@skaile/workspaces 1.3.0 → 1.5.0

package/dist/cli/src/commands/catalog.d.ts

@@ -3,7 +3,25 @@
  * All delegate to @skaile/workspaces/asset-manager's AssetManager class.
  */
 import { AssetManager } from "@skaile/workspaces/asset-manager";
+import { type CatalogEntry } from "@skaile/workspaces/core";
+import type { CatalogAsset } from "@skaile/workspaces/plugins";
 import { Command } from "commander";
+/**
+ * Copyable install ref for a store catalog asset — `kind:@<publisher>/<name>#<version>`,
+ * the exact shape `skaile add` accepts.
+ */
+export declare function catalogAssetRef(a: CatalogAsset): string;
+/**
+ * Copyable ref for a local index entry. Uses `kind:@<publisher>/<name>` when a
+ * publisher is known; local assets without one fall back to the bare name.
+ */
+export declare function localEntryRef(e: Pick<CatalogEntry, "kind" | "name" | "publisher">): string;
+/**
+ * Client-side text filter over catalog assets — the store's `listAssets` has no
+ * server-side query. Case-insensitive match across name, description, publisher;
+ * an empty query returns every asset.
+ */
+export declare function filterCatalogAssets(assets: CatalogAsset[], query: string | undefined): CatalogAsset[];
 /**
  * Create the `skaile search` command.
  *

package/dist/cli/src/commands/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,YAAY,EAMb,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAqK5C;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAW3C;AAwBD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,GAAG,KAAK,CAAC,EAChD,GAAG,EAAE,MAAM,EACX,EAAE,EAAE;IACF,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;IACxD,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACtC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GACA,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,+BAA+B,GAAG,QAAQ,CAAC,EAClE,GAAG,EAAE,MAAM,EACX,EAAE,EAAE;IACF,KAAK,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;IACxD,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACtC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GACA,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAmExC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAsC3C;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAkEzC;AA0DD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAsCzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAkB3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CA2B3C"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,YAAY,EAMb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,KAAK,YAAY,EAKlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAe5C;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,GAAG,MAAM,CAE1F;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,YAAY,EAAE,EACtB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,YAAY,EAAE,CAShB;AA0PD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAW3C;AAwBD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,GAAG,KAAK,CAAC,EAChD,GAAG,EAAE,MAAM,EACX,EAAE,EAAE;IACF,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;IACxD,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACtC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GACA,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,+BAA+B,GAAG,QAAQ,CAAC,EAClE,GAAG,EAAE,MAAM,EACX,EAAE,EAAE;IACF,KAAK,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;IACxD,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACtC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GACA,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAmExC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAsC3C;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAkEzC;AA0DD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAsCzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAkB3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CA2B3C"}

package/dist/cli/src/commands/library-cmd.d.ts

@@ -4,8 +4,8 @@
  *
  * Lifecycle subcommands: list, status, show, init, link, create, default,
  * rename, set, remove. Git verbs (commit, pull, push, propose, git, sync)
- * apply to git-backed libraries. Publish/register/yank are scaffolded stubs
- * that will land when the store publish endpoint is finalised.
+ * apply to git-backed libraries. Publish/register/yank (in `library-publish.ts`)
+ * push + register the library repo and publish its manifest to the store.
  *
  * @docLink cli/commands/library
  */

package/dist/cli/src/commands/library-cmd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"library-cmd.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/library-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAgB5C,wBAAgB,kBAAkB,IAAI,OAAO,CAgiB5C"}
+{"version":3,"file":"library-cmd.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/library-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAO5C,wBAAgB,kBAAkB,IAAI,OAAO,CAqjB5C"}

