+        name,
+        row.path ?? row.url,
+        backend,
+        JSON.stringify(cfg),
+        ownership,
+        row.last_synced_at,
+        row.created_at,
+        now
+      ]
+    });
+  }
+  stmts.push({ sql: `CREATE UNIQUE INDEX idx_libraries_name ON libraries(name);` });
+  stmts.push({
+    sql: `CREATE UNIQUE INDEX idx_libraries_default
+           ON libraries(is_default) WHERE is_default = 1;`
+  });
+  stmts.push({ sql: `ALTER TABLE asset_definitions RENAME COLUMN source_id TO library_id;` });
+  stmts.push({
+    sql: `CREATE INDEX IF NOT EXISTS idx_asset_defs_library_id
+           ON asset_definitions(library_id);`
+  });
+  stmts.push({ sql: `DROP TABLE sources;` });
+  await client.batch(stmts);
+}
+function relocateLegacyFileIfPresent(newDbPath) {
+  const fs12 = __require("fs");
+  const parent = path5.dirname(newDbPath);
+  if (path5.basename(parent) !== "libraries") return;
+  const legacy = path5.join(path5.dirname(parent), "library", "lib.db");
+  if (!fs12.existsSync(legacy) || fs12.existsSync(newDbPath)) return;
+  fs12.mkdirSync(parent, { recursive: true });
+  fs12.renameSync(legacy, newDbPath);
+  for (const ext of ["-wal", "-shm"]) {
+    const src = legacy + ext;
+    if (fs12.existsSync(src)) fs12.renameSync(src, newDbPath + ext);
+  }
+}
+async function createLibraryDb(dbPath) {
+  relocateLegacyFileIfPresent(dbPath);
+  const client = createClient({ url: `file:${dbPath}` });
+  await client.execute("PRAGMA journal_mode = WAL");
+  await client.execute("PRAGMA foreign_keys = ON");
+  if (await legacySourcesPresent(client) && !await librariesPresent(client)) {
+    await runLibrariesMigration(client);
+  }
+  await client.executeMultiple(DDL);
+  const db = drizzle(client, { schema: schema_exports });
+  return { db, close: () => client.close() };
+}
+
+// library/src/local/library.ts
+function escapeLikePrefix(prefix) {
+  return prefix.replace(/[%_]/g, "\\$&");
+}
+function rowToSource(row) {
+  const cfg = (() => {
+    try {
+      return JSON.parse(row.backendConfig);
+    } catch {
+      return {};
+    }
+  })();
+  return {
+    id: row.id,
+    type: row.backend,
+    name: row.name,
+    path: row.path,
+    ownership: row.ownership,
+    isDefault: row.isDefault,
+    backendConfig: cfg,
+    structure: row.structure ?? void 0,
+    manifestGenerated: row.manifestGenerated,
+    lastSyncedAt: row.lastSyncAt ? new Date(row.lastSyncAt) : void 0,
+    createdAt: new Date(row.createdAt),
+    updatedAt: new Date(row.updatedAt),
+    url: typeof cfg.url === "string" ? cfg.url : void 0,
+    ref: typeof cfg.branch === "string" ? cfg.branch : void 0
+  };
+}
+function rowToAssetDef(row) {
+  return {
+    id: row.id,
+    kind: row.kind,
+    publisher: row.publisher,
+    name: row.name,
+    version: row.version,
+    sha256: row.sha256 ?? void 0,
+    description: row.description ?? void 0,
+    license: row.license ?? void 0,
+    category: row.category ?? void 0,
+    manifest: JSON.parse(row.manifest),
+    sourceId: row.libraryId ?? void 0,
+    kindProviderVersion: row.kindProviderVersion ?? void 0,
+    cachedAt: new Date(row.cachedAt),
+    updatedAt: new Date(row.updatedAt)
+  };
+}
+function rowToInstance(row) {
+  return {
+    id: row.id,
+    defRef: row.defRef,
+    defPin: row.defPin,
+    config: JSON.parse(row.config),
+    credentialRef: row.credentialRef ?? void 0,
+    createdAt: new Date(row.createdAt),
+    updatedAt: new Date(row.updatedAt),
+    createdBy: row.createdBy ?? void 0
+  };
+}
+function rowToSubscription(row) {
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    instanceId: row.instanceId,
+    pinPolicy: row.pinPolicy,
+    subscribedAt: new Date(row.subscribedAt)
+  };
+}
+var LocalLibrary = class {
+  dbPath;
+  dbHandleRef = null;
+  dbPromise = null;
+  _kindRegistry;
+  /**
+   * Construct a LocalLibrary. Synchronous — does not open the DB.
+   *
+   * @param optionsOrDir - Either a `LocalLibraryOptions` object or a string
+   *   path (legacy signature, kept for backward compat).
+   */
+  constructor(optionsOrDir) {
+    let dir;
+    if (typeof optionsOrDir === "string") {
+      dir = optionsOrDir;
+    } else {
+      dir = optionsOrDir?.libraryDir ?? resolveLibraryDir();
+      this._kindRegistry = optionsOrDir?.kindRegistry;
+    }
+    if (!fs10.existsSync(dir)) {
+      fs10.mkdirSync(dir, { recursive: true });
+    }
+    this.dbPath = path5.join(dir, "lib.db");
+  }
+  /**
+   * Lazily open the SQLite DB on first use. The `??=` dedupes concurrent
+   * first calls so the DB is opened exactly once, with no race.
+   */
+  async ensureDb() {
+    if (this.dbHandleRef) return this.dbHandleRef.db;
+    this.dbPromise ??= createLibraryDb(this.dbPath);
+    this.dbHandleRef = await this.dbPromise;
+    return this.dbHandleRef.db;
+  }
+  /** The kind registry bound to this library (if any). */
+  get kinds() {
+    return this._kindRegistry;
+  }
+  /** Close the underlying SQLite connection. Call in tests / cleanup. */
+  close() {
+    if (this.dbHandleRef) this.dbHandleRef.close();
+    this.dbHandleRef = null;
+    this.dbPromise = null;
+  }
+  /** Internal access for UserLibraryManager. Do not call from user code. */
+  async dbHandle() {
+    return this.ensureDb();
+  }
+  // -- Sources -------------------------------------------------------------
+  async listSources() {
+    const db = await this.ensureDb();
+    const rows = await db.select().from(libraries).all();
+    return rows.map(rowToSource);
+  }
+  async addSource(input) {
+    const db = await this.ensureDb();
+    const id = crypto.randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await db.insert(libraries).values({
+      id,
+      name: input.name,
+      path: input.path,
+      backend: input.type,
+      backendConfig: JSON.stringify(input.backendConfig ?? {}),
+      ownership: input.ownership ?? (input.type === "local" ? "owner" : "reader"),
+      isDefault: input.isDefault ?? false,
+      manifestGenerated: false,
+      createdAt: now,
+      updatedAt: now
+    }).run();
+    const row = await db.select().from(libraries).where(eq(libraries.id, id)).get();
+    return rowToSource(row);
+  }
+  async removeSource(id) {
+    const db = await this.ensureDb();
+    const existing = await db.select().from(libraries).where(eq(libraries.id, id)).get();
+    if (!existing) throw new SourceNotFoundError(id);
+    await db.delete(libraries).where(eq(libraries.id, id)).run();
+  }
+  async syncSource(id) {
+    const db = await this.ensureDb();
+    const existing = await db.select().from(libraries).where(eq(libraries.id, id)).get();
+    if (!existing) throw new SourceNotFoundError(id);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await db.update(libraries).set({ lastSyncAt: now, updatedAt: now }).where(eq(libraries.id, id)).run();
+    return { sourceId: id, assetsFound: 0, assetsUpdated: 0, errors: [] };
+  }
+  // -- Asset definitions ---------------------------------------------------
+  /**
+   * Insert or update a cached asset definition.
+   *
+   * Not on the IAssetIndex interface -- used by catalog sources (Task 1.5)
+   * and tests. INSERT OR REPLACE semantics.
+   */
+  async upsertAssetDef(def) {
+    const db = await this.ensureDb();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    let providerVersion = def.kindProviderVersion ?? null;
+    if (!providerVersion && this._kindRegistry) {
+      const provider = this._kindRegistry.getProvider(def.kind);
+      if (provider) {
+        providerVersion = provider.providerVersion;
+      }
+    }
+    await db.insert(assetDefinitions).values({
+      id: def.id,
+      kind: def.kind,
+      publisher: def.publisher,
+      name: def.name,
+      version: def.version,
+      sha256: def.sha256 ?? null,
+      description: def.description ?? null,
+      license: def.license ?? null,
+      category: def.category ?? null,
+      manifest: JSON.stringify(def.manifest),
+      libraryId: def.sourceId ?? null,
+      kindProviderVersion: providerVersion,
+      cachedAt: def.cachedAt?.toISOString() ?? now,
+      updatedAt: now
+    }).onConflictDoUpdate({
+      target: assetDefinitions.id,
+      set: {
+        kind: def.kind,
+        publisher: def.publisher,
+        name: def.name,
+        version: def.version,
+        sha256: def.sha256 ?? null,
+        description: def.description ?? null,
+        license: def.license ?? null,
+        category: def.category ?? null,
+        manifest: JSON.stringify(def.manifest),
+        libraryId: def.sourceId ?? null,
+        kindProviderVersion: providerVersion,
+        updatedAt: now
+      }
+    }).run();
+  }
+  async getAssetDef(ref) {
+    const db = await this.ensureDb();
+    const row = await db.select().from(assetDefinitions).where(eq(assetDefinitions.id, ref)).get();
+    return row ? rowToAssetDef(row) : null;
+  }
+  async listAssetDefs(filter) {
+    const db = await this.ensureDb();
+    if (!filter) {
+      return (await db.select().from(assetDefinitions).all()).map(rowToAssetDef);
+    }
+    const conditions = [];
+    if (filter.kind) conditions.push(eq(assetDefinitions.kind, filter.kind));
+    if (filter.publisher) conditions.push(eq(assetDefinitions.publisher, filter.publisher));
+    if (filter.prefix)
+      conditions.push(like(assetDefinitions.id, `${escapeLikePrefix(filter.prefix)}%`));
+    if (filter.sourceId) conditions.push(eq(assetDefinitions.libraryId, filter.sourceId));
+    const where = conditions.length > 0 ? and(...conditions) : void 0;
+    let rows = where ? await db.select().from(assetDefinitions).where(where).all() : await db.select().from(assetDefinitions).all();
+    if (filter.offset) rows = rows.slice(filter.offset);
+    if (filter.limit) rows = rows.slice(0, filter.limit);
+    return rows.map(rowToAssetDef);
+  }
+  // -- Instances -----------------------------------------------------------
+  async createInstance(input) {
+    const db = await this.ensureDb();
+    const id = crypto.randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const pin = input.defPin ?? "minor-track";
+    const config = input.config ?? {};
+    await db.insert(instances).values({
+      id,
+      defRef: input.defRef,
+      defPin: pin,
+      config: JSON.stringify(config),
+      credentialRef: input.credentialRef ?? null,
+      createdAt: now,
+      updatedAt: now,
+      createdBy: input.createdBy ?? null
+    }).run();
+    return {
+      id,
+      defRef: input.defRef,
+      defPin: pin,
+      config,
+      credentialRef: input.credentialRef,
+      createdAt: new Date(now),
+      updatedAt: new Date(now),
+      createdBy: input.createdBy
+    };
+  }
+  async getInstance(id) {
+    const db = await this.ensureDb();
+    const row = await db.select().from(instances).where(eq(instances.id, id)).get();
+    return row ? rowToInstance(row) : null;
+  }
+  async listInstances(filter) {
+    const db = await this.ensureDb();
+    if (!filter) {
+      return (await db.select().from(instances).all()).map(rowToInstance);
+    }
+    const conditions = [];
+    if (filter.defRef) conditions.push(eq(instances.defRef, filter.defRef));
+    if (filter.defPin) conditions.push(eq(instances.defPin, filter.defPin));
+    const where = conditions.length > 0 ? and(...conditions) : void 0;
+    let rows = where ? await db.select().from(instances).where(where).all() : await db.select().from(instances).all();
+    if (filter.offset) rows = rows.slice(filter.offset);
+    if (filter.limit) rows = rows.slice(0, filter.limit);
+    return rows.map(rowToInstance);
+  }
+  async updateInstance(id, patch) {
+    const db = await this.ensureDb();
+    const existing = await db.select().from(instances).where(eq(instances.id, id)).get();
+    if (!existing) throw new InstanceNotFoundError(id);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const updates = { updatedAt: now };
+    if (patch.config !== void 0) updates.config = JSON.stringify(patch.config);
+    if (patch.credentialRef !== void 0) updates.credentialRef = patch.credentialRef;
+    if (patch.defPin !== void 0) updates.defPin = patch.defPin;
+    await db.update(instances).set(updates).where(eq(instances.id, id)).run();
+    const updated = await db.select().from(instances).where(eq(instances.id, id)).get();
+    return rowToInstance(updated);
+  }
+  async deleteInstance(id, opts) {
+    const db = await this.ensureDb();
+    const existing = await db.select().from(instances).where(eq(instances.id, id)).get();
+    if (!existing) throw new InstanceNotFoundError(id);
+    const consumers = await db.select().from(subscriptions).where(eq(subscriptions.instanceId, id)).all();
+    if (consumers.length > 0 && !opts?.cascade) {
+      throw new InstanceHasConsumersError(id, consumers.length);
+    }
+    await db.delete(instances).where(eq(instances.id, id)).run();
+  }
+  // -- Subscriptions -------------------------------------------------------
+  async subscribe(workspaceId, instanceId, pin) {
+    const db = await this.ensureDb();
+    const instance = await db.select().from(instances).where(eq(instances.id, instanceId)).get();
+    if (!instance) throw new InstanceNotFoundError(instanceId);
+    const existing = await db.select().from(subscriptions).where(
+      and(
