@astrale-os/cli 1.0.0-beta.22 → 1.0.0-beta.23

package/dist/public/connect-core.js

@@ -8242,14 +8242,14 @@ function isPidAlive(pid) {
 function sleep(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
-// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.12/node_modules/@astrale-os/kernel-dsl/dist/value/limits.js
+// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.13/node_modules/@astrale-os/kernel-dsl/dist/value/limits.js
 var defaultLimits = Object.freeze({
   maxBytes: 16 * 1024 * 1024,
   maxDepth: 64,
   maxMembers: 1e5,
   maxStringBytes: 1024 * 1024
 });
-// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.12/node_modules/@astrale-os/kernel-dsl/dist/value/canonical.js
+// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.13/node_modules/@astrale-os/kernel-dsl/dist/value/canonical.js
 var encoder2 = new TextEncoder;
 // node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/scanner.js
 var CharacterCodes;
@@ -8429,7 +8429,7 @@ var ParseErrorCode;
   ParseErrorCode2[ParseErrorCode2["InvalidCharacter"] = 16] = "InvalidCharacter";
 })(ParseErrorCode || (ParseErrorCode = {}));
 
-// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.12/node_modules/@astrale-os/kernel-dsl/dist/value/decode.js
+// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.13/node_modules/@astrale-os/kernel-dsl/dist/value/decode.js
 var decoder2 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var exports_external = {};
@@ -23659,7 +23659,7 @@ var log = {
   dim: (msg) => console.log(source_default.dim(msg))
 };
 var IS_CI = !!(process.env.CI || process.env.CONTINUOUS_INTEGRATION || process.env.NO_SPINNER);
-// node_modules/.pnpm/@astrale-os+kernel-core@0.9.0-beta.15/node_modules/@astrale-os/kernel-core/dist/dns-label.js
+// node_modules/.pnpm/@astrale-os+kernel-core@0.9.0-beta.16/node_modules/@astrale-os/kernel-core/dist/dns-label.js
 var DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 function isDnsLabel(value) {
   return DNS_LABEL_RE.test(value);

package/dist/types/admin/contract.d.ts

@@ -1,5 +1,5 @@
 import type { Input } from '@astrale-os/sdk/client';
-import type { ClientSession } from '@astrale-os/sdk/client/session';
+import type { ClientSession, SessionRequestOptions } from '@astrale-os/sdk/client/session';
 import type { ClassRef } from '@astrale-os/sdk/schema';
 import { Path } from '@astrale-os/sdk/graph/path';
 export declare const AdminContract: Readonly<{
@@ -23,4 +23,4 @@ export declare const AdminContract: Readonly<{
     }>;
 }>;
 /** Invoke one stable Admin instance Method without schema discovery or reflection. */
-export declare function callAdminMethod(session: ClientSession, receiver: Path, method: string, input: Input): Promise<unknown>;
+export declare function callAdminMethod(session: ClientSession, receiver: Path, method: string, input: Input, options?: SessionRequestOptions): Promise<unknown>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.22",
+  "version": "1.0.0-beta.23",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -62,8 +62,8 @@
   },
   "devDependencies": {
     "@astrale-os/ox": ">=0.1.3 <1.0.0",
-    "@astrale-os/sdk": "0.5.0-beta.50",
-    "@astrale-os/shell": "0.4.2-beta.5",
+    "@astrale-os/sdk": "0.5.0-beta.51",
+    "@astrale-os/shell": "0.4.2-beta.6",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@commitlint/cli": "21.2.2",
     "@commitlint/config-conventional": "21.2.2",
@@ -98,7 +98,7 @@
   "scripts": {
     "build": "bun scripts/build.ts",
     "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-public-dependency-boundary.mjs",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.tests.json && tsc --noEmit -p viewer && pnpm --dir studio run typecheck",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.tests.json && tsc --noEmit -p tsconfig.scripts.json && tsc --noEmit -p viewer && pnpm --dir studio run typecheck",
     "lint": "oxlint .",
     "lint:fix": "oxlint --fix .",
     "format": "pnpm exec oxfmt --write .",

package/src/admin/contract.ts

@@ -1,5 +1,5 @@
 import type { Input } from '@astrale-os/sdk/client'
-import type { ClientSession } from '@astrale-os/sdk/client/session'
+import type { ClientSession, SessionRequestOptions } from '@astrale-os/sdk/client/session'
 import type { ClassRef } from '@astrale-os/sdk/schema'
 
