@alessandroraffa/tangyr 0.14.1 → 0.16.0

package/dist/index.js

@@ -15090,6 +15090,13 @@ function normalizeSource(declared) {
       "Configuration declares source.type: remote but no source.url. Set source.url to the https endpoint of your kit origin."
     );
   }
+  if (source.channel !== void 0) {
+    if (!/^[a-z0-9][a-z0-9-]{0,31}$/u.test(source.channel)) {
+      throw new Error(
+        `Configuration declares source.channel "${source.channel}", which must be lowercase alphanumeric with hyphens, 1-32 characters.`
+      );
+    }
+  }
   return source;
 }
 function findConfigPath(explicitPath) {
@@ -17577,6 +17584,24 @@ import path15 from "path";
 
 // src/core/kit-reference.ts
 var BARE_URL = /^https?:\/\//u;
+function parseKitSelector(raw) {
+  if (BARE_URL.test(raw)) {
+    throw new Error(
+      "A bare URL is not a kit reference. Configure source.url in tangyr.config.yaml and reference the kit as --kit <name> or --kit <name>@<version>."
+    );
+  }
+  if (raw.length === 0) {
+    throw new Error(
+      "No kit was named. Pass --kit <name> to resolve the configured channel, or --kit <name>@<version> for an exact version."
+    );
+  }
+  const separator = raw.lastIndexOf("@");
+  if (separator === -1) {
+    assertPathSafeComponent("name", raw);
+    return { name: raw };
+  }
+  return parseKitReference(raw);
+}
 function parseKitReference(raw) {
   if (BARE_URL.test(raw)) {
     throw new Error(
@@ -23116,17 +23141,94 @@ function toConflictPolicy2(value) {
 import fs36 from "fs";
 import path36 from "path";
 
+// src/core/channel-state.ts
+import fs28 from "fs";
+import path26 from "path";
+var CHANNEL_STATE_FILENAME = ".tangyr-channels.json";
+function stateFilePath(cacheRoot) {
+  return path26.join(cacheRoot, CHANNEL_STATE_FILENAME);
+}
+function channelKey(kit, channel) {
+  return `${kit}/${channel}`;
+}
+function readState(cacheRoot) {
+  const filePath = stateFilePath(cacheRoot);
+  let raw;
+  try {
+    raw = fs28.readFileSync(filePath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { state: {} };
+    }
+    return {
+      state: {},
+      warning: `Could not read ${filePath} (${err.message}); the channel downgrade guard starts from nothing for this run.`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      state: {},
+      warning: `${filePath} is not valid JSON; the channel downgrade guard starts from nothing for this run.`
+    };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return {
+      state: {},
+      warning: `${filePath} does not contain an object; the channel downgrade guard starts from nothing for this run.`
+    };
+  }
+  return { state: parsed };
+}
+function readChannelSequence(cacheRoot, originUrl, kit, channel) {
+  const { state, warning } = readState(cacheRoot);
+  const record = state[originUrl]?.[channelKey(kit, channel)];
+  const usable = record !== void 0 && Number.isSafeInteger(record.sequence) && typeof record.version === "string" && record.version.length > 0;
+  const result = usable ? { sequence: record.sequence, version: record.version } : { sequence: void 0, version: void 0 };
+  return warning === void 0 ? result : { ...result, warning };
+}
+function writeChannelSequence(params) {
+  const { cacheRoot, originUrl, kit, channel, sequence, version, now } = params;
+  const { state } = readState(cacheRoot);
+  const key = channelKey(kit, channel);
+  const existing = state[originUrl]?.[key]?.sequence;
+  if (existing !== void 0 && existing > sequence) {
+    return;
+  }
+  state[originUrl] = {
+    ...state[originUrl],
+    [key]: { sequence, version, seenAt: now.toISOString() }
+  };
+  const filePath = stateFilePath(cacheRoot);
+  fs28.mkdirSync(path26.dirname(filePath), { recursive: true, mode: 448 });
+  const tempPath = `${filePath}.${process.pid}.tmp`;
+  fs28.writeFileSync(tempPath, `${JSON.stringify(state, null, 2)}
+`, {
+    mode: 384
+  });
+  fs28.renameSync(tempPath, filePath);
+}
+function assertChannelNotRolledBack(params) {
+  const { originUrl, kit, channel, seen, seenVersion, incoming } = params;