+        eq(subscriptions.workspaceId, workspaceId),
+        eq(subscriptions.instanceId, instanceId)
+      )
+    ).get();
+    if (existing) throw new DuplicateSubscriptionError(workspaceId, instanceId);
+    const id = crypto.randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await db.insert(subscriptions).values({ id, workspaceId, instanceId, pinPolicy: pin, subscribedAt: now }).run();
+    return { id, workspaceId, instanceId, pinPolicy: pin, subscribedAt: new Date(now) };
+  }
+  async unsubscribe(subscriptionId) {
+    const db = await this.ensureDb();
+    const existing = await db.select().from(subscriptions).where(eq(subscriptions.id, subscriptionId)).get();
+    if (!existing) throw new SubscriptionNotFoundError(subscriptionId);
+    await db.delete(subscriptions).where(eq(subscriptions.id, subscriptionId)).run();
+  }
+  async listSubscriptions(workspaceId) {
+    const db = await this.ensureDb();
+    return (await db.select().from(subscriptions).where(eq(subscriptions.workspaceId, workspaceId)).all()).map(rowToSubscription);
+  }
+  async getConsumptionGraph(instanceId) {
+    const db = await this.ensureDb();
+    return (await db.select().from(subscriptions).where(eq(subscriptions.instanceId, instanceId)).all()).map(rowToSubscription);
+  }
+};
+
+// library/src/user-library.ts
+var LIBRARY_BACKENDS = ["local", "git", "store"];
+var LIBRARY_OWNERSHIPS = ["owner", "contributor", "reader"];
+var LIBRARY_STRUCTURES = ["flat", "domain"];
+var LibrarySyncError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "LibrarySyncError";
+  }
+  code;
+};
+var OperationNotPermittedError = class extends LibrarySyncError {
+  constructor(verb, reason) {
+    super(`Operation not permitted: ${verb} \u2014 ${reason}`, "operation_not_permitted");
+    this.name = "OperationNotPermittedError";
+  }
+};
+var DuplicateLibraryNameError = class extends LibrarySyncError {
+  constructor(name) {
+    super(`A library named "${name}" already exists.`, "duplicate_name");
+    this.name = "DuplicateLibraryNameError";
+  }
+};
+var UserLibraryNotFoundError = class extends LibrarySyncError {
+  constructor(ident) {
+    super(`Library not found: ${ident}`, "library_not_found");
+    this.name = "UserLibraryNotFoundError";
+  }
+};
+
+// library/src/sync/git-driver.ts
+function git(cwd, args) {
+  return spawnSync("git", args, { cwd, encoding: "utf-8" });
+}
+function ok(r, action) {
+  if (r.status !== 0) {
+    throw new LibrarySyncError(
+      `git ${action} failed: ${r.stderr.trim() || r.stdout.trim()}`,
+      "remote_error"
+    );
+  }
+  return r.stdout.trim();
+}
+function gitCfg(lib) {
+  return lib.backendConfig;
+}
+var GitSyncDriver = class {
+  backend = "git";
+  async status(lib) {
+    const cfg = gitCfg(lib);
+    const porcelain = git(lib.path, ["status", "--porcelain"]);
+    if (porcelain.status !== 0) {
+      return {
+        reachable: false,
+        localChanges: { added: [], modified: [], deleted: [] },
+        notes: [`git not initialised at ${lib.path}`]
+      };
+    }
+    const added = [];
+    const modified = [];
+    const deleted = [];
+    for (const line of porcelain.stdout.split("\n").filter(Boolean)) {
+      const xy = line.slice(0, 2);
+      const file = line.slice(3);
+      if (xy.includes("A") || xy.startsWith("??")) added.push(file);
+      else if (xy.includes("D")) deleted.push(file);
+      else if (xy.includes("M") || xy.includes("R")) modified.push(file);
+    }
+    let remoteChanges;
+    const fetch2 = git(lib.path, ["fetch", "--quiet"]);
+    const reachable = fetch2.status === 0;
+    if (reachable) {
+      const counts = git(lib.path, [
+        "rev-list",
+        "--left-right",
+        "--count",
+        `${cfg.branch}...origin/${cfg.branch}`
+      ]);
+      if (counts.status === 0) {
+        const [ahead, behind] = counts.stdout.trim().split(/\s+/).map(Number);
+        remoteChanges = { ahead: ahead || 0, behind: behind || 0 };
+      }
+    }
+    return {
+      reachable,
+      localChanges: { added, modified, deleted },
+      remoteChanges,
+      notes: reachable ? [] : ["unable to reach origin"]
+    };
+  }
+  async pull(lib, opts) {
+    const cfg = gitCfg(lib);
+    const args = ["pull", "--ff-only", "origin", cfg.branch];
+    if (opts?.rebase) args.splice(1, 1, "--rebase");
+    const r = git(lib.path, args);
+    if (r.status !== 0) {
+      if (/non-fast-forward|diverged|conflict/i.test(r.stderr)) {
+        return { applied: 0, conflicts: [{ path: "(branch)", reason: r.stderr.trim() }] };
+      }
+      throw new LibrarySyncError(`git pull failed: ${r.stderr.trim()}`, "remote_error");
+    }
+    return { applied: 1, conflicts: [] };
+  }
+  async push(lib, opts) {
+    if (lib.ownership !== "owner") {
+      throw new OperationNotPermittedError(
+        "push",
+        `library "${lib.name}" has ownership=${lib.ownership}; use \`propose\` instead`
+      );
+    }
+    const cfg = gitCfg(lib);
+    const args = ["push", "origin", cfg.branch];
+    if (opts?.force) args.push("--force-with-lease");
+    ok(git(lib.path, args), "push");
+    return { pushed: 1 };
+  }
+  async propose(lib, opts) {
+    if (lib.ownership !== "contributor") {
+      throw new OperationNotPermittedError(
+        "propose",
+        `propose requires ownership=contributor; got ${lib.ownership}`
+      );
+    }
+    const cfg = gitCfg(lib);
+    const branch = opts.branch ?? `skaile/${(/* @__PURE__ */ new Date()).toISOString().replace(/[-:.TZ]/g, "").slice(0, 14)}`;
+    const remotes = ok(git(lib.path, ["remote"]), "remote-list").split("\n");
+    if (!remotes.includes("fork")) {
+      if (!cfg.forkUrl) {
+        const fork = spawnSync(
+          "gh",
+          ["repo", "fork", cfg.url, "--remote", "--remote-name", "fork"],
+          {
+            cwd: lib.path,
+            encoding: "utf-8"
+          }
+        );
+        if (fork.status !== 0) {
+          throw new LibrarySyncError(
+            `gh repo fork failed: ${fork.stderr.trim()}. Manual fallback: fork ${cfg.url} on github.com and run \`skaile library set ${lib.name} backendConfig.forkUrl=<url>\`.`,
+            "auth_required"
+          );
+        }
+      } else {
+        ok(git(lib.path, ["remote", "add", "fork", cfg.forkUrl]), "remote-add");
+      }
+    }
+    ok(git(lib.path, ["checkout", "-B", branch]), "checkout");
+    ok(git(lib.path, ["push", "fork", branch]), "push-fork");
+    const ghArgs = ["pr", "create", "--base", cfg.branch, "--head", `fork:${branch}`];
+    if (opts.title) ghArgs.push("--title", opts.title);
+    if (opts.body) ghArgs.push("--body", opts.body);
+    const pr = spawnSync("gh", ghArgs, { cwd: lib.path, encoding: "utf-8" });
+    if (pr.status !== 0) {
+      const manualUrl = `${cfg.url.replace(/\.git$/, "")}/compare/${cfg.branch}...${branch}`;
+      throw new LibrarySyncError(
+        `gh pr create failed: ${pr.stderr.trim()}. Open manually: ${manualUrl}`,
+        "remote_error"
+      );
+    }
+    const prUrl = pr.stdout.trim().split("\n").pop() ?? "(unknown)";
+    return { prUrl, branch };
+  }
+  async publish(_lib, _refs, _opts) {
+    throw new OperationNotPermittedError("publish", "git libraries cannot publish; use store");
+  }
+};
+
+// library/src/sync/local-driver.ts
+var LocalSyncDriver = class {
+  backend = "local";
+  async status(_lib) {
+    return {
+      reachable: true,
+      localChanges: { added: [], modified: [], deleted: [] },
+      notes: ["local library \u2014 no remote sync needed"]
+    };
+  }
+  async pull(_lib, _opts) {
+    return { applied: 0, conflicts: [] };
+  }
+  async push(_lib, _opts) {
+    return { pushed: 0 };
+  }
+  async propose(_lib, _opts) {
+    throw new OperationNotPermittedError(
+      "propose",
+      "local libraries have no remote; convert to git first"
+    );
+  }
+  async publish(_lib, _refs, _opts) {
+    throw new OperationNotPermittedError("publish", "local libraries cannot publish");
+  }
+};
+
+// library/src/sync/store-driver.ts
+var StoreSyncDriver = class {
+  backend = "store";
+  async status(_lib) {
+    return {
+      reachable: true,
+      localChanges: { added: [], modified: [], deleted: [] },
+      notes: ["catalog refresh only \u2014 store write path is a stub in MVP"]
+    };
+  }
+  async pull(_lib, _opts) {
+    return { applied: 0, conflicts: [] };
+  }
+  async push(_lib, _opts) {
+    throw new OperationNotPermittedError("push", "store libraries publish via `publish`");
+  }
+  async propose(_lib, _opts) {
+    throw new OperationNotPermittedError("propose", "store libraries publish via `publish`");
+  }
+  async publish(_lib, _refs, _opts) {
+    throw new LibrarySyncError(
+      "store backend write path is not yet wired (MVP stub)",
+      "remote_error"
+    );
+  }
+};
+
+// library/src/local/user-library-manager.ts
+function rowToUserLibrary(row) {
+  const cfg = (() => {
+    try {
+      return JSON.parse(row.backendConfig);
+    } catch {
+      return {};
+    }
+  })();
+  return {
+    id: row.id,
+    name: row.name,
+    path: row.path,
+    backend: row.backend,
+    backendConfig: cfg,
+    ownership: row.ownership,
+    structure: row.structure ?? void 0,
+    isDefault: row.isDefault,
+    manifestGenerated: row.manifestGenerated,
+    lastSyncAt: row.lastSyncAt ? new Date(row.lastSyncAt) : void 0,
+    createdAt: new Date(row.createdAt),
+    updatedAt: new Date(row.updatedAt)
+  };
+}
+var UserLibraryManager = class {
+  constructor(lib) {
+    this.lib = lib;
+  }
+  lib;
+  localDrv = new LocalSyncDriver();
+  gitDrv = new GitSyncDriver();
+  storeDrv = new StoreSyncDriver();
+  /** Resolve the sync driver for a given backend. */
+  driverFor(backend) {
+    switch (backend) {
+      case "local":
+        return this.localDrv;
+      case "git":
+        return this.gitDrv;
+      case "store":
+        return this.storeDrv;
+    }
+  }
+  async addLibrary(input) {
+    const db = await this.lib.dbHandle();
+    const existing = await db.select().from(libraries).where(eq(libraries.name, input.name)).get();
+    if (existing) throw new DuplicateLibraryNameError(input.name);
+    const id = crypto.randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (input.isDefault) {
+      await db.update(libraries).set({ isDefault: false }).run();
+    }
+    await db.insert(libraries).values({
+      id,
+      name: input.name,
+      path: input.path,
+      backend: input.backend,
+      backendConfig: JSON.stringify(input.backendConfig ?? {}),
+      ownership: input.ownership,
+      structure: input.structure ?? null,
+      isDefault: input.isDefault ?? false,
+      manifestGenerated: input.manifestGenerated ?? false,
+      createdAt: now,
+      updatedAt: now
+    }).run();
+    return this.requireLibrary(id);
+  }
+  async listLibraries() {
+    const db = await this.lib.dbHandle();
+    const rows = await db.select().from(libraries).all();
+    return rows.map(rowToUserLibrary).sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
+  }
+  async getLibrary(nameOrId) {
+    const db = await this.lib.dbHandle();
+    let row = await db.select().from(libraries).where(eq(libraries.name, nameOrId)).get();
+    if (!row) {
+      row = await db.select().from(libraries).where(eq(libraries.id, nameOrId)).get();
+    }
+    return row ? rowToUserLibrary(row) : null;
+  }
+  async requireLibrary(nameOrId) {
+    const lib = await this.getLibrary(nameOrId);
+    if (!lib) throw new UserLibraryNotFoundError(nameOrId);
+    return lib;
+  }
+  async updateLibrary(nameOrId, patch) {
+    const lib = await this.requireLibrary(nameOrId);
+    const db = await this.lib.dbHandle();
+    const updates = {
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (patch.name !== void 0) updates.name = patch.name;
+    if (patch.path !== void 0) updates.path = patch.path;
+    if (patch.backendConfig !== void 0)
+      updates.backendConfig = JSON.stringify(patch.backendConfig);
+    if (patch.ownership !== void 0) updates.ownership = patch.ownership;
+    if (patch.structure !== void 0) updates.structure = patch.structure;
+    if (patch.manifestGenerated !== void 0) updates.manifestGenerated = patch.manifestGenerated;
+    if (patch.isDefault !== void 0) updates.isDefault = patch.isDefault;
+    if (patch.lastSyncAt !== void 0) updates.lastSyncAt = patch.lastSyncAt.toISOString();
+    await db.update(libraries).set(updates).where(eq(libraries.id, lib.id)).run();
+    return this.requireLibrary(lib.id);
+  }
+  async setDefault(nameOrId) {
+    const lib = await this.requireLibrary(nameOrId);
+    const db = await this.lib.dbHandle();
+    await db.update(libraries).set({ isDefault: false }).run();
+    await db.update(libraries).set({ isDefault: true, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(libraries.id, lib.id)).run();
+    return this.requireLibrary(lib.id);
+  }
+  async removeLibrary(nameOrId, opts = {}) {
+    const lib = await this.requireLibrary(nameOrId);
+    const db = await this.lib.dbHandle();
+    await db.delete(libraries).where(eq(libraries.id, lib.id)).run();
+    if (opts.purge && fs10.existsSync(lib.path)) {
+      fs10.rmSync(lib.path, { recursive: true, force: true });
+    }
+  }
+  /**
+   * Idempotently ensure a `personal` library exists at `<librariesDir>/personal`.
