@skaile/workspaces 5.2.0 → 5.3.0

package/dist/{chunk-2MEMXBLC.js → chunk-QHIMMBJO.js}

@@ -1,8 +1,8 @@
-import { flowList, flowShow, flowListSessions, flowGetSession, flowFindFlowForSession } from './chunk-FJTC5YFO.js';
+import { flowList, flowShow, flowListSessions, flowGetSession, flowFindFlowForSession } from './chunk-BUZ3K2PT.js';
 import { sessionList, sessionGet } from './chunk-R6O6YWU7.js';
-import { skillList, skillShow, skillSearch, skillCheckRequirements, skillGetPreamble } from './chunk-BJQUSAGB.js';
+import { skillList, skillShow, skillSearch, skillCheckRequirements, skillGetPreamble } from './chunk-GCYD4EGY.js';
 import { workspaceValidate, workspaceInfo, workspaceTestSecret, workspaceReload } from './chunk-4ZTPYIBE.js';
-import { mountList, mountSync, mountStatus, mountRead, connectorList, connectorRead, connectorWrite, connectorSearch, connectorExec, connectorLoadSkill, connectorDescribe } from './chunk-DD3OZLRD.js';
+import { mountList, mountSync, mountStatus, mountRead, connectorList, connectorRead, connectorWrite, connectorSearch, connectorExec, connectorLoadSkill, connectorDescribe } from './chunk-YTJZQ4HY.js';
 import { withActivityLabelDefs } from './chunk-K2K7OF4P.js';
 import { DEFAULT_DRIVER_ID } from './chunk-5BEFNLOR.js';
 import * as zNS from 'zod';
@@ -246,5 +246,5 @@ async function runMcpServerStdio(plugin) {
 }
 
 export { buildWorkspaceMcpServer, buildWorkspaceMcpStdioServer, buildWorkspaceToolDefs, runMcpServerStdio };
-//# sourceMappingURL=chunk-2MEMXBLC.js.map
-//# sourceMappingURL=chunk-2MEMXBLC.js.map
+//# sourceMappingURL=chunk-QHIMMBJO.js.map
+//# sourceMappingURL=chunk-QHIMMBJO.js.map

