@agimon-ai/po-core 0.0.0-alpha.92 → 0.0.0-alpha.93

package/dist/runtimePackages.cjs

@@ -91,10 +91,10 @@ function runtimeStoreDirectory(poHome) {
 }
 /** Installs the dependency set `<dir>/package.json` declares. */
 async function installRuntimePackages(options) {
-	const { install } = await compatibleUpm();
-	return install({
+	const installOptions = {
 		dir: options.dir,
 		store: runtimeStoreDirectory(options.poHome),
+		npmrcFiles: options.npmrcFiles && [...options.npmrcFiles],
 		minReleaseAge: 2,
 		minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],
 		preferOffline: options.preferOffline,
@@ -102,7 +102,9 @@ async function installRuntimePackages(options) {
 		registry: options.registry,
 		log: options.log,
 		experimental: proxyTuning(options.log)
-	});
+	};
+	const { install } = await compatibleUpm();
+	return install(installOptions);
 }
 /** The newest version of a package that the release-age policy allows. */
 async function resolveNewest(name, options) {
@@ -110,6 +112,7 @@ async function resolveNewest(name, options) {
 	const specOptions = {
 		dir: options.dir,
 		store: runtimeStoreDirectory(options.poHome),
+		npmrcFiles: options.npmrcFiles && [...options.npmrcFiles],
 		minReleaseAge: 2,
 		minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],
 		log: options.log

package/dist/runtimePackages.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"runtimePackages.cjs","names":["path","fileURLToPath","fs","pathToFileURL","http"],"sources":["../src/services/runtimePackages/index.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport http from 'node:http';\nimport path from 'node:path';\nimport { fileURLToPath, pathToFileURL } from 'node:url';\n\nimport {\n  type Experimental,\n  type InstallResult,\n  type LogLevel,\n  type PruneResult,\n  type SpecOptions,\n  type StoreAccess,\n} from 'upm';\n\n/** The build ships a pinned, scoped resolver correction inside the published dist. */\nasync function compatibleUpm(): Promise<typeof import('upm')> {\n  let directory = path.dirname(fileURLToPath(import.meta.url));\n  while (\n    !(await fs.access(path.join(directory, 'package.json')).then(\n      () => true,\n      () => false,\n    ))\n  ) {\n    const parent = path.dirname(directory);\n    if (parent === directory) throw new Error('Cannot locate the Po core package.');\n    directory = parent;\n  }\n  return import(pathToFileURL(path.join(directory, 'dist/vendor/upm/index.mjs')).href);\n}\n\n/**\n * Runtime packages: what Po installs at run time (layer packages, npm plugins)\n * goes through upm into a directory under Po's home, never through a spawned\n * package manager.\n *\n * Every call passes the store explicitly as `<po home>/store`; upm would\n * otherwise fall back to `UPM_STORE` and then `~/.upm/store`.\n *\n * Proxies: Node's env proxy (`NODE_USE_ENV_PROXY=1` or `--use-env-proxy`) only\n * covers upm's registry worker threads when it is present at process start.\n * When a proxy variable is set without it, this module installs the proxy at\n * run time with `http.setGlobalProxyFromEnv()`, which covers the main thread\n * only, and so asks upm to read the registry on the main thread\n * (`experimental.resolvePool: 0`).\n *\n * Certificates: a private CA is supplied the usual Node ways, with\n * `NODE_EXTRA_CA_CERTS` or `--use-system-ca`. Whether either reaches upm's\n * worker threads is not verified.\n */\n\n/** Days a newly picked version must have been published, matching `pnpm-workspace.yaml`. */\nexport const RUNTIME_MIN_RELEASE_AGE_DAYS = 2;\n/**\n * Packages that are never held back: the first-party scopes and the pins `pnpm-workspace.yaml`\n * excludes by version. upm only honours name or scope entries, so the pins are listed by name.\n */\nexport const RUNTIME_MIN_RELEASE_AGE_EXCLUDE: readonly string[] = [\n  '@agimon-ai/*',\n  '@agiflowai/*',\n  '@earendil-works/*',\n  '@deepseek-ai/cordis',\n  '@deepseek-ai/cosmokit',\n];\n\nconst STORE_DIRECTORY = 'store';\nconst ENV_PROXY_FLAG = '--use-env-proxy';\nconst ENV_PROXY_ENABLED = '1';\nconst PROXY_VARIABLES = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy'] as const;\nconst NO_PROXY_VARIABLES = ['NO_PROXY', 'no_proxy'] as const;\n\n/** Whether Node's env proxy was on when the process started, recorded once at module load. */\nconst startedWithEnvProxy =\n  process.env.NODE_USE_ENV_PROXY === ENV_PROXY_ENABLED ||\n  process.execArgv.includes(ENV_PROXY_FLAG) ||\n  (process.env.NODE_OPTIONS ?? '').split(/\\s+/).includes(ENV_PROXY_FLAG);\n\n/** The proxy settings last installed with `setGlobalProxyFromEnv`, so a repeat call keeps the pool. */\nlet appliedProxySettings: string | undefined;\n\n/**\n * How runtime package traffic reaches a proxy:\n * - `startup`: Node's env proxy was on at process start and covers every thread;\n * - `runtime`: a proxy variable is set without it, so the main thread carries all registry traffic;\n * - `none`: no proxy variable is set.\n */\nexport type RuntimeProxyMode = 'startup' | 'runtime' | 'none';\n\nexport interface RuntimePackageOptions {\n  /** The project upm works on: its `package.json`, `upm.lock` and `node_modules`. */\n  dir: string;\n  /** Po's home; the store is always `<poHome>/store`. */\n  poHome: string;\n  log?: (message: string, level: LogLevel) => void;\n}\n\nexport interface InstallRuntimePackagesOptions extends RuntimePackageOptions {\n  /** Pick from kept registry documents however old; ask the registry only for what they cannot answer. */\n  preferOffline?: boolean;\n  /** Never use the network: install from `upm.lock` and the store. */\n  offline?: boolean;\n  /** Registry base url for this install, over `.npmrc` and `npm_config_registry`. */\n  registry?: string;\n}\n\nfunction proxySettings(): string | undefined {\n  const proxies = PROXY_VARIABLES.map((name) => process.env[name]?.trim() ?? '');\n  if (!proxies.some(Boolean)) return undefined;\n  return [...proxies, ...NO_PROXY_VARIABLES.map((name) => process.env[name]?.trim() ?? '')].join('\\n');\n}\n\nexport function runtimeProxyMode(): RuntimeProxyMode {\n  if (startedWithEnvProxy) return 'startup';\n  return proxySettings() === undefined ? 'none' : 'runtime';\n}\n\n/** Installs the runtime proxy when needed and returns the upm tuning that keeps traffic on it. */\nfunction proxyTuning(log: RuntimePackageOptions['log']): Experimental | undefined {\n  if (startedWithEnvProxy) return undefined;\n  const settings = proxySettings();\n  if (settings === undefined) return undefined;\n  if (settings !== appliedProxySettings) {\n    if (typeof http.setGlobalProxyFromEnv === 'function') {\n      http.setGlobalProxyFromEnv();\n      appliedProxySettings = settings;\n    } else {\n      log?.('this Node.js has no http.setGlobalProxyFromEnv; start it with NODE_USE_ENV_PROXY=1', 'warn');\n    }\n  }\n  return { resolvePool: 0 };\n}\n\nexport function runtimeStoreDirectory(poHome: string): string {\n  return path.join(poHome, STORE_DIRECTORY);\n}\n\n/** Installs the dependency set `<dir>/package.json` declares. */\nexport async function installRuntimePackages(options: InstallRuntimePackagesOptions): Promise<InstallResult> {\n  // upm treats an undefined option as an absent one (verified in upm 1.4.0's dist).\n  const { install } = await compatibleUpm();\n  return install({\n    dir: options.dir,\n    store: runtimeStoreDirectory(options.poHome),\n    minReleaseAge: RUNTIME_MIN_RELEASE_AGE_DAYS,\n    minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],\n    preferOffline: options.preferOffline,\n    offline: options.offline,\n    registry: options.registry,\n    log: options.log,\n    experimental: proxyTuning(options.log),\n  });\n}\n\n/** The newest version of a package that the release-age policy allows. */\nexport async function resolveNewest(name: string, options: RuntimePackageOptions): Promise<string> {\n  // upm's resolve always reads the registry on the main thread, so the runtime proxy covers it.\n  proxyTuning(options.log);\n  // upm 1.4.0's resolve keeps registry documents in `options.store` although SpecOptions does not\n  // declare it; without it they land in ~/.upm/store.\n  const specOptions: SpecOptions & StoreAccess = {\n    dir: options.dir,\n    store: runtimeStoreDirectory(options.poHome),\n    minReleaseAge: RUNTIME_MIN_RELEASE_AGE_DAYS,\n    minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],\n    log: options.log,\n  };\n  const { resolve } = await compatibleUpm();\n  const [manifest] = await resolve([name], specOptions);\n  if (!manifest?.version) throw new Error(`The registry reported no version for ${name}.`);\n  return manifest.version;\n}\n\n/** Drops stale project entries under `dir` and store content no package index references. */\nexport async function pruneRuntimePackages(options: RuntimePackageOptions): Promise<PruneResult> {\n  const { prune } = await compatibleUpm();\n  return prune({ dir: options.dir, store: runtimeStoreDirectory(options.poHome), log: options.log });\n}\n"],"mappings":";;;;;;;;;;;AAeA,eAAe,gBAA+C;CAC5D,IAAI,YAAYA,UAAAA,QAAK,SAAA,GAAQC,SAAAA,cAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,IAA6B,CAAC;CAC3D,OACE,CAAE,MAAMC,iBAAAA,QAAG,OAAOF,UAAAA,QAAK,KAAK,WAAW,cAAc,CAAC,CAAC,CAAC,WAChD,YACA,KACR,GACA;EACA,MAAM,SAASA,UAAAA,QAAK,QAAQ,SAAS;EACrC,IAAI,WAAW,WAAW,MAAM,IAAI,MAAM,oCAAoC;EAC9E,YAAY;CACd;CACA,OAAO,QAAA,GAAOG,SAAAA,cAAAA,CAAcH,UAAAA,QAAK,KAAK,WAAW,2BAA2B,CAAC,CAAC,CAAC;AACjF;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,+BAA+B;;;;;AAK5C,MAAa,kCAAqD;CAChE;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,kBAAkB;AACxB,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;CAAC;CAAe;CAAe;CAAc;AAAY;AACjF,MAAM,qBAAqB,CAAC,YAAY,UAAU;;AAGlD,MAAM,sBACJ,QAAQ,IAAI,uBAAuB,qBACnC,QAAQ,SAAS,SAAS,cAAc,MACvC,QAAQ,IAAI,gBAAgB,GAAA,CAAI,MAAM,KAAK,CAAC,CAAC,SAAS,cAAc;;AAGvE,IAAI;AA2BJ,SAAS,gBAAoC;CAC3C,MAAM,UAAU,gBAAgB,KAAK,SAAS,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE;CAC7E,IAAI,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;CACnC,OAAO,CAAC,GAAG,SAAS,GAAG,mBAAmB,KAAK,SAAS,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;AACrG;AAEA,SAAgB,mBAAqC;CACnD,IAAI,qBAAqB,OAAO;CAChC,OAAO,cAAc,MAAM,KAAA,IAAY,SAAS;AAClD;;AAGA,SAAS,YAAY,KAA6D;CAChF,IAAI,qBAAqB,OAAO,KAAA;CAChC,MAAM,WAAW,cAAc;CAC/B,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,IAAI,aAAa,sBAAsB;EACrC,IAAI,OAAOI,UAAAA,QAAK,0BAA0B,YAAY;GACpD,UAAA,QAAK,sBAAsB;GAC3B,uBAAuB;EACzB,OACE,MAAM,sFAAsF,MAAM;CAEtG;CACA,OAAO,EAAE,aAAa,EAAE;AAC1B;AAEA,SAAgB,sBAAsB,QAAwB;CAC5D,OAAOJ,UAAAA,QAAK,KAAK,QAAQ,eAAe;AAC1C;;AAGA,eAAsB,uBAAuB,SAAgE;CAE3G,MAAM,EAAE,YAAY,MAAM,cAAc;CACxC,OAAO,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,sBAAsB,QAAQ,MAAM;EAC3C,eAAA;EACA,sBAAsB,CAAC,GAAG,+BAA+B;EACzD,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,UAAU,QAAQ;EAClB,KAAK,QAAQ;EACb,cAAc,YAAY,QAAQ,GAAG;CACvC,CAAC;AACH;;AAGA,eAAsB,cAAc,MAAc,SAAiD;CAEjG,YAAY,QAAQ,GAAG;CAGvB,MAAM,cAAyC;EAC7C,KAAK,QAAQ;EACb,OAAO,sBAAsB,QAAQ,MAAM;EAC3C,eAAA;EACA,sBAAsB,CAAC,GAAG,+BAA+B;EACzD,KAAK,QAAQ;CACf;CACA,MAAM,EAAE,YAAY,MAAM,cAAc;CACxC,MAAM,CAAC,YAAY,MAAM,QAAQ,CAAC,IAAI,GAAG,WAAW;CACpD,IAAI,CAAC,UAAU,SAAS,MAAM,IAAI,MAAM,wCAAwC,KAAK,EAAE;CACvF,OAAO,SAAS;AAClB;;AAGA,eAAsB,qBAAqB,SAAsD;CAC/F,MAAM,EAAE,UAAU,MAAM,cAAc;CACtC,OAAO,MAAM;EAAE,KAAK,QAAQ;EAAK,OAAO,sBAAsB,QAAQ,MAAM;EAAG,KAAK,QAAQ;CAAI,CAAC;AACnG"}
