Private/Get-KadenInstalledManagedManifest.ps1

function Get-KadenInstalledManagedManifest {
    <#
    .SYNOPSIS
        Read the installed managed-file manifest without rehashing payload bytes.
    .DESCRIPTION
        The apply step uses the manifest as the allowlist of Kaden-managed agents.
        Update already proved the payload. A later standalone apply does not walk
        every payload path again.
    #>

    $manifestPath = Join-Path (Get-KadenPayloadRoot) 'kaden-managed-files.json'
    if (-not (Test-Path -LiteralPath $manifestPath -PathType Leaf)) {
        return [pscustomobject]@{
            Valid   = $false
            Message = 'KDN-PAYLOAD-INCOMPLETE: Installed Kaden payload is incomplete (missing managed-file manifest). Repair the module installation and retry.'
        }
    }
    try {
        $manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
    } catch {
        return [pscustomobject]@{
            Valid   = $false
            Message = 'KDN-PAYLOAD-INCOMPLETE: Installed Kaden payload has an invalid managed-file manifest. Repair the module installation and retry.'
        }
    }
    if ($null -eq $manifest -or [string]$manifest.schemaVersion -ne '1' -or $null -eq $manifest.files) {
        return [pscustomobject]@{
            Valid   = $false
            Message = 'KDN-PAYLOAD-INCOMPLETE: Installed Kaden payload has an unsupported managed-file manifest schema. Repair the module installation and retry.'
        }
    }
    return [pscustomobject]@{
        Valid    = $true
        Message  = 'Payload manifest ready.'
        Manifest = $manifest
    }
}