@skaile/workspaces 4.36.0 → 4.38.0

package/dist/{chunk-KIFJWSNC.js → chunk-KAJH3XPW.js}

@@ -1,7 +1,8 @@
+import { globalSkaileDir } from './chunk-TLKM4M47.js';
 import { DRIVER_TARGETS } from './chunk-EB4ZTESQ.js';
 import { lstatSync } from 'fs';
 import { homedir } from 'os';
-import { resolve, join } from 'path';
+import { join, resolve } from 'path';
 
 function deployedBase(kind, target, globalInstall, cwd) {
   const targetMap = DRIVER_TARGETS[target];
@@ -10,6 +11,9 @@ function deployedBase(kind, target, globalInstall, cwd) {
   const paths = targetMap[scope];
   const destStr = paths[kind] ?? paths.skill ?? "";
   if (globalInstall) {
+    if (destStr === "~/.skaile" || destStr.startsWith("~/.skaile/")) {
+      return join(globalSkaileDir(), destStr.slice("~/.skaile".length));
+    }
     return destStr.replace(/^~/, homedir());
   }
   return resolve(cwd ?? process.cwd(), destStr);
@@ -27,5 +31,5 @@ function isDeployed(kind, name, target, globalInstall, cwd) {
 }
 
 export { deployedBase, deployedDir, isDeployed };
-//# sourceMappingURL=chunk-KIFJWSNC.js.map
-//# sourceMappingURL=chunk-KIFJWSNC.js.map
+//# sourceMappingURL=chunk-KAJH3XPW.js.map
+//# sourceMappingURL=chunk-KAJH3XPW.js.map

package/dist/chunk-KAJH3XPW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/src/store.ts"],"names":[],"mappings":";;;;;;AA6BO,SAAS,YAAA,CACd,IAAA,EACA,MAAA,EACA,aAAA,EACA,GAAA,EACQ;AACR,EAAA,MAAM,SAAA,GAAY,eAAe,MAAM,CAAA;AACvC,EAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,MAAM,CAAA,CAAA,CAAG,CAAA;AACpE,EAAA,MAAM,KAAA,GAAQ,gBAAgB,QAAA,GAAW,OAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAU,KAAK,CAAA;AAC7B,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,IAAI,CAAA,IAAK,MAAM,KAAA,IAAS,EAAA;AAC9C,EAAA,IAAI,aAAA,EAAe;AAGjB,IAAA,IAAI,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/D,MAAA,OAAO,KAAK,eAAA,EAAgB,EAAG,QAAQ,KAAA,CAAM,WAAA,CAAY,MAAM,CAAC,CAAA;AAAA,IAClE;AACA,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,GAAA,IAAO,OAAO,CAAA;AAC9C;AAaO,SAAS,WAAA,CACd,IAAA,EACA,IAAA,EACA,MAAA,EACA,eACA,GAAA,EACQ;AACR,EAAA,OAAO,KAAK,YAAA,CAAa,IAAA,EAAM,QAAQ,aAAA,EAAe,GAAG,GAAG,IAAI,CAAA;AAClE;AAcO,SAAS,UAAA,CACd,IAAA,EACA,IAAA,EACA,MAAA,EACA,eACA,GAAA,EACS;AACT,EAAA,IAAI;AACF,IAAA,SAAA,CAAU,YAAY,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,aAAA,EAAe,GAAG,CAAC,CAAA;AAC7D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"chunk-KAJH3XPW.js","sourcesContent":["/**\n * Deploy-target helpers — resolve framework-specific install paths.\n *\n * This module contains only deploy path resolution. All catalog, repository,\n * and history I/O has moved to @skaile/asset-manager (project-local).\n */\n\nimport { lstatSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport { globalSkaileDir } from \"./cache-paths.js\";\nimport type { DriverTarget } from \"./driver-targets.js\";\nimport { type AiComponent, DRIVER_TARGETS } from \"./driver-targets.js\";\n\n// ── Deploy-target helpers ─────────────────────────────────────────────────────\n\n/**\n * Resolve the base deploy directory for an asset kind in a given driver target + scope.\n * For local scope, the path is relative to `cwd` (defaults to `process.cwd()`).\n * For global scope, `~` is expanded to the home directory.\n *\n * @param kind - Asset component type (e.g. `\"skill\"`, `\"agent\"`)\n * @param target - Driver target identifier (e.g. `\"claude-code\"`, `\"omp\"`)\n * @param globalInstall - `true` for user-global install, `false` for project-local\n * @param cwd - Working directory for project-local installs (default: `process.cwd()`)\n * @returns Absolute path to the base deploy directory\n * @throws When `target` is not found in `DRIVER_TARGETS`\n * @docLink packages/core/concepts#deployed-base\n */\nexport function deployedBase(\n  kind: AiComponent,\n  target: DriverTarget,\n  globalInstall: boolean,\n  cwd?: string,\n): string {\n  const targetMap = DRIVER_TARGETS[target];\n  if (!targetMap) throw new Error(`Unknown deploy target: '${target}'`);\n  const scope = globalInstall ? \"global\" : \"local\";\n  const paths = targetMap[scope];\n  const destStr = paths[kind] ?? paths.skill ?? \"\";\n  if (globalInstall) {\n    // `~/.skaile/...` is skaile's own per-user root, so it follows `$SKAILE_HOME`;\n    // every other `~/...` is a driver's home dir (`~/.claude`, `~/.omp`, ...).\n    if (destStr === \"~/.skaile\" || destStr.startsWith(\"~/.skaile/\")) {\n      return join(globalSkaileDir(), destStr.slice(\"~/.skaile\".length));\n    }\n    return destStr.replace(/^~/, homedir());\n  }\n  return resolve(cwd ?? process.cwd(), destStr);\n}\n\n/**\n * Return the full deploy path for a named asset: `<deployedBase>/<name>`.\n *\n * @param kind - Asset component type\n * @param name - Asset name (becomes the directory/file name under the base)\n * @param target - Driver target identifier\n * @param globalInstall - `true` for user-global, `false` for project-local\n * @param cwd - Working directory for local installs\n * @returns Absolute path to the asset's deploy directory\n * @docLink packages/core/concepts#deployed-dir\n */\nexport function deployedDir(\n  kind: AiComponent,\n  name: string,\n  target: DriverTarget,\n  globalInstall: boolean,\n  cwd?: string,\n): string {\n  return join(deployedBase(kind, target, globalInstall, cwd), name);\n}\n\n/**\n * Check whether an asset is already deployed at its expected location.\n * Uses `lstatSync` so symlinks are treated as deployed.\n *\n * @param kind - Asset component type\n * @param name - Asset name\n * @param target - Driver target identifier\n * @param globalInstall - `true` for user-global, `false` for project-local\n * @param cwd - Working directory for local installs\n * @returns `true` if the deploy path exists, `false` otherwise\n * @docLink packages/core/concepts#is-deployed\n */\nexport function isDeployed(\n  kind: AiComponent,\n  name: string,\n  target: DriverTarget,\n  globalInstall: boolean,\n  cwd?: string,\n): boolean {\n  try {\n    lstatSync(deployedDir(kind, name, target, globalInstall, cwd));\n    return true;\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/chunk-LOHQTTUV.js

@@ -0,0 +1,29 @@
+import { getStoreConfig, getStoreToken, storeFetch } from './chunk-MQ42OYKH.js';
+
+// cli/src/store-publisher.ts
+function makeHttpPublisherClient(config = getStoreConfig(), timeoutMs = 2e4) {
+  const call = async (path, opts) => {
+    const jwt = await getStoreToken();
+    return storeFetch({ ...config, jwt }, path, { timeoutMs, ...opts });
+  };
+  return {
+    me: () => call("/api/v1/me"),
+    sourcesAdd: (body) => call("/api/v1/sources", { method: "POST", body }),
+    sourcesList: () => call("/api/v1/sources"),
+    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: "POST", body: {} }),
+    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),
+    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),
+    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),
+    assetPublish: (id, body, dryRun) => call(`/api/v1/assets/${id}/publish`, {
+      method: "POST",
+      body,
+      ...dryRun ? { params: { dryRun: "1" } } : {}
+    }),
+    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: "POST", body: {} }),
+    namespaceAvailability: (ns) => call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`)
+  };
+}
+
+export { makeHttpPublisherClient };
+//# sourceMappingURL=chunk-LOHQTTUV.js.map
+//# sourceMappingURL=chunk-LOHQTTUV.js.map