package/dist/cli/src/commands/library-publish.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `skaile library publish / register / yank` — the first-party publish flow.
+ * A git-backed library you own carries an in-repo `skaile.manifest.yaml`; this
+ * commits + pushes the library repo (publish), or takes the current remote HEAD
+ * as-is (register), then registers + syncs it as a store source and publishes
+ * the manifest's assets under the manifest's own `publisher` (no namespace
+ * remap — first-party authors intend their declared namespace).
+ *
+ *   - `publish`  = commit (if dirty) + push + register + sync + publish.
+ *   - `register` = same, but skip the commit/push (bytes already on GitHub).
+ *   - `yank`     = unpublish the library's published assets (all, or one).
+ *
+ * The store REST surface is reached through the injectable {@link PublisherClient}
+ * (default HTTP); git side-effects go through an injectable `spawn`. Both seams
+ * keep the flow unit/integration-testable without a live store or a real remote.
+ *
+ * @docLink cli/commands/library
+ */
+import { spawnSync } from "node:child_process";
+import { type PublisherClient } from "../store-publisher.ts";
+/** Injectable spawn contract — the subset of `spawnSync` these helpers use. */
+type SpawnLike = typeof spawnSync;
+/**
+ * `skaile library publish <lib>` — commit + push the library repo, register +
+ * sync it as a store source, and publish its manifest's assets under the
+ * manifest publisher. See the module header for the full flow.
+ */
+export declare function runLibraryPublish(name: string, opts: {
+    asset?: string;
+    createRepo?: boolean;
+    ref?: string;
+    dryRun?: boolean;
+}, client?: PublisherClient, spawn?: SpawnLike): Promise<void>;
+/**
+ * `skaile library register <lib>` — same as publish but skips the commit/push
+ * (the bytes are already on GitHub at the current remote HEAD). Still requires a
+ * git-backed remote.
+ */
+export declare function runLibraryRegister(name: string, opts: {
+    asset?: string;
+    ref?: string;
+    dryRun?: boolean;
+}, client?: PublisherClient, spawn?: SpawnLike): Promise<void>;
+/**
+ * `skaile library yank <lib>` — unpublish the library's published assets from
+ * the store (all, or the single asset matching `opts.asset`'s name).
+ * Auth-gated like publish.
+ */
+export declare function runLibraryYank(name: string, opts: {
+    asset?: string;
+}, client?: PublisherClient): Promise<void>;
+export {};
+//# sourceMappingURL=library-publish.d.ts.map

package/dist/cli/src/commands/library-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-publish.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/library-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAQ/C,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGtF,+EAA+E;AAC/E,KAAK,SAAS,GAAG,OAAO,SAAS,CAAC;AA6OlC;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC9E,MAAM,CAAC,EAAE,eAAe,EACxB,KAAK,GAAE,SAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EACxD,MAAM,CAAC,EAAE,eAAe,EACxB,KAAK,GAAE,SAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EACxB,MAAM,CAAC,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAkDf"}

package/dist/cli/src/commands/preset-apply.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `skaile preset apply` — pure core: reverse a `.preset.yaml` snapshot back into
+ * a workspace's `skaile.yaml` sections (the inverse of `preset export`).
+ *
+ * These helpers are I/O- and prompt-free so they can be unit-tested in
+ * isolation. The Commander action in `preset-cmd.ts` owns file reads, the
+ * interactive prompting for non-secret inputs, the editor writes, and the
+ * post-apply install.
+ */
+import type { ConnectorDeclaration, McpServerDeclaration, SourceEntry } from "@skaile/workspaces/core";
+import type { Placeholder, PresetManifest } from "@skaile/workspaces/types/manifests";
+/** The workspace sections produced by reversing a preset's items. */
+export interface WorkspaceItems {
+    /** Bare dependency refs, copied verbatim from non-connector/mcp items. */
+    dependencies: string[];
+    /** Connector declarations rebuilt from `connector:<driver>` items. */
+    connectors: ConnectorDeclaration[];
+    /** MCP server declarations rebuilt from `mcp:<id>` items. */
+    mcpServers: McpServerDeclaration[];
+    /** Git sources the deps resolve from — registered before install. */
+    sources: SourceEntry[];
+    /** Secret placeholder keys the user must export as env vars before running. */
+    envVarsToSet: string[];
+}
+/** Rejection message for nested preset refs (unsupported by v1 apply). */
+export declare const NESTED_PRESET_UNSUPPORTED = "nested presets are not supported by `preset apply` yet";
+/**
+ * Resolve one placeholder to the value that lands in `skaile.yaml`.
+ *
+ * A secret placeholder NEVER yields its raw value — it resolves to an
+ * `env:<KEY>` indirection reference so the credential stays out of the file.
+ * A non-secret placeholder resolves to the provided literal (or its declared
+ * default); a required non-secret placeholder with neither throws.
+ *
+ * @param placeholder - The placeholder definition from the preset item.
+ * @param providedValue - Value supplied via `--input`/prompt, or `undefined`.
+ * @returns `{ envRef }` for secrets, `{ value }` for resolved literals.
+ * @throws When a required non-secret placeholder has no value and no default.
+ */
+export declare function resolvePlaceholderValue(placeholder: Placeholder, providedValue: string | undefined): {
+    value: string;
+} | {
+    envRef: string;
+};
+/**
+ * Reverse a preset's items into additive `skaile.yaml` sections.
+ *
+ * Items are classified by **`id` presence** (export writes one on connector/mcp
+ * items, never on deps), so a bare `mcp:excel` shorthand stays a dependency.
+ * Secret tokens resolve to `env:<KEY>` refs (collected into `envVarsToSet`).
+ *
+ * @param preset - The validated preset manifest.
+ * @param values - Resolved non-secret input values, keyed by placeholder key.
+ * @returns The workspace sections plus the secret env-var keys to set.
+ * @throws When a required non-secret placeholder is unresolved, or a nested
+ *   preset ref is encountered (unsupported by apply).
+ */
+export declare function presetItemsToWorkspace(preset: PresetManifest, values: Record<string, string>): WorkspaceItems;
+//# sourceMappingURL=preset-apply.d.ts.map