+{"version":3,"file":"runtimePackages.cjs","names":["path","fileURLToPath","fs","pathToFileURL","http"],"sources":["../src/services/runtimePackages/index.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport http from 'node:http';\nimport path from 'node:path';\nimport { fileURLToPath, pathToFileURL } from 'node:url';\n\nimport {\n  type Experimental,\n  type InstallOptions,\n  type InstallResult,\n  type LogLevel,\n  type PruneResult,\n  type SpecOptions,\n  type StoreAccess,\n} from 'upm';\n\n/** The build ships a pinned, scoped resolver correction inside the published dist. */\nasync function compatibleUpm(): Promise<typeof import('upm')> {\n  let directory = path.dirname(fileURLToPath(import.meta.url));\n  while (\n    !(await fs.access(path.join(directory, 'package.json')).then(\n      () => true,\n      () => false,\n    ))\n  ) {\n    const parent = path.dirname(directory);\n    if (parent === directory) throw new Error('Cannot locate the Po core package.');\n    directory = parent;\n  }\n  return import(pathToFileURL(path.join(directory, 'dist/vendor/upm/index.mjs')).href);\n}\n\n/**\n * Runtime packages: what Po installs at run time (layer packages, npm plugins)\n * goes through upm into a directory under Po's home, never through a spawned\n * package manager.\n *\n * Every call passes the store explicitly as `<po home>/store`; upm would\n * otherwise fall back to `UPM_STORE` and then `~/.upm/store`.\n *\n * Proxies: Node's env proxy (`NODE_USE_ENV_PROXY=1` or `--use-env-proxy`) only\n * covers upm's registry worker threads when it is present at process start.\n * When a proxy variable is set without it, this module installs the proxy at\n * run time with `http.setGlobalProxyFromEnv()`, which covers the main thread\n * only, and so asks upm to read the registry on the main thread\n * (`experimental.resolvePool: 0`).\n *\n * Certificates: a private CA is supplied the usual Node ways, with\n * `NODE_EXTRA_CA_CERTS` or `--use-system-ca`. Whether either reaches upm's\n * worker threads is not verified.\n */\n\n/** Days a newly picked version must have been published, matching `pnpm-workspace.yaml`. */\nexport const RUNTIME_MIN_RELEASE_AGE_DAYS = 2;\n/**\n * Packages that are never held back: the first-party scopes and the pins `pnpm-workspace.yaml`\n * excludes by version. upm only honours name or scope entries, so the pins are listed by name.\n */\nexport const RUNTIME_MIN_RELEASE_AGE_EXCLUDE: readonly string[] = [\n  '@agimon-ai/*',\n  '@agiflowai/*',\n  '@earendil-works/*',\n  '@deepseek-ai/cordis',\n  '@deepseek-ai/cosmokit',\n];\n\nconst STORE_DIRECTORY = 'store';\nconst ENV_PROXY_FLAG = '--use-env-proxy';\nconst ENV_PROXY_ENABLED = '1';\nconst PROXY_VARIABLES = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy'] as const;\nconst NO_PROXY_VARIABLES = ['NO_PROXY', 'no_proxy'] as const;\n\n/** Whether Node's env proxy was on when the process started, recorded once at module load. */\nconst startedWithEnvProxy =\n  process.env.NODE_USE_ENV_PROXY === ENV_PROXY_ENABLED ||\n  process.execArgv.includes(ENV_PROXY_FLAG) ||\n  (process.env.NODE_OPTIONS ?? '').split(/\\s+/).includes(ENV_PROXY_FLAG);\n\n/** The proxy settings last installed with `setGlobalProxyFromEnv`, so a repeat call keeps the pool. */\nlet appliedProxySettings: string | undefined;\n\n/**\n * How runtime package traffic reaches a proxy:\n * - `startup`: Node's env proxy was on at process start and covers every thread;\n * - `runtime`: a proxy variable is set without it, so the main thread carries all registry traffic;\n * - `none`: no proxy variable is set.\n */\nexport type RuntimeProxyMode = 'startup' | 'runtime' | 'none';\n\nexport interface RuntimePackageOptions {\n  /** The project upm works on: its `package.json`, `upm.lock` and `node_modules`. */\n  dir: string;\n  /** Po's home; the store is always `<poHome>/store`. */\n  poHome: string;\n  /**\n   * Extra `.npmrc` files, such as the workspace's own, read after `~/.npmrc` and before\n   * `<dir>/.npmrc`: their scoped registries and credentials reach the shared runtime\n   * without being copied into it. A missing file reads as empty.\n   */\n  npmrcFiles?: readonly string[];\n  log?: (message: string, level: LogLevel) => void;\n}\n\n/** `npmrcFiles` is Po's addition to upm's config loader, applied by the build patch in tsdown.config.ts. */\ninterface NpmrcFilesAccess {\n  npmrcFiles?: string[];\n}\n\nexport interface InstallRuntimePackagesOptions extends RuntimePackageOptions {\n  /** Pick from kept registry documents however old; ask the registry only for what they cannot answer. */\n  preferOffline?: boolean;\n  /** Never use the network: install from `upm.lock` and the store. */\n  offline?: boolean;\n  /** Registry base url for this install, over `.npmrc` and `npm_config_registry`. */\n  registry?: string;\n}\n\nfunction proxySettings(): string | undefined {\n  const proxies = PROXY_VARIABLES.map((name) => process.env[name]?.trim() ?? '');\n  if (!proxies.some(Boolean)) return undefined;\n  return [...proxies, ...NO_PROXY_VARIABLES.map((name) => process.env[name]?.trim() ?? '')].join('\\n');\n}\n\nexport function runtimeProxyMode(): RuntimeProxyMode {\n  if (startedWithEnvProxy) return 'startup';\n  return proxySettings() === undefined ? 'none' : 'runtime';\n}\n\n/** Installs the runtime proxy when needed and returns the upm tuning that keeps traffic on it. */\nfunction proxyTuning(log: RuntimePackageOptions['log']): Experimental | undefined {\n  if (startedWithEnvProxy) return undefined;\n  const settings = proxySettings();\n  if (settings === undefined) return undefined;\n  if (settings !== appliedProxySettings) {\n    if (typeof http.setGlobalProxyFromEnv === 'function') {\n      http.setGlobalProxyFromEnv();\n      appliedProxySettings = settings;\n    } else {\n      log?.('this Node.js has no http.setGlobalProxyFromEnv; start it with NODE_USE_ENV_PROXY=1', 'warn');\n    }\n  }\n  return { resolvePool: 0 };\n}\n\nexport function runtimeStoreDirectory(poHome: string): string {\n  return path.join(poHome, STORE_DIRECTORY);\n}\n\n/** Installs the dependency set `<dir>/package.json` declares. */\nexport async function installRuntimePackages(options: InstallRuntimePackagesOptions): Promise<InstallResult> {\n  // upm treats an undefined option as an absent one (verified in upm 1.4.0's dist).\n  const installOptions: InstallOptions & NpmrcFilesAccess = {\n    dir: options.dir,\n    store: runtimeStoreDirectory(options.poHome),\n    npmrcFiles: options.npmrcFiles && [...options.npmrcFiles],\n    minReleaseAge: RUNTIME_MIN_RELEASE_AGE_DAYS,\n    minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],\n    preferOffline: options.preferOffline,\n    offline: options.offline,\n    registry: options.registry,\n    log: options.log,\n    experimental: proxyTuning(options.log),\n  };\n  const { install } = await compatibleUpm();\n  return install(installOptions);\n}\n\n/** The newest version of a package that the release-age policy allows. */\nexport async function resolveNewest(name: string, options: RuntimePackageOptions): Promise<string> {\n  // upm's resolve always reads the registry on the main thread, so the runtime proxy covers it.\n  proxyTuning(options.log);\n  // upm 1.4.0's resolve keeps registry documents in `options.store` although SpecOptions does not\n  // declare it; without it they land in ~/.upm/store.\n  const specOptions: SpecOptions & StoreAccess & NpmrcFilesAccess = {\n    dir: options.dir,\n    store: runtimeStoreDirectory(options.poHome),\n    npmrcFiles: options.npmrcFiles && [...options.npmrcFiles],\n    minReleaseAge: RUNTIME_MIN_RELEASE_AGE_DAYS,\n    minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],\n    log: options.log,\n  };\n  const { resolve } = await compatibleUpm();\n  const [manifest] = await resolve([name], specOptions);\n  if (!manifest?.version) throw new Error(`The registry reported no version for ${name}.`);\n  return manifest.version;\n}\n\n/** Drops stale project entries under `dir` and store content no package index references. */\nexport async function pruneRuntimePackages(options: RuntimePackageOptions): Promise<PruneResult> {\n  const { prune } = await compatibleUpm();\n  return prune({ dir: options.dir, store: runtimeStoreDirectory(options.poHome), log: options.log });\n}\n"],"mappings":";;;;;;;;;;;AAgBA,eAAe,gBAA+C;CAC5D,IAAI,YAAYA,UAAAA,QAAK,SAAA,GAAQC,SAAAA,cAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,IAA6B,CAAC;CAC3D,OACE,CAAE,MAAMC,iBAAAA,QAAG,OAAOF,UAAAA,QAAK,KAAK,WAAW,cAAc,CAAC,CAAC,CAAC,WAChD,YACA,KACR,GACA;EACA,MAAM,SAASA,UAAAA,QAAK,QAAQ,SAAS;EACrC,IAAI,WAAW,WAAW,MAAM,IAAI,MAAM,oCAAoC;EAC9E,YAAY;CACd;CACA,OAAO,QAAA,GAAOG,SAAAA,cAAAA,CAAcH,UAAAA,QAAK,KAAK,WAAW,2BAA2B,CAAC,CAAC,CAAC;AACjF;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,+BAA+B;;;;;AAK5C,MAAa,kCAAqD;CAChE;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,kBAAkB;AACxB,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;CAAC;CAAe;CAAe;CAAc;AAAY;AACjF,MAAM,qBAAqB,CAAC,YAAY,UAAU;;AAGlD,MAAM,sBACJ,QAAQ,IAAI,uBAAuB,qBACnC,QAAQ,SAAS,SAAS,cAAc,MACvC,QAAQ,IAAI,gBAAgB,GAAA,CAAI,MAAM,KAAK,CAAC,CAAC,SAAS,cAAc;;AAGvE,IAAI;AAsCJ,SAAS,gBAAoC;CAC3C,MAAM,UAAU,gBAAgB,KAAK,SAAS,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE;CAC7E,IAAI,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;CACnC,OAAO,CAAC,GAAG,SAAS,GAAG,mBAAmB,KAAK,SAAS,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;AACrG;AAEA,SAAgB,mBAAqC;CACnD,IAAI,qBAAqB,OAAO;CAChC,OAAO,cAAc,MAAM,KAAA,IAAY,SAAS;AAClD;;AAGA,SAAS,YAAY,KAA6D;CAChF,IAAI,qBAAqB,OAAO,KAAA;CAChC,MAAM,WAAW,cAAc;CAC/B,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,IAAI,aAAa,sBAAsB;EACrC,IAAI,OAAOI,UAAAA,QAAK,0BAA0B,YAAY;GACpD,UAAA,QAAK,sBAAsB;GAC3B,uBAAuB;EACzB,OACE,MAAM,sFAAsF,MAAM;CAEtG;CACA,OAAO,EAAE,aAAa,EAAE;AAC1B;AAEA,SAAgB,sBAAsB,QAAwB;CAC5D,OAAOJ,UAAAA,QAAK,KAAK,QAAQ,eAAe;AAC1C;;AAGA,eAAsB,uBAAuB,SAAgE;CAE3G,MAAM,iBAAoD;EACxD,KAAK,QAAQ;EACb,OAAO,sBAAsB,QAAQ,MAAM;EAC3C,YAAY,QAAQ,cAAc,CAAC,GAAG,QAAQ,UAAU;EACxD,eAAA;EACA,sBAAsB,CAAC,GAAG,+BAA+B;EACzD,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,UAAU,QAAQ;EAClB,KAAK,QAAQ;EACb,cAAc,YAAY,QAAQ,GAAG;CACvC;CACA,MAAM,EAAE,YAAY,MAAM,cAAc;CACxC,OAAO,QAAQ,cAAc;AAC/B;;AAGA,eAAsB,cAAc,MAAc,SAAiD;CAEjG,YAAY,QAAQ,GAAG;CAGvB,MAAM,cAA4D;EAChE,KAAK,QAAQ;EACb,OAAO,sBAAsB,QAAQ,MAAM;EAC3C,YAAY,QAAQ,cAAc,CAAC,GAAG,QAAQ,UAAU;EACxD,eAAA;EACA,sBAAsB,CAAC,GAAG,+BAA+B;EACzD,KAAK,QAAQ;CACf;CACA,MAAM,EAAE,YAAY,MAAM,cAAc;CACxC,MAAM,CAAC,YAAY,MAAM,QAAQ,CAAC,IAAI,GAAG,WAAW;CACpD,IAAI,CAAC,UAAU,SAAS,MAAM,IAAI,MAAM,wCAAwC,KAAK,EAAE;CACvF,OAAO,SAAS;AAClB;;AAGA,eAAsB,qBAAqB,SAAsD;CAC/F,MAAM,EAAE,UAAU,MAAM,cAAc;CACtC,OAAO,MAAM;EAAE,KAAK,QAAQ;EAAK,OAAO,sBAAsB,QAAQ,MAAM;EAAG,KAAK,QAAQ;CAAI,CAAC;AACnG"}

package/dist/runtimePackages.d.mts

@@ -38,6 +38,12 @@ export interface RuntimePackageOptions {
   dir: string;
   /** Po's home; the store is always `<poHome>/store`. */
   poHome: string;
+  /**
+   * Extra `.npmrc` files, such as the workspace's own, read after `~/.npmrc` and before
+   * `<dir>/.npmrc`: their scoped registries and credentials reach the shared runtime
+   * without being copied into it. A missing file reads as empty.
