pixelkiln 0.70.0 → 0.71.0

package/dist/cli.js

@@ -67,7 +67,7 @@ function exitCodeFor(err) {
 }
 
 // src/cli/main.ts
-import { existsSync as existsSync35 } from "fs";
+import { existsSync as existsSync36 } from "fs";
 import { readFile as readFile32 } from "fs/promises";
 
 // src/cli/args.ts
@@ -108,7 +108,8 @@ var VALUE_FLAGS = [
   "--description",
   "--weight",
   "--glyph-px",
-  "--frames"
+  "--frames",
+  "--estimate-limit"
 ];
 var BOOL_FLAGS = [
   "--force",
@@ -430,7 +431,8 @@ function parseArgs(argv) {
     description: get("--description"),
     weight: get("--weight"),
     glyphPx: numberOption("--glyph-px", { min: 8, max: 64, integer: true }),
-    frames: numberOption("--frames", { min: 3, max: 15, integer: true })
+    frames: numberOption("--frames", { min: 3, max: 15, integer: true }),
+    estimateLimit: numberOption("--estimate-limit", { min: 0, max: 1e3, integer: true })
   };
 }
 
@@ -543,6 +545,7 @@ Options
   --no-open           Do not auto-open the browser (pick, salvage, gallery) or editor (edit)
   --edit              gallery: allow manifest edits from the page (never spends)
   --no-editor         gallery: do not offer or serve the in-browser editor
+  --estimate-limit <n> gallery: PixelLab skeleton estimates the page may make (default 10)
   --tag               Also push tags upstream after fetch
   --refresh           fetch: re-download and replace files whose object changed
                       upstream (e.g. edited in PixelLab's editor); no generation
@@ -14373,7 +14376,7 @@ async function runEdit(args) {
 
 // src/cli/commands/gallery.ts
 import path33 from "path";
-import { existsSync as existsSync24 } from "fs";
+import { existsSync as existsSync25 } from "fs";
 
