@skaile/workspaces 5.6.1 → 5.7.0

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## 5.7.0
+
+### Minor Changes
+
+- [#1027](https://github.com/skaile-ai/workspaces/pull/1027) [`13a54f1`](https://github.com/skaile-ai/workspaces/commit/13a54f15275a9410af554a3eadf05c58e0d1b932) Thanks [@mortegro](https://github.com/mortegro)! - Library authoring fixes from the 5.4.0 review:
+
+  - `skaile library index` and `skaile validate` now accept dependency refs in the documented `kind:@publisher/name#version` form. A malformed `dependencies` entry fails both commands with the same message; before, `index` dropped it and exited 0 while `validate` passed.
+  - `skaile library index` no longer writes a broken asset into the manifest. An asset whose file does not parse (e.g. an empty `SKILL.md`) is reported and skipped with exit 1, an asset with a version that is not semver is skipped with a warning, and `library publish` refuses both. Re-indexing removes the index row of an asset it now skips, so `add` and `search --local` stop finding the old version.
+  - `skaile validate` fails on a `metadata.version` that is not semver, warns when the manifest version differs from the asset file (the file is the source of truth; run `skaile library index`), and flags unedited scaffolds of every kind (prompt, agent, contract and flow, not only skill).
+  - `skaile validate versions [path]` and `skaile validate changelog [path]` take a path like plain `skaile validate` and default to the library you are in. `--changed-only` outside a git repo prints one line, `git diff failed in <root>: …`. `skaile validate versions` now fails on a non-semver version, like plain `validate`.
+  - `skaile library create` now scaffolds only skill, agent, prompt, flow, preset and contract. Other kinds (persona, ruleset, knowledge, mcp-server, connector) are refused with exit 1 instead of silently creating a skill. Hand-written files of those kinds still validate.
+  - `skaile library create --dir` is refused when it points outside the library.
+  - `skaile library create` rejects asset names that are not lowercase kebab-case and invalid `--publisher` values (also checked by `library set publisher=`), with a hint and exit 1, creating nothing.
+  - `skaile library create` and `skaile library index` no longer write `metadata.publisher` into asset files; the manifest (`assets[].publisher`, else the library's `publisher:`) is the only publisher source. `skaile validate` warns about a file whose `metadata.publisher` differs from it. Existing files keep the key until you remove it.
+  - `skaile library index` and adopting an existing directory with `skaile library init` now warn when the publisher falls back to the library name.
+  - `skaile library link` and `skaile library init --git` warn when the remote is not a GitHub URL, since `library publish` only supports GitHub. The exit code is unchanged.
+  - API: `createScaffold` / `AssetManager.create` return `{ ok: false }` for a kind without a scaffold instead of creating a skill, and `syncManifestWithDisk` returns `{ removed, skipped }` (see MIGRATION.md).
+
+- [#1028](https://github.com/skaile-ai/workspaces/pull/1028) [`baa938a`](https://github.com/skaile-ai/workspaces/commit/baa938a4ea1e888afbb5af6441082cb8e765406a) Thanks [@mortegro](https://github.com/mortegro)! - Library git flow, `library set` guards and path fixes from the 5.4.0 review:
+
+  - `skaile library pull` and `skaile library sync` stay fast-forward-only. When local and remote both changed, they now fail with one line that names `skaile library git <lib> pull --rebase origin <branch>`, instead of a long git dump (`pull` used to exit 0 here). `library init --git` and `library link` now set the branch upstream.
+  - `skaile library commit` now refuses (exit 1, no commit) while a rebase, merge, cherry-pick or revert is unfinished or unmerged files exist.
+  - `skaile library set <lib> isDefault=true` now makes that library the only default instead of failing with a SQL error. `isDefault=false` on the current default is refused.
+  - `skaile library set` now rejects an unknown `ownership`, `contributor`/`reader` on a local library, and `backendConfig.url` on a local library, with the same wording `init` uses.
+  - Library names must be letters, digits, `_` or `-`, starting with a letter or digit (`init`, `rename`, `set name=`). Names like `a/b` or `../y` no longer create nested folders or crash. `set name=` now renames like `library rename`. `library remove --purge` also removes the empty parent folders it leaves behind under the libraries root.
+  - `skaile library remove` without a TTY and without `-y` now exits 1 with `library remove needs confirmation: pass -y` and keeps the library.
+  - Git-only commands on a local library (`push`, `pull`, `sync`, …) now tell you to run `skaile library link <name> <url>` first.
+  - A relative `SKAILE_HOME`, `SKAILE_INDEX_PATH`, `SKAILE_LIBRARIES_DIR` or `SKAILE_CACHE_DIR` is now made absolute at startup, so commands run from a subdirectory, and programs `skaile` starts, use the same libraries, index and cache.
+  - `skaile source remove` and its `--purge` help now name the real cache directory instead of a hard-coded `~/.skaile/cache/sources/`.
+  - `skaile update` with `catalog.url: local` now prints `Catalog refresh skipped (catalog.url: local)` instead of reporting a failed refresh.
+  - Piping output into a reader that closes early (`skaile search … | head -1`) now exits 0 without an EPIPE stack trace.
+  - `skaile --help` lists the real session subcommands (`session list|show|switch|delete`), and the README quick start no longer uses the non-existent `skaile run mvp`.
+  - Registering or renaming a library through `@skaile/workspaces/library` now rejects names that are not letters, digits, `_` or `-`, and `source add` turns repo names such as `my.repo` into valid library names.
+
+- [#1026](https://github.com/skaile-ai/workspaces/pull/1026) [`014b422`](https://github.com/skaile-ai/workspaces/commit/014b422606c879517419ad467fbc8426671a729f) Thanks [@mortegro](https://github.com/mortegro)! - Resolver and lock fixes from the 5.4.0 review:
+
+  - `skaile add` and `skaile install` now resolve a ref from your registered library before asking any store, so a library asset adds even when the store is unreachable, and the success line names the library. A `#version` pin the library does not hold still falls through to the store. See MIGRATION.md.
+  - `skaile install` no longer asks the store about refs your library already provides, and an unreachable store is reported once per store URL instead of once per ref.
+  - The dependencies of a library asset (`requires` and `dependencies`) are now deployed and locked together with it. Dependency cycles are handled.
+  - `skaile add skill:@acme/x` now finds an asset created with `library create --publisher acme`, even when the library's own publisher is different.
+  - Short refs like `skill:name` now find library assets in `info`, `why` and `diff`. `diff` on an unknown ref says "not found" instead of crashing.
+  - `skaile doctor` and `skaile check` now report unmet requirements of library assets and locked assets whose library is gone, instead of saying everything is fine. `skaile check` fails for every declared dependency that does not resolve and names `skaile install`.
+  - Re-adding an asset with a new version pin (`skaile add x#0.2.0` after `skaile add x`) now replaces its line in `skaile.yaml` instead of adding a second one.
+  - Upgrading a source or store pinned asset now leaves one entry for it in `skaile.lock.yaml`, not one per version.
+  - The lock now records the library asset version that was actually deployed, so bumping a skill and running `skaile update` writes the new version and `skaile install --locked` passes.
+  - `skaile remove` now removes a declared asset from `skaile.yaml` and the lock even when its files are already gone, including every duplicate line an older `add` left behind. It exits 1 only when there was nothing to remove.
+  - `skaile outdated` now reads library assets from disk, so a version bump shows up once without `skaile library index` first. It lists a library asset whose content changed without a version bump as `content changed since lock`, and a source asset after `skaile source sync` moved the clone past the locked commit, with the number of commits behind. A lock that is ahead of your local clone is not reported as behind.
