@almadar/std 17.0.2 → 17.0.3

package/behaviors/lolo/cli/atoms/std-orb-packages.lolo

@@ -6,7 +6,7 @@ app std-orb-packages [
   sys: [identity],
   fs: { cwd: "**": [read, write, create, remove], "/**": [read], "~/.orb/**": [read, write, create, remove], "~/.orb": [create] },
   net: { "registry.npmjs.org:443": [tcp] },
-  description: "std-orb-packages — the `orb list|add|update|remove [--global]` client of the npm registry (spec/cli/orb-packages.lolo; golden: orbital-cli packages.rs), bun-free. Packages live in <dir>/node_modules (dir = the working directory, or ~/.orb with --global) and the lockfile <dir>/<lockfile> holds { packages: [{ name, version, url, integrity }] }. Every command first reads the lockfile (absent = empty) and scans node_modules (scoped names included; the entry kind symlink is the workspace link), reading each package.json: a package is an orb package when it declares orbLanguage, orb, orbVocabulary or orbProgram.kind shell|desktop, and its kinds are those. list prints one row per orb package sorted by name (package 34, version 12, kinds 26, `ok`, ` (linked)`, ` [<prefix>/]`) or --json rows. remove refuses a behavior package whose prefix a .lolo or .orb file under the working directory still imports, deletes the package (a link is unlinked, never its target) and drops its lock entry. add parses name@exact-version (a range is refused ORB_PACKAGE_RANGE; a workspace-linked package is refused ORB_PACKAGE_LINKED) or a direct tarball URL (refused: it carries no integrity), and resolves name@version through GET <registry>/<name>/<version> (the npm version manifest: dist.tarball and dist.integrity). update reads the npm packument GET <registry>/<name> of every non-linked orb package and of every missing baseline package (an upgrade from nothing), and moves each to the newest stable, non-deprecated version above the installed one whose language is compatible: the running orb answers `orb --version` as `orb X.Y.Z (language R)` (any other form is refused) and keeps R; @almadar/core resolves first, and its candidate is compatible when its orbLanguage.version satisfies R; every other package is compatible when its language range (orb.language, orbLanguage.language, orbVocabulary.language or orbProgram.language, the first present) is satisfied by the target core language, the orbLanguage.version of the core version this update installs, else of the installed core; a version with no language is skipped ORB_PACKAGE_NO_LANGUAGE (compatibility is declared by the version itself, so one that declares nothing is never assumed compatible). The release version of orb is never compared with a package range. The tarball is downloaded from the registry knob (RegistryHttp) or the sourceOrigin knob (SourceHttp, one client per origin; any other host is refused ORB_PACKAGE_SOURCE), and its sha512 digest must equal the registry dist.integrity (sha512- plus base64, hash/sha): a different digest is refused `integrity-mismatch`, an unhashable one `integrity-unavailable`, and nothing is written or recorded. A verified tarball is gunzipped (maxUnpackedBytes) and read as a ustar archive (maxEntries) by the kernel; a codec refusal is ORB_PACKAGE_ARCHIVE (<code>), an entry outside package/ ORB_PACKAGE_LAYOUT. The files are written into node_modules/.orb-staging/<name>@<version> (mode 755 for executables, else 644), the old node_modules/<name> is renamed to node_modules/.orb-staging/<name>@<version>.old, the staging directory is renamed into place and only then is the backup removed (a failed rename into place renames the backup back and refuses the package ORB_PACKAGE_INSTALL, saying the previous version was restored; a failed restore names where the backup is kept; a leftover backup from an earlier crashed swap is never overwritten, it refuses the package); only then is the package's lock entry replaced and the lockfile written last. Every version may carry a top-level orbRelease block { severity security|critical|normal, advisory (one line), fixes (a semver range of the earlier versions it fixes) } in its registry manifest; no block is normal, and any other severity word is read as normal. update names, after the list rows, one `<severity> update: <name> <from> → <to>: <advisory>` line for each applied version whose own severity is security or critical. `orb update --urgent` (update only; with any other command it is refused with the usage line) installs only urgent updates: a package is urgent when some stable, non-deprecated version newer than the installed one is security or critical, declares a fixes range, the installed version satisfies that range (std-semver) and the version passes the language check above; the newest such version is installed through the same integrity check, staging swap and lockfile write, a baseline package that is not installed is never urgent, and stdout carries only the applied `<severity> update:` lines. An urgent version that fails the language check (ORB_PACKAGE_INCOMPATIBLE or ORB_PACKAGE_NO_LANGUAGE), whose fixes range std-semver refuses (ORB_PACKAGE_RELEASE), or that fails its download, integrity or install, is not applied: the installed version stays, the call answers 500, and stderr names the refusals and each confirmed-urgent advisory (a failed install leaves the old package in place, never half-installed). `orb update --global` also keeps this host's orb binary package (the orbPlatforms knob, matched on os/uname sysname and machine: @almadar/orb-darwin-arm64, -darwin-x64, -linux-x64, -linux-arm64, -windows-x64) installed like a baseline package, in the registry knob, with its own compatibility rule: it has no language range, so its newest stable, non-deprecated version is taken whose package.json declares orbReads, a range the target core language satisfies (a version without orbReads is skipped ORB_PACKAGE_NO_LANGUAGE; its orb and orbProgram blocks are not read); a package that declares orbReads is listed with kind `orb`; --urgent never installs it from nothing. A host that matches no entry, or whose os/uname fails (the Windows host does not implement it), prints one ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered. Not yet ported: the kind-loads-for-this-orb problem column, the behaviors count, the update-check record and the engines subcommands; add does not remove a package that declares no orb kind."