 // src/gallery/snapshot.ts
 import { createHash as createHash3 } from "crypto";
@@ -14416,6 +14419,16 @@ var SkeletonAnimationRequestSchema = z8.object({
   /** Replace an existing `keypointsFile` with `set`. */
   overwrite: z8.boolean().optional()
 }).strict();
+var SkeletonKeypointsUpdateSchema = z8.object({
+  action: z8.literal("update-skeleton-keypoints"),
+  project: z8.string().min(1).optional(),
+  styleId: z8.string().min(1),
+  assetId: z8.string().min(1),
+  /** The file's SHA-256 when the page loaded it; anything else on disk is a concurrent edit. */
+  expectedSha256: z8.string().regex(/^[0-9a-f]{64}$/),
+  set: SkeletonSetSchema
+}).strict();
+var DEFAULT_ESTIMATE_LIMIT = 10;
 function skeletonSourceFile(spec) {
   if (spec.source) return path26.resolve(spec.root, spec.source);
   if (spec.quality && existsSync18(spec.quality.outFile)) return spec.quality.outFile;
@@ -14424,7 +14437,12 @@ function skeletonSourceFile(spec) {
 function createGallerySkeletonHandlers(opts) {
   const log2 = opts.onProgress ?? (() => {
   });
+  const limit = opts.limit ?? DEFAULT_ESTIMATE_LIMIT;
+  let used = 0;
+  const spent = {};
+  const status = () => ({ used, limit, spent: { ...spent } });
   return {
+    status,
     async estimate(body) {
       const parsed = SkeletonEstimateRequestSchema.safeParse(body);
       if (!parsed.success) throw new ManifestEditError(`invalid estimate request: ${parsed.error.issues[0]?.message}`);
@@ -14440,16 +14458,33 @@ function createGallerySkeletonHandlers(opts) {
       if (!metadata) throw new ManifestEditError(`${path26.basename(file)} is not a readable PNG or JPEG`);
       const problem = estimateSkeletonSizeProblem(metadata.width, metadata.height);
       if (problem) throw new ManifestEditError(`${key} is ${problem}`);
+      if (used >= limit) {
+        throw Object.assign(
+          new Error(`this gallery has made its ${limit} skeleton estimate${limit === 1 ? "" : "s"}; restart it with --estimate-limit to allow more`),
+          { status: 429 }
+        );
+      }
       const client2 = (opts.client ?? clientFromEnv)();
+      used++;
       const res = await client2.estimateSkeleton({ image: { base64: bytes.toString("base64"), format: metadata.format } });
-      log2(`  estimated a skeleton for ${key} (PixelLab estimate-skeleton, not budgeted)`);
+      const billed = billedAmount(res.usage);
+      if (billed) spent[billed.unit] = (spent[billed.unit] ?? 0) + billed.amount;
+      log2(`  estimated a skeleton for ${key} (PixelLab estimate-skeleton, ${used}/${limit} this session${billed ? `, billed ${billed.amount} ${billed.unit}` : ""})`);
       return {
         set: scaffoldSkeletonSet(res.keypoints, request.frames ?? DEFAULT_SCAFFOLD_FRAMES),
-        source: path26.relative(ctx.loaded.root, file).split(path26.sep).join("/")
+        source: path26.relative(ctx.loaded.root, file).split(path26.sep).join("/"),
+        session: status()
       };
     }
   };
 }
+function billedAmount(usage) {
+  if (!usage || typeof usage !== "object") return null;
+  const { type } = usage;
+  if (type !== "usd" && type !== "generations") return null;
+  const amount = usage[type];
+  return typeof amount === "number" && Number.isFinite(amount) ? { unit: type, amount } : null;
+}
 async function createSkeletonAnimation(manifestPath, request) {
   const root = path26.dirname(path26.resolve(manifestPath));
   const file = path26.resolve(root, request.keypointsFile);
@@ -14495,6 +14530,26 @@ async function createSkeletonAnimation(manifestPath, request) {
     throw error;
   }
 }
+async function updateSkeletonKeypoints(ctx, request) {
+  const key = lockKey(request.styleId, request.assetId);
+  const spec = ctx.specs.find((candidate) => lockKey(candidate.styleId, candidate.assetId) === key);
+  if (!spec) throw new ManifestEditError(`"${key}" is not declared by the manifest`);
+  const file = spec.revision?.mode === "animate-skeleton" ? spec.revision.keypointsFile : void 0;
+  if (!file) throw new ManifestEditError(`${key} is not an animate-skeleton revision`);
+  const relative = path26.relative(ctx.loaded.root, file);
+  if (relative.startsWith("..") || path26.isAbsolute(relative)) {
+    throw new ManifestEditError(`${key}'s keypoints file is outside the project; edit it by hand`);
+  }
+  const current = existsSync18(file) ? sha256(await readFile17(file)) : null;
+  if (current !== request.expectedSha256) {
+    throw Object.assign(
+      new Error(`${relative.split(path26.sep).join("/")} changed on disk since this page loaded it; press Refresh and edit again`),
+      { status: 409 }
+    );
+  }
+  await writeFile12(file, JSON.stringify(request.set, null, 2) + "\n");
+  return relative.split(path26.sep).join("/");
+}
 
 // src/gallery/edit.ts
 var Base64 = z9.string().regex(/^[A-Za-z0-9+/]*={0,2}$/).max(Math.ceil(MAX_HAND_EDIT_BYTES / 3) * 4);
@@ -14571,6 +14626,18 @@ function createGalleryEditHandler(opts) {
       }
       return opts.reload();
     }
+    const poses = SkeletonKeypointsUpdateSchema.safeParse(body);
+    if (poses.success) {
+      if (!opts.loadProject) throw new ManifestEditError("pose edits are not available in this gallery");
+      const written = await updateSkeletonKeypoints(await opts.loadProject(poses.data.project), poses.data);
+      log2(`  poses saved: ${written} (${poses.data.styleId}/${poses.data.assetId} is stale until generated again)`);
+      return opts.reload();
+    }
+    if (body?.action === "update-skeleton-keypoints") {
+      throw new ManifestEditError(
+        "invalid pose edit: " + poses.error.issues.slice(0, 3).map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")
+      );
+    }
     const skeleton = SkeletonAnimationRequestSchema.safeParse(body);
     if (skeleton.success) {
       let manifestPath2;
@@ -15086,7 +15153,8 @@ async function buildGallerySnapshot(opts) {
       mirrorOfKey: spec.mirror ? lockKey(spec.styleId, spec.mirror.sourceAssetId) : entry?.mirror ? lockKey(spec.styleId, entry.mirror.sourceAssetId) : null,
       skeleton: spec.revision?.mode === "animate-skeleton" && spec.revision.keypointsFile ? {
         keypointsFile: portableOutputPath(spec.revision.keypointsFile, root),
-        set: spec.revision.skeleton ?? null
+        set: spec.revision.skeleton ?? null,
+        sha256: spec.revision.keypointsSha256 ?? null
       } : null,
       character: describeCharacter(spec, entry),
       outputs,
@@ -15378,13 +15446,48 @@ import { createServer as createServer2 } from "http";
 import { readFile as readFile19 } from "fs/promises";
 