package/dist/chunk-LOHQTTUV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../cli/src/store-publisher.ts"],"names":[],"mappings":";;;AA+FO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAC3F,qBAAA,EAAuB,CAAC,EAAA,KACtB,IAAA,CAAK,sBAAsB,kBAAA,CAAmB,EAAE,CAAC,CAAA,aAAA,CAAe;AAAA,GACpE;AACF","file":"chunk-LOHQTTUV.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n  /**\n   * Identity of the caller. `username` is the Keycloak login (personal-tier\n   * namespace); `githubLogin` is the verified GitHub handle when connected —\n   * the namespace to publish under when it differs from the login.\n   */\n  me(): Promise<{ username: string; githubLogin?: string | null }>;\n  /** Register (or re-register) a source; returns the created/existing row id. */\n  sourcesAdd(body: {\n    url: string;\n    ref: string;\n    sidecarUrl?: string;\n    sidecarRef?: string;\n    /**\n     * Target publisher namespace (the manifest's `publisher`). When it differs\n     * from the caller's login username, the store resolves the CLAIMED Publisher\n     * for it (the store must already have the claim). Omitted → the store\n     * defaults to `@<username>` (personal).\n     */\n    namespace?: string;\n  }): Promise<{ id: string }>;\n  /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n  sourcesList(): Promise<Array<{ id: string; url: string }>>;\n  /** Kick off a source sync; returns the async job id to poll. */\n  sourceSync(id: string): Promise<{ jobId: string }>;\n  /** Poll a job's terminal status + per-item results. */\n  jobGet(\n    jobId: string,\n  ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n  /** Discovered publishable candidates for a synced source. */\n  sourceCandidates(id: string): Promise<\n    Array<{\n      id: string;\n      name: string;\n      version: string;\n      kind: string;\n      published: boolean;\n      assetRoot: string;\n    }>\n  >;\n  /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n  assetPreview(id: string): Promise<{\n    discoveredFiles: string[];\n    candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n  }>;\n  /**\n   * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n   * launching a job; the normal path returns `{ jobId }`.\n   */\n  assetPublish(\n    id: string,\n    body: { ref: string; files: string[] },\n    dryRun?: boolean,\n  ): Promise<{ jobId?: string; manifest?: unknown }>;\n  /** Retract a published asset. Response body is ignored. */\n  assetUnpublish(id: string): Promise<unknown>;\n  /**\n   * Read-only \"can I publish under `@<ns>` right now, and if not, what's the\n   * path?\" probe. Backs the `publish --dry-run` namespace status line; its\n   * `message` is store-authored and meant to be surfaced verbatim.\n   */\n  namespaceAvailability(ns: string): Promise<{\n    namespace: string;\n    status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n    claimMethod?: string;\n    message: string;\n  }>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n  config: StoreConfig = getStoreConfig(),\n  timeoutMs = 20_000,\n): PublisherClient {\n  // Acquire a fresh Keycloak token per call (device-flow session in\n  // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n  const call = async <T>(\n    path: string,\n    opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n  ): Promise<T> => {\n    const jwt = await getStoreToken();\n    return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n  };\n  return {\n    me: () => call(\"/api/v1/me\"),\n    sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n    sourcesList: () => call(\"/api/v1/sources\"),\n    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n    assetPublish: (id, body, dryRun) =>\n      call(`/api/v1/assets/${id}/publish`, {\n        method: \"POST\",\n        body,\n        ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n      }),\n    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n    namespaceAvailability: (ns) =>\n      call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`),\n  };\n}\n"]}

package/dist/{chunk-MDBAEEY5.js → chunk-MQ42OYKH.js}

@@ -1,7 +1,8 @@
-import { globalSettingsPath, mapLegacyFields } from './chunk-FJYOQMXT.js';
+import { S, logErr, logWarn, logOk, logInfo } from './chunk-ILAZDNIA.js';
+import { globalSettingsPath, mapLegacyFields } from './chunk-YV3YI3TA.js';
+import { globalSkaileDir } from './chunk-TLKM4M47.js';
 import { rmSync, existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
 import { randomBytes, createHash } from 'crypto';
-import { homedir } from 'os';
 import { join, dirname } from 'path';
 
 function makePkcePair() {
@@ -13,12 +14,11 @@ function trimTrailingSlash(url) {
   return url.replace(/\/+$/, "");
 }
 function loadStoreAuthConfig() {
-  const home = process.env.SKAILE_HOME ?? join(homedir(), ".skaile");
   return {
     keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? "https://auth.skaile.ai"),
     realm: process.env.SKAILE_STORE_REALM ?? "skaile-store",
     clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? "skaile-store-cli",
-    authFile: process.env.SKAILE_AUTH_FILE ?? join(home, "auth.json")
+    authFile: process.env.SKAILE_AUTH_FILE ?? join(globalSkaileDir(), "auth.json")
   };
 }
 function oidc(config) {
@@ -227,6 +227,158 @@ function isStoreAuthenticated() {
   return hasStoredAuth(loadStoreAuthConfig());
 }
 
-export { deviceLogin, getStoreConfig, getStoreIdentity, getStoreToken, hasStoredAuth, isStoreAuthenticated, loadStoreAuthConfig, logout, storeFetch };
-//# sourceMappingURL=chunk-MDBAEEY5.js.map
-//# sourceMappingURL=chunk-MDBAEEY5.js.map
+// cli/src/commands/publish-core.ts
+function formatNamespaceAvailability(a) {
+  switch (a.status) {
+    case "owned-by-you":
+    case "available":
+      return `${S.ok("\u2713")} ${a.message}`;
+    case "claimable-by-you":
+      return `${S.warn("!")} ${a.message}`;
+    default:
+      return `${S.err("\u2717")} ${a.message}`;
+  }
+}
+async function preflightNamespace(client, namespace) {
+  let a;
+  try {
+    a = await client.namespaceAvailability(namespace);
+  } catch {
+    return { ok: true };
+  }
+  switch (a.status) {
+    case "owned-by-you":
+    case "available":
+      return { ok: true };
+    case "claimable-by-you":
+      return {
+        ok: false,
+        message: `@${namespace} isn't yours yet \u2014 claim it in the store first${a.claimMethod ? ` (${a.claimMethod})` : ""}, then re-run. ${a.message}`
+      };
+    default:
+      return { ok: false, message: `Cannot publish under @${namespace} \u2014 ${a.message}` };
+  }
+}
+function matchCandidatesToManifest(candidates, manifest) {
+  const wanted = new Set((manifest.assets ?? []).map((a) => `${a.kind}:${a.name}`));
+  return candidates.filter((c) => wanted.has(`${c.kind}:${c.name}`));
+}
+function refFor(kind, publisher, name, version) {
+  const base = `${kind}:@${publisher}/${name}`;
+  return version ? `${base}#${version}` : base;
+}
+var UNSET_NAMESPACE = "<manifest publisher>";
+function assetNamespace(asset, manifest) {
+  return asset.publisher ?? manifest.publisher;
+}
+function manifestNamespaces(manifest, assetName) {
+  const out = /* @__PURE__ */ new Set();
+  for (const a of manifest.assets ?? []) {
+    if (assetName && a.name !== assetName) continue;
+    const ns = assetNamespace(a, manifest);
+    if (ns) out.add(ns);
+  }
+  if (out.size === 0 && manifest.publisher) out.add(manifest.publisher);
+  return [...out];
+}
+function plannedRefs(manifest, assetName) {
+  return (manifest.assets ?? []).filter((a) => !assetName || a.name === assetName).map(
+    (a) => refFor(
+      a.kind,
+      assetNamespace(a, manifest) ?? UNSET_NAMESPACE,
+      a.name,
+      a.version ?? manifest.version
+    )
+  );
+}
+function bareName(ref) {
+  const afterKind = ref.includes(":") ? ref.slice(ref.indexOf(":") + 1) : ref;
+  const afterScope = afterKind.includes("/") ? afterKind.slice(afterKind.indexOf("/") + 1) : afterKind;
+  return afterScope.split("#")[0];
+}
+async function pollJob(client, jobId, intervalMs = 1500, timeoutMs = 6e4) {
+  const deadline = Date.now() + timeoutMs;
+  let job = await client.jobGet(jobId);
+  while (job.status === "running" && Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, intervalMs));
+    job = await client.jobGet(jobId);
+  }
+  return job;
+}
+function isDupSourceError(err) {
+  const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
+  return /\b409\b|conflict|duplicate|already exists|already registered|unique/.test(msg);
+}
+async function publishToStore(opts) {
+  const { sourceUrl, ref, sidecar, manifest, assetName, client: pub } = opts;
+  let sourceId;
+  try {
+    const added = await pub.sourcesAdd({
+      url: sourceUrl,
+      ref,
+      ...sidecar ? { sidecarUrl: sidecar.url, sidecarRef: sidecar.ref } : {},
+      // Publish under the manifest's declared namespace; the store resolves a
+      // claimed Publisher when it differs from the caller's login, else defaults
+      // to `@<username>`. Omitted when the manifest carries no publisher.
+      ...manifest.publisher ? { namespace: manifest.publisher } : {}
+    });
+    sourceId = added.id;
+  } catch (err) {
+    if (!isDupSourceError(err)) throw err;
+    const rows = await pub.sourcesList();
+    const found = rows.find((r) => r.url === sourceUrl);
+    if (!found) {
+      throw new Error(
+        `Source ${sourceUrl} looked already-registered but no owned row matched: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    sourceId = found.id;
+  }
+  const { jobId } = await pub.sourceSync(sourceId);
+  const job = await pollJob(pub, jobId);
+  if (job.status === "failed" || job.status === "cancelled") {
+    const failed = (job.items ?? []).filter((i) => i.status === "failed");
+    for (const i of failed) logErr(`sync: ${i.label}: ${i.error ?? "failed"}`);
+    logErr(`Source sync ${job.status}.`);
+    process.exit(1);
+  }
+  if (job.status === "running") {
+    logErr("Source sync timed out before completing \u2014 re-run `publish`, or check the store.");
+    process.exit(1);
+  }
+  let candidates = matchCandidatesToManifest(await pub.sourceCandidates(sourceId), manifest);
+  if (assetName) candidates = candidates.filter((c) => c.name === assetName);
+  if (candidates.length === 0) {
+    logWarn("No candidates discovered \u2014 check the manifest and the source ref.");
+    process.exit(1);
+  }
+  const published = [];
+  for (const c of candidates) {
+    try {
+      const preview = await pub.assetPreview(c.id);
+      const res = await pub.assetPublish(c.id, { ref, files: preview.discoveredFiles });
+      if (res.jobId) {
+        const pubJob = await pollJob(pub, res.jobId);
+        if (pubJob.status !== "succeeded") {
+          const errs = (pubJob.items ?? []).filter((i) => i.status === "failed").map((i) => i.error).filter(Boolean);
+          logWarn(
+            `Publish of ${c.kind}:${c.name} did not succeed (${pubJob.status})` + (errs.length ? `: ${errs.join("; ")}` : "")
+          );
+          continue;
+        }
+      }
+      published.push(refFor(c.kind, preview.candidate.publisherNamespace, c.name, c.version));
+    } catch (err) {
+      logWarn(
+        `Failed to publish ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  logOk(`Published ${published.length} asset(s):`);
+  for (const r of published) logInfo(`  ${r}`);
+  return { published };
+}
+
+export { assetNamespace, bareName, deviceLogin, formatNamespaceAvailability, getStoreConfig, getStoreIdentity, getStoreToken, hasStoredAuth, isStoreAuthenticated, loadStoreAuthConfig, logout, manifestNamespaces, plannedRefs, preflightNamespace, publishToStore, refFor, storeFetch };
+//# sourceMappingURL=chunk-MQ42OYKH.js.map
+//# sourceMappingURL=chunk-MQ42OYKH.js.map