+  if (seen !== void 0 && incoming < seen) {
+    throw new IntegrityError(
+      `Channel pointer for ${kit}/${channel} from ${originUrl} carries sequence ${incoming}, behind the highest already accepted (${seen}${seenVersion === void 0 ? "" : `, naming ${kit}@${seenVersion}`}). That is a replay of a superseded pointer, which would pin this machine to ${kit}@${params.incomingVersion} and hide every version published since \u2014 refusing.`
+    );
+  }
+}
+
+// src/core/bundle.ts
+var CHANNEL_POINTER_TYPE = "tangyr.channel-pointer.v1";
+var DEFAULT_CHANNEL = "stable";
+
 // src/core/materialize.ts
 import fs29 from "fs";
 import path27 from "path";
 
 // src/core/integrity.ts
 import crypto3 from "crypto";
-
-// src/core/bundle.ts
-var DENY_LIST_TYPE = "tangyr.deny-list.v2";
-
-// src/core/integrity.ts
 function canonicalize(value) {
   if (Array.isArray(value)) {
     return value.map(canonicalize);
@@ -23241,43 +23343,7 @@ function verifyBundle(bundle, keys, expectedIdentity, now) {
   verifyBundleSignature(bundle, keys, now);
   verifyIdentity(bundle.manifest, expectedIdentity);
 }
-function verifyDenyList(denyList, keys, now) {
-  if (denyList === null || typeof denyList !== "object") {
-    throw new IntegrityError(DENY_LIST_MALFORMED);
-  }
-  const actualKeys = Object.keys(denyList).sort();
-  const expectedKeys = [
-    "entries",
-    "expiresAt",
-    "issuedAt",
-    "keyId",
-    "sequence",
-    "signature",
-    "type"
-  ];
-  if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
-    throw new IntegrityError(
-      `${DENY_LIST_MALFORMED} Expected exactly [${expectedKeys.join(", ")}], got [${actualKeys.join(", ")}].`
-    );
-  }
-  const list = denyList;
-  const shapeOk = list.type === DENY_LIST_TYPE && typeof list.keyId === "string" && typeof list.signature === "string" && list.signature.length > 0 && Number.isSafeInteger(list.sequence) && list.sequence >= 0 && typeof list.issuedAt === "string" && typeof list.expiresAt === "string" && Array.isArray(list.entries) && list.entries.every((entry) => typeof entry === "string");
-  if (!shapeOk) {
-    throw new IntegrityError(DENY_LIST_MALFORMED);
-  }
-  const { signature, ...signed } = list;
-  verifySignedPayload(
-    canonicalJsonBytes(signed),
-    signature,
-    list.keyId,
-    keys,
-    now
-  );
-  assertFreshnessWindow(list.issuedAt, list.expiresAt, now);
-  return list;
-}
-var DENY_LIST_MALFORMED = "Revocation deny-list response is malformed, unsigned, or corrupted \u2014 treated as an integrity failure, never as an absent deny-list (REQ-INT-009).";
-function assertFreshnessWindow(issuedAt, expiresAt, now) {
+function assertFreshnessWindow(issuedAt, expiresAt, now, expiryConsequence) {
   const utcDesignatorPattern = /Z|[+-]\d{2}:\d{2}$/;
   if (!utcDesignatorPattern.test(issuedAt) || !utcDesignatorPattern.test(expiresAt)) {
     throw new IntegrityError(
@@ -23298,7 +23364,7 @@ function assertFreshnessWindow(issuedAt, expiresAt, now) {
   }
   if (now.getTime() > expires.getTime()) {
     throw new IntegrityError(
-      `Signed document expired at ${expiresAt} (now ${now.toISOString()}). An expired revocation deny-list is not evidence that nothing is revoked \u2014 the publisher must re-sign and republish it.`
+      `Signed document expired at ${expiresAt} (now ${now.toISOString()}). ${expiryConsequence}`
     );
   }
   if (now.getTime() < issued.getTime()) {
@@ -23307,74 +23373,54 @@ function assertFreshnessWindow(issuedAt, expiresAt, now) {
     );
   }
 }
-
-// src/core/revocation-state.ts
-import fs28 from "fs";
-import path26 from "path";
-var REVOCATION_STATE_FILENAME = ".tangyr-revocation.json";
-function stateFilePath(cacheRoot) {
-  return path26.join(cacheRoot, REVOCATION_STATE_FILENAME);
-}
-function readState(cacheRoot) {
-  const filePath = stateFilePath(cacheRoot);
-  let raw;
-  try {
-    raw = fs28.readFileSync(filePath, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return { state: {} };
-    }
-    return {
-      state: {},