+  description: "std-orb-packages — the `orb list|add|update|remove [--global]` client of the npm registry (spec/cli/orb-packages.lolo; golden: orbital-cli packages.rs), bun-free. Packages live in <dir>/node_modules (dir = the working directory, or ~/.orb with --global) and the lockfile <dir>/<lockfile> holds { packages: [{ name, version, url, integrity }] }. Every command first reads the lockfile (absent = empty) and scans node_modules (scoped names included; the entry kind symlink is the workspace link), reading each package.json: a package is an orb package when it declares orbLanguage, orb, orbVocabulary or orbProgram.kind shell|desktop, and its kinds are those. list prints one row per orb package sorted by name (package 34, version 12, kinds 26, `ok`, ` (linked)`, ` [<prefix>/]`) or --json rows. remove refuses a behavior package whose prefix a .lolo or .orb file under the working directory still imports, deletes the package (a link is unlinked, never its target) and drops its lock entry. add parses name@exact-version (a range is refused ORB_PACKAGE_RANGE; a workspace-linked package is refused ORB_PACKAGE_LINKED) or a direct tarball URL (refused: it carries no integrity), and resolves name@version through GET <registry>/<name>/<version> (the npm version manifest: dist.tarball and dist.integrity). update reads the npm packument GET <registry>/<name> of every non-linked orb package and of every missing baseline package (an upgrade from nothing), and moves each to the newest stable, non-deprecated version above the installed one whose language is compatible: the running orb answers `orb --version` as `orb X.Y.Z (language R)` (any other form is refused) and keeps R; @almadar/core resolves first, and its candidate is compatible when its orbLanguage.version satisfies R; every other package is compatible when its language range (orb.language, orbLanguage.language, orbVocabulary.language or orbProgram.language, the first present) is satisfied by the target core language, the orbLanguage.version of the core version this update installs, else of the installed core; a version with no language is skipped ORB_PACKAGE_NO_LANGUAGE (compatibility is declared by the version itself, so one that declares nothing is never assumed compatible). The release version of orb is never compared with a package range. The tarball is downloaded from the registry knob (RegistryHttp) or the sourceOrigin knob (SourceHttp, one client per origin; any other host is refused ORB_PACKAGE_SOURCE), and its sha512 digest must equal the registry dist.integrity (sha512- plus base64, hash/sha): a different digest is refused `integrity-mismatch`, an unhashable one `integrity-unavailable`, and nothing is written or recorded. A verified tarball is gunzipped (maxUnpackedBytes) and read as a ustar archive (maxEntries) by the kernel; a codec refusal is ORB_PACKAGE_ARCHIVE (<code>), an entry outside package/ ORB_PACKAGE_LAYOUT. The files are written into node_modules/.orb-staging/<name>@<version> (mode 755 for executables, else 644), the old node_modules/<name> is renamed to node_modules/.orb-staging/<name>@<version>.old, the staging directory is renamed into place and only then is the backup removed (a failed rename into place renames the backup back and refuses the package ORB_PACKAGE_INSTALL, saying the previous version was restored; a failed restore names where the backup is kept; a leftover backup from an earlier crashed swap is never overwritten, it refuses the package); only then is the package's lock entry replaced and the lockfile written last. Every version may carry a top-level orbRelease block { severity security|critical|normal, advisory (one line), fixes (a semver range of the earlier versions it fixes) } in its registry manifest; no block is normal, and any other severity word is read as normal. update names, after the list rows, one `<severity> update: <name> <from> → <to>: <advisory>` line for each applied version whose own severity is security or critical. `orb update --urgent` (update only; with any other command it is refused with the usage line) installs only urgent updates: a package is urgent when some stable, non-deprecated version newer than the installed one is security or critical, declares a fixes range, the installed version satisfies that range (std-semver) and the version passes the language check above; the newest such version is installed through the same integrity check, staging swap and lockfile write, a baseline package that is not installed is never urgent, and stdout carries only the applied `<severity> update:` lines. An urgent version that fails the language check (ORB_PACKAGE_INCOMPATIBLE or ORB_PACKAGE_NO_LANGUAGE), whose fixes range std-semver refuses (ORB_PACKAGE_RELEASE), or that fails its download, integrity or install, is not applied: the installed version stays, the call answers 500, and stderr names the refusals and each confirmed-urgent advisory (a failed install leaves the old package in place, never half-installed). `orb update --global` also keeps this host's orb binary package (the orbPlatforms knob, matched on os/uname sysname and machine: @almadar/orb-darwin-arm64, -darwin-x64, -linux-x64, -linux-arm64, -windows-x64) installed like a baseline package, in the registry knob, with its own compatibility rule: it has no language range, so its newest stable, non-deprecated version is taken whose package.json declares orbReads, a range the target core language satisfies (a version without orbReads is skipped ORB_PACKAGE_NO_LANGUAGE; its orb and orbProgram blocks are not read); a package that declares orbReads is listed with kind `orb`; --urgent never installs it from nothing. A host that matches no entry, or whose os/uname fails (the Windows host does not implement it), prints one ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered. A package whose package.json declares orbProgram also installs each of its optionalDependencies at its exact version whose registry manifest os and cpu include this host's (the os and cpu of the orbPlatforms entry os/uname matched, the npm platform rule; every add and update asks os/uname); a host os/uname cannot place installs none of them. Every file the package.json bin map names is written executable. Not yet ported: the kind-loads-for-this-orb problem column, the behaviors count, the update-check record and the engines subcommands; add does not remove a package that declares no orb kind."