package/dist/chunk-MQ42OYKH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../cli/src/store-auth.ts","../cli/src/store-client.ts","../cli/src/commands/publish-core.ts"],"names":["readFileSync"],"mappings":";;;;;;;AAsBA,SAAS,YAAA,GAAwD;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AAC1E,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAUA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,oBAAoB,IAAA,CAAK,eAAA,IAAmB,WAAW;AAAA,GAC/E;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,gBAAA,CACd,MAAA,GAA0B,mBAAA,EAAoB,EACM;AACpD,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,SAAS,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AAC3E,IAAA,MAAM,WACJ,OAAO,IAAA,CAAK,kBAAA,KAAuB,QAAA,GAAW,KAAK,kBAAA,GAAqB,KAAA,CAAA;AAC1E,IAAA,MAAM,cAAc,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,GAAW,KAAK,YAAA,GAAe,KAAA,CAAA;AAChF,IAAA,OAAO,QAAA,IAAY,WAAA,GAAc,EAAE,QAAA,EAAU,aAAY,GAAI,IAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACG;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,YAAA,EAAa;AAE1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,KAAA,EAAO,gBAAA;AAAA,MACP,gBAAgB,IAAA,CAAK,SAAA;AAAA,MACrB,qBAAA,EAAuB;AAAA,KACxB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,IAAA,CAAK;AAAA,OACrB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yBAAyB,KAAA,CAAM,iBAAA,IAAqB,KAAA,CAAM,KAAA,IAAS,IAAI,MAAM,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;AC9PO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAMA,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C;;;ACjGO,SAAS,4BAA4B,CAAA,EAGjC;AACT,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,EAAA,CAAG,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IAClC,KAAK,kBAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IACpC;AACE,MAAA,OAAO,GAAG,CAAA,CAAE,GAAA,CAAI,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA;AAEvC;AAYA,eAAsB,kBAAA,CACpB,QACA,SAAA,EAC4C;AAC5C,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,MAAM,MAAA,CAAO,qBAAA,CAAsB,SAAS,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB;AACA,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,IACpB,KAAK,kBAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EACE,CAAA,CAAA,EAAI,SAAS,CAAA,mDAAA,EACV,CAAA,CAAE,WAAA,GAAc,CAAA,EAAA,EAAK,CAAA,CAAE,WAAW,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,eAAA,EAAkB,EAAE,OAAO,CAAA;AAAA,OAC5E;AAAA,IACF;AACE,MAAA,OAAO,EAAE,IAAI,KAAA,EAAO,OAAA,EAAS,yBAAyB,SAAS,CAAA,QAAA,EAAM,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA;AAEvF;AAaO,SAAS,yBAAA,CACd,YACA,QAAA,EACK;AACL,EAAA,MAAM,SAAS,IAAI,GAAA,CAAA,CAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,IAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AAChF,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AACnE;AAGO,SAAS,MAAA,CAAO,IAAA,EAAc,SAAA,EAAmB,IAAA,EAAc,OAAA,EAA0B;AAC9F,EAAA,MAAM,OAAO,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,SAAS,IAAI,IAAI,CAAA,CAAA;AAC1C,EAAA,OAAO,OAAA,GAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,IAAA;AAC1C;AAGA,IAAM,eAAA,GAAkB,sBAAA;AAQjB,SAAS,cAAA,CACd,OACA,QAAA,EACoB;AACpB,EAAA,OAAO,KAAA,CAAM,aAAa,QAAA,CAAS,SAAA;AACrC;AAQO,SAAS,kBAAA,CAAmB,UAA6B,SAAA,EAA8B;AAC5F,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAY;AAC5B,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AACrC,IAAA,IAAI,SAAA,IAAa,CAAA,CAAE,IAAA,KAAS,SAAA,EAAW;AACvC,IAAA,MAAM,EAAA,GAAK,cAAA,CAAe,CAAA,EAAG,QAAQ,CAAA;AACrC,IAAA,IAAI,EAAA,EAAI,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAAA,EACpB;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,IAAK,QAAA,CAAS,WAAW,GAAA,CAAI,GAAA,CAAI,SAAS,SAAS,CAAA;AACpE,EAAA,OAAO,CAAC,GAAG,GAAG,CAAA;AAChB;AAMO,SAAS,WAAA,CAAY,UAA6B,SAAA,EAA8B;AACrF,EAAA,OAAA,CAAQ,QAAA,CAAS,MAAA,IAAU,EAAC,EACzB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,SAAA,IAAa,CAAA,CAAE,IAAA,KAAS,SAAS,CAAA,CAChD,GAAA;AAAA,IAAI,CAAC,CAAA,KACJ,MAAA;AAAA,MACE,CAAA,CAAE,IAAA;AAAA,MACF,cAAA,CAAe,CAAA,EAAG,QAAQ,CAAA,IAAK,eAAA;AAAA,MAC/B,CAAA,CAAE,IAAA;AAAA,MACF,CAAA,CAAE,WAAW,QAAA,CAAS;AAAA;AACxB,GACF;AACJ;AAGO,SAAS,SAAS,GAAA,EAAqB;AAC5C,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAAI,GAAA;AACxE,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GACrC,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAC1C,SAAA;AACJ,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA;AAChC;AAOA,eAAsB,QACpB,MAAA,EACA,KAAA,EACA,UAAA,GAAa,IAAA,EACb,YAAY,GAAA,EACmF;AAC/F,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAC9B,EAAA,IAAI,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,OAAO,IAAI,MAAA,KAAW,SAAA,IAAa,IAAA,CAAK,GAAA,KAAQ,QAAA,EAAU;AACxD,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,UAAU,CAAC,CAAA;AAClD,IAAA,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,iBAAiB,GAAA,EAAuB;AACtD,EAAA,MAAM,GAAA,GAAA,CAAO,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,GAAG,WAAA,EAAY;AAC3E,EAAA,OAAO,qEAAA,CAAsE,KAAK,GAAG,CAAA;AACvF;AAcA,eAAsB,eAAe,IAAA,EAOA;AACnC,EAAA,MAAM,EAAE,WAAW,GAAA,EAAK,OAAA,EAAS,UAAU,SAAA,EAAW,MAAA,EAAQ,KAAI,GAAI,IAAA;AAEtE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW;AAAA,MACjC,GAAA,EAAK,SAAA;AAAA,MACL,GAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,UAAA,EAAY,OAAA,CAAQ,KAAK,UAAA,EAAY,OAAA,CAAQ,GAAA,EAAI,GAAI,EAAC;AAAA;AAAA;AAAA;AAAA,MAItE,GAAI,SAAS,SAAA,GAAY,EAAE,WAAW,QAAA,CAAS,SAAA,KAAc;AAAC,KAC/D,CAAA;AACD,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI,CAAC,gBAAA,CAAiB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,SAAS,CAAA;AAClD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,OAAA,EAAU,SAAS,CAAA,qDAAA,EACd,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OACvD;AAAA,IACF;AACA,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,GAAA,CAAI,WAAW,QAAQ,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AACpC,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,WAAA,EAAa;AACzD,IAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,KAAA,IAAS,EAAC,EAAG,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,QAAQ,CAAA;AACpE,IAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,MAAA,CAAO,CAAA,MAAA,EAAS,CAAA,CAAE,KAAK,CAAA,EAAA,EAAK,CAAA,CAAE,KAAA,IAAS,QAAQ,CAAA,CAAE,CAAA;AACzE,IAAA,MAAA,CAAO,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACnC,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,IAAA,MAAA,CAAO,sFAAiF,CAAA;AACxF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,aAAa,yBAAA,CAA0B,MAAM,IAAI,gBAAA,CAAiB,QAAQ,GAAG,QAAQ,CAAA;AACzF,EAAA,IAAI,SAAA,eAAwB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,SAAS,CAAA;AACzE,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,wEAAmE,CAAA;AAC3E,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,YAAA,CAAa,EAAE,EAAE,CAAA;AAC3C,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,YAAA,CAAa,CAAA,CAAE,EAAA,EAAI,EAAE,GAAA,EAAK,KAAA,EAAO,OAAA,CAAQ,eAAA,EAAiB,CAAA;AAGhF,MAAA,IAAI,IAAI,KAAA,EAAO;AACb,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,EAAK,IAAI,KAAK,CAAA;AAC3C,QAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,UAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAC,EAC5B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA,CACnC,IAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA,CAClB,OAAO,OAAO,CAAA;AACjB,UAAA,OAAA;AAAA,YACE,cAAc,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,kBAAA,EAAqB,MAAA,CAAO,MAAM,CAAA,CAAA,CAAA,IAC7D,KAAK,MAAA,GAAS,CAAA,EAAA,EAAK,KAAK,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AAAA,WAC5C;AACA,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,SAAA,CAAU,IAAA,CAAK,MAAA,CAAO,CAAA,CAAE,IAAA,EAAM,OAAA,CAAQ,SAAA,CAAU,kBAAA,EAAoB,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAC,CAAA;AAAA,IACxF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA;AAAA,QACE,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OAC5F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,CAAA,UAAA,EAAa,SAAA,CAAU,MAAM,CAAA,UAAA,CAAY,CAAA;AAC/C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAA,EAAW,OAAA,CAAQ,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAC3C,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB","file":"chunk-MQ42OYKH.js","sourcesContent":["/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { globalSkaileDir } from \"@skaile/workspaces/core\";\n\n/**\n * A PKCE (RFC 7636) `code_verifier` + its S256 `code_challenge`. Keycloak\n * enforces PKCE on the `skaile-store-cli` device flow (the device-authorization\n * request 400s with \"Missing parameter: code_challenge_method\" otherwise), so\n * every `deviceLogin` mints a fresh pair: the challenge goes on the device-auth\n * request, the verifier on the matching token poll. `base64url` (no padding)\n * per the spec.\n */\nfunction makePkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  const challenge = createHash(\"sha256\").update(verifier).digest(\"base64url\");\n  return { verifier, challenge };\n}\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n  keycloakUrl: string;\n  realm: string;\n  clientId: string;\n  authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n  return {\n    keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n    realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n    clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n    authFile: process.env.SKAILE_AUTH_FILE ?? join(globalSkaileDir(), \"auth.json\"),\n  };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n  const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n  return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n  access_token: string;\n  refresh_token?: string;\n  /** Epoch ms when the access token expires (with a safety margin already applied). */\n  expires_at: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  interval?: number;\n  expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n  fetchImpl?: typeof fetch;\n  sleep?: (ms: number) => Promise<void>;\n  /** Called once with the verification URL + user code (default: write to stderr). */\n  onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n  try {\n    const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n    // Reject a corrupt / hand-edited file rather than treat it as a session.\n    if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The caller's store identity, decoded LOCALLY from the cached token's JWT\n * payload (no network, no signature check — this is an author-side hint, not an\n * authorization decision). Returns `null` when not signed in or the token is\n * unreadable. `githubLogin` is the verified GitHub handle (the preferred\n * publisher namespace); `username` is the Keycloak `preferred_username`.\n */\nexport function getStoreIdentity(\n  config: StoreAuthConfig = loadStoreAuthConfig(),\n): { username?: string; githubLogin?: string } | null {\n  const auth = readAuth(config);\n  if (!auth) return null;\n  try {\n    const payload = auth.access_token.split(\".\")[1];\n    const json = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf-8\"));\n    const username =\n      typeof json.preferred_username === \"string\" ? json.preferred_username : undefined;\n    const githubLogin = typeof json.github_login === \"string\" ? json.github_login : undefined;\n    return username || githubLogin ? { username, githubLogin } : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n  mkdirSync(dirname(config.authFile), { recursive: true });\n  writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n  chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n  try {\n    rmSync(config.authFile);\n  } catch {\n    // already absent — nothing to do\n  }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n  return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n  return {\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n  };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n  process.stderr.write(\n    `\\nTo sign in, open:\\n\\n    ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n  );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<StoredAuth> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const sleep = deps.sleep ?? defaultSleep;\n  const onPrompt = deps.onPrompt ?? defaultPrompt;\n  const endpoints = oidc(config);\n  const pkce = makePkcePair();\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      client_id: config.clientId,\n      scope: \"openid profile\",\n      code_challenge: pkce.challenge,\n      code_challenge_method: \"S256\",\n    }),\n  });\n  if (!deviceRes.ok) {\n    throw new Error(\n      `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n  onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n  const intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n  let waitMs = intervalMs;\n\n  while (Date.now() < deadline) {\n    await sleep(waitMs);\n    const tokenRes = await fetchImpl(endpoints.token, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: device.device_code,\n        client_id: config.clientId,\n        code_verifier: pkce.verifier,\n      }),\n    });\n    const token = (await tokenRes.json()) as TokenResponse;\n    if (tokenRes.ok) {\n      const stored = tokenToStored(token);\n      writeAuth(config, stored);\n      return stored;\n    }\n    // RFC 8628 §3.5 pending / slow-down handling.