 import { call } from '@astrale-os/sdk/client'
@@ -41,6 +41,7 @@ export function callAdminMethod(
   receiver: Path,
   method: string,
   input: Input,
+  options?: SessionRequestOptions,
 ): Promise<unknown> {
-  return session.call(call(Path.instanceMethod(receiver, method), input))
+  return session.call(call(Path.instanceMethod(receiver, method), input), options)
 }

package/src/commands/__tests__/read-commands.test.ts

@@ -6,6 +6,12 @@ type GraphContext = {
     getOrThrow: typeof getOrThrowMock
     mutate: typeof mutateMock
   }
+  session: {
+    schema: {
+      inspect: typeof inspectMock
+      bundle: typeof bundleMock
+    }
+  }
 }
 
 type RunOpts = {
@@ -36,6 +42,8 @@ let mutations: unknown[] = []
 let queryResult: unknown
 let getResult: unknown
 let mutationResult: unknown
+let inspectResult: unknown
+let bundleResult: unknown
 let selfFailure: unknown
 let selfContexts: unknown[] = []
 
@@ -51,6 +59,8 @@ const mutateMock = mock(async (mutation: unknown) => {
   mutations.push(mutation)
   return mutationResult
 })
+const inspectMock = mock(async (_origin: string) => inspectResult)
+const bundleMock = mock(async (_origin: string) => bundleResult)
 const expandSelfInPathMock = mock(async (path: string, context: unknown) => {
   selfContexts.push(context)
   if (selfFailure !== undefined) throw selfFailure
@@ -65,6 +75,7 @@ const expandSelfInPathMock = mock(async (path: string, context: unknown) => {
 const withSelfHintMock = mock(async (action: () => Promise<unknown>) => action())
 const commandContext = {
   graph: { query: queryMock, getOrThrow: getOrThrowMock, mutate: mutateMock },
+  session: { schema: { inspect: inspectMock, bundle: bundleMock } },
 }
 const runKernelCommandMock = mock(async (run: RunOpts) => {
   const result = await run.fn(commandContext)
@@ -93,11 +104,22 @@ beforeEach(() => {
   }
   getResult = undefined
   mutationResult = { createdNodes: {} }
+  inspectResult = {
+    origin: 'notes.example.dev',
+    revision: 'notes-v1',
+    generation: 'sha256:generation',
+  }
+  bundleResult = {
+    domain: inspectResult,
+    bundle: { origin: 'notes.example.dev', revision: 'notes-v1' },
+  }
   selfFailure = undefined
   selfContexts = []
   queryMock.mockClear()
   getOrThrowMock.mockClear()
   mutateMock.mockClear()
+  inspectMock.mockClear()
+  bundleMock.mockClear()
   expandSelfInPathMock.mockClear()
   withSelfHintMock.mockClear()
   runKernelCommandMock.mockClear()
@@ -280,6 +302,40 @@ describe('get command', () => {
   })
 })
 
+describe('introspect command', () => {
+  test('uses the split SDK Schema API without recreating the retired introspection request', async () => {
+    const { introspectCommand } = await import('../introspect')
+
+    await introspectCommand(
+      'notes.example.dev',
+      { json: true },
+      {
+        runKernelCommand: runKernelCommandMock as never,
+      },
+    )
+
+    expect(inspectMock).toHaveBeenCalledWith('notes.example.dev')
+    expect(bundleMock).not.toHaveBeenCalled()
+    expect(JSON.parse(stdout)).toEqual(inspectResult)
+  })
+
+  test('requests the immutable bundle only when explicitly selected', async () => {
+    const { introspectCommand } = await import('../introspect')
+
+    await introspectCommand(
+      'notes.example.dev',
+      { json: true, bundle: true },
+      {
+        runKernelCommand: runKernelCommandMock as never,
+      },
+    )
+
+    expect(bundleMock).toHaveBeenCalledWith('notes.example.dev')
+    expect(inspectMock).not.toHaveBeenCalled()
+    expect(JSON.parse(stdout)).toEqual(bundleResult)
+  })
+})
+
 describe('mutate command', () => {
   /** @evidence TEST-CLI-MUTATE-DISPATCHES-CANONICAL-V3 */
   test('admits authoring input and dispatches one canonical Mutation V3 document', async () => {

