@skaile/workspaces 5.10.0 → 5.12.0

package/dist/{chunk-2JMLDZLP.js → chunk-TVAR4JHA.js}

@@ -1,18 +1,18 @@
-import { unregisteredLibraryNames, scanUnlistedAssets, getStoreManifestsDir, missingLibraryDirMessage } from './chunk-3BEY4WK3.js';
-import { readManifestSourceConfig, isManifestMode, discoverAssetsInTree } from './chunk-GEWAIQZ5.js';
-import { installTargetOf, canonicalEntryRef, deployAll, removeAsset, diffDeployedAgent, createScaffold, installAgent } from './chunk-PE36IF2D.js';
+import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, getStoreManifestsDir, missingLibraryDirMessage } from './chunk-C3BMXXTN.js';
+import { readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-7CR2OZPA.js';
+import { installTargetOf, canonicalEntryRef, deployAll, removeAsset, diffDeployedAgent, removeExcludedLeftovers, deployedAssetDrift, createScaffold, installAgent } from './chunk-NJV5SLEK.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { driverTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-6HHE63CO.js';
-import { resolveConfiguredDriverTarget, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, buildLockFile, writeLock, readLock, verifyLock, mergeLockFile, extractForPatch, generatePatch, savePatch, applyPatch } from './chunk-2FMEGSBN.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-GFCXNFTW.js';
+import { driverTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-7QWQTA5S.js';
+import { resolveConfiguredDriverTarget, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, computeHash, buildLockFile, writeLock, readLock, verifyLock, mergeLockFile, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-T5TSLSRO.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-SHQMPGOL.js';
 import { deployedBase, deployedDir, isDeployed, deployedPaths } from './chunk-PMECEZK3.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, resolveAll, ensureRepo, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, readLinks, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID, resolveAgentDefinitionDir, storeManifestSlug } from './chunk-JZCSNEHK.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, resolveAll, agentSourceCacheDir, ensureRepo, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID, resolveAgentDefinitionDir, storeManifestSlug } from './chunk-PNOGX36L.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
 import { DRIVER_TARGETS } from './chunk-CPSIPIX7.js';
-import { loadSkPublishManifest } from './chunk-IXWODEED.js';
-import { scanDirectory, parseRequires, dedupeRequirements } from './chunk-Y34MSWEZ.js';
-import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr } from './chunk-4OV5DSBB.js';
+import { loadSkPublishManifest } from './chunk-CTP3XBMF.js';
+import { scanDirectory, parseRequires, dedupeRequirements } from './chunk-XTVSNWLL.js';
+import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-PNTXHTBC.js';
 import { spawnSync } from 'child_process';
 import { existsSync, rmSync, readdirSync, lstatSync, unlinkSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 import path, { resolve, dirname, sep, join, relative, posix } from 'path';
@@ -40,13 +40,10 @@ function writeLedger(projectDir, ledger) {
 function bindInstance(projectDir, id, instance) {
   const errors = [];
   let srcDir;
-  const addHint = instance.ref.startsWith("agent:") ? ` \u2014 add the agent first: run skaile add ${instance.ref}` : "";
   try {
     srcDir = resolveAgentDefinitionDir(projectDir, instance.ref);
   } catch (err) {
-    errors.push(
-      `agent instance "${id}": ${err instanceof Error ? err.message : String(err)}${addHint}`
-    );
+    errors.push(`agent instance "${id}": ${err instanceof Error ? err.message : String(err)}`);
   }
   if (srcDir !== void 0 && !existsSync(join(srcDir, "agent.yaml"))) {
     errors.push(
@@ -404,6 +401,19 @@ function filesUnderManifestDir(paths, manifestRel) {
   const manifestDir = posix.dirname(manifestRel);
   return paths.map((p) => posix.relative(manifestDir, p)).filter((rel) => rel !== "" && !rel.startsWith(".."));
 }
+function lockedAssetFiles(kind, files) {
+  const manifestRel = matchManifestPath(
+    kind,
+    files.map((f) => f.path)
+  ) ?? files[0]?.path;
+  if (!manifestRel) return [];
+  const manifestDir = posix.dirname(manifestRel);
+  return files.flatMap((f) => {
+    const rel = posix.relative(manifestDir, f.path);
+    return rel === "" || rel.startsWith("..") ? [] : [{ rel, sha256: f.sha256 }];
+  });
+}
+var GITHUB_REPO_URL = /github\.com[/:]/i;
 function indexLockByKindName(lock) {
   const lockByKindName = /* @__PURE__ */ new Map();
   for (const [key, entry] of Object.entries(lock?.assets ?? {})) {
@@ -438,6 +448,28 @@ function commitsBetween(repoDir, from, to, cache) {
   return count;
 }
 var COMMIT_ID = /^[0-9a-f]{7,64}$/;
+function commitsTouching(repoDir, from, to, dir, cache) {
+  if (!COMMIT_ID.test(from) || !COMMIT_ID.test(to)) return null;
+  if (from === to) return 0;
+  const key = `${from}..${to} -- ${dir}`;
+  const hit = cache.get(key);
+  if (hit !== void 0) return hit;
+  const r = spawnSync("git", ["-C", repoDir, "rev-list", "--count", `${from}..${to}`, "--", dir], {
+    encoding: "utf8",
+    stdio: "pipe"
+  });
+  const n = r.status === 0 ? Number.parseInt(r.stdout.trim(), 10) : Number.NaN;
+  if (!Number.isFinite(n) || n < 0) return null;
+  cache.set(key, n);
+  return n;
+}
+function lockedAssetDir(kind, files) {
+  const manifestRel = matchManifestPath(
+    kind,
+    files.map((f) => f.path)
+  ) ?? files[0]?.path;
+  return manifestRel ? posix.dirname(manifestRel) : ".";
+}
 function libraryDiskHashes(libPath, cache, registry) {
   let hashes = cache.get(libPath);
   if (!hashes) {
@@ -509,7 +541,7 @@ function newestLibraryDef(snap, libraryName, id) {
   }
   return best;
 }
-function libraryPreference(isDefaultLib) {
+function libraryPreference(isDefaultLib, rank) {
   return (a, b) => {
     const va = coerceVersion(a.entry.version ?? "");
     const vb = coerceVersion(b.entry.version ?? "");
@@ -517,7 +549,9 @@ function libraryPreference(isDefaultLib) {
     if (gt(vb, va)) return 1;
     const da = isDefaultLib.get(a.library) ? 0 : 1;
     const db = isDefaultLib.get(b.library) ? 0 : 1;
-    return da - db || a.library.localeCompare(b.library);
+    if (da !== db) return da - db;
+    const byRank = rank ? rank(a) - rank(b) : 0;
+    return byRank || a.library.localeCompare(b.library);
   };
 }
 function qualifyDepRef(ref, fallback) {
@@ -652,8 +686,7 @@ function withKeptLockEntries(lock, kept) {
   for (const s of kept.sources) if (!sources.has(s.url)) sources.set(s.url, s);
   return {
     ...lock,
-    // v4 once a library-origin entry is present (see buildLockFile).
-    schema_version: lock.schema_version === 4 || Object.values(kept.assets).some((e) => e.library) ? 4 : 3,
+    schema_version: LOCK_SCHEMA_VERSION,
     assets: { ...lock.assets, ...kept.assets },
     sources: [...sources.values()].sort((a, b) => a.url.localeCompare(b.url))
   };
@@ -674,10 +707,39 @@ function relockedRefs(prev, next) {
   }
   return out;
 }
+function libraryMoves(prev, next) {
+  if (!prev) return [];
+  const out = [];
+  for (const [key, entry] of Object.entries(next)) {
+    const to = entry.library;
+    if (!to || to.installed) continue;
+    const id = parseCanonicalLockKey(key);
+    for (const [prevKey, before] of Object.entries(prev.assets)) {
+      const o = parseCanonicalLockKey(prevKey);
+      if (o.kind !== id.kind || o.name !== id.name || o.publisher !== id.publisher) continue;
+      const from = before.library;
+      if (!from || from.installed || from.name === to.name) continue;
+      out.push({ ref: `${id.kind}:@${id.publisher}/${id.name}`, from: from.name, to: to.name });
+      break;
+    }
+  }
+  return out;
+}
 function unregisteredLibraryFix(origin, ref) {
   const register = origin.url ? `\`skaile library init ${origin.name} --git ${origin.url}\` (no registered library has the remote ${origin.url} either)` : `\`skaile library init ${origin.name} --path <dir>\``;
   return `register library "${origin.name}" again with ${register}, or drop the dependency with \`skaile remove ${ref}\``;
 }
+function declaredNoHolderReason(ref) {
+  return `is declared but no library or source holds it \u2014 register the library that holds it with \`skaile library init <name> --path <dir>\`, or drop it with \`skaile remove ${ref.split("#")[0]}\``;
+}
+var REGISTER_HOLDER = "register the library that holds it with `skaile library init <name> --path <dir>`";
+function requirementNoHolderFix(asset) {
+  return `${REGISTER_HOLDER}, or drop ${asset} with \`skaile remove ${asset}\``;
+}
+function sameAsset(ref, want) {
+  const p = parseRefTolerant(ref);
+  return p !== null && p.kind === want.kind && p.name === want.name && (!want.publisher || !p.publisher || p.publisher === want.publisher);
+}
 function lockedLibraryProblem(lookup, origin, ref) {
   return lookup.state === "dir-missing" ? missingLibraryDirMessage({ name: origin.name, path: lookup.path }) : `library "${origin.name}" is not registered \u2014 renamed or removed? ${unregisteredLibraryFix(origin, ref)}`;
 }
@@ -767,6 +829,17 @@ var AssetManager = class {
   onLibraryCollision;
   /** Store URLs whose failed version lookup was already reported (one warning per URL). */
   warnedStoreVersionLookups = /* @__PURE__ */ new Set();
+  /** Stores a lookup could not reach (store URL -> one line why); `add` reports them instead of "not found". */
+  storeFailures = /* @__PURE__ */ new Map();
+  /** Sources a provenance walk had to skip (source URL → why); one warning per source. */
+  skippedSources = /* @__PURE__ */ new Map();
+  /** `onSourceError` of every provenance walk: name the source once, leave it out, go on. */
+  reportSourceError = (clone, err) => {
+    const why = err instanceof Error ? err.message : String(err);
+    if (this.skippedSources.has(clone.sourceUrl)) return;
+    this.skippedSources.set(clone.sourceUrl, why);
+    console.warn(`skaile: source ${clone.sourceUrl} skipped: ${why}`);
+  };
   constructor(opts) {
     this.projectDir = resolve(opts.projectDir);
     this.global = opts.global ?? false;
@@ -801,15 +874,27 @@ var AssetManager = class {
     return this.global ? globalSkaileDir() : this.projectDir;
   }
   /**
-   * The harnesses a global deploy fans out to: the explicit `harnesses` override
-   * (a `--harness` filter), else `resolveGlobalHarnesses()`. In project mode this
-   * is exactly `[driverTarget]`, so the shared fan-out loop degenerates to the
+   * The harnesses a global deploy fans out to: the explicit `harnesses` override (a `--harness`
+   * filter), else the explicit `global_harnesses:` of `~/.skaile/skaile.yaml`, else every harness
+   * whose root dir exists under `~` plus the harness the project is configured for (a project on
+   * a harness whose dir does not exist yet still gets its user-scope assets). In project mode
+   * this is exactly `[driverTarget]`, so the shared fan-out loop degenerates to the
    * single-target path.