package/dist/cli/src/commands/preset-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preset-apply.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/preset-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACZ,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAc,MAAM,oCAAoC,CAAC;AAElG,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sEAAsE;IACtE,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,6DAA6D;IAC7D,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,qEAAqE;IACrE,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAKD,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,2DAA2D,CAAC;AAElG;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAexC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,cAAc,CA+BhB"}

package/dist/cli/src/commands/preset-cmd.d.ts

@@ -1,9 +1,10 @@
 /**
- * skaile preset — scaffold and validate preset YAML files.
+ * skaile preset — scaffold, validate, export, and apply preset YAML files.
  *
- * Subcommands: init, validate.
+ * Subcommands: init, validate, export, apply.
  * Delegates to @skaile/library preset module for parsing and validation.
  */
+import { type Placeholder } from "@skaile/workspaces/types/manifests";
 import { Command } from "commander";
 /**
  * Creates the `skaile preset` command group.
@@ -16,4 +17,9 @@ import { Command } from "commander";
  * @docLink cli/commands/misc#preset
  */
 export declare function makePresetCommand(): Command;
+/**
+ * Validate per-item placeholder structure (dry-run with no input values).
+ * Returns true when any placeholder issues were surfaced as warnings.
+ */
+export declare function checkPresetPlaceholders(allPlaceholders: Placeholder[]): Promise<boolean>;
 //# sourceMappingURL=preset-cmd.d.ts.map

package/dist/cli/src/commands/preset-cmd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preset-cmd.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/preset-cmd.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAsC3C"}
+{"version":3,"file":"preset-cmd.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/preset-cmd.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,EACL,KAAK,WAAW,EAGjB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBpC;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CA0E3C;AAwhBD;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,eAAe,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAqB9F"}

