@skaile/workspaces 1.3.0 → 1.5.0

package/dist/cli/index.js

@@ -1,20 +1,15 @@
 #!/usr/bin/env node
-import { makeSourceCommand, syncProjectSources } from '../chunk-RYRJEVQ4.js';
-import { openCatalogSource, openLibraryManager, createFullRegistry, openLibrary } from '../chunk-RHMQPLIK.js';
-import { logErr, S, logOk, logInfo, colorRef, logWarn, kindColorPad, kindColor, formatSoftDepSection, bareSoftDepName, formatSoftDepHint, formatRelativeTime, fitWidth, formatSoftDepRemovePreview, formatSoftDepAddPreview } from '../chunk-5XS3BFJS.js';
-import { getStoreConfig, storeFetch, saveStoreTokens, clearStoreTokens, isStoreAuthenticated } from '../chunk-JQMIG7D3.js';
-import { AI_RESOURCES, aiResourceRoots } from '../chunk-XBG2YDQQ.js';
+import { AI_RESOURCES, aiResourceRoots } from '../chunk-2ZMO4CFG.js';
+import { getStoreConfig, storeFetch, deviceLogin, loadStoreAuthConfig, logout, hasStoredAuth, isStoreAuthenticated, getStoreToken } from '../chunk-J5TI55E7.js';
+import { makeSourceCommand, syncProjectSources } from '../chunk-WYGXYGJH.js';
+import { openCatalogSource, openLibraryManager, createFullRegistry, openLibrary } from '../chunk-RSYV7XEN.js';
+import { logErr, S, logOk, logInfo, colorRef, logWarn, kindColorPad, kindColor, formatSoftDepSection, bareSoftDepName, formatSoftDepHint, formatRelativeTime, fitWidth, formatSoftDepRemovePreview, formatSoftDepAddPreview } from '../chunk-KMY7HVQ6.js';
 import { LocalSecretsProvider } from '../chunk-6BEGKO2Q.js';
-import { resolveLibraryDir } from '../chunk-P3MJYPZE.js';
-import '../chunk-BZMTR5WW.js';
-import '../chunk-UKJMQZV6.js';
-import '../chunk-R7FOF242.js';
-import '../chunk-JXT46QFC.js';
-import { runFlow, resumeFlow } from '../chunk-YXEPZ7LP.js';
+import { runFlow, resumeFlow } from '../chunk-CNSNN7N6.js';
 import '../chunk-4R6DROGN.js';
 import { validateFlowVersions, parseSkillFrontmatter } from '../chunk-GXC3TYMQ.js';
-import { runAgentChat, loadSessionById, loadSession, listSessions, setCurrentSession, deleteSession, clearSession, loadAgentManifest, compileComposition, MarkdownStreamer, resolveMixin } from '../chunk-7CNIRF42.js';
-import { buildClaudePluginFiles } from '../chunk-ETYDLXI5.js';
+import { runAgentChat, loadSessionById, loadSession, listSessions, setCurrentSession, deleteSession, clearSession, loadAgentManifest, compileComposition, MarkdownStreamer, resolveMixin } from '../chunk-BGIC25VK.js';
+import { buildClaudePluginFiles } from '../chunk-RDYOU6N6.js';
 import '../chunk-X5YPJV4N.js';
 import '../chunk-O7SG5PC2.js';
 import '../chunk-7QBNJTTQ.js';
@@ -22,38 +17,43 @@ import '../chunk-GTS2FODO.js';
 import '../chunk-WQ7DE5UC.js';
 import '../chunk-32NA4TVC.js';
 import '../chunk-W3UDISS2.js';
-import '../chunk-EVZKWY5J.js';
-import '../chunk-K5SD7FSF.js';
+import '../chunk-HKX5VSWQ.js';
 import '../chunk-ISQWMBKD.js';
+import '../chunk-RRVQAE5D.js';
 import '../chunk-BMQKMOQY.js';
 import '../chunk-GAH4YRCI.js';
-import '../chunk-RRVQAE5D.js';
-import '../chunk-SUOGVHGJ.js';
+import '../chunk-TNSCHS4I.js';
 import '../chunk-LV2HPH3C.js';
-import '../chunk-PSMW5HLX.js';
-import '../chunk-BDUANIAR.js';
+import '../chunk-DMG6NJH7.js';
+import '../chunk-KEQ4GLVM.js';
 import '../chunk-6E6PKKAD.js';
-import { loadFlow, loadAllFlows } from '../chunk-SKADPHAM.js';
+import { loadFlow, loadAllFlows } from '../chunk-4N5XR5DQ.js';
 import '../chunk-DEYYRFQU.js';
 import '../chunk-IFGTRL2I.js';
-import { AssetManager, NON_DEPLOYABLE_KINDS, MissingManifestError } from '../chunk-OBSSORCE.js';
-import '../chunk-WFEPI5LA.js';
-import { readLock, resolveSettings, globalSettingsPath, projectSettingsPath, loadSettings, saveSettings, portableSpawn, portableSpawnSync, WorkspaceYamlEditor, checkAgentSkillConformance } from '../chunk-AZAS3FKN.js';
-import '../chunk-TJRWGMD2.js';
-import { globalCacheRoot, sourceCacheKey, getGlobalCacheDir, resolveAgentDir, resolveSkWorkspaceConfig } from '../chunk-OUWNTFDG.js';
-import { SKAILE_MANIFEST_FILENAME, decodeSkaileManifest, loadSkPublishManifest, saveSkPublishManifest } from '../chunk-DZCK7GRW.js';
+import '../chunk-PK7Q7MC7.js';
+import { AssetManager, NON_DEPLOYABLE_KINDS, MissingManifestError, normalizeRepoUrl, FACTORY_SOURCE_URL } from '../chunk-3CHARYD4.js';
+import { resolveLibraryDir, getStoreManifestsDir, getDefaultValue, isSecretPlaceholder } from '../chunk-FDE7XRQA.js';
+import '../chunk-MZV6WCF3.js';
+import '../chunk-JXT46QFC.js';
+import '../chunk-UKJMQZV6.js';
+import '../chunk-R7FOF242.js';
+import '../chunk-6NR2BEIY.js';
+import '../chunk-CGYEHQOX.js';
+import { readLock, resolveSettings, globalSettingsPath, projectSettingsPath, loadSettings, saveSettings, portableSpawn, portableSpawnSync, WorkspaceYamlEditor, checkAgentSkillConformance } from '../chunk-HY33RMEA.js';
+import { assetSearchDirs, detectDomains } from '../chunk-ZAP2BDHG.js';
+import { factoryAssetRoots } from '../chunk-ZBZQC5R7.js';
+import { globalCacheRoot, sourceCacheKey, getGlobalCacheDir, resolveAgentDir, loadSkWorkspaceConfig, resolveSkWorkspaceConfig, storeManifestSlug } from '../chunk-UQKYT4V6.js';
+import { SKAILE_MANIFEST_FILENAME, decodeSkaileManifest, loadSkPublishManifest, saveSkPublishManifest } from '../chunk-P4VHQA4N.js';
 import { parseFrontmatter } from '../chunk-BQCGFPHW.js';
 import { parseAssetRef, ASSET_KINDS, isValidAssetName, slugifyAssetName, ASSET_NAME_HINT, assetRefToStr } from '../chunk-GEEW6SY2.js';
 import '../chunk-F3HNW354.js';
 import { SUPPORTED_DRIVER_TARGETS } from '../chunk-MENCWIHW.js';
 import { DRIVER_DEFAULTS } from '../chunk-K5GBV4SA.js';
-import { assetSearchDirs, detectDomains } from '../chunk-ZAP2BDHG.js';
 import { openSqlite } from '../chunk-JB35MVBN.js';
 import '../chunk-KTBKW2FI.js';
 import '../chunk-UQ6LFBPZ.js';
-import '../chunk-XKARS6EE.js';
-import '../chunk-GB4SEEK4.js';
-import '../chunk-CGYEHQOX.js';
+import '../chunk-IEX5YV4R.js';
+import { validatePreset } from '../chunk-IRORTHGA.js';
 import '../chunk-NSBPE2FW.js';
 import * as fs12 from 'fs';
 import fs12__default, { readFileSync, existsSync, mkdirSync, writeFileSync, lstatSync, rmSync, readdirSync, statSync } from 'fs';
@@ -71,8 +71,22 @@ import { createInterface } from 'readline';
 import fs6 from 'fs/promises';
 import { parse as parse$1, stringify as stringify$1 } from 'smol-toml';
 import { execSync } from 'child_process';
+import * as readline2 from 'readline/promises';
 import { createTRPCUntypedClient, httpLink, httpSubscriptionLink } from '@trpc/client';
 
+function catalogAssetRef(a) {
+  return `${a.kind}:@${a.publisher}/${a.name}#${a.version}`;
+}
+function localEntryRef(e) {
+  return e.publisher ? `${e.kind}:@${e.publisher}/${e.name}` : e.name;
+}
+function filterCatalogAssets(assets, query) {
+  if (!query) return assets;
+  const q = query.toLowerCase();
+  return assets.filter(
+    (a) => a.name.toLowerCase().includes(q) || (a.description?.toLowerCase().includes(q) ?? false) || a.publisher.toLowerCase().includes(q)
+  );
+}
 async function runSearch(kind, query, opts) {
   if (kind?.includes(":")) {
     query = kind;
@@ -89,19 +103,68 @@ async function runSearch(kind, query, opts) {
     await searchStore(query, kind, opts, airGapped);
   }
 }
+async function searchIndex(query, kind) {
+  const { openLibrary: openLibrary2 } = await import('../open-library-4HMIDK3N.js');
+  const library = await openLibrary2();
+  try {
+    const defs = await library.listAssetDefs(kind ? { kind } : {});
+    let entries = defs.map(
+      (d) => ({
+        name: d.name,
+        kind: d.kind,
+        description: d.description ?? "",
+        source: d.id,
+        // Stored publishers may carry the `@` scope sigil (manifest-mode rows);
+        // `localEntryRef` re-adds it, so strip here to avoid `@@`.