+  - Adding two sources with the same repo name from different orgs now gives each its own library row, and `source remove` only removes the row of the source you name.
+  - `skaile manage` now ticks an asset only in the library its lock entry names, and `skaile search` shows which library each result comes from.
+  - `asset show` and `asset install` now reject `@publisher/name@version` like `install` does, and `asset show` prints only the canonical `ref`.
+
+- [#1029](https://github.com/skaile-ai/workspaces/pull/1029) [`8b5e19f`](https://github.com/skaile-ai/workspaces/commit/8b5e19fb14f89a475937ceddeb9613dedf871eae) Thanks [@mortegro](https://github.com/mortegro)! - Upgrade hints and docs from the 5.4.0 review:
+
+  - `--domain` on `asset import`, `asset migrate`, `library create` and `validate versions`, and `skaile library set <lib> structure=…`, now print the "domains were removed in 5.0" hint and exit 1 instead of a generic unknown-option error. `--domain` no longer appears in `--help`.
+  - When `skaile add` or `skaile install` cannot find a ref after a publisher change, the error now names the asset under its new publisher (`did you mean skill:@acme/…?`) and the lock entry still pinned to the old one, only when that lock entry came from the library that now holds the asset under the new publisher (an unrelated asset that just shares the name is no longer offered). The hint is printed by the CLI; programmatically, `InstallResult.missing` still holds bare refs and the text is in the new `InstallResult.missingHints` (ref → hint).
+  - The "Upgrading a 4.x library" steps and the 5.3.0 migration entry now say to run `skaile install` once and commit `skaile.lock.yaml` (`install --locked` fails until then), and to run `skaile library link <name> <url>` before `library commit`, `push` or `publish` on a library still registered as local.
+  - The 5.4.0 migration entry carries its real heading, and the release script refuses to publish a new version while `MIGRATION.md` still has an `## Unreleased` heading (`node scripts/release.mjs --check-migration` runs the check alone).
+
+### Patch Changes
+
+- [#1036](https://github.com/skaile-ai/workspaces/pull/1036) [`5ebf7dd`](https://github.com/skaile-ai/workspaces/commit/5ebf7dd75c15f253ee573a0f049cb523e90d853f) Thanks [@peteralbert](https://github.com/peteralbert)! - The runner now re-announces `protocol_info` on every reconnect once a session is initialized, not only on managed hosts. A platform that re-adopted a running container after its own restart had lost the announcement, so it refused every version-gated command for the rest of the container's life: answering a flow's open question failed with "connector_mutate requires Protocol 3.7 acknowledgement support".
+
 ## 5.6.1
 
 ### Patch Changes

package/README.md

@@ -80,7 +80,8 @@ cli  (top-level CLI — orchestrates everything below)
 # Installed from npm (npm i -D skaile-cli)
 npx skaile --help          # run the skaile CLI
 npx skaile search skill    # list available skills
-npx skaile run mvp         # run a flow
+npx skaile flow list       # list available flows
+npx skaile run "Summarise this repository"   # send a single prompt (run also takes a flow name)
 ```
 
 ```bash
@@ -88,7 +89,8 @@ npx skaile run mvp         # run a flow
 bun run build
 bun packages/workspaces/cli/src/index.ts --help        # run the skaile CLI
 bun packages/workspaces/cli/src/index.ts search skill  # list available skills
-bun packages/workspaces/cli/src/index.ts run mvp       # run a flow
+bun packages/workspaces/cli/src/index.ts flow list     # list available flows
+bun packages/workspaces/cli/src/index.ts run "Summarise this repository"  # send a single prompt
 ```
 
 Flow authors and editor integrations can import the v2 contract independently:

package/dist/{asset-feeds-LU7NHOAP.js → asset-feeds-K36CR52Q.js}

@@ -1,27 +1,27 @@
-import { getKnownKinds } from './chunk-OLLAQLFJ.js';
-import './chunk-AOAZCSDI.js';
+import { getKnownKinds } from './chunk-WIEC3ZE4.js';
+import './chunk-LBQ4BBX4.js';
 import './chunk-QZLWJETK.js';
 import './chunk-NFGRW3L7.js';
 import './chunk-QCI6D7E4.js';
-import './chunk-MX3UQXLU.js';
-import './chunk-XOGG7VDZ.js';
-import './chunk-BTISGSK4.js';
+import './chunk-DFFD4BFG.js';
+import './chunk-6VRJH4MR.js';
+import './chunk-FAP63KV7.js';
 import './chunk-R7FOF242.js';
 import './chunk-3TXEJN4W.js';
 import './chunk-FRHE7FFB.js';
-import './chunk-TZCQ7ZWQ.js';
+import './chunk-OOLT6HGP.js';
 import './chunk-4GY63JU6.js';
-import { factoryAssetRoots } from './chunk-BF33SCLY.js';
-import './chunk-46OVMT76.js';
+import { factoryAssetRoots } from './chunk-SWO25LTO.js';
+import './chunk-G67BOI2J.js';
 import './chunk-5BEFNLOR.js';
 import './chunk-A2ULN3KX.js';
-import { scanRepo } from './chunk-2W4LBLIN.js';
-import './chunk-MFHKHXDE.js';
+import { scanRepo } from './chunk-LCU5U5IW.js';
+import './chunk-L5VSIPQD.js';
 import './chunk-CPSIPIX7.js';
-import './chunk-7ZHLYXTI.js';
+import './chunk-RVIZQ5XD.js';
 import './chunk-RVRB27AN.js';
-import './chunk-PA7WLID3.js';
-import './chunk-AO7VJ6G6.js';
+import './chunk-TTPSDC2G.js';
+import './chunk-O7VPNKYN.js';
 import './chunk-ICSCSM5D.js';
 import './chunk-JMKB7IB4.js';
 import './chunk-MJHSLODD.js';
@@ -34,7 +34,7 @@ import * as path from 'path';
 async function libraryAssets() {
   const notes = [];
   try {
-    const { openLibraryManager, authoringLibraries } = await import('./open-library-4WUMQHES.js');
+    const { openLibraryManager, authoringLibraries } = await import('./open-library-P3D337NH.js');
     const { manager, close } = await openLibraryManager();
     try {
       const libs = authoringLibraries(await manager.listLibraries());
@@ -61,7 +61,7 @@ async function libraryAssets() {
 async function storeAssets(projectDir) {
   const notes = [];
   try {
-    const { resolveCatalogSource } = await import('./open-library-4WUMQHES.js');
+    const { resolveCatalogSource } = await import('./open-library-P3D337NH.js');
     const { source, close } = await resolveCatalogSource({ projectDir });
     try {
       const assets = await source.listAssets();
@@ -140,5 +140,5 @@ async function gatherAssetFeeds(am, projectDir) {
 }
 
 export { gatherAssetFeeds };
-//# sourceMappingURL=asset-feeds-LU7NHOAP.js.map
-//# sourceMappingURL=asset-feeds-LU7NHOAP.js.map
+//# sourceMappingURL=asset-feeds-K36CR52Q.js.map
+//# sourceMappingURL=asset-feeds-K36CR52Q.js.map