+   */
+  npmrcFiles?: readonly string[];
   log?: (message: string, level: LogLevel) => void;
 }
 export interface InstallRuntimePackagesOptions extends RuntimePackageOptions {

package/dist/runtimePackages.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"runtimePackages.d.mts","names":[],"sources":["../src/services/runtimePackages/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;qBAmDa;;;;;qBAKA;;;;;;;YA6BD;iBAEK;;EAEf;;EAEA;EACA,OAAO,iBAAiB,OAAO;;iBAGhB,sCAAsC;;EAErD;;EAEA;;EAEA;;wBASc,oBAAoB;wBAqBpB,sBAAsB;;wBAKhB,uBAAuB,SAAS,gCAAgC,QAAQ;;wBAiBxE,cAAc,cAAc,SAAS,wBAAwB;;wBAmB7D,qBAAqB,SAAS,wBAAwB,QAAQ"}
+{"version":3,"file":"runtimePackages.d.mts","names":[],"sources":["../src/services/runtimePackages/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;qBAoDa;;;;;qBAKA;;;;;;;YA6BD;iBAEK;;EAEf;;EAEA;;;;;;EAMA;EACA,OAAO,iBAAiB,OAAO;;iBAQhB,sCAAsC;;EAErD;;EAEA;;EAEA;;wBASc,oBAAoB;wBAqBpB,sBAAsB;;wBAKhB,uBAAuB,SAAS,gCAAgC,QAAQ;;wBAmBxE,cAAc,cAAc,SAAS,wBAAwB;;wBAoB7D,qBAAqB,SAAS,wBAAwB,QAAQ"}

package/dist/runtimePackages.mjs

@@ -86,10 +86,10 @@ function runtimeStoreDirectory(poHome) {
 }
 /** Installs the dependency set `<dir>/package.json` declares. */
 async function installRuntimePackages(options) {
-	const { install } = await compatibleUpm();
-	return install({
+	const installOptions = {
 		dir: options.dir,
 		store: runtimeStoreDirectory(options.poHome),
+		npmrcFiles: options.npmrcFiles && [...options.npmrcFiles],
 		minReleaseAge: 2,
 		minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],
 		preferOffline: options.preferOffline,
@@ -97,7 +97,9 @@ async function installRuntimePackages(options) {
 		registry: options.registry,
 		log: options.log,
 		experimental: proxyTuning(options.log)
-	});
+	};
+	const { install } = await compatibleUpm();
+	return install(installOptions);
 }
 /** The newest version of a package that the release-age policy allows. */
 async function resolveNewest(name, options) {
@@ -105,6 +107,7 @@ async function resolveNewest(name, options) {
 	const specOptions = {
 		dir: options.dir,
 		store: runtimeStoreDirectory(options.poHome),
+		npmrcFiles: options.npmrcFiles && [...options.npmrcFiles],
 		minReleaseAge: 2,
 		minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],
 		log: options.log

package/dist/runtimePackages.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"runtimePackages.mjs","names":[],"sources":["../src/services/runtimePackages/index.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport http from 'node:http';\nimport path from 'node:path';\nimport { fileURLToPath, pathToFileURL } from 'node:url';\n\nimport {\n  type Experimental,\n  type InstallResult,\n  type LogLevel,\n  type PruneResult,\n  type SpecOptions,\n  type StoreAccess,\n} from 'upm';\n\n/** The build ships a pinned, scoped resolver correction inside the published dist. */\nasync function compatibleUpm(): Promise<typeof import('upm')> {\n  let directory = path.dirname(fileURLToPath(import.meta.url));\n  while (\n    !(await fs.access(path.join(directory, 'package.json')).then(\n      () => true,\n      () => false,\n    ))\n  ) {\n    const parent = path.dirname(directory);\n    if (parent === directory) throw new Error('Cannot locate the Po core package.');\n    directory = parent;\n  }\n  return import(pathToFileURL(path.join(directory, 'dist/vendor/upm/index.mjs')).href);\n}\n\n/**\n * Runtime packages: what Po installs at run time (layer packages, npm plugins)\n * goes through upm into a directory under Po's home, never through a spawned\n * package manager.\n *\n * Every call passes the store explicitly as `<po home>/store`; upm would\n * otherwise fall back to `UPM_STORE` and then `~/.upm/store`.\n *\n * Proxies: Node's env proxy (`NODE_USE_ENV_PROXY=1` or `--use-env-proxy`) only\n * covers upm's registry worker threads when it is present at process start.\n * When a proxy variable is set without it, this module installs the proxy at\n * run time with `http.setGlobalProxyFromEnv()`, which covers the main thread\n * only, and so asks upm to read the registry on the main thread\n * (`experimental.resolvePool: 0`).\n *\n * Certificates: a private CA is supplied the usual Node ways, with\n * `NODE_EXTRA_CA_CERTS` or `--use-system-ca`. Whether either reaches upm's\n * worker threads is not verified.\n */\n\n/** Days a newly picked version must have been published, matching `pnpm-workspace.yaml`. */\nexport const RUNTIME_MIN_RELEASE_AGE_DAYS = 2;\n/**\n * Packages that are never held back: the first-party scopes and the pins `pnpm-workspace.yaml`\n * excludes by version. upm only honours name or scope entries, so the pins are listed by name.\n */\nexport const RUNTIME_MIN_RELEASE_AGE_EXCLUDE: readonly string[] = [\n  '@agimon-ai/*',\n  '@agiflowai/*',\n  '@earendil-works/*',\n  '@deepseek-ai/cordis',\n  '@deepseek-ai/cosmokit',\n];\n\nconst STORE_DIRECTORY = 'store';\nconst ENV_PROXY_FLAG = '--use-env-proxy';\nconst ENV_PROXY_ENABLED = '1';\nconst PROXY_VARIABLES = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy'] as const;\nconst NO_PROXY_VARIABLES = ['NO_PROXY', 'no_proxy'] as const;\n\n/** Whether Node's env proxy was on when the process started, recorded once at module load. */\nconst startedWithEnvProxy =\n  process.env.NODE_USE_ENV_PROXY === ENV_PROXY_ENABLED ||\n  process.execArgv.includes(ENV_PROXY_FLAG) ||\n  (process.env.NODE_OPTIONS ?? '').split(/\\s+/).includes(ENV_PROXY_FLAG);\n\n/** The proxy settings last installed with `setGlobalProxyFromEnv`, so a repeat call keeps the pool. */\nlet appliedProxySettings: string | undefined;\n\n/**\n * How runtime package traffic reaches a proxy:\n * - `startup`: Node's env proxy was on at process start and covers every thread;\n * - `runtime`: a proxy variable is set without it, so the main thread carries all registry traffic;\n * - `none`: no proxy variable is set.\n */\nexport type RuntimeProxyMode = 'startup' | 'runtime' | 'none';\n\nexport interface RuntimePackageOptions {\n  /** The project upm works on: its `package.json`, `upm.lock` and `node_modules`. */\n  dir: string;\n  /** Po's home; the store is always `<poHome>/store`. */\n  poHome: string;\n  log?: (message: string, level: LogLevel) => void;\n}\n\nexport interface InstallRuntimePackagesOptions extends RuntimePackageOptions {\n  /** Pick from kept registry documents however old; ask the registry only for what they cannot answer. */\n  preferOffline?: boolean;\n  /** Never use the network: install from `upm.lock` and the store. */\n  offline?: boolean;\n  /** Registry base url for this install, over `.npmrc` and `npm_config_registry`. */\n  registry?: string;\n}\n\nfunction proxySettings(): string | undefined {\n  const proxies = PROXY_VARIABLES.map((name) => process.env[name]?.trim() ?? '');\n  if (!proxies.some(Boolean)) return undefined;\n  return [...proxies, ...NO_PROXY_VARIABLES.map((name) => process.env[name]?.trim() ?? '')].join('\\n');\n}\n\nexport function runtimeProxyMode(): RuntimeProxyMode {\n  if (startedWithEnvProxy) return 'startup';\n  return proxySettings() === undefined ? 'none' : 'runtime';\n}\n\n/** Installs the runtime proxy when needed and returns the upm tuning that keeps traffic on it. */\nfunction proxyTuning(log: RuntimePackageOptions['log']): Experimental | undefined {\n  if (startedWithEnvProxy) return undefined;\n  const settings = proxySettings();\n  if (settings === undefined) return undefined;\n  if (settings !== appliedProxySettings) {\n    if (typeof http.setGlobalProxyFromEnv === 'function') {\n      http.setGlobalProxyFromEnv();\n      appliedProxySettings = settings;\n    } else {\n      log?.('this Node.js has no http.setGlobalProxyFromEnv; start it with NODE_USE_ENV_PROXY=1', 'warn');\n    }\n  }\n  return { resolvePool: 0 };\n}\n\nexport function runtimeStoreDirectory(poHome: string): string {\n  return path.join(poHome, STORE_DIRECTORY);\n}\n\n/** Installs the dependency set `<dir>/package.json` declares. */\nexport async function installRuntimePackages(options: InstallRuntimePackagesOptions): Promise<InstallResult> {\n  // upm treats an undefined option as an absent one (verified in upm 1.4.0's dist).\n  const { install } = await compatibleUpm();\n  return install({\n    dir: options.dir,\n    store: runtimeStoreDirectory(options.poHome),\n    minReleaseAge: RUNTIME_MIN_RELEASE_AGE_DAYS,\n    minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],\n    preferOffline: options.preferOffline,\n    offline: options.offline,\n    registry: options.registry,\n    log: options.log,\n    experimental: proxyTuning(options.log),\n  });\n}\n\n/** The newest version of a package that the release-age policy allows. */\nexport async function resolveNewest(name: string, options: RuntimePackageOptions): Promise<string> {\n  // upm's resolve always reads the registry on the main thread, so the runtime proxy covers it.\n  proxyTuning(options.log);\n  // upm 1.4.0's resolve keeps registry documents in `options.store` although SpecOptions does not\n  // declare it; without it they land in ~/.upm/store.\n  const specOptions: SpecOptions & StoreAccess = {\n    dir: options.dir,\n    store: runtimeStoreDirectory(options.poHome),\n    minReleaseAge: RUNTIME_MIN_RELEASE_AGE_DAYS,\n    minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],\n    log: options.log,\n  };\n  const { resolve } = await compatibleUpm();\n  const [manifest] = await resolve([name], specOptions);\n  if (!manifest?.version) throw new Error(`The registry reported no version for ${name}.`);\n  return manifest.version;\n}\n\n/** Drops stale project entries under `dir` and store content no package index references. */\nexport async function pruneRuntimePackages(options: RuntimePackageOptions): Promise<PruneResult> {\n  const { prune } = await compatibleUpm();\n  return prune({ dir: options.dir, store: runtimeStoreDirectory(options.poHome), log: options.log });\n}\n"],"mappings":";;;;;;AAeA,eAAe,gBAA+C;CAC5D,IAAI,YAAY,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;CAC3D,OACE,CAAE,MAAM,GAAG,OAAO,KAAK,KAAK,WAAW,cAAc,CAAC,CAAC,CAAC,WAChD,YACA,KACR,GACA;EACA,MAAM,SAAS,KAAK,QAAQ,SAAS;EACrC,IAAI,WAAW,WAAW,MAAM,IAAI,MAAM,oCAAoC;EAC9E,YAAY;CACd;CACA,OAAO,OAAO,cAAc,KAAK,KAAK,WAAW,2BAA2B,CAAC,CAAC,CAAC;AACjF;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,+BAA+B;;;;;AAK5C,MAAa,kCAAqD;CAChE;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,kBAAkB;AACxB,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;CAAC;CAAe;CAAe;CAAc;AAAY;AACjF,MAAM,qBAAqB,CAAC,YAAY,UAAU;;AAGlD,MAAM,sBACJ,QAAQ,IAAI,uBAAuB,qBACnC,QAAQ,SAAS,SAAS,cAAc,MACvC,QAAQ,IAAI,gBAAgB,GAAA,CAAI,MAAM,KAAK,CAAC,CAAC,SAAS,cAAc;;AAGvE,IAAI;AA2BJ,SAAS,gBAAoC;CAC3C,MAAM,UAAU,gBAAgB,KAAK,SAAS,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE;CAC7E,IAAI,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;CACnC,OAAO,CAAC,GAAG,SAAS,GAAG,mBAAmB,KAAK,SAAS,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;AACrG;AAEA,SAAgB,mBAAqC;CACnD,IAAI,qBAAqB,OAAO;CAChC,OAAO,cAAc,MAAM,KAAA,IAAY,SAAS;AAClD;;AAGA,SAAS,YAAY,KAA6D;CAChF,IAAI,qBAAqB,OAAO,KAAA;CAChC,MAAM,WAAW,cAAc;CAC/B,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,IAAI,aAAa,sBAAsB;EACrC,IAAI,OAAO,KAAK,0BAA0B,YAAY;GACpD,KAAK,sBAAsB;GAC3B,uBAAuB;EACzB,OACE,MAAM,sFAAsF,MAAM;CAEtG;CACA,OAAO,EAAE,aAAa,EAAE;AAC1B;AAEA,SAAgB,sBAAsB,QAAwB;CAC5D,OAAO,KAAK,KAAK,QAAQ,eAAe;AAC1C;;AAGA,eAAsB,uBAAuB,SAAgE;CAE3G,MAAM,EAAE,YAAY,MAAM,cAAc;CACxC,OAAO,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,sBAAsB,QAAQ,MAAM;EAC3C,eAAA;EACA,sBAAsB,CAAC,GAAG,+BAA+B;EACzD,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,UAAU,QAAQ;EAClB,KAAK,QAAQ;EACb,cAAc,YAAY,QAAQ,GAAG;CACvC,CAAC;AACH;;AAGA,eAAsB,cAAc,MAAc,SAAiD;CAEjG,YAAY,QAAQ,GAAG;CAGvB,MAAM,cAAyC;EAC7C,KAAK,QAAQ;EACb,OAAO,sBAAsB,QAAQ,MAAM;EAC3C,eAAA;EACA,sBAAsB,CAAC,GAAG,+BAA+B;EACzD,KAAK,QAAQ;CACf;CACA,MAAM,EAAE,YAAY,MAAM,cAAc;CACxC,MAAM,CAAC,YAAY,MAAM,QAAQ,CAAC,IAAI,GAAG,WAAW;CACpD,IAAI,CAAC,UAAU,SAAS,MAAM,IAAI,MAAM,wCAAwC,KAAK,EAAE;CACvF,OAAO,SAAS;AAClB;;AAGA,eAAsB,qBAAqB,SAAsD;CAC/F,MAAM,EAAE,UAAU,MAAM,cAAc;CACtC,OAAO,MAAM;EAAE,KAAK,QAAQ;EAAK,OAAO,sBAAsB,QAAQ,MAAM;EAAG,KAAK,QAAQ;CAAI,CAAC;AACnG"}