 ]
 uses Spec from "almadar-std/orb-packages"
 uses Http from "std/behaviors/std-http-client"
@@ -17,18 +17,18 @@ type PackageKind = "language" | "behaviors" | "language pack" | "shell" | "deskt
 type PackageRow = { package : string!, kinds : [PackageKind]!, version : string!, path : string!, link : boolean!, prefix : string?, behaviors : number?, problem : string? }
 type LockEntry = { name : string!, version : string!, url : string!, integrity : string! }
 type BaselineEntry = { name : string!, registry : string! }
-type OrbPlatform = { sysname : string!, machine : string!, package : string! }
+type OrbPlatform = { sysname : string!, machine : string!, package : string!, os : string!, cpu : string! }
 type LockFile = { packages : [LockEntry]! }
-type PackageTarget = { name : string!, version : string!, url : string!, integrity : string!, severity : string?, advisory : string?, installedVersion : string? }
+type PackageTarget = { name : string!, version : string!, url : string!, integrity : string!, severity : string?, advisory : string?, installedVersion : string?, platform : boolean? }
 type Marker = { x : string? }
 type LanguageBlock = { version : string? }
 type OrbPackagesBlock = { prefix : string? }
 type ProgramBlock = { kind : string?, name : string? }
-type OrbPackagesManifest = { name : string?, version : string?, orbLanguage : LanguageBlock?, orb : OrbPackagesBlock?, orbVocabulary : Marker?, orbProgram : ProgramBlock?, orbReads : string? }
+type OrbPackagesManifest = { name : string?, version : string?, orbLanguage : LanguageBlock?, orb : OrbPackagesBlock?, orbVocabulary : Marker?, orbProgram : ProgramBlock?, orbReads : string?, optionalDependencies : Map string string?, bin : Map string string? }
 type NpmDist = { tarball : string!, integrity : string? }
 type NpmLanguage = { language : string?, version : string? }
 type NpmRelease = { severity : string?, advisory : string?, fixes : string? }
-type NpmManifest = { version : string!, deprecated : string?, dist : NpmDist?, orb : NpmLanguage?, orbLanguage : NpmLanguage?, orbVocabulary : NpmLanguage?, orbProgram : NpmLanguage?, orbRelease : NpmRelease?, orbReads : string? }
+type NpmManifest = { version : string!, deprecated : string?, dist : NpmDist?, orb : NpmLanguage?, orbLanguage : NpmLanguage?, orbVocabulary : NpmLanguage?, orbProgram : NpmLanguage?, orbRelease : NpmRelease?, orbReads : string?, os : [string]?, cpu : [string]? }
 type Packument = { name : string!, versions : Map string NpmManifest! }
 type Candidate = { version : string!, key : number!, language : string!, provides : string!, url : string!, integrity : string!, severity : string?, advisory : string?, fixes : string? }
 type Subject = { package : string!, version : string!, missing : boolean! }
@@ -107,6 +107,8 @@ orbital OrbPackagesOrbital {
     orbPackage : string = ""
     unamed : boolean = false
     platformNote : string = ""
+    hostOs : string = ""
+    hostCpu : string = ""
     placeError : string = ""
   }
 
@@ -176,6 +178,8 @@ orbital OrbPackagesOrbital {
         (set @entity.orbPackage "")
         (set @entity.unamed false)
         (set @entity.platformNote "")
+        (set @entity.hostOs "")
+        (set @entity.hostCpu "")
         (set @entity.lock [])
         (set @entity.pkgs [])
         (set @entity.rows [])
@@ -281,14 +285,14 @@ orbital OrbPackagesOrbital {
         (emit PKG_RM_NEXT { })
       PKG_DISPATCH -> ready when (and (not @entity.installed) (= @entity.cmd "add") (= (array/len @entity.args) 0))
         (emit PACKAGES_ANSWERED { status: 400, body: "", stderr: "usage: orb add <package, an at sign and an exact version | tarball url> [--global]" })
-      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "add") (> (array/len @entity.args) 0))
+      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "add") (> (array/len @entity.args) 0) @entity.unamed)
         (set @entity.targets [])
         (set @entity.cursor 0)
         (emit PKG_PLAN_ADD { })
-      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "update") (and @entity.global (not @entity.urgent) (not @entity.unamed)))
+      PKG_DISPATCH -> resolving when (and (not @entity.installed) (or (= @entity.cmd "update") (and (= @entity.cmd "add") (> (array/len @entity.args) 0))) (not @entity.unamed))
         (set @entity.targets [])
         (os/uname { key: "uname" emit: { success: PKG_UNAME, failure: PKG_UNAME_FAILED } })
-      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "update") (not (and @entity.global (not @entity.urgent) (not @entity.unamed))))
+      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "update") @entity.unamed)
         (set @entity.targets [])
         (set @entity.subjects (let ((all (array/concat (array/map (array/filter @entity.rows (fn r (not (object/get @r "link")))) (fn r { package: (object/get @r "package"), version: (object/get @r "version"), missing: false })) (if @entity.urgent [] (array/map (array/filter (array/concat @config.baseline (if (!= @entity.orbPackage "") [{ name: @entity.orbPackage, registry: @config.registry }] [])) (fn b (and (= (array/len (array/filter @entity.rows (fn r (= (object/get @r "package") (object/get @b "name"))))) 0) (= (object/get @b "registry") @config.registry)))) (fn b { package: (object/get @b "name"), version: "0.0.0", missing: true })))))) (array/concat (array/filter @all (fn s (= (object/get @s "package") @config.corePackage))) (array/filter @all (fn s (!= (object/get @s "package") @config.corePackage))))))