    */
   targetHarnesses() {
     if (!this.global) return [this.driverTarget];
     if (this.harnessesOverride && this.harnessesOverride.length > 0) return this.harnessesOverride;
-    return resolveGlobalHarnesses();
+    const resolved = resolveGlobalHarnesses();
+    if (resolveGlobalSkWorkspaceConfig().global_harnesses?.length) return resolved;
+    const configured = resolveConfiguredDriverTarget(this.projectDir);
+    return configured && !resolved.includes(configured) ? [...resolved, configured] : resolved;
+  }
+  /**
+   * The harnesses `add` / `install` deploy into: `[driverTarget]` for a project, the global
+   * harness set (see {@link AssetManager.targetHarnesses}) for a global manager.
+   */
+  deployTargets() {
+    return this.targetHarnesses();
   }
   get storeCacheDir() {
     if (this.global) return join(globalCacheRoot(), "store");
@@ -841,14 +926,15 @@ var AssetManager = class {
   }
   /** Deploy options for one harness. In global mode, `driverTarget` is the
    * fan-out target (not the constructor's `driverTarget`, which is project-only). */
-  deployOptsFor(target, link, onSkippedSymlink) {
+  deployOptsFor(target, link, onSkippedSymlink, onEnvFile) {
     return {
       registry: this.registry,
       driverTarget: target,
       global: this.global,
       cwd: this.projectDir,
       link: link === true,
-      ...onSkippedSymlink ? { onSkippedSymlink: (entry, p) => onSkippedSymlink(canonicalEntryRef(entry), p) } : {}
+      ...onSkippedSymlink ? { onSkippedSymlink: (entry, p) => onSkippedSymlink(canonicalEntryRef(entry), p) } : {},
+      ...onEnvFile ? { onEnvFile: (entry, p) => onEnvFile(canonicalEntryRef(entry), p) } : {}
     };
   }
   /**
@@ -878,13 +964,18 @@ var AssetManager = class {
    * skills resolve. Project scope only. An instance whose `ref` resolves to no agent is
    * reported in `agentInstanceErrors`; any other render error is warned and swallowed.
    */
-  renderAgentInstances() {
+  async renderAgentInstances() {
     if (this.global) return {};
     try {
       const result = installAgentInstances({
         projectDir: this.projectDir,
         driverTarget: this.driverTarget
       });
+      for (const u of unboundAgentInstances(this.projectDir, this.driverTarget)) {
+        if (!u.ref.startsWith("agent:")) continue;
+        const at = result.errors.findIndex((e) => e.startsWith(`agent instance "${u.id}":`));
+        if (at >= 0) result.errors[at] += ` \u2014 ${(await this.unboundAgentAdvice(u.ref)).advice}`;
+      }
       for (const w of [...result.warnings, ...result.errors]) console.warn(`skaile: ${w}`);
       return {
         agentInstances: result.instances,
@@ -1007,6 +1098,31 @@ var AssetManager = class {
     if (c.homepage != null) entry.homepage = c.homepage;
     return entry;
   }
+  /**
+   * The {@link ProvenanceCandidate} a source- or store-origin lock entry stands for: what a
+   * deploy needs to restore the asset from the commit the lock names (`files[]` is the asset's
+   * whole file set). `null` for a library-origin entry or a key that is not a canonical ref.
+   * The source URL is the declared source's own spelling (the bundled factory tree and a
+   * `sources:` entry match their declaration by it).
+   */
+  lockedCandidate(key, entry, repositories) {
+    if (!entry.source) return null;
+    const { publisher, kind, name, version } = parseCanonicalLockKey(key);
+    if (!publisher || !kind || !name) return null;
+    const url = entry.source.url;
+    const factory = Object.values(repositories).find((d) => d.factory);
+    const declared = factory?.url !== void 0 && normalizeRepoUrl(url) === normalizeRepoUrl(factory.url) ? factory : repositories[sourceCacheKey(url)];
+    return {
+      publisher,
+      kind,
+      name,
+      version: version ?? "",
+      sourceUrl: declared?.url ?? url,
+      commit: entry.source.commit,
+      files: entry.files,
+      sha256: entry.sha256
+    };
+  }
   /**
    * Resolve refs the source/store pass could not against the user's registered
    * **libraries** (local authoring places). Each library dir is scanned on disk
@@ -1024,6 +1140,9 @@ var AssetManager = class {
    *   builds an error hint must not warn).
    * @param opts.library - Resolve only from this library (the one a lock entry names), not
    *   from every registered one. Never warns: no choice is made between libraries.
+   * @param opts.lockedLibraries - `kind:publisher/name` → the library its lock entry names
+   *   ({@link AssetManager.lockedLibraryNames}). A ref listed here resolves from that library
+   *   when it holds a match, whatever the default library is.
    * @returns the matched deploy entries, the set of `missing` refs covered, and
    *   each entry's originating library name.
    */
@@ -1036,6 +1155,7 @@ var AssetManager = class {
     const { byKey, isDefaultLib, libraryDir } = scan;
     const entries = [];
     const fileSets = /* @__PURE__ */ new Map();
+    const diskHashes = /* @__PURE__ */ new Map();
     let snap;
     const allCandidates = [...byKey.values()].flat();
     for (const ref of missing) {
@@ -1044,12 +1164,53 @@ var AssetManager = class {
       const hash = ref.indexOf("#");
       const pin = parsed.pin ?? (hash >= 0 ? ref.slice(hash + 1) : void 0);
       const key = parsed.publisher ? `${parsed.kind}:@${parsed.publisher}/${parsed.name}` : void 0;
-      const pool = (key ? byKey.get(key) ?? [] : allCandidates.filter(
+      const scanned = (key ? byKey.get(key) ?? [] : allCandidates.filter(
         (c) => c.entry.kind === parsed.kind && c.entry.name === parsed.name
       )).filter((c) => !opts.library || c.library === opts.library);
-      const candidates = pool.filter((c) => !pin || matchPin(pin, c.entry.version ?? ""));
+      const pool = [];
+      for (const c of scanned) {
+        if (c.entry.version) {
+          pool.push(c);
+          continue;
+        }
+        if (snap === void 0) snap = await this.loadLibraryIndex();
+        const def = newestLibraryDef(snap, c.library, {
+          kind: c.entry.kind,
+          publisher: c.entry.publisher ?? "",
+          name: c.entry.name
+        });
+        pool.push(def?.version ? { ...c, entry: { ...c.entry, version: def.version } } : c);
+      }
+      let candidates = pool.filter((c) => !pin || matchPin(pin, c.entry.version ?? ""));
+      let lockedLibrary;
+      const lockedMap = opts.preferLocked?.libraries ?? opts.lockedLibraries;
+      if (parsed.publisher) {
+        lockedLibrary = lockedMap?.get(
+          `${parsed.kind}:${parsed.publisher.replace(/^@/, "")}/${parsed.name}`
+        );
+      } else {
+        const same = [...lockedMap ?? []].filter(([k]) => {
+          const slash = k.indexOf("/");
+          return k.startsWith(`${parsed.kind}:`) && k.slice(slash + 1) === parsed.name;
+        });
+        if (same.length === 1) lockedLibrary = same[0][1];
+      }
+      if (lockedLibrary && !opts.preferLocked) {
+        const inLocked = candidates.filter((c) => c.library === lockedLibrary);
+        if (inLocked.length > 0) candidates = inLocked;
+      }
       if (candidates.length === 0) continue;
-      candidates.sort(libraryPreference(isDefaultLib));
+      const prefer = opts.preferLocked ? (c) => {
+        if (lockedLibrary && c.library === lockedLibrary) return 0;
+        const id = `${c.entry.kind}:${(c.entry.publisher ?? "").replace(/^@/, "")}/${c.entry.name}`;
+        const lockedSha = opts.preferLocked?.shas.get(id);
+        const libPath = libraryDir.get(c.library);
+        const onDisk = lockedSha && libPath ? libraryDiskHashes(libPath, diskHashes, this.registry).get(
+          `${c.entry.kind}:${c.entry.name}`
+        ) : void 0;
+        return onDisk !== void 0 && onDisk === lockedSha ? 1 : 2;
+      } : void 0;
+      candidates.sort(libraryPreference(isDefaultLib, prefer));
       const hit = candidates[0];
       if (!opts.quiet && !opts.library) {
         this.warnLibraryCollision(
@@ -1058,16 +1219,7 @@ var AssetManager = class {
           hit
         );
       }
-      let entry = hit.entry;
-      if (!entry.version) {
-        if (snap === void 0) snap = await this.loadLibraryIndex();
-        const def = newestLibraryDef(snap, hit.library, {
-          kind: entry.kind,
-          publisher: entry.publisher ?? "",
-          name: entry.name
-        });
-        if (def?.version) entry = { ...entry, version: def.version };
-      }
+      const entry = hit.entry;
       withLibraryFiles(entry, libraryDir.get(hit.library), fileSets, this.registry);
       entries.push(entry);
       libraryOf.set(entry, hit.library);
@@ -1199,7 +1351,8 @@ var AssetManager = class {
     const cloneDirs = new Set(clones.map((c) => resolve(c.localPath)));
     const index = await buildProvenanceIndex(clones, {
       projectDir: this.projectDir,
-      knownKinds: this.knownKinds
+      knownKinds: this.knownKinds,
+      onSourceError: this.reportSourceError
     });
     const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
     const hasFactory = Object.values(repositories).some((d) => d.factory);
@@ -1408,6 +1561,34 @@ var AssetManager = class {
       publisher: ref?.publisher ?? entry.publisher?.replace(/^@/, "")
     };
   }
+  /**
+   * Refuse to lock a source commit another machine cannot check out. A commit made in the clone
+   * itself (or one `source sync` could not fast-forward past) is in no remote branch: the lock
+   * would name bytes nobody else has, and `install --locked` there could not restore them.