+        publisher: d.publisher ? d.publisher.replace(/^@/, "") : void 0,
+        version: d.version,
+        requires: [],
+        dependencies: [],
+        license: d.license,
+        category: d.category
+      })
+    );
+    if (query) {
+      const q = query.toLowerCase();
+      entries = entries.filter(
+        (e) => e.name.toLowerCase().includes(q) || e.description.toLowerCase().includes(q)
+      );
+    }
+    return entries;
+  } finally {
+    library.close();
+  }
+}
+function searchFactory(projectDir, query, kind) {
+  const prefixes = factoryAssetRoots().map((r) => r.endsWith(path14__default.sep) ? r : r + path14__default.sep);
+  const isFactoryPath = (p8) => prefixes.some((fp) => p8 === fp.slice(0, -1) || p8.startsWith(fp));
+  try {
+    return new AssetManager({ projectDir }).search(query, kind).filter((e) => isFactoryPath(e.source));
+  } catch {
+    return [];
+  }
+}
+function entryDedupKey(e) {
+  return `${e.kind}:${e.publisher ? `@${e.publisher}/` : ""}${e.name}`;
+}
+function unionEntries(indexed, factory) {
+  const seen = new Set(indexed.map(entryDedupKey));
+  return [...indexed, ...factory.filter((e) => !seen.has(entryDedupKey(e)))];
+}
 async function searchLocal(query, kind, opts, showStore, airGapped) {
   const projectDir = path14__default.resolve(opts.projectDir);
-  let entries = new AssetManager({ projectDir }).search(query, kind);
+  const factory = searchFactory(projectDir, query, kind);
+  let entries = unionEntries(await searchIndex(query, kind), factory);
   if (entries.length === 0 && !query && !kind && !airGapped) {
-    const { autoSyncForSearch } = await import('../source-22U5NOY4.js');
+    const { autoSyncForSearch } = await import('../source-LOAM7IIQ.js');
     if (await autoSyncForSearch(projectDir)) {
-      entries = new AssetManager({ projectDir }).search(query, kind);
+      entries = unionEntries(await searchIndex(query, kind), factory);
     }
   }
   if (entries.length === 0) {
     if (!showStore) {
       logInfo(
-        query ? `No entries matching "${query}".` : "No assets found. Run `skaile source sync` first."
+        query ? `No entries matching "${query}".` : kind ? `No "${kind}" assets found in this project's sources.` : "No assets found. Run `skaile source sync` first."
       );
     }
     return;
@@ -119,7 +182,7 @@ function printLocalEntries(entries) {
     byKind.get(e.kind).push(e);
   }
   for (const [k, items] of byKind) {
-    const nameW = Math.max(4, ...items.map((e) => e.name.length));
+    const nameW = Math.max(4, ...items.map((e) => localEntryRef(e).length));
     console.log();
     console.log(
       `  ${kindColor(k)} ${S.heading(`${k.toUpperCase()}S`)} ${S.dim(`(${items.length})`)}`
@@ -127,7 +190,9 @@ function printLocalEntries(entries) {
     console.log(`  ${S.rule(nameW + 62)}`);
     for (const e of items) {
       const ver = e.version ? S.dim(` v${e.version}`) : "";
-      console.log(`  ${S.cmd(e.name.padEnd(nameW))}  ${e.description.slice(0, 60)}${ver}`);
+      console.log(
+        `  ${S.cmd(localEntryRef(e).padEnd(nameW))}  ${e.description.slice(0, 60)}${ver}`
+      );
     }
   }
   console.log(`
@@ -145,30 +210,33 @@ async function searchStore(query, kind, opts, airGapped) {
     logInfo("air-gapped (cache_ttl: 0) \u2014 local sources only");
     return;
   }
+  const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError } = await import('../open-library-4HMIDK3N.js');
   try {
-    const { getStoreConfig: getStoreConfig2, storeFetch: storeFetch2 } = await import('../store-client-YLMBH5MF.js');
-    const config = getStoreConfig2();
-    const params = {};
-    if (query) params.q = query;
-    if (kind) params.kind = kind;
-    const storeRes = await storeFetch2(config, "/api/assets", { params });
-    if (storeRes.results.length > 0) {
+    const remote = await openCatalogSource2({ projectDir: path14__default.resolve(opts.projectDir) });
+    const assets = await remote.listAssets(kind ? { kind } : {});
+    const results = filterCatalogAssets(assets, query);
+    if (results.length > 0) {
       console.log(`
   ${S.heading("Store:")}`);
-      for (const asset of storeRes.results) {
-        const ref = `${asset.kind}:@${asset.publisher}/${asset.slug}`;
+      for (const asset of results) {
+        const ref = catalogAssetRef(asset);
         console.log(
-          `    \u2B21 ${kindColorPad(asset.kind)}  ${colorRef(ref).padEnd(40)}  ${S.dim(asset.description?.slice(0, 50) || "")}  ${S.dim(`\u2193${asset.downloads}`)}`
+          `    \u2B21 ${kindColorPad(asset.kind)}  ${colorRef(ref).padEnd(48)}  ${S.dim(asset.description?.slice(0, 50) || "")}`
         );
       }
     } else if (opts.store) {
       logInfo("No results in store");
     }
   } catch (e) {
+    const local = e instanceof LocalCatalogDisabledError;
     if (opts.store) {
-      logErr(`Store search failed: ${e.message}`);
+      logErr(
+        local ? "remote catalog disabled (catalog.url: local) \u2014 set catalog.url: https://skaile.store to search the store" : `Store search failed: ${e.message}`
+      );
     } else {
-      logInfo("store unavailable \u2014 showing local results only (run with --store to see the error)");
+      logInfo(
+        local ? "remote catalog disabled (catalog.url: local) \u2014 showing local results only" : "store unavailable \u2014 showing local results only (run with --store to see the error)"
+      );
     }
   }
 }
@@ -1006,7 +1074,7 @@ function makeCatalogCommand() {
   return catalog;
 }
 async function runLocalCatalogTest(projectDir) {
-  const { resolveCatalogSource } = await import('../open-library-RPV2LIKL.js');
+  const { resolveCatalogSource } = await import('../open-library-4HMIDK3N.js');
   let resolved;
   try {
     resolved = await resolveCatalogSource({ projectDir });
@@ -1625,8 +1693,8 @@ async function promptField(field) {
 function makeConnectorCommand() {
   const cmd = new Command("connector").description("Operate on connectors in a workspace");
   cmd.command("catalog").description("List all available connector drivers and their dependencies").action(async () => {
-    const { scanDirectory, factoryAssetRoots } = await import('../core/index.js');
-    const entries = scanFactoryConnectors(scanDirectory, factoryAssetRoots());
+    const { scanDirectory, factoryAssetRoots: factoryAssetRoots2 } = await import('../core/index.js');
+    const entries = scanFactoryConnectors(scanDirectory, factoryAssetRoots2());
     if (entries.length === 0) {
       console.log("No connector descriptors found.");
       return;
@@ -1650,14 +1718,14 @@ function makeConnectorCommand() {
   cmd.command("add <driver>").option("--id <id>", "Connector instance ID (defaults to driver name)").option("--access <level>", "Access level: read-only | read-write", "read-only").option("--no-install", "Skip npm dependency installation").option("--project-dir <path>", "Workspace directory", process.cwd()).description("Add a connector to skaile.yaml and install its npm deps").action(
     async (driver, opts) => {
       const { installNpmPackages } = await import('../connectors/index.js');
-      const { scanDirectory, factoryAssetRoots, WorkspaceYamlEditor: WorkspaceYamlEditor2 } = await import('../core/index.js');
+      const { scanDirectory, factoryAssetRoots: factoryAssetRoots2, WorkspaceYamlEditor: WorkspaceYamlEditor2 } = await import('../core/index.js');
       const projectDir = path14__default.resolve(opts.projectDir);
       const yamlPath = path14__default.join(projectDir, "skaile.yaml");
       if (!existsSync(yamlPath)) {
         logErr("No skaile.yaml found in current directory. Run 'skaile init' first.");
         process.exit(1);
       }
-      const entries = scanFactoryConnectors(scanDirectory, factoryAssetRoots());
+      const entries = scanFactoryConnectors(scanDirectory, factoryAssetRoots2());
       const entry = entries.find((e) => e.name === driver);
       if (!entry) {
         logErr(
@@ -1996,7 +2064,7 @@ async function ensureTargetsRegistered(projectDir) {
   const { resolveSkWorkspaceConfig: resolveSkWorkspaceConfig2 } = await import('../core/index.js');
   const config = resolveSkWorkspaceConfig2(projectDir);
   if (config.plugins && config.plugins.length > 0) {
-    const { ensurePluginsLoaded } = await import('../plugin-store-G4HKWCTU.js');
+    const { ensurePluginsLoaded } = await import('../plugin-store-S7OMGI7N.js');
     const result = await ensurePluginsLoaded(projectDir, config.plugins, pluginRegistry);
     for (const f of result.failed) logWarn(f.error);
   }
@@ -2801,11 +2869,6 @@ function makeIntegrationCommand() {
   cmd.action(() => cmd.help());
   return cmd;
 }
-var NOT_WIRED_MSG_PUBLISH = "`skaile library publish` is scaffolded but not yet wired. Server endpoint `POST /sources/<id>/manifest` lands in a follow-up PR.";
-function notWired(verb, msg) {
-  logErr(`${msg} (verb: library ${verb})`);
-  process.exit(2);
-}
 function makeLibraryCommand() {
   const cmd = new Command("library").description("Manage user authoring libraries (local / git)");
   cmd.command("list").description("List all registered libraries").option("--json", "Output as JSON").action(async (opts) => {
@@ -3181,9 +3244,20 @@ function makeLibraryCommand() {
       close();
     }
   });
-  cmd.command("publish <ref>").description("Push + register manifest atomically (needs git backend)").action((_ref) => notWired("publish", NOT_WIRED_MSG_PUBLISH));
-  cmd.command("register <ref>").description("Register manifest in store without pushing (bytes already on github)").action((_ref) => notWired("register", NOT_WIRED_MSG_PUBLISH));
-  cmd.command("yank <ref>").description("Retract a catalog entry").option("--version <v>", "Version to yank").action((_ref) => notWired("yank", NOT_WIRED_MSG_PUBLISH));
+  cmd.command("publish <lib>").description("Push + register the library's manifest atomically (needs git backend)").option("--asset <ref>", "Publish only the single asset matching this ref/name").option("--create-repo", "Provision + link a public github repo if the library has no remote").option("--ref <gitref>", "Git ref to ingest (default: the library branch or main)").option("--dry-run", "Print the plan; push nothing and call no store endpoint").action(
+    async (lib, opts) => {
+      const { runLibraryPublish } = await import('../library-publish-K5IBE44D.js');
+      await runLibraryPublish(lib, opts);
+    }
+  );
+  cmd.command("register <lib>").description("Register the library's manifest without pushing (bytes already on github)").option("--asset <ref>", "Publish only the single asset matching this ref/name").option("--ref <gitref>", "Git ref to ingest (default: the library branch or main)").option("--dry-run", "Print the plan; call no store endpoint").action(async (lib, opts) => {
+    const { runLibraryRegister } = await import('../library-publish-K5IBE44D.js');
+    await runLibraryRegister(lib, opts);
+  });
+  cmd.command("yank <lib>").description("Retract the library's published assets from the store").option("--asset <ref>", "Yank only the single asset matching this ref/name").action(async (lib, opts) => {
+    const { runLibraryYank } = await import('../library-publish-K5IBE44D.js');
+    await runLibraryYank(lib, opts);
+  });
   return cmd;
 }
 async function printPerLibraryStatus(name, asJson) {
@@ -3712,7 +3786,7 @@ async function previewSoftDepsUnderCursor() {
 }
 async function loadAssets() {
   softDepPreviewCache.clear();
-  const { gatherAssetFeeds } = await import('../asset-feeds-NEZKG6YS.js');