+   * Created silently — one stderr line — on first call when no writable default
+   * exists. Returns the library row and a `created` flag.
+   */
+  async ensurePersonalLibrary(librariesDir) {
+    const existing = await this.getLibrary("personal");
+    if (existing) return { library: existing, created: false };
+    const all = await this.listLibraries();
+    const writableDefault = all.find(
+      (l) => l.isDefault && (l.ownership === "owner" || l.ownership === "contributor")
+    );
+    if (writableDefault) return { library: writableDefault, created: false };
+    const personalPath = path5.join(librariesDir, "personal");
+    fs10.mkdirSync(personalPath, { recursive: true });
+    const lib = await this.addLibrary({
+      name: "personal",
+      path: personalPath,
+      backend: "local",
+      backendConfig: {},
+      ownership: "owner",
+      structure: "domain",
+      isDefault: true,
+      manifestGenerated: false
+    });
+    process.stderr.write(
+      `[skaile/library] Created personal library at ${personalPath} (default).
+`
+    );
+    return { library: lib, created: true };
+  }
+};
+var SKAILE_HOME_ENV = "SKAILE_HOME";
+function getSidecarRoot() {
+  const home = process.env[SKAILE_HOME_ENV] ?? path5.join(os.homedir(), ".skaile");
+  return path5.join(home, "sources");
+}
+function resolveSidecarPaths(slug) {
+  const rootDir = getSidecarRoot();
+  const sidecarDir = path5.join(rootDir, slug);
+  return {
+    rootDir,
+    sidecarDir,
+    manifestFile: path5.join(sidecarDir, ".skaile-source.yaml"),
+    readmeFile: path5.join(sidecarDir, "README.md"),
+    lockFile: path5.join(sidecarDir, ".skaile-source.lock.json")
+  };
+}
+function deriveSlug(sourceConfig, sourcePath, existingSlugs) {
+  const fromConfig = sourceConfig && typeof sourceConfig.name === "string" ? sourceConfig.name : void 0;
+  const base = fromConfig && fromConfig.length > 0 ? slugify2(fromConfig) : slugify2(path5.basename(sourcePath || "")) || "unnamed-source";
+  const taken = new Set(existingSlugs);
+  if (!taken.has(base)) return base;
+  for (let i = 2; i < 1e3; i++) {
+    const candidate = `${base}-${i}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+  return `${base}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function listSidecarSlugsOnDisk() {
+  const root = getSidecarRoot();
+  if (!fs10.existsSync(root)) return [];
+  const out = [];
+  for (const entry of fs10.readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    if (entry.name.startsWith(".")) continue;
+    out.push(entry.name);
+  }
+  return out.sort();
+}
+function slugify2(input) {
+  return input.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^[-.]+|[-.]+$/g, "");
+}
+var FALLBACK_USER_NAME = "Skaile CLI";
+var FALLBACK_USER_EMAIL = "skaile-cli@local";
+var ROOT_README = `# Skaile Sidecar Manifests
+
+This directory is managed by \`skaile source sidecar\` commands. Each
+subdirectory is a curated local-overlay manifest for an asset source
+registered in your LocalLibrary at \`~/.skaile/library/lib.db\`.
+
+You can push this repo to your own remote (e.g. a private dotfiles repo)
+to share or back up your sidecars across machines:
+
+\`\`\`bash
+skaile source sidecar git -- remote add origin git@example.com:you/sidecars.git
+skaile source sidecar git -- push -u origin main
+\`\`\`
+
+See the agent-framework docs (\`library/docs/source-sidecars.md\`) for the
+full workflow.
+`;
+var GITATTRIBUTES = "* text=auto eol=lf\n";
+var SidecarGit = class {
+  constructor(rootDir) {
+    this.rootDir = rootDir;
+  }
+  rootDir;
+  /**
+   * Initialize the sidecar root if it doesn't yet exist.
+   *
+   * Steps (idempotent — each is a no-op when already present):
+   *   1. `mkdir -p <rootDir>`
+   *   2. `git init -b main <rootDir>` if `<rootDir>/.git` is missing
+   *   3. Write `.gitattributes` (`* text=auto eol=lf`) if missing
+   *   4. Write `README.md` if missing
+   *   5. Apply fallback `user.name` / `user.email` to the repo config if
+   *      the global config is missing them
+   *   6. Create the seed commit (`chore: initialize sidecar manifests`) if
+   *      the repo has no commits yet
+   *
+   * Subsequent calls don't reset config, so a user who overrode the
+   * identity manually keeps their override.
+   *
+   * @docLink packages/library/concepts#sidecar-git
+   */
+  async ensureInitialized() {
+    if (!fs10.existsSync(this.rootDir)) {
+      fs10.mkdirSync(this.rootDir, { recursive: true });
+    }
+    const gitDir = path5.join(this.rootDir, ".git");
+    const freshRepo = !fs10.existsSync(gitDir);
+    if (freshRepo) {
+      const init = this.spawn(["init", "-b", "main"]);
+      if (init.exitCode !== 0) {
+        throw new Error(`git init failed: ${init.stderr || init.stdout}`);
+      }
+    }
+    const attrsPath = path5.join(this.rootDir, ".gitattributes");
+    if (!fs10.existsSync(attrsPath)) fs10.writeFileSync(attrsPath, GITATTRIBUTES, "utf-8");
+    const readmePath = path5.join(this.rootDir, "README.md");
+    if (!fs10.existsSync(readmePath)) fs10.writeFileSync(readmePath, ROOT_README, "utf-8");
+    if (!this.hasGlobalGitConfig("user.name")) {
+      this.spawn(["config", "user.name", FALLBACK_USER_NAME]);
+    }
+    if (!this.hasGlobalGitConfig("user.email")) {
+      this.spawn(["config", "user.email", FALLBACK_USER_EMAIL]);
+    }
+    if (freshRepo || !this.hasAnyCommit()) {
+      this.spawn(["add", ".gitattributes", "README.md"]);
+      this.spawn(["commit", "-m", "chore: initialize sidecar manifests"]);
+    }
+  }
+  /**
+   * Stage everything under `<rootDir>/<slug>/` and create a commit.
+   *
+   * Idempotent: if there are no staged changes after `git add`, the commit
+   * is skipped (and resolves successfully — a no-op is fine).
+   *
+   * @param slug - Sidecar slug (subdirectory name)
+   * @param message - Commit message (conventional-commits style preferred;
+   *   the CLI uses `feat(<slug>): create sidecar...`, `chore(<slug>): ...`)
+   * @param opts - `{ skip: true }` short-circuits without staging or committing
+   */
+  async commit(slug, message, opts) {
+    if (opts?.skip) return;
+    const slugDir = path5.join(this.rootDir, slug);
+    if (fs10.existsSync(slugDir)) {
+      this.spawn(["add", "--", slug]);
+    } else {
+      this.spawn(["add", "-A"]);
+    }
+    const status = this.spawn(["status", "--porcelain"]);
+    if (status.stdout.trim().length === 0) return;
+    const result = this.spawn(["commit", "-m", message]);
+    if (result.exitCode !== 0) {
+      const combined = `${result.stdout}
+${result.stderr}`;
+      if (/nothing to commit|nothing added to commit/i.test(combined)) return;
+      throw new Error(`git commit failed: ${combined.trim()}`);
+    }
+  }
+  /**
+   * Check whether the sidecar repo has uncommitted changes.
+   *
+   * @returns `true` when `git status --porcelain` has any output.
+   */
+  async hasChanges() {
+    const result = this.spawn(["status", "--porcelain"]);
+    return result.stdout.trim().length > 0;
+  }
+  /**
+   * Run an arbitrary `git -C <rootDir> <args>` invocation and return the
+   * captured stdout/stderr + exit code.
+   *
+   * Used by `skaile source sidecar git -- <args>` so users don't have to
+   * `cd ~/.skaile/sources` to operate the repo manually.
+   *
+   * @param args - Git arguments (no leading `git` token)
+   * @returns Combined output + exit code; never throws on non-zero exit
+   * @docLink packages/library/concepts#sidecar-git
+   */
+  async runRaw(args) {
+    return this.spawn(args);
+  }
+  // -- Internals -----------------------------------------------------------
+  spawn(args) {
+    const result = spawnSync("git", ["-C", this.rootDir, ...args], {
+      encoding: "utf-8"
+    });
+    return {
+      stdout: result.stdout ?? "",
+      stderr: result.stderr ?? "",
+      exitCode: result.status ?? 1
+    };
+  }
+  hasGlobalGitConfig(key) {
+    const result = spawnSync("git", ["config", "--global", "--get", key], { encoding: "utf-8" });
+    return result.status === 0 && (result.stdout ?? "").trim().length > 0;
+  }
+  hasAnyCommit() {
+    const result = this.spawn(["rev-parse", "--verify", "HEAD"]);
+    return result.exitCode === 0;
+  }
+};
+var PinPolicySchema = z2.enum(PIN_POLICIES);
+var LibraryInstanceRefSchema = z2.object({
+  id: z2.string().uuid(),
+  alias: z2.string().optional()
+});
+var LibrarySectionSchema = z2.object({
+  pin_policy: PinPolicySchema.default("minor-track"),
+  instances: z2.array(LibraryInstanceRefSchema).default([])
+});
+var PresetAppliedItemSchema = z2.object({
+  instance_id: z2.string().uuid(),
+  def_ref: z2.string()
+});
+var PresetAppliedSchema = z2.object({
+  ref: z2.string(),
+  applied_at: z2.string(),
+  items: z2.array(PresetAppliedItemSchema).default([])
+});
+var WorkspaceConfigV2Schema = z2.object({
+  version: z2.literal(2),
+  library: LibrarySectionSchema.optional(),
+  presets_applied: z2.array(PresetAppliedSchema).optional()
+});
+var LockSubscriptionSchema = z2.object({
+  subscription_id: z2.string().uuid(),
+  instance_id: z2.string().uuid(),
+  def_ref: z2.string(),
+  resolved_version: z2.string(),
+  resolved_sha256: z2.string().optional(),
+  pin_policy: PinPolicySchema
+});
+var RequiresEdgeSchema = z2.object({
+  from: z2.string(),
+  to: z2.string(),
+  kind: z2.string().optional()
+});
+var PresetExpandedSchema = z2.object({
+  preset_ref: z2.string(),
+  instance_ids: z2.array(z2.string().uuid())
+});
+var LockFileSchema = z2.object({
+  version: z2.literal(2),
+  generated_at: z2.string(),
+  subscriptions: z2.array(LockSubscriptionSchema).default([]),
+  requires_graph: z2.array(RequiresEdgeSchema).default([]),
+  presets_expanded: z2.array(PresetExpandedSchema).default([])
+});
+function parseWorkspaceV2(raw) {
+  if (raw.version !== 2) return null;
+  return WorkspaceConfigV2Schema.parse(raw);
+}
+function loadWorkspaceV2(dir, filename = "skaile.yaml") {
+  const filePath = path5.join(dir, filename);
+  if (!fs10.existsSync(filePath)) return null;
+  const content = fs10.readFileSync(filePath, "utf-8");
+  const raw = parse(content);
+  if (!raw || typeof raw !== "object") return null;
+  return parseWorkspaceV2(raw);
+}
+function saveWorkspaceV2(dir, v2, filename = "skaile.yaml") {
+  const filePath = path5.join(dir, filename);
+  let existing = {};
+  if (fs10.existsSync(filePath)) {
+    const content = fs10.readFileSync(filePath, "utf-8");
+    existing = parse(content) ?? {};
+  }
+  existing.version = 2;
+  if (v2.library !== void 0) existing.library = v2.library;
+  if (v2.presets_applied !== void 0) existing.presets_applied = v2.presets_applied;
+  if (!fs10.existsSync(dir)) {
+    fs10.mkdirSync(dir, { recursive: true });
+  }
+  fs10.writeFileSync(filePath, stringify(existing, { indent: 2 }), "utf-8");
+}
+var LOCK_FILENAME = "skaile.lock.yaml";
+function loadLockFile(dir) {
+  const filePath = path5.join(dir, LOCK_FILENAME);
+  if (!fs10.existsSync(filePath)) return null;
+  const content = fs10.readFileSync(filePath, "utf-8");
+  const raw = parse(content);
+  return LockFileSchema.parse(raw);
+}
+function saveLockFile(dir, lock) {
+  const filePath = path5.join(dir, LOCK_FILENAME);
+  if (!fs10.existsSync(dir)) {
+    fs10.mkdirSync(dir, { recursive: true });
+  }
+  fs10.writeFileSync(
+    filePath,
+    `# Auto-generated by skaile. Do not edit manually.