+   * Linked (dev-override) and user-owned local sources are never checked: their lock is
+   * machine-local by choice.
+   *
+   * @param resolved - Candidates about to be locked.
+   * @param repositories - Source declarations of the project.
+   * @throws With `<url> clone has unpublished commit <sha>` and the way out.
+   */
+  assertSourceCommitsPublished(resolved, repositories) {
+    const links = readLinks(this.projectDir);
+    const checked = /* @__PURE__ */ new Set();
+    for (const c of resolved) {
+      if (!c.commit || /^0+$/.test(c.commit) || checked.has(`${c.sourceUrl}@${c.commit}`)) continue;
+      checked.add(`${c.sourceUrl}@${c.commit}`);
+      const hit = Object.entries(repositories).find(
+        ([, d]) => d.url !== void 0 && !d.factory && d.url === c.sourceUrl
+      );
+      if (!hit || links[hit[0]]) continue;
+      const dir = this.resolveRepoDir(hit[1], hit[0]);
+      if (!dir || isCommitOnRemote(dir, c.commit)) continue;
+      throw new Error(
+        `${c.sourceUrl} clone has unpublished commit ${c.commit.slice(0, 7)} - push it, or reset the clone (git -C ${dir} reset --hard origin/${hit[1].branch ?? "main"}) - nothing was locked`
+      );
+    }
+  }
   /**
    * Refuse assets of one kind and name from different publishers: they deploy into the
    * same folder, so the later one would silently overwrite the earlier. Throws one line
@@ -1697,6 +1878,11 @@ var AssetManager = class {
       } catch {
       }
     }
+    if (byName.state === "unregistered") {
+      const renamed = renamedLibraryName(name);
+      const now = renamed ? snap?.libraries.find((l) => l.name === renamed) : void 0;
+      if (now && existsSync(now.path)) return { state: "ok", path: now.path, name: now.name };
+    }
     if (byName.state === "ok" || !origin.url) return byName;
     const wanted = normalizeRepoUrl(origin.url);
     const byUrl = snap?.libraries.find((l) => {
@@ -1710,6 +1896,14 @@ var AssetManager = class {
     const found = this.lockedLibrary(origin, snap);
     return found.state === "ok" ? found.path : null;
   }
+  /**
+   * The `kind:@publisher/name` identities the lock holds for one `kind` and `name`, whatever
+   * their publisher. `diff` uses it to accept a ref without a publisher only when it names
+   * exactly one locked asset.
+   */
+  lockedRefsNamed(kind, name) {
+    return Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey).filter((id) => id.kind === kind && id.name === name).map((id) => id.publisher ? `${kind}:@${id.publisher}/${name}` : `${kind}:${name}`);
+  }
   /**
    * Where each library-origin lock entry of this project resolves on this machine: identity
    * `kind:publisher/name` (no scope sigil, no version) → the name the locked library is
@@ -1739,6 +1933,19 @@ var AssetManager = class {
     }
     return out;
   }
+  /**
+   * What `update` prefers when libraries tie: the library each lock entry resolves to here
+   * ({@link lockedLibraryNames}, a `library rename` followed) and the sha256 it locked.
+   */
+  async lockedPreference() {
+    const shas = /* @__PURE__ */ new Map();
+    for (const [key, e] of Object.entries(this.tryReadLock()?.assets ?? {})) {
+      if (!e.library?.sha256 || e.library.installed) continue;
+      const { publisher, kind, name } = parseCanonicalLockKey(key);
+      if (publisher && kind && name) shas.set(`${kind}:${publisher}/${name}`, e.library.sha256);
+    }
+    return { libraries: await this.lockedLibraryNames(), shas };
+  }
   // ── Store fetch-then-deploy ────────────────────────────────────────────
   /** A candidate's stable identity key (`<publisher>/<kind>:<name>@<version>`). */
   candidateKey(c) {
@@ -1804,6 +2011,7 @@ var AssetManager = class {
     const resolved = [];
     const overridesApplied = /* @__PURE__ */ new Set();
     const presets = [];
+    const requiredBy = /* @__PURE__ */ new Map();
     const lib = { entries: [], resolved: /* @__PURE__ */ new Set(), libraryOf: /* @__PURE__ */ new Map() };
     const missing = /* @__PURE__ */ new Set();
     const seen = /* @__PURE__ */ new Set();
@@ -1852,6 +2060,13 @@ var AssetManager = class {
             return depId !== null && declaredById.get(depId) || dep;
           })
         );
+        if (e.kind !== "preset") {
+          for (const dep of deps2) {
+            const depId = refIdentity(dep);
+            if (depId !== null && declaredById.has(depId)) continue;
+            requiredBy.set(dep, [...requiredBy.get(dep) ?? [], canonicalEntryRef(e)]);
+          }
+        }
       }
       for (const r of hit.resolved) lib.resolved.add(r);
       return next;
@@ -1875,7 +2090,9 @@ var AssetManager = class {
         })
       );
       const hit = await this.resolveLibraryEntries([...libraryTried], {
-        quiet: !opts.warnCollisions
+        quiet: !opts.warnCollisions,
+        lockedLibraries: opts.lockedLibraries,
+        preferLocked: opts.preferLocked
       });
       const next = absorb(hit);
       const rest = fresh.filter((ref) => !hit.resolved.has(ref));
@@ -1892,7 +2109,11 @@ var AssetManager = class {
         presets.push(...r.presets);
         const hit2 = await this.resolveLibraryEntries(
           r.missing.filter((m) => !libraryTried.has(m)),
-          { quiet: !opts.warnCollisions }
+          {
+            quiet: !opts.warnCollisions,
+            lockedLibraries: opts.lockedLibraries,
+            preferLocked: opts.preferLocked
+          }
         );
         next.push(...absorb(hit2));
         for (const m of r.missing) if (!hit2.resolved.has(m)) missing.add(m);
@@ -1903,7 +2124,7 @@ var AssetManager = class {
       const id = refIdentity(m);
       return !lib.resolved.has(m) && !(id !== null && covered.has(id));
     });
-    return { resolved, missing: stillMissing, overridesApplied, lib, presets };
+    return { resolved, missing: stillMissing, overridesApplied, lib, presets, requiredBy };
   }
   /** The catalog fetcher to use: an injected one, else built from `stores`. */
   storeFetcherFor(stores) {
@@ -1918,8 +2139,8 @@ var AssetManager = class {
     let url = this.catalogUrlOverride;
     if (url === void 0) {
       try {
-        const { resolveConfig } = await import('./library/index.js');
-        url = resolveConfig({ projectDir: this.projectDir }).catalog.url;
+        const { resolveConfig: resolveConfig2 } = await import('./library/index.js');
+        url = resolveConfig2({ projectDir: this.projectDir }).catalog.url;
       } catch {
         return [];
       }
@@ -1977,13 +2198,31 @@ var AssetManager = class {
         // from source.url@commit and ignores it, so "" is inert.
         tier: ""
       };
-      const { installPath } = await installFromManifest({
-        manifest,
-        libraryRoot: this.storeCacheDir,
-        targetDir,
-        fetcher: this.injectedAssetFetcher
+      const root = commonDirPrefix(c.files.map((f) => f.path));
+      const intact = c.files.every((f) => {
+        const rel = root && f.path.startsWith(`${root}/`) ? f.path.slice(root.length + 1) : f.path;
+        try {
+          return computeHash(join(targetDir, rel)) === f.sha256;
+        } catch {
+          return false;
+        }
       });
-      staged.set(this.candidateKey(c), join(installPath, this.stagedManifestRel(c)));
+      if (intact) {
+        staged.set(this.candidateKey(c), join(targetDir, this.stagedManifestRel(c)));
+        continue;
+      }
+      try {
+        const { installPath } = await installFromManifest({
+          manifest,
+          libraryRoot: this.storeCacheDir,
+          targetDir,
+          fetcher: this.injectedAssetFetcher
+        });
+        staged.set(this.candidateKey(c), join(installPath, this.stagedManifestRel(c)));
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new Error(`${manifest.ref} (${c.sourceUrl} at ${c.commit.slice(0, 7)}): ${reason}`);
+      }
     }
     return staged;
   }
@@ -2065,6 +2304,9 @@ var AssetManager = class {
    * @param opts.link - When `true`, symlink local-path assets instead of copying them
    *   (the author dev-loop). Machine-local / not for committing; a no-op for
    *   store/factory sources. Defaults to copy.
+   * @param opts.moveLibraries - When `true` (`skaile update`), a locked library asset is
+   *   re-resolved from every library and may move to another one; {@link InstallResult.moved}
+   *   lists the moves. Without it a locked asset stays on the library its lock entry names.
    * @returns {@link InstallResult} summarising what was deployed, what was missing, and any collisions.
    */
   async install(opts) {
@@ -2090,14 +2332,43 @@ var AssetManager = class {
     if (cloneError) return cloneError;
     const provenanceIndex = await buildProvenanceIndex(this.buildClones(repositories), {
       projectDir: this.projectDir,
-      knownKinds: this.knownKinds
+      knownKinds: this.knownKinds,
+      onSourceError: this.reportSourceError
+    });
+    const { resolved, missing, overridesApplied, lib, presets, requiredBy } = await this.resolveLibraryFirst(dependencies, {
+      provenanceIndex,
+      overrides,
+      stores,
+      declaredRefs: dependencies,
+      // `install` restores what the lock recorded: a changed default library or a second
+      // library holding the same ref does not move a locked asset. `update` re-resolves.