+  const { gatherAssetFeeds } = await import('../asset-feeds-T35ELX2O.js');
   const { entries, domains, notes } = await gatherAssetFeeds(am, am.projectDir);
   if (notes.length > 0) {
     state.message = notes.map((n) => `[${n.feed}] ${n.message}`).join(" \u2022 ");
@@ -3879,7 +3953,7 @@ function reconcileCollapsedSets(rows) {
 async function loadSourcesAndLibraries() {
   try {
     const [{ openLibraryManager: openLibraryManager2 }, { skaileHomeDir }, { getGlobalCacheDir: getGlobalCacheDir2 }] = await Promise.all([
-      import('../open-library-RPV2LIKL.js'),
+      import('../open-library-4HMIDK3N.js'),
       import('../library/index.js'),
       import('../core/index.js')
     ]);
@@ -4748,8 +4822,8 @@ function makeManageCommand() {
 }
 function makeMcpServerCommand() {
   return new Command("mcp-server").description("Start skaile workspace MCP server (stdio transport)").option("--project-dir <path>", "Project directory (default: cwd)", process.cwd()).action(async (opts) => {
-    const path36 = await import('path');
-    const projectDir = path36.default.resolve(opts.projectDir);
+    const path37 = await import('path');
+    const projectDir = path37.default.resolve(opts.projectDir);
     const { LogStore, StdoutSink, registerLogStore } = await import('../core/logging.js');
     registerLogStore(
       new LogStore({
@@ -4965,7 +5039,7 @@ function action2(fn) {
   };
 }
 async function reconcileAndReport(projectDir, plugins) {
-  const { reconcilePlugins } = await import('../plugin-store-G4HKWCTU.js');
+  const { reconcilePlugins } = await import('../plugin-store-S7OMGI7N.js');
   if (plugins.length === 0) {
     logInfo("No plugins declared \u2014 nothing to reconcile.");
     return;
@@ -4981,7 +5055,7 @@ async function reconcileAndReport(projectDir, plugins) {
 async function runInstall2(spec, opts) {
   const projectDir = path14__default.resolve(opts.projectDir);
   const { WorkspaceYamlEditor: WorkspaceYamlEditor2 } = await import('../core/index.js');
-  const { specName } = await import('../plugin-store-G4HKWCTU.js');
+  const { specName } = await import('../plugin-store-S7OMGI7N.js');
   const yamlPath = path14__default.join(projectDir, "skaile.yaml");
   const editor = WorkspaceYamlEditor2.load(yamlPath);
   const replaced = editor.addPlugin(spec, specName);
@@ -4993,7 +5067,7 @@ async function runInstall2(spec, opts) {
 async function runRemove(name, opts) {
   const projectDir = path14__default.resolve(opts.projectDir);
   const { WorkspaceYamlEditor: WorkspaceYamlEditor2 } = await import('../core/index.js');
-  const { specName } = await import('../plugin-store-G4HKWCTU.js');
+  const { specName } = await import('../plugin-store-S7OMGI7N.js');
   const yamlPath = path14__default.join(projectDir, "skaile.yaml");
   const editor = WorkspaceYamlEditor2.load(yamlPath);
   const removed = editor.removePlugin(name, specName);
@@ -5021,7 +5095,7 @@ async function runList(opts) {
   const registry = createPluginRegistry();
   if (declared.length > 0) {
     try {
-      const { loadPlugins } = await import('../plugin-store-G4HKWCTU.js');
+      const { loadPlugins } = await import('../plugin-store-S7OMGI7N.js');
       const result = await loadPlugins(projectDir, declared, registry);
       for (const f of result.failed) logWarn(f.error);
     } catch (err) {
@@ -5055,150 +5129,93 @@ function makePluginCommand() {
   cmd.action(() => cmd.help());
   return cmd;
 }
-function makePresetCommand() {
-  const cmd = new Command("preset").description("Scaffold and validate preset YAML files");
-  cmd.command("init [name]").description("Scaffold a new .preset.yaml file").option("--dir <path>", "Output directory", process.cwd()).action(async (name, opts) => {
-    const presetName = name ?? "my-preset";
-    const filename = `${presetName}.preset.yaml`;
-    const outPath = path14__default.join(path14__default.resolve(opts.dir), filename);
-    if (existsSync(outPath)) {
-      logErr(`File already exists: ${outPath}`);
-      logInfo("Choose a different name or remove the existing file.");
-      process.exit(1);
-    }
-    const template = generatePresetTemplate(presetName);
-    writeFileSync(outPath, template, "utf-8");
-    logOk(`Created ${S.brand(filename)}`);
-    logInfo(`Path: ${outPath}`);
-    logInfo("Edit the file to define your preset items, then validate with:");
-    logInfo(`  skaile preset validate ${filename}`);
-  });
-  cmd.command("validate <path>").description("Validate a preset YAML file (schema + cycles + nesting depth)").action(async (filePath) => {
-    await runPresetValidate(filePath);
-  });
-  return cmd;
-}
-async function loadPresetForValidation(resolved) {
-  if (!existsSync(resolved)) {
-    logErr(`File not found: ${resolved}`);
-    process.exit(1);
-  }
-  const content = readFileSync(resolved, "utf-8");
-  const { parsePresetYaml } = await import('../library/index.js');
-  const parseResult = parsePresetYaml(content);
-  if (!parseResult.ok) {
-    logErr("Preset validation failed (parse errors):");
-    for (const err of parseResult.errors) {
-      console.log(`  ${S.err("\u2717")} ${err}`);
-    }
-    process.exit(1);
-  }
-  if (!parseResult.preset) {
-    logErr("Preset validation failed: parser returned no manifest");
-    process.exit(1);
-  }
-  return parseResult.preset;
-}
-async function reportNestedPresetRefs(preset) {
-  const { detectNestedPresetRefs } = await import('../library/index.js');
-  const nestedRefs = detectNestedPresetRefs(preset);
-  if (nestedRefs.length > 0) {
-    logInfo(`Nested preset refs: ${nestedRefs.length} (depth validated at apply-time)`);
-  }
-}
-async function checkPresetCycles(preset, resolved) {
-  const { detectCycles } = await import('../discovery/index.js');
-  const presetRef = path14__default.basename(resolved, ".preset.yaml");
-  const edges = [];
+
+// cli/src/commands/preset-apply.ts
+var TOKEN_RE = /\$\{(INPUT|SECRET):([^}]+)\}/g;
+var NESTED_PRESET_UNSUPPORTED = "nested presets are not supported by `preset apply` yet";
+function resolvePlaceholderValue(placeholder, providedValue) {
+  if (isSecretPlaceholder(placeholder)) {
+    return { envRef: `env:${placeholder.key}` };
+  }
+  const fallback = getDefaultValue(placeholder);
+  const resolved = providedValue ?? (fallback !== void 0 ? String(fallback) : void 0);
+  if (resolved === void 0) {
+    if (placeholder.required !== false) {
+      throw new Error(`Placeholder "${placeholder.key}" is required but no value was provided`);
+    }
+    return { value: "" };
+  }
+  return { value: resolved };
+}
+function presetItemsToWorkspace(preset, values) {
+  const dependencies = [];
+  const connectors = [];
+  const mcpServers = [];
+  const envVarsToSet = /* @__PURE__ */ new Set();
   for (const item of preset.items) {
-    if (item.ref) {
-      edges.push({ from: presetRef, to: item.ref, field: "items[].ref" });
-    }
-  }
-  if (edges.length === 0) return;
-  const cycleResult = detectCycles(edges);
-  if (!cycleResult.acyclic) {
-    logErr("Cycle detected in preset references:");
-    if (cycleResult.cyclePath) {
-      console.log(`  ${S.err("\u2717")} ${cycleResult.cyclePath.join(" \u2192 ")}`);
+    const ref = item.ref;
+    if (ref.startsWith("preset:")) throw new Error(NESTED_PRESET_UNSUPPORTED);
+    if (item.id && ref.startsWith("connector:")) {
+      const config = resolveItemConfig(item, preset, values, envVarsToSet);
+      connectors.push({
+        id: item.id,
+        driver: ref.slice("connector:".length),
+        ...config
+      });
+    } else if (item.id && ref.startsWith("mcp:")) {
+      const config = resolveItemConfig(item, preset, values, envVarsToSet);
+      mcpServers.push({ id: item.id, ...config });
+    } else {
+      dependencies.push(ref);
     }
-    process.exit(1);
   }
+  const sources = (preset.sources ?? []).map(
+    (s) => s.pin ? { url: s.url, pin: s.pin } : { url: s.url }
+  );
+  return { dependencies, connectors, mcpServers, sources, envVarsToSet: [...envVarsToSet] };
 }
-async function checkPresetPlaceholders(allPlaceholders) {
-  if (allPlaceholders.length === 0) return false;
-  const { validatePlaceholder } = await import('../library/index.js');
-  const invalidEntries = [];
-  for (const ph of allPlaceholders) {
-    const result = validatePlaceholder(ph, ph.default);
-    if (!result.valid) {
-      invalidEntries.push({ key: ph.key, errors: result.errors });
+function resolveItemConfig(item, preset, values, envVarsToSet) {
+  const byKey = placeholderIndex(item, preset);
+  const resolve5 = (key) => {
+    const ph = byKey.get(key) ?? { key, type: "text", required: true };
+    return resolvePlaceholderValue(ph, values[key]);
+  };
+  return substituteNode(item.config ?? {}, resolve5, envVarsToSet);
+}
+function placeholderIndex(item, preset) {
+  const map = /* @__PURE__ */ new Map();
+  for (const input of preset.inputs ?? []) map.set(input.key, input);
+  for (const ph of item.placeholders ?? []) map.set(ph.key, ph);
+  return map;
+}
+function substituteNode(node, resolve5, envVarsToSet) {
+  if (typeof node === "string") return substituteString(node, resolve5, envVarsToSet);
+  if (Array.isArray(node)) return node.map((el) => substituteNode(el, resolve5, envVarsToSet));
+  if (node && typeof node === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(node)) out[k] = substituteNode(v, resolve5, envVarsToSet);
+    return out;
+  }
+  return node;
+}
+function substituteString(value, resolve5, envVarsToSet) {
+  const tokens = [...value.matchAll(TOKEN_RE)];
+  if (tokens.length === 0) return value;
+  const secret = tokens.find(([, ns]) => ns === "SECRET") ?? tokens.find(([, , key]) => "envRef" in resolve5(key));
+  if (secret) {
+    const [full, , key] = secret;
+    if (tokens.length > 1 || full !== value) {
+      throw new Error(
+        `Secret "${key}" must be the only token in its value \u2014 remove the surrounding tokens/text`
+      );
     }
+    envVarsToSet.add(key);
+    return `env:${key}`;
   }
-  if (invalidEntries.length === 0) return false;
-  logWarn("Placeholder issues:");
-  for (const r of invalidEntries) {
-    console.log(`  ${S.warn("!")} ${r.key}: ${r.errors.join(", ")}`);
-  }
-  return true;
-}
-function printPresetSummary(preset, placeholderCount, hasWarnings) {
-  console.log();
-  console.log(S.heading("  Preset Validation"));
-  console.log(`  ${S.rule(40)}`);
-  console.log(`  ${S.label("Name")}          ${preset.name}`);
-  console.log(`  ${S.label("Version")}       ${preset.version ?? "unversioned"}`);
-  console.log(`  ${S.label("Items")}         ${preset.items.length}`);
-  console.log(`  ${S.label("Inputs")}         ${preset.inputs?.length ?? 0}`);
-  console.log(`  ${S.label("Placeholders")}  ${placeholderCount}`);
-  console.log();
-  if (hasWarnings) {
-    logWarn("Validation passed with warnings");
-  } else {
-    logOk("Preset is valid");
-  }
-}
-async function runPresetValidate(filePath) {
-  const resolved = path14__default.resolve(filePath);
-  const preset = await loadPresetForValidation(resolved);
-  await reportNestedPresetRefs(preset);
-  await checkPresetCycles(preset, resolved);
-  const allPlaceholders = preset.items.flatMap((item) => item.placeholders ?? []);
-  const hasWarnings = await checkPresetPlaceholders(allPlaceholders);
-  printPresetSummary(preset, allPlaceholders.length, hasWarnings);
-}
-function generatePresetTemplate(name) {
-  return `# ${name}.preset.yaml
-# Polymorphic Preset \u2014 composition + configuration primitive for the asset store.