package/dist/{asset-feeds-LU7NHOAP.js.map → asset-feeds-K36CR52Q.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/asset-feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEA,eAAe,aAAA,GAGZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,kBAAA,EAAoB,kBAAA,EAAmB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACnF,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,IAAA,IAAI;AAEF,MAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,MAAM,OAAA,CAAQ,eAAe,CAAA;AAC7D,MAAA,MAAM,UAAyB,EAAC;AAChC,MAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,QAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3B,QAAA,MAAM,UAAA,GAAa;AAAA,UACjB,GAAI,MAAM,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,EAAE,UAAA,EAAY,aAAA,EAAc,EAAG;AAAA,SACxE;AACA,QAAA,KAAA,MAAW,KAAA,IAAS,UAAA,EAAY,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,MAC5F;AACA,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAYA,eAAe,YAAY,UAAA,EAGxB;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACjE,IAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,MAAM,oBAAA,CAAqB,EAAE,YAAY,CAAA;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,MAAA,MAAM,OAAA,GAA0B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,IAAA,EAAO,EAAE,IAAA,IAAsB,OAAA;AAAA,QAC/B,WAAA,EAAa,EAAE,WAAA,IAAe,EAAA;AAAA,QAC9B,MAAA,EAAQ,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,CAAA;AAAA,QACvB,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OACjB,CAAE,CAAA;AACF,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG3D,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAK,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAaA,eAAe,aAAa,EAAA,EAA8C;AAIxE,EAAA,MAAM,eAAA,GAAkB,iBAAA,EAAkB,CAAE,GAAA,CAAI,CAAC,CAAA,KAAO,CAAA,CAAE,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,CAAA,GAAI,CAAA,GAAS,IAAA,CAAA,GAAI,CAAA;AAChG,EAAA,MAAM,gBAAgB,CAAC,CAAA,KACrB,eAAA,CAAgB,IAAA,CAAK,CAAC,EAAA,KAAO,CAAA,KAAM,EAAA,CAAG,KAAA,CAAM,GAAG,EAAE,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,EAAE,CAAC,CAAA;AAExE,EAAA,MAAM,GAAA,GAAA,CAAO,MAAM,EAAA,CAAG,MAAA,EAAO,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AACtE,EAAA,MAAM,UAAyB,EAAC;AAMhC,EAAA,KAAA,MAAW,EAAE,QAAA,EAAU,IAAA,EAAK,IAAK,EAAA,CAAG,iBAAgB,EAAG;AACrD,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACzB,IAAA,MAAM,SAAS,IAAA,CAAK,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,OAAO,IAAA,GAAY,IAAA,CAAA,GAAA;AAC5D,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,IAAA,IAAQ,CAAA,CAAE,MAAA,CAAO,UAAA,CAAW,MAAM,CAAC,CAAA;AAChF,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACxB,IAAA,MAAM,aAAa,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,QAAA;AAChD,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,EAAE,QAAQ,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,OAAA;AACT;AAUA,eAAe,aAAA,GAGZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,IAAA,IAAQ,mBAAkB,EAAG;AACtC,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAI,MAAM,QAAA,CAAS,IAAA,EAAM,gBAAA,EAAkB,EAAE,UAAA,EAAY,aAAA,EAAc,EAAG,CAAE,CAAA;AAAA,IAC3F;AACA,IAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,EAC1B,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,SAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAGA,SAAS,GAAA,CAAI,QAAqB,OAAA,EAAwC;AACxE,EAAA,OAAO,QAAQ,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAM,CAAE,CAAA;AACnD;AASA,eAAsB,gBAAA,CACpB,IACA,UAAA,EAC0B;AAC1B,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,aAAA,EAAc,EAAG,WAAA,CAAY,UAAU,CAAC,CAAC,CAAA;AAClF,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,EAAc;AACpC,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,EAAE,CAAA;AACjC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP,GAAG,GAAA;AAAA,MACH,GAAG,IAAA,CAAK,OAAA;AAAA,MACR,GAAG,GAAA,CAAI,SAAA,EAAW,OAAA,CAAQ,OAAO,CAAA;AAAA,MACjC,GAAG,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,OAAO;AAAA,KAC/B;AAAA,IACA,KAAA,EAAO,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,GAAG,KAAA,CAAM,KAAA,EAAO,GAAG,OAAA,CAAQ,KAAK;AAAA,GACzD;AACF","file":"asset-feeds-LU7NHOAP.js","sourcesContent":["/**\n * asset-feeds.ts — gather installable assets from every feed the manage TUI\n * surfaces.\n *\n * Four feeds, normalized into `CatalogEntry`:\n * - **Project sources** — `skaile.yaml` `sources:` entries (scanned via\n *   `AssetManager.search()`; the new `sources:` field is merged into the\n *   legacy repositories map in `AssetManager.loadConfig`).\n * - **Local libraries** — user authoring places from `LocalIndex` (filesystem\n *   scan of each library's `path`).\n * - **Factory assets** — the bundled first-party `factory-assets` tree\n *   (`factoryAssetRoots()`), scanned from disk. Always present; no network.\n * - **Remote store** — the configured catalog source when `catalog.url` is\n *   not `local`. Failures are non-fatal — they surface as notes.\n */\n\nimport { existsSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  type AssetKind,\n  type CatalogEntry,\n  factoryAssetRoots,\n  scanRepo,\n} from \"@skaile/workspaces/core\";\nimport { getKnownKinds } from \"./open-registry.ts\";\n\n/** One non-fatal note returned to the caller for surfacing in the UI. */\nexport interface FeedNote {\n  feed: \"sources\" | \"libraries\" | \"store\" | \"factory\";\n  message: string;\n}\n\n/**\n * Which feed an asset came from. This is the top-level grouping axis in the\n * manage TUI (\"where is this skill coming from?\") and is intentionally distinct\n * from `publisher` (asset-intrinsic identity): the same publisher can legitimately\n * appear under more than one origin (e.g. a github repo you added as a `source`\n * that is also listed in the remote `store`).\n */\nexport type AssetOrigin = \"source\" | \"library\" | \"factory\" | \"store\";\n\n/** A catalog entry tagged with the feed it was gathered from. */\nexport interface OriginEntry {\n  origin: AssetOrigin;\n  entry: CatalogEntry;\n  /**\n   * Second-level grouping label for the manage tree. Defaults (when unset) to the\n   * entry's `publisher`; the source feed sets it to the source's short repo name\n   * so the Sources band groups by source — \"which repo did this come from\" — not\n   * by the asset-intrinsic publisher.\n   */\n  group?: string;\n}\n\nexport interface AssetFeedResult {\n  entries: OriginEntry[];\n  notes: FeedNote[];\n}\n\n/**\n * Pull assets from local libraries (the authoring places under\n * `~/.skaile/libraries/<name>/`, not the `~/.skaile/cache/sources/` cache). Each\n * library's `path` is scanned with `scanRepo` and grouped under the bare library\n * name (`group: <name>`) so the manage TUI shows a clean `<name>` band — no\n * `library:` prefix (mirrors the source feed). Plugin grouping (`entry.plugin`)\n * is stamped by `scanRepo`.\n */\nasync function libraryAssets(): Promise<{\n  entries: OriginEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { openLibraryManager, authoringLibraries } = await import(\"./open-library.ts\");\n    const { manager, close } = await openLibraryManager();\n    try {\n      // Authoring libraries are the rows that are NOT source clones.\n      const libs = authoringLibraries(await manager.listLibraries());\n      const entries: OriginEntry[] = [];\n      for (const lib of libs) {\n        if (!existsSync(lib.path)) continue;\n        const libEntries = [\n          ...(await scanRepo(lib.path, lib.name, { knownKinds: getKnownKinds() })),\n        ];\n        for (const entry of libEntries) entries.push({ origin: \"library\", entry, group: lib.name });\n      }\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    notes.push({\n      feed: \"libraries\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], notes };\n  }\n}\n\n/**\n * Pull a (best-effort) snapshot of the connected remote store catalog.