-      warning: `Could not read ${filePath} (${err.message}); the deny-list replay guard starts from nothing for this run.`
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return {
-      state: {},
-      warning: `${filePath} is not valid JSON; the deny-list replay guard starts from nothing for this run.`
-    };
+var CHANNEL_POINTER_MALFORMED = "Channel pointer from the origin is malformed.";
+function verifyChannelPointer(pointer, expectedKit, expectedChannel, keys, now) {
+  if (pointer === null || typeof pointer !== "object") {
+    throw new IntegrityError(CHANNEL_POINTER_MALFORMED);
   }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return {
-      state: {},
-      warning: `${filePath} does not contain an object; the deny-list replay guard starts from nothing for this run.`
-    };
+  const actualKeys = Object.keys(pointer).sort();
+  const expectedKeys = [
+    "channel",
+    "expiresAt",
+    "issuedAt",
+    "keyId",
+    "kit",
+    "sequence",
+    "signature",
+    "type",
+    "version"
+  ];
+  if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
+    throw new IntegrityError(
+      `${CHANNEL_POINTER_MALFORMED} Expected exactly [${expectedKeys.join(", ")}], got [${actualKeys.join(", ")}].`
+    );
   }
-  return { state: parsed };
-}
-function readRevocationSequence(cacheRoot, originUrl) {
-  const { state, warning } = readState(cacheRoot);
-  const record = state[originUrl];
-  const sequence = record !== void 0 && Number.isSafeInteger(record.sequence) ? record.sequence : void 0;
-  return warning === void 0 ? { sequence } : { sequence, warning };
-}
-function writeRevocationSequence(cacheRoot, originUrl, sequence, now) {
-  const { state } = readState(cacheRoot);
-  const existing = state[originUrl]?.sequence;
-  if (existing !== void 0 && existing >= sequence) {
-    return;
+  const candidate = pointer;
+  const shapeOk = candidate.type === CHANNEL_POINTER_TYPE && typeof candidate.keyId === "string" && typeof candidate.kit === "string" && candidate.kit.length > 0 && typeof candidate.channel === "string" && candidate.channel.length > 0 && typeof candidate.version === "string" && candidate.version.length > 0 && typeof candidate.signature === "string" && candidate.signature.length > 0 && Number.isSafeInteger(candidate.sequence) && candidate.sequence >= 0 && typeof candidate.issuedAt === "string" && typeof candidate.expiresAt === "string";
+  if (!shapeOk) {
+    throw new IntegrityError(CHANNEL_POINTER_MALFORMED);
   }
-  state[originUrl] = { sequence, seenAt: now.toISOString() };
-  const filePath = stateFilePath(cacheRoot);
-  fs28.mkdirSync(path26.dirname(filePath), { recursive: true, mode: 448 });
-  const tempPath = `${filePath}.${process.pid}.tmp`;
-  fs28.writeFileSync(tempPath, `${JSON.stringify(state, null, 2)}
-`, {
-    mode: 384
-  });
-  fs28.renameSync(tempPath, filePath);
-}
-function assertSequenceNotReplayed(params) {
-  const { originUrl, seen, incoming } = params;
-  if (seen !== void 0 && incoming < seen) {
+  const { signature, ...signed } = candidate;
+  verifySignedPayload(
+    canonicalJsonBytes(signed),
+    signature,
+    candidate.keyId,
+    keys,
+    now
+  );
+  if (candidate.kit !== expectedKit || candidate.channel !== expectedChannel) {
     throw new IntegrityError(
-      `Revocation deny-list from ${originUrl} carries sequence ${incoming}, behind the highest already accepted (${seen}). That is a replay of a superseded deny-list, which would silently un-revoke a kit \u2014 refusing (REQ-INT-009).`
+      `Channel pointer is signed for ${candidate.kit}/${candidate.channel} but was served as ${expectedKit}/${expectedChannel}. A pointer the publisher signed for one channel is being presented as another's \u2014 refusing.`
     );
   }
+  assertPathSafeComponent("version", candidate.version);
+  assertFreshnessWindow(
+    candidate.issuedAt,
+    candidate.expiresAt,
+    now,
+    "An expired channel pointer is not evidence that it still names the newest version \u2014 the publisher must re-sign and republish it."