-# See: _devlog/specs/2026-05-03-ai-asset-store-v2-design.md \xA7 Presets
-
-name: "${name}"
-version: "1.0.0"
-description: "TODO: describe what this preset configures"
-
-# Placeholders \u2014 values the user provides at apply-time.
-# Types: text, multiline, secret, number, boolean, enum, oauth, instance-picker
-placeholders:
-  - key: EXAMPLE_KEY
-    type: text
-    label: "Example placeholder"
-    required: true
-    # default: "some-value"
-    # hint: "Help text shown to the user"
-
-# Items \u2014 each becomes a Library Instance when the preset is applied.
-# Ref types:
-#   - Asset ref (kind:publisher/name@pin) \u2192 creates new Instance
-#   - Library Instance ref (#uuid) \u2192 reuses existing Instance
-#   - Nested Preset ref (preset:path.preset.yaml) \u2192 recursive apply (max depth 3)
-items:
-  - id: example-item
-    ref: "skill:@skaile/example-skill@^1.0"
-    config:
-      # Use \${INPUT:EXAMPLE_KEY} for placeholder interpolation
-      setting: "\${INPUT:EXAMPLE_KEY}"
-    # credential_ref: "\${SECRET:EXAMPLE_KEY}"  # for secret placeholders
-`;
+  return value.replace(TOKEN_RE, (_m, _ns, key) => {
+    const resolved = resolve5(key);
+    return "envRef" in resolved ? resolved.envRef : resolved.value;
+  });
 }
 var REF_HINT = "kind:@<publisher>/<name>#<version> (e.g. skill:@skaile/use-exa#1.0.0)";
 function isValidAssetRef(ref) {
@@ -5275,7 +5292,7 @@ async function runRefInstall(ref, opts) {
   const spinner5 = p6.spinner();
   spinner5.start(`Installing ${ref}`);
   try {
-    const { openCatalogSource: openCatalogSource2, openLibrary: openLibrary2 } = await import('../open-library-RPV2LIKL.js');
+    const { openCatalogSource: openCatalogSource2, openLibrary: openLibrary2 } = await import('../open-library-4HMIDK3N.js');
     const catalog = await openCatalogSource2({ projectDir: path14__default.resolve(opts.projectDir) });
     if (!supportsInstallManifest(catalog)) {
       throw new Error(
@@ -5290,6 +5307,9 @@ async function runRefInstall(ref, opts) {
       logInfo(`Path: ${S.dim(result.installPath)}`);
       logInfo(`Commit: ${S.dim(result.commitSha)}`);
       logInfo(`Files: ${S.dim(String(result.fileCount))}`);
+      logInfo(
+        S.dim(`Installed globally (see Path above) \u2014 use \`skaile add ${ref}\` to deploy into this project.`)
+      );
     } finally {
       library.close();
     }
@@ -5312,7 +5332,7 @@ async function runYamlInstall(opts) {
     return;
   }
   try {
-    const { ensureSourcesCloned } = await import('../ensure-sources-4BAJGJRK.js');
+    const { ensureSourcesCloned } = await import('../ensure-sources-QDVFUIUP.js');
     const hydrate = ensureSourcesCloned(projectDir, { quiet: true });
     if (hydrate.cloned.length > 0) {
       logOk(`Cloned source(s): ${hydrate.cloned.join(", ")}`);
@@ -5468,48 +5488,669 @@ function makeCleanCommand() {
     }
   });
 }
-function makeRebuildCommand() {
-  return new Command("rebuild").description("Re-snapshot inline-snapshot composition items and bump prompt version").argument("[agent]", "Agent name or path (defaults to current project agent)").option("--project-dir <dir>", "Project directory", process.cwd()).action(async (agentArg, opts) => {
-    const projectDir = path14__default.resolve(opts.projectDir);
-    let agentDir;
-    if (agentArg) {
-      if (agentArg.includes("/") || agentArg.includes("\\")) {
-        agentDir = path14__default.resolve(projectDir, agentArg);
-      } else {
-        const resolved = resolveAgentDir(projectDir);
-        agentDir = resolved ?? path14__default.resolve(projectDir, agentArg);
-      }
-    } else {
-      const resolved = resolveAgentDir(projectDir);
-      if (!resolved) {
-        logErr("No agent found in current project. Specify an agent name or path.");
-        process.exit(1);
-      }
-      agentDir = resolved;
-    }
-    const manifest = await loadAgentManifest(agentDir);
-    if (!manifest) {
-      logErr(`No agent.yaml found in ${agentDir}`);
-      process.exit(1);
-    }
-    if (!manifest.composes || manifest.composes.length === 0) {
-      logInfo("Agent has no composes: items \u2014 nothing to rebuild.");
-      return;
+function buildPresetFromWorkspace(config, name, sources = []) {
+  const items = [];
+  for (const ref of config.dependencies ?? []) {
+    items.push({ ref });
+  }
+  for (const connector of config.connectors ?? []) {
+    const config_ = compact({
+      access: connector.access,
+      auth: connector.auth,
+      options: connector.options,
+      version: connector.version,
+      tags: connector.tags
+    });
+    items.push({
+      id: connector.id,
+      ref: `connector:${connector.driver}`,
+      ...config_ ? { config: config_ } : {}
+    });
+  }
+  for (const mcp of config.mcp_servers ?? []) {
+    const config_ = compact({
+      transport: mcp.transport,
+      command: mcp.command,
+      args: mcp.args,
+      env: mcp.env,
+      url: mcp.url,
+      headers: mcp.headers
+    });
+    items.push({
+      id: mcp.id,
+      ref: `mcp:${mcp.id}`,
+      ...config_ ? { config: config_ } : {}
+    });
+  }
+  const project = config.name ?? name;
+  return {
+    name,
+    version: "1.0.0",
+    description: `Exported from ${project} workspace`,
+    items,
+    // Never let a credential-bearing source URL reach a shareable preset.
+    ...sources.length > 0 ? { sources: sources.map((s) => ({ ...s, url: stripUrlCredentials(s.url) })) } : {}
+  };
+}
+function neededSources(config, lock) {
+  const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
+  const nonFactory = (config.sources ?? []).filter((s) => normalizeRepoUrl(s.url) !== factoryUrl);
+  if (!lock) return nonFactory;
+  const inClosure = new Set(lock.sources.map((s) => normalizeRepoUrl(s.url)));
+  return nonFactory.filter((s) => inClosure.has(normalizeRepoUrl(s.url)));
+}
+function sourcesWithSidecar(sources) {
+  const dir = getStoreManifestsDir();
+  return sources.filter((s) => existsSync(path14.join(dir, `${storeManifestSlug(s.url)}.yaml`))).map((s) => s.url);
+}
+function compact(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0 && v !== null) out[k] = v;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+var SECRET_REFERENCE_PREFIXES = ["env", "forge", "secret", "op", "kp", "oauth", "pat"];
+var SECRET_REFERENCE_RE = new RegExp(`^(${SECRET_REFERENCE_PREFIXES.join("|")}):`);
+function isSecretReference(value) {
+  return SECRET_REFERENCE_RE.test(value);
+}
+var PLACEHOLDER_RE = /^\$\{(INPUT|SECRET):[^}]+\}$/;
+var SUSPICIOUS_KEY_RE = /(?:^|[_-])(?:token|password|passwd|secret|apikey|key|dsn|credential|auth|authorization|bearer)(?:[_-]|$)/i;
+var PROTO_CREDENTIAL_URL_RE = /\w+:\/\/[^/@\s]+:[^/@\s]+@/;
+function urlHasCredentials(url) {
+  return PROTO_CREDENTIAL_URL_RE.test(url);
+}
+function stripUrlCredentials(url) {
+  return url.replace(/^(\w+:\/\/)[^/@]*:[^/@]*@/, "$1");
+}
+function isLongEntropic(value) {
+  if (value.length < 20) return false;
+  if (/^\w+:\/\//.test(value) || value.startsWith("/")) return false;
+  const classes = [/[a-z]/, /[A-Z]/, /[0-9]/].filter((re) => re.test(value)).length;
+  return classes >= 2;
+}
+function scanInlineSecrets(preset) {
+  const findings = [];
+  for (const item of preset.items) {
+    const itemId = typeof item.id === "string" ? item.id : "";
+    if (item.config) scanNode(item.config, [], false, itemId, findings);
+  }
+  return findings;
+}
+function scanNode(node, segments, inCredentialField, itemId, findings) {
+  if (typeof node === "string") {
+    if (isInlineSecret(node, segments.at(-1) ?? "", inCredentialField)) {
+      findings.push({ itemId, path: segments.join("."), maskedValue: maskSecret(node) });
     }
-    logInfo(
-      `Rebuilding ${manifest.name ?? "agent"} (${manifest.composes.length} composition items)...`
+    return;
+  }
+  if (Array.isArray(node)) {
+    node.forEach(
+      (el, i) => scanNode(el, [...segments, String(i)], inCredentialField, itemId, findings)
     );
-    const loadContent = async (ref, kind) => {
-      try {
-        const repos = {};
-        const mixinKind = kind;
-        const resolved = await resolveMixin(ref, mixinKind, agentDir, repos);