\n *\n * - Returns no entries when the resolved catalog is local-only or the host\n *   is unreachable (the failure becomes a note, not an exception).\n * - Maps `CatalogAsset` → `CatalogEntry`, carrying `publisher`, `repo`, and\n *   `category` straight through and using `source = \"store://<id>\"`; per-file\n *   `source` paths are not available for remote assets so the canonical ref is\n *   a stable placeholder.\n */\nasync function storeAssets(projectDir: string): Promise<{\n  entries: CatalogEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { resolveCatalogSource } = await import(\"./open-library.ts\");\n    const { source, close } = await resolveCatalogSource({ projectDir });\n    try {\n      const assets = await source.listAssets();\n      const entries: CatalogEntry[] = assets.map((a) => ({\n        name: a.name,\n        kind: (a.kind as AssetKind) ?? \"skill\",\n        description: a.description ?? \"\",\n        source: `store://${a.id}`,\n        publisher: a.publisher,\n        repo: a.repo,\n        plugin: a.plugin,\n        category: a.category,\n        version: a.version,\n        requires: [],\n        dependencies: [],\n      }));\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    // Local-only catalog throws a recognizable message — silence it; absence\n    // is the user's choice, not an error.\n    if (!/local/i.test(msg)) {\n      notes.push({ feed: \"store\", message: msg });\n    }\n    return { entries: [], notes };\n  }\n}\n\n/** The slice of `AssetManager` the source feed needs (kept narrow for tests). */\ninterface AssetManagerLike {\n  search: () => Promise<CatalogEntry[]>;\n  searchRepoRoots: () => { repoName: string; root: string }[];\n}\n\n/**\n * Project-source feed: leans on `AssetManager.search()`, which merges\n * `skaile.yaml`'s `sources:` field into the repositories map. Plugin grouping\n * (`entry.plugin`) is stamped by the scanner, so entries pass through as-is.\n */\nasync function sourceAssets(am: AssetManagerLike): Promise<OriginEntry[]> {\n  // The bundled factory tree is injected into the repositories map as an implicit\n  // source, so `am.search()` returns it too. It has its own `factory` origin band,\n  // so drop it here — otherwise the same first-party skills list twice under Sources.\n  const factoryPrefixes = factoryAssetRoots().map((r) => (r.endsWith(path.sep) ? r : r + path.sep));\n  const isFactoryPath = (p: string) =>\n    factoryPrefixes.some((fp) => p === fp.slice(0, -1) || p.startsWith(fp));\n\n  const all = (await am.search()).filter((e) => !isFactoryPath(e.source));\n  const entries: OriginEntry[] = [];\n  // Group each source's entries under the source node (its short repo name), not\n  // the publisher: under Sources the navigational question is \"which repo did\n  // this come from\". Each entry's `source` (absolute manifest path) lives under\n  // exactly one declared root, so group by prefix. The cache slug is\n  // URL-keyed `github.com/<org>/<repo>` — take the trailing segment.\n  for (const { repoName, root } of am.searchRepoRoots()) {\n    if (isFactoryPath(root)) continue;\n    const prefix = root.endsWith(path.sep) ? root : root + path.sep;\n    const owned = all.filter((e) => e.source === root || e.source.startsWith(prefix));\n    if (owned.length === 0) continue;\n    const sourceName = repoName.split(\"/\").pop() || repoName;\n    for (const entry of owned) entries.push({ origin: \"source\", entry, group: sourceName });\n  }\n  return entries;\n}\n\n/**\n * Factory-asset feed: scan the bundled first-party `factory-assets` tree(s)\n * resolved by `factoryAssetRoots()` (the `SKAILE_FACTORY_ASSETS_DIR` override\n * layer ahead of the bundled tree). Local disk only, no network — the entries are\n * the built-in skills / connectors / bundles that ship with `@skaile/workspaces`.\n * `factoryAssetRoots()` already dedupes, so the env override pointing at the\n * bundled dir collapses to one root.\n */\nasync function factoryAssets(): Promise<{\n  entries: CatalogEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const entries: CatalogEntry[] = [];\n    for (const root of factoryAssetRoots()) {\n      entries.push(...(await scanRepo(root, \"skaile-factory\", { knownKinds: getKnownKinds() })));\n    }\n    return { entries, notes };\n  } catch (err) {\n    notes.push({\n      feed: \"factory\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], notes };\n  }\n}\n\n/** Tag a flat entry list with a single origin. */\nfunction tag(origin: AssetOrigin, entries: CatalogEntry[]): OriginEntry[] {\n  return entries.map((entry) => ({ origin, entry }));\n}\n\n/**\n * Run all feeds and return a single normalized result.\n *\n * Feeds run in parallel where possible — the store fetch is the slow one\n * (one HTTP call) and is fired alongside the local library walk. The factory\n * scan is local disk only, so it runs inline.\n */\nexport async function gatherAssetFeeds(\n  am: AssetManagerLike,\n  projectDir: string,\n): Promise<AssetFeedResult> {\n  const [libs, store] = await Promise.all([libraryAssets(), storeAssets(projectDir)]);\n  const factory = await factoryAssets();\n  const src = await sourceAssets(am);\n  return {\n    entries: [\n      ...src,\n      ...libs.entries,\n      ...tag(\"factory\", factory.entries),\n      ...tag(\"store\", store.entries),\n    ],\n    notes: [...libs.notes, ...store.notes, ...factory.notes],\n  };\n}\n"]}
+{"version":3,"sources":["../cli/src/asset-feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEA,eAAe,aAAA,GAGZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,kBAAA,EAAoB,kBAAA,EAAmB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACnF,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,IAAA,IAAI;AAEF,MAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,MAAM,OAAA,CAAQ,eAAe,CAAA;AAC7D,MAAA,MAAM,UAAyB,EAAC;AAChC,MAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,QAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3B,QAAA,MAAM,UAAA,GAAa;AAAA,UACjB,GAAI,MAAM,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,EAAE,UAAA,EAAY,aAAA,EAAc,EAAG;AAAA,SACxE;AACA,QAAA,KAAA,MAAW,KAAA,IAAS,UAAA,EAAY,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,MAC5F;AACA,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAYA,eAAe,YAAY,UAAA,EAGxB;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACjE,IAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,MAAM,oBAAA,CAAqB,EAAE,YAAY,CAAA;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,MAAA,MAAM,OAAA,GAA0B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,IAAA,EAAO,EAAE,IAAA,IAAsB,OAAA;AAAA,QAC/B,WAAA,EAAa,EAAE,WAAA,IAAe,EAAA;AAAA,QAC9B,MAAA,EAAQ,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,CAAA;AAAA,QACvB,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OACjB,CAAE,CAAA;AACF,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG3D,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAK,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAaA,eAAe,aAAa,EAAA,EAA8C;AAIxE,EAAA,MAAM,eAAA,GAAkB,iBAAA,EAAkB,CAAE,