package/dist/cli/src/commands/preset-export.d.ts

@@ -0,0 +1,102 @@
+/**
+ * `skaile preset export` — pure core: turn a project's own `skaile.yaml`
+ * (`SkWorkspaceConfig`) into a shareable `PresetManifest`, with first-class
+ * detection and redaction of inline secrets.
+ *
+ * These helpers are intentionally free of I/O and prompting so they can be
+ * unit-tested in isolation; the Commander action in `preset-cmd.ts` owns file
+ * reads/writes, the loud stderr summary, and interactive confirmation.
+ */
+import { type LockFile, type SkWorkspaceConfig, type SourceEntry } from "@skaile/workspaces/core";
+import type { PresetManifest } from "@skaile/workspaces/types/manifests";
+/** One inline-secret hit: which item, where in its config, and a safe preview. */
+export interface SecretFinding {
+    /** `id` of the offending preset item (connector/mcp id). */
+    itemId: string;
+    /** Dotted path into the item's `config`, e.g. `options.dsn` or `env.TOKEN`. */
+    path: string;
+    /** Value with its secret portion masked, safe to print to a terminal. */
+    maskedValue: string;
+}
+/**
+ * Build a self-consistent {@link PresetManifest} from a workspace config.
+ *
+ * Mapping (a future `preset apply` reverses this):
+ * - `dependencies[]` → `{ ref }` items, ref copied VERBATIM (no re-pinning).
+ * - `connectors[]` → `{ id, ref: "connector:<driver>", config }` items.
+ * - `mcp_servers[]` → `{ id, ref: "mcp:<id>", config }` items.
+ *
+ * `agent_config` is deliberately NOT exported — it is personal/machine-specific
+ * (driver, model, API-cloud transport) and does not belong in a shared preset.
+ *
+ * @param config - The project-own `skaile.yaml` (NOT the merged/global config).
+ * @param name - Preset name; also the default output filename stem.
+ * @param sources - Git sources the dep items resolve from (see {@link neededSources}).
+ * @returns A manifest that passes `validatePreset` whenever it has ≥1 item.
+ */
+export declare function buildPresetFromWorkspace(config: SkWorkspaceConfig, name: string, sources?: SourceEntry[]): PresetManifest;
+/**
+ * The subset of `config.sources` a cross-repo apply must register before install.
+ *
+ * The lock's top-level `sources` list is the full **transitive** closure of every
+ * source that contributed a resolved asset, so filtering `config.sources` to it
+ * (minus the always-available factory source) captures direct + transitive deps
+ * with no drop risk. With no lock (provenance unknown), every non-factory source
+ * is kept so apply still resolves. Connectors/mcp carry no source.
+ */
+export declare function neededSources(config: SkWorkspaceConfig, lock: LockFile | null): SourceEntry[];
+/**
+ * Of the captured `neededSources`, the ones whose assets resolve through a
+ * MACHINE-LOCAL curated store manifest (`~/.skaile/store/manifests/<slug>.yaml`,
+ * written by `source manifest init`). Those overlays are not shared with the
+ * preset, so a recipient on another machine won't reproduce the same resolution
+ * until the sidecar is itself published. Returns the affected source URLs (empty
+ * when none carry a sidecar).
+ */
+export declare function sourcesWithSidecar(sources: SourceEntry[]): string[];
+/**
+ * True when `value` is a secret *reference* (indirection) rather than an inline
+ * secret — e.g. `env:DATABASE_URL`, `forge:api-key`, `pat:env:GH_TOKEN`. Such
+ * values are safe to publish and are never flagged.
+ */
+export declare function isSecretReference(value: string): boolean;
+/** True when a source URL embeds `user:pass@` credentials (private-HTTPS auth form). */
+export declare function urlHasCredentials(url: string): boolean;
+/**
+ * Strip `user:pass@` userinfo from a URL. The repo is fully identified without it
+ * (git auth on apply uses the target's own credential helper / ssh key), so an
+ * exported source URL must never carry the token into a shared preset.
+ */
+export declare function stripUrlCredentials(url: string): string;
+/**
+ * Scan every string inside each item's `config` and return inline secrets.
+ *
+ * A string is flagged when it is NOT a {@link isSecretReference} AND sits in a
+ * credential context: the inherent `auth` field, a suspicious key name, a
+ * `proto://user:pass@` URL, or a long high-entropy blob. Items without a `config`
+ * (bare deps) are skipped.
+ *
+ * Detection is **heuristic / best-effort**, not exhaustive: a short, low-entropy
+ * secret under an innocuous key name can slip through. A clean scan is not a
+ * guarantee — treat it as a safety net, not proof the file holds no secrets.
+ */
+export declare function scanInlineSecrets(preset: PresetManifest): SecretFinding[];
+/**
+ * Replace each flagged inline value with a `${INPUT:<KEY>}` placeholder and add
+ * a matching `secret` placeholder entry to the owning item. Returns a NEW preset
+ * (the input is not mutated) plus the generated placeholder keys.
+ *
+ * `<KEY>` is `<itemId>_<path>` upper-snake-cased so it is stable and readable.
+ */
+export declare function redactSecrets(preset: PresetManifest, findings: SecretFinding[]): {
+    preset: PresetManifest;
+    keys: string[];
+};
+/** Exact wording written into the file when unresolved inline secrets remain. */
+export declare const INLINE_SECRETS_HEADER = "# \u26A0\uFE0F CONTAINS INLINE SECRETS \u2014 replace with placeholders before sharing or publishing";
+/**
+ * Header comment for a preset that still holds unresolved inline secrets, or
+ * `null` when `findings` is empty (nothing left to warn about).
+ */
+export declare function secretHeaderComment(findings: SecretFinding[]): string | null;
+//# sourceMappingURL=preset-export.d.ts.map