-        return resolved?.content ?? null;
-      } catch {
-        return null;
-      }
+    return;
+  }
+  if (node && typeof node === "object") {
+    for (const [k, v] of Object.entries(node)) {
+      const credField = inCredentialField || k === "auth";
+      scanNode(v, [...segments, k], credField, itemId, findings);
+    }
+  }
+}
+function isInlineSecret(value, key, inCredentialField) {
+  if (isSecretReference(value) || PLACEHOLDER_RE.test(value)) return false;
+  if (inCredentialField) return true;
+  if (SUSPICIOUS_KEY_RE.test(key)) return true;
+  if (PROTO_CREDENTIAL_URL_RE.test(value)) return true;
+  return isLongEntropic(value);
+}
+function maskSecret(value) {
+  const proto = value.match(/^(\w+):\/\/[^/@\s]+:[^/@\s]+@/);
+  if (proto) return `${proto[1]}://\u2026:****@\u2026`;
+  return "****";
+}
+function redactSecrets(preset, findings) {
+  const next = structuredClone(preset);
+  const keys = [];
+  const used = /* @__PURE__ */ new Set();
+  for (const finding of findings) {
+    const item = next.items.find((it) => it.id === finding.itemId);
+    if (!item?.config) continue;
+    const base = placeholderKey(finding.itemId, finding.path);
+    let key = base;
+    for (let n = 2; used.has(key); n++) key = `${base}_${n}`;
+    if (!setAtPath(item.config, finding.path.split("."), `\${INPUT:${key}}`)) continue;
+    used.add(key);
+    const placeholder = {
+      key,
+      type: "secret",
+      required: true,
+      prompt: `Secret value for ${finding.itemId}.${finding.path}`
     };
-    const result = await compileComposition({
+    item.placeholders = [...item.placeholders ?? [], placeholder];
+    keys.push(key);
+  }
+  return { preset: next, keys };
+}
+function placeholderKey(itemId, path37) {
+  return `${itemId}_${path37}`.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+}
+function setAtPath(root, segments, value) {
+  let node = root;
+  for (let i = 0; i < segments.length - 1; i++) {
+    if (!node || typeof node !== "object") return false;
+    node = node[segments[i]];
+  }
+  if (!node || typeof node !== "object") return false;
+  node[segments.at(-1)] = value;
+  return true;
+}
+var INLINE_SECRETS_HEADER = "# \u26A0\uFE0F CONTAINS INLINE SECRETS \u2014 replace with placeholders before sharing or publishing";
+function secretHeaderComment(findings) {
+  return findings.length > 0 ? INLINE_SECRETS_HEADER : null;
+}
+
+// cli/src/commands/preset-cmd.ts
+function makePresetCommand() {
+  const cmd = new Command("preset").description("Scaffold and validate preset YAML files");
+  cmd.command("init [name]").description("Scaffold a new .preset.yaml file").option("--dir <path>", "Output directory", process.cwd()).action(async (name, opts) => {
+    const presetName = name ?? "my-preset";
+    const filename = `${presetName}.preset.yaml`;
+    const outPath = path14__default.join(path14__default.resolve(opts.dir), filename);
+    if (existsSync(outPath)) {
+      logErr(`File already exists: ${outPath}`);
+      logInfo("Choose a different name or remove the existing file.");
+      process.exit(1);
+    }
+    const template = generatePresetTemplate(presetName);
+    writeFileSync(outPath, template, "utf-8");
+    logOk(`Created ${S.brand(filename)}`);
+    logInfo(`Path: ${outPath}`);
+    logInfo("Edit the file to define your preset items, then validate with:");
+    logInfo(`  skaile preset validate ${filename}`);
+  });
+  cmd.command("validate <path>").description("Validate a preset YAML file (schema + cycles + nesting depth)").action(async (filePath) => {
+    await runPresetValidate(filePath);
+  });
+  cmd.command("export [name]").description("Snapshot the workspace's skaile.yaml into a shareable .preset.yaml").option("--project-dir <path>", "Project directory to read skaile.yaml from", process.cwd()).option("--out <file>", "Explicit output file path").option("--dir <path>", "Output directory (default: cwd)", process.cwd()).option("--redact", "Replace every detected inline secret with a placeholder").option(
+    "--allow-inline-secrets",
+    "Exit 0 even when inline secrets remain unredacted (opt-in; unsafe for CI)"
+  ).option("--force", "Overwrite the output file if it already exists").action(async (name, opts) => {
+    await runPresetExport(name, opts);
+  });
+  cmd.command("apply <path>").description("Apply a .preset.yaml additively into the workspace's skaile.yaml").option("--project-dir <path>", "Project directory holding skaile.yaml", process.cwd()).option(
+    "--input <KEY=VAL>",
+    "Provide a placeholder value (repeatable)",
+    collectInput,
+    []
+  ).option("--yes", "Skip interactive prompts; use defaults where available").option("--no-deploy", "Skip the final `skaile install` step").action(async (filePath, opts) => {
+    await runPresetApply(filePath, opts);
+  });
+  return cmd;
+}
+async function runPresetExport(name, opts) {
+  const projectDir = path14__default.resolve(opts.projectDir);
+  const file = loadSkWorkspaceConfig(projectDir);
+  if (!file) {
+    logErr(`No skaile.yaml found in ${projectDir}`);
+    logInfo("Run this from a project directory or pass --project-dir <path>.");
+    process.exit(1);
+  }
+  const presetName = name ?? file.config.name ?? "my-preset";
+  let lock = null;
+  try {
+    lock = readLock(path14__default.join(projectDir, "skaile.lock.yaml"));
+  } catch {
+    lock = null;
+  }
+  const sources = neededSources(file.config, lock);
+  if (lock === null && sources.length > 0) {
+    logInfo("No lock file \u2014 exporting all non-factory sources conservatively.");
+  }
+  const strippedCreds = sources.filter((s) => urlHasCredentials(s.url)).length;
+  if (strippedCreds > 0) {
+    logWarn(
+      `Stripped credentials from ${strippedCreds} source URL(s) \u2014 resolved via git auth on apply.`
+    );
+  }
+  const sidecarSources = sourcesWithSidecar(sources);
+  if (sidecarSources.length > 0) {
+    logWarn(
+      `${sidecarSources.length} captured source(s) rely on a MACHINE-LOCAL sidecar overlay (\`~/.skaile/store/manifests/*\`) \u2014 assets may not resolve on other machines or when this preset is shared, until the sidecar manifest is published: ${sidecarSources.join(", ")}`
+    );
+  }
+  let preset = buildPresetFromWorkspace(file.config, presetName, sources);
+  if (preset.items.length === 0) {
+    logErr("Nothing to export \u2014 skaile.yaml has no dependencies, connectors, or mcp_servers.");
+    process.exit(1);
+  }
+  const result = validatePreset(preset);
+  if (!result.ok) {
+    logErr("Internal error: generated preset failed validation:");
+    for (const err of result.errors) console.error(`  ${S.err("\u2717")} ${err.path}: ${err.message}`);
+    process.exit(1);
+  }
+  const findings = scanInlineSecrets(preset);
+  reportFindings(findings);
+  const toRedact = await resolveRedactions(findings, opts.redact === true);
+  if (toRedact.length > 0) preset = redactSecrets(preset, toRedact).preset;
+  const unresolved = scanInlineSecrets(preset);
+  const header = secretHeaderComment(unresolved);
+  const body = stringify(preset);
+  const contents = header ? `${header}
+${body}` : body;
+  if (opts.out && opts.dir !== process.cwd()) logWarn("--dir is ignored when --out is set.");
+  const outPath = opts.out ? path14__default.resolve(opts.out) : path14__default.join(path14__default.resolve(opts.dir), `${presetName}.preset.yaml`);
+  if (existsSync(outPath) && !opts.force) {
+    logErr(`File already exists: ${outPath}`);
+    logInfo("Pass --force to overwrite, or choose a different --out/--dir.");
+    process.exit(1);
+  }
+  try {
+    writeFileSync(outPath, contents, "utf-8");
+  } catch (e) {
+    logErr(`Failed to write ${outPath}: ${e.message}`);
+    process.exit(1);
+  }
+  logOk(`Exported ${S.brand(path14__default.basename(outPath))}`);
+  logInfo(`Path: ${outPath}`);
+  if (unresolved.length > 0) {
+    console.error(S.err("This file is NOT safe to share."));
+    if (!opts.allowInlineSecrets) {
+      logErr(`${unresolved.length} inline secret(s) left unredacted.`);
+      logInfo(
+        "Re-run with --redact to placeholder them, or --allow-inline-secrets to accept the risk."