+      ...opts?.moveLibraries ? { preferLocked: await this.lockedPreference() } : { lockedLibraries: await this.lockedLibraryNames() }
     });
-    const { resolved, missing, overridesApplied, lib, presets } = await this.resolveLibraryFirst(
-      dependencies,
-      { provenanceIndex, overrides, stores, declaredRefs: dependencies }
-    );
     this.assertNoFolderCollision([...resolved, ...lib.entries.map((e) => this.entryIdentity(e))]);
+    this.assertSourceCommitsPublished(resolved, repositories);
     const stillMissing = missing.filter((m) => !lib.resolved.has(m));
+    const lockedKeys = new Set(Object.keys(this.tryReadLock()?.assets ?? {}));
+    const unmetByNew = /* @__PURE__ */ new Map();
+    for (const m of stillMissing) {
+      const newcomers = (requiredBy.get(m) ?? []).filter((parent) => !lockedKeys.has(parent));
+      if (newcomers.length > 0) unmetByNew.set(m, newcomers);
+    }
+    if (unmetByNew.size > 0) {
+      const hints = {};
+      for (const [m, parents] of unmetByNew) {
+        const requirer = parents.map((p) => p.split("#")[0]).join(", ");
+        hints[m] = ` is required by ${requirer} (not found \u2014 ${REGISTER_HOLDER}, or drop ${requirer} with \`skaile remove ${parents[0].split("#")[0]}\`) \u2014 nothing was installed`;
+      }
+      return {
+        deployed: [],
+        removed: [],
+        missing: [...unmetByNew.keys()],
+        missingHints: hints,
+        lockWritten: false,
+        npmInstalled: [],
+        npmFailed: []
+      };
+    }
     const missingHints = await this.publisherChangeHints(stillMissing);
     const prevLock = this.tryReadLock();
     const kept = keptLockEntries(prevLock, stillMissing);
@@ -2122,6 +2393,7 @@ var AssetManager = class {
       /* @__PURE__ */ new Set([...Object.keys(libraryLock), ...Object.keys(kept.assets)])
     );
     const entries = [...await this.buildCatalogEntries(resolved, repositories), ...lib.entries];
+    const copyDrift = await this.lockedCopyDrift();
     const deployed = [
       ...new Set(
         this.targetHarnesses().flatMap(
@@ -2129,25 +2401,32 @@ var AssetManager = class {
         )
       )
     ];
+    let restored = this.restoredCopies(copyDrift, deployed);
     await this.renderDriverMcpConfig();
-    const agentRender = this.renderAgentInstances();
+    const agentRender = await this.renderAgentInstances();
     const lockWanted = resolved.length > 0 || lib.entries.length > 0 || existsSync(this.lockPath);
     let lockWritten = false;
     let relocked = [];
+    let moved = [];
     if (lockWanted) {
       const lockData = withKeptLockEntries(freshLock, kept);
       relocked = relockedRefs(prevLock, lockData);
+      restored = [...restored, ...this.removeExcludedLeftovers(relocked)];
+      moved = libraryMoves(prevLock, libraryLock);
       lockWritten = writeLock(this.lockPath, lockData);
     }
     this.recordInstallHistory(deployed, removed);
     const { npmInstalled, npmFailed } = await this.installRuntimeAssetDeps();
+    await this.adviseMissing(stillMissing, missingHints);
     return {
       deployed,
       removed,
       missing: stillMissing,
       ...Object.keys(missingHints).length > 0 ? { missingHints } : {},
       ...relocked.length > 0 ? { relocked } : {},
+      ...moved.length > 0 ? { moved } : {},
       ...replaced.length > 0 ? { replaced } : {},
+      ...restored.length > 0 ? { restored } : {},
       lockWritten,
       npmInstalled,
       npmFailed,
@@ -2193,7 +2472,8 @@ var AssetManager = class {
     const { kind, name, publisher } = id;
     const component = kind ? this.installTarget(kind) : void 0;
     if (!kind || !name || !component) return [];
-    const dir = deployedDir(component, name, this.driverTarget, this.global, this.projectDir);
+    const keptAgent = kind === "agent" && !this.global ? join(agentSourceCacheDir(this.projectDir), name) : null;
+    const dir = keptAgent && existsSync(keptAgent) ? keptAgent : deployedDir(component, name, this.driverTarget, this.global, this.projectDir);
     if (!existsSync(dir)) return [];
     try {
       const scanned = await scanDirectory(dir, publisher ?? "", { knownKinds: this.knownKinds });
@@ -2317,13 +2597,33 @@ var AssetManager = class {
       return null;
     }
   }
+  /**
+   * A catalog client for `storeUrl` that honours `catalog.cache_ttl` (`0` = air-gapped: no
+   * network, so every lookup that is not cached throws `OfflineError`).
+   */
+  remoteStore(storeUrl) {
+    let cacheTtlMs;
+    try {
+      cacheTtlMs = resolveConfig({ projectDir: this.projectDir }).catalog.cache_ttl * 1e3;
+    } catch {
+    }
+    return new RemoteCatalogSource({ baseUrl: storeUrl, cacheTtlMs });
+  }
+  /**
+   * Remember why a store could not be asked (store URL → one line without a JS error class
+   * name), so `add` can say `store unreachable` instead of a bare `Asset not found`.
+   */
+  noteStoreFailure(storeUrl, err) {
+    const text = err instanceof OfflineError ? `${storeUrl}: air-gapped (catalog.cache_ttl: 0), the store was not asked` : describeCatalogError(err, storeUrl);
+    this.storeFailures.set(storeUrl, text);
+    return text;
+  }
   /** Build a store fetcher from the configured stores, or undefined when none. */
   buildStoreFetcher(stores) {
     if (stores.length === 0) return void 0;
     return {
       getInstallManifest: async (storeUrl, ref) => {
-        const { RemoteCatalogSource, CatalogHttpError } = await import('./library/index.js');
-        const src = new RemoteCatalogSource({ baseUrl: storeUrl });
+        const src = this.remoteStore(storeUrl);
         try {
           const m = await src.getInstallManifest(ref);
           let deps;
@@ -2336,7 +2636,7 @@ var AssetManager = class {
             else if (deps === void 0)
               gap = `has a cached catalog row for ${ref} without dependencies`;
           } catch (err) {
-            gap = `dependency lookup for ${ref} failed \u2014 ${err}`;
+            gap = `dependency lookup for ${ref} failed \u2014 ${describeCatalogError(err, storeUrl)}`;
           }
           if (gap) {
             console.warn(`skaile: store ${storeUrl} ${gap}; installing without its dependencies`);
@@ -2350,23 +2650,23 @@ var AssetManager = class {
           };
         } catch (err) {
           if (err instanceof CatalogHttpError && err.status === 404) return null;
+          this.noteStoreFailure(storeUrl, err);
           throw err;
         }
       },
       getCanonicalDigest: async (storeUrl, ref) => {
-        const { RemoteCatalogSource } = await import('./library/index.js');
-        const src = new RemoteCatalogSource({ baseUrl: storeUrl });
+        const src = this.remoteStore(storeUrl);
         return src.getCanonicalDigest(ref);
       },
       listVersions: async (storeUrl, ref) => {
-        const { RemoteCatalogSource } = await import('./library/index.js');
-        const src = new RemoteCatalogSource({ baseUrl: storeUrl });
+        const src = this.remoteStore(storeUrl);
         try {
           return await src.listVersions(ref);
         } catch (err) {
+          const text = this.noteStoreFailure(storeUrl, err);
           if (!this.warnedStoreVersionLookups.has(storeUrl)) {
             this.warnedStoreVersionLookups.add(storeUrl);
-            console.warn(`skaile: store ${storeUrl} version lookup for ${ref} failed \u2014 ${err}`);
+            console.warn(`skaile: store lookup of ${ref} failed: ${text}`);
           }
           return [];
         }
@@ -2404,28 +2704,84 @@ var AssetManager = class {
     }
     return { npmInstalled, npmFailed };
   }
+  /**
+   * Give every ref `install` could not resolve, and that has no hint yet, the fix the shared
+   * {@link AssetManager.projectState} names for it (a declared ref no library or source holds,
+   * a requirement nothing holds). Runs after the deploy, so a requirer is known by then.
+   * Mutates `hints`: ` <reason>` follows the ref in the `Missing:` line.
+   */
+  async adviseMissing(refs, hints) {
+    const open = refs.filter((r) => !hints[r]);
+    if (open.length === 0) return;
+    const { gaps } = await this.projectState();
+    for (const ref of open) {
+      const want = parseRefTolerant(ref.split(" ")[0] ?? ref);
+      if (!want) continue;
+      const gap = gaps.find(
+        (g) => (g.type === "declared" || g.type === "requires") && g.manualFix && sameAsset(g.ref, want)
+      );
+      if (gap) hints[ref] = ` ${gap.reason}`;
+    }
+  }
   async installLocked(repositories, patches, dependencies) {
     const lock = this.tryReadLock();
     if (!lock) {
+      const gaps2 = (await this.projectState()).gaps.filter((g) => g.type !== "agent");
+      if (gaps2.some((g) => g.manualFix)) {
+        return {
+          deployed: [],
+          removed: [],
+          missing: gaps2.map((g) => g.message),
+          lockWritten: false,
+          npmInstalled: [],
+          npmFailed: []
+        };
+      }
       throw new Error("No lock file found. Run `skaile install` first.");
     }
     this.assertNoFolderCollision(Object.keys(lock.assets).map(parseCanonicalLockKey));
     const declBySlug = new Map(Object.entries(repositories));
     const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
-    const factoryDir = Object.values(repositories).find((d) => d.factory)?.path ?? null;
+    const factoryDecl = Object.values(repositories).find((d) => d.factory);
+    const factoryDir = factoryDecl?.path ?? null;
+    const isFactoryUrl = (url) => factoryDir !== null && normalizeRepoUrl(url) === factoryUrl;
+    const unavailable = [];
     for (const src of lock.sources) {
-      if (factoryDir && normalizeRepoUrl(src.url) === factoryUrl) continue;
+      if (isFactoryUrl(src.url)) continue;
       const slug = sourceCacheKey(src.url);
-      const decl = declBySlug.get(slug) ?? { url: src.url };
-      ensureRepo(decl, slug, this.reposDir, { projectDir: this.projectDir, pin: src.commit });
+      const declared = declBySlug.get(slug);
+      if (!declared && GITHUB_REPO_URL.test(src.url)) continue;
+      try {
+        const dir = ensureRepo(declared ?? { url: src.url }, slug, this.reposDir, {
+          projectDir: this.projectDir,
+          // A lock restore deploys the pinned commit's bytes or fails: never another commit's.