package/dist/{chunk-2MEMXBLC.js.map → chunk-QHIMMBJO.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../workspace-plugin/src/adapters/mcp.ts"],"names":["z"],"mappings":";;;;;;;;;AA4CA,IAAM,OAAA,GAA4B,SAAkB,GAAA,CAAA,OAAA,IAAW,GAAA;AAiCxD,SAAS,uBAAuB,MAAA,EAA6C;AAClF,EAAA,MAAMA,EAAAA,GAAS,OAAA;AAEf,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,iBAAA;AAChC,EAAA,MAAM,IAAI,MAAA,CAAO,UAAA;AAEjB,EAAA,OAAO;AAAA;AAAA,IAEL;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,kEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,SAAA,CAAU,MAAA,CAAO,gBAAgB;AAAA,KACxD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,SAAA,CAAU,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KAC/C;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,WAAA,CAAY,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KACjD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,2CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gCAAgC;AAAA,OAC5D;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,IAAA,OAC1B,SAAA,CAAU,MAAA,CAAO,gBAAA,EAAkB,QAAA,EAAU,IAAI;AAAA,KACrD;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,QAAA,CAAS,CAAC;AAAA,KACjC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,0DAAA;AAAA,MACb,WAAA,EAAa,EAAE,OAAA,EAASA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,wBAAwB,CAAA,EAAE;AAAA,MACtE,SAAS,OAAO,EAAE,SAAQ,KAA2B,QAAA,CAAS,GAAG,OAAO;AAAA,KAC1E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,4DAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,gBAAA,CAAiB,CAAC;AAAA,KACzC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,gCAAgC,CAAA,EAAE;AAAA,MAC7E,SAAS,OAAO,EAAE,QAAO,KAA0B,cAAA,CAAe,GAAG,MAAM;AAAA,KAC7E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,4BAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,sBAAA,CAAuB,GAAG,MAAM;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,2CAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,SAAA,CAAU,CAAC;AAAA,KAClC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,SAAS,OAAO,EAAE,UAAS,KAA4B,SAAA,CAAU,GAAG,QAAQ;AAAA,KAC9E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,kDAAA;AAAA,MACb,WAAA,EAAa,EAAE,KAAA,EAAOA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACjC,SAAS,OAAO,EAAE,OAAM,KAAyB,WAAA,CAAY,GAAG,KAAK;AAAA,KACvE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,0BAAA;AAAA,MACN,WAAA,EAAa,wEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,YAAYA,EAAAA,CACT,MAAA,GACA,QAAA,EAAS,CACT,SAAS,kDAAkD;AAAA,OAChE;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,UAAA,OAC1B,sBAAA,CAAuB,CAAA,EAAG,QAAA,EAAU,UAAA,IAAc,CAAC;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,SAAS,OAAO,EAAE,UAAS,KAA4B,gBAAA,CAAiB,GAAG,QAAQ;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,2EAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,WAAA,CAAY,CAAC;AAAA,KACpC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,aAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,UAAA,CAAW,GAAG,MAAM;AAAA,KACzE;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EACE,mYAAA;AAAA,MACF,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,aAAA,CAAc,MAAA,CAAO,gBAAgB;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,wCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kCAAkC,CAAA;AAAA,QACpE,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B;AAAA,OACvD;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,IAAA,OAC9B,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,IAAI;AAAA,KAC7D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,iBAAA;AAAA,MACN,WAAA,EAAa,uCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,IAAA,EAAMA,GAAE,MAAA,EAAO;AAAA,QACf,OAAA,EAASA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kBAAkB;AAAA,OACjD;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,YAKI,cAAA,CAAe,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,MAAM,OAAO;AAAA,KAC3E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,KAAA,EAAOA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAAA,OAC3C;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,KAAA,OAC9B,eAAA,CAAgB,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,KAAK;AAAA,KAChE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,SAAA,EAAWA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wCAAwC,CAAA;AAAA,QACvE,IAAA,EAAMA,EAAAA,CAAE,MAAA,CAAOA,EAAAA,CAAE,MAAA,EAAO,EAAGA,EAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,CAAS,qBAAqB;AAAA,OACxE;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,YAKI,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,WAAW,IAAI;AAAA,KAC5E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,sBAAA;AAAA,MACN,WAAA,EAAa,oEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,kBAAA,CAAmB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,qEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC3D;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,sEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,iBAAA,CAAkB,MAAA,EAAQ,MAAM;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,yEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,SAAS,YAAY,aAAA,CAAc,MAAA,EAAQ,MAAA,EAAQ,OAAO,KAAK;AAAA,KACjE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,uBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,GAAA,EAAKA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,uCAAuC,CAAA,EAAE;AAAA,MACjF,SAAS,OAAO,EAAE,GAAA,EAAI,KAAuB,oBAAoB,GAAG;AAAA,KACtE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,mDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,eAAA,CAAgB,MAAM;AAAA;AAC7C,GACF;AACF;AAmBA,eAAsB,wBAAwB,MAAA,EAAkD;AAC9F,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,OAAO,gCAAgC,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAI,kBAAA,CAAmB;AAAA,IAC5B,IAAA,EAAM,kBAAA;AAAA,IACN,KAAA,EAAO,qBAAA,CAAsB,sBAAA,CAAuB,MAAM,GAAG,OAAO;AAAA,GACrE,CAAA;AACH;AAgBA,eAAsB,6BAA6B,MAAA,EAAuC;AACxF,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,yCAAmD,CAAA;AACtF,EAAA,MAAM,MAAA,GAAS,IAAI,SAAA,CAAU,EAAE,MAAM,kBAAA,EAAoB,OAAA,EAAS,SAAS,CAAA;AAC3E,EAAA,KAAA,MAAW,GAAA,IAAO,sBAAA,CAAuB,MAAM,CAAA,EAAG;AAChD,IAAA,MAAA,CAAO,YAAA;AAAA,MACL,GAAA,CAAI,IAAA;AAAA,MACJ,EAAE,WAAA,EAAa,GAAA,CAAI,WAAA,EAAa,WAAA,EAAa,IAAI,WAAA,EAAY;AAAA,MAC7D,GAAA,CAAI;AAAA,KACN;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAaA,eAAsB,kBAAkB,MAAA,EAAwC;AAC9E,EAAA,MAAM,MAAA,GAAS,MAAM,4BAAA,CAA6B,MAAM,CAAA;AACxD,EAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OACrC,2CACF,CAAA;AACA,EAAA,MAAM,MAAA,CAAO,OAAA,CAAQ,IAAI,oBAAA,EAAsB,CAAA;AACjD","file":"chunk-2MEMXBLC.js","sourcesContent":["// Static namespace import so bun --compile bundles zod into the binary.\n// Dynamic import(\"zod\") via a string variable evades bun's static analysis\n// and fails at runtime inside /$bunfs/. The unwrap (zNS.z ?? zNS.default\n// ?? zNS) handles both bun's native ESM and vitest's CJS-interop resolver,\n// which return the zod namespace at different keys.\nimport * as zNS from \"zod\";\nimport { DEFAULT_DRIVER_ID } from \"@skaile/workspaces/core/framework\";\nimport { withActivityLabelDefs } from \"@skaile/workspaces/types\";\nimport type { WorkspacePlugin } from \"../plugin.js\";\nimport {\n  connectorDescribe,\n  connectorExec,\n  connectorList,\n  connectorLoadSkill,\n  connectorRead,\n  connectorSearch,\n  connectorWrite,\n  mountList,\n  mountRead,\n  mountStatus,\n  mountSync,\n} from \"../tools/connectors.js\";\nimport {\n  flowFindFlowForSession,\n  flowGetSession,\n  flowList,\n  flowListSessions,\n  flowShow,\n} from \"../tools/flows.js\";\nimport { sessionGet, sessionList } from \"../tools/sessions.js\";\nimport {\n  skillCheckRequirements,\n  skillGetPreamble,\n  skillList,\n  skillSearch,\n  skillShow,\n} from \"../tools/skills.js\";\nimport {\n  workspaceInfo,\n  workspaceReload,\n  workspaceTestSecret,\n  workspaceValidate,\n} from \"../tools/validator.js\";\n\nconst zStatic: any = (zNS as any).z ?? (zNS as any).default ?? zNS;\n\n/**\n * One workspace plugin tool — name, description, a zod raw-shape input schema,\n * and an async handler returning a `ToolResult`.\n *\n * Carries **zero MCP/SDK dependency**: the same definitions feed both the\n * in-process Claude Agent SDK server ({@link buildWorkspaceMcpServer}) and the\n * raw stdio MCP server ({@link buildWorkspaceMcpStdioServer}).\n */\nexport interface WorkspaceToolDef {\n  name: string;\n  description: string;\n  inputSchema: Record<string, unknown>;\n  handler: (args: any) => Promise<unknown>;\n}\n\n/**\n * Build the 27 workspace plugin tool definitions.\n *\n * Tool groups:\n * - 4 mount tools (`mount_list`, `mount_sync`, `mount_status`, `mount_read`)\n * - 5 flow tools (`flow_list`, `flow_show`, `flow_list_sessions`, `flow_get_session`, `flow_find_flow_for_session`)\n * - 5 skill tools (`skill_list`, `skill_show`, `skill_search`, `skill_check_requirements`, `skill_get_preamble`)\n * - 2 session tools (`session_list`, `session_get`)\n * - 7 connector tools (`connector_list`, `connector_read`, `connector_write`, `connector_search`, `connector_exec`, `connector_load_skill`, `connector_describe`)\n * - 4 workspace tools (`workspace_validate`, `workspace_info`, `workspace_test_secret`, `workspace_reload`)\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The 27 tool definitions, free of any MCP/SDK coupling.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport function buildWorkspaceToolDefs(plugin: WorkspacePlugin): WorkspaceToolDef[] {\n  const z: any = zStatic;\n\n  const driver = plugin.driver ?? DEFAULT_DRIVER_ID;\n  const p = plugin.projectDir;\n\n  return [\n    // Mount tools\n    {\n      name: \"mount_list\",\n      description: \"List all mounts declared in skaile.yaml with their mount status.\",\n      inputSchema: {},\n      handler: async () => mountList(plugin.connectorManager),\n    },\n    {\n      name: \"mount_sync\",\n      description: \"Sync a mount — pull latest from remote (git, S3, WebDAV).\",\n      inputSchema: { mount_id: z.string().describe(\"Mount ID from mount_list\") },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountSync(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_status\",\n      description: \"Get the mount status and last sync time for a mount.\",\n      inputSchema: { mount_id: z.string() },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountStatus(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_read\",\n      description: \"Read a file from a mounted mount by path.\",\n      inputSchema: {\n        mount_id: z.string(),\n        path: z.string().describe(\"Relative path within the mount\"),\n      },\n      handler: async ({ mount_id, path }: { mount_id: string; path: string }) =>\n        mountRead(plugin.connectorManager, mount_id, path),\n    },\n    // Flow tools\n    {\n      name: \"flow_list\",\n      description: \"List all available flow definitions from ai-assets.\",\n      inputSchema: {},\n      handler: async () => flowList(p),\n    },\n    {\n      name: \"flow_show\",\n      description: \"Show full flow definition (nodes + edges) for a flow ID.\",\n      inputSchema: { flow_id: z.string().describe(\"Flow ID from flow_list\") },\n      handler: async ({ flow_id }: { flow_id: string }) => flowShow(p, flow_id),\n    },\n    {\n      name: \"flow_list_sessions\",\n      description: \"List past and active flow run sessions for this workspace.\",\n      inputSchema: {},\n      handler: async () => flowListSessions(p),\n    },\n    {\n      name: \"flow_get_session\",\n      description: \"Get driver metadata for a specific flow run session.\",\n      inputSchema: { run_id: z.string().describe(\"Run ID from flow_list_sessions\") },\n      handler: async ({ run_id }: { run_id: string }) => flowGetSession(p, run_id),\n    },\n    {\n      name: \"flow_find_flow_for_session\",\n      description: \"Resolve and return the flow definition used in a past session.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => flowFindFlowForSession(p, run_id),\n    },\n    // Skill tools\n    {\n      name: \"skill_list\",\n      description: \"List all skills in the ai-assets catalog.\",\n      inputSchema: {},\n      handler: async () => skillList(p),\n    },\n    {\n      name: \"skill_show\",\n      description: \"Show the full SKILL.md content for a skill ID.\",\n      inputSchema: { skill_id: z.string().describe(\"Skill ID from skill_list\") },\n      handler: async ({ skill_id }: { skill_id: string }) => skillShow(p, skill_id),\n    },\n    {\n      name: \"skill_search\",\n      description: \"Search skills by name, description, or keywords.\",\n      inputSchema: { query: z.string() },\n      handler: async ({ query }: { query: string }) => skillSearch(p, query),\n    },\n    {\n      name: \"skill_check_requirements\",\n      description: \"Validate that all skill prerequisites are met in the target directory.\",\n      inputSchema: {\n        skill_id: z.string(),\n        target_dir: z\n          .string()\n          .optional()\n          .describe(\"Directory to check against (default: projectDir)\"),\n      },\n      handler: async ({ skill_id, target_dir }: { skill_id: string; target_dir?: string }) =>\n        skillCheckRequirements(p, skill_id, target_dir ?? p),\n    },\n    {\n      name: \"skill_get_preamble\",\n      description: \"Get the REQUIRES/INPUT/READS/WRITES DSL preamble for a skill.\",\n      inputSchema: { skill_id: z.string() },\n      handler: async ({ skill_id }: { skill_id: string }) => skillGetPreamble(p, skill_id),\n    },\n    // Session tools\n    {\n      name: \"session_list\",\n      description: \"List all past agent run sessions for this workspace, sorted newest first.\",\n      inputSchema: {},\n      handler: async () => sessionList(p),\n    },\n    {\n      name: \"session_get\",\n      description: \"Get full metadata for a specific session by run ID.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => sessionGet(p, run_id),\n    },\n    // Connector tools\n    {\n      name: \"connector_list\",\n      description:\n        \"List connectors declared in skaile.yaml as {connected, failed, notice?}. A host-managed mount in `connected` carries `health` {status: ok|stale|failed, errorClass, checkedAt}; if it is not ok, tell the user and do not write to it. `failed` holds connectors that did not connect this session, with the failure reason — their mount paths are dead directories, not synced workspaces.\",\n      inputSchema: {},\n      handler: async () => connectorList(plugin.connectorManager),\n    },\n    {\n      name: \"connector_read\",\n      description: \"Read content from a connector by path.\",\n      inputSchema: {\n        connector_id: z.string().describe(\"Connector ID from connector_list\"),\n        path: z.string().describe(\"Path within the connector\"),\n      },\n      handler: async ({ connector_id, path }: { connector_id: string; path: string }) =>\n        connectorRead(plugin.connectorManager, connector_id, path),\n    },\n    {\n      name: \"connector_write\",\n      description: \"Write content to a connector by path.\",\n      inputSchema: {\n        connector_id: z.string(),\n        path: z.string(),\n        content: z.string().describe(\"Content to write\"),\n      },\n      handler: async ({\n        connector_id,\n        path,\n        content,\n      }: {\n        connector_id: string;\n        path: string;\n        content: string;\n      }) => connectorWrite(plugin.connectorManager, connector_id, path, content),\n    },\n    {\n      name: \"connector_search\",\n      description: \"Search within a connector by query string.\",\n      inputSchema: {\n        connector_id: z.string(),\n        query: z.string().describe(\"Search query\"),\n      },\n      handler: async ({ connector_id, query }: { connector_id: string; query: string }) =>\n        connectorSearch(plugin.connectorManager, connector_id, query),\n    },\n    {\n      name: \"connector_exec\",\n      description: \"Execute a custom operation on a connector.\",\n      inputSchema: {\n        connector_id: z.string(),\n        operation: z.string().describe(\"Operation name from connector_describe\"),\n        args: z.record(z.string(), z.unknown()).describe(\"Operation arguments\"),\n      },\n      handler: async ({\n        connector_id,\n        operation,\n        args,\n      }: {\n        connector_id: string;\n        operation: string;\n        args: Record<string, unknown>;\n      }) => connectorExec(plugin.connectorManager, connector_id, operation, args),\n    },\n    {\n      name: \"connector_load_skill\",\n      description: \"Load the rendered skill body for a connector (operations + usage).\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorLoadSkill(plugin.connectorManager, connector_id),\n    },\n    {\n      name: \"connector_describe\",\n      description: \"Describe a connector's capabilities via its RuntimeSkillDescriptor.\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorDescribe(plugin.connectorManager, connector_id),\n    },\n    // Validator tools\n    {\n      name: \"workspace_validate\",\n      description: \"Run a full health check: connectors, mounts, secrets, driver binary.\",\n      inputSchema: {},\n      handler: async () => workspaceValidate(plugin, driver),\n    },\n    {\n      name: \"workspace_info\",\n      description: \"Show workspace configuration: driver, model, provider, resource counts.\",\n      inputSchema: {},\n      handler: async () => workspaceInfo(plugin, driver, plugin.model),\n    },\n    {\n      name: \"workspace_test_secret\",\n      description: \"Test resolution of one secret reference (env:VAR, forge:key).\",\n      inputSchema: { ref: z.string().describe(\"Secret ref e.g. env:ANTHROPIC_API_KEY\") },\n      handler: async ({ ref }: { ref: string }) => workspaceTestSecret(ref),\n    },\n    {\n      name: \"workspace_reload\",\n      description: \"Re-read skaile.yaml and re-sync the plugin state.\",\n      inputSchema: {},\n      handler: async () => workspaceReload(plugin),\n    },\n  ];\n}\n\n/**\n * Build the **in-process** workspace MCP server via the Claude Agent SDK's\n * `createSdkMcpServer`. This shape is what the runner embeds into a Claude\n * Agent SDK `query()` call — the runner *is* the Claude Agent SDK host.\n *\n * Returns `null` when `@anthropic-ai/claude-agent-sdk` is not installed\n * (graceful degradation for non-Claude-Code environments).\n *\n * For the standalone `skaile mcp-server` stdio subprocess use\n * {@link buildWorkspaceMcpStdioServer} / {@link runMcpServerStdio} instead —\n * those carry no Claude Agent SDK dependency.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The SDK MCP server object or `null` if the SDK is unavailable.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpServer(plugin: WorkspacePlugin): Promise<unknown | null> {\n  let sdk: any;\n  try {\n    sdk = await import(\"@anthropic-ai/claude-agent-sdk\");\n  } catch {\n    return null;\n  }\n  return sdk.createSdkMcpServer({\n    name: \"skaile-workspace\",\n    tools: withActivityLabelDefs(buildWorkspaceToolDefs(plugin), zStatic),\n  });\n}\n\n/**\n * Build a **raw stdio** workspace MCP server on `@modelcontextprotocol/sdk` —\n * no Claude Agent SDK. This is the correct shape for the `skaile mcp-server`\n * stdio subprocess that MCP-client agents (Claude Code, Codex, …) spawn.\n * Runs on plain Node.\n *\n * The returned server is not yet connected — call `.connect(transport)` (or\n * use {@link runMcpServerStdio}).\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns A `McpServer` with all 27 workspace tools registered.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpStdioServer(plugin: WorkspacePlugin): Promise<any> {\n  const { McpServer } = await import(\"@modelcontextprotocol/sdk/server/mcp.js\" as string);\n  const server = new McpServer({ name: \"skaile-workspace\", version: \"1.0.0\" });\n  for (const def of buildWorkspaceToolDefs(plugin)) {\n    server.registerTool(\n      def.name,\n      { description: def.description, inputSchema: def.inputSchema },\n      def.handler,\n    );\n  }\n  return server;\n}\n\n/**\n * Start the workspace MCP server over stdio transport.\n *\n * Builds the raw `@modelcontextprotocol/sdk` server via\n * {@link buildWorkspaceMcpStdioServer} and connects a `StdioServerTransport`.\n * No `@anthropic-ai/claude-agent-sdk` dependency anywhere on this path.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function runMcpServerStdio(plugin: WorkspacePlugin): Promise<void> {\n  const server = await buildWorkspaceMcpStdioServer(plugin);\n  const { StdioServerTransport } = await import(\n    \"@modelcontextprotocol/sdk/server/stdio.js\" as string\n  );\n  await server.connect(new StdioServerTransport());\n}\n"]}