+  );
+  return candidate;
 }
 
 // src/core/materialize.ts
@@ -23422,7 +23468,6 @@ async function withBoundedRetry(operation, sleep2, logger) {
   );
 }
 var BUNDLE_OBJECT_PATH_PREFIX = "/v1/kits";
-var DENY_LIST_OBJECT_PATH = "/v1/deny-list";
 async function fetchVerifiedBundle(params) {
   const { originUrl, reference, transport, keys, now, logger, sleep: sleep2 } = params;
   const credentials = resolveCredentialNonInteractive();
@@ -23476,76 +23521,6 @@ async function fetchVerifiedBundle(params) {
   }
   return parsed;
 }
-async function assertReferenceNotRevoked(params) {
-  const {
-    originUrl,
-    reference,
-    cacheRoot,
-    transport,
-    keys,
-    now,
-    logger,
-    sleep: sleep2
-  } = params;
-  const credentials = resolveCredentialNonInteractive();
-  const denyList = await withBoundedRetry(
-    async () => {
-      const controller = new AbortController();
-      const response = await transport.fetchObjectStream(
-        originUrl,
-        DENY_LIST_OBJECT_PATH,
-        credentials,
-        controller.signal
-      );
-      if (response.status === 401 || response.status === 403) {
-        throw new AuthenticationError(
-          `The origin rejected the credential (HTTP ${response.status}) fetching the revocation deny-list. Set TANGYR_ACCESS_CLIENT_ID and TANGYR_ACCESS_CLIENT_SECRET, or run 'tangyr auth login'.`
-        );
-      }
-      if (response.status !== 200) {
-        throw new Error(
-          `Unexpected HTTP ${response.status} fetching the revocation deny-list from ${originUrl}${DENY_LIST_OBJECT_PATH}.`
-        );
-      }
-      const buffer = await readBoundedStream(
-        response.body,
-        MAX_TOTAL_BUNDLE_BYTES,
-        () => controller.abort()
-      );
-      let parsed;
-      try {
-        parsed = JSON.parse(buffer.toString("utf8"));
-      } catch {
-        throw new IntegrityError(
-          "Revocation deny-list response is not valid JSON \u2014 rejecting (REQ-INT-009)."