\n    if (token.error === \"authorization_pending\") continue;\n    if (token.error === \"slow_down\") {\n      waitMs += 5_000;\n      continue;\n    }\n    throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n  }\n  throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n  config: StoreAuthConfig,\n  refreshToken: string,\n  fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n  const res = await fetchImpl(oidc(config).token, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n      client_id: config.clientId,\n    }),\n  });\n  const token = (await res.json()) as TokenResponse;\n  if (!res.ok) {\n    throw new Error(\n      `Token refresh failed: ${token.error_description ?? token.error ?? res.status}`,\n    );\n  }\n  const stored = tokenToStored(token);\n  writeAuth(config, stored);\n  return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<string> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const auth = readAuth(config);\n  if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n  if (Date.now() < auth.expires_at) return auth.access_token;\n  if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n  try {\n    return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n  } catch {\n    throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n  }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n","/**\n * Shared store-interaction core for the two publish front-ends — the curator\n * sidecar flow (`source manifest publish`) and the first-party library flow\n * (`library publish`). Both differ only in their git side-effects + how they\n * resolve the source repo; the store orchestration below (register → sync →\n * candidates → per-asset preview+publish) is identical.\n *\n * The store REST surface is reached through the injectable {@link PublisherClient}\n * so the orchestration stays unit/integration-testable without a live store.\n *\n * @docLink cli/commands/source#manifest-publish\n */\n\nimport type { SkPublishManifest } from \"@skaile/workspaces/core\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport type { PublisherClient } from \"../store-publisher.ts\";\n\n/**\n * One-line rendering of a namespace-availability probe for a `--dry-run` plan.\n * The `message` is store-authored (identical to what a real publish would echo)\n * — we only prepend a status glyph so the reader sees green/amber/red at a\n * glance without the CLI re-deriving any authorization logic.\n */\nexport function formatNamespaceAvailability(a: {\n  status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n  message: string;\n}): string {\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return `${S.ok(\"✓\")} ${a.message}`;\n    case \"claimable-by-you\":\n      return `${S.warn(\"!\")} ${a.message}`;\n    default:\n      return `${S.err(\"✗\")} ${a.message}`;\n  }\n}\n\n/**\n * Preflight the target namespace against the store's availability probe BEFORE a\n * publish does any irreversible work (a public git push). Returns `{ ok: false }`\n * with a guided message for `reserved` (not yours) and `claimable-by-you` (must\n * claim first) — the two states a real publish would reject — so the caller can\n * abort with actionable guidance instead of a raw 422 after pushing bytes.\n *\n * The probe is advisory: any failure (offline, older store) returns `{ ok: true }`\n * so the store stays the authority and a valid publish is never blocked.\n */\nexport async function preflightNamespace(\n  client: PublisherClient,\n  namespace: string,\n): Promise<{ ok: boolean; message?: string }> {\n  let a: Awaited<ReturnType<PublisherClient[\"namespaceAvailability\"]>>;\n  try {\n    a = await client.namespaceAvailability(namespace);\n  } catch {\n    return { ok: true };\n  }\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return { ok: true };\n    case \"claimable-by-you\":\n      return {\n        ok: false,\n        message:\n          `@${namespace} isn't yours yet — claim it in the store first` +\n          `${a.claimMethod ? ` (${a.claimMethod})` : \"\"}, then re-run. ${a.message}`,\n      };\n    default: // reserved, or any unrecognized future status (fail safe → block)\n      return { ok: false, message: `Cannot publish under @${namespace} — ${a.message}` };\n  }\n}\n\n/** One candidate row shape the matcher operates on (kind + name are the key). */\ninterface CandidateLike {\n  kind: string;\n  name: string;\n}\n\n/**\n * Keep only candidates whose `(kind, name)` pair is declared in the manifest.\n * The backend may merge extra assets from the base repo into the candidate\n * list; a publish only touches what the manifest curated/declared.\n */\nexport function matchCandidatesToManifest<T extends CandidateLike>(\n  candidates: T[],\n  manifest: SkPublishManifest,\n): T[] {\n  const wanted = new Set((manifest.assets ?? []).map((a) => `${a.kind}:${a.name}`));\n  return candidates.filter((c) => wanted.has(`${c.kind}:${c.name}`));\n}\n\n/** A canonical ref string `kind:@publisher/name[#version]` for reporting. */\nexport function refFor(kind: string, publisher: string, name: string, version?: string): string {\n  const base = `${kind}:@${publisher}/${name}`;\n  return version ? `${base}#${version}` : base;\n}\n\n/** Placeholder namespace shown when neither the asset nor the manifest names a publisher. */\nconst UNSET_NAMESPACE = \"<manifest publisher>\";\n\n/**\n * The publisher namespace one manifest asset publishes under:\n * `assets[].publisher` first, else the manifest's top-level `publisher` —\n * the same priority discovery applies when it indexes the asset. `undefined`\n * when neither is declared.\n */\nexport function assetNamespace(\n  asset: { publisher?: string },\n  manifest: SkPublishManifest,\n): string | undefined {\n  return asset.publisher ?? manifest.publisher;\n}\n\n/**\n * Every distinct namespace the manifest's assets (optionally narrowed to\n * `assetName`) publish under, in first-seen order. A manifest whose assets\n * carry no namespace at all falls back to its top-level `publisher` so an\n * empty inventory still reports the namespace it would claim.\n */\nexport function manifestNamespaces(manifest: SkPublishManifest, assetName?: string): string[] {\n  const out = new Set<string>();\n  for (const a of manifest.assets ?? []) {\n    if (assetName && a.name !== assetName) continue;\n    const ns = assetNamespace(a, manifest);\n    if (ns) out.add(ns);\n  }\n  if (out.size === 0 && manifest.publisher) out.add(manifest.publisher);\n  return [...out];\n}\n\n/**\n * The canonical refs a publish would produce, one per manifest asset (optionally\n * narrowed to `assetName`), each under its own `assets[].publisher ?? publisher`.\n */\nexport function plannedRefs(manifest: SkPublishManifest, assetName?: string): string[] {\n  return (manifest.assets ?? [])\n    .filter((a) => !assetName || a.name === assetName)\n    .map((a) =>\n      refFor(\n        a.kind,\n        assetNamespace(a, manifest) ?? UNSET_NAMESPACE,\n        a.name,\n        a.version ?? manifest.version,\n      ),\n    );\n}\n\n/** The bare asset name from a `kind:@publisher/name#version` ref or a plain name. */\nexport function bareName(ref: string): string {\n  const afterKind = ref.includes(\":\") ? ref.slice(ref.indexOf(\":\") + 1) : ref;\n  const afterScope = afterKind.includes(\"/\")\n    ? afterKind.slice(afterKind.indexOf(\"/\") + 1)\n    : afterKind;\n  return afterScope.split(\"#\")[0];\n}\n\n/**\n * Poll a job until it leaves `running` or the deadline passes. Returns the last\n * observed state — the caller MUST treat a still-`running` result as a timeout\n * (not success), since it means the deadline was hit before the job finished.\n */\nexport async function pollJob(\n  client: PublisherClient,\n  jobId: string,\n  intervalMs = 1_500,\n  timeoutMs = 60_000,\n): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }> {\n  const deadline = Date.now() + timeoutMs;\n  let job = await client.jobGet(jobId);\n  while (job.status === \"running\" && Date.now() < deadline) {\n    await new Promise((r) => setTimeout(r, intervalMs));\n    job = await client.jobGet(jobId);\n  }\n  return job;\n}\n\n/**\n * True when a `sourcesAdd` rejection is a duplicate-URL conflict (the source is\n * already registered) — the only error the publish flow recovers from by looking\n * the existing row up. Every other failure (auth, 5xx, network) must propagate.\n */\nexport function isDupSourceError(err: unknown): boolean {\n  const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();\n  return /\\b409\\b|conflict|duplicate|already exists|already registered|unique/.test(msg);\n}\n\n/**\n * Register + sync the source, then publish its curated/declared candidates —\n * the store-side steps shared by both publish front-ends. Git side-effects (the\n * sidecar push, or the library commit+push) happen in the caller *before* this;\n * this function is purely store interaction.\n *\n * The sidecar front-end passes `sidecar` (so `sourcesAdd` carries the sidecar\n * pin); the library front-end omits it (the source repo IS the manifest host).\n * `assetName`, when set, narrows publication to the single candidate of that\n * name. Fatal store states (`sourcesAdd` non-dup failure) surface; sync failures\n * and empty candidate sets `process.exit(1)` with the same messages as before.\n */\nexport async function publishToStore(opts: {\n  sourceUrl: string;\n  ref: string;\n  sidecar?: { url: string; ref: string };\n  manifest: SkPublishManifest;\n  assetName?: string;\n  client: PublisherClient;\n}): Promise<{ published: string[] }> {\n  const { sourceUrl, ref, sidecar, manifest, assetName, client: pub } = opts;\n\n  let sourceId: string;\n  try {\n    const added = await pub.sourcesAdd({\n      url: sourceUrl,\n      ref,\n      ...(sidecar ? { sidecarUrl: sidecar.url, sidecarRef: sidecar.ref } : {}),\n      // Publish under the manifest's declared namespace; the store resolves a\n      // claimed Publisher when it differs from the caller's login, else defaults\n      // to `@<username>`. Omitted when the manifest carries no publisher.\n      ...(manifest.publisher ? { namespace: manifest.publisher } : {}),\n    });\n    sourceId = added.id;\n  } catch (err) {\n    // Only a duplicate-url conflict is recoverable (source already registered);\n    // auth/5xx/network failures must surface, not silently reuse a stale row.\n    if (!isDupSourceError(err)) throw err;\n    const rows = await pub.sourcesList();\n    const found = rows.find((r) => r.url === sourceUrl);\n    if (!found) {\n      throw new Error(\n        `Source ${sourceUrl} looked already-registered but no owned row matched: ` +\n          `${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n    sourceId = found.id;\n  }\n\n  const { jobId } = await pub.sourceSync(sourceId);\n  const job = await pollJob(pub, jobId);\n  if (job.status === \"failed\" || job.status === \"cancelled\") {\n    const failed = (job.items ?? []).filter((i) => i.status === \"failed\");\n    for (const i of failed) logErr(`sync: ${i.label}: ${i.error ?? \"failed\"}`);\n    logErr(`Source sync ${job.status}.`);\n    process.exit(1);\n  }\n  // A still-`running` job means the poll deadline was hit — do NOT proceed on an\n  // unfinished sync (it would read incomplete candidates).\n  if (job.status === \"running\") {\n    logErr(\"Source sync timed out before completing — re-run `publish`, or check the store.\");\n    process.exit(1);\n  }\n\n  let candidates = matchCandidatesToManifest(await pub.sourceCandidates(sourceId), manifest);\n  if (assetName) candidates = candidates.filter((c) => c.name === assetName);\n  if (candidates.length === 0) {\n    logWarn(\"No candidates discovered — check the manifest and the source ref.\");\n    process.exit(1);\n  }\n\n  const published: string[] = [];\n  for (const c of candidates) {\n    try {\n      const preview = await pub.assetPreview(c.id);\n      const res = await pub.assetPublish(c.id, { ref, files: preview.discoveredFiles });\n      // Publish is async — wait for the job so we only report refs that actually\n      // landed, not ones whose import is still in flight or about to fail.\n      if (res.jobId) {\n        const pubJob = await pollJob(pub, res.jobId);\n        if (pubJob.status !== \"succeeded\") {\n          const errs = (pubJob.items ?? [])\n            .filter((i) => i.status === \"failed\")\n            .map((i) => i.error)\n            .filter(Boolean);\n          logWarn(\n            `Publish of ${c.kind}:${c.name} did not succeed (${pubJob.status})` +\n              (errs.length ? `: ${errs.join(\"; \")}` : \"\"),\n          );\n          continue;\n        }\n      }\n      published.push(refFor(c.kind, preview.candidate.publisherNamespace, c.name, c.version));\n    } catch (err) {\n      logWarn(\n        `Failed to publish ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  logOk(`Published ${published.length} asset(s):`);\n  for (const r of published) logInfo(`  ${r}`);\n  return { published };\n}\n"]}