+{"version":3,"file":"runtimePackages.mjs","names":[],"sources":["../src/services/runtimePackages/index.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport http from 'node:http';\nimport path from 'node:path';\nimport { fileURLToPath, pathToFileURL } from 'node:url';\n\nimport {\n  type Experimental,\n  type InstallOptions,\n  type InstallResult,\n  type LogLevel,\n  type PruneResult,\n  type SpecOptions,\n  type StoreAccess,\n} from 'upm';\n\n/** The build ships a pinned, scoped resolver correction inside the published dist. */\nasync function compatibleUpm(): Promise<typeof import('upm')> {\n  let directory = path.dirname(fileURLToPath(import.meta.url));\n  while (\n    !(await fs.access(path.join(directory, 'package.json')).then(\n      () => true,\n      () => false,\n    ))\n  ) {\n    const parent = path.dirname(directory);\n    if (parent === directory) throw new Error('Cannot locate the Po core package.');\n    directory = parent;\n  }\n  return import(pathToFileURL(path.join(directory, 'dist/vendor/upm/index.mjs')).href);\n}\n\n/**\n * Runtime packages: what Po installs at run time (layer packages, npm plugins)\n * goes through upm into a directory under Po's home, never through a spawned\n * package manager.\n *\n * Every call passes the store explicitly as `<po home>/store`; upm would\n * otherwise fall back to `UPM_STORE` and then `~/.upm/store`.\n *\n * Proxies: Node's env proxy (`NODE_USE_ENV_PROXY=1` or `--use-env-proxy`) only\n * covers upm's registry worker threads when it is present at process start.\n * When a proxy variable is set without it, this module installs the proxy at\n * run time with `http.setGlobalProxyFromEnv()`, which covers the main thread\n * only, and so asks upm to read the registry on the main thread\n * (`experimental.resolvePool: 0`).\n *\n * Certificates: a private CA is supplied the usual Node ways, with\n * `NODE_EXTRA_CA_CERTS` or `--use-system-ca`. Whether either reaches upm's\n * worker threads is not verified.\n */\n\n/** Days a newly picked version must have been published, matching `pnpm-workspace.yaml`. */\nexport const RUNTIME_MIN_RELEASE_AGE_DAYS = 2;\n/**\n * Packages that are never held back: the first-party scopes and the pins `pnpm-workspace.yaml`\n * excludes by version. upm only honours name or scope entries, so the pins are listed by name.\n */\nexport const RUNTIME_MIN_RELEASE_AGE_EXCLUDE: readonly string[] = [\n  '@agimon-ai/*',\n  '@agiflowai/*',\n  '@earendil-works/*',\n  '@deepseek-ai/cordis',\n  '@deepseek-ai/cosmokit',\n];\n\nconst STORE_DIRECTORY = 'store';\nconst ENV_PROXY_FLAG = '--use-env-proxy';\nconst ENV_PROXY_ENABLED = '1';\nconst PROXY_VARIABLES = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy'] as const;\nconst NO_PROXY_VARIABLES = ['NO_PROXY', 'no_proxy'] as const;\n\n/** Whether Node's env proxy was on when the process started, recorded once at module load. */\nconst startedWithEnvProxy =\n  process.env.NODE_USE_ENV_PROXY === ENV_PROXY_ENABLED ||\n  process.execArgv.includes(ENV_PROXY_FLAG) ||\n  (process.env.NODE_OPTIONS ?? '').split(/\\s+/).includes(ENV_PROXY_FLAG);\n\n/** The proxy settings last installed with `setGlobalProxyFromEnv`, so a repeat call keeps the pool. */\nlet appliedProxySettings: string | undefined;\n\n/**\n * How runtime package traffic reaches a proxy:\n * - `startup`: Node's env proxy was on at process start and covers every thread;\n * - `runtime`: a proxy variable is set without it, so the main thread carries all registry traffic;\n * - `none`: no proxy variable is set.\n */\nexport type RuntimeProxyMode = 'startup' | 'runtime' | 'none';\n\nexport interface RuntimePackageOptions {\n  /** The project upm works on: its `package.json`, `upm.lock` and `node_modules`. */\n  dir: string;\n  /** Po's home; the store is always `<poHome>/store`. */\n  poHome: string;\n  /**\n   * Extra `.npmrc` files, such as the workspace's own, read after `~/.npmrc` and before\n   * `<dir>/.npmrc`: their scoped registries and credentials reach the shared runtime\n   * without being copied into it. A missing file reads as empty.\n   */\n  npmrcFiles?: readonly string[];\n  log?: (message: string, level: LogLevel) => void;\n}\n\n/** `npmrcFiles` is Po's addition to upm's config loader, applied by the build patch in tsdown.config.ts. */\ninterface NpmrcFilesAccess {\n  npmrcFiles?: string[];\n}\n\nexport interface InstallRuntimePackagesOptions extends RuntimePackageOptions {\n  /** Pick from kept registry documents however old; ask the registry only for what they cannot answer. */\n  preferOffline?: boolean;\n  /** Never use the network: install from `upm.lock` and the store. */\n  offline?: boolean;\n  /** Registry base url for this install, over `.npmrc` and `npm_config_registry`. */\n  registry?: string;\n}\n\nfunction proxySettings(): string | undefined {\n  const proxies = PROXY_VARIABLES.map((name) => process.env[name]?.trim() ?? '');\n  if (!proxies.some(Boolean)) return undefined;\n  return [...proxies, ...NO_PROXY_VARIABLES.map((name) => process.env[name]?.trim() ?? '')].join('\\n');\n}\n\nexport function runtimeProxyMode(): RuntimeProxyMode {\n  if (startedWithEnvProxy) return 'startup';\n  return proxySettings() === undefined ? 'none' : 'runtime';\n}\n\n/** Installs the runtime proxy when needed and returns the upm tuning that keeps traffic on it. */\nfunction proxyTuning(log: RuntimePackageOptions['log']): Experimental | undefined {\n  if (startedWithEnvProxy) return undefined;\n  const settings = proxySettings();\n  if (settings === undefined) return undefined;\n  if (settings !== appliedProxySettings) {\n    if (typeof http.setGlobalProxyFromEnv === 'function') {\n      http.setGlobalProxyFromEnv();\n      appliedProxySettings = settings;\n    } else {\n      log?.('this Node.js has no http.setGlobalProxyFromEnv; start it with NODE_USE_ENV_PROXY=1', 'warn');\n    }\n  }\n  return { resolvePool: 0 };\n}\n\nexport function runtimeStoreDirectory(poHome: string): string {\n  return path.join(poHome, STORE_DIRECTORY);\n}\n\n/** Installs the dependency set `<dir>/package.json` declares. */\nexport async function installRuntimePackages(options: InstallRuntimePackagesOptions): Promise<InstallResult> {\n  // upm treats an undefined option as an absent one (verified in upm 1.4.0's dist).\n  const installOptions: InstallOptions & NpmrcFilesAccess = {\n    dir: options.dir,\n    store: runtimeStoreDirectory(options.poHome),\n    npmrcFiles: options.npmrcFiles && [...options.npmrcFiles],\n    minReleaseAge: RUNTIME_MIN_RELEASE_AGE_DAYS,\n    minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],\n    preferOffline: options.preferOffline,\n    offline: options.offline,\n    registry: options.registry,\n    log: options.log,\n    experimental: proxyTuning(options.log),\n  };\n  const { install } = await compatibleUpm();\n  return install(installOptions);\n}\n\n/** The newest version of a package that the release-age policy allows. */\nexport async function resolveNewest(name: string, options: RuntimePackageOptions): Promise<string> {\n  // upm's resolve always reads the registry on the main thread, so the runtime proxy covers it.\n  proxyTuning(options.log);\n  // upm 1.4.0's resolve keeps registry documents in `options.store` although SpecOptions does not\n  // declare it; without it they land in ~/.upm/store.\n  const specOptions: SpecOptions & StoreAccess & NpmrcFilesAccess = {\n    dir: options.dir,\n    store: runtimeStoreDirectory(options.poHome),\n    npmrcFiles: options.npmrcFiles && [...options.npmrcFiles],\n    minReleaseAge: RUNTIME_MIN_RELEASE_AGE_DAYS,\n    minReleaseAgeExclude: [...RUNTIME_MIN_RELEASE_AGE_EXCLUDE],\n    log: options.log,\n  };\n  const { resolve } = await compatibleUpm();\n  const [manifest] = await resolve([name], specOptions);\n  if (!manifest?.version) throw new Error(`The registry reported no version for ${name}.`);\n  return manifest.version;\n}\n\n/** Drops stale project entries under `dir` and store content no package index references. */\nexport async function pruneRuntimePackages(options: RuntimePackageOptions): Promise<PruneResult> {\n  const { prune } = await compatibleUpm();\n  return prune({ dir: options.dir, store: runtimeStoreDirectory(options.poHome), log: options.log });\n}\n"],"mappings":";;;;;;AAgBA,eAAe,gBAA+C;CAC5D,IAAI,YAAY,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;CAC3D,OACE,CAAE,MAAM,GAAG,OAAO,KAAK,KAAK,WAAW,cAAc,CAAC,CAAC,CAAC,WAChD,YACA,KACR,GACA;EACA,MAAM,SAAS,KAAK,QAAQ,SAAS;EACrC,IAAI,WAAW,WAAW,MAAM,IAAI,MAAM,oCAAoC;EAC9E,YAAY;CACd;CACA,OAAO,OAAO,cAAc,KAAK,KAAK,WAAW,2BAA2B,CAAC,CAAC,CAAC;AACjF;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,+BAA+B;;;;;AAK5C,MAAa,kCAAqD;CAChE;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,kBAAkB;AACxB,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;CAAC;CAAe;CAAe;CAAc;AAAY;AACjF,MAAM,qBAAqB,CAAC,YAAY,UAAU;;AAGlD,MAAM,sBACJ,QAAQ,IAAI,uBAAuB,qBACnC,QAAQ,SAAS,SAAS,cAAc,MACvC,QAAQ,IAAI,gBAAgB,GAAA,CAAI,MAAM,KAAK,CAAC,CAAC,SAAS,cAAc;;AAGvE,IAAI;AAsCJ,SAAS,gBAAoC;CAC3C,MAAM,UAAU,gBAAgB,KAAK,SAAS,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE;CAC7E,IAAI,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;CACnC,OAAO,CAAC,GAAG,SAAS,GAAG,mBAAmB,KAAK,SAAS,QAAQ,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;AACrG;AAEA,SAAgB,mBAAqC;CACnD,IAAI,qBAAqB,OAAO;CAChC,OAAO,cAAc,MAAM,KAAA,IAAY,SAAS;AAClD;;AAGA,SAAS,YAAY,KAA6D;CAChF,IAAI,qBAAqB,OAAO,KAAA;CAChC,MAAM,WAAW,cAAc;CAC/B,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,IAAI,aAAa,sBAAsB;EACrC,IAAI,OAAO,KAAK,0BAA0B,YAAY;GACpD,KAAK,sBAAsB;GAC3B,uBAAuB;EACzB,OACE,MAAM,sFAAsF,MAAM;CAEtG;CACA,OAAO,EAAE,aAAa,EAAE;AAC1B;AAEA,SAAgB,sBAAsB,QAAwB;CAC5D,OAAO,KAAK,KAAK,QAAQ,eAAe;AAC1C;;AAGA,eAAsB,uBAAuB,SAAgE;CAE3G,MAAM,iBAAoD;EACxD,KAAK,QAAQ;EACb,OAAO,sBAAsB,QAAQ,MAAM;EAC3C,YAAY,QAAQ,cAAc,CAAC,GAAG,QAAQ,UAAU;EACxD,eAAA;EACA,sBAAsB,CAAC,GAAG,+BAA+B;EACzD,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,UAAU,QAAQ;EAClB,KAAK,QAAQ;EACb,cAAc,YAAY,QAAQ,GAAG;CACvC;CACA,MAAM,EAAE,YAAY,MAAM,cAAc;CACxC,OAAO,QAAQ,cAAc;AAC/B;;AAGA,eAAsB,cAAc,MAAc,SAAiD;CAEjG,YAAY,QAAQ,GAAG;CAGvB,MAAM,cAA4D;EAChE,KAAK,QAAQ;EACb,OAAO,sBAAsB,QAAQ,MAAM;EAC3C,YAAY,QAAQ,cAAc,CAAC,GAAG,QAAQ,UAAU;EACxD,eAAA;EACA,sBAAsB,CAAC,GAAG,+BAA+B;EACzD,KAAK,QAAQ;CACf;CACA,MAAM,EAAE,YAAY,MAAM,cAAc;CACxC,MAAM,CAAC,YAAY,MAAM,QAAQ,CAAC,IAAI,GAAG,WAAW;CACpD,IAAI,CAAC,UAAU,SAAS,MAAM,IAAI,MAAM,wCAAwC,KAAK,EAAE;CACvF,OAAO,SAAS;AAClB;;AAGA,eAAsB,qBAAqB,SAAsD;CAC/F,MAAM,EAAE,UAAU,MAAM,cAAc;CACtC,OAAO,MAAM;EAAE,KAAK,QAAQ;EAAK,OAAO,sBAAsB,QAAQ,MAAM;EAAG,KAAK,QAAQ;CAAI,CAAC;AACnG"}

package/dist/vendor/upm/_chunks/main.mjs

@@ -1,4 +1,4 @@
-import{A as e,B as t,C as n,D as r,E as i,F as a,G as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,R as m,S as h,T as g,U as _,V as v,W as y,Y as b,_ as x,a as S,b as C,c as w,f as ee,g as T,j as te,k as E,l as D,o as O,p as k,q as ne,u as A,v as j,w as M,x as re,y as ie}from"./limit.mjs";import{C as N,D as ae,E as P,T as F,_ as oe,a as se,i as I,l as L,n as ce,s as le,t as ue,u as R,x as de}from"./registry.mjs";import{a as fe,i as pe,r as me,t as he}from"./unpack.mjs";import{C as z,S as ge,T as _e,_ as ve,a as ye,b as B,c as be,d as xe,f as Se,h as V,i as H,l as U,m as W,n as G,o as Ce,p as we,s as Te,t as Ee,u as De,v as Oe,w as ke,x as Ae,y as je}from"./resolve.mjs";const Me=`.npmrc`,Ne=/* @__PURE__ */ new Set([`_authtoken`,`_auth`,`username`,`_password`]),Pe=/^npm_config_/i,Fe=/(?<!\\)(\\*)\$\{([^${}?]+)(\?)?\}/g,Ie=864e5;function Le(e,t=globalThis.process?.env??{}){let n={};for(let r of e.split(/\r?\n/)){let e=r.trim();if(!e||e.startsWith(`#`)||e.startsWith(`;`)||e.startsWith(`[`))continue;let i=e.indexOf(`=`),a=i===-1?e:e.slice(0,i).trim(),o=Ke(a),s=i===-1?`true`:e.slice(i+1).trim();if(s=s.length>1&&/^(["']).*\1$/.test(s)?s.slice(1,-1):s.replace(/\s*[;#].*$/,``),Ne.has(o)&&s)throw K(`${a} in .npmrc must be keyed by its registry: //host/path/:${a}`);if(s=s.replace(Fe,(e,n,r,i)=>n.length%2?e.slice((n.length+1)/2):n.slice(n.length/2)+(t[r]??(i?``:`\${${r}}`))),o.endsWith(`[]`)){let e=o.slice(0,-2);n[e]=n[e]&&s?`${n[e]},${s}`:n[e]||s}else n[o]=s}return n}function Re(e){let t={};for(let[n,r]of Object.entries(e)){if(!Pe.test(n)||!r)continue;let e=n.slice(11),i=Ke(e.startsWith(`//`)?e:e.replace(/(?!^)_/g,`-`));Ne.has(i)||(t[i]=r)}return!t.registry&&e.UPM_REGISTRY&&(t.registry=e.UPM_REGISTRY),t}function ze(e,t){let n={};for(let t of e)for(let[e,r]of Object.entries(t))r&&(n[e]=r);let r=se(t||n.registry),i={},a=/* @__PURE__ */ new Map;for(let[e,t]of Object.entries(n))if(e.startsWith(`@`)&&e.endsWith(`:registry`))i[e.slice(0,-9)]=se(t);else if(e.startsWith(`//`)){let n=e.lastIndexOf(`:`);if(n===-1)continue;let r=e.slice(0,n);a.set(r,{...a.get(r),[e.slice(n+1)]:t})}let o={};for(let[e,t]of a){let n=Ve(t);n&&(o[e]=n)}for(let e of[r,...Object.values(i)]){let t=He(e),n=t&&ue(o,`${e}/`);t&&n&&!o[t]&&(o[t]=n)}return{registry:r,scopes:i,auth:o,saveExact:n[`save-exact`]===`true`,before:Be(e),releaseAgeExclude:[...new Set((n[`min-release-age-exclude`]??