 // src/gallery/page.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync4 } from "fs";
+
+// src/gallery/client-bundle.ts
+import { createRequire } from "module";
+import { fileURLToPath } from "url";
+function bundleGalleryClient(entry = fileURLToPath(new URL("./client/src/main.ts", import.meta.url))) {
+  const esbuild = createRequire(import.meta.url)("esbuild");
+  const result = esbuild.buildSync({
+    entryPoints: [entry],
+    bundle: true,
+    format: "iife",
+    target: "es2020",
+    platform: "browser",
+    write: false,
+    legalComments: "none",
+    charset: "utf8"
+  });
+  return result.outputFiles[0].text;
+}
+
+// src/gallery/page.ts
+function galleryContentSecurityPolicy(nonce) {
+  return [
+    "default-src 'self'",
+    `script-src 'nonce-${nonce}'`,
+    `style-src 'nonce-${nonce}'`,
+    "img-src 'self' data: blob:",
+    "frame-src 'self'",
+    "connect-src 'self'",
+    "object-src 'none'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "frame-ancestors 'none'"
+  ].join("; ");
+}
 var CLIENT_DIR = new URL("./client/", import.meta.url);
 var client;
 function clientAssets() {
+  const prebuilt = new URL("gallery.js", CLIENT_DIR);
   client ??= {
     css: readFileSync4(new URL("gallery.css", CLIENT_DIR), "utf8"),
-    js: readFileSync4(new URL("gallery.js", CLIENT_DIR), "utf8")
+    js: existsSync21(prebuilt) ? readFileSync4(prebuilt, "utf8") : bundleGalleryClient()
   };
   return client;
 }
@@ -15396,6 +15499,7 @@ function renderGallery(snapshot, opts = {}) {
   const editor = JSON.stringify(Boolean(opts.editor && opts.session));
   const title = `${snapshot.project?.name ?? "workspace"} | pixelkiln`;
   const { css, js } = clientAssets();
+  const nonce = opts.nonce ? ` nonce="${escapeHtml2(opts.nonce)}"` : "";
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -15403,7 +15507,7 @@ function renderGallery(snapshot, opts = {}) {
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>${escapeHtml2(title)}</title>
 <link rel="icon" href="data:,">
-<style>
+<style${nonce}>
 ${css}</style>
 </head>
 <body>
@@ -15445,7 +15549,7 @@ ${css}</style>
 <div id="drawer-host"></div>
 <div id="dialog-host"></div>
 <datalist id="view-options"><option value="low top-down"><option value="high top-down"><option value="side"><option value="sidescroller"></datalist>
-<script>
+<script${nonce}>
 const INITIAL = ${data};
 const SESSION = ${session};
 const EDITABLE = ${editable};
@@ -15641,6 +15745,10 @@ async function serveGallery(opts) {
       }
     }
     if (req.method !== "GET" && req.method !== "HEAD") return fail(405, "the gallery is read-only");
+    if (url2.pathname === "/api/skeleton") {
+      if (!opts.skeleton) return fail(404, "skeleton estimates need the gallery started with --edit");
+      return json(200, opts.skeleton.status());
+    }
     if (url2.pathname === "/api/jobs") {
       if (!opts.generate) return fail(404, "generation is off");
       return json(200, opts.generate.status());
@@ -15674,12 +15782,15 @@ async function serveGallery(opts) {
     try {
       if (url2.pathname === "/") {
         const { snapshot } = await load();
+        const nonce = randomBytes(16).toString("base64");
         res.writeHead(200, {
           "Content-Type": "text/html; charset=utf-8",
           "Cache-Control": "no-store",
-          "X-Content-Type-Options": "nosniff"
+          "X-Content-Type-Options": "nosniff",
+          "Content-Security-Policy": galleryContentSecurityPolicy(nonce)
         });
         res.end(renderGallery(snapshot, {
+          nonce,
           ...session ? { session } : {},
           editable: Boolean(opts.edit),
           generation: Boolean(opts.generate),
@@ -16158,12 +16269,12 @@ function ownedReferenceImageId(spec, lock, providerId) {
 }
 