-        );
-      }
-      return verifyDenyList(parsed, keys, now);
-    },
-    sleep2,
-    logger
-  );
-  const seen = readRevocationSequence(cacheRoot, originUrl);
-  if (seen.warning) {
-    logger.warn(seen.warning);
-  }
-  assertSequenceNotReplayed({
-    originUrl,
-    seen: seen.sequence,
-    incoming: denyList.sequence
-  });
-  writeRevocationSequence(cacheRoot, originUrl, denyList.sequence, now);
-  const key = `${reference.name}@${reference.version}`;
-  if (denyList.entries.includes(key)) {
-    const entryDir = cacheEntryPath(cacheRoot, reference);
-    if (fs29.existsSync(entryDir)) {
-      fs29.rmSync(entryDir, { recursive: true, force: true });
-    }
-    throw new IntegrityError(
-      `"${key}" is present on the signed revocation deny-list \u2014 refusing to materialize or install; any existing cache entry has been invalidated (REQ-INT-009).`
-    );
-  }
-}
 function parseVersionTriple(version) {
   const leading = version.split("-")[0];
   const parts = leading.split(".");
@@ -23716,16 +23691,6 @@ async function materializeRemoteKit(params) {
     logger,
     sleep: sleep2
   });
-  await assertReferenceNotRevoked({
-    originUrl,
-    reference,
-    cacheRoot,
-    transport,
-    keys,
-    now,
-    logger,
-    sleep: sleep2
-  });
   assertCliVersionCompatible(bundle.manifest.minCliVersion, CLI_VERSION);
   const decoded = verifyBundleFileHashes(bundle);
   if (decoded.has(CACHE_COMPLETION_MARKER) || decoded.has(BUNDLE_DOCUMENT_FILENAME)) {
@@ -23752,6 +23717,91 @@ async function materializeRemoteKit(params) {
     throw error;
   }
 }
+var CHANNEL_OBJECT_PATH_PREFIX = "/v1/channels";
+var MAX_CHANNEL_POINTER_BYTES = 64 * 1024;
+async function resolveChannelVersion(params) {
+  const {
+    originUrl,
+    kit,
+    channel,
+    cacheRoot,
+    transport,
+    keys,
+    now,
+    logger,
+    sleep: sleep2
+  } = params;
+  const credentials = resolveCredentialNonInteractive();
+  const objectPath = `${CHANNEL_OBJECT_PATH_PREFIX}/${kit}/${channel}.json`;
+  const pointer = await withBoundedRetry(
+    async () => {
+      const controller = new AbortController();
+      const response = await transport.fetchObjectStream(
+        originUrl,
+        objectPath,
+        credentials,
+        controller.signal
+      );
+      if (response.status === 401 || response.status === 403) {
+        throw new AuthenticationError(
+          `The origin rejected the credential (HTTP ${response.status}) resolving ${kit}/${channel}. Set TANGYR_ACCESS_CLIENT_ID and TANGYR_ACCESS_CLIENT_SECRET, or run 'tangyr auth login'.`
+        );
+      }
+      if (response.status === 404) {
+        throw new IntegrityError(
+          `The origin has no ${channel} channel for "${kit}" (HTTP 404 at ${originUrl}${objectPath}). Either the publisher has not published that channel, or the kit name is wrong. Reference an explicit version as --kit ${kit}@<version> if you know one.`
+        );
+      }
+      if (response.status !== 200) {
+        throw new Error(
+          `Unexpected HTTP ${response.status} resolving ${kit}/${channel} from ${originUrl}${objectPath}.`
+        );
+      }
+      const buffer = await readBoundedStream(
+        response.body,
+        MAX_CHANNEL_POINTER_BYTES,
+        () => controller.abort()
+      );
+      let parsed;
+      try {
+        parsed = JSON.parse(buffer.toString("utf8"));
+      } catch {
+        throw new IntegrityError(
+          `Channel pointer for ${kit}/${channel} is not valid JSON \u2014 rejecting.`
+        );
+      }
+      return verifyChannelPointer(parsed, kit, channel, keys, now);
+    },
+    sleep2,
+    logger
+  );
+  const seen = readChannelSequence(cacheRoot, originUrl, kit, channel);
+  if (seen.warning) {
+    logger.warn(seen.warning);
+  }
+  assertChannelNotRolledBack({
+    originUrl,
+    kit,
+    channel,
+    seen: seen.sequence,
+    seenVersion: seen.version,
+    incoming: pointer.sequence,
+    incomingVersion: pointer.version
+  });
+  writeChannelSequence({
+    cacheRoot,
+    originUrl,
+    kit,
+    channel,
+    sequence: pointer.sequence,
+    version: pointer.version,
+    now
+  });
+  logger.verbose(
+    `Resolved ${kit}/${channel} to ${kit}@${pointer.version} (pointer sequence ${pointer.sequence}).`
+  );
+  return pointer.version;
+}
 
 // src/core/kit-source.ts
 function resolveCacheOnly(entryDir, reference, keys, now) {
@@ -23790,13 +23840,25 @@ async function resolveKitSource(params) {
   if (config.source.type !== "remote") {
     return { kitName: kitOption };
   }
-  const reference = parseKitReference(kitOption ?? "");
+  const selector = parseKitSelector(kitOption ?? "");
   if (!config.source.url) {
     throw new Error(
       "Configuration declares source.type: remote but no source.url. Set source.url to the https endpoint of your kit origin."