+      );
+      process.exit(1);
+    }
+  }
+}
+function reportFindings(findings) {
+  if (findings.length === 0) return;
+  console.error(S.err(`\u26A0\uFE0F ${findings.length} potential INLINE secret(s) found`));
+  for (const f of findings) {
+    console.error(`  ${S.err("\u2022")} ${f.itemId}  ${S.dim(f.path)}  ${f.maskedValue}`);
+  }
+}
+async function resolveRedactions(findings, redactAll) {
+  if (findings.length === 0) return [];
+  if (redactAll) return findings;
+  if (!process.stdin.isTTY) return [];
+  const rl = readline2.createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const chosen = [];
+    for (const f of findings) {
+      const answer = await rl.question(`Redact ${f.itemId}.${f.path}? [y/N] `);
+      if (/^y(es)?$/i.test(answer.trim())) chosen.push(f);
+    }
+    return chosen;
+  } finally {
+    rl.close();
+  }
+}
+function collectInput(value, acc) {
+  acc.push(value);
+  return acc;
+}
+async function runPresetApply(filePath, opts) {
+  const projectDir = path14__default.resolve(opts.projectDir);
+  const file = loadSkWorkspaceConfig(projectDir);
+  if (!file) {
+    logErr("No skaile.yaml \u2014 run `skaile init` first");
+    process.exit(1);
+  }
+  const resolved = path14__default.resolve(filePath);
+  if (!existsSync(resolved)) {
+    logErr(`File not found: ${resolved}`);
+    process.exit(1);
+  }
+  const { parsePresetYaml } = await import('../library/index.js');
+  const parseResult = parsePresetYaml(readFileSync(resolved, "utf-8"));
+  if (!parseResult.ok || !parseResult.preset) {
+    logErr("Preset validation failed:");
+    for (const err of parseResult.errors) console.error(`  ${S.err("\u2717")} ${err}`);
+    process.exit(1);
+  }
+  const preset = parseResult.preset;
+  if (preset.items.some((it) => it.ref.startsWith("preset:"))) {
+    logErr(NESTED_PRESET_UNSUPPORTED);
+    logInfo("Remove the nested `preset:` item(s) and re-run.");
+    process.exit(1);
+  }
+  const values = parseInputs(opts.input);
+  await promptMissingInputs(preset.items, preset.inputs, values, opts.yes === true);
+  let items;
+  try {
+    items = presetItemsToWorkspace(preset, values);
+  } catch (err) {
+    logErr(err.message);
+    process.exit(1);
+  }
+  const editor = WorkspaceYamlEditor.load(file.path);
+  const summary = applyItems(editor, file.config, items);
+  const changed = summary.addedSources.length + summary.addedDeps.length + summary.addedConnectors.length + summary.addedMcp.length;
+  if (changed > 0) editor.save();
+  printApplySummary(summary, items.envVarsToSet);
+  if (opts.deploy) {
+    await runPresetInstall(projectDir);
+  } else {
+    logInfo("Skipped deploy (--no-deploy). Run `skaile install` to deploy the new dependencies.");
+  }
+}
+function parseInputs(pairs) {
+  const out = {};
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) {
+      logErr(`Invalid --input "${pair}" \u2014 expected KEY=VALUE.`);
+      process.exit(1);
+    }
+    out[pair.slice(0, eq)] = pair.slice(eq + 1);
+  }
+  return out;
+}
+async function promptMissingInputs(presetItems, presetInputs, values, yes) {
+  const seen = /* @__PURE__ */ new Set();
+  const toPrompt = [];
+  const collect = (ph) => {
+    if (seen.has(ph.key) || isSecretPlaceholder(ph)) return;
+    seen.add(ph.key);
+    if (values[ph.key] === void 0) toPrompt.push(ph);
+  };
+  for (const input of presetInputs ?? []) collect(input);
+  for (const item of presetItems) for (const ph of item.placeholders ?? []) collect(ph);
+  if (toPrompt.length === 0 || yes || !process.stdin.isTTY) return;
+  const rl = readline2.createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    for (const ph of toPrompt) {
+      const def = getDefaultValue(ph);
+      const suffix = def !== void 0 ? ` [${String(def)}]` : "";
+      const answer = (await rl.question(`${ph.prompt ?? ph.key}${suffix}: `)).trim();
+      if (answer) values[ph.key] = answer;
+      else if (def !== void 0) values[ph.key] = String(def);
+    }
+  } finally {
+    rl.close();
+  }
+}
+function applyItems(editor, config, items) {
+  const s = {
+    addedDeps: [],
+    skippedDeps: [],
+    addedConnectors: [],
+    skippedConnectors: [],
+    unchangedConnectors: [],
+    addedMcp: [],
+    skippedMcp: [],
+    unchangedMcp: [],
+    addedSources: [],
+    skippedSources: [],
+    unchangedSources: []
+  };
+  const existingSourceUrls = new Map(
+    editor.getSources().map((src) => [normalizeRepoUrl(src.url), src])
+  );
+  for (const src of items.sources) {
+    const key = normalizeRepoUrl(src.url);
+    const existing = existingSourceUrls.get(key);
+    if (!existing) {
+      editor.setSource(src);
+      existingSourceUrls.set(key, src);
+      s.addedSources.push(src.url);
+    } else if ((existing.pin ?? void 0) !== (src.pin ?? void 0)) {
+      s.skippedSources.push({ url: src.url, keptPin: existing.pin, presetPin: src.pin });
+    } else {
+      s.unchangedSources.push(src.url);
+    }
+  }
+  for (const ref of items.dependencies) {
+    if (editor.addDependency(ref)) s.addedDeps.push(ref);
+    else s.skippedDeps.push(ref);
+  }
+  const existingConnectors = new Map((config.connectors ?? []).map((c) => [c.id, c]));
+  for (const conn of items.connectors) {
+    const existing = existingConnectors.get(conn.id);
+    if (existing) {
+      (stableEqual(existing, conn) ? s.unchangedConnectors : s.skippedConnectors).push(conn.id);
+      continue;
+    }
+    editor.setConnector(conn);
+    s.addedConnectors.push(conn.id);
+  }
+  const existingMcp = new Map((config.mcp_servers ?? []).map((m) => [m.id, m]));
+  for (const mcp of items.mcpServers) {
+    const existing = existingMcp.get(mcp.id);
+    if (existing) {
+      (stableEqual(existing, mcp) ? s.unchangedMcp : s.skippedMcp).push(mcp.id);
+      continue;
+    }
+    editor.setMcpServer(mcp);
+    s.addedMcp.push(mcp.id);
+  }
+  return s;
+}
+function stableEqual(a, b) {
+  return canonicalJson(a) === canonicalJson(b);
+}
+function canonicalJson(value) {
+  return JSON.stringify(
+    value,
+    (_k, v) => v && typeof v === "object" && !Array.isArray(v) ? Object.fromEntries(
+      Object.entries(v).sort(([x], [y]) => x.localeCompare(y))
+    ) : v
+  );
+}
+function printApplySummary(summary, envVarsToSet) {
+  const added = summary.addedSources.length + summary.addedDeps.length + summary.addedConnectors.length + summary.addedMcp.length;
+  if (added === 0) {
+    logInfo("Nothing to apply \u2014 everything was already present.");
+  } else {
+    if (summary.addedSources.length > 0) {
+      logOk(`Registered ${summary.addedSources.length} source(s).`);
+    }
+    logOk(
+      `Applied ${summary.addedDeps.length} dependency(ies), ${summary.addedConnectors.length} connector(s), ${summary.addedMcp.length} mcp server(s).`
+    );
+  }
+  const skipped = [
+    ...summary.skippedSources.map(
+      (s) => `source ${s.url} (kept pin '${s.keptPin ?? "none"}', preset had '${s.presetPin ?? "none"}')`
+    ),
+    ...summary.skippedDeps.map((d) => `dependency ${d} (already present)`),
+    ...summary.skippedConnectors.map((c) => `connector ${c} (id exists, differs)`),
+    ...summary.skippedMcp.map((m) => `mcp ${m} (id exists, differs)`)
+  ];
+  for (const line of skipped) logWarn(`Skipped ${line}`);
+  const unchanged = summary.unchangedConnectors.length + summary.unchangedMcp.length + summary.unchangedSources.length;
+  if (unchanged > 0)
+    logInfo(`${unchanged} source/connector/mcp entry(ies) already matched \u2014 left as-is.`);
+  if (envVarsToSet.length > 0) {
+    logWarn(
+      `This preset references secrets by env var \u2014 provide them before running: ${envVarsToSet.join(", ")}`
+    );
+    logInfo("Add them to .env (gitignored) or export in your shell, e.g. export <VAR>=\u2026");
+  }
+}
+async function runPresetInstall(projectDir) {
+  try {
+    const { AssetManager: AssetManager2 } = await import('../asset-manager/index.js');
+    const am2 = new AssetManager2({ projectDir });
+    logInfo("Installing new dependencies\u2026");
+    const result = await am2.install({});
+    for (const d of result.deployed) logOk(d);
+    for (const m of result.missing) logErr(`Missing: ${m}`);
+    await reportInstalledSoftDeps(am2);
+  } catch (err) {
+    logErr(`Install failed: ${err instanceof Error ? err.message : String(err)}`);
+    logInfo("Run `skaile install` to deploy the new dependencies.");
+  }
+}
+async function loadPresetForValidation(resolved) {
+  if (!existsSync(resolved)) {
+    logErr(`File not found: ${resolved}`);
+    process.exit(1);
+  }
+  const content = readFileSync(resolved, "utf-8");
+  const { parsePresetYaml } = await import('../library/index.js');
+  const parseResult = parsePresetYaml(content);
+  if (!parseResult.ok) {
+    logErr("Preset validation failed (parse errors):");
+    for (const err of parseResult.errors) {
+      console.log(`  ${S.err("\u2717")} ${err}`);
+    }
+    process.exit(1);
+  }
+  if (!parseResult.preset) {
+    logErr("Preset validation failed: parser returned no manifest");
+    process.exit(1);
+  }
+  return parseResult.preset;
+}
+async function reportNestedPresetRefs(preset) {
+  const { detectNestedPresetRefs } = await import('../library/index.js');
+  const nestedRefs = detectNestedPresetRefs(preset);
+  if (nestedRefs.length > 0) {
+    logInfo(`Nested preset refs: ${nestedRefs.length} (depth validated at apply-time)`);
+  }
+}
+async function checkPresetCycles(preset, resolved) {
+  const { detectCycles } = await import('../discovery/index.js');
+  const presetRef = path14__default.basename(resolved, ".preset.yaml");
+  const edges = [];
+  for (const item of preset.items) {
+    if (item.ref) {
+      edges.push({ from: presetRef, to: item.ref, field: "items[].ref" });
+    }
+  }
+  if (edges.length === 0) return;
+  const cycleResult = detectCycles(edges);
+  if (!cycleResult.acyclic) {
+    logErr("Cycle detected in preset references:");
+    if (cycleResult.cyclePath) {
+      console.log(`  ${S.err("\u2717")} ${cycleResult.cyclePath.join(" \u2192 ")}`);
+    }
+    process.exit(1);
+  }
+}
+async function checkPresetPlaceholders(allPlaceholders) {
+  if (allPlaceholders.length === 0) return false;
+  const { validatePlaceholder } = await import('../library/index.js');
+  const invalidEntries = [];
+  for (const ph of allPlaceholders) {
+    if (ph.default === void 0) continue;
+    const result = validatePlaceholder(ph, ph.default);
+    if (!result.valid) {
+      invalidEntries.push({ key: ph.key, errors: result.errors });
+    }
+  }
+  if (invalidEntries.length === 0) return false;
+  logWarn("Placeholder issues:");
+  for (const r of invalidEntries) {
+    console.log(`  ${S.warn("!")} ${r.key}: ${r.errors.join(", ")}`);
+  }
+  return true;
+}
+function printPresetSummary(preset, placeholderCount, hasWarnings) {
+  console.log();
+  console.log(S.heading("  Preset Validation"));
+  console.log(`  ${S.rule(40)}`);
+  console.log(`  ${S.label("Name")}          ${preset.name}`);
+  console.log(`  ${S.label("Version")}       ${preset.version ?? "unversioned"}`);
+  console.log(`  ${S.label("Items")}         ${preset.items.length}`);
+  console.log(`  ${S.label("Inputs")}         ${preset.inputs?.length ?? 0}`);
+  console.log(`  ${S.label("Placeholders")}  ${placeholderCount}`);
+  console.log();
+  if (hasWarnings) {
+    logWarn("Validation passed with warnings");
+  } else {
+    logOk("Preset is valid");
+  }
+}
+async function runPresetValidate(filePath) {
+  const resolved = path14__default.resolve(filePath);
+  const preset = await loadPresetForValidation(resolved);
+  await reportNestedPresetRefs(preset);
+  await checkPresetCycles(preset, resolved);
+  const allPlaceholders = preset.items.flatMap((item) => item.placeholders ?? []);
+  const hasWarnings = await checkPresetPlaceholders(allPlaceholders);
+  printPresetSummary(preset, allPlaceholders.length, hasWarnings);
+}
+function generatePresetTemplate(name) {
+  return `# ${name}.preset.yaml
+# Polymorphic Preset \u2014 composition + configuration primitive for the asset store.