+{"version":3,"sources":["../workspace-plugin/src/adapters/mcp.ts"],"names":["z"],"mappings":";;;;;;;;;AA4CA,IAAM,OAAA,GAA4B,SAAkB,GAAA,CAAA,OAAA,IAAW,GAAA;AAiCxD,SAAS,uBAAuB,MAAA,EAA6C;AAClF,EAAA,MAAMA,EAAAA,GAAS,OAAA;AAEf,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,iBAAA;AAChC,EAAA,MAAM,IAAI,MAAA,CAAO,UAAA;AAEjB,EAAA,OAAO;AAAA;AAAA,IAEL;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,kEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,SAAA,CAAU,MAAA,CAAO,gBAAgB;AAAA,KACxD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,SAAA,CAAU,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KAC/C;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,WAAA,CAAY,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KACjD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,2CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gCAAgC;AAAA,OAC5D;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,IAAA,OAC1B,SAAA,CAAU,MAAA,CAAO,gBAAA,EAAkB,QAAA,EAAU,IAAI;AAAA,KACrD;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,QAAA,CAAS,CAAC;AAAA,KACjC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,0DAAA;AAAA,MACb,WAAA,EAAa,EAAE,OAAA,EAASA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,wBAAwB,CAAA,EAAE;AAAA,MACtE,SAAS,OAAO,EAAE,SAAQ,KAA2B,QAAA,CAAS,GAAG,OAAO;AAAA,KAC1E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,4DAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,gBAAA,CAAiB,CAAC;AAAA,KACzC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,gCAAgC,CAAA,EAAE;AAAA,MAC7E,SAAS,OAAO,EAAE,QAAO,KAA0B,cAAA,CAAe,GAAG,MAAM;AAAA,KAC7E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,4BAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,sBAAA,CAAuB,GAAG,MAAM;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,2CAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,SAAA,CAAU,CAAC;AAAA,KAClC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,SAAS,OAAO,EAAE,UAAS,KAA4B,SAAA,CAAU,GAAG,QAAQ;AAAA,KAC9E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,kDAAA;AAAA,MACb,WAAA,EAAa,EAAE,KAAA,EAAOA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACjC,SAAS,OAAO,EAAE,OAAM,KAAyB,WAAA,CAAY,GAAG,KAAK;AAAA,KACvE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,0BAAA;AAAA,MACN,WAAA,EAAa,wEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,YAAYA,EAAAA,CACT,MAAA,GACA,QAAA,EAAS,CACT,SAAS,kDAAkD;AAAA,OAChE;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,UAAA,OAC1B,sBAAA,CAAuB,CAAA,EAAG,QAAA,EAAU,UAAA,IAAc,CAAC;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,SAAS,OAAO,EAAE,UAAS,KAA4B,gBAAA,CAAiB,GAAG,QAAQ;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,2EAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,WAAA,CAAY,CAAC;AAAA,KACpC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,aAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,UAAA,CAAW,GAAG,MAAM;AAAA,KACzE;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EACE,mYAAA;AAAA,MACF,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,aAAA,CAAc,MAAA,CAAO,gBAAgB;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,wCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kCAAkC,CAAA;AAAA,QACpE,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B;AAAA,OACvD;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,IAAA,OAC9B,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,IAAI;AAAA,KAC7D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,iBAAA;AAAA,MACN,WAAA,EAAa,uCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,IAAA,EAAMA,GAAE,MAAA,EAAO;AAAA,QACf,OAAA,EAASA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kBAAkB;AAAA,OACjD;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,YAKI,cAAA,CAAe,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,MAAM,OAAO;AAAA,KAC3E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,KAAA,EAAOA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAAA,OAC3C;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,KAAA,OAC9B,eAAA,CAAgB,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,KAAK;AAAA,KAChE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,SAAA,EAAWA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wCAAwC,CAAA;AAAA,QACvE,IAAA,EAAMA,EAAAA,CAAE,MAAA,CAAOA,EAAAA,CAAE,MAAA,EAAO,EAAGA,EAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,CAAS,qBAAqB;AAAA,OACxE;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,YAKI,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,WAAW,IAAI;AAAA,KAC5E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,sBAAA;AAAA,MACN,WAAA,EAAa,oEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,kBAAA,CAAmB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,qEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC3D;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,sEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,iBAAA,CAAkB,MAAA,EAAQ,MAAM;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,yEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,SAAS,YAAY,aAAA,CAAc,MAAA,EAAQ,MAAA,EAAQ,OAAO,KAAK;AAAA,KACjE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,uBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,GAAA,EAAKA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,uCAAuC,CAAA,EAAE;AAAA,MACjF,SAAS,OAAO,EAAE,GAAA,EAAI,KAAuB,oBAAoB,GAAG;AAAA,KACtE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,mDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,eAAA,CAAgB,MAAM;AAAA;AAC7C,GACF;AACF;AAmBA,eAAsB,wBAAwB,MAAA,EAAkD;AAC9F,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,OAAO,gCAAgC,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAI,kBAAA,CAAmB;AAAA,IAC5B,IAAA,EAAM,kBAAA;AAAA,IACN,KAAA,EAAO,qBAAA,CAAsB,sBAAA,CAAuB,MAAM,GAAG,OAAO;AAAA,GACrE,CAAA;AACH;AAgBA,eAAsB,6BAA6B,MAAA,EAAuC;AACxF,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,yCAAmD,CAAA;AACtF,EAAA,MAAM,MAAA,GAAS,IAAI,SAAA,CAAU,EAAE,MAAM,kBAAA,EAAoB,OAAA,EAAS,SAAS,CAAA;AAC3E,EAAA,KAAA,MAAW,GAAA,IAAO,sBAAA,CAAuB,MAAM,CAAA,EAAG;AAChD,IAAA,MAAA,CAAO,YAAA;AAAA,MACL,GAAA,CAAI,IAAA;AAAA,MACJ,EAAE,WAAA,EAAa,GAAA,CAAI,WAAA,EAAa,WAAA,EAAa,IAAI,WAAA,EAAY;AAAA,MAC7D,GAAA,CAAI;AAAA,KACN;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAaA,eAAsB,kBAAkB,MAAA,EAAwC;AAC9E,EAAA,MAAM,MAAA,GAAS,MAAM,4BAAA,CAA6B,MAAM,CAAA;AACxD,EAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OACrC,2CACF,CAAA;AACA,EAAA,MAAM,MAAA,CAAO,OAAA,CAAQ,IAAI,oBAAA,EAAsB,CAAA;AACjD","file":"chunk-QHIMMBJO.js","sourcesContent":["// Static namespace import so bun --compile bundles zod into the binary.\n// Dynamic import(\"zod\") via a string variable evades bun's static analysis\n// and fails at runtime inside /$bunfs/. The unwrap (zNS.z ?? zNS.default\n// ?? zNS) handles both bun's native ESM and vitest's CJS-interop resolver,\n// which return the zod namespace at different keys.\nimport * as zNS from \"zod\";\nimport { DEFAULT_DRIVER_ID } from \"@skaile/workspaces/core/framework\";\nimport { withActivityLabelDefs } from \"@skaile/workspaces/types\";\nimport type { WorkspacePlugin } from \"../plugin.js\";\nimport {\n  connectorDescribe,\n  connectorExec,\n  connectorList,\n  connectorLoadSkill,\n  connectorRead,\n  connectorSearch,\n  connectorWrite,\n  mountList,\n  mountRead,\n  mountStatus,\n  mountSync,\n} from \"../tools/connectors.js\";\nimport {\n  flowFindFlowForSession,\n  flowGetSession,\n  flowList,\n  flowListSessions,\n  flowShow,\n} from \"../tools/flows.js\";\nimport { sessionGet, sessionList } from \"../tools/sessions.js\";\nimport {\n  skillCheckRequirements,\n  skillGetPreamble,\n  skillList,\n  skillSearch,\n  skillShow,\n} from \"../tools/skills.js\";\nimport {\n  workspaceInfo,\n  workspaceReload,\n  workspaceTestSecret,\n  workspaceValidate,\n} from \"../tools/validator.js\";\n\nconst zStatic: any = (zNS as any).z ?? (zNS as any).default ?? zNS;\n\n/**\n * One workspace plugin tool — name, description, a zod raw-shape input schema,\n * and an async handler returning a `ToolResult`.\n *\n * Carries **zero MCP/SDK dependency**: the same definitions feed both the\n * in-process Claude Agent SDK server ({@link buildWorkspaceMcpServer}) and the\n * raw stdio MCP server ({@link buildWorkspaceMcpStdioServer}).\n */\nexport interface WorkspaceToolDef {\n  name: string;\n  description: string;\n  inputSchema: Record<string, unknown>;\n  handler: (args: any) => Promise<unknown>;\n}\n\n/**\n * Build the 27 workspace plugin tool definitions.\n *\n * Tool groups:\n * - 4 mount tools (`mount_list`, `mount_sync`, `mount_status`, `mount_read`)\n * - 5 flow tools (`flow_list`, `flow_show`, `flow_list_sessions`, `flow_get_session`, `flow_find_flow_for_session`)\n * - 5 skill tools (`skill_list`, `skill_show`, `skill_search`, `skill_check_requirements`, `skill_get_preamble`)\n * - 2 session tools (`session_list`, `session_get`)\n * - 7 connector tools (`connector_list`, `connector_read`, `connector_write`, `connector_search`, `connector_exec`, `connector_load_skill`, `connector_describe`)\n * - 4 workspace tools (`workspace_validate`, `workspace_info`, `workspace_test_secret`, `workspace_reload`)\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The 27 tool definitions, free of any MCP/SDK coupling.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport function buildWorkspaceToolDefs(plugin: WorkspacePlugin): WorkspaceToolDef[] {\n  const z: any = zStatic;\n\n  const driver = plugin.driver ?? DEFAULT_DRIVER_ID;\n  const p = plugin.projectDir;\n\n  return [\n    // Mount tools\n    {\n      name: \"mount_list\",\n      description: \"List all mounts declared in skaile.yaml with their mount status.\",\n      inputSchema: {},\n      handler: async () => mountList(plugin.connectorManager),\n    },\n    {\n      name: \"mount_sync\",\n      description: \"Sync a mount — pull latest from remote (git, S3, WebDAV).\",\n      inputSchema: { mount_id: z.string().describe(\"Mount ID from mount_list\") },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountSync(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_status\",\n      description: \"Get the mount status and last sync time for a mount.\",\n      inputSchema: { mount_id: z.string() },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountStatus(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_read\",\n      description: \"Read a file from a mounted mount by path.\",\n      inputSchema: {\n        mount_id: z.string(),\n        path: z.string().describe(\"Relative path within the mount\"),\n      },\n      handler: async ({ mount_id, path }: { mount_id: string; path: string }) =>\n        mountRead(plugin.connectorManager, mount_id, path),\n    },\n    // Flow tools\n    {\n      name: \"flow_list\",\n      description: \"List all available flow definitions from ai-assets.\",\n      inputSchema: {},\n      handler: async () => flowList(p),\n    },\n    {\n      name: \"flow_show\",\n      description: \"Show full flow definition (nodes + edges) for a flow ID.\",\n      inputSchema: { flow_id: z.string().describe(\"Flow ID from flow_list\") },\n      handler: async ({ flow_id }: { flow_id: string }) => flowShow(p, flow_id),\n    },\n    {\n      name: \"flow_list_sessions\",\n      description: \"List past and active flow run sessions for this workspace.\",\n      inputSchema: {},\n      handler: async () => flowListSessions(p),\n    },\n    {\n      name: \"flow_get_session\",\n      description: \"Get driver metadata for a specific flow run session.\",\n      inputSchema: { run_id: z.string().describe(\"Run ID from flow_list_sessions\") },\n      handler: async ({ run_id }: { run_id: string }) => flowGetSession(p, run_id),\n    },\n    {\n      name: \"flow_find_flow_for_session\",\n      description: \"Resolve and return the flow definition used in a past session.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => flowFindFlowForSession(p, run_id),\n    },\n    // Skill tools\n    {\n      name: \"skill_list\",\n      description: \"List all skills in the ai-assets catalog.\",\n      inputSchema: {},\n      handler: async () => skillList(p),\n    },\n    {\n      name: \"skill_show\",\n      description: \"Show the full SKILL.md content for a skill ID.\",\n      inputSchema: { skill_id: z.string().describe(\"Skill ID from skill_list\") },\n      handler: async ({ skill_id }: { skill_id: string }) => skillShow(p, skill_id),\n    },\n    {\n      name: \"skill_search\",\n      description: \"Search skills by name, description, or keywords.\",\n      inputSchema: { query: z.string() },\n      handler: async ({ query }: { query: string }) => skillSearch(p, query),\n    },\n    {\n      name: \"skill_check_requirements\",\n      description: \"Validate that all skill prerequisites are met in the target directory.\",\n      inputSchema: {\n        skill_id: z.string(),\n        target_dir: z\n          .string()\n          .optional()\n          .describe(\"Directory to check against (default: projectDir)\"),\n      },\n      handler: async ({ skill_id, target_dir }: { skill_id: string; target_dir?: string }) =>\n        skillCheckRequirements(p, skill_id, target_dir ?? p),\n    },\n    {\n      name: \"skill_get_preamble\",\n      description: \"Get the REQUIRES/INPUT/READS/WRITES DSL preamble for a skill.\",\n      inputSchema: { skill_id: z.string() },\n      handler: async ({ skill_id }: { skill_id: string }) => skillGetPreamble(p, skill_id),\n    },\n    // Session tools\n    {\n      name: \"session_list\",\n      description: \"List all past agent run sessions for this workspace, sorted newest first.\",\n      inputSchema: {},\n      handler: async () => sessionList(p),\n    },\n    {\n      name: \"session_get\",\n      description: \"Get full metadata for a specific session by run ID.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => sessionGet(p, run_id),\n    },\n    // Connector tools\n    {\n      name: \"connector_list\",\n      description:\n        \"List connectors declared in skaile.yaml as {connected, failed, notice?}. A host-managed mount in `connected` carries `health` {status: ok|stale|failed, errorClass, checkedAt}; if it is not ok, tell the user and do not write to it. `failed` holds connectors that did not connect this session, with the failure reason — their mount paths are dead directories, not synced workspaces.\",\n      inputSchema: {},\n      handler: async () => connectorList(plugin.connectorManager),\n    },\n    {\n      name: \"connector_read\",\n      description: \"Read content from a connector by path.\",\n      inputSchema: {\n        connector_id: z.string().describe(\"Connector ID from connector_list\"),\n        path: z.string().describe(\"Path within the connector\"),\n      },\n      handler: async ({ connector_id, path }: { connector_id: string; path: string }) =>\n        connectorRead(plugin.connectorManager, connector_id, path),\n    },\n    {\n      name: \"connector_write\",\n      description: \"Write content to a connector by path.\",\n      inputSchema: {\n        connector_id: z.string(),\n        path: z.string(),\n        content: z.string().describe(\"Content to write\"),\n      },\n      handler: async ({\n        connector_id,\n        path,\n        content,\n      }: {\n        connector_id: string;\n        path: string;\n        content: string;\n      }) => connectorWrite(plugin.connectorManager, connector_id, path, content),\n    },\n    {\n      name: \"connector_search\",\n      description: \"Search within a connector by query string.\",\n      inputSchema: {\n        connector_id: z.string(),\n        query: z.string().describe(\"Search query\"),\n      },\n      handler: async ({ connector_id, query }: { connector_id: string; query: string }) =>\n        connectorSearch(plugin.connectorManager, connector_id, query),\n    },\n    {\n      name: \"connector_exec\",\n      description: \"Execute a custom operation on a connector.\",\n      inputSchema: {\n        connector_id: z.string(),\n        operation: z.string().describe(\"Operation name from connector_describe\"),\n        args: z.record(z.string(), z.unknown()).describe(\"Operation arguments\"),\n      },\n      handler: async ({\n        connector_id,\n        operation,\n        args,\n      }: {\n        connector_id: string;\n        operation: string;\n        args: Record<string, unknown>;\n      }) => connectorExec(plugin.connectorManager, connector_id, operation, args),\n    },\n    {\n      name: \"connector_load_skill\",\n      description: \"Load the rendered skill body for a connector (operations + usage).\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorLoadSkill(plugin.connectorManager, connector_id),\n    },\n    {\n      name: \"connector_describe\",\n      description: \"Describe a connector's capabilities via its RuntimeSkillDescriptor.\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorDescribe(plugin.connectorManager, connector_id),\n    },\n    // Validator tools\n    {\n      name: \"workspace_validate\",\n      description: \"Run a full health check: connectors, mounts, secrets, driver binary.\",\n      inputSchema: {},\n      handler: async () => workspaceValidate(plugin, driver),\n    },\n    {\n      name: \"workspace_info\",\n      description: \"Show workspace configuration: driver, model, provider, resource counts.\",\n      inputSchema: {},\n      handler: async () => workspaceInfo(plugin, driver, plugin.model),\n    },\n    {\n      name: \"workspace_test_secret\",\n      description: \"Test resolution of one secret reference (env:VAR, forge:key).\",\n      inputSchema: { ref: z.string().describe(\"Secret ref e.g. env:ANTHROPIC_API_KEY\") },\n      handler: async ({ ref }: { ref: string }) => workspaceTestSecret(ref),\n    },\n    {\n      name: \"workspace_reload\",\n      description: \"Re-read skaile.yaml and re-sync the plugin state.\",\n      inputSchema: {},\n      handler: async () => workspaceReload(plugin),\n    },\n  ];\n}\n\n/**\n * Build the **in-process** workspace MCP server via the Claude Agent SDK's\n * `createSdkMcpServer`. This shape is what the runner embeds into a Claude\n * Agent SDK `query()` call — the runner *is* the Claude Agent SDK host.\n *\n * Returns `null` when `@anthropic-ai/claude-agent-sdk` is not installed\n * (graceful degradation for non-Claude-Code environments).\n *\n * For the standalone `skaile mcp-server` stdio subprocess use\n * {@link buildWorkspaceMcpStdioServer} / {@link runMcpServerStdio} instead —\n * those carry no Claude Agent SDK dependency.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The SDK MCP server object or `null` if the SDK is unavailable.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpServer(plugin: WorkspacePlugin): Promise<unknown | null> {\n  let sdk: any;\n  try {\n    sdk = await import(\"@anthropic-ai/claude-agent-sdk\");\n  } catch {\n    return null;\n  }\n  return sdk.createSdkMcpServer({\n    name: \"skaile-workspace\",\n    tools: withActivityLabelDefs(buildWorkspaceToolDefs(plugin), zStatic),\n  });\n}\n\n/**\n * Build a **raw stdio** workspace MCP server on `@modelcontextprotocol/sdk` —\n * no Claude Agent SDK. This is the correct shape for the `skaile mcp-server`\n * stdio subprocess that MCP-client agents (Claude Code, Codex, …) spawn.\n * Runs on plain Node.\n *\n * The returned server is not yet connected — call `.connect(transport)` (or\n * use {@link runMcpServerStdio}).\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns A `McpServer` with all 27 workspace tools registered.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpStdioServer(plugin: WorkspacePlugin): Promise<any> {\n  const { McpServer } = await import(\"@modelcontextprotocol/sdk/server/mcp.js\" as string);\n  const server = new McpServer({ name: \"skaile-workspace\", version: \"1.0.0\" });\n  for (const def of buildWorkspaceToolDefs(plugin)) {\n    server.registerTool(\n      def.name,\n      { description: def.description, inputSchema: def.inputSchema },\n      def.handler,\n    );\n  }\n  return server;\n}\n\n/**\n * Start the workspace MCP server over stdio transport.\n *\n * Builds the raw `@modelcontextprotocol/sdk` server via\n * {@link buildWorkspaceMcpStdioServer} and connects a `StdioServerTransport`.\n * No `@anthropic-ai/claude-agent-sdk` dependency anywhere on this path.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function runMcpServerStdio(plugin: WorkspacePlugin): Promise<void> {\n  const server = await buildWorkspaceMcpStdioServer(plugin);\n  const { StdioServerTransport } = await import(\n    \"@modelcontextprotocol/sdk/server/stdio.js\" as string\n  );\n  await server.connect(new StdioServerTransport());\n}\n"]}