package/dist/cli/src/commands/preset-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preset-export.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/preset-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAA2B,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAElG,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;CACrB;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,WAAW,EAAO,GAC1B,cAAc,CAoDhB;AAID;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,WAAW,EAAE,CAM7F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,CAKnE;AAmBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAkBD,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa,EAAE,CASzE;AAwDD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,aAAa,EAAE,GACxB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA+B5C;AAwBD,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,yGACuD,CAAC;AAE1F;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,IAAI,CAE5E"}

package/dist/cli/src/commands/project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/project.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAOhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBpC;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,qBAAqB,CAKxF;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtE;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GAChE,OAAO,CAAC,wBAAwB,CAAC,CA8BnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAoB5C;AAkKD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,gBAAgB,CAAC,EACzD,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAA+B,GACxD,OAAO,CAAC,IAAI,CAAC,CASf;AA6CD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAkB1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAwE1C"}
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/project.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAOhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBpC;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,qBAAqB,CAKxF;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtE;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GAChE,OAAO,CAAC,wBAAwB,CAAC,CA8BnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAoB5C;AAqKD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,gBAAgB,CAAC,EACzD,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAA+B,GACxD,OAAO,CAAC,IAAI,CAAC,CASf;AA6CD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAkB1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAwE1C"}

package/dist/cli/src/commands/publish-core.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Shared store-interaction core for the two publish front-ends — the curator
+ * sidecar flow (`source manifest publish`) and the first-party library flow
+ * (`library publish`). Both differ only in their git side-effects + how they
+ * resolve the source repo; the store orchestration below (register → sync →
+ * candidates → per-asset preview+publish) is identical.
+ *
+ * The store REST surface is reached through the injectable {@link PublisherClient}
+ * so the orchestration stays unit/integration-testable without a live store.
+ *
+ * @docLink cli/commands/source#manifest-publish
+ */
+import type { SkPublishManifest } from "@skaile/workspaces/core";
+import type { PublisherClient } from "../store-publisher.ts";
+/** One candidate row shape the matcher operates on (kind + name are the key). */
+interface CandidateLike {
+    kind: string;
+    name: string;
+}
+/**
+ * Keep only candidates whose `(kind, name)` pair is declared in the manifest.
+ * The backend may merge extra assets from the base repo into the candidate
+ * list; a publish only touches what the manifest curated/declared.
+ */
+export declare function matchCandidatesToManifest<T extends CandidateLike>(candidates: T[], manifest: SkPublishManifest): T[];
+/** A canonical ref string `kind:@publisher/name[#version]` for reporting. */
+export declare function refFor(kind: string, publisher: string, name: string, version?: string): string;
+/** The bare asset name from a `kind:@publisher/name#version` ref or a plain name. */
+export declare function bareName(ref: string): string;
+/**
+ * Poll a job until it leaves `running` or the deadline passes. Returns the last
+ * observed state — the caller MUST treat a still-`running` result as a timeout
+ * (not success), since it means the deadline was hit before the job finished.
+ */
+export declare function pollJob(client: PublisherClient, jobId: string, intervalMs?: number, timeoutMs?: number): Promise<{
+    status: string;
+    items?: Array<{
+        label: string;
+        status: string;
+        error?: string;
+    }>;
+}>;
+/**
+ * True when a `sourcesAdd` rejection is a duplicate-URL conflict (the source is
+ * already registered) — the only error the publish flow recovers from by looking
+ * the existing row up. Every other failure (auth, 5xx, network) must propagate.
+ */
+export declare function isDupSourceError(err: unknown): boolean;
+/**
+ * Register + sync the source, then publish its curated/declared candidates —
+ * the store-side steps shared by both publish front-ends. Git side-effects (the
+ * sidecar push, or the library commit+push) happen in the caller *before* this;
+ * this function is purely store interaction.
+ *
+ * The sidecar front-end passes `sidecar` (so `sourcesAdd` carries the sidecar
+ * pin); the library front-end omits it (the source repo IS the manifest host).
+ * `assetName`, when set, narrows publication to the single candidate of that
+ * name. Fatal store states (`sourcesAdd` non-dup failure) surface; sync failures
+ * and empty candidate sets `process.exit(1)` with the same messages as before.
+ */
+export declare function publishToStore(opts: {
+    sourceUrl: string;
+    ref: string;
+    sidecar?: {
+        url: string;
+        ref: string;
+    };
+    manifest: SkPublishManifest;
+    assetName?: string;
+    client: PublisherClient;
+}): Promise<{
+    published: string[];
+}>;
+export {};
+//# sourceMappingURL=publish-core.d.ts.map