``).split(`,`).map(e=>e.trim()))].filter(Boolean),offline:n.offline===`true`,preferOffline:n[`prefer-offline`]===`true`,hoist:n.hoist!==`false`}}function Be(e){let t=Date.now()-1*Ie;for(let n of e)if(n.before){if(t=Date.parse(n.before),Number.isNaN(t))throw K(`before=${n.before} is not a date`)}else if(n[`min-release-age`]){let e=Number(n[`min-release-age`]);if(!(e>=0))throw K(`min-release-age=${n[`min-release-age`]} is not a number of days`);t=e===0?void 0:Date.now()-e*Ie}return t}function Ve(e){if(e._authtoken)return`Bearer ${e._authtoken}`;if(e._auth)return`Basic ${e._auth}`;if(e.username&&e._password){let n=new TextDecoder().decode(t(e._password));return`Basic ${ne(new TextEncoder().encode(`${e.username}:${n}`))}`}}function He(e){try{return`//${new URL(e).host}/`}catch{return}}function Ue(e,t={},n=b.os.homedir()){let r=globalThis.process?.env??{},i=Re(r),a=e=>e?.startsWith(`~/`)?b.path.join(n,e.slice(2)):e,o=Le(Ge(a(i.userconfig)||b.path.join(n,Me)),r),s=Le(Ge(a(i.globalconfig||o.globalconfig)||We(r,a(i.prefix||o.prefix))),r),c=Le(Ge(b.path.join(e,Me)),r),l={};return t.minReleaseAge!==void 0&&(l[`min-release-age`]=`${t.minReleaseAge}`),t.before!==void 0&&(l.before=t.before),t.minReleaseAgeExclude&&(l[`min-release-age-exclude`]=t.minReleaseAgeExclude.join(`,`)),t.offline!==void 0&&(l.offline=`${t.offline}`),t.preferOffline!==void 0&&(l[`prefer-offline`]=`${t.preferOffline}`),ze([s,o,c,i,l],t.registry)}function We(e,t){let{dirname:n,join:r}=b.path,i=globalThis.process.execPath;return r(t||e.PREFIX||(globalThis.process.platform===`win32`?n(i):r(e.DESTDIR??``,n(n(i)))),`etc`,`npmrc`)}function Ge(e){try{return b.fs.readFileSync(e,`utf8`)}catch{return``}}function Ke(e){if(!e.startsWith(`//`))return e.toLowerCase();let t=e.lastIndexOf(`:`);return t===-1?e:e.slice(0,t)+e.slice(t).toLowerCase()}function K(e){return Object.assign(Error(e),{code:`ECONFIG`})}const qe=he;function Je(e){return e||globalThis.process?.env.UPM_STORE||b.path.join(b.os.homedir(),`.upm`,`store`)}function q(t={}){let n=Je(t.dir),r=t.fetch??P(),o=t.auth,l=t.concurrency??32,h=t.held??67108864,g=t.stall??3e4,y=t.verify===!0,x=t.backend,C,w=()=>C??=import(`./store-backend.mjs`).then(e=>e.createBackendClient(t,D,T,g),t.backendFailed),ee=te({max:l}),T=u(d()),D=me(n),O=/* @__PURE__ */ new Map,A=/* @__PURE__ */ new Set,j=/* @__PURE__ */ new Map,M=/* @__PURE__ */ new Map,ie=/* @__PURE__ */ new Map,N=e=>{let t=M.get(e);return t===void 0&&M.set(e,t=D.indexPath(e)),t},oe,se,I=0,L=0,ce=[],le,R=e=>b.path.basename(b.path.dirname(e)).toLowerCase();function de(){try{let e=b.fs.readdirSync(b.path.join(n,`index`));return new Set(e.map(e=>e.toLowerCase()))}catch(e){if(e.code===`ENOENT`)return/* @__PURE__ */ new Set;throw fe(e,`list indexes in ${n}`)}}function he(e){return le??=de(),le.has(R(e))}function z(e){let t=j.get(e);if(t)return t;let n=ge(e);return n&&j.set(e,n),n}function ge(t){let n=D.indexPath(t);if(!he(n))return;let r,i=e?re():0;try{r=b.fs.readFileSync(n,`utf8`)}catch(n){if(e&&f(`loadIndexMiss`,re()-i),n.code===`ENOENT`)return;throw fe(n,`read index for ${t}`)}let a;try{a=JSON.parse(r)}catch{return}return k(a)&&S(a.integrity,t)?a:void 0}function _e(e){for(let t of e.files)if(i(D.blobPath(t.blob))!==t.size)return!1;return!0}async function ve(e,n,r){let i=z(r),a=y&&await import(`./verify.mjs`);if(i&&(n===void 0||Xe(i,n))&&(!a||a.sound(Ce,i.files,N(r),t.rehash)))return i;let o=Ze(i,n);if(se||ye(),x&&n===void 0){let e=await(await w())?.fetch(r,!!i);if(e)return await V(r,e)}I++,E(`miss`,{i:r,behind:I});try{let t=F();t&&await t;let n=await be(e,r,i!==void 0,o);return x?.set&&w().then(t=>t?.put(r,n,e)),n}finally{I--}}function ye(){return se??=import(`./unpack-pool.mjs`).then(({createPool:e})=>oe=e(n,{size:t.workers,concurrency:l,entry:t.workerEntry,fallback:B,noThreads:t.noThreads})).catch(()=>{t.workers!==0&&t.noThreads?.()})}async function B(e,t,n){return await pe(e,t),await T(()=>D.unpack(e,t,n))}async function be(e,t,n,r){try{return await H(e,t,n,r,!0)}catch(i){if(i.code!==`EWORKERDIED`)throw i;return await H(e,t,n,r,!1)}}async function xe(){for(;L>=h;)await new Promise(e=>ce.push(e))}function Se(e){for(L-=e;L<h&&ce.length>0;)ce.shift()()}async function V(e,t,n){n&&(t={...t,sources:n});let r=D.indexPath(e);return await D.ensureDir(b.path.dirname(r)),le?.add(R(r)),await D.put(r,new TextEncoder().encode(JSON.stringify(t)),420,!0),E(`index`,{i:e,files:t.files.length}),j.set(e,t),A.add(e),t}async function H(e,n,r,i,a,o=!1){let s=a?async e=>(oe??await ye())?.open(n,r,e):void 0,c=await ee(async t=>(await xe(),t.restart(),E(`slot`,{i:n,behind:I}),E(`pull`,{i:n,url:e}),await U(e,t,s)));L+=c.size;try{let e;if(`streamed`in c)e=await V(n,await c.streamed,i);else{let{bytes:t}=c,o=(a?oe??await ye():void 0)?.offer(n,t,r,I);E(`offer`,{i:n,behind:I,taken:!!o}),e=await V(n,await(o??B(n,t,r)),i)}return t.served?.(n,c.modified??NaN),e}catch(t){if(t.code!==`EINTEGRITY`)throw t;if(o||!(`unframed`in c&&c.unframed)){let n=`${typeof e==`string`?e:e.path}: ${t.message} (${c.size} bytes)`;throw Object.assign(Error(n),{code:`EINTEGRITY`,cause:t})}}finally{Se(c.size)}return E(`unframed`,{i:n}),await H(e,n,r,i,a,!0)}async function U(e,n,r){if(typeof e!=`string`){let t=await Qe(e.path);return{bytes:[t],size:t.byteLength}}if(t.offline)throw Object.assign(/* @__PURE__ */ Error(`offline: ${e} is not in the store`),{code:`EOFFLINE`});let i,a=0;for(let t=0;t<5;t++){t>0&&await c(a||100*2**(t-1));try{return await W(e,r)}catch(e){let{code:t,status:r,wait:o}=e;a=o??0;let s=r!==void 0&&p(r);if(!s&&(r??0)<500&&(r!==void 0||t!==`ENETWORK`&&t!==`ETIMEDOUT`))throw e;(s||t===`ETIMEDOUT`)&&n.throttled(),i=e}}throw i}async function W(e,t){let n=new AbortController,r=setTimeout(()=>n.abort(),g),i=()=>{clearTimeout(r),r=setTimeout(()=>n.abort(),g)};try{return await G(e,n.signal,i,t)}catch(t){if(typeof t?.code==`string`)throw t;let r=n.signal.aborted;throw Object.assign(/* @__PURE__ */ Error(`Tarball ${e} ${r?`went quiet for ${g} ms`:`failed`}: ${t?.message??t}`),{code:r?`ETIMEDOUT`:`ENETWORK`})}finally{clearTimeout(r)}}async function G(n,i,c,l){let u=o&&ue(o,n),d=u?{authorization:u}:void 0,f=t.fetch?void 0:ae(),m=f?await f(n,d,i):await r(n,{...d&&{headers:d},signal:i});if(m.status<200||m.status>299)throw Object.assign(/* @__PURE__ */ Error(`Tarball ${n} returned ${m.status}`),{code:m.status===404?`E404`:`ENETWORK`,status:m.status,wait:p(m.status)?a(m):0});let h=m.body;if(!h)throw Object.assign(/* @__PURE__ */ Error(`Tarball response had no body`),{code:`ENETWORK`});let g=Date.parse(m.headers.get(`last-modified`)??``),y=Number(m.headers.get(`content-length`)),b=y>=qe?await l?.(y):void 0;E(`head`,{i:n,length:y,stream:!!b});let x=0,S=[],C=[],w=0,ee=e=>b?b.push(e):S.push(e);try{for await(let t of _(h))c(),e&&x===0&&E(`first`,{i:n}),x+=t.byteLength,C.push(t),w+=t.byteLength,w>=1048576&&(ee(s(C,w)),C=[],w=0);w>0&&ee(s(C,w)),E(`last`,{i:n,bytes:x})}catch(e){throw b?.abort(),e}if(b)return{streamed:b.end(),size:x,modified:g};let T=m.headers,te=v&&!t.fetch&&T.get(`content-length`)===null&&!/chunked/i.test(T.get(`transfer-encoding`)??``);return{bytes:S,size:x,unframed:te,modified:g}}let Ce={dir:n,contentPath:D.contentPath,blobPath:e=>D.blobPath(e.blob),index:z,pending:e=>O.get(e),indexPath:N,indexSize(e){let t=ie.get(e);if(t!==void 0)return t;try{let n=N(e);t=he(n)?Math.max(0,i(n)):0}catch{return 0}return t>0&&ie.set(e,t),t},async ensure(e,t,n){let r=Ye(e,n),i=r===void 0?j.has(t)||Ce.indexSize(t)>0:Ce.vouches(r,t);(y||!i)&&await Ce.add(e,t,n)},vouches:(e,t)=>Xe(z(t),e),async add(e,t,n){let r=Ye(e,n),i=O.get(t);if(i&&r===void 0)return{index:await i,cached:!0};let a=()=>ve(e,r,t),o=(i?i.then(e=>Xe(e,r)?e:a(),a):a()).catch(e=>{throw O.delete(t),e});return O.set(t,o),{index:await o,cached:!A.has(t)}},async adopt(e){let t=F();t&&await t;let n=await ee(async t=>{let n=await U(e,t);return t.settled(),n.bytes}),r=m(`sha512`);for(let e of n)r.update(e);let i=`sha512-${ne(await r.digest())}`,a=z(i),o=Ze(a,typeof e==`string`?e:void 0);return a&&_e(a)?{index:o===a.sources?a:await V(i,a,o),integrity:i}:{index:await V(i,await B(i,n,a!==void 0),o),integrity:i}},close(){oe?.close()},async flush(){await(await C)?.flush()}};return Ce}function Ye(e,t){return t&&typeof e==`string`?e:void 0}function Xe(e,t){return Array.isArray(e?.sources)&&e.sources.includes(t)}function Ze(e,t){let n=Array.isArray(e?.sources)?e.sources:void 0;return t===void 0||n?.includes(t)?n:[...n??[],t]}async function Qe(e){try{if(!(await b.fsp.stat(e)).isFile())throw Object.assign(/* @__PURE__ */ Error(`not a regular file`),{code:`EINVAL`});return await b.fsp.readFile(e)}catch(t){let{code:n}=t;throw Object.assign(/* @__PURE__ */ Error(`Tarball ${e} cannot be read`),{code:n,cause:t})}}const $e=36e5;async function et(e,t){let n=b.path.join(e,`node_modules`,`.upm`),r={removed:0,bytes:0},i=Date.now()-$e;for(let e of await x(n)){let{name:a}=e;if(!e.isDirectory()||a.startsWith(`.`)||a===`node_modules`||t.has(a))continue;let o=b.path.join(n,a);await b.fsp.stat(o).then(e=>e.mtimeMs,()=>1/0)>i||(r.bytes+=await it(o),await ct(o,!0),r.removed++)}return r}async function tt(e){let{blobPath:t}=q({dir:e}),n=Date.now()-$e,r={blobs:0,indexes:0,bytes:0},i=b.path.join(e,`files`),a=b.path.join(e,`index`),o=await at(i),s=/* @__PURE__ */ new Set;for(let e of await at(a)){let i=(await st(e))?.files.map(e=>t(e));if(!i||!(await Promise.all(i.map(A))).every(Boolean)){await rt(e,n,r,`indexes`);continue}for(let e of i)s.add(e)}for(let e of o)s.has(e)||await rt(e,n,r,`blobs`);return await nt(i,``,n,r),await ot(i),await ot(a),r}async function nt(e,t=``,n=Date.now()-$e,r={blobs:0,indexes:0,bytes:0}){for(let i of await x(e)){let{name:a}=i;if(!i.isFile()||!a.startsWith(t)||!a.endsWith(`.tmp`))continue;let o=Number(a.slice(t.length).split(`-`)[0]);!Number.isInteger(o)||o<=0||w(o)||await rt(b.path.join(e,a),n,r,`blobs`)}}async function rt(e,t,n,r){let i=await b.fsp.stat(e).catch(()=>void 0);!i||i.mtimeMs>t||(await ct(e,!1),n[r]++,n.bytes+=i.size)}async function it(e){let t=await b.fsp.lstat(e).catch(()=>void 0);if(!t)return 0;if(!t.isDirectory())return t.nlink===1?t.blocks*512:0;let n=t.blocks*512;for(let t of await x(e))n+=await it(b.path.join(e,t.name));return n}async function at(e){let t=[];for(let n of await x(e))if(n.isDirectory())for(let r of await x(b.path.join(e,n.name)))r.isFile()&&!r.name.endsWith(`.tmp`)&&t.push(b.path.join(e,n.name,r.name));return t}async function ot(e){for(let t of await x(e))t.isDirectory()&&await b.fsp.rmdir(b.path.join(e,t.name)).catch(()=>{})}async function st(e){try{let t=JSON.parse(await b.fsp.readFile(e,`utf8`));return k(t)?t:void 0}catch{return}}async function ct(e,t){try{await b.fsp.rm(e,{recursive:t,force:!0,maxRetries:3})}catch(t){if(!await A(e))return;let{message:n}=t;throw Object.assign(/* @__PURE__ */ Error(`Cannot remove ${e}: ${n}`),{code:`EGC`})}}async function lt(e){let t=await ht(e),n={};for(let[r,i]of Object.entries(e))i.local===void 0&&(n[r]=dt(i,t.get(r)));return n}function ut(e){let{root:t,packages:n}=e,r=Object.values(n).map(ft);r.push(`::root::${pt(t.dependencies)}`);for(let e of Object.values(n))e.local!==void 0&&!e.link&&r.push(`::top:${e.local}::${pt(W(e))}`);return mt(r)}function dt(e,t){return`${e.name.replaceAll(`/`,`+`)}@${e.version}-${t}`}function ft(e){return e.local===void 0?`${e.name}@${e.version}::${e.integrity}::${pt(W(e))}`:`${e.name}@link:${e.local}::local`}function pt(e){return Object.entries(e).map(([e,t])=>`${e}@${t}`).sort().join(`,`)}function mt(e){return o([...e].sort().join(`