GAAA,CAAI,CAAC,CAAA,KAAO,CAAA,CAAE,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,CAAA,GAAI,CAAA,GAAS,IAAA,CAAA,GAAI,CAAA;AAChG,EAAA,MAAM,gBAAgB,CAAC,CAAA,KACrB,eAAA,CAAgB,IAAA,CAAK,CAAC,EAAA,KAAO,CAAA,KAAM,EAAA,CAAG,KAAA,CAAM,GAAG,EAAE,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,EAAE,CAAC,CAAA;AAExE,EAAA,MAAM,GAAA,GAAA,CAAO,MAAM,EAAA,CAAG,MAAA,EAAO,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AACtE,EAAA,MAAM,UAAyB,EAAC;AAMhC,EAAA,KAAA,MAAW,EAAE,QAAA,EAAU,IAAA,EAAK,IAAK,EAAA,CAAG,iBAAgB,EAAG;AACrD,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACzB,IAAA,MAAM,SAAS,IAAA,CAAK,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,OAAO,IAAA,GAAY,IAAA,CAAA,GAAA;AAC5D,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,IAAA,IAAQ,CAAA,CAAE,MAAA,CAAO,UAAA,CAAW,MAAM,CAAC,CAAA;AAChF,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACxB,IAAA,MAAM,aAAa,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,QAAA;AAChD,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,EAAE,QAAQ,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,OAAA;AACT;AAUA,eAAe,aAAA,GAGZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,IAAA,IAAQ,mBAAkB,EAAG;AACtC,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAI,MAAM,QAAA,CAAS,IAAA,EAAM,gBAAA,EAAkB,EAAE,UAAA,EAAY,aAAA,EAAc,EAAG,CAAE,CAAA;AAAA,IAC3F;AACA,IAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,EAC1B,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,SAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAGA,SAAS,GAAA,CAAI,QAAqB,OAAA,EAAwC;AACxE,EAAA,OAAO,QAAQ,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAM,CAAE,CAAA;AACnD;AASA,eAAsB,gBAAA,CACpB,IACA,UAAA,EAC0B;AAC1B,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,aAAA,EAAc,EAAG,WAAA,CAAY,UAAU,CAAC,CAAC,CAAA;AAClF,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,EAAc;AACpC,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,EAAE,CAAA;AACjC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP,GAAG,GAAA;AAAA,MACH,GAAG,IAAA,CAAK,OAAA;AAAA,MACR,GAAG,GAAA,CAAI,SAAA,EAAW,OAAA,CAAQ,OAAO,CAAA;AAAA,MACjC,GAAG,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,OAAO;AAAA,KAC/B;AAAA,IACA,KAAA,EAAO,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,GAAG,KAAA,CAAM,KAAA,EAAO,GAAG,OAAA,CAAQ,KAAK;AAAA,GACzD;AACF","file":"asset-feeds-K36CR52Q.js","sourcesContent":["/**\n * asset-feeds.ts — gather installable assets from every feed the manage TUI\n * surfaces.\n *\n * Four feeds, normalized into `CatalogEntry`:\n * - **Project sources** — `skaile.yaml` `sources:` entries (scanned via\n *   `AssetManager.search()`; the new `sources:` field is merged into the\n *   legacy repositories map in `AssetManager.loadConfig`).\n * - **Local libraries** — user authoring places from `LocalIndex` (filesystem\n *   scan of each library's `path`).\n * - **Factory assets** — the bundled first-party `factory-assets` tree\n *   (`factoryAssetRoots()`), scanned from disk. Always present; no network.\n * - **Remote store** — the configured catalog source when `catalog.url` is\n *   not `local`. Failures are non-fatal — they surface as notes.\n */\n\nimport { existsSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  type AssetKind,\n  type CatalogEntry,\n  factoryAssetRoots,\n  scanRepo,\n} from \"@skaile/workspaces/core\";\nimport { getKnownKinds } from \"./open-registry.ts\";\n\n/** One non-fatal note returned to the caller for surfacing in the UI. */\nexport interface FeedNote {\n  feed: \"sources\" | \"libraries\" | \"store\" | \"factory\";\n  message: string;\n}\n\n/**\n * Which feed an asset came from. This is the top-level grouping axis in the\n * manage TUI (\"where is this skill coming from?\") and is intentionally distinct\n * from `publisher` (asset-intrinsic identity): the same publisher can legitimately\n * appear under more than one origin (e.g. a github repo you added as a `source`\n * that is also listed in the remote `store`).\n */\nexport type AssetOrigin = \"source\" | \"library\" | \"factory\" | \"store\";\n\n/** A catalog entry tagged with the feed it was gathered from. */\nexport interface OriginEntry {\n  origin: AssetOrigin;\n  entry: CatalogEntry;\n  /**\n   * Second-level grouping label for the manage tree. Defaults (when unset) to the\n   * entry's `publisher`; the source feed sets it to the source's short repo name\n   * so the Sources band groups by source — \"which repo did this come from\" — not\n   * by the asset-intrinsic publisher.\n   */\n  group?: string;\n}\n\nexport interface AssetFeedResult {\n  entries: OriginEntry[];\n  notes: FeedNote[];\n}\n\n/**\n * Pull assets from local libraries (the authoring places under\n * `~/.skaile/libraries/<name>/`, not the `~/.skaile/cache/sources/` cache). Each\n * library's `path` is scanned with `scanRepo` and grouped under the bare library\n * name (`group: <name>`) so the manage TUI shows a clean `<name>` band — no\n * `library:` prefix (mirrors the source feed). Plugin grouping (`entry.plugin`)\n * is stamped by `scanRepo`.\n */\nasync function libraryAssets(): Promise<{\n  entries: OriginEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { openLibraryManager, authoringLibraries } = await import(\"./open-library.ts\");\n    const { manager, close } = await openLibraryManager();\n    try {\n      // Authoring libraries are the rows that are NOT source clones.\n      const libs = authoringLibraries(await manager.listLibraries());\n      const entries: OriginEntry[] = [];\n      for (const lib of libs) {\n        if (!existsSync(lib.path)) continue;\n        const libEntries = [\n          ...(await scanRepo(lib.path, lib.name, { knownKinds: getKnownKinds() })),\n        ];\n        for (const entry of libEntries) entries.push({ origin: \"library\", entry, group: lib.name });\n      }\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    notes.push({\n      feed: \"libraries\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], notes };\n  }\n}\n\n/**\n * Pull a (best-effort) snapshot of the connected remote store catalog.\n *\n * - Returns no entries when the resolved catalog is local-only or the host\n *   is unreachable (the failure becomes a note, not an exception).\n * - Maps `CatalogAsset` → `CatalogEntry`, carrying `publisher`, `repo`, and\n *   `category` straight through and using `source = \"store://<id>\"`; per-file\n *   `source` paths are not available for remote assets so the canonical ref is\n *   a stable placeholder.\n */\nasync function storeAssets(projectDir: string): Promise<{\n  entries: CatalogEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { resolveCatalogSource } = await import(\"./open-library.ts\");\n    const { source, close } = await resolveCatalogSource({ projectDir });\n    try {\n      const assets = await source.listAssets();\n      const entries: CatalogEntry[] = assets.map((a) => ({\n        name: a.name,\n        kind: (a.kind as AssetKind) ?? \"skill\",\n        description: a.description ?? \"\",\n        source: `store://${a.id}`,\n        publisher: a.publisher,\n        repo: a.repo,\n        plugin: a.plugin,\n        category: a.category,\n        version: a.version,\n        requires: [],\n        dependencies: [],\n      }));\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    // Local-only catalog throws a recognizable message — silence it; absence\n    // is the user's choice, not an error.