package/src/commands/__tests__/view.test.ts

@@ -52,7 +52,6 @@ const resolved = [
         kind: 'definition' as const,
         definitions: [{ origin: 'ai-gateway.astrale.ai', kind: 'class' as const, name: 'Model' }],
       },
-      auth: 'required' as const,
     },
   }),
   route({
@@ -62,7 +61,7 @@ const resolved = [
     issuer: 'https://ai-gateway.astrale.ai',
     etag: `sha256:${'c'.repeat(64)}`,
     revision: `sha256:${'d'.repeat(64)}`,
-    declaration: { target: { kind: 'domain' as const }, auth: 'public' as const },
+    declaration: { target: { kind: 'domain' as const } },
   }),
 ]
 

package/src/commands/introspect.ts

@@ -38,14 +38,13 @@ export async function introspectCommand(
     opts,
     label: `Introspect ${origin}`,
     fn: async ({ session }) => {
-      const includeBundle = wantsCallable || opts.bundle === true
-      const result = await readInstalledDomain(session.schema, origin, includeBundle)
       if (wantsCallable) {
-        const described = describeCallableFromBundle(path, (result as DomainBundle).bundle)
+        const result = await readInstalledDomain(session.schema, origin, true)
+        const described = describeCallableFromBundle(path, result.bundle)
         if (described === undefined) throw missingCallableDescription(path.raw)
         return described
       }
-      return result
+      return readInstalledDomain(session.schema, origin, opts.bundle === true)
     },
     format: (value, format) => output(value, format),
   })
@@ -110,11 +109,11 @@ export default {
   description: 'Read installed Domain schema from the Kernel Schema syscall',
   afterHelpText: `
 Behavior:
-  Calls the public Kernel introspect syscall for one installed Domain.
-  A bare origin (kernel.astrale.ai or /:kernel.astrale.ai) prints installation
-  state, target, source, readiness, and capabilities. --bundle includes the
-  schema bundle. A method or Function Path projects that callable's
-  input/output from the installed bundle.
+  Calls the public SDK Schema API for one installed Domain. A bare origin
+  (kernel.astrale.ai or /:kernel.astrale.ai) prints its exact revision,
+  generation, publication, readiness, capabilities, and bindings. --bundle
+  includes the schema bundle. A method or Function Path projects that
+  callable's input/output from the installed bundle.
 
 Examples:
   $ astrale introspect kernel.astrale.ai

package/src/ui/.spec/architecture.md

@@ -4,10 +4,11 @@ This private CLI owner manages an existing local React project. It does not conn
 does not add React, Base UI, Tailwind, shadcn, or the UI runtime to the installed CLI dependency
 graph.
 
-One registry operation resolves one immutable UI commit. Package compatibility and registry reads
-use that commit. Patterns and blocks invoke the release-qualified shadcn CLI on demand through the
-detected package manager. Released themes copy the exact admitted embedded CSS directly, while a
-local playground export is admitted and copied without registry or shadcn. Both theme paths install
-consumer-owned source and activate it through one project-relative CSS
-import, and complete application writes before the lock advances. Dry-run, list, and doctor do not
-claim a file mutation.
+One registry operation resolves one immutable UI commit. During the V1 prerelease, operations
+without an explicit version resolve the npm `beta` dist-tag; the legacy `latest` channel is not a V1
+source. Package compatibility and registry reads use that commit. Patterns and blocks invoke the
+release-qualified shadcn CLI on demand through the detected package manager. Released themes copy
+the exact admitted embedded CSS directly, while a local playground export is admitted and copied
+without registry or shadcn. Both theme paths install consumer-owned source and activate it through
+one project-relative CSS import, and complete application writes before the lock advances. Dry-run,
+list, and doctor do not claim a file mutation.

package/src/ui/.spec/laws.ts

@@ -1,5 +1,12 @@
 import { defineLaw } from '@astrale-os/spec/authoring'
 