+${stringify(lock, { indent: 2 })}`,
+    "utf-8"
+  );
+}
+function createEmptyLockFile() {
+  return {
+    version: 2,
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    subscriptions: [],
+    requires_graph: [],
+    presets_expanded: []
+  };
+}
+function detectWorkspaceVersion(dir, filename = "skaile.yaml") {
+  const filePath = path5.join(dir, filename);
+  if (!fs10.existsSync(filePath)) return null;
+  const content = fs10.readFileSync(filePath, "utf-8");
+  const raw = parse(content);
+  if (!raw || typeof raw !== "object") return null;
+  return raw.version === 2 ? 2 : 1;
+}
+var MANIFEST_FILENAME = ".skaile-source.yaml";
+async function writeManifestIfMissing(input) {
+  const manifestPath = path5.join(input.libraryPath, MANIFEST_FILENAME);
+  if (fs10.existsSync(manifestPath)) return { wrote: false, manifestPath };
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const yaml = `# Generated by skaile library add on ${now}
+# Edit by hand to inline discovered assets; or run \`skaile library refresh-manifest\`.
+version: 2
+structure: ${input.structure}
+publisher: ""
+assets: []
+`;
+  fs10.writeFileSync(manifestPath, yaml, "utf-8");
+  if (input.ownership !== "owner") {
+    const excludePath = path5.join(input.libraryPath, ".git", "info", "exclude");
+    if (fs10.existsSync(path5.dirname(excludePath))) {
+      const current = fs10.existsSync(excludePath) ? fs10.readFileSync(excludePath, "utf-8") : "";
+      if (!current.includes(MANIFEST_FILENAME)) {
+        fs10.writeFileSync(
+          excludePath,
+          (current.endsWith("\n") || current === "" ? current : current + "\n") + `# skaile-managed local-overlay manifest
+${MANIFEST_FILENAME}
+`,
+          "utf-8"
+        );
+      }
+    }
+  }
+  return { wrote: true, manifestPath };
+}
+function migrateWorkspaceConfig(dir, opts) {
+  const filename = opts?.filename ?? "skaile.yaml";
+  const filePath = path5.join(dir, filename);
+  if (!fs10.existsSync(filePath)) {
+    return { migrated: false, version: 1, warnings: ["No skaile.yaml found"] };
+  }
+  const content = fs10.readFileSync(filePath, "utf-8");
+  const raw = parse(content);
+  if (!raw || typeof raw !== "object") {
+    return { migrated: false, version: 1, warnings: ["Invalid YAML content"] };
+  }
+  if (raw.version === 2) {
+    return { migrated: false, version: 2, warnings: [] };
+  }
+  const warnings = [];
+  if (raw.dependencies && Array.isArray(raw.dependencies)) {
+    warnings.push(
+      "v1 'dependencies' field found. In v2, use 'library.instances' to reference configured asset instances. Manual migration recommended."
+    );
+  }
+  if (raw.ai_resources) {
+    warnings.push(
+      "v1 'ai_resources' field found. In v2, sources are managed via 'skaile source add'. The field still works but is deprecated."
+    );
+  }
+  if (!opts?.dryRun) {
+    const doc = parseDocument(content);
+    if (doc.contents && "items" in doc.contents) {
+      const map = doc.contents;
+      const items = map.items;
+      const idx = items.findIndex((p) => p.key?.value === "version");
+      if (idx >= 0) items.splice(idx, 1);
+      doc.set("version", 2);
+      const added = items.pop();
+      if (added) items.unshift(added);
+    } else {
+      doc.set("version", 2);
+    }
+    fs10.writeFileSync(filePath, doc.toString(), "utf-8");
+  }
+  return {
+    migrated: !opts?.dryRun,
+    version: opts?.dryRun ? 1 : 2,
+    warnings
+  };
+}
+
+// library/src/pin-resolver.ts
+function resolvePin(pin, availableVersions) {
+  if (availableVersions.length === 0) return null;
+  const parsed = availableVersions.map(parseSemVer).filter((v) => v !== null).sort((a, b) => compareSemVer(b, a));
+  if (parsed.length === 0) return null;
+  if (pin === "latest") {
+    return { version: parsed[0].raw, match: "latest" };
+  }
+  if (pin.startsWith("exact:")) {
+    const target = pin.slice(6);
+    const found = parsed.find((v) => v.raw === target);
+    return found ? { version: found.raw, match: "exact" } : null;
+  }
+  if (pin.startsWith("^")) {
+    const target = parseRangeTarget(pin.slice(1));
+    if (!target) return null;
+    const match = parsed.find(
+      (v) => v.major === target.major && (v.minor > target.minor || v.minor === target.minor && v.patch >= target.patch)
+    );
+    return match ? { version: match.raw, match: "range" } : null;
+  }
+  if (pin.startsWith("~")) {
+    const target = parseRangeTarget(pin.slice(1));
+    if (!target) return null;
+    const match = parsed.find(
+      (v) => v.major === target.major && v.minor === target.minor && v.patch >= target.patch
+    );
+    return match ? { version: match.raw, match: "range" } : null;
+  }
+  if (pin.endsWith(".x")) {
+    const base = pin.slice(0, -2);
+    const parts = base.split(".");
+    const major = Number.parseInt(parts[0], 10);
+    const minor = parts.length > 1 ? Number.parseInt(parts[1], 10) : 0;
+    if (Number.isNaN(major)) return null;
+    const match = parsed.find(
+      (v) => v.major === major && (Number.isNaN(minor) || v.minor === minor)
+    );
+    return match ? { version: match.raw, match: "range" } : null;
+  }
+  const bareSemver = parseSemVer(pin);
+  if (bareSemver) {
+    const found = parsed.find((v) => v.raw === pin);
+    return found ? { version: found.raw, match: "exact" } : null;
+  }
+  return null;
+}
+function parseSemVer(v) {
+  const match = v.match(/^(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return null;
+  return {
+    major: Number.parseInt(match[1], 10),
+    minor: Number.parseInt(match[2], 10),
+    patch: Number.parseInt(match[3], 10),
+    raw: v
+  };
+}
+function compareSemVer(a, b) {
+  if (a.major !== b.major) return a.major - b.major;
+  if (a.minor !== b.minor) return a.minor - b.minor;
+  return a.patch - b.patch;
+}
+function parseRangeTarget(range) {
+  const parts = range.split(".");
+  const major = Number.parseInt(parts[0], 10);
+  if (Number.isNaN(major)) return null;
+  const minor = parts.length > 1 ? Number.parseInt(parts[1], 10) : 0;
+  const patch = parts.length > 2 ? Number.parseInt(parts[2], 10) : 0;
+  return {
+    major,
+    minor: Number.isNaN(minor) ? 0 : minor,
+    patch: Number.isNaN(patch) ? 0 : patch
+  };
+}
+var LocalCatalogSource = class {
+  constructor(library, sourceId, rootPath, registry, options) {
+    this.library = library;
+    this.sourceId = sourceId;
+    this.rootPath = rootPath;
+    this.registry = registry;
+    this.id = `local:${sourceId}`;
+    this.sidecarPath = options?.sidecarPath;
+  }
+  library;
+  sourceId;
+  rootPath;
+  registry;
+  id;
+  sidecarPath;
+  async resolve(ref) {
+    const def = await this.library.getAssetDef(ref);
+    if (!def || def.sourceId !== this.sourceId) return null;
+    return defToCatalogAsset(def);
+  }
+  async listAssets(filter) {
+    const libraryFilter = { sourceId: this.sourceId };
+    if (filter?.kind) libraryFilter.kind = filter.kind;
+    if (filter?.publisher) libraryFilter.publisher = filter.publisher;
+    if (filter?.prefix) libraryFilter.prefix = filter.prefix;
+    const defs = await this.library.listAssetDefs(libraryFilter);
+    return defs.map(defToCatalogAsset);
+  }
+  async fetchTarball(_ref, _sha256) {
+    throw new Error(
+      "LocalCatalogSource does not support tarball delivery. Assets are available on disk."
+    );
+  }
+  async listSources() {
+    return [{ id: this.sourceId, type: "local", url: this.rootPath }];
+  }
+  /**
+   * Sync: discover assets in the source directory and cache them in the library.
+   *
+   * Runs the discovery pipeline (glob -> parse -> filter -> hash -> requires)
+   * and upserts each discovered asset into the LocalLibrary cache.
+   *
+   * @returns Discovery statistics and any errors encountered.
+   */
+  async sync() {
+    const opts = {
+      registry: this.registry,
+      sidecarPath: this.sidecarPath
+    };
+    if (!this.sidecarPath) {
+      opts.sourceConfig = loadSourceConfigIfPresent(this.rootPath);
+    }
+    const result = discoverAssetsInTree(this.rootPath, opts);
+    let assetsUpdated = 0;
+    const errors = [];
+    for (const asset of result.assets) {
+      if (asset.kind === "preset") continue;
+      try {
+        await this.library.upsertAssetDef({
+          id: asset.ref,
+          kind: asset.kind,
+          publisher: asset.publisher,
+          name: asset.name,
+          version: asset.version,
+          sha256: asset.sha256,
+          description: typeof asset.manifest.description === "string" ? asset.manifest.description : void 0,
+          license: typeof asset.manifest.license === "string" ? asset.manifest.license : void 0,
+          category: typeof asset.manifest.category === "string" ? asset.manifest.category : void 0,
+          manifest: asset.manifest,
+          sourceId: this.sourceId,
+          cachedAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+        assetsUpdated++;
+      } catch (err) {
+        errors.push(`${asset.ref}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    for (const err of result.errors) {
+      errors.push(`${err.path}: ${err.error}`);
+    }
+    return { assetsFound: result.assets.length, assetsUpdated, errors };
+  }
+};
+function defToCatalogAsset(def) {
+  return {
+    id: def.id,
+    kind: def.kind,
+    publisher: def.publisher,
+    name: def.name,
+    version: def.version,
+    sha256: def.sha256,
+    description: def.description,
+    license: def.license,
+    category: def.category,
+    manifest: def.manifest
+  };
+}
+function loadSourceConfigIfPresent(rootPath) {
+  const configPath = path5.join(rootPath, ".skaile-source.yaml");
+  if (!fs10.existsSync(configPath)) return void 0;
+  try {
+    const content = fs10.readFileSync(configPath, "utf-8");
+    const result = loadSourceConfig(content);
+    if (!result.ok) return void 0;
+    return result.config;
+  } catch {
+    return void 0;
+  }
+}
+function defaultCacheDir() {
+  return path5.join(os.homedir(), ".skaile", "catalog-cache");
+}
+var INDEX_FILE = "index.json";
+var TARBALL_DIR = "tarballs";
+var CatalogCache = class {
+  dir;
+  ttlMs;
+  nowFn;
+  index = null;
+  constructor(opts) {
+    this.dir = opts.dir ?? defaultCacheDir();
+    this.ttlMs = opts.ttlMs;
+    this.nowFn = opts.now ?? Date.now;
+    this.ensureDir();
+  }
+  // ── public: resolve cache ───────────────────────────────────────────────
+  /**
+   * Return a fresh resolve-cache entry for `ref`, or `null` if absent / stale.
+   *
+   * When `ttlMs === 0` (air-gapped), all entries are considered fresh
+   * regardless of `fetchedAt`.
+   */
+  getResolve(ref) {
+    const idx = this.loadIndex();
+    const entry = idx.resolve[ref];
+    if (!entry) return null;
+    if (this.ttlMs === 0) return entry;
+    if (this.nowFn() - entry.fetchedAt > this.ttlMs) return null;
+    return entry;
+  }
+  /**
+   * Return a stale resolve-cache entry regardless of TTL — for stale-while-revalidate.
+   */
+  getResolveStale(ref) {
+    const idx = this.loadIndex();
+    return idx.resolve[ref] ?? null;
+  }
+  /** Persist a resolve-cache entry (use `null` to negatively cache misses). */
+  setResolve(ref, value) {
+    const idx = this.loadIndex();
+    idx.resolve[ref] = { fetchedAt: this.nowFn(), value };
+    this.writeIndex(idx);
+  }
+  // ── public: list cache ──────────────────────────────────────────────────
+  /**
+   * Return a fresh list-cache entry for `filter`, or `null` if absent / stale.