+# See: _devlog/specs/2026-05-03-ai-asset-store-v2-design.md \xA7 Presets
+
+name: "${name}"
+version: "1.0.0"
+description: "TODO: describe what this preset configures"
+
+# Placeholders \u2014 values the user provides at apply-time.
+# Types: text, multiline, secret, number, boolean, enum, oauth, instance-picker
+placeholders:
+  - key: EXAMPLE_KEY
+    type: text
+    label: "Example placeholder"
+    required: true
+    # default: "some-value"
+    # hint: "Help text shown to the user"
+
+# Items \u2014 each becomes a Library Instance when the preset is applied.
+# Ref types:
+#   - Asset ref (kind:publisher/name@pin) \u2192 creates new Instance
+#   - Library Instance ref (#uuid) \u2192 reuses existing Instance
+#   - Nested Preset ref (preset:path.preset.yaml) \u2192 recursive apply (max depth 3)
+items:
+  - id: example-item
+    ref: "skill:@skaile/example-skill@^1.0"
+    config:
+      # Use \${INPUT:EXAMPLE_KEY} for placeholder interpolation
+      setting: "\${INPUT:EXAMPLE_KEY}"
+    # credential_ref: "\${SECRET:EXAMPLE_KEY}"  # for secret placeholders
+`;
+}
+function makeRebuildCommand() {
+  return new Command("rebuild").description("Re-snapshot inline-snapshot composition items and bump prompt version").argument("[agent]", "Agent name or path (defaults to current project agent)").option("--project-dir <dir>", "Project directory", process.cwd()).action(async (agentArg, opts) => {
+    const projectDir = path14__default.resolve(opts.projectDir);
+    let agentDir;
+    if (agentArg) {
+      if (agentArg.includes("/") || agentArg.includes("\\")) {
+        agentDir = path14__default.resolve(projectDir, agentArg);
+      } else {
+        const resolved = resolveAgentDir(projectDir);
+        agentDir = resolved ?? path14__default.resolve(projectDir, agentArg);
+      }
+    } else {
+      const resolved = resolveAgentDir(projectDir);
+      if (!resolved) {
+        logErr("No agent found in current project. Specify an agent name or path.");
+        process.exit(1);
+      }
+      agentDir = resolved;
+    }
+    const manifest = await loadAgentManifest(agentDir);
+    if (!manifest) {
+      logErr(`No agent.yaml found in ${agentDir}`);
+      process.exit(1);
+    }
+    if (!manifest.composes || manifest.composes.length === 0) {
+      logInfo("Agent has no composes: items \u2014 nothing to rebuild.");
+      return;
+    }
+    logInfo(
+      `Rebuilding ${manifest.name ?? "agent"} (${manifest.composes.length} composition items)...`
+    );
+    const loadContent = async (ref, kind) => {
+      try {
+        const repos = {};
+        const mixinKind = kind;
+        const resolved = await resolveMixin(ref, mixinKind, agentDir, repos);
+        return resolved?.content ?? null;
+      } catch {
+        return null;
+      }
+    };
+    const result = await compileComposition({
       agentDir,
       items: manifest.composes,
       loadContent
@@ -5523,6 +6164,21 @@ function makeRebuildCommand() {
     logInfo(`Written: ${result.manifestPath}`);
   });
 }
+
+// cli/src/driver-error.ts
+function friendlyDriverError(err) {
+  const e = err;
+  if (!e) return null;
+  const isSpawnEnoent = e.code === "ENOENT" && (e.syscall?.startsWith("spawn") === true || /^spawn .*ENOENT/.test(e.message ?? ""));
+  const isConfig = e.category === "config" || e.detail?.category === "config";
+  if (!isSpawnEnoent && !isConfig) return null;
+  const hint = e.hint ?? e.detail?.hint;
+  const base = hint ?? "The configured agent binary is not installed or not on your PATH.";
+  return `${base}
+Try a different backend with \`--driver claude-sdk\`.`;
+}
+
+// cli/src/commands/run.ts
 function makeFlowEventHandler() {
   const md = new MarkdownStreamer();
   const displayed = /* @__PURE__ */ new Set();
@@ -5608,14 +6264,24 @@ function makeRunCommand() {
         }
         process.exit(1);
       }
-      await runAgentChat({
-        projectDir,
-        driver: config.driver,
-        model: config.model,
-        provider: config.provider,
-        message: textPrompt,
-        skill: opts.skill
-      });
+      try {
+        await runAgentChat({
+          projectDir,
+          driver: config.driver,
+          model: config.model,
+          provider: config.provider,
+          message: textPrompt,
+          skill: opts.skill
+        });
+      } catch (err) {
+        const friendly = friendlyDriverError(err);
+        if (friendly) {
+          logErr(friendly);
+        } else {
+          logErr(err instanceof Error ? err.message : String(err));
+        }
+        process.exit(1);
+      }
       return;
     }
     let flow;
@@ -5634,17 +6300,23 @@ function makeRunCommand() {
     if (opts.label) console.log(`  ${S.label("Label:")}       ${opts.label}`);
     if (dryRun) console.log(`  ${S.warn("(dry run \u2014 no agent will be started)")}`);
     console.log();
-    await runFlow({
-      projectDir,
-      flowPath,
-      driver,
-      model,
-      provider,
-      sessionLabel: opts.label,
-      dryRun,
-      onEvent: makeFlowEventHandler(),
-      onLog: (line) => console.log(line)
-    });
+    try {
+      await runFlow({
+        projectDir,
+        flowPath,
+        driver,
+        model,
+        provider,
+        sessionLabel: opts.label,
+        dryRun,
+        onEvent: makeFlowEventHandler(),
+        onLog: (line) => console.log(line)
+      });
+    } catch (err) {
+      const friendly = friendlyDriverError(err);
+      logErr(friendly ?? (err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
   });
   return cmd;
 }
@@ -5786,12 +6458,12 @@ function makeServeCommand() {
   );
 }
 async function ensurePluginsLoadedForServe(projectDir) {
-  const { logInfo: logInfo2, logWarn: logWarn2 } = await import('../helpers-2OL4FRFB.js');
+  const { logInfo: logInfo2, logWarn: logWarn2 } = await import('../helpers-TF7GCBRQ.js');
   try {
     const { resolveSkWorkspaceConfig: resolveSkWorkspaceConfig2 } = await import('../core/index.js');
     const config = resolveSkWorkspaceConfig2(projectDir);
     if (!config.plugins || config.plugins.length === 0) return;
-    const { ensurePluginsLoaded } = await import('../plugin-store-G4HKWCTU.js');
+    const { ensurePluginsLoaded } = await import('../plugin-store-S7OMGI7N.js');
     const { pluginRegistry } = await import('../plugin-registry/index.js');
     const result = await ensurePluginsLoaded(projectDir, config.plugins, pluginRegistry);
     if (result.loaded.length > 0) {
@@ -5805,21 +6477,21 @@ async function ensurePluginsLoadedForServe(projectDir) {
   }
 }
 async function runCompileTest(opts) {
-  const { logOk: logOk2, logErr: logErr2, logInfo: logInfo2, S: S2 } = await import('../helpers-2OL4FRFB.js');
+  const { logOk: logOk2, logErr: logErr2, logInfo: logInfo2, S: S2 } = await import('../helpers-TF7GCBRQ.js');
   const { tmpdir } = await import('os');
-  const { dirname: dirname4, join: join5, resolve: resolve5 } = await import('path');
+  const { dirname: dirname4, join: join6, resolve: resolve5 } = await import('path');
   const { fileURLToPath: fileURLToPath2 } = await import('url');
-  const { unlinkSync, existsSync: existsSync13 } = await import('fs');
+  const { unlinkSync, existsSync: existsSync14 } = await import('fs');
   const { spawn } = await import('child_process');
   const { portableSpawnSync: portableSpawnSync2 } = await import('../core/index.js');
-  const { MONOREPO_ROOT } = await import('../paths-ML33B5SB.js');
+  const { MONOREPO_ROOT } = await import('../paths-P3DWFUPS.js');
   if (MONOREPO_ROOT === null) {
     logErr2("--compile-test is only available inside the skaile-dev workspace.");
     logInfo2("Run it from a checkout of skaile-ai/skaile-dev (the monorepo shell).");
     process.exitCode = 2;
     return;
   }
-  const outfile = join5(tmpdir(), `skaile-compile-test-${Date.now()}`);
+  const outfile = join6(tmpdir(), `skaile-compile-test-${Date.now()}`);
   const __thisFile = fileURLToPath2(import.meta.url);
   const entryPoint = resolve5(dirname4(__thisFile), "..", "index.ts");
   logInfo2(`Building compiled binary...`);
@@ -5871,7 +6543,7 @@ async function runCompileTest(opts) {
     } catch {
     }
     try {
-      if (existsSync13(outfile)) unlinkSync(outfile);
+      if (existsSync14(outfile)) unlinkSync(outfile);
     } catch {
     }
   }
@@ -6625,96 +7297,37 @@ function makeShowCommand() {
     }
   });
 }
+async function fetchIdentity() {
+  const jwt = await getStoreToken();
+  return storeFetch({ ...getStoreConfig(), jwt }, "/api/v1/me");
+}
 function makeStoreCommand() {
   const store = new Command("store").description("Manage the AI Asset Store");
-  store.command("login").description("Authenticate with the store").option("--email <email>", "Login with email instead of GitHub").action(async (opts) => {
-    const config = getStoreConfig();
-    if (opts.email) {
-      const readline2 = await import('readline');
-      const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
-      const password = await new Promise((resolve5) => {
-        rl.question("Password: ", (answer) => {
-          rl.close();
-          resolve5(answer);
-        });
-      });
-      try {
-        const res = await storeFetch(
-          config,
-          "/api/auth/login",
-          { method: "POST", body: { email: opts.email, password } }
-        );
-        saveStoreTokens(res.jwt, res.refreshToken);
-        logOk(`Logged in as ${S.brand(`@${res.publisher.slug}`)}`);
-      } catch (e) {
-        logErr(e.message);
-        process.exit(1);
-      }
-    } else {
-      const loginUrl = `${config.url}/api/auth/login/github`;
-      console.log(`
-  Opening browser to authenticate...