+          .../^0*$/.test(src.commit) ? {} : { pin: src.commit, strictPin: true }
+        });
+        if (!declared) repositories[slug] = { url: src.url, path: dir };
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        unavailable.push(`unavailable: ${src.url} at ${src.commit.slice(0, 7)} (${reason})`);
+      }
     }
-    const resolveCloneDir = (sourceUrl) => {
-      if (factoryDir && normalizeRepoUrl(sourceUrl) === factoryUrl) return factoryDir;
+    if (unavailable.length > 0) {
+      throw new Error(`Lock file verification failed:
+  ${unavailable.join("\n  ")}`);
+    }
+    const candidates = [];
+    const cloneOrigin = {};
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      const candidate = this.lockedCandidate(key, entry, repositories);
+      if (!candidate) continue;
+      candidates.push(candidate);
+      if (isFactoryUrl(candidate.sourceUrl) || this.candidateHasLocalBytes(candidate, repositories)) {
+        cloneOrigin[key] = entry;
+      }
+    }
+    const verification = verifyLock({ ...lock, assets: cloneOrigin }, (sourceUrl) => {
+      if (isFactoryUrl(sourceUrl)) return factoryDir;
       const slug = sourceCacheKey(sourceUrl);
-      const decl = declBySlug.get(slug) ?? { url: sourceUrl };
-      return this.resolveRepoDir(decl, slug);
-    };
-    const verification = verifyLock(lock, resolveCloneDir);
+      return this.resolveRepoDir(repositories[slug] ?? { url: sourceUrl }, slug);
+    });
     if (!verification.ok) {
       const issues = [
         ...verification.drifted.map((r) => `drifted: ${r}`),
@@ -2444,30 +2800,16 @@ var AssetManager = class {
   ${lines.join("\n  ")}`
       );
     }
-    const resolved = [];
-    for (const [ref, entry] of Object.entries(lock.assets)) {
-      if (!entry.source) continue;
-      const { publisher, kind, name } = parseCanonicalLockKey(ref);
-      if (!publisher || !kind || !name) continue;
-      const slug = sourceCacheKey(entry.source.url);
-      const cloneDir = resolveCloneDir(entry.source.url) ?? join(this.reposDir, slug);
-      const mdRel = entry.files.find((f) => /\.(md|yaml)$/i.test(f.path))?.path ?? entry.files[0]?.path ?? "";
-      resolved.push({
-        name,
-        kind,
-        description: "",
-        source: mdRel ? join(cloneDir, mdRel) : cloneDir,
-        // Keep the publisher label slash-free (repo name), not the full cache key.
-        publisher: sourceShortName(entry.source.url),
-        version: entry.source.commit,
-        // The lock key is the canonical ref; `publisher` above is only a clone label.
-        canonicalRef: ref,
-        requires: [],
-        dependencies: []
-      });
-      if (!repositories[slug]) repositories[slug] = { url: entry.source.url, path: cloneDir };
+    let resolved;
+    try {
+      resolved = await this.buildCatalogEntries(candidates, repositories);
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      throw new Error(`Lock file verification failed:
+  ${reason}`);
     }
     const library = await this.restoreLibraryLockEntries(lock);
+    const copyDrift = await this.lockedCopyDrift();
     const deployed = [
       ...new Set(
         this.targetHarnesses().flatMap(
@@ -2480,8 +2822,9 @@ var AssetManager = class {
         )
       )
     ];
+    const restored = this.restoredCopies(copyDrift, deployed);
     await this.renderDriverMcpConfig();
-    const agentRender = this.renderAgentInstances();
+    const agentRender = await this.renderAgentInstances();
     const alreadyMissing = new Set(
       library.missing.map((m) => {
         const p = parseRefTolerant(m.split(" ")[0] ?? m);
@@ -2498,6 +2841,7 @@ var AssetManager = class {
       removed: [],
       missing: [...library.missing, ...gaps],
       lockWritten: false,
+      ...restored.length > 0 ? { restored } : {},
       ...agentRender
     };
   }
@@ -2551,7 +2895,8 @@ var AssetManager = class {
       this.ensureSourceClonesQuiet(repositories, sources);
       const index = await buildProvenanceIndex(this.buildClones(repositories), {
         projectDir: this.projectDir,
-        knownKinds: this.knownKinds
+        knownKinds: this.knownKinds,
+        onSourceError: this.reportSourceError
       });
       for (const candidates of index.values()) for (const c of candidates) note(c);
       for (const { entry } of await this.libraryAssets()) note(entry);
@@ -2572,6 +2917,8 @@ var AssetManager = class {
    *   store/factory sources. Defaults to copy.
    * @param opts.onLibraryOrigin - Called once per deployed library-origin asset with its
    *   canonical ref and the name of the library it was resolved from.
+   * @param opts.onLibraryMoved - Called once per asset whose lock entry named another library
+   *   than the one this add resolved it from.
    * @param opts.onPresets - Called once with the presets expanded into this add (the
    *   added preset and any it nests); a library-held preset names its library.
    * @returns Array of asset refs that were deployed in this call.
@@ -2584,11 +2931,19 @@ var AssetManager = class {
     this.ensureSourceClonesQuiet(repositories, sources);
     const provenanceIndex = await buildProvenanceIndex(this.buildClones(repositories), {
       projectDir: this.projectDir,
-      knownKinds: this.knownKinds
+      knownKinds: this.knownKinds,
+      onSourceError: this.reportSourceError
     });
     const { resolved, missing, overridesApplied, lib, presets } = await this.resolveLibraryFirst(
       [ref],
-      { provenanceIndex, overrides, stores, declaredRefs: dependencies, warnCollisions: true }
+      {
+        provenanceIndex,
+        overrides,
+        stores,
+        declaredRefs: dependencies,
+        warnCollisions: true,
+        ...opts?.preferLockedLibrary ? { preferLocked: await this.lockedPreference() } : {}
+      }
     );
     if (resolved.length === 0 && lib.entries.length === 0 && presets.length === 0) {
       const snap = await this.loadLibraryIndex();
@@ -2606,6 +2961,12 @@ var AssetManager = class {
           );
         }
       }
+      const unreachable = [...this.storeFailures.values()];
+      if (unreachable.length > 0) {
+        throw new Error(
+          `Store unreachable \u2014 ${ref} was not looked up: ${unreachable.join("; ")}. Check the URL with \`skaile catalog test\`; a library or source can still hold the asset.`
+        );
+      }
       throw new Error(
         `Asset not found: ${ref}${(await this.publisherChangeHints([ref]))[ref] ?? ""}${missing.length ? ` (missing: ${missing.join(", ")})` : ""}`
       );
@@ -2627,6 +2988,7 @@ var AssetManager = class {
         }
       }
     }
+    this.assertSourceCommitsPublished(resolved, repositories);
     this.assertNoFolderCollision(
       [...resolved, ...lib.entries.map((e) => this.entryIdentity(e))],
       [
@@ -2635,8 +2997,8 @@ var AssetManager = class {
       ]
     );
     if (missing.length > 0) {
-      console.warn(
-        `skaile: ${ref} was added without unresolved dependencies: ${missing.join(", ")}`
+      throw new Error(
+        `${ref.split("#")[0]} requires ${missing.join(", ")} (not found \u2014 ${REGISTER_HOLDER}, or remove the requirement from the asset's manifest) \u2014 nothing was added`
       );
     }
     const entries = [...await this.buildCatalogEntries(resolved, repositories), ...lib.entries];
@@ -2647,7 +3009,7 @@ var AssetManager = class {
             entries,
             repositories,
             patches,
-            this.deployOptsFor(t, opts?.link, opts?.onSkippedSymlink)
+            this.deployOptsFor(t, opts?.link, opts?.onSkippedSymlink, opts?.onEnvFile)
           )
         )
       )
@@ -2662,13 +3024,18 @@ var AssetManager = class {
     if (presets.length > 0) opts?.onPresets?.(presets);
     this.addDependencyToConfig(ref);
     await this.renderDriverMcpConfig();
-    this.renderAgentInstances();
+    await this.renderAgentInstances();
     if (resolved.length > 0 || lib.entries.length > 0) {
+      const libraryLock = await this.libraryLockEntries(lib);
       const fresh = {
-        ...buildLockFile(resolved, overridesApplied, await this.libraryLockEntries(lib)),
+        ...buildLockFile(resolved, overridesApplied, libraryLock),
         ...presetsLockSlice(presets)
       };
-      writeLock(this.lockPath, mergeLockFile(this.tryReadLock(), fresh));
+      const prevLock = this.tryReadLock();
+      if (opts?.onLibraryMoved) {
+        for (const m of libraryMoves(prevLock, libraryLock)) opts.onLibraryMoved(m);
+      }
+      writeLock(this.lockPath, mergeLockFile(prevLock, fresh));
     }
     for (const d of deployed) {
       appendHistory(this.projectDir, {
@@ -2726,16 +3093,16 @@ var AssetManager = class {
     const target = memberIdentity(ref);
     if (!target || target.kind === "preset") return [];
     try {
-      const sameAsset = (id, want) => !!id && id.kind === want.kind && id.name === want.name && (!id.publisher || !want.publisher || id.publisher === want.publisher);
+      const sameAsset2 = (id, want) => !!id && id.kind === want.kind && id.name === want.name && (!id.publisher || !want.publisher || id.publisher === want.publisher);
       const declared = this.loadConfig().dependencies.map(memberIdentity);
       const out = [];
       const seen = /* @__PURE__ */ new Set();
       for (const p of await this.search(void 0, "preset")) {
         const members = [...p.dependencies, ...p.requires.map(depToStr)];
-        if (!members.some((m) => sameAsset(memberIdentity(m), target))) continue;
+        if (!members.some((m) => sameAsset2(memberIdentity(m), target))) continue;
         const publisher = p.publisher?.replace(/^@/, "");
         const presetId = { kind: "preset", name: p.name, publisher };
-        if (declared.some((d) => sameAsset(d, presetId))) continue;
+        if (declared.some((d) => sameAsset2(d, presetId))) continue;
         const presetRef = publisher ? assetRefToStr({ kind: "preset", name: p.name, publisher }) : `preset:${p.name}`;
         if (seen.has(presetRef)) continue;
         seen.add(presetRef);
@@ -3057,11 +3424,35 @@ var AssetManager = class {
     const requiredBy = [...requires].filter(([node, deps]) => node !== targetKey && deps.includes(targetKey)).map(([node]) => display(node));
     return requiredBy.length > 0 ? { ref: display(targetKey), requiredBy } : null;
   }
+  /**
+   * Publishers under which the lock or `skaile.yaml` track `kind:name`. A deployed dir carries
+   * no publisher, so this is what says whose copy it is. `undefined` stands for a
+   * publisher-less declaration.