package/dist/cli/src/commands/publish-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-core.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/publish-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,iFAAiF;AACjF,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,aAAa,EAC/D,UAAU,EAAE,CAAC,EAAE,EACf,QAAQ,EAAE,iBAAiB,GAC1B,CAAC,EAAE,CAGL;AAED,6EAA6E;AAC7E,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAG9F;AAED,qFAAqF;AACrF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI5C;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,UAAU,SAAQ,EAClB,SAAS,SAAS,GACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAQ/F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGtD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,CAAC;CACzB,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgFnC"}

package/dist/cli/src/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/run.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgDpC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAyHxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAqC3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAoC3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAS1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAyEzC"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/run.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiDpC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAyIxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAqC3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAoC3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAS1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAyEzC"}

package/dist/cli/src/commands/source-manifest-publish.d.ts

@@ -0,0 +1,82 @@
+/**
+ * `skaile source manifest publish` / `yank` — the curator-publish flow. Takes a
+ * locally-curated sidecar manifest (over a foreign public GitHub repo) and:
+ *
+ *   1. Pushes the curated `skaile.manifest.yaml` to the curator's OWN public
+ *      "sidecar" repo (bytes stay in the foreign source; the sidecar holds only
+ *      the manifest pointing at it).
+ *   2. Registers the foreign source + the sidecar (url + pinned commit) with the
+ *      store, syncs it, and publishes each curated asset.
+ *
+ * `yank` is the inverse: unpublish each currently-published asset of the source.
+ *
+ * The store REST surface is reached through the injectable {@link PublisherClient}
+ * (default HTTP client); git side-effects go through an injectable `spawn`. Both
+ * seams keep the pure helpers + orchestration unit/integration-testable without a
+ * live store or a real remote.
+ *
+ * @docLink cli/commands/source#manifest-publish
+ */
+import { spawnSync } from "node:child_process";
+import { type SkPublishManifest } from "@skaile/workspaces/core";
+import { type PublisherClient } from "../store-publisher.ts";
+/** Injectable spawn contract — the subset of `spawnSync` these helpers use. */
+type SpawnLike = typeof spawnSync;
+/**
+ * Return a copy of `manifest` normalized for publication under `namespace`:
+ * the top-level `publisher` is set to `namespace` and every per-asset
+ * `publisher` override is removed so all assets inherit the top-level one.
+ * Pure — the input is not mutated.
+ */
+export declare function normalizePublishedManifest(manifest: SkPublishManifest, namespace: string): SkPublishManifest;
+/**
+ * The sidecar repo URL previously associated with a source `slug`, if any.
+ * Reads `settings.sidecarRepos?.[slug]?.repo`.
+ */
+export declare function getSidecarRepo(slug: string): string | undefined;
+/**
+ * Persist the sidecar repo URL for a source `slug`, preserving every other
+ * settings key. Stored as an object (`{ repo }`) so a `path` (or other fields)
+ * can be added later without a schema migration.
+ */
+export declare function saveSidecarRepo(slug: string, repo: string): void;
+/**
+ * Clone the curator's sidecar repo, write the curated manifest at its root, and
+ * commit + push. Returns the pushed commit sha (used to pin the store source).
+ *
+ * Idempotent re-publish: when the manifest is unchanged `git commit` fails with
+ * "nothing to commit" — we swallow that and return the current HEAD so a no-op
+ * re-run still yields a valid pin. Any push/auth failure surfaces as a thrown
+ * Error carrying git's stderr.
+ */
+export declare function pushSidecarManifest(opts: {
+    sidecarRepoUrl: string;
+    manifestText: string;
+    spawn?: SpawnLike;
+}): {
+    commitSha: string;
+};
+/**
+ * `source manifest publish <src>` — publish a curated sidecar manifest to the
+ * store. See the module header for the full flow. Store calls go through
+ * `client` (default HTTP); git side-effects through `spawn` (default
+ * `spawnSync`). The auth gate is enforced only for the default HTTP client so
+ * injected fakes bypass it.
+ */
+export declare function runPublish(arg: string, opts: {
+    projectDir: string;
+    as?: string;
+    sidecarRepo?: string;
+    ref?: string;
+    dryRun?: boolean;
+}, client?: PublisherClient, spawn?: SpawnLike): Promise<void>;
+/**
+ * `source manifest yank <src>` — unpublish the source's published assets (all,
+ * or the single asset matching `opts.asset`'s name). Auth-gated like publish.
+ */
+export declare function runYank(arg: string, opts: {
+    projectDir: string;
+    asset?: string;
+}, client?: PublisherClient): Promise<void>;
+export {};
+//# sourceMappingURL=source-manifest-publish.d.ts.map