package/dist/{chunk-5JJ5KQUM.js → chunk-MS2JK4V7.js}

@@ -1,7 +1,7 @@
-import { logErr } from './chunk-L22WTIIC.js';
-import { flowKindProvider } from './chunk-FLGLODDF.js';
-import { knowledgeKindProvider } from './chunk-BSIHJZKN.js';
-import { createDefaultRegistry } from './chunk-DFZDL62S.js';
+import { logErr } from './chunk-ILAZDNIA.js';
+import { flowKindProvider } from './chunk-7RC37XFW.js';
+import { knowledgeKindProvider } from './chunk-XU7JET5Z.js';
+import { createDefaultRegistry } from './chunk-OLMNDIAU.js';
 
 // cli/src/open-registry.ts
 function createFullRegistry() {
@@ -103,5 +103,5 @@ async function openLibraryManager() {
 }
 
 export { LocalCatalogDisabledError, createFullRegistry, openCatalogSource, openLibrary, openLibraryManager, resolveCatalogSource };
-//# sourceMappingURL=chunk-5JJ5KQUM.js.map
-//# sourceMappingURL=chunk-5JJ5KQUM.js.map
+//# sourceMappingURL=chunk-MS2JK4V7.js.map
+//# sourceMappingURL=chunk-MS2JK4V7.js.map