-  ${S.dim(loginUrl)}
-`);
-      const http = await import('http');
-      const { URL: URL2 } = await import('url');
-      const server = http.createServer((req, res) => {
-        const url = new URL2(req.url ?? "/", "http://localhost");
-        const jwt = url.searchParams.get("token");
-        const refresh = url.searchParams.get("refresh");
-        if (jwt && refresh) {
-          saveStoreTokens(jwt, refresh);
-          res.writeHead(200, { "Content-Type": "text/html" });
-          res.end("<h2>Authenticated! You can close this tab.</h2>");
-          logOk("Authenticated with the store");
-          server.close();
-        } else {
-          res.writeHead(400);
-          res.end("Missing tokens");
-        }
-      });
-      server.listen(0, () => {
-        const port = server.address()?.port;
-        const open = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-        import('child_process').then(({ exec }) => {
-          exec(`${open} "${loginUrl}"`);
-        });
-        console.log(`  ${S.dim(`Listening on http://localhost:${port} for callback...`)}`);
-      });
-      setTimeout(() => {
-        logErr("Login timed out");
-        server.close();
-        process.exit(1);
-      }, 12e4);
+  store.command("login").description("Sign in to the store (Keycloak device flow \u2014 approve in your browser)").action(async () => {
+    try {
+      await deviceLogin(loadStoreAuthConfig());
+      const me = await fetchIdentity().catch(() => ({}));
+      logOk(`Signed in${me.username ? ` as ${S.brand(`@${me.username}`)}` : "."}`);
+    } catch (e) {
+      logErr(e.message);
+      process.exit(1);
     }
   });
-  store.command("logout").description("Sign out of the store").action(async () => {
-    const config = getStoreConfig();
-    if (config.refreshToken) {
-      try {
-        await storeFetch(config, "/api/auth/logout", {
-          method: "POST",
-          body: { refreshToken: config.refreshToken }
-        });
-      } catch {
-      }
-    }
-    clearStoreTokens();
-    logOk("Logged out");
+  store.command("logout").description("Sign out of the store").action(() => {
+    logout(loadStoreAuthConfig());
+    logOk("Signed out.");
   });
   store.command("whoami").description("Show current store identity").action(async () => {
-    const config = getStoreConfig();
-    if (!isStoreAuthenticated(config)) {
-      logErr("Not authenticated. Run: skaile store login");
+    if (!hasStoredAuth(loadStoreAuthConfig())) {
+      logErr("Not signed in. Run: skaile store login");
       process.exit(1);
     }
     try {
-      const me = await storeFetch(config, "/api/auth/me");
+      const me = await fetchIdentity();
       console.log();
-      console.log(`  ${S.heading("Publisher")}  ${S.brand(`@${me.slug}`)}`);
-      console.log(`  ${S.label("Name")}       ${me.displayName}`);
-      console.log(`  ${S.label("Email")}      ${me.email}`);
-      console.log(`  ${S.label("Verified")}   ${me.verified ? S.ok("yes") : S.dim("no")}`);
+      console.log(`  ${S.heading("Publisher")}  ${S.brand(`@${me.username ?? "?"}`)}`);
+      if (me.githubLogin) console.log(`  ${S.label("GitHub")}     ${me.githubLogin}`);
+      if (me.roles?.length) console.log(`  ${S.label("Roles")}      ${me.roles.join(", ")}`);
       console.log();
     } catch (e) {
       logErr(e.message);
@@ -6752,9 +7365,8 @@ function makeStoreCommand() {
     process.exit(2);
   });
   store.command("yank <version>").description("Yank (soft-delete) a published version").option("--asset <ref>", "Asset reference (@publisher/slug)").action(async (version, opts) => {
-    const config = getStoreConfig();
-    if (!isStoreAuthenticated(config)) {
-      logErr("Not authenticated. Run: skaile store login");
+    if (!isStoreAuthenticated()) {
+      logErr("Not signed in. Run: skaile store login");
       process.exit(1);
     }
     if (!opts.asset) {
@@ -6768,7 +7380,8 @@ function makeStoreCommand() {
       process.exit(1);
     }
     try {
-      await storeFetch(config, `/api/assets/${publisher}/${slug}/${version}/yank`, {
+      const jwt = await getStoreToken();
+      await storeFetch({ ...getStoreConfig(), jwt }, `/api/assets/${publisher}/${slug}/${version}/yank`, {
         method: "PATCH"
       });
       logOk(`Yanked v${version} of @${publisher}/${slug}`);
@@ -7448,12 +8061,43 @@ function makeVerifyCommand() {
     }
   });
 }
+function refKindName(ref) {
+  const trimmed = ref.trim();
+  const colon = trimmed.indexOf(":");
+  let kind = colon === -1 ? void 0 : trimmed.slice(0, colon);
+  if (kind === "mcp") kind = "mcp-server";
+  let rest = colon === -1 ? trimmed : trimmed.slice(colon + 1);
+  const hash = rest.indexOf("#");
+  if (hash !== -1) rest = rest.slice(0, hash);
+  if (rest.startsWith("@")) {
+    const slash = rest.indexOf("/");
+    if (slash !== -1) rest = rest.slice(slash + 1);
+  }
+  return { kind, name: rest };
+}
+function whyEmptyMessage(ref, declared) {
+  const { kind, name } = refKindName(ref);
+  const isDeclared = declared.some(
+    (d) => d.name === name && (kind === void 0 || d.kind === kind)
+  );
+  if (isDeclared) {
+    return `${ref} not found in lock file. Run \`skaile install\` first.`;
+  }
+  return `${ref} is not a dependency of this project \u2014 nothing in skaile.yaml requires it. Run \`skaile list\` to see declared dependencies.`;
+}
 function makeWhyCommand() {
   return new Command("why").description("Show why an asset is installed (dependency chain)").argument("<ref>", "Asset reference (kind:name)").option("--project-dir <path>", "Project directory", process.cwd()).action(async (ref, opts) => {
     const am2 = new AssetManager({ projectDir: path14__default.resolve(opts.projectDir) });
     const chain = am2.why(ref);
     if (chain.length === 0) {
-      logErr(`${ref} not found in lock file. Run \`skaile install\` first.`);
+      let declared;
+      try {
+        declared = am2.listDeclared();
+      } catch {
+        logErr(`${ref} not found in lock file. Run \`skaile install\` first.`);
+        return;
+      }
+      logErr(whyEmptyMessage(ref, declared));
       return;
     }
     console.log();
@@ -7599,7 +8243,7 @@ program.command("init [project-dir]").description("Initialize a project director
 );
 async function runInit(projectDir, opts) {
   const { mkdirSync: mkdirSync5, writeFileSync: writeFileSync4 } = await import('fs');
-  const { stringify } = await import('yaml');
+  const { stringify: stringify2 } = await import('yaml');
   const { DRIVER_TARGETS, SUPPORTED_DRIVER_TARGETS: SUPPORTED_DRIVER_TARGETS2 } = await import('../core/index.js');
   const backend = opts.backend;
   if (!SUPPORTED_DRIVER_TARGETS2.includes(backend)) {
@@ -7610,29 +8254,29 @@ async function runInit(projectDir, opts) {
   const resolved = path14__default.resolve(projectDir ?? ".");
   const projectName = path14__default.basename(resolved);
   const created = [];
-  const { existsSync: existsSync13 } = await import('fs');
-  if (!existsSync13(resolved)) {
+  const { existsSync: existsSync14 } = await import('fs');
+  if (!existsSync14(resolved)) {
     mkdirSync5(resolved, { recursive: true });
     created.push(".");
   }
   const skaileDir = path14__default.join(resolved, ".skaile");
-  if (!existsSync13(skaileDir)) {
+  if (!existsSync14(skaileDir)) {
     mkdirSync5(path14__default.join(skaileDir, "sessions"), { recursive: true });
     created.push(".skaile/");
   }
   const settingsPath = path14__default.join(skaileDir, "settings.json");
-  if (!existsSync13(settingsPath)) {
+  if (!existsSync14(settingsPath)) {
     writeFileSync4(settingsPath, "{}\n");
     created.push(".skaile/settings.json");
   }
   const wsConfigPath = path14__default.join(resolved, "skaile.yaml");
-  if (!existsSync13(wsConfigPath)) {
-    writeFileSync4(wsConfigPath, stringify(buildInitWorkspaceConfig(projectName, backend)));
+  if (!existsSync14(wsConfigPath)) {
+    writeFileSync4(wsConfigPath, stringify2(buildInitWorkspaceConfig(projectName, backend)));
     created.push("skaile.yaml");
   }
   for (const dir of new Set(Object.values(DRIVER_TARGETS[backend].local))) {
     const full = path14__default.join(resolved, dir);
-    if (!existsSync13(full)) {
+    if (!existsSync14(full)) {
       mkdirSync5(full, { recursive: true });
       created.push(`${dir}/`);
     }
@@ -7663,7 +8307,7 @@ function buildInitWorkspaceConfig(projectName, backend) {
 }
 async function initGitScaffold(resolved, created) {
   const { execSync: execSync3 } = await import('child_process');
-  const { existsSync: existsSync13, readFileSync: readFileSync8, writeFileSync: writeFileSync4 } = await import('fs');
+  const { existsSync: existsSync14, readFileSync: readFileSync8, writeFileSync: writeFileSync4 } = await import('fs');
   const gitignorePath = path14__default.join(resolved, ".gitignore");
   const entries = [
     "node_modules/",
@@ -7679,7 +8323,7 @@ async function initGitScaffold(resolved, created) {
     ".env",
     ".env.local"
   ];
-  const existing = existsSync13(gitignorePath) ? readFileSync8(gitignorePath, "utf-8") : "";
+  const existing = existsSync14(gitignorePath) ? readFileSync8(gitignorePath, "utf-8") : "";
   const have = new Set(existing.split("\n").map((l) => l.trim()));
   const append = entries.filter((e) => !have.has(e));
   if (append.length > 0) {
@@ -7688,7 +8332,7 @@ async function initGitScaffold(resolved, created) {
 `);
     if (!existing) created.push(".gitignore");
   }
-  if (!existsSync13(path14__default.join(resolved, ".git"))) {
+  if (!existsSync14(path14__default.join(resolved, ".git"))) {
     try {
       execSync3("git init", { cwd: resolved, stdio: "pipe" });
       created.push(".git/");
@@ -7718,7 +8362,7 @@ async function bootstrapUserConfig() {
 }
 async function hydrateInitSources(resolved, created) {
   try {
-    const { ensureSourcesCloned } = await import('../ensure-sources-4BAJGJRK.js');
+    const { ensureSourcesCloned } = await import('../ensure-sources-QDVFUIUP.js');
     const hydrate = ensureSourcesCloned(resolved, { quiet: true });
     for (const n of hydrate.cloned) created.push(`~/.skaile/cache/sources/${n}/`);
     if (hydrate.failed.length > 0) {
@@ -7751,10 +8395,14 @@ function printInitSummary(resolved, projectDir, created) {
   console.log(
     `  ${S.dim(`${step}.`)} ${S.cmd("skaile search <query>")} ${S.dim("\u2014 find assets to add")}`
   );
+  step++;
+  console.log(
+    `  ${S.dim(`${step}.`)} ${S.cmd("skaile preset apply <file>")} ${S.dim("\u2014 apply a saved preset (assets + config) at once")}`
+  );
   console.log();
 }
 program.command("setup").description("Interactive provider setup wizard").action(async () => {
-  const { cmdSetup } = await import('../setup-WS6PF6JQ.js');
+  const { cmdSetup } = await import('../setup-2CCS63L6.js');
   await cmdSetup([], { projectDir: process.cwd() });
 });
 program.addCommand(makeInstallCommand());