package/dist/{chunk-YRF5CYHR.js → chunk-SR4RFKHM.js}

@@ -1,5 +1,6 @@
-import { parseAssetRef } from './chunk-OABIGSUY.js';
-import { existsSync, readFileSync } from 'fs';
+import { parseAssetRef } from './chunk-WX74MVNA.js';
+import { createHash } from 'crypto';
+import { existsSync, readFileSync, readdirSync } from 'fs';
 import { join, resolve } from 'path';
 import { stringify, parse } from 'yaml';
 
@@ -230,7 +231,37 @@ function loadSkPublishManifest(dir) {
   }
   return manifest;
 }
+function sha256Hex(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function compositeSha256(files) {
+  const lines = files.slice().sort((a, b) => a.path.localeCompare(b.path)).map((f) => `${f.path}:${f.sha256}
+`).join("");
+  return createHash("sha256").update(lines).digest("hex");
+}
+var NON_ASSET_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".skaile"]);
+function listAssetFiles(absDir) {
+  const out = [];
+  const walk = (dir, rel) => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const childRel = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) {
+        if (!NON_ASSET_DIRS.has(e.name)) walk(join(dir, e.name), childRel);
+      } else if (e.isFile()) {
+        out.push(childRel);
+      }
+    }
+  };
+  walk(absDir, "");
+  return out.sort();
+}
 
-export { ASSET_KEY_ORDER, SKAILE_MANIFEST_FILENAME, decodeSkaileManifest, encodeSkaileManifest, loadSkPublishManifest, orderedAsset };
-//# sourceMappingURL=chunk-YRF5CYHR.js.map
-//# sourceMappingURL=chunk-YRF5CYHR.js.map
+export { ASSET_KEY_ORDER, SKAILE_MANIFEST_FILENAME, compositeSha256, decodeSkaileManifest, encodeSkaileManifest, listAssetFiles, loadSkPublishManifest, orderedAsset, sha256Hex };
+//# sourceMappingURL=chunk-SR4RFKHM.js.map
+//# sourceMappingURL=chunk-SR4RFKHM.js.map