 // src/pick/server.ts
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 import { readFile as readFile21 } from "fs/promises";
 
 // src/pipeline/init.ts
 import { readdir, readFile as readFile20, writeFile as writeFile13 } from "fs/promises";
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 import path30 from "path";
 function pngSize(buf) {
   if (buf.length < 24) return null;
@@ -16257,7 +16368,7 @@ function mode(values) {
   return [...counts.entries()].sort((a, b) => b[1] - a[1])[0]?.[0] ?? 64;
 }
 async function writeManifestFile(target, manifest) {
-  if (existsSync21(target)) {
+  if (existsSync22(target)) {
     throw new Error(`${target} already exists; refusing to overwrite an existing manifest.`);
   }
   await writeFile13(target, JSON.stringify(manifest, null, 2) + "\n");
@@ -16673,7 +16784,7 @@ async function currentArt(entry, spec) {
   const previous = primaryOutput({ ...entry, outputs: entry.supersededOutputs });
   if (!previous) return null;
   const file = resolveOutputPath(previous.path, spec.root);
-  if (!existsSync22(file)) return null;
+  if (!existsSync23(file)) return null;
   const contentType = previous.mediaType ?? mediaTypeFromExtension(file);
   if (!contentType) return null;
   let width = entry.width;
@@ -17181,7 +17292,7 @@ import path32 from "path";
 
 // src/editor/install.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync23 } from "fs";
+import { existsSync as existsSync24 } from "fs";
 import { mkdir as mkdir11, readFile as readFile22, rename as rename9, rm as rm10, stat as stat3, writeFile as writeFile14 } from "fs/promises";
 import os2 from "os";
 import path31 from "path";
@@ -17280,7 +17391,7 @@ async function editorStatus(opts = {}) {
   for (const [name, expected] of Object.entries(pin.files)) {
     totalBytes += expected.bytes;
     const file = path31.join(dir, name);
-    const info = existsSync23(file) ? await stat3(file).catch(() => null) : null;
+    const info = existsSync24(file) ? await stat3(file).catch(() => null) : null;
     if (info && info.size === expected.bytes && await sha256Of(file) === expected.sha256) {
       installedBytes += expected.bytes;
     } else {
@@ -17534,7 +17645,7 @@ async function serveUntilStopped(initial, reload, args, access2) {
     ...args.edit ? { edit: createGalleryEditHandler({ manifestFor: access2.manifestFor, loadProject: access2.loadProject, reload, onProgress: log }) } : {},
     ...budget ? { generate: createGenerateHandlers({ loadProject, providerFor, budget, reload, onProgress: log }) } : {},
     // Estimating acts on the author's behalf and feeds a manifest edit, so it follows the write gate.
-    ...args.edit ? { skeleton: createGallerySkeletonHandlers({ loadProject, onProgress: log }) } : {},
+    ...args.edit ? { skeleton: createGallerySkeletonHandlers({ loadProject, limit: args.estimateLimit, onProgress: log }) } : {},
     // The editor exists to write hand edits back, so it follows the write gate.
     ...args.edit && !args.noEditor ? { editor: createGalleryEditorHandlers({ onProgress: log }) } : {}
   });
@@ -17553,7 +17664,7 @@ async function serveUntilStopped(initial, reload, args, access2) {
 async function runGallery(args) {
   if (args.workspace) {
     const workspacePath = path33.resolve(args.workspace);
-    if (!existsSync24(workspacePath)) {
+    if (!existsSync25(workspacePath)) {
       throw new Error(`Workspace catalog not found: ${workspacePath}`);
     }
     const filter2 = { styles: args.styles, assets: args.assets };
@@ -17907,14 +18018,14 @@ async function runRestoreGeneration(args) {
 }
 
 // src/cli/commands/housekeeping.ts
-import { existsSync as existsSync26 } from "fs";
+import { existsSync as existsSync27 } from "fs";
 