+   */
+  getList(filter) {
+    const key = filterKey(filter);
+    const idx = this.loadIndex();
+    const entry = idx.list[key];
+    if (!entry) return null;
+    if (this.ttlMs === 0) return entry;
+    if (this.nowFn() - entry.fetchedAt > this.ttlMs) return null;
+    return entry;
+  }
+  /** Return a stale list-cache entry regardless of TTL — for stale-while-revalidate. */
+  getListStale(filter) {
+    const key = filterKey(filter);
+    const idx = this.loadIndex();
+    return idx.list[key] ?? null;
+  }
+  /** Persist a list-cache entry. */
+  setList(filter, items) {
+    const key = filterKey(filter);
+    const idx = this.loadIndex();
+    idx.list[key] = { fetchedAt: this.nowFn(), items };
+    this.writeIndex(idx);
+  }
+  // ── public: tarball cache ───────────────────────────────────────────────
+  /** Absolute path where a tarball with `sha256` would be cached. */
+  tarballPath(sha256) {
+    return path5.join(this.dir, TARBALL_DIR, `${sha256}.tgz`);
+  }
+  /** Read a cached tarball from disk if present, otherwise `null`. */
+  readTarball(sha256) {
+    const p = this.tarballPath(sha256);
+    if (!fs10.existsSync(p)) return null;
+    return fs10.readFileSync(p);
+  }
+  /** Persist a tarball blob to disk (atomic write). */
+  writeTarball(sha256, bytes) {
+    const dir = path5.join(this.dir, TARBALL_DIR);
+    if (!fs10.existsSync(dir)) fs10.mkdirSync(dir, { recursive: true });
+    const finalPath = this.tarballPath(sha256);
+    const tmpPath = `${finalPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    fs10.writeFileSync(tmpPath, bytes);
+    fs10.renameSync(tmpPath, finalPath);
+  }
+  // ── public: invalidation ────────────────────────────────────────────────
+  /**
+   * Wipe all cached metadata (resolve + list). Tarballs are content-addressed
+   * and remain valid — they are not invalidated.
+   *
+   * Called by `skaile update`.
+   */
+  invalidateAll() {
+    const idx = { version: 1, resolve: {}, list: {} };
+    this.index = idx;
+    this.writeIndex(idx);
+  }
+  /**
+   * Wipe all cached metadata **and** delete tarball blobs. Used for full reset.
+   */
+  invalidateEverything() {
+    this.invalidateAll();
+    const tarballDir = path5.join(this.dir, TARBALL_DIR);
+    if (fs10.existsSync(tarballDir)) {
+      fs10.rmSync(tarballDir, { recursive: true, force: true });
+    }
+  }
+  /** Return whether `ttlMs` is zero (air-gapped mode). */
+  get airGapped() {
+    return this.ttlMs === 0;
+  }
+  // ── private ─────────────────────────────────────────────────────────────
+  ensureDir() {
+    if (!fs10.existsSync(this.dir)) fs10.mkdirSync(this.dir, { recursive: true });
+    const tarballDir = path5.join(this.dir, TARBALL_DIR);
+    if (!fs10.existsSync(tarballDir)) fs10.mkdirSync(tarballDir, { recursive: true });
+  }
+  indexPath() {
+    return path5.join(this.dir, INDEX_FILE);
+  }
+  loadIndex() {
+    if (this.index) return this.index;
+    const p = this.indexPath();
+    if (!fs10.existsSync(p)) {
+      this.index = { version: 1, resolve: {}, list: {} };
+      return this.index;
+    }
+    try {
+      const raw = JSON.parse(fs10.readFileSync(p, "utf-8"));
+      if (raw && typeof raw === "object" && raw.version === 1) {
+        this.index = {
+          version: 1,
+          resolve: raw.resolve ?? {},
+          list: raw.list ?? {}
+        };
+        return this.index;
+      }
+    } catch {
+    }
+    this.index = { version: 1, resolve: {}, list: {} };
+    return this.index;
+  }
+  writeIndex(idx) {
+    this.index = idx;
+    const p = this.indexPath();
+    const tmp = `${p}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    fs10.writeFileSync(tmp, JSON.stringify(idx, null, 2), "utf-8");
+    fs10.renameSync(tmp, p);
+  }
+};
+function filterKey(filter) {
+  if (!filter) return "__all__";
+  const keys = Object.keys(filter).sort();
+  const norm = {};
+  for (const k of keys) {
+    const v = filter[k];
+    if (v !== void 0) norm[k] = v;
+  }
+  return Object.keys(norm).length === 0 ? "__all__" : JSON.stringify(norm);
+}
+function sha256Hex(bytes) {
+  const h = crypto.createHash("sha256");
+  h.update(bytes);
+  return h.digest("hex");
+}
+
+// library/src/remote/remote-catalog-source.ts
+var TarballHashMismatchError = class extends Error {
+  constructor(expected, actual) {
+    super(`SHA256 mismatch: expected ${expected}, got ${actual}`);
+    this.expected = expected;
+    this.actual = actual;
+    this.name = "TarballHashMismatchError";
+  }
+  expected;
+  actual;
+};
+var OfflineError = class extends Error {
+  constructor(message) {
+    super(`${message} (air-gapped mode; run \`skaile update\` to refresh the cache)`);
+    this.name = "OfflineError";
+  }
+};
+var CatalogHttpError = class extends Error {
+  constructor(message, status, url) {
+    super(message);
+    this.status = status;
+    this.url = url;
+    this.name = "CatalogHttpError";
+  }
+  status;
+  url;
+};
+var DEFAULT_TTL_MS = 864e5;
+var RemoteCatalogSource = class {
+  id;
+  baseUrl;
+  cache;
+  cacheTtlMs;
+  httpClient;
+  silentBackgroundErrors;
+  /** Tracks in-flight background revalidations so callers can `await` them in tests. */
+  inFlight = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.id = `remote:${this.baseUrl}`;
+    this.cacheTtlMs = opts.cacheTtlMs ?? DEFAULT_TTL_MS;
+    this.httpClient = opts.httpClient ?? defaultFetch;
+    this.silentBackgroundErrors = opts.silentBackgroundErrors ?? false;
+    this.cache = opts.cache ?? new CatalogCache({
+      dir: opts.cacheDir,
+      ttlMs: this.cacheTtlMs,
+      now: opts.now
+    });
+  }
+  // ── ICatalogSource ──────────────────────────────────────────────────────
+  /**
+   * Resolve a single asset by canonical ref (`<publisher>/<name>@<version>`).
+   *
+   * Cache: hit returns immediately. Miss fetches `/trpc/catalog.get`. Stale
+   * entry serves the cached value and triggers a background refresh.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   */
+  async resolve(ref) {
+    const fresh = this.cache.getResolve(ref);
+    if (fresh) return fresh.value;
+    if (this.cache.airGapped) {
+      const stale2 = this.cache.getResolveStale(ref);
+      if (stale2) return stale2.value;
+      throw new OfflineError(`Asset '${ref}' not in cache`);
+    }
+    const stale = this.cache.getResolveStale(ref);
+    if (stale) {
+      this.scheduleBackground(`resolve:${ref}`, () => this.fetchAndStoreResolve(ref));
+      return stale.value;
+    }
+    return this.fetchAndStoreResolve(ref);
+  }
+  /**
+   * List assets matching `filter`.
+   *
+   * Cache: hit returns immediately. Miss fetches `/trpc/catalog.list`. Stale
+   * entry serves the cached array and triggers a background refresh.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   */
+  async listAssets(filter) {
+    const fresh = this.cache.getList(filter);
+    if (fresh) return fresh.items;
+    if (this.cache.airGapped) {
+      const stale2 = this.cache.getListStale(filter);
+      if (stale2) return stale2.items;
+      throw new OfflineError("Catalog list not in cache");
+    }
+    const stale = this.cache.getListStale(filter);
+    if (stale) {
+      const filterKey2 = JSON.stringify(filter ?? null);
+      this.scheduleBackground(`list:${filterKey2}`, () => this.fetchAndStoreList(filter));
+      return stale.items;
+    }
+    return this.fetchAndStoreList(filter);
+  }
+  /**
+   * Fetch the content-addressed tarball for an asset. The bytes are downloaded
+   * via the REST endpoint `GET /tarball/:sha256` (which 307-redirects to the
+   * storage tier), then verified against `sha256` on the client side.
+   *
+   * Cache: tarballs are content-addressed and cached forever once written.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   *
+   * @throws {@link TarballHashMismatchError} when the downloaded SHA256 does not match.
+   */
+  async fetchTarball(_ref, sha256) {
+    const cached = this.cache.readTarball(sha256);
+    if (cached) {
+      const actual2 = sha256Hex(cached);
+      if (actual2 !== sha256) {
+        throw new TarballHashMismatchError(sha256, actual2);
+      }
+      return cached;
+    }
+    if (this.cache.airGapped) {
+      throw new OfflineError(`Tarball '${sha256}' not in cache`);
+    }
+    const url = `${this.baseUrl}/tarball/${encodeURIComponent(sha256)}`;
+    const res = await this.httpClient(url, { method: "GET", redirect: "follow" });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `Failed to fetch tarball ${sha256}: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
+    }
+    const buf = new Uint8Array(await res.arrayBuffer());
+    const actual = sha256Hex(buf);
+    if (actual !== sha256) {
+      throw new TarballHashMismatchError(sha256, actual);
+    }
+    this.cache.writeTarball(sha256, buf);
+    return buf;
+  }
+  /**
+   * Single synthetic Source pointing at the configured Catalog URL. Phase 2
+   * is single-Source per spec; multi-source federation is Phase 4.8.
+   */
+  async listSources() {
+    return [{ id: this.id, type: "remote-catalog", url: this.baseUrl }];
+  }
+  // ── extension API ───────────────────────────────────────────────────────
+  /**
+   * Force a metadata-cache refresh. Wipes all resolve/list entries and
+   * re-fetches `listAssets()` (no filter) to pre-warm the canonical query.
+   *
+   * Driven by `skaile update`. Tarballs (content-addressed) are not touched
+   * — they remain valid across refreshes.
+   *
+   * In air-gapped mode this method **does** make a network call (bypassing
+   * the TTL=0 gate); it is the only way to repopulate the cache.
+   */
+  async refresh() {
+    this.cache.invalidateAll();
+    const items = await this.fetchListNetwork(void 0);
+    this.cache.setList(void 0, items);
+    for (const item of items) {
+      this.cache.setResolve(item.id, item);
+    }
+    return { assetsCached: items.length };
+  }
+  /**
+   * Wait for any in-flight stale-while-revalidate background fetches to settle.
+   * Test-only escape hatch.