+import{A as e,B as t,C as n,D as r,E as i,F as a,G as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,R as m,S as h,T as g,U as _,V as v,W as y,Y as b,_ as x,a as S,b as C,c as w,f as ee,g as T,j as te,k as E,l as D,o as O,p as k,q as ne,u as A,v as j,w as M,x as re,y as ie}from"./limit.mjs";import{C as N,D as ae,E as P,T as F,_ as oe,a as se,i as I,l as L,n as ce,s as le,t as ue,u as R,x as de}from"./registry.mjs";import{a as fe,i as pe,r as me,t as he}from"./unpack.mjs";import{C as z,S as ge,T as _e,_ as ve,a as ye,b as B,c as be,d as xe,f as Se,h as V,i as H,l as U,m as W,n as G,o as Ce,p as we,s as Te,t as Ee,u as De,v as Oe,w as ke,x as Ae,y as je}from"./resolve.mjs";const Me=`.npmrc`,Ne=/* @__PURE__ */ new Set([`_authtoken`,`_auth`,`username`,`_password`]),Pe=/^npm_config_/i,Fe=/(?<!\\)(\\*)\$\{([^${}?]+)(\?)?\}/g,Ie=864e5;function Le(e,t=globalThis.process?.env??{}){let n={};for(let r of e.split(/\r?\n/)){let e=r.trim();if(!e||e.startsWith(`#`)||e.startsWith(`;`)||e.startsWith(`[`))continue;let i=e.indexOf(`=`),a=i===-1?e:e.slice(0,i).trim(),o=Ke(a),s=i===-1?`true`:e.slice(i+1).trim();if(s=s.length>1&&/^(["']).*\1$/.test(s)?s.slice(1,-1):s.replace(/\s*[;#].*$/,``),Ne.has(o)&&s)throw K(`${a} in .npmrc must be keyed by its registry: //host/path/:${a}`);if(s=s.replace(Fe,(e,n,r,i)=>n.length%2?e.slice((n.length+1)/2):n.slice(n.length/2)+(t[r]??(i?``:`\${${r}}`))),o.endsWith(`[]`)){let e=o.slice(0,-2);n[e]=n[e]&&s?`${n[e]},${s}`:n[e]||s}else n[o]=s}return n}function Re(e){let t={};for(let[n,r]of Object.entries(e)){if(!Pe.test(n)||!r)continue;let e=n.slice(11),i=Ke(e.startsWith(`//`)?e:e.replace(/(?!^)_/g,`-`));Ne.has(i)||(t[i]=r)}return!t.registry&&e.UPM_REGISTRY&&(t.registry=e.UPM_REGISTRY),t}function ze(e,t){let n={};for(let t of e)for(let[e,r]of Object.entries(t))r&&(n[e]=r);let r=se(t||n.registry),i={},a=/* @__PURE__ */ new Map;for(let[e,t]of Object.entries(n))if(e.startsWith(`@`)&&e.endsWith(`:registry`))i[e.slice(0,-9)]=se(t);else if(e.startsWith(`//`)){let n=e.lastIndexOf(`:`);if(n===-1)continue;let r=e.slice(0,n);a.set(r,{...a.get(r),[e.slice(n+1)]:t})}let o={};for(let[e,t]of a){let n=Ve(t);n&&(o[e]=n)}for(let e of[r,...Object.values(i)]){let t=He(e),n=t&&ue(o,`${e}/`);t&&n&&!o[t]&&(o[t]=n)}return{registry:r,scopes:i,auth:o,saveExact:n[`save-exact`]===`true`,before:Be(e),releaseAgeExclude:[...new Set((n[`min-release-age-exclude`]??``).split(`,`).map(e=>e.trim()))].filter(Boolean),offline:n.offline===`true`,preferOffline:n[`prefer-offline`]===`true`,hoist:n.hoist!==`false`}}function Be(e){let t=Date.now()-1*Ie;for(let n of e)if(n.before){if(t=Date.parse(n.before),Number.isNaN(t))throw K(`before=${n.before} is not a date`)}else if(n[`min-release-age`]){let e=Number(n[`min-release-age`]);if(!(e>=0))throw K(`min-release-age=${n[`min-release-age`]} is not a number of days`);t=e===0?void 0:Date.now()-e*Ie}return t}function Ve(e){if(e._authtoken)return`Bearer ${e._authtoken}`;if(e._auth)return`Basic ${e._auth}`;if(e.username&&e._password){let n=new TextDecoder().decode(t(e._password));return`Basic ${ne(new TextEncoder().encode(`${e.username}:${n}`))}`}}function He(e){try{return`//${new URL(e).host}/`}catch{return}}function Ue(e,t={},n=b.os.homedir()){let r=globalThis.process?.env??{},i=Re(r),a=e=>e?.startsWith(`~/`)?b.path.join(n,e.slice(2)):e,o=Le(Ge(a(i.userconfig)||b.path.join(n,Me)),r),s=Le(Ge(a(i.globalconfig||o.globalconfig)||We(r,a(i.prefix||o.prefix))),r),c=Le(Ge(b.path.join(e,Me)),r),poNpmrcFiles=(t.npmrcFiles??[]).map(f=>Le(Ge(f),r)),l={};return t.minReleaseAge!==void 0&&(l[`min-release-age`]=`${t.minReleaseAge}`),t.before!==void 0&&(l.before=t.before),t.minReleaseAgeExclude&&(l[`min-release-age-exclude`]=t.minReleaseAgeExclude.join(`,`)),t.offline!==void 0&&(l.offline=`${t.offline}`),t.preferOffline!==void 0&&(l[`prefer-offline`]=`${t.preferOffline}`),ze([s,o,...poNpmrcFiles,c,i,l],t.registry)}function We(e,t){let{dirname:n,join:r}=b.path,i=globalThis.process.execPath;return r(t||e.PREFIX||(globalThis.process.platform===`win32`?n(i):r(e.DESTDIR??``,n(n(i)))),`etc`,`npmrc`)}function Ge(e){try{return b.fs.readFileSync(e,`utf8`)}catch{return``}}function Ke(e){if(!e.startsWith(`//`))return e.toLowerCase();let t=e.lastIndexOf(`:`);return t===-1?e:e.slice(0,t)+e.slice(t).toLowerCase()}function K(e){return Object.assign(Error(e),{code:`ECONFIG`})}const qe=he;function Je(e){return e||globalThis.process?.env.UPM_STORE||b.path.join(b.os.homedir(),`.upm`,`store`)}function q(t={}){let n=Je(t.dir),r=t.fetch??P(),o=t.auth,l=t.concurrency??32,h=t.held??67108864,g=t.stall??3e4,y=t.verify===!0,x=t.backend,C,w=()=>C??=import(`./store-backend.mjs`).then(e=>e.createBackendClient(t,D,T,g),t.backendFailed),ee=te({max:l}),T=u(d()),D=me(n),O=/* @__PURE__ */ new Map,A=/* @__PURE__ */ new Set,j=/* @__PURE__ */ new Map,M=/* @__PURE__ */ new Map,ie=/* @__PURE__ */ new Map,N=e=>{let t=M.get(e);return t===void 0&&M.set(e,t=D.indexPath(e)),t},oe,se,I=0,L=0,ce=[],le,R=e=>b.path.basename(b.path.dirname(e)).toLowerCase();function de(){try{let e=b.fs.readdirSync(b.path.join(n,`index`));return new Set(e.map(e=>e.toLowerCase()))}catch(e){if(e.code===`ENOENT`)return/* @__PURE__ */ new Set;throw fe(e,`list indexes in ${n}`)}}function he(e){return le??=de(),le.has(R(e))}function z(e){let t=j.get(e);if(t)return t;let n=ge(e);return n&&j.set(e,n),n}function ge(t){let n=D.indexPath(t);if(!he(n))return;let r,i=e?re():0;try{r=b.fs.readFileSync(n,`utf8`)}catch(n){if(e&&f(`loadIndexMiss`,re()-i),n.code===`ENOENT`)return;throw fe(n,`read index for ${t}`)}let a;try{a=JSON.parse(r)}catch{return}return k(a)&&S(a.integrity,t)?a:void 0}function _e(e){for(let t of e.files)if(i(D.blobPath(t.blob))!==t.size)return!1;return!0}async function ve(e,n,r){let i=z(r),a=y&&await import(`./verify.mjs`);if(i&&(n===void 0||Xe(i,n))&&(!a||a.sound(Ce,i.files,N(r),t.rehash)))return i;let o=Ze(i,n);if(se||ye(),x&&n===void 0){let e=await(await w())?.fetch(r,!!i);if(e)return await V(r,e)}I++,E(`miss`,{i:r,behind:I});try{let t=F();t&&await t;let n=await be(e,r,i!==void 0,o);return x?.set&&w().then(t=>t?.put(r,n,e)),n}finally{I--}}function ye(){return se??=import(`./unpack-pool.mjs`).then(({createPool:e})=>oe=e(n,{size:t.workers,concurrency:l,entry:t.workerEntry,fallback:B,noThreads:t.noThreads})).catch(()=>{t.workers!==0&&t.noThreads?.()})}async function B(e,t,n){return await pe(e,t),await T(()=>D.unpack(e,t,n))}async function be(e,t,n,r){try{return await H(e,t,n,r,!0)}catch(i){if(i.code!==`EWORKERDIED`)throw i;return await H(e,t,n,r,!1)}}async function xe(){for(;L>=h;)await new Promise(e=>ce.push(e))}function Se(e){for(L-=e;L<h&&ce.length>0;)ce.shift()()}async function V(e,t,n){n&&(t={...t,sources:n});let r=D.indexPath(e);return await D.ensureDir(b.path.dirname(r)),le?.add(R(r)),await D.put(r,new TextEncoder().encode(JSON.stringify(t)),420,!0),E(`index`,{i:e,files:t.files.length}),j.set(e,t),A.add(e),t}async function H(e,n,r,i,a,o=!1){let s=a?async e=>(oe??await ye())?.open(n,r,e):void 0,c=await ee(async t=>(await xe(),t.restart(),E(`slot`,{i:n,behind:I}),E(`pull`,{i:n,url:e}),await U(e,t,s)));L+=c.size;try{let e;if(`streamed`in c)e=await V(n,await c.streamed,i);else{let{bytes:t}=c,o=(a?oe??await ye():void 0)?.offer(n,t,r,I);E(`offer`,{i:n,behind:I,taken:!!o}),e=await V(n,await(o??B(n,t,r)),i)}return t.served?.(n,c.modified??NaN),e}catch(t){if(t.code!==`EINTEGRITY`)throw t;if(o||!(`unframed`in c&&c.unframed)){let n=`${typeof e==`string`?e:e.path}: ${t.message} (${c.size} bytes)`;throw Object.assign(Error(n),{code:`EINTEGRITY`,cause:t})}}finally{Se(c.size)}return E(`unframed`,{i:n}),await H(e,n,r,i,a,!0)}async function U(e,n,r){if(typeof e!=`string`){let t=await Qe(e.path);return{bytes:[t],size:t.byteLength}}if(t.offline)throw Object.assign(/* @__PURE__ */ Error(`offline: ${e} is not in the store`),{code:`EOFFLINE`});let i,a=0;for(let t=0;t<5;t++){t>0&&await c(a||100*2**(t-1));try{return await W(e,r)}catch(e){let{code:t,status:r,wait:o}=e;a=o??0;let s=r!==void 0&&p(r);if(!s&&(r??0)<500&&(r!==void 0||t!==`ENETWORK`&&t!==`ETIMEDOUT`))throw e;(s||t===`ETIMEDOUT`)&&n.throttled(),i=e}}throw i}async function W(e,t){let n=new AbortController,r=setTimeout(()=>n.abort(),g),i=()=>{clearTimeout(r),r=setTimeout(()=>n.abort(),g)};try{return await G(e,n.signal,i,t)}catch(t){if(typeof t?.code==`string`)throw t;let r=n.signal.aborted;throw Object.assign(/* @__PURE__ */ Error(`Tarball ${e} ${r?`went quiet for ${g} ms`:`failed`}: ${t?.message??t}`),{code:r?`ETIMEDOUT`:`ENETWORK`})}finally{clearTimeout(r)}}async function G(n,i,c,l){let u=o&&ue(o,n),d=u?{authorization:u}:void 0,f=t.fetch?void 0:ae(),m=f?await f(n,d,i):await r(n,{...d&&{headers:d},signal:i});if(m.status<200||m.status>299)throw Object.assign(/* @__PURE__ */ Error(`Tarball ${n} returned ${m.status}`),{code:m.status===404?`E404`:`ENETWORK`,status:m.status,wait:p(m.status)?a(m):0});let h=m.body;if(!h)throw Object.assign(/* @__PURE__ */ Error(`Tarball response had no body`),{code:`ENETWORK`});let g=Date.parse(m.headers.get(`last-modified`)??``),y=Number(m.headers.get(`content-length`)),b=y>=qe?await l?.(y):void 0;E(`head`,{i:n,length:y,stream:!!b});let x=0,S=[],C=[],w=0,ee=e=>b?b.push(e):S.push(e);try{for await(let t of _(h))c(),e&&x===0&&E(`first`,{i:n}),x+=t.byteLength,C.push(t),w+=t.byteLength,w>=1048576&&(ee(s(C,w)),C=[],w=0);w>0&&ee(s(C,w)),E(`last`,{i:n,bytes:x})}catch(e){throw b?.abort(),e}if(b)return{streamed:b.end(),size:x,modified:g};let T=m.headers,te=v&&!t.fetch&&T.get(`content-length`)===null&&!/chunked/i.test(T.get(`transfer-encoding`)??``);return{bytes:S,size:x,unframed:te,modified:g}}let Ce={dir:n,contentPath:D.contentPath,blobPath:e=>D.blobPath(e.blob),index:z,pending:e=>O.get(e),indexPath:N,indexSize(e){let t=ie.get(e);if(t!==void 0)return t;try{let n=N(e);t=he(n)?Math.max(0,i(n)):0}catch{return 0}return t>0&&ie.set(e,t),t},async ensure(e,t,n){let r=Ye(e,n),i=r===void 0?j.has(t)||Ce.indexSize(t)>0:Ce.vouches(r,t);(y||!i)&&await Ce.add(e,t,n)},vouches:(e,t)=>Xe(z(t),e),async add(e,t,n){let r=Ye(e,n),i=O.get(t);if(i&&r===void 0)return{index:await i,cached:!0};let a=()=>ve(e,r,t),o=(i?i.then(e=>Xe(e,r)?e:a(),a):a()).catch(e=>{throw O.delete(t),e});return O.set(t,o),{index:await o,cached:!A.has(t)}},async adopt(e){let t=F();t&&await t;let n=await ee(async t=>{let n=await U(e,t);return t.settled(),n.bytes}),r=m(`sha512`);for(let e of n)r.update(e);let i=`sha512-${ne(await r.digest())}`,a=z(i),o=Ze(a,typeof e==`string`?e:void 0);return a&&_e(a)?{index:o===a.sources?a:await V(i,a,o),integrity:i}:{index:await V(i,await B(i,n,a!==void 0),o),integrity:i}},close(){oe?.close()},async flush(){await(await C)?.flush()}};return Ce}function Ye(e,t){return t&&typeof e==`string`?e:void 0}function Xe(e,t){return Array.isArray(e?.sources)&&e.sources.includes(t)}function Ze(e,t){let n=Array.isArray(e?.sources)?e.sources:void 0;return t===void 0||n?.includes(t)?n:[...n??[],t]}async function Qe(e){try{if(!(await b.fsp.stat(e)).isFile())throw Object.assign(/* @__PURE__ */ Error(`not a regular file`),{code:`EINVAL`});return await b.fsp.readFile(e)}catch(t){let{code:n}=t;throw Object.assign(/* @__PURE__ */ Error(`Tarball ${e} cannot be read`),{code:n,cause:t})}}const $e=36e5;async function et(e,t){let n=b.path.join(e,`node_modules`,`.upm`),r={removed:0,bytes:0},i=Date.now()-$e;for(let e of await x(n)){let{name:a}=e;if(!e.isDirectory()||a.startsWith(`.`)||a===`node_modules`||t.has(a))continue;let o=b.path.join(n,a);await b.fsp.stat(o).then(e=>e.mtimeMs,()=>1/0)>i||(r.bytes+=await it(o),await ct(o,!0),r.removed++)}return r}async function tt(e){let{blobPath:t}=q({dir:e}),n=Date.now()-$e,r={blobs:0,indexes:0,bytes:0},i=b.path.join(e,`files`),a=b.path.join(e,`index`),o=await at(i),s=/* @__PURE__ */ new Set;for(let e of await at(a)){let i=(await st(e))?.files.map(e=>t(e));if(!i||!(await Promise.all(i.map(A))).every(Boolean)){await rt(e,n,r,`indexes`);continue}for(let e of i)s.add(e)}for(let e of o)s.has(e)||await rt(e,n,r,`blobs`);return await nt(i,``,n,r),await ot(i),await ot(a),r}async function nt(e,t=``,n=Date.now()-$e,r={blobs:0,indexes:0,bytes:0}){for(let i of await x(e)){let{name:a}=i;if(!i.isFile()||!a.startsWith(t)||!a.endsWith(`.tmp`))continue;let o=Number(a.slice(t.length).split(`-`)[0]);!Number.isInteger(o)||o<=0||w(o)||await rt(b.path.join(e,a),n,r,`blobs`)}}async function rt(e,t,n,r){let i=await b.fsp.stat(e).catch(()=>void 0);!i||i.mtimeMs>t||(await ct(e,!1),n[r]++,n.bytes+=i.size)}async function it(e){let t=await b.fsp.lstat(e).catch(()=>void 0);if(!t)return 0;if(!t.isDirectory())return t.nlink===1?t.blocks*512:0;let n=t.blocks*512;for(let t of await x(e))n+=await it(b.path.join(e,t.name));return n}async function at(e){let t=[];for(let n of await x(e))if(n.isDirectory())for(let r of await x(b.path.join(e,n.name)))r.isFile()&&!r.name.endsWith(`.tmp`)&&t.push(b.path.join(e,n.name,r.name));return t}async function ot(e){for(let t of await x(e))t.isDirectory()&&await b.fsp.rmdir(b.path.join(e,t.name)).catch(()=>{})}async function st(e){try{let t=JSON.parse(await b.fsp.readFile(e,`utf8`));return k(t)?t:void 0}catch{return}}async function ct(e,t){try{await b.fsp.rm(e,{recursive:t,force:!0,maxRetries:3})}catch(t){if(!await A(e))return;let{message:n}=t;throw Object.assign(/* @__PURE__ */ Error(`Cannot remove ${e}: ${n}`),{code:`EGC`})}}async function lt(e){let t=await ht(e),n={};for(let[r,i]of Object.entries(e))i.local===void 0&&(n[r]=dt(i,t.get(r)));return n}function ut(e){let{root:t,packages:n}=e,r=Object.values(n).map(ft);r.push(`::root::${pt(t.dependencies)}`);for(let e of Object.values(n))e.local!==void 0&&!e.link&&r.push(`::top:${e.local}::${pt(W(e))}`);return mt(r)}function dt(e,t){return`${e.name.replaceAll(`/`,`+`)}@${e.version}-${t}`}function ft(e){return e.local===void 0?`${e.name}@${e.version}::${e.integrity}::${pt(W(e))}`:`${e.name}@link:${e.local}::local`}function pt(e){return Object.entries(e).map(([e,t])=>`${e}@${t}`).sort().join(`,`)}function mt(e){return o([...e].sort().join(`