package/dist/chunk-SR4RFKHM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/src/publish-manifest.ts"],"names":[],"mappings":";;;;;;AAoJO,IAAM,wBAAA,GAA2B;AAIxC,SAAS,YAAY,GAAA,EAA0C;AAC7D,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,GAAA,KAAQ,QAAA,IAAY,EAAE,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,MAAA;AAC5D,EAAA,MAAM,GAAA,GAAsB,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAI;AACzC,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAA,CAAE,OAAO,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,MAAA,GAAS,CAAA,CAAE,MAAA;AACxE,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,gBAAgB,GAAA,EAA8C;AACrE,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,OAAA,KAAY,QAAA,IAAY,EAAE,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAO,MAAA;AACpE,EAAA,MAAM,GAAA,GAA0B,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,SAAA,KAAc,QAAA,IAAY,CAAA,CAAE,UAAU,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,SAAA,GAAY,CAAA,CAAE,SAAA;AACjF,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,WAAW,GAAA,EAA0D;AAC5E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,MAAA;AAChC,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,IACnB,CAAA,MAAA,IAAW,QAAQ,OAAO,IAAA,KAAS,YAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACnE,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,YAAY,OAAO,CAAA,CAAE,WAAW,QAAA,EAAU;AAC9D,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,IAAA,EAAM,CAAA,CAAE,MAAM,MAAA,EAAQ,CAAA,CAAE,QAAQ,CAAA;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG,OAAO,QAAA;AAChC,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,kBACP,IAAA,EACoF;AACpF,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAA,CAAM,IAAI,CAAA,IAAK,EAAC;AAAA,EAC3B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,aAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS,iBAAiB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAC5E,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC1E,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,iBAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS;AAAA;AACX,KACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,MAAA,EAAkC;AAC5D;AAQA,SAAS,kBAAA,CAAmB,KAAA,EAAe,IAAA,EAAc,WAAA,EAAmC;AAC1F,EAAA,IAAI,CAAC,KAAA,CAAM,UAAA,CAAW,GAAG,GAAG,OAAO,KAAA;AACnC,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA;AAC9B,EAAA,WAAA,CAAY,IAAA,CAAK;AAAA,IACf,IAAA,EAAM,yBAAA;AAAA,IACN,QAAA,EAAU,SAAA;AAAA,IACV,OAAA,EAAS,CAAA,WAAA,EAAc,KAAK,CAAA,8EAAA,EAA4E,QAAQ,CAAA,CAAA,CAAA;AAAA,IAChH;AAAA,GACD,CAAA;AACD,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,oBAAA,CACP,GAAA,EACA,QAAA,EACA,WAAA,EACM;AACN,EAAA,IAAI,OAAO,GAAA,CAAI,SAAA,KAAc,YAAY,GAAA,CAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACjE,IAAA,QAAA,CAAS,SAAA,GAAY,kBAAA,CAAmB,GAAA,CAAI,SAAA,EAAW,aAAa,WAAW,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,QAAA,KAAa,YAAY,GAAA,CAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/D,IAAA,QAAA,CAAS,WAAW,GAAA,CAAI,QAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG;AAChC,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,SAAA,CAAU,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AAC5F,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,SAAA,GAAY,KAAA;AAAA,EAC7C;AACA,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,IAAI,MAAA,WAAiB,MAAA,GAAS,MAAA;AAC9B,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,GAAA,CAAI,UAAU,CAAA;AACjD,EAAA,IAAI,UAAA,WAAqB,UAAA,GAAa,UAAA;AACxC;AAMA,SAAS,uBAAA,CACP,GAAA,EACA,IAAA,EACA,IAAA,EACA,WAAA,EACU;AACV,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,IAAA;AAChC,EAAA,KAAA,MAAW,OAAO,GAAA,EAAK;AACrB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,aAAA,CAAc,GAAG,CAAA;AACjB,MAAA,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,IACf,SAAS,GAAA,EAAK;AACZ,MAAA,WAAA,CAAY,IAAA,CAAK;AAAA,QACf,IAAA,EAAM,sBAAA;AAAA,QACN,QAAA,EAAU,SAAA;AAAA,QACV,OAAA,EAAS,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,gBAAA,EAC7B,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,QACA,IAAA,EAAM,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,aAAA;AAAA,OAC7B,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAOA,SAAS,gBAAA,CAAiB,MAAe,WAAA,EAAmD;AAC1F,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG,OAAO,MAAA;AACrE,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM,OAAO,MAAA;AAC3B,EAAA,MAAM,KAAA,GAAoB,EAAE,IAAA,EAAM,IAAA,EAAK;AACvC,EAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,EAAU,KAAA,CAAM,OAAO,CAAA,CAAE,IAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,CAAE,KAAK,CAAA;AAChC,EAAA,IAAI,KAAA,QAAa,KAAA,GAAQ,KAAA;AACzB,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,EAAE,SAAA,KAAc,QAAA;AACzB,IAAA,KAAA,CAAM,SAAA,GAAY,kBAAA;AAAA,MAChB,CAAA,CAAE,SAAA;AAAA,MACF,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,UAAA,CAAA;AAAA,MACtB;AAAA,KACF;AACF,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,KAAA,CAAM,SAAS,CAAA,CAAE,MAAA;AACnD,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,CAAA,CAAE,MAAM,CAAA;AACxC,EAAA,IAAI,WAAA,QAAmB,MAAA,GAAS,WAAA;AAEhC,EAAA,MAAM,OAAO,uBAAA,CAAwB,CAAA,CAAE,YAAA,EAAc,IAAA,EAAM,MAAM,WAAW,CAAA;AAC5E,EAAA,IAAI,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,YAAA,GAAe,IAAA;AAE1C,EAAA,IAAI,OAAO,CAAA,CAAE,WAAA,KAAgB,QAAA,EAAU,KAAA,CAAM,cAAc,CAAA,CAAE,WAAA;AAC7D,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,EAAG;AAC7B,IAAA,MAAM,EAAA,GAAK,EAAE,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,MAAM,QAAQ,CAAA;AACtE,IAAA,IAAI,EAAA,CAAG,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,QAAA,GAAW,EAAA;AAAA,EACtC;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AACvD,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AAEvD,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,oBAAA,CACP,GAAA,EACA,QAAA,EACA,WAAA,EACM;AACN,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG;AAChC,EAAA,MAAM,UAAwB,EAAC;AAC/B,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAI,MAAA,EAAQ;AAC7B,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,IAAA,EAAM,WAAW,CAAA;AAChD,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,MAAA,GAAS,OAAA;AAC5C;AAYO,SAAS,qBAAqB,IAAA,EAAoC;AACvE,EAAA,MAAM,IAAA,GAAO,kBAAkB,IAAI,CAAA;AACnC,EAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,UAAU,EAAC,EAAG,aAAa,CAAC,IAAA,CAAK,UAAU,CAAA,EAAE;AAAA,EACxD;AAEA,EAAA,MAAM,WAA8B,EAAC;AACrC,EAAA,MAAM,cAA4B,EAAC;AACnC,EAAA,oBAAA,CAAqB,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,WAAW,CAAA;AACpD,EAAA,oBAAA,CAAqB,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,WAAW,CAAA;AAEpD,EAAA,OAAO,EAAE,UAAU,WAAA,EAAY;AACjC;AAKA,IAAM,kBAAA,GAAkD;AAAA,EACtD,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAGO,IAAM,eAAA,GAAiD;AAAA,EAC5D,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAGO,SAAS,aAAa,CAAA,EAAwC;AACnE,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,eAAA,EAAiB;AACjC,IAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,CAAA;AACnB,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,EACtC;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,qBAAqB,QAAA,EAAqC;AACxE,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,kBAAA,EAAoB;AACpC,IAAA,MAAM,KAAA,GAAQ,SAAS,GAAG,CAAA;AAC1B,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAI,GAAA,KAAQ,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5C,MAAA,GAAA,CAAI,MAAA,GAAU,KAAA,CAAuB,GAAA,CAAI,YAAY,CAAA;AAAA,IACvD,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,KAAK,CAAA;AAC1C;AASO,SAAS,sBAAsB,GAAA,EAAuC;AAC3E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,GAAG,wBAAwB,CAAA;AAC5D,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,YAAA,CAAa,UAAU,OAAO,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,qBAAqB,GAAG,CAAA;AAC1D,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,aAAA,IAAiB,CAAA,CAAE,IAAA,KAAS,iBAAiB,CAAA,EAAG;AACrF,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,QAAA;AACT;AAKO,SAAS,UAAU,KAAA,EAA2B;AACnD,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAaO,SAAS,gBAAgB,KAAA,EAAgE;AAC9F,EAAA,MAAM,KAAA,GAAQ,MACX,KAAA,EAAM,CACN,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,EAAE,IAAI,CAAC,CAAA,CAC3C,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,MAAM;AAAA,CAAI,CAAA,CACpC,KAAK,EAAE,CAAA;AACV,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAGA,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,MAAA,EAAQ,cAAA,EAAgB,SAAS,CAAC,CAAA;AAQ3D,SAAS,eAAe,MAAA,EAA0B;AACvD,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,KAAsB;AAC/C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,QAAA,GAAW,MAAM,CAAA,EAAG,GAAG,IAAI,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA;AAC9C,MAAA,IAAI,CAAA,CAAE,aAAY,EAAG;AACnB,QAAA,IAAI,CAAC,cAAA,CAAe,GAAA,CAAI,CAAA,CAAE,IAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,CAAA,EAAG,QAAQ,CAAA;AAAA,MACnE,CAAA,MAAA,IAAW,CAAA,CAAE,MAAA,EAAO,EAAG;AACrB,QAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,MACnB;AAAA,IACF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,QAAQ,EAAE,CAAA;AACf,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB","file":"chunk-SR4RFKHM.js","sourcesContent":["/**\n * Publish manifest — `skaile.manifest.yaml`\n *\n * What a repo PUBLISHES: the `publisher` / `version` / `assets[]` that used to\n * live in the publication half of `skaile.yaml`, plus a per-asset dependency\n * graph, store-listing metadata, and an optional curator `source:` pointer.\n *\n * ── Two files, two codecs ──────────────────────────────────────────────────\n *\n *   skaile.yaml             → SkWorkspaceConfig   (workspace + consumption)\n *   skaile.manifest.yaml    → SkPublishManifest   (publication)            ← this module\n *\n * A repo can have either file, both, or neither: a pure workspace has only\n * `skaile.yaml`; a pure asset repo (e.g. `ai-assets`) has only\n * `skaile.manifest.yaml`; a repo that is both has both.\n *\n * ── One format, three roles ────────────────────────────────────────────────\n *\n *   First-party    `source:` absent  → bytes live in this repo (`root`/`files`).\n *   Curator/sidecar `source:` present → bytes come from the referenced upstream,\n *                                       verified by `sha256`.\n *\n * `decodeSkaileManifest` mirrors `decodeSkaileYaml`: total (never throws),\n * returns {@link Diagnostic}s. Dep-ref strings are validated with `parseAssetRef`.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { type Dirent, existsSync, readdirSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { parse, stringify } from \"yaml\";\nimport { parseAssetRef } from \"./models.js\";\nimport type { Diagnostic } from \"./workspace-config.js\";\n\n// ── Types ───────────────────────────────────────────────────────────────────\n\n/** One file inside a curated asset, pinned to an exact upstream blob hash. */\nexport interface ManifestFileEntry {\n  path: string;\n  /** 64-hex sha256 of the upstream blob. */\n  sha256: string;\n}\n\n/**\n * One entry in a manifest's `assets:` list. Either `root:` (recursive walk) or\n * `files:` (explicit list, supports globs for first-party; the granular\n * `{path, sha256}` form for curated upstream verification) declares which paths\n * constitute the asset. `version:` overrides the manifest-level version.\n *\n * @docLink packages/core/publish-manifest#asset-entry\n */\nexport interface AssetEntry {\n  kind: string;\n  name: string;\n  root?: string;\n  /**\n   * Explicit file listing. First-party manifests use bare `string[]` (globs,\n   * fast-glob). Curated entries may use the granular `{path, sha256}` form so\n   * the resolver fetches + verifies exact upstream blobs without a full clone.\n   */\n  files?: string[] | ManifestFileEntry[];\n  version?: string;\n  /** Per-asset publisher override (e.g. for curator/mirror repos). */\n  publisher?: string;\n\n  /**\n   * Canonical dep refs (`kind:@<publisher>/name[#version]`) — same grammar as\n   * `SkWorkspaceConfig.dependencies`. Authoritative for this asset's resolved\n   * deps. (Was `requires` in `.skaile-source.yaml`.)\n   */\n  dependencies?: string[];\n\n  /**\n   * Author-pinned composite sha256 over the asset's `files`/`root` (the\n   * {@link compositeSha256} the walker, discovery and the lock all use). Optional locally;\n   * REQUIRED on store publish. (Was `.skaile-source.yaml` `assets[].sha256`.)\n   */\n  sha256?: string;\n\n  /**\n   * Curator override: this single asset's bytes come from a different upstream\n   * than the manifest-level `source`. Absent → inherit manifest `source` (or\n   * first-party when that is also absent).\n   */\n  source?: ManifestSource;\n\n  // ── Store-listing metadata (all optional; fall back to content frontmatter) ──\n  description?: string;\n  keywords?: string[];\n  category?: string;\n  license?: string;\n  homepage?: string;\n}\n\n/**\n * Upstream the bytes come from when a manifest curates a repo it does not own.\n * Absent → first-party (bytes live in the manifest's own repo).\n *\n * @docLink packages/core/publish-manifest#manifest-source\n */\nexport interface ManifestSource {\n  url: string;\n  /** 40-char commit the curated bytes are pinned to. */\n  commit?: string;\n}\n\n/**\n * Signing/attribution recorded when a manifest is published on behalf of others.\n *\n * @docLink packages/core/publish-manifest#manifest-provenance\n */\nexport interface ManifestProvenance {\n  curator: string;\n  signed_by?: string;\n}\n\n/**\n * Parsed `skaile.manifest.yaml` — what a repo publishes.\n *\n * @docLink packages/core/publish-manifest#sk-publish-manifest\n */\nexport interface SkPublishManifest {\n  publisher?: string;\n  version?: string;\n  /** Repo-level store defaults inherited by assets unless overridden per-entry. */\n  license?: string;\n  homepage?: string;\n  /**\n   * Repo-relative path prefixes holding dev-only assets — excluded from\n   * discovery/publish unless `--dev`. (Was `.skaile-source.yaml` `dev_paths`.)\n   */\n  dev_paths?: string[];\n  /**\n   * Curator mode: the single upstream all assets in this file come from. A\n   * per-asset `source` overrides it. Absent → first-party (own repo).\n   */\n  source?: ManifestSource;\n  /** Present when this manifest is curated/published on behalf of another author. */\n  provenance?: ManifestProvenance;\n  assets?: AssetEntry[];\n}\n\n/** Result of {@link decodeSkaileManifest}: the manifest plus any notes. */\nexport interface ManifestDecodeResult {\n  manifest: SkPublishManifest;\n  diagnostics: Diagnostic[];\n}\n\n/** The single fixed filename for a publish manifest. */\nexport const SKAILE_MANIFEST_FILENAME = \"skaile.manifest.yaml\";\n\n// ── Decode ──────────────────────────────────────────────────────────────────\n\nfunction parseSource(raw: unknown): ManifestSource | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const s = raw as Record<string, unknown>;\n  if (typeof s.url !== \"string\" || s.url.length === 0) return undefined;\n  const out: ManifestSource = { url: s.url };\n  if (typeof s.commit === \"string\" && s.commit.length > 0) out.commit = s.commit;\n  return out;\n}\n\nfunction parseProvenance(raw: unknown): ManifestProvenance | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const p = raw as Record<string, unknown>;\n  if (typeof p.curator !== \"string\" || p.curator.length === 0) return undefined;\n  const out: ManifestProvenance = { curator: p.curator };\n  if (typeof p.signed_by === \"string\" && p.signed_by.length > 0) out.signed_by = p.signed_by;\n  return out;\n}\n\n/** Parse `files:` as either `string[]` (globs) or `{path, sha256}[]` (granular). */\nfunction parseFiles(raw: unknown): string[] | ManifestFileEntry[] | undefined {\n  if (!Array.isArray(raw)) return undefined;\n  const strings: string[] = [];\n  const granular: ManifestFileEntry[] = [];\n  for (const item of raw) {\n    if (typeof item === \"string\") {\n      strings.push(item);\n    } else if (item && typeof item === \"object\" && !Array.isArray(item)) {\n      const f = item as Record<string, unknown>;\n      if (typeof f.path === \"string\" && typeof f.sha256 === \"string\") {\n        granular.push({ path: f.path, sha256: f.sha256 });\n      }\n    }\n  }\n  // A manifest uses one form per entry; if both somehow appear, granular wins\n  // (it is the verifiable form). Empty → undefined.\n  if (granular.length > 0) return granular;\n  if (strings.length > 0) return strings;\n  return undefined;\n}\n\n/** Parse the YAML root, returning either the mapping or an error diagnostic. */\nfunction parseManifestRoot(\n  text: string,\n): { ok: true; raw: Record<string, unknown> } | { ok: false; diagnostic: Diagnostic } {\n  let parsed: unknown;\n  try {\n    parsed = parse(text) ?? {};\n  } catch (err) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"yaml_syntax\",\n        severity: \"error\",\n        message: `Invalid YAML: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    };\n  }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"non_object_root\",\n        severity: \"error\",\n        message: \"skaile.manifest.yaml must be a mapping at the top level.\",\n      },\n    };\n  }\n  return { ok: true, raw: parsed as Record<string, unknown> };\n}\n\n/**\n * Strip a SINGLE leading `@` from a publisher and, when one was removed, push a\n * `warning` diagnostic. The `@` is the scope sigil the ref formatter adds — an\n * authored `@acme` would otherwise index as `@@acme` and be un-addable. Bare\n * names are returned untouched.\n */\nfunction normalizePublisher(value: string, path: string, diagnostics: Diagnostic[]): string {\n  if (!value.startsWith(\"@\")) return value;\n  const stripped = value.slice(1);\n  diagnostics.push({\n    code: \"publisher_leading_sigil\",\n    severity: \"warning\",\n    message: `publisher \"${value}\": leading \"@\" is the scope sigil and is added automatically — use bare \"${stripped}\"`,\n    path,\n  });\n  return stripped;\n}\n\n/** Decode the manifest-level scalar/array/object fields onto `manifest`. */\nfunction decodeManifestFields(\n  raw: Record<string, unknown>,\n  manifest: SkPublishManifest,\n  diagnostics: Diagnostic[],\n): void {\n  if (typeof raw.publisher === \"string\" && raw.publisher.length > 0) {\n    manifest.publisher = normalizePublisher(raw.publisher, \"publisher\", diagnostics);\n  }\n  if (typeof raw.version === \"string\" && raw.version.length > 0) {\n    manifest.version = raw.version;\n  }\n  if (typeof raw.license === \"string\" && raw.license.length > 0) {\n    manifest.license = raw.license;\n  }\n  if (typeof raw.homepage === \"string\" && raw.homepage.length > 0) {\n    manifest.homepage = raw.homepage;\n  }\n  if (Array.isArray(raw.dev_paths)) {\n    const paths = raw.dev_paths.filter((p): p is string => typeof p === \"string\" && p.length > 0);\n    if (paths.length > 0) manifest.dev_paths = paths;\n  }\n  const source = parseSource(raw.source);\n  if (source) manifest.source = source;\n  const provenance = parseProvenance(raw.provenance);\n  if (provenance) manifest.provenance = provenance;\n}\n\n/**\n * Validate an asset's `dependencies` via `parseAssetRef`, pushing a `warning`\n * for each malformed ref. Returns the kept (valid) refs.\n */\nfunction decodeAssetDependencies(\n  raw: unknown,\n  kind: string,\n  name: string,\n  diagnostics: Diagnostic[],\n): string[] {\n  const deps: string[] = [];\n  if (!Array.isArray(raw)) return deps;\n  for (const dep of raw) {\n    if (typeof dep !== \"string\") continue;\n    try {\n      parseAssetRef(dep);\n      deps.push(dep);\n    } catch (err) {\n      diagnostics.push({\n        code: \"malformed_dependency\",\n        severity: \"warning\",\n        message: `assets[${kind}:${name}].dependencies: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n        path: `assets.${kind}:${name}.dependencies`,\n      });\n    }\n  }\n  return deps;\n}\n\n/**\n * Decode one `assets[]` item into an {@link AssetEntry}, or `undefined` when the\n * item is not a mapping or lacks both `kind` and `name`. Pushes dependency\n * warnings to `diagnostics`.\n */\nfunction decodeAssetEntry(item: unknown, diagnostics: Diagnostic[]): AssetEntry | undefined {\n  if (!item || typeof item !== \"object\" || Array.isArray(item)) return undefined;\n  const a = item as Record<string, unknown>;\n  const kind = typeof a.kind === \"string\" ? a.kind : \"\";\n  const name = typeof a.name === \"string\" ? a.name : \"\";\n  if (!kind || !name) return undefined;\n  const entry: AssetEntry = { kind, name };\n  if (typeof a.root === \"string\") entry.root = a.root;\n  const files = parseFiles(a.files);\n  if (files) entry.files = files;\n  if (typeof a.version === \"string\") entry.version = a.version;\n  if (typeof a.publisher === \"string\")\n    entry.publisher = normalizePublisher(\n      a.publisher,\n      `assets.${kind}:${name}.publisher`,\n      diagnostics,\n    );\n  if (typeof a.sha256 === \"string\") entry.sha256 = a.sha256;\n  const assetSource = parseSource(a.source);\n  if (assetSource) entry.source = assetSource;\n\n  const deps = decodeAssetDependencies(a.dependencies, kind, name, diagnostics);\n  if (deps.length > 0) entry.dependencies = deps;\n\n  if (typeof a.description === \"string\") entry.description = a.description;\n  if (Array.isArray(a.keywords)) {\n    const kw = a.keywords.filter((k): k is string => typeof k === \"string\");\n    if (kw.length > 0) entry.keywords = kw;\n  }\n  if (typeof a.category === \"string\") entry.category = a.category;\n  if (typeof a.license === \"string\") entry.license = a.license;\n  if (typeof a.homepage === \"string\") entry.homepage = a.homepage;\n\n  return entry;\n}\n\n/** Decode the `assets[]` list onto `manifest`, collecting dependency warnings. */\nfunction decodeManifestAssets(\n  raw: Record<string, unknown>,\n  manifest: SkPublishManifest,\n  diagnostics: Diagnostic[],\n): void {\n  if (!Array.isArray(raw.assets)) return;\n  const entries: AssetEntry[] = [];\n  for (const item of raw.assets) {\n    const entry = decodeAssetEntry(item, diagnostics);\n    if (entry) entries.push(entry);\n  }\n  if (entries.length > 0) manifest.assets = entries;\n}\n\n/**\n * Decode `skaile.manifest.yaml` text into a {@link SkPublishManifest} plus\n * {@link Diagnostic}s. Total — never throws: a YAML syntax error or non-object\n * root is reported as an `error`-severity diagnostic with an empty manifest.\n * Malformed `assets[].dependencies` refs are reported as `warning`s (validated\n * via `parseAssetRef`) rather than silently dropped.\n *\n * Pair with {@link encodeSkaileManifest} for round-tripping.\n * @docLink packages/core/publish-manifest#decode-skaile-manifest\n */\nexport function decodeSkaileManifest(text: string): ManifestDecodeResult {\n  const root = parseManifestRoot(text);\n  if (!root.ok) {\n    return { manifest: {}, diagnostics: [root.diagnostic] };\n  }\n\n  const manifest: SkPublishManifest = {};\n  const diagnostics: Diagnostic[] = [];\n  decodeManifestFields(root.raw, manifest, diagnostics);\n  decodeManifestAssets(root.raw, manifest, diagnostics);\n\n  return { manifest, diagnostics };\n}\n\n// ── Encode ──────────────────────────────────────────────────────────────────\n\n/** Fixed top-level key order for {@link encodeSkaileManifest}. */\nconst MANIFEST_KEY_ORDER: (keyof SkPublishManifest)[] = [\n  \"publisher\",\n  \"version\",\n  \"license\",\n  \"homepage\",\n  \"dev_paths\",\n  \"source\",\n  \"provenance\",\n  \"assets\",\n];\n\n/** Fixed per-asset key order for {@link encodeSkaileManifest}. */\nexport const ASSET_KEY_ORDER: readonly (keyof AssetEntry)[] = [\n  \"kind\",\n  \"name\",\n  \"source\",\n  \"root\",\n  \"files\",\n  \"version\",\n  \"publisher\",\n  \"sha256\",\n  \"dependencies\",\n  \"description\",\n  \"keywords\",\n  \"category\",\n  \"license\",\n  \"homepage\",\n];\n\n/** An entry with its keys in canonical order, undefined fields dropped. */\nexport function orderedAsset(a: AssetEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const key of ASSET_KEY_ORDER) {\n    const value = a[key];\n    if (value !== undefined) out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Encode a {@link SkPublishManifest} to canonical `skaile.manifest.yaml` text:\n * deterministic key order, only defined fields, `lineWidth: 120` (mirrors\n * `encodeSkaileYaml`).\n * @docLink packages/core/publish-manifest#encode-skaile-manifest\n */\nexport function encodeSkaileManifest(manifest: SkPublishManifest): string {\n  const out: Record<string, unknown> = {};\n  for (const key of MANIFEST_KEY_ORDER) {\n    const value = manifest[key];\n    if (value === undefined) continue;\n    if (key === \"assets\" && Array.isArray(value)) {\n      out.assets = (value as AssetEntry[]).map(orderedAsset);\n    } else {\n      out[key] = value;\n    }\n  }\n  return stringify(out, { lineWidth: 120 });\n}\n\n// ── File I/O ──────────────────────────────────────────────────────────────────\n\n/**\n * Load and decode `<dir>/skaile.manifest.yaml`. Returns `null` when the file is\n * absent or unparseable (mirrors `loadSkWorkspaceConfig`'s tolerant contract).\n * @docLink packages/core/publish-manifest#load-sk-publish-manifest\n */\nexport function loadSkPublishManifest(dir: string): SkPublishManifest | null {\n  const filePath = join(resolve(dir), SKAILE_MANIFEST_FILENAME);\n  if (!existsSync(filePath)) return null;\n  let raw: string;\n  try {\n    raw = readFileSync(filePath, \"utf-8\");\n  } catch {\n    return null;\n  }\n  const { manifest, diagnostics } = decodeSkaileManifest(raw);\n  if (diagnostics.some((d) => d.code === \"yaml_syntax\" || d.code === \"non_object_root\")) {\n    return null;\n  }\n  return manifest;\n}\n\n// ── Asset content hash ──────────────────────────────────────────────────────\n\n/** Hex SHA-256 of one file's bytes (the per-file `files[].sha256`). */\nexport function sha256Hex(bytes: Uint8Array): string {\n  return createHash(\"sha256\").update(bytes).digest(\"hex\");\n}\n\n/**\n * The one asset content hash, shared by every origin (library index, library\n * lock, git-source lock + provenance walker, store install manifest, author-pinned\n * `sha256`): SHA-256 (bare 64-hex) over `localeCompare`-sorted `<path>:<sha256>\\n`\n * rows, where each `sha256` is the file's own {@link sha256Hex}.\n *\n * `path` MUST be POSIX and relative to the root of the repository/library that\n * holds the asset (so `skills/foo/SKILL.md`, never `SKILL.md` relative to the\n * asset folder) — the path is folded into the digest, so a different base gives a\n * different hash for the same bytes.\n */\nexport function compositeSha256(files: ReadonlyArray<{ path: string; sha256: string }>): string {\n  const lines = files\n    .slice()\n    .sort((a, b) => a.path.localeCompare(b.path))\n    .map((f) => `${f.path}:${f.sha256}\\n`)\n    .join(\"\");\n  return createHash(\"sha256\").update(lines).digest(\"hex\");\n}\n\n/** Directories never part of an asset's bytes (VCS, dependencies, per-project state). */\nconst NON_ASSET_DIRS = new Set([\".git\", \"node_modules\", \".skaile\"]);\n\n/**\n * Every file under `absDir`, as sorted POSIX paths relative to `absDir`,\n * skipping {@link NON_ASSET_DIRS}. The single enumeration behind a `root:`\n * manifest entry — used by the provenance walker and by discovery, so both hash\n * the same file list.\n */\nexport function listAssetFiles(absDir: string): string[] {\n  const out: string[] = [];\n  const walk = (dir: string, rel: string): void => {\n    let entries: Dirent[];\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const e of entries) {\n      const childRel = rel ? `${rel}/${e.name}` : e.name;\n      if (e.isDirectory()) {\n        if (!NON_ASSET_DIRS.has(e.name)) walk(join(dir, e.name), childRel);\n      } else if (e.isFile()) {\n        out.push(childRel);\n      }\n    }\n  };\n  walk(absDir, \"\");\n  return out.sort();\n}\n"]}