+   */
+  trackedPublishers(kind, name) {
+    const found = /* @__PURE__ */ new Set();
+    const note = (id) => {
+      if (id?.kind === kind && id.name === name) found.add(id.publisher?.replace(/^@/, ""));
+    };
+    for (const key of Object.keys(this.tryReadLock()?.assets ?? {})) {
+      note(parseCanonicalLockKey(key));
+    }
+    try {
+      for (const dep of this.loadConfig().dependencies) note(memberIdentity(dep));
+    } catch {
+    }
+    return found;
+  }
   /** Undeploy `parsed` from every target harness and drop its declaration and lock entry. */
   removeResolved(parsed) {
+    const wantPub = parsed.publisher?.replace(/^@/, "");
+    const tracked = this.trackedPublishers(parsed.kind, parsed.name);
+    const someoneElses = wantPub !== void 0 && tracked.size > 0 && !tracked.has(wantPub) && !tracked.has(void 0);
     let undeployed = false;
-    for (const t of this.targetHarnesses()) {
-      if (removeAsset(parsed.kind, parsed.name, this.deployOptsFor(t))) undeployed = true;
+    if (!someoneElses) {
+      for (const t of this.targetHarnesses()) {
+        if (removeAsset(parsed.kind, parsed.name, this.deployOptsFor(t))) undeployed = true;
+      }
     }
     const undeclared = this.removeDependencyFromConfig(parsed);
     const unbound = this.removeAgentBindings(parsed);
@@ -3398,12 +3789,12 @@ var AssetManager = class {
     return out;
   }
   /**
-   * Library-locked assets whose deployed directory lacks files the deploy writes —
-   * a deleted `build.py` / `scripts/` helper next to an intact `SKILL.md`. The
-   * expected set is the library entry's file set (every file under its manifest
-   * `root:`), the same bytes the lock hashes; only presence is checked, so a
-   * local edit never counts. An asset with no deployed directory is not listed
-   * (`listDeclared` reports it as drift); an agent is rendered, not copied, so it
+   * Locked assets whose deployed directory lacks files the deploy writes — a deleted
+   * `build.py` / `scripts/` helper next to an intact `SKILL.md`. The expected set is the file
+   * set the lock covers: a library entry's files (every file under its manifest `root:`), a
+   * source or store entry's `files[]` (the asset's whole file set at the locked commit). Only
+   * presence is checked, so a local edit never counts. An asset with no deployed directory is
+   * not listed (`listDeclared` reports it as drift); an agent is rendered, not copied, so it
    * has no file mirror to compare. `skaile install` restores what is listed.
    *
    * @returns One {@link IncompleteDeploy} per affected asset; empty when healthy
@@ -3412,10 +3803,25 @@ var AssetManager = class {
   async incompleteDeploys() {
     const lock = this.tryReadLock();
     if (!lock) return [];
+    const out = [];
+    const { patches } = this.loadConfig();
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      if (!entry.source || entry.files.length === 0) continue;
+      const { publisher, kind, name } = parseCanonicalLockKey(key);
+      const component = kind ? this.installTarget(kind) : void 0;
+      if (!publisher || !kind || !name || !component || component === "agent") continue;
+      if (patches[`${kind}:${name}`]) continue;
+      const dest = join(
+        deployedBase(component, this.driverTarget, this.global, this.projectDir),
+        name
+      );
+      if (!existsSync(dest) || lstatSync(dest).isSymbolicLink()) continue;
+      const missing = lockedAssetFiles(kind, entry.files).map((f) => f.rel).filter((rel) => !existsSync(join(dest, rel)));
+      if (missing.length > 0) out.push({ ref: `${kind}:@${publisher}/${name}`, missing });
+    }
     const locked = Object.entries(lock.assets).filter(([, e]) => e.library !== void 0 && !e.library.installed).map(([key]) => key);
-    if (locked.length === 0) return [];
+    if (locked.length === 0) return out;
     const lib = await this.resolveLibraryEntries(locked, { quiet: true });
-    const out = [];
     for (const entry of lib.entries) {
       const component = this.installTarget(entry.kind);
       if (!entry.files || !component || component === "agent") continue;
@@ -3647,7 +4053,7 @@ var AssetManager = class {
       return locked.kind === asked.kind && locked.name === asked.name;
     };
     const key = lock.assets[ref] ? ref : Object.keys(lock.assets).find(matchesIdentity);
-    if (!key) return [];
+    if (!key) return asked?.kind === "preset" ? this.whyPreset(lock, asked) : [];
     const { requires, roots } = await this.lockedGraph(lock);
     if (roots.includes(key)) return [key, "direct (skaile.yaml)"];
     const requirers = /* @__PURE__ */ new Map();
@@ -3672,6 +4078,52 @@ var AssetManager = class {
     }
     return [key, "not required by a declared dependency"];
   }
+  /**
+   * The {@link AssetManager.why} chain of a preset. A preset is never a lock asset: its record
+   * is the lock's `presets` slice. Declared in `skaile.yaml` it is `direct`; one only a declared
+   * preset nests is traced through the presets that list it.
+   *
+   * @returns `[]` when the lock does not record the preset.
+   */
+  async whyPreset(lock, asked) {
+    const wanted = memberIdentity(assetRefToStr(asked));
+    const same = (ref) => {
+      const id = memberIdentity(ref);
+      return id !== null && wanted !== null && id.kind === "preset" && id.name === wanted.name && (!id.publisher || !wanted.publisher || id.publisher === wanted.publisher);
+    };
+    const recorded = (lock.presets ?? []).find(same);
+    if (!recorded) return [];
+    let declared = [];
+    try {
+      declared = this.loadConfig().dependencies;
+    } catch {
+    }
+    const roots = declared.filter((d) => memberIdentity(d)?.kind === "preset");
+    if (roots.some(same)) return [recorded, "direct (skaile.yaml)"];
+    const parent = /* @__PURE__ */ new Map();
+    const seen = new Set(roots);
+    const queue = [...roots];
+    for (let node = queue.shift(); node !== void 0; node = queue.shift()) {
+      let items = [];
+      try {
+        const entry = await this.info(node);
+        items = entry ? libraryEntryDepRefs(entry) : [];
+      } catch {
+      }
+      for (const item of items) {
+        if (memberIdentity(item)?.kind !== "preset" || seen.has(item)) continue;
+        seen.add(item);
+        parent.set(item, node);
+        if (same(item)) {
+          const chain = [];
+          for (let c = item; c !== void 0; c = parent.get(c)) chain.push(c);
+          return [...chain, "direct (skaile.yaml)"];
+        }
+        queue.push(item);
+      }
+    }
+    return [recorded, "not required by a declared dependency"];
+  }
   /**
    * List installed assets that have a newer upstream available.
    *
@@ -3710,7 +4162,17 @@ var AssetManager = class {
         if (!kind || !name) continue;
         const lockedCommit = entry.source.commit || src.commit;
         const moved = lockedCommit && !/^0+$/.test(lockedCommit) && lockedCommit !== status.localHead ? commitsBetween(clone, lockedCommit, status.localHead, commitCounts) : 0;
-        const behind = status.behind + moved;
+        let behind = status.behind + moved;
+        if (behind > 0) {
+          const touching = commitsTouching(
+            clone,
+            COMMIT_ID.test(lockedCommit) && !/^0+$/.test(lockedCommit) ? lockedCommit : status.localHead,
+            status.behind > 0 && status.remoteHead ? status.remoteHead : status.localHead,
+            lockedAssetDir(kind, entry.files),
+            commitCounts
+          );
+          if (touching !== null) behind = touching;
+        }
         if (behind <= 0) continue;
         result.push({
           kind,
@@ -3828,6 +4290,37 @@ var AssetManager = class {
     }
     return null;
   }
+  /**
+   * The deploy entry of a source- or store-origin asset, carrying the file set its lock entry
+   * lists (so a missing or edited helper shows in `diff`, not only the manifest). A source asset
+   * reads from its clone; a store asset from the bytes `add`/`install` staged in the project
+   * store cache. `null` when the lock has no such entry or its bytes are not on disk.
+   *
+   * @param want - Kind, name and optional publisher of the asset.