\n    if (!/local/i.test(msg)) {\n      notes.push({ feed: \"store\", message: msg });\n    }\n    return { entries: [], notes };\n  }\n}\n\n/** The slice of `AssetManager` the source feed needs (kept narrow for tests). */\ninterface AssetManagerLike {\n  search: () => Promise<CatalogEntry[]>;\n  searchRepoRoots: () => { repoName: string; root: string }[];\n}\n\n/**\n * Project-source feed: leans on `AssetManager.search()`, which merges\n * `skaile.yaml`'s `sources:` field into the repositories map. Plugin grouping\n * (`entry.plugin`) is stamped by the scanner, so entries pass through as-is.\n */\nasync function sourceAssets(am: AssetManagerLike): Promise<OriginEntry[]> {\n  // The bundled factory tree is injected into the repositories map as an implicit\n  // source, so `am.search()` returns it too. It has its own `factory` origin band,\n  // so drop it here — otherwise the same first-party skills list twice under Sources.\n  const factoryPrefixes = factoryAssetRoots().map((r) => (r.endsWith(path.sep) ? r : r + path.sep));\n  const isFactoryPath = (p: string) =>\n    factoryPrefixes.some((fp) => p === fp.slice(0, -1) || p.startsWith(fp));\n\n  const all = (await am.search()).filter((e) => !isFactoryPath(e.source));\n  const entries: OriginEntry[] = [];\n  // Group each source's entries under the source node (its short repo name), not\n  // the publisher: under Sources the navigational question is \"which repo did\n  // this come from\". Each entry's `source` (absolute manifest path) lives under\n  // exactly one declared root, so group by prefix. The cache slug is\n  // URL-keyed `github.com/<org>/<repo>` — take the trailing segment.\n  for (const { repoName, root } of am.searchRepoRoots()) {\n    if (isFactoryPath(root)) continue;\n    const prefix = root.endsWith(path.sep) ? root : root + path.sep;\n    const owned = all.filter((e) => e.source === root || e.source.startsWith(prefix));\n    if (owned.length === 0) continue;\n    const sourceName = repoName.split(\"/\").pop() || repoName;\n    for (const entry of owned) entries.push({ origin: \"source\", entry, group: sourceName });\n  }\n  return entries;\n}\n\n/**\n * Factory-asset feed: scan the bundled first-party `factory-assets` tree(s)\n * resolved by `factoryAssetRoots()` (the `SKAILE_FACTORY_ASSETS_DIR` override\n * layer ahead of the bundled tree). Local disk only, no network — the entries are\n * the built-in skills / connectors / bundles that ship with `@skaile/workspaces`.\n * `factoryAssetRoots()` already dedupes, so the env override pointing at the\n * bundled dir collapses to one root.\n */\nasync function factoryAssets(): Promise<{\n  entries: CatalogEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const entries: CatalogEntry[] = [];\n    for (const root of factoryAssetRoots()) {\n      entries.push(...(await scanRepo(root, \"skaile-factory\", { knownKinds: getKnownKinds() })));\n    }\n    return { entries, notes };\n  } catch (err) {\n    notes.push({\n      feed: \"factory\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], notes };\n  }\n}\n\n/** Tag a flat entry list with a single origin. */\nfunction tag(origin: AssetOrigin, entries: CatalogEntry[]): OriginEntry[] {\n  return entries.map((entry) => ({ origin, entry }));\n}\n\n/**\n * Run all feeds and return a single normalized result.\n *\n * Feeds run in parallel where possible — the store fetch is the slow one\n * (one HTTP call) and is fired alongside the local library walk. The factory\n * scan is local disk only, so it runs inline.\n */\nexport async function gatherAssetFeeds(\n  am: AssetManagerLike,\n  projectDir: string,\n): Promise<AssetFeedResult> {\n  const [libs, store] = await Promise.all([libraryAssets(), storeAssets(projectDir)]);\n  const factory = await factoryAssets();\n  const src = await sourceAssets(am);\n  return {\n    entries: [\n      ...src,\n      ...libs.entries,\n      ...tag(\"factory\", factory.entries),\n      ...tag(\"store\", store.entries),\n    ],\n    notes: [...libs.notes, ...store.notes, ...factory.notes],\n  };\n}\n"]}

package/dist/asset-manager/catalog-deployer.js

@@ -1,17 +1,17 @@
-export { WORKSPACE_MOUNT_ENV_VAR, deployAll, deployCatalogEntry, findAiAssetsRoot, isUnderWorkspaceMount, resolveFlowSkills, undeployCatalogEntry, workspaceMountDirs } from '../chunk-SDFROXSA.js';
-import '../chunk-TZCQ7ZWQ.js';
+export { WORKSPACE_MOUNT_ENV_VAR, deployAll, deployCatalogEntry, findAiAssetsRoot, isUnderWorkspaceMount, resolveFlowSkills, undeployCatalogEntry, workspaceMountDirs } from '../chunk-O4Z7MAW7.js';
+import '../chunk-OOLT6HGP.js';
 import '../chunk-4GY63JU6.js';
-import '../chunk-BF33SCLY.js';
-import '../chunk-46OVMT76.js';
+import '../chunk-SWO25LTO.js';
+import '../chunk-G67BOI2J.js';
 import '../chunk-5BEFNLOR.js';
 import '../chunk-A2ULN3KX.js';
-import '../chunk-2W4LBLIN.js';
-import '../chunk-MFHKHXDE.js';
+import '../chunk-LCU5U5IW.js';
+import '../chunk-L5VSIPQD.js';
 import '../chunk-CPSIPIX7.js';
-import '../chunk-7ZHLYXTI.js';
+import '../chunk-RVIZQ5XD.js';
 import '../chunk-RVRB27AN.js';
-import '../chunk-PA7WLID3.js';
-import '../chunk-AO7VJ6G6.js';
+import '../chunk-TTPSDC2G.js';
+import '../chunk-O7VPNKYN.js';
 import '../chunk-ICSCSM5D.js';
 import '../chunk-JMKB7IB4.js';
 import '../chunk-MJHSLODD.js';

package/dist/asset-manager/index.js

@@ -1,28 +1,28 @@
-export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName } from '../chunk-PTO2YDDG.js';
-import '../chunk-MX3UQXLU.js';
-import '../chunk-XOGG7VDZ.js';
-import '../chunk-BTISGSK4.js';
+export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName } from '../chunk-D5HOETOB.js';
+import '../chunk-DFFD4BFG.js';
+import '../chunk-6VRJH4MR.js';
+import '../chunk-FAP63KV7.js';
 import '../chunk-R7FOF242.js';
 import '../chunk-3TXEJN4W.js';
-export { createScaffold, deployAll, installAgent, installTargetOf, removeAsset } from '../chunk-2KOKBTR4.js';
+export { SCAFFOLD_KINDS, createScaffold, deployAll, installAgent, installTargetOf, removeAsset } from '../chunk-74EEFB52.js';
 export { BUILT_IN_FRAGMENTS, loadPromptExtensions, resolveFragments } from '../chunk-CGYEHQOX.js';
 export { appendHistory, clearHistory, getRecentHistory, loadHistory } from '../chunk-KTBKW2FI.js';
 import '../chunk-UQ6LFBPZ.js';
-export { AGENT_RENDERERS, claudeCodeRenderer, codexRenderer, driverTargetSupportsAgents, ompRenderer, renderAgentToFramework } from '../chunk-VKSXST23.js';
+export { AGENT_RENDERERS, claudeCodeRenderer, codexRenderer, driverTargetSupportsAgents, ompRenderer, renderAgentToFramework } from '../chunk-AVCUPPG6.js';
 import '../chunk-FRHE7FFB.js';
-import '../chunk-TZCQ7ZWQ.js';
+import '../chunk-OOLT6HGP.js';
 import '../chunk-4GY63JU6.js';
-import '../chunk-BF33SCLY.js';