 // src/pipeline/cache-health.ts
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync26 } from "fs";
 import { readFile as readFile24, readdir as readdir2, rm as rm11 } from "fs/promises";
 import path34 from "path";
 async function inspectCaches(lock, lockPath, options = {}) {
-  if (options.prune && !existsSync25(lockPath)) {
+  if (options.prune && !existsSync26(lockPath)) {
     throw new Error(`Refusing to prune without an existing lockfile at ${path34.resolve(lockPath)}`);
   }
   const contentDir = path34.resolve(path34.dirname(lockPath), ".pixelkiln", "cache");
@@ -17957,7 +18068,7 @@ async function inspectCaches(lock, lockPath, options = {}) {
 async function inspectContentCache(contentDir, referenced) {
   const report = {
     path: contentDir,
-    exists: existsSync25(contentDir),
+    exists: existsSync26(contentDir),
     files: 0,
     bytes: 0,
     valid: 0,
@@ -18021,7 +18132,7 @@ async function inspectContentCache(contentDir, referenced) {
 async function inspectRemoteHashCache(remotePath) {
   const report = {
     path: remotePath,
-    exists: existsSync25(remotePath),
+    exists: existsSync26(remotePath),
     entries: 0,
     valid: 0,
     invalidIds: [],
@@ -18094,7 +18205,7 @@ async function runAccept(args) {
     let intact = true;
     for (const output of entry.outputs) {
       const file = resolveOutputPath(output.path, item.spec.root);
-      if (!existsSync26(file) || await sha256File(file) !== output.sha256) {
+      if (!existsSync27(file) || await sha256File(file) !== output.sha256) {
         intact = false;
         break;
       }
@@ -18150,11 +18261,11 @@ This drops their provenance from the lockfile. The art on disk is`);
 
 // src/cli/commands/init.ts
 import path35 from "path";
-import { existsSync as existsSync27 } from "fs";
+import { existsSync as existsSync28 } from "fs";
 async function runInit(args) {
   if (!args.from) throw new Error("init needs --from <dir> pointing at your existing PNGs.");
   const root = path35.resolve(args.from);
-  if (!existsSync27(root)) throw new Error(`No directory at ${root}`);
+  if (!existsSync28(root)) throw new Error(`No directory at ${root}`);
   const generator = args.generator ?? "map";
   if (generator !== "1dir" && generator !== "map") {
     throw new Error(`--generator must be "1dir" or "map", got "${args.generator}".`);
@@ -18182,7 +18293,7 @@ async function runInit(args) {
 }
 
 // src/pipeline/doctor.ts
-import { constants, existsSync as existsSync28 } from "fs";
+import { constants, existsSync as existsSync29 } from "fs";
 import { access, stat as stat4 } from "fs/promises";
 import path36 from "path";
 async function doctor(loaded, specs, lock, lockPath, opts = {}) {
@@ -18254,7 +18365,7 @@ async function doctor(loaded, specs, lock, lockPath, opts = {}) {
         cacheDir,
         cacheFileName(output.sha256, output.mediaType ?? MediaType.PNG)
       );
-      if (existsSync28(cached) && await sha256File(cached) === output.sha256) {
+      if (existsSync29(cached) && await sha256File(cached) === output.sha256) {
         hasCache = true;
         break;
       }
@@ -18358,7 +18469,7 @@ async function nearestExistingDirectory(start) {
 
 // src/pipeline/audit.ts
 import { readFile as readFile25 } from "fs/promises";
-import { existsSync as existsSync29 } from "fs";
+import { existsSync as existsSync30 } from "fs";
 import path37 from "path";
 function paletteDistance(asset, reference) {
   if (!asset.length || !reference.length) return 0;
@@ -18395,7 +18506,7 @@ async function auditStyle(loaded, specs, styleId, lock) {
   const unreadable = [];
   for (const spec of mine) {
     for (const output of resolveSpecOutputs(spec, lock, loaded.root)) {
-      if (!existsSync29(output.absolutePath)) {
+      if (!existsSync30(output.absolutePath)) {
         missing.push(output.id);
         continue;
       }
@@ -18425,7 +18536,7 @@ async function auditStyle(loaded, specs, styleId, lock) {
   const refPalettes = [];
   for (const img of style.styleImages) {
     const abs = path37.resolve(loaded.root, img.path);
-    if (!existsSync29(abs)) continue;
+    if (!existsSync30(abs)) continue;
     try {
       refPalettes.push(extractPalette(decodePng(await readFile25(abs)), 12));
     } catch {
@@ -19597,7 +19708,7 @@ function sheetFormat(args) {
 import path41 from "path";
 