package/dist/{chunk-5JJ5KQUM.js.map → chunk-MS2JK4V7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/open-registry.ts","../cli/src/open-library.ts"],"names":["source"],"mappings":";;;;;;AA2BO,SAAS,kBAAA,GAAwC;AACtD,EAAA,MAAM,WAAW,qBAAA,EAAsB;AACvC,EAAA,QAAA,CAAS,SAAS,gBAAgB,CAAA;AAClC,EAAA,QAAA,CAAS,SAAS,qBAAqB,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;;;ACfO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;AASA,eAAsB,WAAA,GAAc;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAChE,IAAA,OAAO,IAAI,UAAA,CAAW,EAAE,YAAA,EAAc,kBAAA,IAAsB,CAAA;AAAA,EAC9D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,2BAAA,EAA8B,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACvF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAqBA,eAAsB,kBAAkB,IAAA,EAQtC;AACA,EAAA,MAAM,EAAE,eAAe,mBAAA,EAAqB,iBAAA,EAAmB,mBAAkB,GAAI,MAAM,OACzF,oBACF,CAAA;AACA,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,yBAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,YAAY,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACxD;AAwCA,eAAsB,qBAAqB,IAAA,EAKR;AACjC,EAAA,MAAM;AAAA,IACJ,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AAErD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,EAAA,GAAK,MAAM,OAAO,IAAS,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,WAAA,EAAY;AAG1C,MAAA,MAAM,SAAS,OAAA,CACZ,MAAA;AAAA,QACC,CAAC,CAAA,KACC,CAAA,CAAE,OAAA,KAAY,OAAA,IAAW,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAA,GAAS;AAAA,OAC3E,CACC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,OAAA,EAAQ,GAAI,CAAA,CAAE,SAAA,CAAU,OAAA,EAAS,CAAA;AAE/D,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAEF;AAAA,MACF;AAGA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAC,MAAM,EAAA,CAAG,UAAA,CAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,0GAAA,EACkB,IAAA,CAAK,IAAI,CAAA,UAAA,EAAa,KAAK,EAAE,CAAA,mGAAA;AAAA,SAEjD;AAAA,MACF;AAEA,MAAA,MAAMA,UAAS,IAAI,kBAAA;AAAA,QACjB,OAAA;AAAA,QACA,OAAA,CAAQ,EAAA;AAAA,QACR,OAAA,CAAQ,IAAA;AAAA,QACR,kBAAA;AAAmB,OACrB;AACA,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAAA,IAChD,SAAS,GAAA,EAAK;AAGZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,MAAM,SACJ,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,GACpB,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,UAAA,EAAY,CAAA,GAC7C,IAAI,oBAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACrD,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACnC;AASA,eAAsB,kBAAA,GAInB;AACD,EAAA,MAAM,EAAE,cAAA,EAAe,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,cAAA,CAAe,OAAO,CAAA;AAC1C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAC1D","file":"chunk-5JJ5KQUM.js","sourcesContent":["/**\n * open-registry.ts — shared helper to create a full AssetKindRegistry.\n *\n * Bootstraps the registry with all built-in providers (9 core + preset)\n * from @skaile/discovery, plus the extension kind providers (flow from\n * @skaile/workspaces/factory-assets/connectors/flow/engine, knowledge from @skaile/library).\n *\n * This is the single registration point for the CLI. All code paths\n * that need a registry (source sync, lib-status, etc.) should use this.\n */\n\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultRegistry } from \"@skaile/workspaces/discovery\";\nimport { flowKindProvider } from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\n/**\n * Create a fully-configured AssetKindRegistry with all known providers.\n *\n * Registers:\n * - 9 core kinds (skill, agent, connector, mount, mcp-server, contract, prompt, persona, ruleset)\n * - preset (composition entity)\n * - flow (extension, from @skaile/workspaces/factory-assets/connectors/flow/engine)\n * - knowledge (extension, from @skaile/library)\n *\n * @returns An unfrozen registry (auto-freezes on first read)\n */\nexport function createFullRegistry(): AssetKindRegistry {\n  const registry = createDefaultRegistry();\n  registry.register(flowKindProvider);\n  registry.register(knowledgeKindProvider);\n  return registry;\n}\n","/**\n * open-library.ts — shared helpers to open the LocalIndex and the configured\n * Catalog source.\n *\n * Lazy-loads the `@skaile/workspaces/library` subpath and returns the\n * LocalIndex instance (backed by `@libsql/client`; runs on Node and Bun).\n * The catalog-source helper reads\n * `~/.skaile/config.yaml` (and project-level overlay if `projectDir` is given)\n * to decide between {@link RemoteCatalogSource} (default — points at\n * `https://skaile.store`) and a {@link LocalCatalogSource} bound to the most\n * recent local library registered via `skaile source add`.\n */\n\nimport { logErr } from \"./helpers.ts\";\nimport { createFullRegistry } from \"./open-registry.ts\";\n\n/** Thrown by {@link openCatalogSource} when `catalog.url` is the `local` sentinel. */\nexport class LocalCatalogDisabledError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"LocalCatalogDisabledError\";\n  }\n}\n\n/**\n * Open the LocalIndex with the full kind registry. Exits with code 1\n * if the library directory cannot be created.\n *\n * @returns A `LocalIndex` instance ready for use.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibrary() {\n  try {\n    const { LocalIndex } = await import(\"@skaile/workspaces/library\");\n    return new LocalIndex({ kindRegistry: createFullRegistry() });\n  } catch (err) {\n    logErr(`Could not open LocalIndex: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Resolve the configured **remote** Catalog source for the CLI.\n *\n * Reads `~/.skaile/config.yaml` (plus the optional project-level overlay) and\n * returns a {@link RemoteCatalogSource} pointing at `catalog.url` (default:\n * `https://skaile.store`). The `cache_ttl: 0` config flag flips the source\n * into air-gapped mode: network reads are disabled, only `skaile update`\n * performs refreshes.\n *\n * **Local-mode rejection.** If the resolved config has `catalog.url: local`\n * this helper throws — callers wanting the dispatched local-or-remote source\n * must use {@link resolveCatalogSource}. Remote-only consumers like\n * `skaile update --catalog-only` rely on this strict behaviour.\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A configured {@link RemoteCatalogSource}.\n * @throws When `catalog.url` is the `local` sentinel.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<\n  | import(\"@skaile/workspaces/library\").RemoteCatalogSource\n  | import(\"@skaile/workspaces/library\").RestCatalogSource\n> {\n  const { resolveConfig, RemoteCatalogSource, RestCatalogSource, isLocalCatalogUrl } = await import(\n    \"@skaile/workspaces/library\"\n  );\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n  if (isLocalCatalogUrl(baseUrl)) {\n    throw new LocalCatalogDisabledError(\n      \"catalog.url is set to 'local' — remote catalog is disabled. \" +\n        \"Use `skaile source add <path>` + `skaile source sync` for local sources, \" +\n        \"or set `catalog.url: https://skaile.store` in ~/.skaile/config.yaml.\",\n    );\n  }\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  if (cfg.catalog.framing === \"rest\") {\n    return new RestCatalogSource({ baseUrl, cacheTtlMs });\n  }\n  return new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n}\n\n/**\n * Resolved catalog source plus a close handle for releasing any underlying\n * resources (e.g. the `LocalIndex` SQLite connection in local mode).\n *\n * Callers MUST invoke `close()` when done — typically in a `finally` block.\n * For remote-mode sources `close()` is a no-op, but the contract is uniform\n * so consumers don't have to branch.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport interface ResolvedCatalogSource {\n  /** The {@link ICatalogSource} ready for use. */\n  source: import(\"@skaile/workspaces/library\").ICatalogSource;\n  /** Release any underlying resources (SQLite handle in local mode). */\n  close(): void;\n}\n\n/**\n * Resolve the configured Catalog source — local or remote — based on\n * `~/.skaile/config.yaml`.\n *\n * Dispatch:\n * - `catalog.url: local` → opens {@link LocalIndex}, picks the most recently\n *   registered local library whose `path` still exists on disk, and returns a\n *   {@link LocalCatalogSource} bound to that library. Throws if no usable\n *   local library is registered.\n * - any URL → returns {@link RemoteCatalogSource} (same as\n *   {@link openCatalogSource}).\n *\n * The returned `close()` releases the underlying `LocalIndex` SQLite handle\n * in local mode (no-op in remote mode). Callers MUST invoke it — typically in\n * a `finally` block — to satisfy `library/CLAUDE.md` § \"Notes for Consumers\".\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A `ResolvedCatalogSource` carrying the source and a close handle.\n * @throws When `local` is configured but no usable local library is registered.\n * @docLink cli/dev-guide#open-library\n */\nexport async function resolveCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<ResolvedCatalogSource> {\n  const {\n    resolveConfig,\n    RemoteCatalogSource,\n    RestCatalogSource,\n    LocalCatalogSource,\n    isLocalCatalogUrl,\n  } = await import(\"@skaile/workspaces/library\");\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n\n  if (isLocalCatalogUrl(baseUrl)) {\n    const fs = await import(\"node:fs\");\n    const library = await openLibrary();\n    try {\n      const sources = await library.listSources();\n      type LibraryRow = (typeof sources)[number];\n      // Type-narrow: `path` is required for local libraries after the filter.\n      const usable = sources\n        .filter(\n          (s): s is LibraryRow & { path: string } =>\n            s.backend === \"local\" && typeof s.path === \"string\" && s.path.length > 0,\n        )\n        .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n      if (usable.length === 0) {\n        throw new Error(\n          \"catalog.url is set to 'local' but no local library is registered. \" +\n            \"Run `skaile source add <path>` first, then `skaile source sync`.\",\n        );\n      }\n\n      // Prefer the most recently added library whose path still exists.\n      const present = usable.find((s) => fs.existsSync(s.path));\n      if (!present) {\n        const head = usable[0];\n        throw new Error(\n          `catalog.url is set to 'local' but every registered local library has a missing path on disk. ` +\n            `Most recent: ${head.path} (library ${head.id}). ` +\n            `Re-register with \\`skaile source add <existing-path>\\` or run \\`skaile source list\\` to inspect.`,\n        );\n      }\n\n      const source = new LocalCatalogSource(\n        library,\n        present.id,\n        present.path,\n        createFullRegistry(),\n      );\n      return { source, close: () => library.close() };\n    } catch (err) {\n      // Release the handle on any failure during dispatch — otherwise the\n      // SQLite WAL state leaks for the lifetime of the process.\n      library.close();\n      throw err;\n    }\n  }\n\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  const source =\n    cfg.catalog.framing === \"rest\"\n      ? new RestCatalogSource({ baseUrl, cacheTtlMs })\n      : new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n  return { source, close: () => {} };\n}\n\n/**\n * Open the LibraryManager bound to the active LocalIndex.\n * Caller owns lifetime — must call `close()` (returned helper closes the\n * underlying LocalIndex).\n *\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibraryManager(): Promise<{\n  manager: import(\"@skaile/workspaces/library\").LibraryManager;\n  library: import(\"@skaile/workspaces/library\").LocalIndex;\n  close: () => void;\n}> {\n  const { LibraryManager } = await import(\"@skaile/workspaces/library\");\n  const library = await openLibrary();\n  const manager = new LibraryManager(library);\n  return { manager, library, close: () => library.close() };\n}\n"]}