         (set @entity.refused (if @entity.urgent [] (array/map (array/filter (array/concat @config.baseline (if (!= @entity.orbPackage "") [{ name: @entity.orbPackage, registry: @config.registry }] [])) (fn b (and (= (array/len (array/filter @entity.rows (fn r (= (object/get @r "package") (object/get @b "name"))))) 0) (!= (object/get @b "registry") @config.registry)))) (fn b (str/concat (object/get @b "name") ": ORB_PACKAGE_SOURCE (baseline registry " (object/get @b "registry") " is not the registry knob)")))))
@@ -486,13 +490,15 @@ orbital OrbPackagesOrbital {
       INIT -> resolving
       PKG_UNAME -> dispatching
         (set @entity.unamed true)
-        (set @entity.orbPackage (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "" }) "package"))
-        (set @entity.platformNote (if (= (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "" }) "package") "") (str/concat "orb: ORB_PACKAGE_PLATFORM (" @payload.sysname " " @payload.machine " has no orb platform package in the orbPlatforms knob; the orb binary was not considered)") ""))
+        (set @entity.hostOs (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "", os: "", cpu: "" }) "os"))
+        (set @entity.hostCpu (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "", os: "", cpu: "" }) "cpu"))
+        (set @entity.orbPackage (if (and @entity.global (= @entity.cmd "update") (not @entity.urgent)) (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "", os: "", cpu: "" }) "package") ""))
+        (set @entity.platformNote (if (or (not (and @entity.global (= @entity.cmd "update") (not @entity.urgent))) (!= (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "", os: "", cpu: "" }) "package") "")) "" (str/concat "orb: ORB_PACKAGE_PLATFORM (" @payload.sysname " " @payload.machine " has no orb platform package in the orbPlatforms knob; the orb binary was not considered)")))
         (emit PKG_DISPATCH { })
       PKG_UNAME_FAILED -> dispatching
         (set @entity.unamed true)
         (set @entity.orbPackage "")
-        (set @entity.platformNote (str/concat "orb: ORB_PACKAGE_PLATFORM (the platform could not be determined: " (default @payload.error "") "; the orb binary was not considered)"))
+        (set @entity.platformNote (if (and @entity.global (= @entity.cmd "update") (not @entity.urgent)) (str/concat "orb: ORB_PACKAGE_PLATFORM (the platform could not be determined: " (default @payload.error "") "; the orb binary was not considered)") ""))
         (emit PKG_DISPATCH { })
       PKG_BACKUP_NEXT -> resolving when (and @entity.hadOld @entity.global)
         (os/rmdir (str/concat "~/.orb/node_modules/" (str/concat @entity.stage ".old")) true { key: "backupclear" emit: { success: PKG_BACKUP_GONE, failure: PKG_BACKUP_GONE } })
@@ -609,8 +615,11 @@ orbital OrbPackagesOrbital {
         (emit PKG_DOWNLOAD { url: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "url") })
       PKG_TARGET_NEXT -> resolving when (and (< @entity.cursor (array/len @entity.targets)) (= (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "url") ""))
         (emit PK_GET { key: "resolve", method: "GET", target: (str/concat "/" (str/join (str/split (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name") "/") "%2f") "/" (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version")), headers: [{ name: "accept", value: "application/json" }], body: (bytes/from-string ""), stream: "none" })
-      PKG_RESOLVED -> downloading when (and (!= @entity.mf null) (!= (object/get @entity.mf "dist") null))
-        (set @entity.targets (array/map (array/range 0 (array/len @entity.targets)) (fn i (if (= @i @entity.cursor) { name: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"), version: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version"), url: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "tarball") ""), integrity: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "integrity") "") } (default (array/nth @entity.targets @i) { name: "", version: "", url: "", integrity: "" })))))
+      PKG_RESOLVED -> resolving when (and (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "platform") false) (!= @entity.mf null) (not (and (array/includes (default (object/get @entity.mf "os") []) @entity.hostOs) (array/includes (default (object/get @entity.mf "cpu") []) @entity.hostCpu))))
+        (set @entity.cursor (+ @entity.cursor 1))
+        (emit PKG_TARGET_NEXT { })
+      PKG_RESOLVED -> downloading when (and (!= @entity.mf null) (!= (object/get @entity.mf "dist") null) (not (and (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "platform") false) (not (and (array/includes (default (object/get @entity.mf "os") []) @entity.hostOs) (array/includes (default (object/get @entity.mf "cpu") []) @entity.hostCpu))))))