 // src/pixellab-utils.ts
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync31 } from "fs";
 import { mkdir as mkdir12, readFile as readFile27, writeFile as writeFile15 } from "fs/promises";
 import path40 from "path";
 var UNZOOM_MIN_SIDE = 256;
@@ -19609,7 +19720,7 @@ function defaultUnzoomOut(input) {
 async function unzoomFile(client2, input, opts = {}) {
   const out = path40.resolve(opts.out ?? defaultUnzoomOut(input));
   if (path40.resolve(input) === out) throw new Error("unzoom will not overwrite its own input; pass a different --out");
-  if (existsSync30(out) && !opts.force) throw new Error(`${out} already exists; pass --force to replace it`);
+  if (existsSync31(out) && !opts.force) throw new Error(`${out} already exists; pass --force to replace it`);
   const bytes = await readFile27(input);
   const metadata = imageMetadata(bytes);
   if (!metadata) throw new Error(`${input} is not a readable PNG or JPEG`);
@@ -19638,7 +19749,7 @@ async function generateFont(client2, opts) {
   const { ttf, atlas } = fontOutputPaths(opts.out);
   if (!opts.force) {
     for (const file of [ttf, atlas]) {
-      if (existsSync30(file)) throw new Error(`${file} already exists; pass --force to replace it`);
+      if (existsSync31(file)) throw new Error(`${file} already exists; pass --force to replace it`);
     }
   }
   const sleep3 = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -19752,7 +19863,7 @@ import { readFile as readFile29 } from "fs/promises";
 
 // src/pipeline/quality-regression.ts
 import path42 from "path";
-import { existsSync as existsSync31 } from "fs";
+import { existsSync as existsSync32 } from "fs";
 import { readFile as readFile28 } from "fs/promises";
 import { z as z11 } from "zod";
 var SHA256_RE = /^[0-9a-f]{64}$/;
@@ -19995,7 +20106,7 @@ async function snapshotQualityBaseline(inputs, baselinePath, options = {}) {
     cases
   });
   const data = Buffer.from(JSON.stringify(baseline, null, 2) + "\n");
-  if (existsSync31(absolute) && !options.force) {
+  if (existsSync32(absolute) && !options.force) {
     const current = await readFile28(absolute);
     if (!current.equals(data)) {
       throw new OverwriteRefusedError(
@@ -20192,9 +20303,9 @@ import path45 from "path";
 
 // src/recipes.ts
 import path44 from "path";
-import { existsSync as existsSync32 } from "fs";
+import { existsSync as existsSync33 } from "fs";
 import { readdir as readdir3, readFile as readFile30 } from "fs/promises";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { z as z12 } from "zod";
 var SHA256_RE2 = /^[0-9a-f]{64}$/;
 var RECIPE_ID_RE = /^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/;
@@ -20395,7 +20506,7 @@ async function readRecipeFile(recipePath, bundled) {
   return { recipe: parsed.data, authored: raw, path: absolute, dir: path44.dirname(absolute), bundled };
 }
 async function walkRecipeFiles(root) {
-  if (!existsSync32(root)) return [];
+  if (!existsSync33(root)) return [];
   const out = [];
   for (const entry of await readdir3(root, { withFileTypes: true })) {
     const resolved = path44.join(root, entry.name);
@@ -20405,7 +20516,7 @@ async function walkRecipeFiles(root) {
   return out;
 }
 function bundledRecipeRoot() {
-  return fileURLToPath(new URL("../recipes/", import.meta.url));
+  return fileURLToPath2(new URL("../recipes/", import.meta.url));
 }
 async function listBundledRecipes(root = bundledRecipeRoot()) {
   const recipes = await Promise.all(
@@ -20433,7 +20544,7 @@ function parseSelector(selector) {
 }
 async function resolveRecipe(target, bundledRoot = bundledRecipeRoot()) {
   const local = path44.resolve(target);
-  if (existsSync32(local)) {
+  if (existsSync33(local)) {
     const recipePath = path44.basename(local) === RECIPE_FILE ? local : path44.join(local, RECIPE_FILE);
     return readRecipeFile(recipePath, false);
   }
@@ -20449,7 +20560,7 @@ async function resolveRecipe(target, bundledRoot = bundledRecipeRoot()) {
 }
 async function verifyFile(root, file) {
   const absolute = path44.resolve(root, ...file.path.split("/"));
-  if (!existsSync32(absolute)) {
+  if (!existsSync33(absolute)) {
     return { path: file.path, expectedSha256: file.sha256, actualSha256: null, status: "missing" };
   }
   const actualSha256 = await sha256File(absolute);
@@ -20527,7 +20638,7 @@ async function installRecipe(target, options = {}) {
   })));
   if (!options.force) {
     for (const file of files) {
-      if (!existsSync32(file.path)) continue;
+      if (!existsSync33(file.path)) continue;
       const current = await readFile30(file.path);
       if (!current.equals(file.data)) {
         throw new OverwriteRefusedError(
@@ -20767,7 +20878,7 @@ async function runRefine(args) {
 