package/dist/{chunk-R3QW7CA5.js → chunk-TR7KFBIO.js}

@@ -1,7 +1,7 @@
-import { logErr } from './chunk-77GKEZ2R.js';
-import { createFullRegistry } from './chunk-BZXR6SW5.js';
-import { getGlobalCacheDir } from './chunk-P2EM6FNQ.js';
-import { globalSkaileDir } from './chunk-TLKM4M47.js';
+import { logErr } from './chunk-WGN7Z36G.js';
+import { createFullRegistry } from './chunk-ZCSFGGLG.js';
+import { getGlobalCacheDir } from './chunk-KBAE7PU7.js';
+import { userConfigPath, globalSkaileDir } from './chunk-MFHKHXDE.js';
 import path from 'path';
 
 var LocalCatalogDisabledError = class extends Error {
@@ -28,7 +28,7 @@ async function openCatalogSource(opts) {
   const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;
   if (isLocalCatalogUrl(baseUrl)) {
     throw new LocalCatalogDisabledError(
-      "catalog.url is set to 'local' \u2014 remote catalog is disabled. Use `skaile source add <path>` + `skaile source sync` for local sources, or set `catalog.url: https://skaile.store` in ~/.skaile/config.yaml."
+      `catalog.url is set to 'local' \u2014 remote catalog is disabled. Use \`skaile source add <path>\` + \`skaile source sync\` for local sources, or set \`catalog.url: https://skaile.store\` in ${userConfigPath()}.`
     );
   }
   const cacheTtlMs = cfg.catalog.cache_ttl * 1e3;
@@ -100,5 +100,5 @@ function authoringLibraries(libs) {
 }
 