     );
   }
   const cacheRoot = resolveCacheRoot(env2);
+  const reference = selector.version === void 0 ? await resolveThroughChannel({
+    name: selector.name,
+    channel: config.source.channel ?? DEFAULT_CHANNEL,
+    originUrl: config.source.url,
+    cacheRoot,
+    offline: offline === true,
+    transport,
+    keys,
+    now,
+    logger,
+    sleep: sleep2
+  }) : { name: selector.name, version: selector.version };
   const entryDir = cacheEntryPath(cacheRoot, reference);
   if (offline) {
     return resolveCacheOnly(entryDir, reference, keys, now);
@@ -23827,7 +23889,7 @@ async function resolveKitSource(params) {
   }
   function degradedWarmReturn() {
     process.stderr.write(
-      `Degraded: proceeding on the warm cache for "${reference.name}@${reference.version}" after a network failure during the authorization-freshness re-check \u2014 revocation and freshness were not re-checked. Run with --refresh once connectivity is restored.
+      `Degraded: proceeding on the warm cache for "${reference.name}@${reference.version}" after a network failure during the authorization-freshness re-check \u2014 freshness was not re-checked. Run with --refresh once connectivity is restored.
 `
     );
     return {
@@ -23869,23 +23931,6 @@ async function resolveKitSource(params) {
       );
     }
     if (probeOutcome.outcome === "success") {
-      try {
-        await assertReferenceNotRevoked({
-          originUrl: config.source.url,
-          reference,
-          cacheRoot,
-          transport,
-          keys,
-          now,
-          logger,
-          sleep: sleep2
-        });
-      } catch (error) {
-        if (!(error instanceof RemoteUnavailableError)) {
-          throw error;
-        }
-        return degradedWarmReturn();
-      }
       writeLastAuthorizedAt(cacheRoot, config.source.url, now);
       const warning = formatAdvanceExpiryWarning(
         probeOutcome.metadata.expiresAt,
@@ -23934,6 +23979,54 @@ async function resolveKitSource(params) {
   writeLastAuthorizedAt(cacheRoot, config.source.url, now);
   return { kitPathOverride, kitName: reference.name };
 }
+async function resolveThroughChannel(params) {
+  const { name, channel, originUrl, cacheRoot, offline, logger } = params;
+  const lastSeenVersion = () => {
+    const seen = readChannelSequence(cacheRoot, originUrl, name, channel);
+    if (seen.warning) {
+      logger.warn(seen.warning);
+    }
+    return seen.version;
+  };
+  if (offline) {
+    const version = lastSeenVersion();
+    if (version === void 0) {
+      throw new OfflineCacheMissError(
+        `--offline cannot resolve ${name}/${channel}: this machine has never resolved that channel, and a channel pointer is never cached. Run once with network access, or name a version as --kit ${name}@<version>.`
+      );
+    }
+    logger.warn(
+      `--offline: using ${name}@${version}, the last version this machine saw on ${channel}. A newer one may exist.`
+    );
+    return { name, version };
+  }
+  try {
+    const version = await resolveChannelVersion({
+      originUrl,
+      kit: name,
+      channel,
+      cacheRoot,
+      transport: params.transport,
+      keys: params.keys,
+      now: params.now,
+      logger,
+      sleep: params.sleep
+    });
+    return { name, version };
+  } catch (error) {
+    if (!(error instanceof RemoteUnavailableError)) {
+      throw error;
+    }
+    const version = lastSeenVersion();
+    if (version === void 0) {
+      throw error;
+    }
+    logger.warn(
+      `Could not reach the origin to resolve ${name}/${channel}; falling back to ${name}@${version}, the last version this machine saw. A newer one may exist.`
+    );
+    return { name, version };
+  }
+}
 
 // src/core/keys.ts
 var PINNED_PUBLISHER_KEYS = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alessandroraffa/tangyr",
-  "version": "0.14.1",
+  "version": "0.16.0",
   "description": "CLI for the Tangyr discipline — install and manage operating kits for AI coding tools",
   "license": "MIT",
   "engines": {