package/dist/cli/src/commands/source-manifest-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-manifest-publish.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/source-manifest-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAI/C,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAStF,+EAA+E;AAC/E,KAAK,SAAS,GAAG,OAAO,SAAS,CAAC;AAElC;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,SAAS,EAAE,MAAM,GAChB,iBAAiB,CAMnB;AA0BD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAQhE;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAyDxB;AAID;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,EACD,MAAM,CAAC,EAAE,eAAe,EACxB,KAAK,GAAE,SAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwFf;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5C,MAAM,CAAC,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CA0Cf"}

package/dist/cli/src/commands/source-manifest.d.ts

@@ -1,19 +1,78 @@
 /**
- * `skaile source manifest …` — sidecar manifest lifecycle, refactored under
- * the `source` noun (was `source sidecar …`).
+ * `skaile source manifest …` — curated `skaile.manifest.yaml` lifecycle for a
+ * source you do NOT own. `init` generates a curated manifest from a discovery
+ * run and stores it OUTSIDE the source, under the local store catalog
+ * (`~/.skaile/store/manifests/<slug>.yaml`); `edit` opens it in `$EDITOR` and
+ * re-validates on save. `source add`/`sync` then apply it as a read overlay
+ * (see `source.ts` `refreshManifestCache`).
  *
- * The verbs are stubs for now — the real wiring lands when the publish path
- * through `POST /sources/<id>/manifest` is finalised on the store backend.
- * Each subcommand exits with code 2 plus a clear "not yet wired" hint so
- * smoke tests can verify the surface without depending on the server.
+ * `rebuild` refreshes a curated manifest after an upstream change (merge by
+ * default — curation is sacred; `--overwrite` re-scans). `verify` is a
+ * read-only integrity check (paths, declared hashes, schema, dep refs).
+ * `publish`/`propose`/`yank` remain stubs — they need the store publish
+ * endpoint (`POST /sources/<id>/manifest`), which lands in a follow-up.
  *
  * @docLink cli/commands/source#manifest
  */
 import type { Command } from "commander";
+/**
+ * Resolve a `source manifest` argument into a `{ url, slug, dest }` triple.
+ *
+ * Resolution order:
+ *   1. A key matching an already-registered project source (stored URL, cache
+ *      key, or short slug).
+ *   2. A collision-free **store slug** (`<host>__<owner>__<repo>`) whose
+ *      manifest already exists at `~/.skaile/store/manifests/<arg>.yaml`. This
+ *      MUST be tried before bare-name expansion: a bare name like `cli` would
+ *      otherwise expand (via `normalizeSourceUrl`) to the skaile-ai org and a
+ *      DIFFERENT slug than the one `init` wrote (e.g. `larksuite`). The slug is
+ *      the exact identifier `init`'s next-step hint prints back.
+ *   3. Otherwise a git URL / `owner/repo` / bare name via `normalizeSourceUrl`.
+ *
+ * The clone dir is the same URL-keyed cache `source add` uses.
+ */
+export declare function resolveSourceArg(arg: string, projectDir: string): {
+    url: string;
+    slug: string;
+    dest: string;
+    manifestFile: string;
+};
+/**
+ * Split a `$VISUAL`/`$EDITOR` value into `{ command, args }` and append the file
+ * as the final arg. The env value is a full command line, not a bare binary —
+ * `EDITOR="code --wait"` must spawn `code` with `["--wait", <file>]`, and
+ * `EDITOR=code` (which returns before save) is the user's problem, not ours.
+ * A whitespace split covers the common editors (`code --wait`, `code -w`,
+ * `subl -w`, `vi`); paths with embedded spaces are not supported (rare for an
+ * editor binary and out of scope). Falls back to `vi` when unset/empty.
+ *
+ * @docLink cli/commands/source#manifest-edit
+ */
+export declare function resolveEditorCommand(editorEnv: string | undefined, target: string): {
+    command: string;
+    args: string[];
+};
+/** Minimal spawn contract runEdit needs — lets tests inject a fake. */
+type SpawnLike = (command: string, args: string[], opts: {
+    stdio: "inherit";
+}) => {
+    status: number | null;
+};
+/**
+ * `source manifest edit <src>` — open the curated store manifest in `$EDITOR`
+ * and re-validate on save. Warnings are surfaced but never hard-fail.
+ *
+ * `spawn` is injectable so tests can assert the argv without launching a real
+ * editor; production passes the default `spawnSync`.
+ */
+export declare function runEdit(arg: string, opts: {
+    projectDir: string;
+}, spawn?: SpawnLike): void;
 /**
  * Append the `manifest` sub-tree to a `source` command.
  *
  * Called from `makeSourceCommand()` in `source.ts`.
  */
 export declare function addSourceManifestCommands(src: Command): void;
+export {};
 //# sourceMappingURL=source-manifest.d.ts.map