 export { LocalCatalogDisabledError, authoringLibraries, openCatalogSource, openLibrary, openLibraryManager, resolveCatalogSource };
-//# sourceMappingURL=chunk-R3QW7CA5.js.map
-//# sourceMappingURL=chunk-R3QW7CA5.js.map
+//# sourceMappingURL=chunk-TR7KFBIO.js.map
+//# sourceMappingURL=chunk-TR7KFBIO.js.map

package/dist/chunk-TR7KFBIO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../cli/src/open-library.ts"],"names":["source"],"mappings":";;;;;;AAmBO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;AASA,eAAsB,WAAA,GAAc;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAChE,IAAA,OAAO,IAAI,UAAA,CAAW,EAAE,YAAA,EAAc,kBAAA,IAAsB,CAAA;AAAA,EAC9D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,2BAAA,EAA8B,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACvF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAqBA,eAAsB,kBAAkB,IAAA,EAQtC;AACA,EAAA,MAAM,EAAE,eAAe,mBAAA,EAAqB,iBAAA,EAAmB,mBAAkB,GAAI,MAAM,OACzF,oBACF,CAAA;AACA,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,yBAAA;AAAA,MACR,CAAA,8LAAA,EAEqD,gBAAgB,CAAA,CAAA;AAAA,KACvE;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,YAAY,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACxD;AAwCA,eAAsB,qBAAqB,IAAA,EAKR;AACjC,EAAA,MAAM;AAAA,IACJ,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AAErD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,EAAA,GAAK,MAAM,OAAO,IAAS,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,WAAA,EAAY;AAG1C,MAAA,MAAM,SAAS,OAAA,CACZ,MAAA;AAAA,QACC,CAAC,CAAA,KACC,CAAA,CAAE,OAAA,KAAY,OAAA,IAAW,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAA,GAAS;AAAA,OAC3E,CACC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,OAAA,EAAQ,GAAI,CAAA,CAAE,SAAA,CAAU,OAAA,EAAS,CAAA;AAE/D,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAEF;AAAA,MACF;AAGA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAC,MAAM,EAAA,CAAG,UAAA,CAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,0GAAA,EACkB,IAAA,CAAK,IAAI,CAAA,UAAA,EAAa,KAAK,EAAE,CAAA,mGAAA;AAAA,SAEjD;AAAA,MACF;AAEA,MAAA,MAAMA,UAAS,IAAI,kBAAA;AAAA,QACjB,OAAA;AAAA,QACA,OAAA,CAAQ,EAAA;AAAA,QACR,OAAA,CAAQ,IAAA;AAAA,QACR,kBAAA;AAAmB,OACrB;AACA,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAAA,IAChD,SAAS,GAAA,EAAK;AAGZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,MAAM,SACJ,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,GACpB,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,UAAA,EAAY,CAAA,GAC7C,IAAI,oBAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACrD,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACnC;AASA,eAAsB,kBAAA,GAInB;AACD,EAAA,MAAM,EAAE,cAAA,EAAe,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,cAAA,CAAe,OAAO,CAAA;AAC1C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAC1D;AAUO,SAAS,mBAA+C,IAAA,EAAgB;AAC7E,EAAA,MAAM,UAAU,iBAAA,EAAkB;AAClC,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,eAAA,IAAmB,SAAS,CAAA;AACzD,EAAA,OAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,OAAO,KAAK,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,UAAU,CAAC,CAAA;AACzF","file":"chunk-TR7KFBIO.js","sourcesContent":["/**\n * open-library.ts — shared helpers to open the LocalIndex and the configured\n * Catalog source.\n *\n * Lazy-loads the `@skaile/workspaces/library` subpath and returns the\n * LocalIndex instance (backed by `@libsql/client`; runs on Node and Bun).\n * The catalog-source helper reads\n * `~/.skaile/config.yaml` (and project-level overlay if `projectDir` is given)\n * to decide between {@link RemoteCatalogSource} (default — points at\n * `https://skaile.store`) and a {@link LocalCatalogSource} bound to the most\n * recent local library registered via `skaile source add`.\n */\n\nimport path from \"node:path\";\nimport { getGlobalCacheDir, globalSkaileDir, userConfigPath } from \"@skaile/workspaces/core\";\nimport { logErr } from \"./helpers.ts\";\nimport { createFullRegistry } from \"./open-registry.ts\";\n\n/** Thrown by {@link openCatalogSource} when `catalog.url` is the `local` sentinel. */\nexport class LocalCatalogDisabledError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"LocalCatalogDisabledError\";\n  }\n}\n\n/**\n * Open the LocalIndex with the full kind registry. Exits with code 1\n * if the library directory cannot be created.\n *\n * @returns A `LocalIndex` instance ready for use.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibrary() {\n  try {\n    const { LocalIndex } = await import(\"@skaile/workspaces/library\");\n    return new LocalIndex({ kindRegistry: createFullRegistry() });\n  } catch (err) {\n    logErr(`Could not open LocalIndex: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Resolve the configured **remote** Catalog source for the CLI.\n *\n * Reads `~/.skaile/config.yaml` (plus the optional project-level overlay) and\n * returns a {@link RemoteCatalogSource} pointing at `catalog.url` (default:\n * `https://skaile.store`). The `cache_ttl: 0` config flag flips the source\n * into air-gapped mode: network reads are disabled, only `skaile update`\n * performs refreshes.\n *\n * **Local-mode rejection.** If the resolved config has `catalog.url: local`\n * this helper throws — callers wanting the dispatched local-or-remote source\n * must use {@link resolveCatalogSource}. Remote-only consumers like\n * `skaile update --catalog-only` rely on this strict behaviour.\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A configured {@link RemoteCatalogSource}.\n * @throws When `catalog.url` is the `local` sentinel.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<\n  | import(\"@skaile/workspaces/library\").RemoteCatalogSource\n  | import(\"@skaile/workspaces/library\").RestCatalogSource\n> {\n  const { resolveConfig, RemoteCatalogSource, RestCatalogSource, isLocalCatalogUrl } = await import(\n    \"@skaile/workspaces/library\"\n  );\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n  if (isLocalCatalogUrl(baseUrl)) {\n    throw new LocalCatalogDisabledError(\n      \"catalog.url is set to 'local' — remote catalog is disabled. \" +\n        \"Use `skaile source add <path>` + `skaile source sync` for local sources, \" +\n        `or set \\`catalog.url: https://skaile.store\\` in ${userConfigPath()}.`,\n    );\n  }\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  if (cfg.catalog.framing === \"rest\") {\n    return new RestCatalogSource({ baseUrl, cacheTtlMs });\n  }\n  return new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n}\n\n/**\n * Resolved catalog source plus a close handle for releasing any underlying\n * resources (e.g. the `LocalIndex` SQLite connection in local mode).\n *\n * Callers MUST invoke `close()` when done — typically in a `finally` block.\n * For remote-mode sources `close()` is a no-op, but the contract is uniform\n * so consumers don't have to branch.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport interface ResolvedCatalogSource {\n  /** The {@link ICatalogSource} ready for use. */\n  source: import(\"@skaile/workspaces/library\").ICatalogSource;\n  /** Release any underlying resources (SQLite handle in local mode). */\n  close(): void;\n}\n\n/**\n * Resolve the configured Catalog source — local or remote — based on\n * `~/.skaile/config.yaml`.\n *\n * Dispatch:\n * - `catalog.url: local` → opens {@link LocalIndex}, picks the most recently\n *   registered local library whose `path` still exists on disk, and returns a\n *   {@link LocalCatalogSource} bound to that library. Throws if no usable\n *   local library is registered.\n * - any URL → returns {@link RemoteCatalogSource} (same as\n *   {@link openCatalogSource}).\n *\n * The returned `close()` releases the underlying `LocalIndex` SQLite handle\n * in local mode (no-op in remote mode). Callers MUST invoke it — typically in\n * a `finally` block — to satisfy `library/CLAUDE.md` § \"Notes for Consumers\".\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A `ResolvedCatalogSource` carrying the source and a close handle.\n * @throws When `local` is configured but no usable local library is registered.\n * @docLink cli/dev-guide#open-library\n */\nexport async function resolveCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<ResolvedCatalogSource> {\n  const {\n    resolveConfig,\n    RemoteCatalogSource,\n    RestCatalogSource,\n    LocalCatalogSource,\n    isLocalCatalogUrl,\n  } = await import(\"@skaile/workspaces/library\");\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n\n  if (isLocalCatalogUrl(baseUrl)) {\n    const fs = await import(\"node:fs\");\n    const library = await openLibrary();\n    try {\n      const sources = await library.listSources();\n      type LibraryRow = (typeof sources)[number];\n      // Type-narrow: `path` is required for local libraries after the filter.\n      const usable = sources\n        .filter(\n          (s): s is LibraryRow & { path: string } =>\n            s.backend === \"local\" && typeof s.path === \"string\" && s.path.length > 0,\n        )\n        .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n      if (usable.length === 0) {\n        throw new Error(\n          \"catalog.url is set to 'local' but no local library is registered. \" +\n            \"Run `skaile source add <path>` first, then `skaile source sync`.\",\n        );\n      }\n\n      // Prefer the most recently added library whose path still exists.\n      const present = usable.find((s) => fs.existsSync(s.path));\n      if (!present) {\n        const head = usable[0];\n        throw new Error(\n          `catalog.url is set to 'local' but every registered local library has a missing path on disk. ` +\n            `Most recent: ${head.path} (library ${head.id}). ` +\n            `Re-register with \\`skaile source add <existing-path>\\` or run \\`skaile source list\\` to inspect.`,\n        );\n      }\n\n      const source = new LocalCatalogSource(\n        library,\n        present.id,\n        present.path,\n        createFullRegistry(),\n      );\n      return { source, close: () => library.close() };\n    } catch (err) {\n      // Release the handle on any failure during dispatch — otherwise the\n      // SQLite WAL state leaks for the lifetime of the process.\n      library.close();\n      throw err;\n    }\n  }\n\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  const source =\n    cfg.catalog.framing === \"rest\"\n      ? new RestCatalogSource({ baseUrl, cacheTtlMs })\n      : new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n  return { source, close: () => {} };\n}\n\n/**\n * Open the LibraryManager bound to the active LocalIndex.\n * Caller owns lifetime — must call `close()` (returned helper closes the\n * underlying LocalIndex).\n *\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibraryManager(): Promise<{\n  manager: import(\"@skaile/workspaces/library\").LibraryManager;\n  library: import(\"@skaile/workspaces/library\").LocalIndex;\n  close: () => void;\n}> {\n  const { LibraryManager } = await import(\"@skaile/workspaces/library\");\n  const library = await openLibrary();\n  const manager = new LibraryManager(library);\n  return { manager, library, close: () => library.close() };\n}\n\n/**\n * Keep the registered libraries that are authoring places — the rows that are\n * NOT source clones. Source clones live under the cache root; `index.db` rows\n * predating the cache migration still carry the legacy `~/.skaile/sources`\n * path, so both roots are excluded.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport function authoringLibraries<L extends { path: string }>(libs: L[]): L[] {\n  const newRoot = getGlobalCacheDir();\n  const legacyRoot = path.join(globalSkaileDir(), \"sources\");\n  return libs.filter((l) => !l.path.startsWith(newRoot) && !l.path.startsWith(legacyRoot));\n}\n"]}

package/dist/{chunk-JPR7EPIM.js → chunk-TVFSA5IQ.js}

@@ -1,5 +1,5 @@
-import { defaultLibraryDir } from './chunk-BIMEKYOE.js';
-import { factoryAssetRoots } from './chunk-PU5VY7KF.js';
+import { defaultLibraryDir } from './chunk-6GBQND2F.js';
+import { factoryAssetRoots } from './chunk-4SSKKFDF.js';
 import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
@@ -19,5 +19,5 @@ var MONOREPO_ROOT = findMonorepoRoot(__ownDir);
 var AI_RESOURCES = factoryAssetRoots()[0] ?? defaultLibraryDir();
 
 export { AI_RESOURCES, MONOREPO_ROOT };
-//# sourceMappingURL=chunk-JPR7EPIM.js.map
-//# sourceMappingURL=chunk-JPR7EPIM.js.map
+//# sourceMappingURL=chunk-TVFSA5IQ.js.map
+//# sourceMappingURL=chunk-TVFSA5IQ.js.map