-import '../chunk-46OVMT76.js';
+import '../chunk-SWO25LTO.js';
+import '../chunk-G67BOI2J.js';
 import '../chunk-5BEFNLOR.js';
 import '../chunk-A2ULN3KX.js';
-import '../chunk-2W4LBLIN.js';
-import '../chunk-MFHKHXDE.js';
+import '../chunk-LCU5U5IW.js';
+import '../chunk-L5VSIPQD.js';
 import '../chunk-CPSIPIX7.js';
-import '../chunk-7ZHLYXTI.js';
+import '../chunk-RVIZQ5XD.js';
 import '../chunk-RVRB27AN.js';
-import '../chunk-PA7WLID3.js';
-import '../chunk-AO7VJ6G6.js';
+import '../chunk-TTPSDC2G.js';
+import '../chunk-O7VPNKYN.js';
 import '../chunk-ICSCSM5D.js';
 import '../chunk-JMKB7IB4.js';
 import '../chunk-MJHSLODD.js';

package/dist/asset-manager/installer.js

@@ -1,20 +1,20 @@
-export { canonicalEntryRef, createScaffold, deployAll, deployAsset, installTargetOf, removeAsset } from '../chunk-2KOKBTR4.js';
+export { SCAFFOLD_KINDS, canonicalEntryRef, createScaffold, deployAll, deployAsset, installTargetOf, removeAsset } from '../chunk-74EEFB52.js';
 import '../chunk-CGYEHQOX.js';
-import '../chunk-VKSXST23.js';
+import '../chunk-AVCUPPG6.js';
 import '../chunk-FRHE7FFB.js';
-import '../chunk-TZCQ7ZWQ.js';
+import '../chunk-OOLT6HGP.js';
 import '../chunk-4GY63JU6.js';
-import '../chunk-BF33SCLY.js';
-import '../chunk-46OVMT76.js';
+import '../chunk-SWO25LTO.js';
+import '../chunk-G67BOI2J.js';
 import '../chunk-5BEFNLOR.js';
 import '../chunk-A2ULN3KX.js';
-import '../chunk-2W4LBLIN.js';
-import '../chunk-MFHKHXDE.js';
+import '../chunk-LCU5U5IW.js';
+import '../chunk-L5VSIPQD.js';
 import '../chunk-CPSIPIX7.js';
-import '../chunk-7ZHLYXTI.js';
+import '../chunk-RVIZQ5XD.js';
 import '../chunk-RVRB27AN.js';
-import '../chunk-PA7WLID3.js';
-import '../chunk-AO7VJ6G6.js';
+import '../chunk-TTPSDC2G.js';
+import '../chunk-O7VPNKYN.js';
 import '../chunk-ICSCSM5D.js';
 import '../chunk-JMKB7IB4.js';
 import '../chunk-MJHSLODD.js';

package/dist/asset-manager/renderers.js

@@ -1,18 +1,18 @@
-export { AGENT_RENDERERS, CODEX_IDENTITY_DIR, claudeCodeRenderer, codexRenderer, driverTargetSupportsAgents, ompRenderer, renderAgentToFramework } from '../chunk-VKSXST23.js';
+export { AGENT_RENDERERS, CODEX_IDENTITY_DIR, claudeCodeRenderer, codexRenderer, driverTargetSupportsAgents, ompRenderer, renderAgentToFramework } from '../chunk-AVCUPPG6.js';
 import '../chunk-FRHE7FFB.js';
-import '../chunk-TZCQ7ZWQ.js';
+import '../chunk-OOLT6HGP.js';
 import '../chunk-4GY63JU6.js';
-import '../chunk-BF33SCLY.js';
-import '../chunk-46OVMT76.js';
+import '../chunk-SWO25LTO.js';
+import '../chunk-G67BOI2J.js';
 import '../chunk-5BEFNLOR.js';
 import '../chunk-A2ULN3KX.js';
-import '../chunk-2W4LBLIN.js';
-import '../chunk-MFHKHXDE.js';
+import '../chunk-LCU5U5IW.js';
+import '../chunk-L5VSIPQD.js';
 import '../chunk-CPSIPIX7.js';
-import '../chunk-7ZHLYXTI.js';
+import '../chunk-RVIZQ5XD.js';
 import '../chunk-RVRB27AN.js';
-import '../chunk-PA7WLID3.js';
-import '../chunk-AO7VJ6G6.js';
+import '../chunk-TTPSDC2G.js';
+import '../chunk-O7VPNKYN.js';
 import '../chunk-ICSCSM5D.js';
 import '../chunk-JMKB7IB4.js';
 import '../chunk-MJHSLODD.js';

package/dist/asset-manager/src/index.d.ts

@@ -136,7 +136,7 @@ export type { HistoryEntry } from "./history.js";
 export { appendHistory, clearHistory, getRecentHistory, loadHistory, } from "./history.js";
 export type { DeployOptions, ScaffoldOptions } from "./installer.js";
 export type { DeployableEntry } from "./installer.js";
-export { createScaffold, deployAll, installTargetOf, removeAsset } from "./installer.js";
+export { createScaffold, deployAll, installTargetOf, removeAsset, SCAFFOLD_KINDS, } from "./installer.js";
 export type { RenderMcpConfigOptions, RenderMcpConfigResult, SkippedMcpServer, } from "./mcp-config.js";
 export { renderMcpServerConfig } from "./mcp-config.js";
 export type { Log } from "./renderers.js";
@@ -187,8 +187,22 @@ export interface InstallResult {
     deployed: string[];
     /** Asset refs (`kind:name`) removed because they are no longer in the resolved set. */
     removed: string[];
-    /** Asset refs that could not be resolved in any configured repository. */
+    /**
+     * Asset refs that could not be resolved in any configured repository. On the
+     * non-locked path every entry is a bare ref; the reason a miss happened lives in
+     * {@link InstallResult.missingHints}. The `--locked` path still appends its prose
+     * (`ref (not found in library "x")`) to the entry.
+     */
     missing: string[];
+    /**
+     * Why a ref in {@link InstallResult.missing} may have missed, keyed by that ref:
+     * the asset's publisher changed (`library set publisher=`), so the lock still holds
+     * it under the old one and/or a library now holds it under another. Parenthesised
+     * parts such as `did you mean skill:@acme/x?` and
+     * `locked as skill:@plain/x; run skaile install to re-resolve`. Only refs with a
+     * hint appear; absent when none has.
+     */
+    missingHints?: Record<string, string>;
     /** Whether `skaile.lock.yaml` was written or updated. */
     lockWritten: boolean;
     /**
@@ -247,6 +261,12 @@ export interface OutdatedEntry {
      * has no `latestVersion`.
      */
     problem?: string;
+    /**
+     * Library-origin asset only: the library's files on disk differ from the content
+     * hash recorded in the lock at the same version (edited in place, no version bump).
+     * `skaile update` re-deploys them.
+     */
+    contentChanged?: boolean;
 }
 /**
  * Outcome of `AssetManager.diff()` — distinguishes an unknown ref from a real
@@ -296,6 +316,11 @@ export interface DepIssue {
     depName: string;
     /** `true` when the missing dependency exists in a configured repository but has not been installed. */
     inRepos: boolean;
+    /**
+     * `true` when the asset itself is lock-managed but no source or library holds it
+     * any more, so its `requires` cannot be checked. `depKind`/`depName` repeat the asset.
+     */
+    unresolved?: boolean;
 }
 /**
  * A single deployed asset shown in the workspace overview.
@@ -456,6 +481,8 @@ export declare class AssetManager {
     private readonly indexPathOverride?;
     /** Sink for cross-library collision warnings; else `console.warn`. */
     private readonly onLibraryCollision?;
+    /** Store URLs whose failed version lookup was already reported (one warning per URL). */
+    private readonly warnedStoreVersionLookups;
     constructor(opts: AssetManagerOptions);
     /** Registered kind names — the `knownKinds` argument of the manifest scanners. */
     private get knownKinds();
@@ -536,10 +563,26 @@ export declare class AssetManager {
      * content. The returned `libraryOf` map names the library each entry came from
      * so callers can lock it as library-origin (see {@link libraryLockEntries}).
      *
+     * @param opts.quiet - Skip the cross-library collision warning (a lookup that only
+     *   builds an error hint must not warn).
      * @returns the matched deploy entries, the set of `missing` refs covered, and
      *   each entry's originating library name.