+   */
+  lockedSourceEntry(want) {
+    const { repositories } = this.loadConfig();
+    for (const [key, e] of Object.entries(this.tryReadLock()?.assets ?? {})) {
+      const id = parseCanonicalLockKey(key);
+      if (!e.source || id.kind !== want.kind || id.name !== want.name) continue;
+      if (want.publisher && id.publisher !== want.publisher) continue;
+      const c = this.lockedCandidate(key, e, repositories);
+      if (!c) continue;
+      if (this.candidateHasLocalBytes(c, repositories)) {
+        return this.candidateToCatalogEntry(c, repositories);
+      }
+      const staged = join(
+        this.storeCacheDir,
+        c.publisher,
+        c.kind,
+        c.name,
+        c.version,
+        this.stagedManifestRel(c)
+      );
+      if (existsSync(staged)) return this.stagedCandidateToEntry(c, staged);
+    }
+    return null;
+  }
   /**
    * Produce a unified diff from the deployed asset to its catalog source: `-` lines
    * are in the deployed copy only (local edits `update` would overwrite), `+` lines
@@ -3845,9 +4338,17 @@ var AssetManager = class {
   async diff(ref) {
     const parsed = parseRefTolerant(ref);
     if (!parsed) return { status: "not-found" };
-    const entry = await this.lockedLibraryEntry(parsed) ?? await this.info(ref);
+    const entry = await this.lockedLibraryEntry(parsed) ?? this.lockedSourceEntry(parsed) ?? await this.info(ref);
     if (!entry || !existsSync(entry.source)) return { status: "not-found" };
+    const wantPublisher = parsed.publisher?.replace(/^@/, "");
+    if (wantPublisher) {
+      const lockedHere = Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey).filter((id) => id.kind === parsed.kind && id.name === parsed.name);
+      if (lockedHere.length > 0 && !lockedHere.some((id) => id.publisher === wantPublisher)) {
+        return { status: "not-deployed" };
+      }
+    }
     const component = this.installTarget(parsed.kind);
+    if (parsed.kind === "preset" && this.presetRecorded(parsed)) return { status: "no-files" };
     if (!component) return { status: "not-deployed" };
     if (component === "agent") {
       const diff = diffDeployedAgent(entry, this.deployOptsFor(this.driverTarget));
@@ -3888,7 +4389,8 @@ var AssetManager = class {
     this.ensureSourceClonesQuiet(repositories, sources);
     const provenanceIndex = await buildProvenanceIndex(this.buildClones(repositories), {
       projectDir: this.projectDir,
-      knownKinds: this.knownKinds
+      knownKinds: this.knownKinds,
+      onSourceError: this.reportSourceError
     });
     const { resolved, overridesApplied, lib } = await this.resolveLibraryFirst(dependencies, {
       provenanceIndex,
@@ -4015,7 +4517,11 @@ var AssetManager = class {
       const full = await this.info(
         publisher ? `${entry.kind}:@${publisher}/${entry.name}` : `${entry.kind}:${entry.name}`
       );
-      if (!full) {
+      const restorable = !full && publisher !== void 0 && Object.entries(lock?.assets ?? {}).some(([key, e]) => {
+        const id = parseCanonicalLockKey(key);
+        return e.source !== void 0 && id.kind === entry.kind && id.name === entry.name && id.publisher === publisher;
+      });
+      if (!full && !restorable) {
         if (publisher) {
           const canonical = `${entry.kind}:@${publisher}/${entry.name}`;
           const fix = (await this.unresolvedFixes([canonical])).get(canonical);
@@ -4031,8 +4537,9 @@ var AssetManager = class {
         }
         continue;
       }
+      const declaredRequires = full ? full.requires : (await this.deployedRequirementsOf({ ...entry, publisher })).map(parseDep);
       const gaps = [];
-      const requirements = dedupeRequirements(full.requires, publisher).map(
+      const requirements = dedupeRequirements(declaredRequires, publisher).map(
         (r) => r.publisher || !publisher ? r : { ...r, publisher }
       );
       for (const req of requirements) {
@@ -4113,7 +4620,11 @@ var AssetManager = class {
     const lock = this.tryReadLock();
     const lockedIds = Object.keys(lock?.assets ?? {}).map(parseCanonicalLockKey);
     const requirements = await this.doctor();
-    const gaps = [];
+    let gaps = [];
+    const lockIdentity = (kind, name) => {
+      const publisher = lockedIds.find((id) => id.kind === kind && id.name === name)?.publisher;
+      return publisher ? `${kind}:@${publisher}/${name}` : `${kind}:${name}`;
+    };
     for (const i of requirements) {
       if (i.unresolved) {
         const publisher = lockedIds.find(
@@ -4130,18 +4641,18 @@ var AssetManager = class {
         });
         continue;
       }
-      const asset = `${i.assetKind}:${i.assetName}`;
+      const asset = lockIdentity(i.assetKind, i.assetName);
       const dep = `${i.depKind}:${i.depName}`;
       if (i.inRepos) {
         gaps.push({
           type: "requires",
           ref: dep,
           asset,
-          reason: `is required by ${asset} but neither deployed nor locked (fixable)`,
-          message: `${asset} requires ${dep} (fixable)`
+          reason: `is required by ${asset} but neither deployed nor locked (run skaile install)`,
+          message: `${asset} requires ${dep} (run skaile install)`
         });
       } else {
-        const fix = `register the library that holds it with \`skaile library init <name> --path <dir>\`, or drop ${asset} with \`skaile remove ${asset}\``;
+        const fix = requirementNoHolderFix(asset);
         gaps.push({
           type: "requires",
           ref: dep,
@@ -4159,17 +4670,51 @@ var AssetManager = class {
       gaps.push(gap);
       named.add(gapIdentity(gap.ref));
     }
+    const libraryHeld = (dep) => {
+      const want = parseRefTolerant(dep);
+      return want !== null && gaps.some((g) => g.type === "library" && sameAsset(g.ref, want));
+    };
+    gaps = gaps.filter((g) => !(g.type === "requires" && libraryHeld(g.ref)));
     for (const gap of this.undeployedLockGaps(lock, named)) {
       gaps.push(gap);
       named.add(gapIdentity(gap.ref));
     }
+    for (const d of await this.lockedCopyDrift()) {
+      if (named.has(gapIdentity(d.ref))) continue;
+      const parts = [
+        ...d.modified.map((f) => `${f} was edited`),
+        ...d.extra.map((f) => `${f} is not part of the asset`)
+      ];
+      const reason = `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 run \`skaile install --locked\` to restore it`;
+      gaps.push({ type: "modified", ref: d.ref, reason, message: `${d.ref} ${reason}` });
+      named.add(gapIdentity(d.ref));
+    }
     gaps.push(...await this.declaredGaps(requirements, named));
     for (const d of await this.incompleteDeploys()) {
       const reason = `is deployed without ${d.missing.join(", ")} \u2014 run \`skaile install\` to restore it`;
       gaps.push({ type: "incomplete", ref: d.ref, reason, message: `${d.ref} ${reason}` });
     }
+    const skipped = [];
+    await buildProvenanceIndex(this.buildClones(this.loadConfig().repositories), {
+      projectDir: this.projectDir,
+      knownKinds: this.knownKinds,
+      onSourceError: (clone, err) => skipped.push({
+        url: clone.sourceUrl,
+        why: err instanceof Error ? err.message : String(err)
+      })
+    });
+    for (const s of skipped) {
+      const reason = `is skipped: ${s.why.replace(`${s.url}: `, "")} \u2014 fix it or run \`skaile source remove\``;
+      gaps.push({
+        type: "source",
+        ref: s.url,
+        reason,
+        message: `source ${s.url} ${reason}`,
+        manualFix: true
+      });
+    }
     for (const u of unboundAgentInstances(this.projectDir, this.driverTarget)) {
-      const reason = u.ref.startsWith("agent:") ? `is bound by agent instance "${u.id}" but no agent was added for it \u2014 run \`skaile add ${u.ref}\` first, or drop the binding from skaile.yaml` : `is bound by agent instance "${u.id}" but resolves to no agent.yaml \u2014 fix the path, or drop the binding from skaile.yaml`;
+      const reason = u.ref.startsWith("agent:") ? await this.unboundAgentReason(u.id, u.ref) : `is bound by agent instance "${u.id}" but resolves to no agent.yaml \u2014 fix the path, or drop the binding from skaile.yaml`;
       gaps.push({
         type: "agent",
         ref: u.ref,
@@ -4178,7 +4723,65 @@ var AssetManager = class {
         manualFix: true
       });
     }
-    return { gaps, requirements };
+    return {
+      gaps,
+      requirements: requirements.filter(
+        (i) => i.unresolved || !libraryHeld(`${i.depKind}:${i.depName}`)
+      )
+    };
+  }
+  /**
+   * Why the `agent:` ref of agent instance `id` binds to nothing, as the phrase that follows
+   * the ref in a {@link LockGap}; see {@link AssetManager.unboundAgentAdvice}.
+   */
+  async unboundAgentReason(id, ref) {
+    const { lead, advice } = await this.unboundAgentAdvice(ref);
+    return `is bound by agent instance "${id}" but ${lead} \u2014 ${advice}`;
+  }
+  /**
+   * What is wrong with an `agent:` ref bound by an agent instance and what to do (`lead`, then
+   * `advice`). `skaile add` is named only when a registered library or source holds the agent
+   * and `add` takes the ref (it needs a publisher); otherwise the user registers the library
+   * that holds it, writes the publisher, or drops the binding.
+   */
+  async unboundAgentAdvice(ref) {
+    const drop = "or drop the binding from skaile.yaml";
+    const parsedRef = parseRefTolerant(ref);
+    const publisher = parsedRef?.publisher;
+    const lockedAgent = Object.keys(this.tryReadLock()?.assets ?? {}).some((key) => {
+      const k = parseCanonicalLockKey(key);
+      return k.kind === "agent" && k.name === parsedRef?.name && (!publisher || !k.publisher || k.publisher === publisher);
+    });
+    if (lockedAgent) {
+      return {
+        lead: "the agent is locked but not restored here",
+        advice: `run \`skaile install --locked\` first, ${drop}`
+      };
+    }
+    if (publisher && await this.info(ref) !== null) {
+      return {
+        lead: "no agent was added for it",
+        advice: `run \`skaile add ${ref}\` first, ${drop}`
+      };
+    }
+    if (!publisher) {
+      return {
+        lead: "names no publisher",
+        advice: `write it as agent:@<publisher>/<name> (\`skaile add\` needs the publisher), ${drop}`
+      };
+    }
+    const fix = (await this.unresolvedFixes([ref])).get(ref);
+    if (fix) {
+      const register = fix.replace(/, or drop the dependency with `skaile remove [^`]*`$/, "");
+      return {
+        lead: "no agent was added for it, and `skaile add` cannot resolve it",
+        advice: `${register}, ${drop}`
+      };
+    }
+    return {
+      lead: "no registered library or source holds it",
+      advice: `register the library that holds it with \`skaile library init <name> --path <dir>\`, ${drop}`
+    };
   }
   /** @deprecated Use `(await projectState()).gaps`; removed in the next major. */
   async lockGaps() {
@@ -4201,6 +4804,52 @@ var AssetManager = class {
       (g) => names(g.ref) || g.asset && names(g.asset)
     );
   }
+  /**
+   * The {@link ProjectState} gaps of everything `ref` requires, transitively: what `check`
+   * says about the requirements of `ref`, so a command that answers for one asset (`diff`)
+   * does not call it fine while a requirement of it is broken. The requirements are read from
+   * the deployed copies (the lock records no edges), the way `remove` and `install` read them
+   * when no library holds the asset any more. The gaps of `ref` itself are not included
+   * ({@link gapsOf}).