+   */
+  async waitForBackground() {
+    const promises = Array.from(this.inFlight.values());
+    await Promise.allSettled(promises);
+  }
+  // ── private ─────────────────────────────────────────────────────────────
+  scheduleBackground(key, fn) {
+    if (this.inFlight.has(key)) return;
+    const p = (async () => {
+      try {
+        await fn();
+      } catch (err) {
+        if (!this.silentBackgroundErrors) {
+          process.stderr.write(
+            `[skaile/catalog] Background refresh failed for ${key}: ${err instanceof Error ? err.message : String(err)}
+`
+          );
+        }
+      } finally {
+        this.inFlight.delete(key);
+      }
+    })();
+    this.inFlight.set(key, p);
+  }
+  async fetchAndStoreResolve(ref) {
+    const value = await this.fetchResolveNetwork(ref);
+    this.cache.setResolve(ref, value);
+    return value;
+  }
+  async fetchAndStoreList(filter) {
+    const items = await this.fetchListNetwork(filter);
+    this.cache.setList(filter, items);
+    return items;
+  }
+  /** Raw network call: GET /trpc/catalog.get?input=<superjson> */
+  async fetchResolveNetwork(ref) {
+    const url = trpcGetUrl(this.baseUrl, "catalog.get", { ref });
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog.get ${ref} failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
+    }
+    const data = await parseTrpcGet(res);
+    if (data === null || data === void 0) return null;
+    return normalizeCatalogAsset(data);
+  }
+  /** Raw network call: GET /trpc/catalog.list?input=<superjson> */
+  async fetchListNetwork(filter) {
+    const input = filter ? { filter } : {};
+    const url = trpcGetUrl(this.baseUrl, "catalog.list", input);
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog.list failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
+    }
+    const data = await parseTrpcGet(res);
+    if (!Array.isArray(data)) {
+      throw new CatalogHttpError(
+        `catalog.list returned non-array payload (got ${typeof data})`,
+        200,
+        url
+      );
+    }
+    return data.map(normalizeCatalogAsset);
+  }
+};
+function trpcGetUrl(baseUrl, procedure, input) {
+  const wrapped = JSON.stringify({ json: input });
+  return `${baseUrl.replace(/\/+$/, "")}/trpc/${procedure}?input=${encodeURIComponent(wrapped)}`;
+}
+async function parseTrpcGet(res) {
+  const text2 = await res.text();
+  let body;
+  try {
+    body = text2.length > 0 ? JSON.parse(text2) : null;
+  } catch {
+    throw new CatalogHttpError(
+      `tRPC response is not valid JSON: ${text2.slice(0, 200)}`,
+      res.status
+    );
+  }
+  if (body && typeof body === "object" && "error" in body) {
+    const err = body.error;
+    throw new CatalogHttpError(
+      `tRPC error: ${err.message ?? "unknown"}${err.data?.code ? ` (${err.data.code})` : ""}`,
+      res.status
+    );
+  }
+  const result = body?.result;
+  if (!result || !("data" in result)) {
+    throw new CatalogHttpError(`tRPC response missing result.data envelope`, res.status);
+  }
+  const data = result.data;
+  if (data && typeof data === "object" && !Array.isArray(data) && "json" in data) {
+    return data.json;
+  }
+  return data;
+}
+function normalizeCatalogAsset(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new CatalogHttpError("Catalog response item is not an object", 200);
+  }
+  const r = raw;
+  const publisher = pickString(r, "publisher") ?? pickString(r, "publisherSlug") ?? "";
+  const name = pickString(r, "name") ?? "";
+  const version = pickString(r, "version") ?? "";
+  const id = pickString(r, "id") ?? `${publisher}/${name}@${version}`;
+  const kind = pickString(r, "kind") ?? "";
+  const manifest = typeof r.manifest === "object" && r.manifest !== null ? r.manifest : typeof r.manifestJson === "object" && r.manifestJson !== null ? r.manifestJson : {};
+  const asset = {
+    id,
+    kind,
+    publisher,
+    name,
+    version,
+    manifest
+  };
+  const sha = pickString(r, "sha256") ?? pickString(r, "tarballSha256");
+  if (sha) asset.sha256 = sha;
+  const description = pickString(r, "description");
+  if (description) asset.description = description;
+  const license = pickString(r, "license");
+  if (license) asset.license = license;
+  const category = pickString(r, "category");
+  if (category) asset.category = category;
+  return asset;
+}
+function pickString(r, key) {
+  const v = r[key];
+  return typeof v === "string" ? v : void 0;
+}
+var defaultFetch = async (url, init) => {
+  if (typeof fetch === "undefined") {
+    throw new Error("global fetch is not available; pass an httpClient explicitly");
+  }
+  return fetch(url, init);
+};
+
+// library/src/remote/rest-catalog-source.ts
+var DEFAULT_TTL_MS2 = 864e5;
+var RestCatalogSource = class {
+  id;
+  baseUrl;
+  cache;
+  cacheTtlMs;
+  httpClient;
+  silentBackgroundErrors;
+  /** Tracks in-flight background revalidations so callers can `await` them in tests. */
+  inFlight = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.id = `rest:${this.baseUrl}`;
+    this.cacheTtlMs = opts.cacheTtlMs ?? DEFAULT_TTL_MS2;
+    this.httpClient = opts.httpClient ?? defaultFetch2;
+    this.silentBackgroundErrors = opts.silentBackgroundErrors ?? false;
+    this.cache = opts.cache ?? new CatalogCache({
+      dir: opts.cacheDir,
+      ttlMs: this.cacheTtlMs,
+      now: opts.now
+    });
+  }
+  // ── ICatalogSource ──────────────────────────────────────────────────────
+  /**
+   * Resolve a single asset by canonical ref (`<publisher>/<name>@<version>`).
+   *
+   * Cache: hit returns immediately. Miss fetches `/api/catalog/get?ref=<ref>`. Stale
+   * entry serves the cached value and triggers a background refresh.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   */
+  async resolve(ref) {
+    const fresh = this.cache.getResolve(ref);
+    if (fresh) return fresh.value;
+    if (this.cache.airGapped) {
+      const stale2 = this.cache.getResolveStale(ref);
+      if (stale2) return stale2.value;
+      throw new OfflineError(`Asset '${ref}' not in cache`);
+    }
+    const stale = this.cache.getResolveStale(ref);
+    if (stale) {
+      this.scheduleBackground(`resolve:${ref}`, () => this.fetchAndStoreResolve(ref));
+      return stale.value;
+    }
+    return this.fetchAndStoreResolve(ref);
+  }
+  /**
+   * List assets matching `filter`.
+   *
+   * Cache: hit returns immediately. Miss fetches `/api/catalog/list`. Stale
+   * entry serves the cached array and triggers a background refresh.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   *
+   * Note: `filter.prefix` is not supported by the forge-store REST API and is silently ignored.
+   */
+  async listAssets(filter) {
+    const fresh = this.cache.getList(filter);
+    if (fresh) return fresh.items;
+    if (this.cache.airGapped) {
+      const stale2 = this.cache.getListStale(filter);
+      if (stale2) return stale2.items;
+      throw new OfflineError("Catalog list not in cache");
+    }
+    const stale = this.cache.getListStale(filter);
+    if (stale) {
+      const filterKey2 = JSON.stringify(filter ?? null);
+      this.scheduleBackground(`list:${filterKey2}`, () => this.fetchAndStoreList(filter));
+      return stale.items;
+    }
+    return this.fetchAndStoreList(filter);
+  }
+  /**
+   * Fetch the content-addressed tarball for an asset.
+   *
+   * Steps:
+   * 1. `GET /api/tarball/manifest?sha256=<sha256>` → JSON with `{ url, ... }`
+   * 2. `GET <manifest.url>` following redirects → raw bytes
+   * 3. Verify SHA256 client-side — hard fail on mismatch
+   * 4. Write to cache on success
+   *
+   * Cache: tarballs are content-addressed and cached forever once written.
+   *
+   * Air-gapped: throws {@link OfflineError} on cache miss.
+   *
+   * @throws {@link TarballHashMismatchError} when the downloaded SHA256 does not match.
+   */
+  async fetchTarball(_ref, sha256) {
+    const cached = this.cache.readTarball(sha256);
+    if (cached) {
+      const actual2 = sha256Hex(cached);
+      if (actual2 !== sha256) {
+        throw new TarballHashMismatchError(sha256, actual2);
+      }
+      return cached;
+    }
+    if (this.cache.airGapped) {
+      throw new OfflineError(`Tarball '${sha256}' not in cache`);
+    }
+    const manifestUrl = `${this.baseUrl}/api/tarball/manifest?sha256=${encodeURIComponent(sha256)}`;
+    const manifestRes = await this.httpClient(manifestUrl, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!manifestRes.ok) {
+      throw new CatalogHttpError(
+        `Failed to fetch tarball manifest for ${sha256}: ${manifestRes.status} ${manifestRes.statusText}`,
+        manifestRes.status,
+        manifestUrl
+      );
+    }
+    const manifestText = await manifestRes.text();
+    let manifest;
+    try {
+      manifest = JSON.parse(manifestText);
+    } catch {
+      throw new CatalogHttpError(
+        `Tarball manifest response is not valid JSON: ${manifestText.slice(0, 200)}`,
+        manifestRes.status,
+        manifestUrl
+      );
+    }
+    const downloadUrl = manifest && typeof manifest === "object" && "url" in manifest ? manifest.url : void 0;
+    if (typeof downloadUrl !== "string") {
+      throw new CatalogHttpError(
+        `Tarball manifest missing 'url' field`,
+        manifestRes.status,
+        manifestUrl
+      );
+    }
+    const tarballRes = await this.httpClient(downloadUrl, { method: "GET", redirect: "follow" });
+    if (!tarballRes.ok) {
+      throw new CatalogHttpError(
+        `Failed to fetch tarball ${sha256}: ${tarballRes.status} ${tarballRes.statusText}`,
+        tarballRes.status,
+        downloadUrl
+      );
+    }
+    const buf = new Uint8Array(await tarballRes.arrayBuffer());
+    const actual = sha256Hex(buf);
+    if (actual !== sha256) {
+      throw new TarballHashMismatchError(sha256, actual);
+    }
+    this.cache.writeTarball(sha256, buf);
+    return buf;
+  }
+  /**
+   * Single synthetic Source pointing at the configured forge-store URL.
+   */
+  async listSources() {
+    return [{ id: this.id, type: "rest-catalog", url: this.baseUrl }];
+  }
+  // ── extension API ───────────────────────────────────────────────────────
+  /**
+   * Force a metadata-cache refresh. Wipes all resolve/list entries and
+   * re-fetches `listAssets()` (no filter) to pre-warm the canonical query.
+   *
+   * Driven by `skaile update`. Tarballs (content-addressed) are not touched.
+   *
+   * In air-gapped mode this method **does** make a network call (bypassing
+   * the TTL=0 gate); it is the only way to repopulate the cache.
+   */
+  async refresh() {
+    this.cache.invalidateAll();
+    const items = await this.fetchListNetwork(void 0);
+    this.cache.setList(void 0, items);
+    for (const item of items) {
+      this.cache.setResolve(item.id, item);
+    }
+    return { assetsCached: items.length };
+  }
+  /**
+   * Wait for any in-flight stale-while-revalidate background fetches to settle.
+   * Test-only escape hatch.
+   */
+  async waitForBackground() {
+    const promises = Array.from(this.inFlight.values());
+    await Promise.allSettled(promises);
+  }
+  // ── private ─────────────────────────────────────────────────────────────
+  scheduleBackground(key, fn) {
+    if (this.inFlight.has(key)) return;
+    const p = (async () => {
+      try {
+        await fn();
+      } catch (err) {
+        if (!this.silentBackgroundErrors) {
+          process.stderr.write(
+            `[skaile/catalog] Background refresh failed for ${key}: ${err instanceof Error ? err.message : String(err)}
+`
+          );
+        }
+      } finally {
+        this.inFlight.delete(key);
+      }
+    })();
+    this.inFlight.set(key, p);
+  }
+  async fetchAndStoreResolve(ref) {
+    const value = await this.fetchResolveNetwork(ref);
+    this.cache.setResolve(ref, value);
+    return value;
+  }
+  async fetchAndStoreList(filter) {
+    const items = await this.fetchListNetwork(filter);
+    this.cache.setList(filter, items);
+    return items;
+  }
+  /** Raw network call: GET /api/catalog/get?ref=<ref> */
+  async fetchResolveNetwork(ref) {
+    const url = `${this.baseUrl}/api/catalog/get?ref=${encodeURIComponent(ref)}`;
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog/get ${ref} failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
+    }
+    const data = await parseRestResponse(res, url);
+    if (data === null || data === void 0) return null;
+    return normalizeRestAsset(data);
+  }
+  /** Raw network call: GET /api/catalog/list?publisher=&kind=&category= */
+  async fetchListNetwork(filter) {
+    const params = new URLSearchParams();
+    if (filter?.publisher) params.set("publisher", filter.publisher);
+    if (filter?.kind) params.set("kind", filter.kind);
+    const qs = params.toString();
+    const url = `${this.baseUrl}/api/catalog/list${qs ? `?${qs}` : ""}`;
+    const res = await this.httpClient(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new CatalogHttpError(
+        `catalog/list failed: ${res.status} ${res.statusText}`,
+        res.status,
+        url
+      );
+    }
+    const data = await parseRestResponse(res, url);
+    if (!Array.isArray(data)) {
+      throw new CatalogHttpError(
+        `catalog/list returned non-array payload (got ${typeof data})`,
+        200,
+        url
+      );
+    }
+    return data.map(normalizeRestAsset);
+  }
+};
+async function parseRestResponse(res, url) {
+  const text2 = await res.text();
+  if (text2.length === 0) return null;
+  try {
+    return JSON.parse(text2);
+  } catch {
+    throw new CatalogHttpError(
+      `REST response is not valid JSON: ${text2.slice(0, 200)}`,
+      res.status,
+      url
+    );
+  }
+}
+function normalizeRestAsset(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new CatalogHttpError("Catalog REST response item is not an object", 200);
+  }
+  const r = raw;
+  const publisher = pickString2(r, "publisherNamespace") ?? pickString2(r, "publisher") ?? "";
+  const name = pickString2(r, "name") ?? "";
+  const version = pickString2(r, "version") ?? "";