+export const CLI_UI_BETA_DEFAULT = defineLaw({
+  id: 'CLI-UI-BETA-DEFAULT',
+  statement:
+    'Until the UI V1 channel is promoted, an operation without an explicit version resolves the npm beta dist-tag and never the legacy latest dist-tag.',
+  tests: [{ file: '../__tests__/ui.test.ts', id: 'TEST-CLI-UI-BETA-DEFAULT' }],
+})
+
 export const CLI_UI_ONE_SNAPSHOT = defineLaw({
   id: 'CLI-UI-ONE-SNAPSHOT',
   statement:

package/src/ui/__tests__/ui.test.ts

@@ -28,6 +28,30 @@ const registry: UiRegistry = {
     },
   ],
 }
+const componentRegistry: UiRegistry = {
+  name: 'astrale-ui',
+  items: [
+    {
+      name: 'component-sidebar',
+      type: 'registry:component',
+      title: 'Component · sidebar',
+      dependencies: ['@astrale-os/ui@^0.3.0-beta.0', 'lucide-react@1.32.0'],
+      files: [
+        {
+          path: 'sidebar.tsx',
+          type: 'registry:component',
+          target: 'components/astrale/component/sidebar/sidebar.tsx',
+        },
+        {
+          path: 'use-mobile.ts',
+          type: 'registry:hook',
+          target: 'components/astrale/component/sidebar/use-mobile.ts',
+        },
+      ],
+      meta: { canonicalAddress: 'component/sidebar', ownership: 'consumer-source' },
+    },
+  ],
+}
 const themeCss = `/* Generated from observatory.astrale-theme.json. Consumer-owned after installation. */
 :root,
 [data-ui-theme='observatory'] {
@@ -257,15 +281,17 @@ function lock(): UiLock {
 }
 
 describe('UI release and runner contracts', () => {
+  /** @evidence TEST-CLI-UI-BETA-DEFAULT */
   test('resolves the default release from the public beta channel', async () => {
     const seen: string[] = []
+    const fallback = mockFetch()
     const fetcher = (async (input: string | URL | Request, init?: RequestInit) => {
       const url = String(input)
+      seen.push(url)
       if (url.endsWith('/@astrale-os/ui/beta')) {
-        seen.push(url)
         return Response.json({ version: '0.3.0-beta.1' })
       }
-      return mockFetch(seen)(input, init)
+      return fallback(input, init)
     }) as typeof fetch
 
     const release = await resolveUiRelease(undefined, fetcher)
@@ -322,6 +348,36 @@ describe('UI release and runner contracts', () => {
     ])
   })
 
+  test('admits an exact consumer-owned component with item-local dependencies and files', async () => {
+    const release = await resolveUiRelease('0.3.0-beta.0', mockFetch([], componentRegistry))
+    expect(release.registry.items).toEqual([
+      expect.objectContaining({
+        name: 'component-sidebar',
+        type: 'registry:component',
+        dependencies: ['@astrale-os/ui@^0.3.0-beta.0', 'lucide-react@1.32.0'],
+        meta: expect.objectContaining({ canonicalAddress: 'component/sidebar' }),
+        files: [
+          expect.objectContaining({
+            type: 'registry:component',
+            target: 'components/astrale/component/sidebar/sidebar.tsx',
+          }),
+          expect.objectContaining({
+            type: 'registry:hook',
+            target: 'components/astrale/component/sidebar/use-mobile.ts',
+          }),
+        ],
+      }),
+    ])
+  })
+
+  test('rejects a component item that targets another registry ownership category', async () => {
+    const invalid = structuredClone(componentRegistry)
+    invalid.items[0]!.files[0]!.target = 'components/astrale/pattern/sidebar/sidebar.tsx'
+    await expect(resolveUiRelease('0.3.0-beta.0', mockFetch([], invalid))).rejects.toMatchObject({
+      code: 'UI_REGISTRY_UNAVAILABLE',
+    })
+  })
+
   test('lists release themes through the public type filter', async () => {
     const themes = await listUi(
       undefined,
@@ -795,8 +851,60 @@ describe('UI initialization transaction', () => {
     )
   })
 