 // src/cli/commands/skeleton.ts
 import path47 from "path";
-import { existsSync as existsSync33 } from "fs";
+import { existsSync as existsSync34 } from "fs";
 import { readFile as readFile31, writeFile as writeFile16 } from "fs/promises";
 
 // src/skeleton-preview.ts
@@ -20879,7 +20990,7 @@ var Canvas = class {
 async function runEstimateSkeleton(args) {
   const image = args.target;
   if (!image) throw new UsageError("estimate-skeleton needs an image path: pixelkiln estimate-skeleton <image> [--out keypoints.json]");
-  if (args.out && existsSync33(path47.resolve(args.out)) && !args.force) {
+  if (args.out && existsSync34(path47.resolve(args.out)) && !args.force) {
     throw new UsageError(`${args.out} already exists; pass --force to replace it`);
   }
   loadEnvFiles(path47.dirname(path47.resolve(args.manifest)));
@@ -20925,7 +21036,7 @@ async function runSkeletonPreview(args) {
     sourceFile = args.from ? path47.resolve(args.from) : spec.revision.sourceFile;
     label = `${spec.styleId}/${spec.assetId}`;
   }
-  if (!existsSync33(keypointsFile)) throw new UsageError(`Keypoints file does not exist yet: ${keypointsFile}`);
+  if (!existsSync34(keypointsFile)) throw new UsageError(`Keypoints file does not exist yet: ${keypointsFile}`);
   let json;
   try {
     json = JSON.parse(await readFile31(keypointsFile, "utf8"));
@@ -20935,7 +21046,7 @@ async function runSkeletonPreview(args) {
   const set = parseSkeletonSet(json, keypointsFile);
   let source;
   if (sourceFile) {
-    if (!existsSync33(sourceFile)) {
+    if (!existsSync34(sourceFile)) {
       log(`  source image does not exist yet, drawing on a plain ground: ${sourceFile}`);
     } else {
       const bytes = await readFile31(sourceFile);
@@ -20993,7 +21104,7 @@ async function runTools(args) {
 
 // src/cli/commands/workspace.ts
 import path48 from "path";
-import { existsSync as existsSync34 } from "fs";
+import { existsSync as existsSync35 } from "fs";
 async function runWorkspace(args) {
   const workspacePath = path48.resolve(args.workspace ?? "pixelkiln.workspace.json");
   const dir = path48.dirname(workspacePath);
@@ -21023,7 +21134,7 @@ async function runWorkspace(args) {
     log(`  registered "${id}" in ${path48.relative(process.cwd(), workspacePath)}`);
     log(`    manifest: ${project.manifest}`);
     log(`    lock:     ${project.lock}`);
-    if (!existsSync34(lockPath)) {
+    if (!existsSync35(lockPath)) {
       log(
         `  warning: no lockfile there yet; this project contributes no claims until one is generated`
       );
@@ -21047,7 +21158,7 @@ async function runWorkspace(args) {
     return;
   }
   if (args.subcommand === "list") {
-    if (!existsSync34(workspacePath)) {
+    if (!existsSync35(workspacePath)) {
       throw new Error(`Workspace catalog not found: ${workspacePath}`);
     }
     const ws = await loadWorkspace(workspacePath);
@@ -21067,7 +21178,7 @@ async function runWorkspace(args) {
     return;
   }
   if (args.subcommand === "status") {
-    if (!existsSync34(workspacePath)) {
+    if (!existsSync35(workspacePath)) {
       throw new Error(`Workspace catalog not found: ${workspacePath}`);
     }
     const ws = await loadWorkspace(workspacePath);
@@ -21129,7 +21240,7 @@ async function runHelp() {
 async function runVersion() {
   for (const up of ["../package.json", "../../package.json"]) {
     const url = new URL(up, import.meta.url);
-    if (!existsSync35(url)) continue;
+    if (!existsSync36(url)) continue;
     const pkg = JSON.parse(await readFile32(url, "utf8"));
     if (pkg.name === "pixelkiln") {
       log(`${pkg.name} ${pkg.version}`);