+  const kind = pickString2(r, "kind") ?? "";
+  const id = `${publisher}/${name}@${version}`;
+  const requiresParsed = tryParseJson(pickString2(r, "requiresJson"));
+  const filesParsed = tryParseJson(pickString2(r, "filesJson"));
+  const manifest = { ...requiresParsed, ...filesParsed };
+  const asset = {
+    id,
+    kind,
+    publisher,
+    name,
+    version,
+    manifest
+  };
+  const sha = pickString2(r, "sha256");
+  if (sha) asset.sha256 = sha;
+  const description = pickString2(r, "description");
+  if (description) asset.description = description;
+  const license = pickString2(r, "license");
+  if (license) asset.license = license;
+  const category = pickString2(r, "category");
+  if (category) asset.category = category;
+  return asset;
+}
+function pickString2(r, key) {
+  const v = r[key];
+  return typeof v === "string" ? v : void 0;
+}
+function tryParseJson(s) {
+  if (!s) return {};
+  try {
+    const parsed = JSON.parse(s);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+  }
+  return {};
+}
+var defaultFetch2 = async (url, init) => {
+  if (typeof fetch === "undefined") {
+    throw new Error("global fetch is not available; pass an httpClient explicitly");
+  }
+  return fetch(url, init);
+};
+var KnowledgeManifestSchema = z2.object({
+  name: z2.string().optional(),
+  description: z2.string().optional(),
+  version: z2.string().optional(),
+  files: z2.array(z2.string()).optional(),
+  keywords: z2.array(z2.string()).optional(),
+  license: z2.string().optional()
+}).passthrough();
+function validateKnowledge(data) {
+  const result = KnowledgeManifestSchema.safeParse(data);
+  if (result.success) {
+    return { ok: true, data: result.data };
+  }
+  return {
+    ok: false,
+    errors: result.error.issues.map((issue) => ({
+      path: issue.path.join("."),
+      message: issue.message
+    }))
+  };
+}
+function collectDirRecursive(baseDir, relativeDir) {
+  const full = path5.join(baseDir, relativeDir);
+  if (!fs10.existsSync(full) || !fs10.statSync(full).isDirectory()) return [];
+  const results = [];
+  for (const entry of fs10.readdirSync(full, { withFileTypes: true })) {
+    const rel = path5.posix.join(relativeDir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...collectDirRecursive(baseDir, rel));
+    } else if (entry.isFile()) {
+      results.push(rel);
+    }
+  }
+  return results;
+}
+var knowledgeKindProvider = {
+  kind: "knowledge",
+  displayName: "Knowledge",
+  providerVersion: "1.0.0",
+  discoveryPatterns: ["**/knowledge.yaml", "**/knowledge/index.yaml"],
+  matchesPath(relativePath) {
+    const parts = relativePath.split("/");
+    const filename = parts[parts.length - 1] ?? "";
+    if (filename === "knowledge.yaml") return true;
+    if (filename === "index.yaml" && parts.length >= 2 && parts[parts.length - 2] === "knowledge") {
+      return true;
+    }
+    return false;
+  },
+  validateManifest(data) {
+    return validateKnowledge(data);
+  },
+  defaultFileFilter(manifestPath) {
+    const dir = path5.dirname(manifestPath);
+    const manifestName = path5.basename(manifestPath);
+    const files = [manifestName];
+    files.push(...collectDirRecursive(dir, "documents"));
+    files.sort();
+    return { assetRoot: dir, files };
+  }
+  // Knowledge has no cross-asset dependency edges — omit extractRequires
+};
+function parsePreset(data) {
+  const zodResult = PresetManifestSchema.safeParse(data);
+  if (!zodResult.success) {
+    return {
+      ok: false,
+      errors: zodResult.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`)
+    };
+  }
+  const preset = zodResult.data;
+  const errors = [];
+  const ids = /* @__PURE__ */ new Set();
+  const refCounts = /* @__PURE__ */ new Map();
+  for (const item of preset.items) {
+    if (item.id) {
+      if (ids.has(item.id)) {
+        errors.push(`Duplicate item id: "${item.id}"`);
+      }
+      ids.add(item.id);
+    } else {
+      refCounts.set(item.ref, (refCounts.get(item.ref) ?? 0) + 1);
+    }
+  }
+  for (const [ref, count] of refCounts) {
+    if (count > 1) {
+      errors.push(
+        `${count} items share ref "${ref}" without distinct "id" fields \u2014 upgrade matching will be ambiguous`
+      );
+    }
+  }
+  for (const item of preset.items) {
+    if (item.composes) {
+      for (const compose of item.composes) {
+        if (compose.ref.startsWith("#")) {
+          const targetId = compose.ref.slice(1);
+          if (!ids.has(targetId)) {
+            errors.push(
+              `Cross-item ref "${compose.ref}" in item "${item.id ?? item.ref}" references undeclared id "${targetId}"`
+            );
+          }
+        }
+      }
+    }
+  }
+  for (const item of preset.items) {
+    if (item.placeholders) {
+      const keys = /* @__PURE__ */ new Set();
+      for (const ph of item.placeholders) {
+        if (keys.has(ph.key)) {
+          errors.push(`Duplicate placeholder key "${ph.key}" in item "${item.id ?? item.ref}"`);
+        }
+        keys.add(ph.key);
+        if (ph.type === "enum" && (!ph.values || ph.values.length === 0)) {
+          errors.push(`Placeholder "${ph.key}" has type "enum" but no values defined`);
+        }
+      }
+    }
+  }
+  if (errors.length > 0) {
+    return { ok: false, preset, errors };
+  }
+  return { ok: true, preset, errors: [] };
+}
+function parsePresetYaml(yamlContent) {
+  let data;
+  try {
+    data = parse(yamlContent);
+  } catch (err) {
+    return {
+      ok: false,
+      errors: [`YAML parse error: ${err instanceof Error ? err.message : String(err)}`]
+    };
+  }
+  return parsePreset(data);
+}
+function detectNestedPresetRefs(preset, knownPresetRefs) {
+  const nested = [];
+  for (const item of preset.items) {
+    if (item.ref.startsWith("library://") || item.ref.startsWith("#")) continue;
+    if (knownPresetRefs?.has(item.ref)) {
+      nested.push(item.ref);
+    }
+  }
+  return nested;
+}
+function validateNestingDepth(presetRef, currentDepth) {
+  const MAX_DEPTH = 3;
+  if (currentDepth >= MAX_DEPTH) {
+    return `Preset "${presetRef}" exceeds maximum nesting depth (${MAX_DEPTH} levels allowed, depth ${currentDepth} reached)`;
+  }
+  return void 0;
+}
+
+// library/src/preset/resolve-item.ts
+function classifyRef(ref) {
+  if (ref.startsWith("library://")) return "library-instance";
+  if (ref.startsWith("#")) return "cross-item";
+  return "asset";
+}
+function extractLibraryInstanceId(ref) {
+  const match = ref.match(/^library:\/\/[^/]+\/instances\/([a-f0-9-]+)$/i);
+  return match ? match[1] : null;
+}
+async function resolveItem(item, library, knownPresetRefs) {
+  const ref = item.ref;
+  if (ref.startsWith("#")) {
+    return { kind: "cross-item", item, targetId: ref.slice(1) };
+  }
+  if (ref.startsWith("library://")) {
+    const instanceId = extractLibraryInstanceId(ref);
+    if (!instanceId) {
+      return { kind: "library-instance", item, instanceId: "", instance: null };
+    }
+    const instance = await library.getInstance(instanceId);
+    return { kind: "library-instance", item, instanceId, instance };
+  }
+  if (knownPresetRefs?.has(ref)) {
+    return { kind: "nested-preset", item, presetRef: ref };
+  }
+  const assetDef = await library.getAssetDef(ref);
+  return { kind: "asset", item, defRef: ref, assetDef };
+}
+async function resolveAllItems(items, library, knownPresetRefs) {
+  return Promise.all(items.map((item) => resolveItem(item, library, knownPresetRefs)));
+}
+
+// library/src/preset/placeholders.ts
+function validatePlaceholder(placeholder, value) {
+  const { key, type = "text", required } = placeholder;
+  if (value === void 0 || value === null || value === "") {
+    if (placeholder.default !== void 0) {
+      return { valid: true, errors: [], value: placeholder.default };
+    }
+    if (required === true || required === void 0) {
+      return { valid: false, errors: [`Placeholder "${key}" is required`] };
+    }
+    return { valid: true, errors: [], value: void 0 };
+  }
+  switch (type) {
+    case "text":
+      return validateText(key, value);
+    case "multiline":
+      return validateMultiline(key, value);
+    case "secret":
+      return validateSecret(key, value);
+    case "number":
+      return validateNumber(key, value);
+    case "boolean":
+      return validateBoolean(key, value);
+    case "enum":
+      return validateEnum(key, value, placeholder.values);
+    case "oauth":
+      return validateOauth(key, value);
+    case "instance-picker":
+      return validateInstancePicker(key, value);
+  }
+}
+function validateAllPlaceholders(placeholders, inputs) {
+  const values = {};
+  const errors = [];
+  for (const ph of placeholders) {
+    const result = validatePlaceholder(ph, inputs[ph.key]);
+    if (!result.valid) {
+      errors.push(...result.errors);
+    } else if (result.value !== void 0) {
+      values[ph.key] = result.value;
+    }
+  }
+  return { valid: errors.length === 0, values, errors };
+}
+async function queryInstancePickerChoices(library, options) {
+  const filter = {};
+  if (options?.defRefPrefix) {
+    filter.defRef = options.defRefPrefix;
+  }
+  const instances2 = await library.listInstances(filter);
+  return instances2.map((inst) => ({
+    instanceId: inst.id,
+    defRef: inst.defRef,
+    label: `${inst.defRef} (${inst.id.slice(0, 8)})`
+  }));
+}
+function getDefaultValue(placeholder) {
+  return placeholder.default;
+}
+function isSecretPlaceholder(placeholder) {
+  return placeholder.type === "secret" || placeholder.type === "oauth";
+}
+function validateText(key, value) {
+  if (typeof value !== "string") {
+    return { valid: false, errors: [`Placeholder "${key}" must be a string`] };
+  }
+  return { valid: true, errors: [], value };
+}
+function validateMultiline(key, value) {
+  if (typeof value !== "string") {
+    return { valid: false, errors: [`Placeholder "${key}" must be a string`] };
+  }
+  return { valid: true, errors: [], value };
+}
+function validateSecret(key, value) {
+  if (typeof value !== "string") {
+    return { valid: false, errors: [`Placeholder "${key}" must be a string`] };
+  }
+  if (value.length === 0) {
+    return { valid: false, errors: [`Placeholder "${key}" (secret) cannot be empty`] };
+  }
+  return { valid: true, errors: [], value };
+}
+function validateNumber(key, value) {
+  if (typeof value === "number" && !Number.isNaN(value)) {
+    return { valid: true, errors: [], value };
+  }
+  if (typeof value === "string") {
+    const parsed = Number(value);
+    if (!Number.isNaN(parsed)) {
+      return { valid: true, errors: [], value: parsed };
+    }
+  }
+  return { valid: false, errors: [`Placeholder "${key}" must be a valid number`] };
+}
+function validateBoolean(key, value) {
+  if (typeof value === "boolean") {
+    return { valid: true, errors: [], value };
+  }
+  if (typeof value === "string") {
+    const lower = value.toLowerCase();
+    if (lower === "true" || lower === "1" || lower === "yes") {
+      return { valid: true, errors: [], value: true };
+    }
+    if (lower === "false" || lower === "0" || lower === "no") {
+      return { valid: true, errors: [], value: false };
+    }
+  }
+  return { valid: false, errors: [`Placeholder "${key}" must be a boolean`] };
+}
+function validateEnum(key, value, allowedValues) {
+  if (!allowedValues || allowedValues.length === 0) {
+    return { valid: false, errors: [`Placeholder "${key}" (enum) has no allowed values defined`] };
+  }
+  const stringValue = String(value);
+  const matches = allowedValues.some((v) => String(v) === stringValue);
+  if (!matches) {
+    return {
+      valid: false,
+      errors: [
+        `Placeholder "${key}" value "${stringValue}" is not in allowed values: [${allowedValues.join(", ")}]`
+      ]
+    };
+  }
+  const matched = allowedValues.find((v) => String(v) === stringValue);
+  return { valid: true, errors: [], value: matched };
+}
+function validateOauth(key, value) {
+  if (typeof value !== "string") {
+    return { valid: false, errors: [`Placeholder "${key}" (oauth) must be a string`] };
+  }
+  if (value.length === 0) {
+    return { valid: false, errors: [`Placeholder "${key}" (oauth) cannot be empty`] };
+  }
+  return { valid: true, errors: [], value };
+}
+function validateInstancePicker(key, value) {
+  if (typeof value !== "string") {
+    return {
+      valid: false,
+      errors: [`Placeholder "${key}" (instance-picker) must be a string UUID`]
+    };
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuidPattern.test(value)) {
+    return {
+      valid: false,
+      errors: [`Placeholder "${key}" (instance-picker) must be a valid UUID`]
+    };
+  }
+  return { valid: true, errors: [], value };
+}
+
+// library/src/preset/interpolate.ts
+var InterpolationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InterpolationError";
+  }
+};
+function interpolate(materialize, baseConfig, context, credentialRefPrefix) {
+  const config = { ...baseConfig ?? {} };
+  const secretsToStore = [];
+  let credentialRef;
+  if (!materialize) {
+    for (const [key, value] of Object.entries(context.inputs)) {
+      config[key] = value;
+    }
+    if (Object.keys(context.secrets).length > 0) {
+      credentialRef = `${credentialRefPrefix}/creds`;
+      for (const [key, value] of Object.entries(context.secrets)) {
+        secretsToStore.push({ ref: `${credentialRef}/${key}`, value });
+      }
+    }
+    return { config, credentialRef, secretsToStore };
+  }
+  for (const [configPath, template] of Object.entries(materialize)) {
+    const resolved = resolveTemplate(template, context);
+    if (resolved.hasSecret) {
+      if (!credentialRef) {
+        credentialRef = `${credentialRefPrefix}/creds`;
+      }
+      const secretRef = `${credentialRef}/${configPath}`;
+      secretsToStore.push({ ref: secretRef, value: resolved.value });
+      setNestedValue(config, configPath, `secret://${secretRef}`);
+    } else {
+      setNestedValue(config, configPath, resolved.value);
+    }
+  }
+  return { config, credentialRef, secretsToStore };