      */
     private resolveLibraryEntries;
+    /**
+     * Explain misses caused by a publisher change, for every missed publisher-qualified
+     * ref at once (one library scan, one lock read). Per ref:
+     * - `did you mean <ref>?` when a registered library holds the same kind + name
+     *   under another publisher;
+     * - `locked as <lockRef>; run skaile install to re-resolve` when the lock holds the
+     *   same kind + name under another publisher, records the library it came from, and
+     *   that library now holds the asset under yet another publisher than the locked
+     *   one. An unrelated asset that merely shares kind + name does not qualify.
+     *
+     * @param refs - Missed refs; a trailing `(reason)` after the first space is ignored.
+     * @returns hint text per ref, only for refs that have one. Never warns.
+     */
+    private publisherChangeHints;
     /** Collision messages already printed by this instance (one warning per ref + library set). */
     private readonly warnedLibraryCollisions;
     /**
@@ -555,10 +598,12 @@ export declare class AssetManager {
     private loadLibraryIndex;
     /**
      * Library-origin lock entries for the assets {@link resolveLibraryEntries}
-     * matched. The locked version comes from the library index when it knows the
-     * asset (its manifest-declared version is authoritative), else from the
-     * on-disk asset. The hash is computed from the files on disk, so it matches
-     * what `install --locked` re-hashes.
+     * matched. The locked version is the one actually deployed: the on-disk
+     * entry's version, falling back to the library index only when the disk entry
+     * carries none — the index lags until the next `skaile library index`, so
+     * preferring it would lock a stale version after an in-place bump. The hash is
+     * computed from the files on disk, so it matches what `install --locked`
+     * re-hashes.
      */
     private libraryLockEntries;
     /**
@@ -584,6 +629,26 @@ export declare class AssetManager {
      * (offline, store down) keeps the first pass's result rather than regressing.
      */
     private resolveWithStores;
+    /**
+     * Resolve `deps` library-first, then walk the dependencies of every library
+     * asset it picks.
+     *
+     * A publisher-qualified ref that no project source declares is looked up in the
+     * registered **libraries** before any store is asked, so a locally authored
+     * asset resolves (and deploys) with the store unreachable and without a
+     * version-discovery round trip. Only refs the libraries did not satisfy go to
+     * {@link resolveWithStores}; its misses get one more library try (a ref a source
+     * knows only under another version). A `#version` pin still selects through
+     * `matchPin` inside {@link resolveLibraryEntries}.
+     *
+     * Library assets declare `dependencies` / `requires`. Those are fed back through
+     * the same resolution with a `seen` identity set (mirrors `resolveAll`), so deps
+     * deploy, get lock entries, and a dependency cycle terminates.
+     *
+     * @returns source/store candidates, still-unresolved refs, applied overrides,
+     *   expanded presets, and the library leg (entries + originating library per entry).
+     */
+    private resolveLibraryFirst;
     /** The catalog fetcher to use: an injected one, else built from `stores`. */
     private storeFetcherFor;
     /**
@@ -816,7 +881,11 @@ export declare class AssetManager {
      */
     private presentRefs;
     /**
-     * Remove a deployed asset and unregister it from `skaile.yaml`.
+     * Remove a deployed asset and unregister it from `skaile.yaml` and the lock.
+     *
+     * A declared asset is always unregistered, even when nothing is deployed any
+     * more (e.g. its library file was deleted): the declaration and lock entry
+     * would otherwise be stuck behind a "not deployed" refusal.
      *
      * Deliberately does NOT re-render the driver target's MCP config: the render
      * step is async (the declaration resolver is), and making this synchronous
@@ -825,15 +894,18 @@ export declare class AssetManager {
      * {@link renderMcpServerConfig}.
      *
      * @param ref - Asset ref in `kind:name` form (e.g. `skill:my-skill`).
-     * @returns `true` if the asset was found and removed, `false` if it was not deployed.
-     *   A `preset:` ref has no deployed files: it is found when declared in `skaile.yaml`, and
-     *   only its declaration goes — its expanded items leave with the next `skaile install`.
+     * @returns `true` if anything changed (files undeployed, declaration or lock
+     *   entry removed), `false` if the asset was neither deployed nor declared.
+     *   A `preset:` ref has no deployed files: only its declaration goes — its
+     *   expanded items leave with the next `skaile install`.
      */
     remove(ref: string): boolean;
     /**
      * Drop every lock entry matching a removed asset's identity, version-agnostic so
      * a content-sha pseudo-version key is pruned too. Symmetric with {@link add}'s
      * lock-merge — stops a stale entry reporting a phantom "removed" on next install.
+     *
+     * @returns `true` when at least one lock entry was dropped.
      */
     private pruneLockEntry;
     /**
@@ -971,10 +1043,13 @@ export declare class AssetManager {
      *
      * Two kinds of staleness are reported:
      * - **Source assets** — only remote repositories (not local paths) are checked;
-     *   `behind` is the number of commits the local clone is missing.
-     * - **Library assets** — a library-origin lock entry whose library index now
-     *   offers a newer version than the locked one; `behind` is 0, `latestVersion`
-     *   and `library` are set. A library not indexed (or removed) is not reported.
+     *   `behind` counts the commits the clone is missing from the remote plus the
+     *   commits the clone moved past the locked commit (`source sync` after `add`).
+     * - **Library assets** — a library-origin lock entry whose library files on disk
+     *   (not the index, which lags until `skaile library index`) hold a newer version
+     *   than the locked one (`latestVersion`, `library` set), or the same version with
+     *   different bytes (`contentChanged`). `behind` is 0. An unregistered library is a
+     *   `problem` row.
      *
      * @returns Array of {@link OutdatedEntry} objects.
      */
@@ -1046,7 +1121,13 @@ export declare class AssetManager {
      *
      * For each deployed asset, checks that all entries in its `requires` list are
      * also deployed. Returns a list of issues with a flag indicating whether the
-     * missing dependency can be resolved from a configured repository.
+     * missing dependency can be resolved from a configured repository or library.
+     *
+     * A deployed asset is looked up by its publisher-qualified identity taken from
+     * the lock key (`kind:@pub/name`), so library and source assets resolve alike.
+     * A lock-managed asset that no source or library can be found for is reported
+     * as an issue with `unresolved: true` (its `requires` cannot be verified);
+     * unmanaged deployed files carry no declared origin and are skipped.
      *
      * @returns Array of {@link DepIssue} objects. An empty array means the workspace is healthy.
      */
@@ -1059,7 +1140,7 @@ export declare class AssetManager {
      * @param destDir - Parent directory to create the asset in.
      * @param opts - Optional scaffold content (`description`).
      * @returns `{ ok: true, path }` on success, `{ ok: false, path: errorMessage }` if the
-     *   directory already exists.
+     *   directory already exists or `kind` has no scaffold template.
      */
     create(name: string, kind: string, destDir: string, opts?: ScaffoldOptions): {
         ok: boolean;
@@ -1117,9 +1198,18 @@ export declare class AssetManager {
      * parent dir) when absent so `skaile add --global` works on a fresh machine.
      */
     private addDependencyToConfig;
+    /**
+     * Whether the declared `dep` names the same asset (kind, publisher, name) as
+     * `ref`, ignoring the version pin. A publisher must agree on both sides —
+     * unlike {@link removeDependencyFromConfig}, a bare `kind:name` never replaces a
+     * publisher-qualified line. Unparseable entries only match on string equality.
+     */
+    private sameDeclaredAsset;
     /**
      * Remove a dependency ref from the manifest `dependencies:`. Targets the same
      * file as {@link addDependencyToConfig} (`~/.skaile/skaile.yaml` in global mode).
+     *
+     * @returns `true` when a declaration was removed.
      */
     private removeDependencyFromConfig;
     private resolveRepoDir;