+        (set @entity.targets (array/map (array/range 0 (array/len @entity.targets)) (fn i (if (= @i @entity.cursor) { name: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"), version: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version"), url: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "tarball") ""), integrity: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "integrity") ""), platform: (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "platform") false) } (default (array/nth @entity.targets @i) { name: "", version: "", url: "", integrity: "" })))))
         (emit PKG_DOWNLOAD { url: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "tarball") "") })
       PKG_RESOLVED -> resolving when (or (= @entity.mf null) (= (object/get @entity.mf "dist") null))
         (set @entity.refused (array/append @entity.refused (str/concat (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name") " version " (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version") ": ORB_PACKAGE_NOT_FOUND (registry answered " @payload.status ")")))
@@ -684,7 +693,7 @@ orbital OrbPackagesOrbital {
         (set @entity.cursor (+ @entity.cursor 1))
         (emit PKG_TARGET_NEXT { })
       PKG_UNTARRED -> installing when (and (!= @entity.tar null) (default (object/get @entity.tar "ok") false))
-        (set @entity.files (default (object/get @entity.tar "entries") []))
+        (set @entity.files (let ((es (default (object/get @entity.tar "entries") []))) (let ((pj (array/find @es (fn e (= (object/get @e "path") "package/package.json"))))) (let ((bins (if (= @pj null) [] (let ((m (json/parse (default (bytes/to-string (object/get @pj "data")) "") OrbPackagesManifest))) (if (= @m null) [] (array/map (object/entries (default (object/get @m "bin") {})) (fn b (str/concat "package/" (str/replace-pattern (default (array/nth @b 1) "") "^\\./" ""))))))))) (array/map @es (fn e { path: (object/get @e "path"), data: (object/get @e "data"), executable: (or (object/get @e "executable") (array/includes @bins (object/get @e "path"))) }))))))
         (set @entity.tar null)
         (emit PKG_LAYOUT { })
       PKG_LAYOUT -> resolving when (or (= (array/len @entity.files) 0) (> (array/len (array/filter @entity.files (fn e (not (str/startsWith (object/get @e "path") "package/"))))) 0))
@@ -761,7 +770,8 @@ orbital OrbPackagesOrbital {
         (set @entity.lock (array/append (array/filter @entity.lock (fn l (!= (object/get @l "name") (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name")))) { name: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"), version: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version"), url: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "url"), integrity: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "integrity") }))
         (set @entity.lockDirty true)
         (set @entity.applied (if (array/includes ["security", "critical"] (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "severity") "normal")) (array/append @entity.applied (str/concat (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "severity") "") " update: " (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name") " " (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "installedVersion") "") " → " (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version") ": " (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "advisory") ""))) @entity.applied))
-        (set @entity.done (array/append @entity.done (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name")))
+        (set @entity.done (if (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "platform") false) @entity.done (array/append @entity.done (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"))))
+        (set @entity.targets (let ((pj (array/find @entity.files (fn e (= (object/get @e "path") "package/package.json"))))) (let ((m (if (= @pj null) null (json/parse (default (bytes/to-string (object/get @pj "data")) "") OrbPackagesManifest)))) (if (or (= @m null) (= (object/get @m "orbProgram") null) (= @entity.hostOs "")) @entity.targets (array/concat @entity.targets (array/map (object/entries (default (object/get @m "optionalDependencies") {})) (fn d { name: (array/nth @d 0), version: (array/nth @d 1), url: "", integrity: "", platform: true })))))))
         (set @entity.files [])
         (set @entity.tarball (bytes/from-string ""))
         (emit PACKAGE_INSTALLED { name: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"), version: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version"), kinds: [] })
@@ -1076,7 +1086,7 @@ orbital OrbPackagesOrbital {
       baseline : [BaselineEntry] = [{ name: (quote "@almadar/core"), registry: "https://registry.npmjs.org" }, { name: (quote "@almadar/std"), registry: "https://registry.npmjs.org" }, { name: (quote "@almadar/lolo-ar"), registry: "https://registry.npmjs.org" }, { name: (quote "@almadar/lolo-sl"), registry: "https://registry.npmjs.org" }, { name: (quote "@almadar/orb-shell-typescript"), registry: "https://registry.npmjs.org" }]
         @label "Baseline"
         @description "The packages `orb update` installs when missing, each resolved like an upgrade from nothing: the newest stable, non-deprecated version whose language is compatible (core: its orbLanguage.version is in the range this orb reads; any other package: its language range accepts the core language this update installs, else the installed one), read from its registry."