+   *
+   * @param ref - Asset ref in `kind:name` or `kind:@publisher/name` form.
+   */
+  async requirementGapsOf(ref) {
+    const want = parseRefTolerant(ref);
+    if (!want) return [];
+    const gaps = (await this.projectState()).gaps;
+    const lockedIds = Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey);
+    const idKey = (id) => `${id.publisher ?? ""}/${id.kind}:${id.name}`;
+    const seen = /* @__PURE__ */ new Set();
+    const queue = [
+      {
+        kind: want.kind,
+        name: want.name,
+        publisher: want.publisher?.replace(/^@/, "") ?? lockedIds.find((l) => l.kind === want.kind && l.name === want.name)?.publisher
+      }
+    ];
+    seen.add(idKey(queue[0]));
+    const out = [];
+    for (const asset of queue) {
+      for (const dep of await this.deployedRequirementsOf(asset)) {
+        const id = memberIdentity(dep);
+        if (!id) continue;
+        const publisher = id.publisher ?? lockedIds.find((l) => l.kind === id.kind && l.name === id.name)?.publisher;
+        const next = { kind: id.kind, name: id.name, publisher };
+        if (seen.has(idKey(next))) continue;
+        seen.add(idKey(next));
+        queue.push(next);
+        for (const g of gaps) {
+          if (out.includes(g)) continue;
+          const p = parseRefTolerant(g.ref);
+          if (p !== null && p.kind === next.kind && p.name === next.name && (!publisher || !p.publisher || p.publisher.replace(/^@/, "") === publisher)) {
+            out.push(g);
+          }
+        }
+      }
+    }
+    return out;
+  }
   /**
    * Locked library assets whose library cannot supply them: the library is not registered
    * (renamed or removed) or no longer holds the asset. Another library holding it makes the
@@ -4266,6 +4915,121 @@ var AssetManager = class {
     }
     return gaps;
   }
+  /**
+   * Remove the files a deploy never writes (`.env`, `.venv/`, `.pytest_cache/`, ...) from the
+   * deployed folders of re-locked assets, as {@link RestoredAsset} rows. The lock covers what
+   * the exclusion list leaves; the extras an older release copied are the owner's to drop, and
+   * this is the one point where they are: the lock was just rewritten.
+   *
+   * @param refs - Lock keys the install re-locked (hash or commit changed).
+   */
+  removeExcludedLeftovers(refs) {
+    const out = [];
+    for (const key of refs) {
+      const { kind, name } = parseCanonicalLockKey(key);
+      const component = kind ? this.installTarget(kind) : void 0;
+      if (!kind || !name || !component || component === "agent") continue;
+      const dest = deployedDir(component, name, this.driverTarget, this.global, this.projectDir);
+      const removed = removeExcludedLeftovers(dest);
+      if (removed.length === 0) continue;
+      const dir = relative(this.projectDir, dest).split(sep).join("/");
+      out.push({ ref: key, restored: [], removed: removed.map((f) => `${dir}/${f}`) });
+    }
+    return out;
+  }
+  /**
+   * The {@link RestoredAsset} rows for the drifted copies (see {@link lockedCopyDrift}) a
+   * deploy just wrote again: those whose ref is among the `deployed` canonical refs.
+   */
+  restoredCopies(drifts, deployed) {
+    const rewritten = new Set(deployed.map((d) => d.split("#")[0]));
+    const out = [];
+    for (const d of drifts) {
+      if (!rewritten.has(d.ref)) continue;
+      const { kind, name } = parseCanonicalLockKey(d.key);
+      const component = kind ? this.installTarget(kind) : void 0;
+      if (!kind || !name || !component) continue;
+      const dir = relative(
+        this.projectDir,
+        deployedDir(component, name, this.driverTarget, this.global, this.projectDir)
+      ).split(sep).join("/");
+      out.push({
+        ref: d.key,
+        restored: d.modified.map((f) => `${dir}/${f}`),
+        removed: d.extra.map((f) => `${dir}/${f}`)
+      });
+    }
+    return out;
+  }
+  /**
+   * Locked assets whose deployed copy differs from the bytes the lock covers: a file edited by
+   * hand, or a file the asset does not ship. One row per asset, `ref` being `kind:@publisher/name`
+   * and `key` its lock key. The one comparison behind the `modified` gap and the `Restored` lines
+   * of `install`.
+   *
+   * - A library-origin asset is compared with its library's files, but only while those equal the
+   *   locked hash (changed library content is the `content` gap's business), both modified and
+   *   extra files.
+   * - A source asset is compared with the per-file hashes the lock records (modified files only:
+   *   the lock lists what the source covers, not what the deploy copies).
+   *
+   * An agent (rendered, not copied), a `--link` deploy, an asset with a configured patch, and a
+   * copy that is missing are not compared: other gaps cover them. Project mode only.
+   */
+  async lockedCopyDrift() {
+    if (this.global) return [];
+    const lock = this.tryReadLock();
+    if (!lock) return [];
+    const { patches } = this.loadConfig();
+    const out = [];
+    const deployOpts = {
+      registry: this.registry,
+      driverTarget: this.driverTarget,
+      global: this.global,
+      cwd: this.projectDir
+    };
+    const refOf = (key) => {
+      const { kind, publisher, name } = parseCanonicalLockKey(key);
+      return publisher ? `${kind}:@${publisher}/${name}` : `${kind}:${name}`;
+    };
+    const keyOf = /* @__PURE__ */ new Map();
+    for (const key of Object.keys(lock.assets)) keyOf.set(refOf(key), key);
+    const { entries } = await this.restoreLibraryLockEntries(lock);
+    for (const e of entries) {
+      if (patches[`${e.kind}:${e.name}`]) continue;
+      const drift = deployedAssetDrift(e, deployOpts);
+      if (!drift || drift.modified.length === 0 && drift.extra.length === 0) continue;
+      const ref = `${e.kind}:@${(e.publisher ?? "").replace(/^@/, "")}/${e.name}`;
+      out.push({ ref, key: keyOf.get(ref) ?? ref, ...drift, library: true });
+    }
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      if (!entry.source || entry.files.length === 0) continue;
+      const { kind, name } = parseCanonicalLockKey(key);
+      const component = kind ? this.installTarget(kind) : void 0;
+      if (!kind || !name || !component || component === "agent") continue;
+      if (patches[`${kind}:${name}`]) continue;
+      const dest = deployedDir(component, name, this.driverTarget, this.global, this.projectDir);
+      try {
+        const deployed = lstatSync(dest);
+        if (deployed.isSymbolicLink() || !deployed.isDirectory()) continue;
+      } catch {
+        continue;
+      }
+      const modified = [];
+      for (const f of lockedAssetFiles(kind, entry.files)) {
+        const deployedFile = join(dest, f.rel);
+        if (!existsSync(deployedFile)) continue;
+        try {
+          if (computeHash(deployedFile) !== f.sha256) modified.push(f.rel);
+        } catch {
+          modified.push(f.rel);
+        }
+      }
+      if (modified.length > 0)
+        out.push({ ref: refOf(key), key, modified, extra: [], library: false });
+    }
+    return out;
+  }
   /**
    * Locked assets (declared or required by one) whose deployed copy is gone: `skaile install`
    * restores them. Same deployability rule as {@link AssetManager.listDeclared}'s `drift`.
@@ -4336,7 +5100,7 @@ var AssetManager = class {
         } else {
           gap = {
             type: "declared",
-            reason: `is declared but no library or source holds it \u2014 register the library that holds it with \`skaile library init <name> --path <dir>\`, or drop it with \`skaile remove ${d.ref.split("#")[0]}\``,
+            reason: declaredNoHolderReason(d.ref),
             manualFix: true
           };
         }
@@ -4346,7 +5110,7 @@ var AssetManager = class {
           if (this.presetRecorded(want) || await this.info(d.ref) !== null) continue;
           gap = await this.declaredRefResolvable(d.ref) ? { type: "declared", reason: "is declared but not locked \u2014 run `skaile install`" } : {
             type: "declared",
-            reason: `is declared but no library or source holds it \u2014 register the library that holds it with \`skaile library init <name> --path <dir>\`, or drop it with \`skaile remove ${d.ref.split("#")[0]}\``,
+            reason: declaredNoHolderReason(d.ref),
             manualFix: true
           };
           gaps.push({ ...gap, ref: d.ref, message: `${d.ref} ${gap.reason}` });
@@ -4407,7 +5171,8 @@ var AssetManager = class {
     const { repositories } = this.loadConfig();
     const provenanceIndex = await buildProvenanceIndex(this.buildClones(repositories), {
       projectDir: this.projectDir,
-      knownKinds: this.knownKinds
+      knownKinds: this.knownKinds,
+      onSourceError: this.reportSourceError
     });
     const lockKeys = Object.keys(lock.assets).map(parseCanonicalLockKey);
     const sourceCandidate = (ref) => {
@@ -4715,5 +5480,5 @@ var AssetManager = class {
 };
 
 export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName };
-//# sourceMappingURL=chunk-2JMLDZLP.js.map
-//# sourceMappingURL=chunk-2JMLDZLP.js.map
+//# sourceMappingURL=chunk-TVAR4JHA.js.map
+//# sourceMappingURL=chunk-TVAR4JHA.js.map