 `))}async function ht(e){let t=_t(e),n=/* @__PURE__ */ new Map;for(let r of gt(t)){let i=await Promise.all(r.map(r=>{let i=r.map(t=>ft(e[t]));for(let e of r)for(let r of t.get(e)??[]){let e=n.get(r);e!==void 0&&i.push(`>${e}`)}return mt(i)}));r.forEach((e,t)=>{for(let r of e)n.set(r,i[t])})}return n}function gt(e){let t=/* @__PURE__ */ new Map,n=[];for(let r of vt(e)){let i=0;for(let n of r)for(let r of e.get(n)??[]){let e=t.get(r);e!==void 0&&(i=Math.max(i,e+1))}for(let e of r)t.set(e,i);(n[i]??=[]).push(r)}return n}function _t(e){let t=/* @__PURE__ */ new Map;for(let[n,r]of Object.entries(e)){let i=[];if(r.local!==void 0){t.set(n,i);continue}for(let[t,n]of Object.entries(W(r)))`${t}@${n}`in e&&i.push(`${t}@${n}`);t.set(n,i)}return t}function vt(e){let t=/* @__PURE__ */ new Map,n=/* @__PURE__ */ new Map,r=/* @__PURE__ */ new Set,i=[],a=[],o=0;for(let s of e.keys()){if(t.has(s))continue;let c=[[s,0]];for(;c.length>0;){let s=c.at(-1),[l,u]=s;u===0&&(t.set(l,o),n.set(l,o++),i.push(l),r.add(l));let d=e.get(l)??[];if(u<d.length){s[1]++;let e=d[u];t.has(e)?r.has(e)&&n.set(l,Math.min(n.get(l),t.get(e))):c.push([e,0]);continue}c.pop();let f=c.at(-1)?.[0];if(f!==void 0&&n.set(f,Math.min(n.get(f),n.get(l))),n.get(l)!==t.get(l))continue;let p=[],m;do m=i.pop(),r.delete(m),p.push(m);while(m!==l);a.push(p)}}return a}function J(e){try{let{size:t,mtimeNs:n,ctimeNs:r,ino:i}=b.fs.statSync(e,{bigint:!0});return[String(t),String(n),String(r),String(i)]}catch{return}}function yt(e,t){return e!==void 0&&t!==void 0&&e.every((e,n)=>e===t[n])}function bt(e){let t=xt(e),n=e.workspaces?.length?`${JSON.stringify(e.workspaces)}\n`:``,r=e.pnpm===void 0?``:`${JSON.stringify(e.pnpm)}\n`,i=JSON.stringify(e.manifest);return o(`upm-inputs-1\n${i}\n${n}${r}${t}\n${e.lock}`)}function xt(e){let{production:t,store:n,hoist:r,hosts:i,platform:a}=e;return JSON.stringify([t,b.path.resolve(n),r,i,a])}async function St(e,t){let n=[`upm-state-1`,await ut(e),`production:${+!!t.production}`,`hoist:${t.hoist===!1?0:1}`,`store:${b.path.resolve(t.store)}`];for(let t of Object.keys(e.packages).sort()){let r=e.packages[t],i=Object.entries(r.bin).sort().flat().join(`,`);if(r.local!==void 0){n.push(`${t}:local:${r.local}:${i}${r.link&&r.dev?`:d`:``}`);continue}n.push(`${t}:${r.integrity}:${i}:${r.dev?`d`:``}${r.optional?`o`:``}`)}return o(n.join(`
 `))}function Ct(e){return b.path.join(e,`node_modules`,`.upm.json`)}async function wt(e){let t;try{t=b.fs.readFileSync(Ct(e),`utf8`)}catch{return}try{let e=JSON.parse(t);return jt(e)?e:void 0}catch{return}}async function Tt(e,t){await kt(Ct(e),`${JSON.stringify(t,void 0,2)}\n`)}function Et(e){return b.path.join(e,`node_modules`,`.upm.lock`)}function Dt(e){try{return b.fs.readFileSync(Et(e),`utf8`)}catch{return}}async function Ot(e,t){await kt(Et(e),t)}async function kt(e,t){let n=`${e}.${y}-${globalThis.crypto.randomUUID()}.tmp`;try{await b.fsp.mkdir(b.path.dirname(e),{recursive:!0}),await b.fsp.writeFile(n,t),await M(n,e)}catch(t){throw await b.fsp.rm(n,{force:!0}),It(`cannot write ${e}: ${t.message}`)}}async function At(e){try{await b.fsp.rm(Ct(e),{force:!0})}catch(t){throw It(`cannot remove ${Ct(e)}: ${t.message}`)}}function jt(e){let t=e;return typeof t==`object`&&!!t&&t.version===1&&typeof t.hash==`string`&&typeof t.store==`string`&&typeof t.complete==`boolean`&&Array.isArray(t.entries)&&t.entries.every(e=>typeof e==`string`)&&(t.missing===void 0||Array.isArray(t.missing)&&t.missing.every(e=>typeof e==`string`))&&(t.inputs===void 0||typeof t.inputs==`string`&&typeof t.summary?.packages==`number`&&typeof t.summary.otherPlatforms==`number`&&Array.isArray(t.summary.warnings)&&t.summary.warnings.every(e=>typeof e==`string`)&&Mt(t.tops??{})&&[t.root,...Object.values(t.tops??{})].every(Nt)&&(t.stamps===void 0||Pt(t.stamps.lock)&&Pt(t.stamps.manifest)&&typeof t.stamps.settings==`string`))&&(t.tarballs===void 0||Mt(t.tarballs)&&Object.values(t.tarballs).every(e=>e===null||Ft(e)))&&(t.links===void 0||Mt(t.links)&&Object.values(t.links).every(e=>e===null||Pt(e)))}function Mt(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function Nt(e){let t=e;return Mt(t?.links)&&Object.values(t.links).every(e=>typeof e==`string`)&&Array.isArray(t.bins)&&t.bins.every(e=>typeof e==`string`)}function Pt(e){return Array.isArray(e)&&e.length===4&&e.every(e=>typeof e==`string`)}function Ft(e){return Array.isArray(e)&&e.length<6&&Pt(e.slice(0,4))&&Pt(e.slice(-4))}function It(e){return Object.assign(Error(e),{code:`ESTATE`})}function Lt(e){return{name:e.fetchName??e.name,version:e.version}}const Rt=globalThis.process?.platform===`win32`,zt=/* @__PURE__ */ new Set([`EXDEV`,`EPERM`,`ENOSYS`,`EOPNOTSUPP`,`ENOTSUP`,`EACCES`]);let Bt=``,Vt=0;function Ht(){return Bt||=globalThis.crypto.randomUUID().slice(0,8)}async function Ut(e,t){let{store:n}=t,{dirname:r,join:i,normalize:a,relative:o,sep:s}=b.path,c=/* @__PURE__ */ new Map,l=/* @__PURE__ */ new Map,{lstat:d,mkdir:f,readdir:p,realpath:m,rename:_,rm:v,rmdir:S,stat:ee,utimes:T}=b.fsp,{copyFileSync:te,linkSync:D,unlinkSync:O}=b.fs,k=`..${s}`,ne=u(t.concurrency??16),M=i(t.dir,`node_modules`,`.upm`),re=t.production===!0,N=t.hoist!==!1,ae=t.hash??await St(e,{production:re,store:n.dir,hoist:N}),P={entries:0,linked:0,copied:0,reused:0,repaired:0,pooled:0,bins:0,removed:0,dropped:[],upToDate:!1},F=Wt(t.dir,e),oe=await wt(t.dir);E(`link:state`);let se=Object.create(null),{inputs:I}=t,L=(e,r,{"":i,...a},o)=>({version:1,hash:ae,entries:e,complete:r,...o?.length&&{missing:o},store:b.path.resolve(n.dir),...re&&{production:!0},...t.tarballs&&{tarballs:t.tarballs},...t.links&&{links:t.links},...I&&{inputs:I.hash,summary:{packages:I.packages,otherPlatforms:I.otherPlatforms,warnings:I.warnings},root:i,...F.length>1&&{tops:a},...I.stamps&&{stamps:I.stamps}},workspaces:t.workspaces}),ce=async n=>{if(t.verify||n?.hash!==ae||!n.complete)return;let r=await Gt(t.dir,M,F,e,n,re,N);if(!r)return;let i=I&&n.inputs!==I.hash,a=JSON.stringify(n.tarballs)!==JSON.stringify(t.tarballs)||JSON.stringify(n.links)!==JSON.stringify(t.links),o=JSON.stringify(n.workspaces)!==JSON.stringify(t.workspaces);(i||a||o)&&await Tt(t.dir,L(n.entries,!0,r,n.missing));let s=n.missing??[];return{...P,reused:n.entries.length,upToDate:!0,dropped:s}},le=await ce(oe);if(E(`link:standing`),le)return le;if(await t.hold?.()){let e=await ce(await wt(t.dir));if(e)return e}await At(t.dir);let ue=await lt(e.packages);E(`link:keys`);let R=/* @__PURE__ */ new Map,de=[],fe=!1,pe=new Set(Object.entries(e.root.dependencies).map(([e,t])=>`${e}@${t}`));for(let t of Object.values(e.packages)){if(t.local===void 0)continue;let e=t.specs?.devDependencies??{};for(let[n,r]of Object.entries(W(t)))(!Object.hasOwn(t.peers??{},n)||Object.hasOwn(e,n))&&pe.add(`${n}@${r}`)}function me(t){let n=e.packages[t];return n.source??n.fetchName??n.name}function he(t){let n={};for(let[r,i]of Object.entries(W(t))){let a=`${r}@${i}`,o=e.packages[a];if(!o||o.local!==void 0)continue;let s=me(a);(Object.hasOwn(t.peers??{},r)?s===r:t.local===void 0)&&(n[r]=s)}return n}let z=/* @__PURE__ */ new Map,ge;for(let[t,n]of Object.entries(e.packages)){if(!n.peers)continue;let r=W(n);for(let i of Object.keys(n.peers)){let n=`${i}@${r[i]}`,a=e.packages[n];if(!a||a.local!==void 0||me(n)===i)continue;let o=z.get(t);o||z.set(t,o={}),o[i]=n}}for(let[t,n]of Object.entries(e.packages)){let e=n.local!==void 0&&j({},he(n));if(e)throw Y(`${t} cannot be installed: ${e}`,`EMISMATCH`)}for(let[t,r]of Object.entries(e.packages)){if(r.local!==void 0||re&&r.dev)continue;let e=ue[t];if(!e)continue;let a;R.set(t,{pkg:r,key:e,bytes:0,home:i(e,`node_modules`,r.name),get index(){let e=n.index(r.integrity);if(!e)throw Y(`${t} is not in the store at ${n.dir}`,`ELINK`);if(a===e)return e;let i=(r.source===void 0?C(e,Lt(r)):void 0)??ie(e,n.blobPath,he(r),de);if(i)throw Y(`${t} cannot be installed: ${i}`,`EMISMATCH`);return a=e,e}})}E(`link:entries`);let _e=i(n.dir,`files`),ve=await f(F[0].nm,{recursive:!0})!==void 0;await f(M,{recursive:!0});let ye=new Set(await p(M)),B=/* @__PURE__ */ new Map,be=[],xe=0;for(let[e,r]of R)B.set(e,(async()=>{await t.awaiting?.(r.pkg.integrity)?.catch(()=>{});let{pkg:i}=r,a=nn(i)&&!n.vouches(i.resolved,i.integrity)?0:n.indexSize(i.integrity);if(a===0||i.optional&&!n.index(i.integrity)){if(!i.optional)throw Y(`${e} is not in the store at ${n.dir}`,`ELINK`);be.push(i.integrity),P.dropped.push(e),R.delete(e);return}r.bytes=a,t.awaiting&&!ye.has(r.key)&&(xe+=r.index.files.length)})());for(let e of B.values())e.catch(()=>{});t.awaiting||await Promise.all(B.values()),E(`link:indexes`);let Se=-1,V=()=>{if(t.awaiting)return Se=xe;let e=0;for(let t of R.values())ye.has(t.key)||(e+=t.index.files.length);return e},H,U,G=[],Ce=0,we=R.size;if(await Promise.all([...R].map(([e,n])=>ne(async()=>{if(await B.get(e),!R.has(e)){t.onProgress?.({phase:`link`,done:Ce,total:--we});return}for(let[e,t]of Object.entries(W(n.pkg)))e!==n.pkg.name&&await B.get(`${e}@${t}`);z.has(e)&&await ke(e,n),H||=((!U||t.awaiting&&xe!==Se)&&(U=t.pool?.(V)??Promise.resolve(void 0)),await U),!(G.length>0)&&(await Ae(n),t.onProgress?.({phase:`link`,done:++Ce,total:we}))}).catch(e=>void G.push(e)))),G.length>0)throw G[0];E(`link:materialized`),H?.close();for(let t of z.keys())e.packages[t].local!==void 0&&await ke(t);let Te=await m(t.dir);if(await Qt([...F.map(async(e,t)=>{await K(r(e.nm)),await K(e.nm),await qe(e,t===0&&ve)}),Je()]),E(`link:tops`),await Fe(),E(`link:swept`),P.dropped.sort(),await Tt(t.dir,L([...new Set([...R.values()].map(e=>e.key))].sort(),be.every(e=>t.final?.has(e)),se,P.dropped)),E(`link:statewritten`),de.length>0){let{keepAliases:e}=await import(`./index-upgrade.mjs`);for(let t of de)e(n.indexPath(t.integrity),t)}return P;function Ee(e){return i(M,e.home)}function De(e,t){return`${k}${k}${e.includes(`/`)?k:``}${t.home}`}function Oe(t){let n=[];for(let[r,i]of Object.entries(W(t))){let a=`${r}@${i}`;if(e.packages[a]?.local!==void 0)throw Y(`${t.name}@${t.version} depends on the workspace ${r}`,`ELINK`);let o=R.get(a);o&&r!==t.name&&n.push([r,o])}return n}async function ke(t,r){ge??=import(`./vouch.mjs`).then(t=>t.vouched(pe,e.packages,e=>R.has(e),n,()=>Promise.all(B.values())));let i=await(await ge)(z.get(t),r?.index);if(i)throw Y(`${t} cannot be installed: ${i}`,`EMISMATCH`)}async function Ae(e){let t=i(M,e.key);if(ye.has(e.key)){let r=Oe(e.pkg),a=Ee(e),o=await Me(e,e=>i(a,e.path))||(await import(`./verify.mjs`)).sized(e.index.files,a);if(!o&&!await Me(e,n.blobPath))throw Y(`${e.pkg.name}@${e.pkg.version} is damaged in ${n.dir}`,`ELINK`);if(o&&await je(e,r)){P.reused++;let e=/* @__PURE__ */ new Date;await T(t,e,e).catch(()=>{});let n=i(t,`node_modules`);await q(n,new Set(r.map(([e])=>e))),await q(i(n,`.bin`),new Set(Ue(r,n).keys()));return}await Ne(e,t)?P.repaired++:P.reused++;return}let r=Pe();try{let n=await Ie(e,r,t);await _(r,t),P.entries++,n&&P.pooled++}catch(e){if(await v(r,{recursive:!0,force:!0}),!await A(t))throw e;P.reused++}}async function je(e,r){let a=i(M,e.key,`node_modules`);if(e.index.files.length===0&&!Jt(i(a,e.pkg.name)))return!1;if(t.verify){let{placed:t}=await import(`./verify.mjs`);if(!t(n,e.index.files,i(M,e.home)))return!1}if(!await $t(r.map(async([e,t])=>await h(i(a,e))===De(e,t))))return!1;let s=i(a,`.bin`),c=Ue(r,a),l=Rt&&await import(`./shim.mjs`);return l?await l.shimsStand(s,await Ge(c,s)):await $t([...c].map(async([e,t])=>await h(i(s,e))===o(s,t.to)))}async function Me(e,t){return await $t(e.index.files.map(async e=>await g(t(e))===e.size))}async function Ne(e,t){let n=Pe(),r=Pe(),i=!1;try{i=await Ie(e,n,t)}catch(e){throw await v(n,{recursive:!0,force:!0}),e}let a=await _(t,r).then(()=>!0,()=>!1);try{await _(n,t)}catch(e){if(await v(n,{recursive:!0,force:!0}),await A(t))return await v(r,{recursive:!0,force:!0}),!1;throw a&&await _(r,t).catch(()=>{}),e}return await v(r,{recursive:!0,force:!0}),i&&P.pooled++,!0}function Pe(){return`${M}${s}.tmp-${y}-${Ht()}-${Vt++}`}async function Fe(){let e=Date.now()-36e5;for(let t of await x(M)){if(!t.isDirectory()||!t.name.startsWith(`.tmp-`))continue;let n=Number(t.name.split(`-`)[1]);if(!Number.isInteger(n)||n<=0||w(n))continue;let r=i(M,t.name),a=await ee(r).catch(()=>void 0);!a||a.mtimeMs>e||(await v(r,{recursive:!0,force:!0}),P.removed++)}}async function Ie(e,t,n){let r=H;if(r){let a=i(n,`node_modules`),o=Rt?Ue(Oe(e.pkg),a):void 0,s=o&&await Ge(o,i(a,`.bin`)),[c,l]=Le(e,t,r.size,s),u=c.map(e=>r.run(e));if(!u.includes(void 0)){let e=await Promise.allSettled(u),n=!1;for(let t of e)if(t.status!