package/dist/{chunk-JPR7EPIM.js.map → chunk-TVFSA5IQ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/paths.ts"],"names":[],"mappings":";;;;;;AAeA,IAAM,WAAW,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAW5D,SAAS,iBAAiB,IAAA,EAA6B;AACrD,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,EAAA,CAAG,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,YAAY,CAAC,GAAG,OAAO,GAAA;AACxD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAYO,IAAM,aAAA,GAA+B,iBAAiB,QAAQ;AAc9D,IAAM,YAAA,GAAuB,iBAAA,EAAkB,CAAE,CAAC,KAAK,iBAAA","file":"chunk-JPR7EPIM.js","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { defaultLibraryDir, factoryAssetRoots } from \"@skaile/workspaces/core\";\n\n/**\n * The content-root policy lives in `@skaile/workspaces/core` so the flow\n * connector's resolution surfaces can reach it too — `factory-assets → cli`\n * would be a module cycle. Re-exported here because this module is the CLI's\n * documented path surface and every CLI caller imports it from here.\n *\n * @docLink cli/dev-guide#paths\n */\nexport { aiResourceRoots } from \"@skaile/workspaces/core\";\n\nconst __ownDir = path.dirname(fileURLToPath(import.meta.url));\n\n/**\n * Walk up from `from` looking for the monorepo marker (`biome.json`, the\n * repo-root shared tooling config). Returns the matching directory or `null`\n * when none is found within eight levels — the latter is the typical case when\n * `@skaile/workspaces` has been installed via `npm i` without a skaile-dev\n * workspace context. Used only to gate dev-only commands (e.g.\n * `serve --compile-test`); first-party content is located via\n * {@link aiResourceRoots}, not this.\n */\nfunction findMonorepoRoot(from: string): string | null {\n  let dir = from;\n  for (let i = 0; i < 8; i++) {\n    if (fs.existsSync(path.join(dir, \"biome.json\"))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Absolute path to the monorepo root, or `null` when the CLI is running\n * outside the skaile-dev workspace (typical for `npm i -g` installs).\n *\n * Consumers that only make sense inside the workspace (e.g.\n * `skaile serve --compile-test`) MUST check for `null` and report a\n * \"monorepo-only feature\" error before proceeding.\n *\n * @docLink cli/dev-guide#paths\n */\nexport const MONOREPO_ROOT: string | null = findMonorepoRoot(__ownDir);\n\n/**\n * Default content root used by path display and the `validate` command.\n *\n * The primary first-party `factory-assets/` root resolved through the shared\n * `factoryAssetRoots()` helper — the `SKAILE_FACTORY_ASSETS_DIR` override when\n * set, else the in-repo source during dev / bundled `dist/factory-assets/` after\n * `npm i`. Falls back to `$SKAILE_HOME/libraries/` (`~/.skaile/libraries/`) — the user-library directory\n * managed by `skaile library add` — when the package cannot be located.\n * Consumers `fs.existsSync` first and degrade to \"no skills / flows discovered\".\n *\n * @docLink cli/dev-guide#paths\n */\nexport const AI_RESOURCES: string = factoryAssetRoots()[0] ?? defaultLibraryDir();\n"]}
+{"version":3,"sources":["../cli/src/paths.ts"],"names":[],"mappings":";;;;;;AAeA,IAAM,WAAW,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAW5D,SAAS,iBAAiB,IAAA,EAA6B;AACrD,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,EAAA,CAAG,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,YAAY,CAAC,GAAG,OAAO,GAAA;AACxD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAYO,IAAM,aAAA,GAA+B,iBAAiB,QAAQ;AAc9D,IAAM,YAAA,GAAuB,iBAAA,EAAkB,CAAE,CAAC,KAAK,iBAAA","file":"chunk-TVFSA5IQ.js","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { defaultLibraryDir, factoryAssetRoots } from \"@skaile/workspaces/core\";\n\n/**\n * The content-root policy lives in `@skaile/workspaces/core` so the flow\n * connector's resolution surfaces can reach it too — `factory-assets → cli`\n * would be a module cycle. Re-exported here because this module is the CLI's\n * documented path surface and every CLI caller imports it from here.\n *\n * @docLink cli/dev-guide#paths\n */\nexport { aiResourceRoots } from \"@skaile/workspaces/core\";\n\nconst __ownDir = path.dirname(fileURLToPath(import.meta.url));\n\n/**\n * Walk up from `from` looking for the monorepo marker (`biome.json`, the\n * repo-root shared tooling config). Returns the matching directory or `null`\n * when none is found within eight levels — the latter is the typical case when\n * `@skaile/workspaces` has been installed via `npm i` without a skaile-dev\n * workspace context. Used only to gate dev-only commands (e.g.\n * `serve --compile-test`); first-party content is located via\n * {@link aiResourceRoots}, not this.\n */\nfunction findMonorepoRoot(from: string): string | null {\n  let dir = from;\n  for (let i = 0; i < 8; i++) {\n    if (fs.existsSync(path.join(dir, \"biome.json\"))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Absolute path to the monorepo root, or `null` when the CLI is running\n * outside the skaile-dev workspace (typical for `npm i -g` installs).\n *\n * Consumers that only make sense inside the workspace (e.g.\n * `skaile serve --compile-test`) MUST check for `null` and report a\n * \"monorepo-only feature\" error before proceeding.\n *\n * @docLink cli/dev-guide#paths\n */\nexport const MONOREPO_ROOT: string | null = findMonorepoRoot(__ownDir);\n\n/**\n * Default content root used by path display and the `validate` command.\n *\n * The primary first-party `factory-assets/` root resolved through the shared\n * `factoryAssetRoots()` helper — the `SKAILE_FACTORY_ASSETS_DIR` override when\n * set, else the in-repo source during dev / bundled `dist/factory-assets/` after\n * `npm i`. Falls back to `$SKAILE_HOME/libraries/` (`~/.skaile/libraries/`) — the user-library directory\n * managed by `skaile library add` — when the package cannot be located.\n * Consumers `fs.existsSync` first and degrade to \"no skills / flows discovered\".\n *\n * @docLink cli/dev-guide#paths\n */\nexport const AI_RESOURCES: string = factoryAssetRoots()[0] ?? defaultLibraryDir();\n"]}

package/dist/{chunk-4YE7OYTB.js → chunk-VKSA2CDJ.js}

@@ -1,4 +1,5 @@
-import { parseAssetRef } from './chunk-OABIGSUY.js';
+import { compositeSha256 } from './chunk-SR4RFKHM.js';
+import { parseAssetRef } from './chunk-WX74MVNA.js';
 import { createHash } from 'crypto';
 import { rm, mkdir, writeFile } from 'fs/promises';
 import { isAbsolute, resolve, sep, join, dirname } from 'path';
@@ -75,9 +76,7 @@ async function installFromManifest(opts) {
       throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);
     }
   }
-  const sortedLines = manifest.files.slice().sort((a, b) => a.path.localeCompare(b.path)).map((e) => `${e.path}:${e.sha256}
-`).join("");
-  const actualComposite = createHash("sha256").update(sortedLines, "utf-8").digest("hex");
+  const actualComposite = compositeSha256(manifest.files);
   if (actualComposite !== manifest.sha256) {
     throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);
   }
@@ -124,5 +123,5 @@ async function installFlat(manifest, targetDir, fetcher) {
 }
 
 export { assertSafeManifestPath, installFromManifest, longestCommonDirPrefix };
-//# sourceMappingURL=chunk-4YE7OYTB.js.map
-//# sourceMappingURL=chunk-4YE7OYTB.js.map
+//# sourceMappingURL=chunk-VKSA2CDJ.js.map
+//# sourceMappingURL=chunk-VKSA2CDJ.js.map

package/dist/chunk-VKSA2CDJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;;AAgDO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,QAAA,CAAS,KAAK,CAAA;AACtD,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AAAA,IACxC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-VKSA2CDJ.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\nimport { compositeSha256 } from \"../../../core/src/publish-manifest.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const actualComposite = compositeSha256(manifest.files);\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n  }\n\n  return { installPath: target };\n}\n"]}

package/dist/{chunk-TVJBJLXR.js → chunk-VLEWVR44.js}

@@ -1,12 +1,12 @@
-import { openLibraryManager } from './chunk-R3QW7CA5.js';
-import { logErr, logInfo, logWarn, logOk, S } from './chunk-77GKEZ2R.js';
-import { createFullRegistry } from './chunk-BZXR6SW5.js';
-import { getStoreManifestsDir, LocalCatalogSource, curatedManifestOverlay, writeCuratedManifest } from './chunk-B4J4RGNY.js';
-import { computeDeterministicHash, discoverAssetsInTree } from './chunk-LZ5RH6LD.js';
-import { WorkspaceYamlEditor } from './chunk-BIMEKYOE.js';
-import { findWorkspaceRoot, workspaceConfigFilename, sourceShortName, sourceCacheKey, storeManifestSlug, getGlobalCacheDir, resolveSourcePublisher } from './chunk-P2EM6FNQ.js';
-import { decodeSkaileManifest, encodeSkaileManifest } from './chunk-YRF5CYHR.js';
-import { parseAssetRef } from './chunk-OABIGSUY.js';
+import { openLibraryManager } from './chunk-TR7KFBIO.js';
+import { logErr, logInfo, logWarn, logOk, S } from './chunk-WGN7Z36G.js';
+import { createFullRegistry } from './chunk-ZCSFGGLG.js';
+import { getStoreManifestsDir, LocalCatalogSource, curatedManifestOverlay, writeCuratedManifest } from './chunk-3ZVSINEV.js';
+import { computeDeterministicHash, discoverAssetsInTree } from './chunk-Y7UBRRKG.js';
+import { WorkspaceYamlEditor } from './chunk-6GBQND2F.js';
+import { findWorkspaceRoot, workspaceConfigFilename, sourceShortName, sourceCacheKey, storeManifestSlug, getGlobalCacheDir, resolveSourcePublisher } from './chunk-KBAE7PU7.js';
+import { decodeSkaileManifest, encodeSkaileManifest } from './chunk-SR4RFKHM.js';
+import { parseAssetRef } from './chunk-WX74MVNA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, rmSync, renameSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
 import * as path from 'path';
@@ -315,12 +315,12 @@ function addSourceManifestCommands(src) {
   ).option("-C, --project-dir <dir>", "Project directory", process.cwd()).option("--publisher <name>", "Override the publisher (--overwrite only)").option("--dev", "Include assets under the source's dev_paths", false).option("--overwrite", "Discard curation and re-scan the full inventory", false).action((arg, opts) => runRebuild(arg, opts));
   manifest.command("verify <src>").description("Verify hashes, deps, and schema (read-only)").option("-C, --project-dir <dir>", "Project directory", process.cwd()).option("--strict", "Fail on advisory checks (warnings force a nonzero exit)", false).action((arg, opts) => runVerify(arg, opts));
   manifest.command("publish <src>").description("Push the curated sidecar manifest and publish it to the store").option("-C, --project-dir <dir>", "Project directory", process.cwd()).option("--as <namespace>", "Publisher namespace (default: your store username)").option("--sidecar-repo <url>", "Public GitHub repo you own to hold the curated manifest").option("--ref <gitref>", "Foreign source ref to ingest (branch/sha; default: main)").option("--dry-run", "Print the publish plan without pushing or calling the store", false).action(async (arg, opts) => {
-    const { runPublish } = await import('./source-manifest-publish-QEJML4VS.js');
+    const { runPublish } = await import('./source-manifest-publish-SCAHAYSQ.js');
     await runPublish(arg, opts);
   });
   manifest.command("propose <src>").description("Open a PR to upstream with the sidecar manifest").action(() => notWired("propose"));
   manifest.command("yank <src>").description("Retract the source's published assets from the store").option("-C, --project-dir <dir>", "Project directory", process.cwd()).option("--asset <ref>", "Yank only the asset matching this ref/name").action(async (arg, opts) => {
-    const { runYank } = await import('./source-manifest-publish-QEJML4VS.js');
+    const { runYank } = await import('./source-manifest-publish-SCAHAYSQ.js');
     await runYank(arg, opts);
   });
 }
@@ -685,5 +685,5 @@ function makeSourceCommand() {
 }
 
 export { autoSyncForSearch, ensureClone, findCacheKeyCollision, indexingHadFailures, legacySourceConfigHint, makeSourceCommand, normalizeSourceUrl, readProjectSources, resolveSourceArg, sourceClonePath, sourceMatchesKey, syncProjectSources };
-//# sourceMappingURL=chunk-TVJBJLXR.js.map
-//# sourceMappingURL=chunk-TVJBJLXR.js.map
+//# sourceMappingURL=chunk-VLEWVR44.js.map
+//# sourceMappingURL=chunk-VLEWVR44.js.map