-      orbPlatforms : [OrbPlatform] = [{ sysname: "Darwin", machine: "arm64", package: (quote "@almadar/orb-darwin-arm64") }, { sysname: "Darwin", machine: "x86_64", package: (quote "@almadar/orb-darwin-x64") }, { sysname: "Linux", machine: "x86_64", package: (quote "@almadar/orb-linux-x64") }, { sysname: "Linux", machine: "aarch64", package: (quote "@almadar/orb-linux-arm64") }, { sysname: "Linux", machine: "arm64", package: (quote "@almadar/orb-linux-arm64") }, { sysname: "Windows_NT", machine: "AMD64", package: (quote "@almadar/orb-windows-x64") }]
+      orbPlatforms : [OrbPlatform] = [{ sysname: "Darwin", machine: "arm64", package: (quote "@almadar/orb-darwin-arm64"), os: "darwin", cpu: "arm64" }, { sysname: "Darwin", machine: "x86_64", package: (quote "@almadar/orb-darwin-x64"), os: "darwin", cpu: "x64" }, { sysname: "Linux", machine: "x86_64", package: (quote "@almadar/orb-linux-x64"), os: "linux", cpu: "x64" }, { sysname: "Linux", machine: "aarch64", package: (quote "@almadar/orb-linux-arm64"), os: "linux", cpu: "arm64" }, { sysname: "Linux", machine: "arm64", package: (quote "@almadar/orb-linux-arm64"), os: "linux", cpu: "arm64" }, { sysname: "Windows_NT", machine: "AMD64", package: (quote "@almadar/orb-windows-x64"), os: "win32", cpu: "x64" }]
         @label "Orb platform packages"
         @description "The orb binary's own package per platform, keyed by the sysname and machine os/uname answers. `orb update --global` (not --urgent) asks os/uname and resolves the entry that matches this host like a baseline package, in the registry knob, but on its own compatibility rule: an orb platform package has no language range, so a version is compatible when its package.json declares orbReads, a range of core languages, and the target core language satisfies it (a version with no orbReads is skipped ORB_PACKAGE_NO_LANGUAGE). A host that matches no entry, or whose os/uname fails, gets one loud ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered."
       maxUnpackedBytes : number = 536870912

package/behaviors/lolo/spec/cli/orb-packages.lolo

@@ -1,6 +1,6 @@
 app orb-packages-spec [
   version: "1.0.0",
-  description: "Design contract for `orb add|update|remove|list [--global]` and `orb engines add|update|remove|list`, the client of the npm registry. Golden = orbital-cli packages.rs and engines_cmd.rs today; the change is that a package is installed at one exact version from its npm tarball and the lockfile {name, version, url, integrity} replaces bun (ranges are refused with ORB_PACKAGE_RANGE). Tarballs are valid sources only under the registry knob (default https://registry.npmjs.org; the origin the composed std-http-client trait is configured with, its host a net grant) or the sourceOrigin knob; any other host is refused ORB_PACKAGE_SOURCE. A name resolves through the registry knob: GET /<name> (the packument, slash encoded %2f) for update, GET /<name>/<version> for add. Integrity is dist.integrity, `sha512-` plus the base64 sha512 of the downloaded gzip tarball; a mismatch installs nothing. The tarball is gunzipped and read as ustar by the kernel (a codec refusal is ORB_PACKAGE_ARCHIVE (<code>)), every entry must sit under package/ (ORB_PACKAGE_LAYOUT), the files are written into node_modules/.orb-staging/<name>@<version>, the old package is removed, the staging directory is renamed into place and only then is the lock entry recorded and the lockfile written. A package kind is read from its package.json: orbLanguage = language, orb = behaviors, orbVocabulary = language pack, orbProgram.kind shell|desktop = shell|desktop; no kind is refused ORB_PACKAGE_NOT_ORB with `<name>: not an orb package (its package.json declares none of orbLanguage, orb, orbVocabulary, orbProgram)`. add: installs, then checks each named or newly appeared package; a clean one prints `added <name>@<version> (<kinds joined by , >)`; one that declares no kind or does not load is refused and, if this call added it, removed again; any refusal fails with `not added:` and one indented `<name>: <problem>` line per refusal; an install that yields no package fails `installed nothing for <specs>`. update: resolves every non-linked orb package and every missing baseline package (the `baseline` knob: {name, registry} entries; core, std, the language packs, the typescript shell) like an upgrade from nothing, moving each to the highest non-deprecated stable version by semver order that is language-compatible (core: its orbLanguage.version satisfies the range this orb reads; every other package: its language range, orb, orbLanguage, orbVocabulary or orbProgram .language, the first present in the packument, is satisfied by the target core language, the orbLanguage.version of the core version this update installs, else of the installed core; core resolves first); a missing baseline package with no compatible version fails the update (the range this orb reads is the R of the `orb X.Y.Z (language R)` answer of `orb --version`, any other answer refuses the update; checks use std-semver; a version whose manifest records no language is treated as incompatible, never guessed, and named on stderr as `<name>@<version>: ORB_PACKAGE_NO_LANGUAGE (...)