==`fulfilled`){if(t.reason.code!==`EWORKERDIED`)throw t.reason;n=!0}if(!n){for(let t of e)P.linked+=t.value.linked,P.copied+=t.value.copied;return P.bins+=l,!0}await v(t,{recursive:!0,force:!0})}}return await ze(e,t,n),!1}function Le(e,t,r,i){let{pkg:a}=e,o=`${t}${s}node_modules`,c=`${o}${s}${a.name}`,l=[t,o],u=a.name.indexOf(`/`),d=u===-1?``:a.name.slice(0,u);d&&l.push(`${o}${s}${d}`),l.push(c);let f=Oe(a),p=[],m=[];for(let[e]of f){let t=e.indexOf(`/`);if(t!==-1&&e.slice(0,t)!==d){let n=`${o}${s}${e.slice(0,t)}`;p.includes(n)||p.push(n)}}for(let[e,t]of f)m.push(De(e,t),`${o}${s}${e}`);let h=We(f),g=`${o}${s}.bin`;for(let[e,t]of h)m.push(t,`${g}${s}${e}`);let _=[];for(let[e,t]of i??[])for(let[n,r]of t)_.push(`${g}${s}${e}${n}`,r);let v=h.size+(i?.size??0);if(v>0&&p.push(g),e.bytes<=41090)return[[{dirs:[...l,...p],dir:c,paths:[],blobDir:_e,blobs:[],symlinks:m,shims:_,index:n.indexPath(a.integrity),integrity:a.integrity,...a.source===void 0&&{want:Lt(a)},edges:he(a)}],v];let{index:y}=e,b=(e,t)=>({dirs:[...l,...t?p:[],...Re(e).map(e=>`${c}${s}${e}`)],dir:c,paths:e.map(e=>e.path),blobDir:_e,blobs:e.map(e=>e.blob),symlinks:t?m:[],shims:t?_:[]}),x=Math.min(r,Math.ceil(y.files.length/256));if(x<=1)return[[b(y.files,!0)],v];let S=/* @__PURE__ */ new Map;for(let e of y.files){let t=e.path.slice(0,e.path.lastIndexOf(`/`)+1),n=S.get(t);n?n.push(e):S.set(t,[e])}let C=Array.from({length:x},()=>[]);for(let e of[...S.values()].sort((e,t)=>t.length-e.length)){let t=C[0];for(let e of C)e.length<t.length&&(t=e);t.push(...e)}return[C.filter(e=>e.length>0).map((e,t)=>b(e,t===0)),v]}function Re(e){let t=[];for(let{path:n}of e){let e=0;for(let r=n.indexOf(`/`);r!==-1;r=n.indexOf(`/`,r+1))(t[e++]??=/* @__PURE__ */ new Set).add(n.slice(0,r))}return t.flatMap(e=>[...e])}async function ze(e,t,n){let{pkg:r,index:a}=e,o=i(t,`node_modules`);await Be(a,i(o,r.name));let c=Oe(r),l=/* @__PURE__ */ new Set;for(let[e]of c){let t=e.indexOf(`/`);t!==-1&&l.add(e.slice(0,t))}let u=r.name.indexOf(`/`);u!==-1&&l.delete(r.name.slice(0,u)),await Promise.all([...l].map(e=>f(`${o}${s}${e}`).catch(en)));for(let[e,t]of c)await Zt(De(e,t),`${o}${s}${e}`);let d=i(n,`node_modules`);await Ke(i(o,`.bin`),i(d,`.bin`),Ue(c,d),!0)}async function Be(e,t){let r=[];for(let{path:t}of e.files){let e=0;for(let n=t.indexOf(`/`);n!==-1;n=t.indexOf(`/`,n+1))(r[e++]??=/* @__PURE__ */ new Set).add(t.slice(0,n))}await f(t,{recursive:!0});for(let e of r)await Promise.all([...e].map(e=>f(`${t}${s}${e}`).catch(en)));for(let r of e.files)Ve(n.blobPath(r),`${t}${s}${r.path}`)}function Ve(e,t,n=!1){if(!fe)try{D(e,t),P.linked++;return}catch(r){let i=r.code??``;if(zt.has(i))fe=!0;else if(i===`EEXIST`&&!n&&He(t))return Ve(e,t,!0);else if(i!==`EMLINK`)throw Y(`cannot link ${t}: ${tn(r)}`,`ELINK`)}try{te(e,t),P.copied++}catch(e){throw Y(`cannot copy ${t}: ${tn(e)}`,`ELINK`)}}function He(e){try{return O(e),!0}catch{return!1}}function Ue(e,t){let n=/* @__PURE__ */ new Map;for(let[r,{pkg:a}]of e)for(let[e,o]of Object.entries(a.bin))n.set(e,{to:i(t,r,o),pkg:a,path:o});return n}function We(e){let t=/* @__PURE__ */ new Map;if(Rt)return t;for(let[n,r]of e)for(let[e,i]of Object.entries(r.pkg.bin)){let r=c.get(i);r===void 0&&c.set(i,r=a(i)),t.set(e,`..${s}${n}${s}${r}`)}return t}async function Ge(e,r){let a=await import(`./shim.mjs`),s=/* @__PURE__ */ new Map;for(let[c,{to:u,pkg:d,path:f}]of e){let e=(d.local===void 0?n.index(d.integrity):void 0)?.files.find(e=>e.path===f),p=d.local===void 0?e&&n.blobPath(e):i(t.dir,d.local,f),m=p&&l.get(p);p&&!m&&l.set(p,m=a.readHead(p)),s.set(c,a.shimsOf(o(r,u),await m))}return s}async function Ke(e,t,n,r=!1){if(n.size!==0){if(await f(e,{recursive:!0}),Rt){await(await import(`./shim.mjs`)).placeShims(e,await Ge(n,t),r),P.bins+=n.size;return}for(let[a,s]of n)await Xt(o(t,s.to),i(e,a),e,r),P.bins++}}async function K(e){let t;try{t=await m(e)}catch{if(!await d(e).then(e=>e.isSymbolicLink(),()=>!1))return;throw Y(`refusing to link through ${e}: a symlink that leads nowhere`,`ELINK`)}if(t!==Te&&!t.startsWith(Te+s))throw Y(`refusing to link through ${e}: it leads outside the project, to ${t}`,`ELINK`)}async function qe({path:n,nm:a,dependencies:s},c){let l=[],u=[],d={},p=/* @__PURE__ */ new Set,m=c||await f(a,{recursive:!0})!==void 0;for(let[n,c]of Object.entries(s)){let s=`${n}@${c}`,f=e.packages[s];if(!f)continue;let m=R.get(s),h=f.local!==void 0&&!(re&&f.dev)?i(t.dir,f.local):m&&Ee(m);if(!h)continue;l.push([n,{pkg:f}]);let g=i(a,n);n.includes(`/`)&&p.add(r(g));let _=o(r(g),h);u.push([g,_]),d[n]=_}for(let e of p)await K(e),await f(e,{recursive:!0});await Qt(u.map(([e,t])=>Xt(t,e,a,m)));let h=Ue(l,a);se[n]={links:d,bins:[...h.keys()]},await Ke(i(a,`.bin`),i(a,`.bin`),h,m),!m&&(await q(a,new Set(l.map(([e])=>e))),await q(i(a,`.bin`),new Set(h.keys())))}async function Je(){let t=i(M,`node_modules`);if(await K(t),!N)return await v(t,{recursive:!0,force:!0});let n=await f(t,{recursive:!0})!==void 0,r=/* @__PURE__ */ new Set,a=[],o=(e,t)=>{let n=R.get(t);n&&!r.has(e)&&(r.add(e),a.push([e,n]))},s=t=>R.has(t)||e.packages[t]?.local!==void 0;for(let[e,t]of Object.entries(F[0].dependencies))s(`${e}@${t}`)&&r.add(e);let c=/* @__PURE__ */ new Set,l=[];for(let[e,{dependencies:t}]of F.entries())for(let[n,r]of Object.entries(t)){let t=`${n}@${r}`;e>0&&o(n,t),R.has(t)&&!c.has(t)&&(c.add(t),l.push(t))}for(;l.length>0;){let e=[];for(let t of l.sort())for(let[n,r]of Object.entries(W(R.get(t).pkg))){let t=`${n}@${r}`;o(n,t),R.has(t)&&!c.has(t)&&(c.add(t),e.push(t))}l=e}let u=/* @__PURE__ */ new Set;for(let[e]of a)e.includes(`/`)&&u.add(i(t,e.slice(0,e.indexOf(`/`))));for(let e of u)await K(e),await f(e,{recursive:!0});let d=(e,t)=>`${k}${e.includes(`/`)?k:``}${t.home}`;await Qt(a.map(([e,r])=>Xt(d(e,r),i(t,e),t,n))),n||await q(t,new Set(a.map(([e])=>e)))}async function q(e,t,n=``){let r=Rt&&b.path.basename(e)===`.bin`;for(let a of await x(e)){let{name:o}=a,s=i(e,o);if(n===``&&o.startsWith(`.`))continue;if(n===``&&o.startsWith(`@`)&&a.isDirectory()){await q(s,t,`${o}/`),await S(s).catch(()=>{});continue}let c=r?o.replace(/\.(?:cmd|ps1)$/i,``):n+o;(r?a.isDirectory():!a.isSymbolicLink())||t.has(c)||t.has(n+o)||(await v(s,{force:!0}),c===n+o&&P.removed++)}}}function Wt(e,t){let{join:n}=b.path,r=[{path:``,nm:n(e,`node_modules`),dependencies:t.root.dependencies}];for(let i of Object.values(t.packages)){if(i.local===void 0||i.link)continue;let t=n(e,i.local,`node_modules`);r.push({path:i.local,nm:t,dependencies:W(i)})}return r}async function Gt(e,t,n,r,i,a,o){let s=Object.create(null);for(let t of n){let n=await qt(e,t,r,a);if(!n)return;s[t.path]=n}let c=new Set((await b.fsp.readdir(t,{withFileTypes:!0}).catch(()=>[])).filter(e=>e.isDirectory()).map(e=>e.name));if(!o||c.has(`node_modules`))return i.entries.every(e=>c.has(e))?s:void 0}function Kt(e,t,r=!0){let{join:i}=b.path,{readdirSync:a}=b.fs,{root:o}=t;if(!o||!t.complete)return!1;for(let[r,{links:s,bins:c}]of Object.entries({...t.tops,"":o})){let t=i(e,r,`node_modules`);for(let[e,r]of Object.entries(s)){let a=i(t,e);if(n(a)!==r||!Jt(a))return!1}if(c.length===0)continue;let o;try{o=a(i(t,`.bin`))}catch{return!1}let l=new Set(o);if(!c.every(e=>l.has(Rt?`${e}.cmd`:e)))return!1}let s;try{s=a(i(e,`node_modules`,`.upm`),{withFileTypes:!0})}catch{return!1}let c=new Set(s.filter(e=>e.isDirectory()).map(e=>e.name));return r&&!c.has(`node_modules`)?!1:t.entries.every(e=>c.has(e))}async function qt(e,{nm:t,dependencies:n},r,i){let{join:a,relative:o,dirname:s,sep:c}=b.path,l=await b.fsp.readdir(t,{withFileTypes:!0}).catch(()=>void 0);if(!l)return;let u={links:{},bins:[]},d=/* @__PURE__ */ new Set;for(let e of l)e.isSymbolicLink()&&d.add(e.name);for(let e of l){if(!e.name.startsWith(`@`)||e.isSymbolicLink())continue;let n=await b.fsp.readdir(a(t,e.name),{withFileTypes:!0}).catch(()=>[]);for(let t of n)t.isSymbolicLink()&&d.add(`${e.name}/${t.name}`)}let f=Object.entries(n).filter(([e,t])=>!(i&&r.packages[`${e}@${t}`]?.dev)),p=/* @__PURE__ */ new Set;for(let[n,i]of f){if(!d.has(n))return;let l=r.packages[`${n}@${i}`],f=await h(a(t,n))??``;if(l?.local!==void 0){if(f!==o(s(a(t,n)),a(e,l.local)))return}else{let r=o(s(a(t,n)),a(e,`node_modules`,`.upm`))+c;if(!f.startsWith(r)||!f.endsWith(a(c,`node_modules`,n)))return}if(!Jt(a(t,n)))return;u.links[n]=f;for(let e of Object.keys(l?.bin??{}))p.add(e)}if(p.size>0){let e=new Set((await b.fsp.readdir(a(t,`.bin`)).catch(()=>[])).map(String));for(let t of p)if(!e.has(Rt?`${t}.cmd`:t))return}return u.bins=[...p],u}function Jt(e){try{return b.fs.statSync(e,{throwIfNoEntry:!1})?.isDirectory()===!0}catch{return!1}}async function Yt(e,t,n){if(b.path.relative(n,e).startsWith(`..`))throw Object.assign(/* @__PURE__ */ Error(`refusing to link outside ${n}: ${e}`),{code:`ELINK`});for(let n=0;;n++){if(await h(e)===t)return;await b.fsp.rm(e,{recursive:!0,force:!0});try{return await Zt(t,e)}catch(e){if(en(e),n===3)throw e}}}function Xt(e,t,n,r){return r?Zt(e,t).catch(()=>Yt(t,e,n)):Yt(t,e,n)}async function Zt(e,t){try{let[n,r]=T(e,t);await b.fsp.symlink(n,t,r)}catch(n){throw Object.assign(Y(`cannot symlink ${t} -> ${e}: ${tn(n)}`,`ELINK`),{cause:n})}}async function Qt(e){for(let t of await Promise.allSettled(e))if(t.status===`rejected`)throw t.reason}async function $t(e){return(await Promise.all(e)).every(Boolean)}function en(e){let{code:t,cause:n}=e;if(t!==`EEXIST`&&n?.code!==`EEXIST`)throw e}function tn(e){return e?.message??String(e)}function Y(e,t){return Object.assign(Error(e),{code:t})}function nn(e){return e.source!==void 0&&!e.source.startsWith(`file:`)}function rn(e,t,n=!1){if(e.type===`workspace`)return e.raw.slice(e.name.length+1);let r=e.type===`tag`||e.fetchSpec===`*`?n?t:`^${t}`:e.fetchSpec;return e.fetchName===e.name?r:`npm:${e.fetchName}@${r}`}function an(e,t,n=we){let r=e=>typeof e==`object`&&!!e&&!Array.isArray(e);if(!r(e))throw fn(`${t} is not a JSON object`);for(let i of n){let n=e[i];if(n!==void 0&&(!r(n)||Object.values(n).some(e=>typeof e!=`string`)))throw fn(`${t}: ${i} is not a map of ranges`)}}function on(e,t,n){let r;try{r=JSON.parse(e)}catch(e){throw fn(`${t} is not valid JSON: ${e.message}`)}return an(r,t,n),r}function sn(e,t){for(let{name:n,range:r,group:i}of t){for(let t of we)t!==i&&dn(e,t,n);e[i]=ke({...e[i],[n]:r})}}function cn(e,t){let n=[];for(let r of t){let t=!1;for(let n of we)t=dn(e,n,r)||t;t||n.push(r)}return n}function ln(e,t){let n=/^([ \t]+)"/m.exec(t)?.[1]??`  `,r=t.includes(`\r
 `)?`\r

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agimon-ai/po-core",
-  "version": "0.0.0-alpha.92",
+  "version": "0.0.0-alpha.93",
   "description": "Po runtime systems and reusable core services.",
   "keywords": [
     "ai",
@@ -569,8 +569,8 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@agimon-ai/po-logsink": "0.0.1-alpha.74",
-    "@agimon-ai/po-web-security": "0.0.0-alpha.92",
+    "@agimon-ai/po-logsink": "0.0.1-alpha.75",
+    "@agimon-ai/po-web-security": "0.0.0-alpha.93",
     "@deepseek-ai/cordis": "4.0.5",
     "@earendil-works/chord": "1.4.0",
     "@earendil-works/pi-agent-core": "1.4.0",
@@ -594,7 +594,7 @@
     "yaml": "2.9.1"
   },
   "devDependencies": {
-    "@agimon-ai/vibe-lint-plugin-po-core": "0.0.0-alpha.92",
+    "@agimon-ai/vibe-lint-plugin-po-core": "0.0.0-alpha.93",
     "@apidevtools/swagger-parser": "^13.1.0",
     "@asyncapi/parser": "^3.6.4",
     "@earendil-works/pi-ai": "1.4.0",