+{"version":3,"sources":["../cli/src/open-registry.ts","../cli/src/open-library.ts"],"names":["source"],"mappings":";;;;;;AA2BO,SAAS,kBAAA,GAAwC;AACtD,EAAA,MAAM,WAAW,qBAAA,EAAsB;AACvC,EAAA,QAAA,CAAS,SAAS,gBAAgB,CAAA;AAClC,EAAA,QAAA,CAAS,SAAS,qBAAqB,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;;;ACfO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;AASA,eAAsB,WAAA,GAAc;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAChE,IAAA,OAAO,IAAI,UAAA,CAAW,EAAE,YAAA,EAAc,kBAAA,IAAsB,CAAA;AAAA,EAC9D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,2BAAA,EAA8B,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACvF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAqBA,eAAsB,kBAAkB,IAAA,EAQtC;AACA,EAAA,MAAM,EAAE,eAAe,mBAAA,EAAqB,iBAAA,EAAmB,mBAAkB,GAAI,MAAM,OACzF,oBACF,CAAA;AACA,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,yBAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,YAAY,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACxD;AAwCA,eAAsB,qBAAqB,IAAA,EAKR;AACjC,EAAA,MAAM;AAAA,IACJ,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AAErD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,EAAA,GAAK,MAAM,OAAO,IAAS,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,WAAA,EAAY;AAG1C,MAAA,MAAM,SAAS,OAAA,CACZ,MAAA;AAAA,QACC,CAAC,CAAA,KACC,CAAA,CAAE,OAAA,KAAY,OAAA,IAAW,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAA,GAAS;AAAA,OAC3E,CACC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,OAAA,EAAQ,GAAI,CAAA,CAAE,SAAA,CAAU,OAAA,EAAS,CAAA;AAE/D,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAEF;AAAA,MACF;AAGA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAC,MAAM,EAAA,CAAG,UAAA,CAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,0GAAA,EACkB,IAAA,CAAK,IAAI,CAAA,UAAA,EAAa,KAAK,EAAE,CAAA,mGAAA;AAAA,SAEjD;AAAA,MACF;AAEA,MAAA,MAAMA,UAAS,IAAI,kBAAA;AAAA,QACjB,OAAA;AAAA,QACA,OAAA,CAAQ,EAAA;AAAA,QACR,OAAA,CAAQ,IAAA;AAAA,QACR,kBAAA;AAAmB,OACrB;AACA,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAAA,IAChD,SAAS,GAAA,EAAK;AAGZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,MAAM,SACJ,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,GACpB,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,UAAA,EAAY,CAAA,GAC7C,IAAI,oBAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACrD,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACnC;AASA,eAAsB,kBAAA,GAInB;AACD,EAAA,MAAM,EAAE,cAAA,EAAe,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,cAAA,CAAe,OAAO,CAAA;AAC1C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAC1D","file":"chunk-MS2JK4V7.js","sourcesContent":["/**\n * open-registry.ts — shared helper to create a full AssetKindRegistry.\n *\n * Bootstraps the registry with all built-in providers (9 core + preset)\n * from @skaile/discovery, plus the extension kind providers (flow from\n * @skaile/workspaces/factory-assets/connectors/flow/engine, knowledge from @skaile/library).\n *\n * This is the single registration point for the CLI. All code paths\n * that need a registry (source sync, lib-status, etc.) should use this.\n */\n\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultRegistry } from \"@skaile/workspaces/discovery\";\nimport { flowKindProvider } from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\n/**\n * Create a fully-configured AssetKindRegistry with all known providers.\n *\n * Registers:\n * - 9 core kinds (skill, agent, connector, mount, mcp-server, contract, prompt, persona, ruleset)\n * - preset (composition entity)\n * - flow (extension, from @skaile/workspaces/factory-assets/connectors/flow/engine)\n * - knowledge (extension, from @skaile/library)\n *\n * @returns An unfrozen registry (auto-freezes on first read)\n */\nexport function createFullRegistry(): AssetKindRegistry {\n  const registry = createDefaultRegistry();\n  registry.register(flowKindProvider);\n  registry.register(knowledgeKindProvider);\n  return registry;\n}\n","/**\n * open-library.ts — shared helpers to open the LocalIndex and the configured\n * Catalog source.\n *\n * Lazy-loads the `@skaile/workspaces/library` subpath and returns the\n * LocalIndex instance (backed by `@libsql/client`; runs on Node and Bun).\n * The catalog-source helper reads\n * `~/.skaile/config.yaml` (and project-level overlay if `projectDir` is given)\n * to decide between {@link RemoteCatalogSource} (default — points at\n * `https://skaile.store`) and a {@link LocalCatalogSource} bound to the most\n * recent local library registered via `skaile source add`.\n */\n\nimport { logErr } from \"./helpers.ts\";\nimport { createFullRegistry } from \"./open-registry.ts\";\n\n/** Thrown by {@link openCatalogSource} when `catalog.url` is the `local` sentinel. */\nexport class LocalCatalogDisabledError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"LocalCatalogDisabledError\";\n  }\n}\n\n/**\n * Open the LocalIndex with the full kind registry. Exits with code 1\n * if the library directory cannot be created.\n *\n * @returns A `LocalIndex` instance ready for use.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibrary() {\n  try {\n    const { LocalIndex } = await import(\"@skaile/workspaces/library\");\n    return new LocalIndex({ kindRegistry: createFullRegistry() });\n  } catch (err) {\n    logErr(`Could not open LocalIndex: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Resolve the configured **remote** Catalog source for the CLI.\n *\n * Reads `~/.skaile/config.yaml` (plus the optional project-level overlay) and\n * returns a {@link RemoteCatalogSource} pointing at `catalog.url` (default:\n * `https://skaile.store`). The `cache_ttl: 0` config flag flips the source\n * into air-gapped mode: network reads are disabled, only `skaile update`\n * performs refreshes.\n *\n * **Local-mode rejection.** If the resolved config has `catalog.url: local`\n * this helper throws — callers wanting the dispatched local-or-remote source\n * must use {@link resolveCatalogSource}. Remote-only consumers like\n * `skaile update --catalog-only` rely on this strict behaviour.\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A configured {@link RemoteCatalogSource}.\n * @throws When `catalog.url` is the `local` sentinel.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<\n  | import(\"@skaile/workspaces/library\").RemoteCatalogSource\n  | import(\"@skaile/workspaces/library\").RestCatalogSource\n> {\n  const { resolveConfig, RemoteCatalogSource, RestCatalogSource, isLocalCatalogUrl } = await import(\n    \"@skaile/workspaces/library\"\n  );\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n  if (isLocalCatalogUrl(baseUrl)) {\n    throw new LocalCatalogDisabledError(\n      \"catalog.url is set to 'local' — remote catalog is disabled. \" +\n        \"Use `skaile source add <path>` + `skaile source sync` for local sources, \" +\n        \"or set `catalog.url: https://skaile.store` in ~/.skaile/config.yaml.\",\n    );\n  }\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  if (cfg.catalog.framing === \"rest\") {\n    return new RestCatalogSource({ baseUrl, cacheTtlMs });\n  }\n  return new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n}\n\n/**\n * Resolved catalog source plus a close handle for releasing any underlying\n * resources (e.g. the `LocalIndex` SQLite connection in local mode).\n *\n * Callers MUST invoke `close()` when done — typically in a `finally` block.\n * For remote-mode sources `close()` is a no-op, but the contract is uniform\n * so consumers don't have to branch.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport interface ResolvedCatalogSource {\n  /** The {@link ICatalogSource} ready for use. */\n  source: import(\"@skaile/workspaces/library\").ICatalogSource;\n  /** Release any underlying resources (SQLite handle in local mode). */\n  close(): void;\n}\n\n/**\n * Resolve the configured Catalog source — local or remote — based on\n * `~/.skaile/config.yaml`.\n *\n * Dispatch:\n * - `catalog.url: local` → opens {@link LocalIndex}, picks the most recently\n *   registered local library whose `path` still exists on disk, and returns a\n *   {@link LocalCatalogSource} bound to that library. Throws if no usable\n *   local library is registered.\n * - any URL → returns {@link RemoteCatalogSource} (same as\n *   {@link openCatalogSource}).\n *\n * The returned `close()` releases the underlying `LocalIndex` SQLite handle\n * in local mode (no-op in remote mode). Callers MUST invoke it — typically in\n * a `finally` block — to satisfy `library/CLAUDE.md` § \"Notes for Consumers\".\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A `ResolvedCatalogSource` carrying the source and a close handle.\n * @throws When `local` is configured but no usable local library is registered.\n * @docLink cli/dev-guide#open-library\n */\nexport async function resolveCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<ResolvedCatalogSource> {\n  const {\n    resolveConfig,\n    RemoteCatalogSource,\n    RestCatalogSource,\n    LocalCatalogSource,\n    isLocalCatalogUrl,\n  } = await import(\"@skaile/workspaces/library\");\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n\n  if (isLocalCatalogUrl(baseUrl)) {\n    const fs = await import(\"node:fs\");\n    const library = await openLibrary();\n    try {\n      const sources = await library.listSources();\n      type LibraryRow = (typeof sources)[number];\n      // Type-narrow: `path` is required for local libraries after the filter.\n      const usable = sources\n        .filter(\n          (s): s is LibraryRow & { path: string } =>\n            s.backend === \"local\" && typeof s.path === \"string\" && s.path.length > 0,\n        )\n        .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n      if (usable.length === 0) {\n        throw new Error(\n          \"catalog.url is set to 'local' but no local library is registered. \" +\n            \"Run `skaile source add <path>` first, then `skaile source sync`.\",\n        );\n      }\n\n      // Prefer the most recently added library whose path still exists.\n      const present = usable.find((s) => fs.existsSync(s.path));\n      if (!present) {\n        const head = usable[0];\n        throw new Error(\n          `catalog.url is set to 'local' but every registered local library has a missing path on disk. ` +\n            `Most recent: ${head.path} (library ${head.id}). ` +\n            `Re-register with \\`skaile source add <existing-path>\\` or run \\`skaile source list\\` to inspect.`,\n        );\n      }\n\n      const source = new LocalCatalogSource(\n        library,\n        present.id,\n        present.path,\n        createFullRegistry(),\n      );\n      return { source, close: () => library.close() };\n    } catch (err) {\n      // Release the handle on any failure during dispatch — otherwise the\n      // SQLite WAL state leaks for the lifetime of the process.\n      library.close();\n      throw err;\n    }\n  }\n\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  const source =\n    cfg.catalog.framing === \"rest\"\n      ? new RestCatalogSource({ baseUrl, cacheTtlMs })\n      : new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n  return { source, close: () => {} };\n}\n\n/**\n * Open the LibraryManager bound to the active LocalIndex.\n * Caller owns lifetime — must call `close()` (returned helper closes the\n * underlying LocalIndex).\n *\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibraryManager(): Promise<{\n  manager: import(\"@skaile/workspaces/library\").LibraryManager;\n  library: import(\"@skaile/workspaces/library\").LocalIndex;\n  close: () => void;\n}> {\n  const { LibraryManager } = await import(\"@skaile/workspaces/library\");\n  const library = await openLibrary();\n  const manager = new LibraryManager(library);\n  return { manager, library, close: () => library.close() };\n}\n"]}