`, an unsatisfied one as `ORB_PACKAGE_INCOMPATIBLE`, only for versions newer than the installed one), written exact into the lockfile (a workspace-linked package is never updated), prints the list rows and, after them, one `<severity> update: <name> <from> → <to>: <advisory>` line for every applied version whose registry manifest carries orbRelease severity security or critical, removes again what this call added and does not load, records the update check, and fails `these packages do not load for this orb:` with one indented `<name>: <problem>` line each. update --global also keeps this host's orb binary package installed (the orbPlatforms knob maps the os/uname sysname and machine to @almadar/orb-darwin-arm64, -darwin-x64, -linux-x64, -linux-arm64 or -windows-x64), resolved like a baseline package in the registry knob but on its own compatibility rule: an orb platform package has no language range, so its newest stable, non-deprecated version is taken whose package.json declares orbReads, a range of core languages the target core language satisfies (no orbReads: skipped ORB_PACKAGE_NO_LANGUAGE; its orb and orbProgram blocks are not read); a package declaring orbReads is listed with kind `orb`; a host with no matching entry or whose os/uname fails gets one ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered (the Windows host does not implement os/uname today). update --urgent (update only; any other command is refused with the usage line): every version may carry a top-level orbRelease { severity security|critical|normal, advisory (one line), fixes (a semver range of earlier versions it fixes) } in its registry manifest (none, or an unknown severity word, is normal); a package is urgent when a stable, non-deprecated version newer than the installed one is security or critical, declares fixes, the installed version satisfies fixes (std-semver) and the version passes the language check above; only urgent packages are updated, to the newest such version, through the same integrity check, staging swap and lockfile write; a baseline package that is not installed is never urgent; stdout is only the applied `<severity> update:` lines; an urgent version that fails the language check (ORB_PACKAGE_INCOMPATIBLE or ORB_PACKAGE_NO_LANGUAGE), whose fixes range std-semver refuses (ORB_PACKAGE_RELEASE), or whose download, integrity or install fails is not applied: the installed version stays, the call answers 500 and stderr names each refusal and each confirmed-urgent advisory, the vulnerable version is never replaced by a half-written one. remove: a workspace-linked package is refused ORB_PACKAGE_LINKED and its link is never deleted; a behavior package whose prefix a .lolo or .orb file still imports (skipping node_modules, .git, dist, target) is refused `refusing to remove '<name>': N file(s) still import '<prefix>/':` plus the files, one per line; otherwise prints `removed <name>` per name. list: one row per installed orb package, sorted by name, columns package (34), version (12), kinds joined by `, ` (26), then `ok` or the problem, ` (linked)` for a workspace link, and ` [<prefix>/, N behaviors]` for a behavior package; --json prints the rows { package, kinds, version, path, link, prefix?, behaviors?, problem } as pretty JSON; with no rows the table is empty and stderr says `orb: nothing is installed in <dir> (no @almadar/core or @almadar/std); run `orb update --global` to set the language up`. Without --global the project directory is used, falling back to the user store when there is no project. Engines: `engines add|update` install the pinned runtime-verify/compiled engine packages at the exact pinned version (`installed <package>@<version> (entry <bin> → <path>)`; a wrong version fails `<package>: expected version <v>, got <w>`, a missing bin entry `<package>: installed package has no `<bin>` bin entry`, a package not found after install `<package>: install reported success but the package was not found`), update prints `updated <package>: <old> → <new>` or `<package>@<old> already up to date` or `installed <package>@<version>`, remove prints `removed <package>`, list prints rows engine (16), package (32), version (12), link (6), path, or `not installed — <hint>`, --json the rows { engine, package, version, entry, path, installed, link }."
+  description: "Design contract for `orb add|update|remove|list [--global]` and `orb engines add|update|remove|list`, the client of the npm registry. Golden = orbital-cli packages.rs and engines_cmd.rs today; the change is that a package is installed at one exact version from its npm tarball and the lockfile {name, version, url, integrity} replaces bun (ranges are refused with ORB_PACKAGE_RANGE). Tarballs are valid sources only under the registry knob (default https://registry.npmjs.org; the origin the composed std-http-client trait is configured with, its host a net grant) or the sourceOrigin knob; any other host is refused ORB_PACKAGE_SOURCE. A name resolves through the registry knob: GET /<name> (the packument, slash encoded %2f) for update, GET /<name>/<version> for add. Integrity is dist.integrity, `sha512-` plus the base64 sha512 of the downloaded gzip tarball; a mismatch installs nothing. The tarball is gunzipped and read as ustar by the kernel (a codec refusal is ORB_PACKAGE_ARCHIVE (<code>)), every entry must sit under package/ (ORB_PACKAGE_LAYOUT), the files are written into node_modules/.orb-staging/<name>@<version>, the old package is removed, the staging directory is renamed into place and only then is the lock entry recorded and the lockfile written. A package kind is read from its package.json: orbLanguage = language, orb = behaviors, orbVocabulary = language pack, orbProgram.kind shell|desktop = shell|desktop; no kind is refused ORB_PACKAGE_NOT_ORB with `<name>: not an orb package (its package.json declares none of orbLanguage, orb, orbVocabulary, orbProgram)`. add: installs, then checks each named or newly appeared package; a clean one prints `added <name>@<version> (<kinds joined by , >)`; one that declares no kind or does not load is refused and, if this call added it, removed again; any refusal fails with `not added:` and one indented `<name>: <problem>` line per refusal; an install that yields no package fails `installed nothing for <specs>`. update: resolves every non-linked orb package and every missing baseline package (the `baseline` knob: {name, registry} entries; core, std, the language packs, the typescript shell) like an upgrade from nothing, moving each to the highest non-deprecated stable version by semver order that is language-compatible (core: its orbLanguage.version satisfies the range this orb reads; every other package: its language range, orb, orbLanguage, orbVocabulary or orbProgram .language, the first present in the packument, is satisfied by the target core language, the orbLanguage.version of the core version this update installs, else of the installed core; core resolves first); a missing baseline package with no compatible version fails the update (the range this orb reads is the R of the `orb X.Y.Z (language R)` answer of `orb --version`, any other answer refuses the update; checks use std-semver; a version whose manifest records no language is treated as incompatible, never guessed, and named on stderr as `<name>@<version>: ORB_PACKAGE_NO_LANGUAGE (...)`, an unsatisfied one as `ORB_PACKAGE_INCOMPATIBLE`, only for versions newer than the installed one), written exact into the lockfile (a workspace-linked package is never updated), prints the list rows and, after them, one `<severity> update: <name> <from> → <to>: <advisory>` line for every applied version whose registry manifest carries orbRelease severity security or critical, removes again what this call added and does not load, records the update check, and fails `these packages do not load for this orb:` with one indented `<name>: <problem>` line each. update --global also keeps this host's orb binary package installed (the orbPlatforms knob maps the os/uname sysname and machine to @almadar/orb-darwin-arm64, -darwin-x64, -linux-x64, -linux-arm64 or -windows-x64), resolved like a baseline package in the registry knob but on its own compatibility rule: an orb platform package has no language range, so its newest stable, non-deprecated version is taken whose package.json declares orbReads, a range of core languages the target core language satisfies (no orbReads: skipped ORB_PACKAGE_NO_LANGUAGE; its orb and orbProgram blocks are not read); a package declaring orbReads is listed with kind `orb`; a host with no matching entry or whose os/uname fails gets one ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered (the Windows host does not implement os/uname today). A package whose package.json declares orbProgram also installs each of its optionalDependencies at its exact version whose registry manifest os and cpu include this host's (the os and cpu of the orbPlatforms entry os/uname matched, the npm platform rule; every add and update asks os/uname); a host os/uname cannot place installs none of them. Every file the package.json bin map names is written executable. update --urgent (update only; any other command is refused with the usage line): every version may carry a top-level orbRelease { severity security|critical|normal, advisory (one line), fixes (a semver range of earlier versions it fixes) } in its registry manifest (none, or an unknown severity word, is normal); a package is urgent when a stable, non-deprecated version newer than the installed one is security or critical, declares fixes, the installed version satisfies fixes (std-semver) and the version passes the language check above; only urgent packages are updated, to the newest such version, through the same integrity check, staging swap and lockfile write; a baseline package that is not installed is never urgent; stdout is only the applied `<severity> update:` lines; an urgent version that fails the language check (ORB_PACKAGE_INCOMPATIBLE or ORB_PACKAGE_NO_LANGUAGE), whose fixes range std-semver refuses (ORB_PACKAGE_RELEASE), or whose download, integrity or install fails is not applied: the installed version stays, the call answers 500 and stderr names each refusal and each confirmed-urgent advisory, the vulnerable version is never replaced by a half-written one. remove: a workspace-linked package is refused ORB_PACKAGE_LINKED and its link is never deleted; a behavior package whose prefix a .lolo or .orb file still imports (skipping node_modules, .git, dist, target) is refused `refusing to remove '<name>': N file(s) still import '<prefix>/':` plus the files, one per line; otherwise prints `removed <name>` per name. list: one row per installed orb package, sorted by name, columns package (34), version (12), kinds joined by `, ` (26), then `ok` or the problem, ` (linked)` for a workspace link, and ` [<prefix>/, N behaviors]` for a behavior package; --json prints the rows { package, kinds, version, path, link, prefix?, behaviors?, problem } as pretty JSON; with no rows the table is empty and stderr says `orb: nothing is installed in <dir> (no @almadar/core or @almadar/std); run `orb update --global` to set the language up`. Without --global the project directory is used, falling back to the user store when there is no project. Engines: `engines add|update` install the pinned runtime-verify/compiled engine packages at the exact pinned version (`installed <package>@<version> (entry <bin> → <path>)`; a wrong version fails `<package>: expected version <v>, got <w>`, a missing bin entry `<package>: installed package has no `<bin>` bin entry`, a package not found after install `<package>: install reported success but the package was not found`), update prints `updated <package>: <old> → <new>` or `<package>@<old> already up to date` or `installed <package>@<version>`, remove prints `removed <package>`, list prints rows engine (16), package (32), version (12), link (6), path, or `not installed — <hint>`, --json the rows { engine, package, version, entry, path, installed, link }."
 ]
 
 type PackageKind = "language" | "behaviors" | "language pack" | "shell" | "desktop" | "orb"