package/dist/cli/src/commands/source-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-manifest.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/source-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAwC5D"}
+{"version":3,"file":"source-manifest.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/source-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAqBH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBzC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,GACjB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAWnE;AAyZD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAIrC;AAED,uEAAuE;AACvE,KAAK,SAAS,GAAG,CACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,KACvB;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAE/B;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,EAC5B,KAAK,GAAE,SAA6C,GACnD,IAAI,CAgCN;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAqE5D"}

package/dist/cli/src/commands/source.d.ts

@@ -58,6 +58,19 @@ export declare function sourceMatchesKey(entry: SourceEntry, key: string): boole
  * (which `setSource` updates in place).
  */
 export declare function findCacheKeyCollision(sources: SourceEntry[], url: string): SourceEntry | undefined;
+export declare function readProjectSources(yamlPath: string): SourceEntry[];
+/**
+ * Clone the source if its clone directory does not yet exist. When `force` is
+ * set, the existing clone is replaced by a fresh checkout. Returns true when a
+ * clone happened. The cache slug is derived from the URL.
+ *
+ * A `--force` re-clone moves the old clone aside first and only deletes it once
+ * the fresh clone succeeds — so a failed re-clone restores the previous clone
+ * rather than leaving the source registered with no cache behind it.
+ */
+export declare function ensureClone(entry: SourceEntry, opts?: {
+    force?: boolean;
+}): boolean;
 /**
  * Auto-sync hook for `skaile search` on an unsynced workspace. Clones/pulls and
  * re-indexes every source declared in the project's `skaile.yaml`, then returns

package/dist/cli/src/commands/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAGL,KAAK,WAAW,EAKjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAKD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAEzE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYvE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIzE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,MAAM,GACV,WAAW,GAAG,SAAS,CAGzB;AAkFD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAsC5D;AAoBD,wBAAgB,iBAAiB,IAAI,OAAO,CAmR3C"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAGL,KAAK,WAAW,EAMjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAKD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAEzE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYvE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIzE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,MAAM,GACV,WAAW,GAAG,SAAS,CAGzB;AAaD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAQlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAwBvF;AA+CD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuC5D;AAoBD,wBAAgB,iBAAiB,IAAI,OAAO,CAwR3C"}

package/dist/cli/src/commands/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAqO1C"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../../cli/src/commands/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBpC;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAuJ1C"}