+}
+async function storeSecrets(router, secretsToStore) {
+  for (const { ref, value } of secretsToStore) {
+    const encoded = new TextEncoder().encode(value);
+    await router.setSecret(ref, encoded);
+  }
+}
+function hasInterpolationTokens(template) {
+  return INTERPOLATION_PATTERN.test(template);
+}
+function extractReferencedKeys(materialize) {
+  const inputKeys = /* @__PURE__ */ new Set();
+  const secretKeys = /* @__PURE__ */ new Set();
+  for (const template of Object.values(materialize)) {
+    const pattern = new RegExp(INTERPOLATION_PATTERN.source, "g");
+    for (const match of template.matchAll(pattern)) {
+      const namespace = match[1];
+      const key = match[2];
+      if (namespace === "INPUT") inputKeys.add(key);
+      else if (namespace === "SECRET") secretKeys.add(key);
+    }
+  }
+  return { inputKeys: [...inputKeys], secretKeys: [...secretKeys] };
+}
+var INTERPOLATION_PATTERN = /\$\{(INPUT|SECRET):([^}]+)\}/;
+function resolveTemplate(template, context) {
+  const singleMatch = template.match(/^\$\{(INPUT|SECRET):([^}]+)\}$/);
+  if (singleMatch) {
+    const [, namespace, key] = singleMatch;
+    if (namespace === "SECRET") {
+      if (!(key in context.secrets)) {
+        throw new InterpolationError(`Missing secret key "${key}" in interpolation context`);
+      }
+      return { value: context.secrets[key], hasSecret: true };
+    }
+    if (!(key in context.inputs)) {
+      throw new InterpolationError(`Missing input key "${key}" in interpolation context`);
+    }
+    return { value: context.inputs[key], hasSecret: false };
+  }
+  const tokens = [...template.matchAll(/\$\{(INPUT|SECRET):([^}]+)\}/g)];
+  const hasSecretToken = tokens.some(([, ns]) => ns === "SECRET");
+  if (hasSecretToken) {
+    throw new InterpolationError(
+      `Template "${template}" mixes \${SECRET:...} with other tokens. SECRET must be the sole token in a template value.`
+    );
+  }
+  const result = template.replace(/\$\{INPUT:([^}]+)\}/g, (_, key) => {
+    if (!(key in context.inputs)) {
+      throw new InterpolationError(`Missing input key "${key}" in interpolation context`);
+    }
+    return String(context.inputs[key] ?? "");
+  });
+  return { value: result, hasSecret: false };
+}
+function setNestedValue(obj, path13, value) {
+  const parts = path13.split(".");
+  let current = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const key = parts[i];
+    if (current[key] === void 0 || current[key] === null || typeof current[key] !== "object") {
+      current[key] = {};
+    }
+    current = current[key];
+  }
+  current[parts[parts.length - 1]] = value;
+}
+
+// library/src/preset/apply.ts
+async function applyPreset(presetRef, manifest, inputs, opts) {
+  const depth = opts._depth ?? 0;
+  const pinPolicy = opts.pinPolicy ?? "minor-track";
+  const depthError = validateNestingDepth(presetRef, depth);
+  if (depthError) {
+    return { instances: [], subscriptions: [], errors: [depthError] };
+  }
+  const result = { instances: [], subscriptions: [], errors: [] };
+  const itemResults = /* @__PURE__ */ new Map();
+  for (const item of manifest.items) {
+    const itemResult = await applyItemImpl(
+      presetRef,
+      item,
+      inputs,
+      opts,
+      depth,
+      pinPolicy,
+      itemResults
+    );
+    result.errors.push(...itemResult.errors);
+    for (const inst of itemResult.instances) {
+      result.instances.push(inst);
+      if (item.id && itemResult.instances.length > 0) {
+        itemResults.set(item.id, itemResult.instances[0]);
+      }
+    }
+    result.subscriptions.push(...itemResult.subscriptions);
+  }
+  return result;
+}
+async function applyPresetFromData(presetRef, data, inputs, opts) {
+  const parseResult = parsePreset(data);
+  if (!parseResult.ok || !parseResult.preset) {
+    return {
+      instances: [],
+      subscriptions: [],
+      errors: parseResult.errors.map((e) => `Parse: ${e}`)
+    };
+  }
+  return applyPreset(presetRef, parseResult.preset, inputs, opts);
+}
+async function applyItemImpl(presetRef, item, inputs, opts, depth, pinPolicy, itemResults) {
+  const { library } = opts;
+  const resolved = await resolveItem(item, library, opts.knownPresetRefs);
+  switch (resolved.kind) {
+    case "cross-item": {
+      const target = itemResults.get(resolved.targetId);
+      if (!target) {
+        return {
+          instances: [],
+          subscriptions: [],
+          errors: [
+            `Cross-item ref "#${resolved.targetId}" not yet resolved (items must be ordered)`
+          ]
+        };
+      }
+      return { instances: [target], subscriptions: [], errors: [] };
+    }
+    case "library-instance": {
+      if (!resolved.instance) {
+        return {
+          instances: [],
+          subscriptions: [],
+          errors: [`Library instance "${resolved.instanceId}" not found`]
+        };
+      }
+      try {
+        const sub = await library.subscribe(opts.workspaceId, resolved.instanceId, pinPolicy);
+        return { instances: [resolved.instance], subscriptions: [sub], errors: [] };
+      } catch {
+        return { instances: [resolved.instance], subscriptions: [], errors: [] };
+      }
+    }
+    case "nested-preset": {
+      if (!opts.loadPreset) {
+        return {
+          instances: [],
+          subscriptions: [],
+          errors: [`Cannot resolve nested preset "${resolved.presetRef}" \u2014 no loader provided`]
+        };
+      }
+      const nestedData = await opts.loadPreset(resolved.presetRef);
+      if (!nestedData) {
+        return {
+          instances: [],
+          subscriptions: [],
+          errors: [`Nested preset "${resolved.presetRef}" not found`]
+        };
+      }
+      const parseResult = parsePreset(nestedData);
+      if (!parseResult.ok || !parseResult.preset) {
+        return { instances: [], subscriptions: [], errors: parseResult.errors };
+      }
+      const nestedInputs = {
+        ...item.inputs ?? {},
+        ...inputs
+      };
+      const nestedResult = await applyPreset(resolved.presetRef, parseResult.preset, nestedInputs, {
+        ...opts,
+        _depth: depth + 1
+      });
+      return {
+        instances: nestedResult.instances,
+        subscriptions: nestedResult.subscriptions,
+        errors: nestedResult.errors
+      };
+    }
+    case "asset": {
+      const itemInputs = { ...inputs };
+      let validatedValues = {};
+      const secretValues = {};
+      if (item.placeholders && item.placeholders.length > 0) {
+        const nonSecretPhs = item.placeholders.filter((ph) => !isSecretPlaceholder(ph));
+        const secretPhs = item.placeholders.filter((ph) => isSecretPlaceholder(ph));
+        const validation = validateAllPlaceholders(nonSecretPhs, itemInputs);
+        if (!validation.valid) {
+          return { instances: [], subscriptions: [], errors: validation.errors };
+        }
+        validatedValues = validation.values;
+        const secretValidation = validateAllPlaceholders(secretPhs, itemInputs);
+        if (!secretValidation.valid) {
+          return { instances: [], subscriptions: [], errors: secretValidation.errors };
+        }
+        for (const [key, value] of Object.entries(secretValidation.values)) {
+          secretValues[key] = String(value);
+        }
+      }
+      const credentialRefPrefix = `preset/${presetRef}/${item.id ?? resolved.defRef}`;
+      const context = {
+        inputs: validatedValues,
+        secrets: secretValues
+      };
+      const interpolated = interpolate(
+        item.materialize,
+        item.config,
+        context,
+        credentialRefPrefix
+      );
+      if (opts.secretsRouter && interpolated.secretsToStore.length > 0) {
+        try {
+          await storeSecrets(opts.secretsRouter, interpolated.secretsToStore);
+        } catch (err) {
+          return {
+            instances: [],
+            subscriptions: [],
+            errors: [
+              `Secret storage failed for "${item.ref}": ${err instanceof Error ? err.message : String(err)}`
+            ]
+          };
+        }
+      }
+      try {
+        const instance = await library.createInstance({
+          defRef: resolved.defRef,
+          defPin: pinPolicy,
+          config: interpolated.config,
+          credentialRef: interpolated.credentialRef,
+          createdBy: opts.createdBy ?? `preset:${presetRef}`
+        });
+        const subscriptions2 = [];
+        try {
+          const sub = await library.subscribe(opts.workspaceId, instance.id, pinPolicy);
+          subscriptions2.push(sub);
+        } catch {
+        }
+        return { instances: [instance], subscriptions: subscriptions2, errors: [] };
+      } catch (err) {
+        return {
+          instances: [],
+          subscriptions: [],
+          errors: [
+            `Instance creation failed for "${item.ref}": ${err instanceof Error ? err.message : String(err)}`
+          ]
+        };
+      }
+    }
+  }
+}
+
+// library/src/preset/upgrade.ts
+function detectChanges(oldManifest, newManifest) {
+  const oldItems = indexItems(oldManifest.items);
+  const newItems = indexItems(newManifest.items);
+  const addedItems = [];
+  const removedItems = [];
+  const changedRefItems = [];
+  const configChangedItems = [];
+  for (const [key, oldItem] of oldItems) {
+    if (!newItems.has(key)) {
+      removedItems.push(oldItem);
+    }
+  }
+  for (const [key, newItem] of newItems) {
+    if (!oldItems.has(key)) {
+      addedItems.push(newItem);
+    }
+  }
+  for (const [key, newItem] of newItems) {
+    const oldItem = oldItems.get(key);
+    if (!oldItem) continue;
+    if (oldItem.ref !== newItem.ref) {
+      changedRefItems.push({ old: oldItem, new: newItem });
+    } else if (!deepEqual(oldItem.placeholders, newItem.placeholders) || !deepEqual(oldItem.materialize, newItem.materialize)) {
+      changedRefItems.push({ old: oldItem, new: newItem });
+    } else if (!deepEqual(oldItem.config, newItem.config)) {
+      configChangedItems.push({ old: oldItem, new: newItem });
+    }
+  }
+  const isStructural = addedItems.length > 0 || removedItems.length > 0 || changedRefItems.length > 0;
+  const kind = isStructural ? "structural" : "non-structural";
+  const summaryParts = [];
+  if (addedItems.length > 0) summaryParts.push(`+${addedItems.length} items`);
+  if (removedItems.length > 0) summaryParts.push(`-${removedItems.length} items`);
+  if (changedRefItems.length > 0) summaryParts.push(`${changedRefItems.length} ref changes`);
+  if (configChangedItems.length > 0)
+    summaryParts.push(`${configChangedItems.length} config changes`);
+  const summary = summaryParts.length > 0 ? `${kind}: ${summaryParts.join(", ")}` : "no changes";
+  return {
+    kind,
+    addedItems,
+    removedItems,
+    changedRefItems,
+    configChangedItems,
+    summary
+  };
+}
+function evaluateUpgrade(oldManifest, newManifest) {
+  const diff = detectChanges(oldManifest, newManifest);
+  if (diff.kind === "non-structural") {
+    return { autoUpgradable: true, diff };
+  }
+  const requiredActions = [];
+  if (diff.addedItems.length > 0) {
+    requiredActions.push(
+      `Create ${diff.addedItems.length} new instance(s): ${diff.addedItems.map((i) => i.ref).join(", ")}`
+    );
+  }
+  if (diff.removedItems.length > 0) {
+    requiredActions.push(
+      `Remove ${diff.removedItems.length} instance(s): ${diff.removedItems.map((i) => i.ref).join(", ")}`
+    );
+  }
+  if (diff.changedRefItems.length > 0) {
+    requiredActions.push(`Replace ${diff.changedRefItems.length} instance(s) with new refs`);
+  }
+  return { autoUpgradable: false, diff, requiredActions };
+}
+async function applyNonStructuralUpgrade(newManifest, existingInstances, library) {
+  let updated = 0;
+  const errors = [];
+  for (const item of newManifest.items) {
+    const key = itemKey(item);
+    const instanceId = existingInstances.get(key);
+    if (!instanceId) continue;
+    if (item.config) {
+      try {
+        await library.updateInstance(instanceId, {
+          config: item.config
+        });
+        updated++;
+      } catch (err) {
+        errors.push(
+          `Failed to update instance "${instanceId}": ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  }
+  return { updated, errors };
+}
+function itemKey(item) {
+  return item.id ?? item.ref;
+}
+function indexItems(items) {
+  const map = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    map.set(itemKey(item), item);
+  }
+  return map;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === void 0 && b === void 0) return true;
+  if (a === null && b === null) return true;
+  if (a === void 0 || b === void 0) return false;
+  if (a === null || b === null) return false;
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+
+export { CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateLibraryNameError, DuplicateSubscriptionError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KNOWN_ASSET_KINDS, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LIBRARY_STRUCTURES, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalLibrary, LocalSyncDriver, LockFileSchema, LockSubscriptionSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, SidecarGit, SkaileConfigSchema, SourceNotFoundError, StoreSyncDriver, SubscriptionNotFoundError, TarballHashMismatchError, UserLibraryManager, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, classifyRef, createEmptyLockFile, deriveSlug, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, hasInterpolationTokens, interpolate, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, migrateWorkspaceConfig, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, queryInstancePickerChoices, resolveAllItems, resolveConfig, resolveItem, resolveLibraryDir, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, sha256Hex, storeSecrets, trpcGetUrl, userConfigPath, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeManifestIfMissing };
+//# sourceMappingURL=chunk-DOMCYP7D.js.map
+//# sourceMappingURL=chunk-DOMCYP7D.js.map