+  test('preserves an existing development-only UI dependency during initialization', async () => {
+    const root = await fixture()
+    const manifestPath = path.join(root, 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    manifest.devDependencies = { '@astrale-os/ui': '0.3.0-beta.0' }
+    await writeFile(manifestPath, JSON.stringify(manifest))
+
+    await initUi({ path: root, version: '0.3.0-beta.0', install: false }, { fetcher: mockFetch() })
+
+    const written = JSON.parse(await readFile(manifestPath, 'utf8'))
+    expect(written.dependencies['@astrale-os/ui']).toBeUndefined()
+    expect(written.devDependencies['@astrale-os/ui']).toBe('0.3.0-beta.0')
+  })
+
+  test('doctor accepts one exact development dependency and rejects drift or duplication', async () => {
+    const root = await lockedFixture()
+    const manifestPath = path.join(root, 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    delete manifest.dependencies['@astrale-os/ui']
+    manifest.devDependencies = { '@astrale-os/ui': '0.3.0-beta.0' }
+    await writeFile(manifestPath, JSON.stringify(manifest))
+    await writeFile(
+      path.join(root, 'components.json'),
+      JSON.stringify({ style: 'base-nova', tailwind: { css: 'src/index.css' } }),
+    )
+    await writeFile(
+      path.join(root, 'src/index.css'),
+      "@import '@astrale-os/ui/theme.css';\n@import '@astrale-os/ui/presets/astrale.css';\n",
+    )
+
+    expect((await doctorUi(root)).healthy).toBe(true)
+
+    manifest.devDependencies['@astrale-os/ui'] = '0.3.0-beta.1'
+    await writeFile(manifestPath, JSON.stringify(manifest))
+    expect((await doctorUi(root)).checks.find(({ check }) => check === 'package')).toMatchObject({
+      ok: false,
+      detail: 'devDependencies:0.3.0-beta.1',
+    })
+
+    manifest.devDependencies['@astrale-os/ui'] = '0.3.0-beta.0'
+    manifest.dependencies['@astrale-os/ui'] = '0.3.0-beta.0'
+    await writeFile(manifestPath, JSON.stringify(manifest))
+    expect((await doctorUi(root)).checks.find(({ check }) => check === 'package')).toMatchObject({
+      ok: false,
+      detail: 'declared in dependencies and devDependencies',
+    })
+  })
+
   test('repeated exact init performs no release fetch while requested drift rejects', async () => {
     const root = await fixture()
+    const manifestPath = path.join(root, 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    manifest.dependencies['@astrale-os/ui'] = '0.3.0-beta.0'
+    await writeFile(manifestPath, JSON.stringify(manifest))
     await writeFile(path.join(root, 'astrale-ui.lock.json'), JSON.stringify(lock()))
     await writeFile(
       path.join(root, 'components.json'),
@@ -821,6 +929,11 @@ describe('UI initialization transaction', () => {
     await expect(initUi({ path: root, preset: 'compact' })).rejects.toMatchObject({
       code: 'UI_ITEM_CONFLICT',
     })
+    manifest.dependencies['@astrale-os/ui'] = '0.3.0-beta.1'
+    await writeFile(manifestPath, JSON.stringify(manifest))
+    await expect(initUi({ path: root, preset: 'astrale' })).rejects.toMatchObject({
+      code: 'UI_ITEM_CONFLICT',
+    })
   })
 })
 
@@ -1132,6 +1245,38 @@ describe('UI source operations', () => {
     ).toBe('0.3.0-beta.0')
   })
 
+  test('restores a development-only UI dependency without retaining shadcn duplication', async () => {
+    const root = await lockedFixture()
+    const manifestPath = path.join(root, 'package.json')
+    const initial = JSON.parse(await readFile(manifestPath, 'utf8'))
+    delete initial.dependencies['@astrale-os/ui']
+    initial.devDependencies = { '@astrale-os/ui': '0.3.0-beta.0' }
+    await writeFile(manifestPath, JSON.stringify(initial))
+    const installed = path.join(root, 'components/astrale/pattern/chart/line-basic.tsx')
+
+    await addUi(
+      ['pattern/chart/line/basic'],
+      { project: root, yes: true },
+      {
+        fetcher: mockFetch(),
+        runner: async (_file, args) => {
+          if (args[0] === 'dlx') {
+            await mkdir(path.dirname(installed), { recursive: true })
+            await writeFile(installed, 'export const Chart = true\n')
+            const changed = JSON.parse(await readFile(manifestPath, 'utf8'))
+            changed.dependencies['@astrale-os/ui'] = '^0.3.0-beta.0'
+            await writeFile(manifestPath, JSON.stringify(changed))
+          }
+          return { code: 0, stdout: '', stderr: '' }
+        },
+      },
+    )
+
+    const written = JSON.parse(await readFile(manifestPath, 'utf8'))
+    expect(written.dependencies['@astrale-os/ui']).toBeUndefined()
+    expect(written.devDependencies['@astrale-os/ui']).toBe('0.3.0-beta.0')
+  })
+
   test('rolls back item and package state when restoring the locked dependency fails', async () => {
     const root = await lockedFixture()
     const manifestPath = path.join(root, 'package.json')

package/src/ui/operations.ts

@@ -134,8 +134,45 @@ function activateTheme(current: string, statement: string): string {
     .replace(/^\n/u, '')
 }
 