package/dist/{chunk-JRSLMZOT.js → chunk-OKGUDNDT.js}

@@ -366,6 +366,8 @@ var AgentStore = class _AgentStore {
   _unnamedEchoesOwed = 0;
   _error = null;
   _isAllLoaded;
+  /** Prompts a cancel dropped before they ran; new Set on every change. */
+  _notSentPromptIds = /* @__PURE__ */ new Set();
   _seq;
   _streamingFlushed = true;
   /** Shared state per store namespace — new Map instance on every mutation. */
@@ -426,6 +428,18 @@ var AgentStore = class _AgentStore {
   get isAllLoaded() {
     return this._isAllLoaded;
   }
+  /** `messageId`s of prompts a cancel dropped before they ran. */
+  get notSentPromptIds() {
+    return this._notSentPromptIds;
+  }
+  /**
+   * Whether `message` is a prompt a cancel dropped before it ran, so the UI
+   * shows it as "Not sent". Matches on the prompt payload's `messageId`.
+   */
+  isPromptNotSent(message) {
+    const payload = message.payload;
+    return payload.type === "prompt" && typeof payload.messageId === "string" && this._notSentPromptIds.has(payload.messageId);
+  }
   // -- Commands --------------------------------------------------------------
   /**
    * Send a user prompt to the agent and optimistically update local state.
@@ -442,8 +456,16 @@ var AgentStore = class _AgentStore {
     this._streamingFlushed = false;
     this._setOpenQuestions([]);
     this._phase = "thinking";
-    this._appendMessage({ type: "prompt", prompt: text }, "user");
-    this._options.send({ type: "prompt", prompt: text });
+    const userId = this._options.userId;
+    if (userId) {
+      const id = crypto.randomUUID();
+      const command = { type: "prompt", prompt: text, messageId: id, senderId: userId };
+      this._appendMessage(command, "user", id);
+      this._options.send(command);
+    } else {
+      this._appendMessage({ type: "prompt", prompt: text }, "user");
+      this._options.send({ type: "prompt", prompt: text });
+    }
     this._notify();
   }
   /**
@@ -498,7 +520,8 @@ var AgentStore = class _AgentStore {
     this._streamingText = "";
     this._streamingFlushed = true;
     this._phase = "cancelling";
-    this._options.send({ type: "cancel" });
+    const userId = this._options.userId;
+    this._options.send(userId ? { type: "cancel", senderId: userId } : { type: "cancel" });
     this._notify();
   }
   /**
@@ -596,6 +619,7 @@ var AgentStore = class _AgentStore {
         pendingQuestion: this._pendingQuestion,
         error: this._error,
         isAllLoaded: this._isAllLoaded,
+        notSentPromptIds: this._notSentPromptIds,
         sharedState: this._sharedState,
         capabilities: this._capabilities,
         activeRenderInvocations: this._activeRenderInvocations,
@@ -772,6 +796,12 @@ var AgentStore = class _AgentStore {
         this._incompatibleProtocol = null;
         break;
       }
+      case "queued_prompts_dropped": {
+        const fresh = event.messageIds.filter((id) => !this._notSentPromptIds.has(id));
+        if (fresh.length === 0) return;
+        this._notSentPromptIds = /* @__PURE__ */ new Set([...this._notSentPromptIds, ...fresh]);
+        break;
+      }
       case "incompatible_protocol":
         this._incompatibleProtocol = event;
         break;
@@ -798,12 +828,12 @@ var AgentStore = class _AgentStore {
     this._streamingFlushed = true;
     return true;
   }
-  _appendMessage(payload, senderId) {
+  _appendMessage(payload, senderId, id = crypto.randomUUID()) {
     this._seq++;
     this._messages = [
       ...this._messages,
       {
-        id: crypto.randomUUID(),
+        id,
         seq: this._seq,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         sessionId: this._options.sessionId,
@@ -821,5 +851,5 @@ var AgentStore = class _AgentStore {
 };
 
 export { AgentStore, ResourceClient, ResourceRequestError };
-//# sourceMappingURL=chunk-JRSLMZOT.js.map
-//# sourceMappingURL=chunk-JRSLMZOT.js.map
+//# sourceMappingURL=chunk-OKGUDNDT.js.map
+//# sourceMappingURL=chunk-OKGUDNDT.js.map