-function manifestDependencies(manifest: Record<string, unknown>): Record<string, string> {
-  return { ...(manifest.dependencies as Record<string, string> | undefined) }
+type ManifestDependencySection = 'dependencies' | 'devDependencies'
+
+function manifestDependencies(
+  manifest: Record<string, unknown>,
+  section: ManifestDependencySection = 'dependencies',
+): Record<string, string> {
+  return { ...(manifest[section] as Record<string, string> | undefined) }
+}
+
+function uiDependencySection(
+  manifest: Record<string, unknown>,
+  fallback: ManifestDependencySection = 'dependencies',
+): ManifestDependencySection {
+  const runtime = Object.hasOwn(manifestDependencies(manifest), UI_PACKAGE)
+  const development = Object.hasOwn(manifestDependencies(manifest, 'devDependencies'), UI_PACKAGE)
+  if (runtime && development) {
+    throw new UiError(
+      'UI_PROJECT_UNSUPPORTED',
+      UI_PACKAGE + ' must be declared in exactly one dependency section.',
+      'Remove it from either dependencies or devDependencies, then retry.',
+    )
+  }
+  if (development) return 'devDependencies'
+  if (runtime) return 'dependencies'
+  return fallback
+}
+
+function setUiDependency(
+  manifest: Record<string, unknown>,
+  section: ManifestDependencySection,
+  version: string,
+): void {
+  const other = section === 'dependencies' ? 'devDependencies' : 'dependencies'
+  manifest[section] = { ...manifestDependencies(manifest, section), [UI_PACKAGE]: version }
+  const otherDependencies = manifestDependencies(manifest, other)
+  if (Object.hasOwn(otherDependencies, UI_PACKAGE)) {
+    delete otherDependencies[UI_PACKAGE]
+    manifest[other] = otherDependencies
+  }
 }
 
 function domainRegistryPackagePath(project: UiProject): string {
@@ -294,6 +331,10 @@ export async function initUi(
   }
   if ((await exists(project.uiLockPath)) && !options.force) {
     const lock = await readUiLock(project.uiLockPath)
+    const dependencySection = uiDependencySection(project.packageJson)
+    const dependencyVersion = manifestDependencies(project.packageJson, dependencySection)[
+      UI_PACKAGE
+    ]
     const css = (await readOptional(project.cssPath)) ?? ''
     const components = await readOptional(project.componentsPath)
       .then((value) => (value ? (JSON.parse(value) as Record<string, unknown>) : undefined))
@@ -301,6 +342,7 @@ export async function initUi(
     const requestedVersion = options.version?.replace(/^v/u, '')
     const desired =
       (!requestedVersion || requestedVersion === lock.package.version) &&
+      dependencyVersion === lock.package.version &&
       (!options.preset || options.preset === lock.preset) &&
       css.includes(UI_PACKAGE + '/theme.css') &&
       css.includes(UI_PACKAGE + '/presets/' + lock.preset + '.css') &&
@@ -362,10 +404,7 @@ export async function initUi(
 
   try {
     const manifest = { ...project.packageJson }
-    manifest.dependencies = {
-      ...manifestDependencies(manifest),
-      [UI_PACKAGE]: release.version,
-    }
+    setUiDependency(manifest, uiDependencySection(manifest), release.version)
     await writeDomainRegistryWorkspace(project, manifest)
     await writeJson(project.packageJsonPath, manifest)
 
@@ -461,14 +500,17 @@ export async function initUi(
 async function pinUiDependency(
   project: UiProject,
   version: string,
+  section: ManifestDependencySection,
   runner: UiRunner,
 ): Promise<void> {
   const manifest = JSON.parse(await readFile(project.packageJsonPath, 'utf8')) as Record<
     string,
     unknown
   >
-  if (manifestDependencies(manifest)[UI_PACKAGE] === version) return
-  manifest.dependencies = { ...manifestDependencies(manifest), [UI_PACKAGE]: version }
+  const current = manifestDependencies(manifest, section)[UI_PACKAGE]
+  const other = section === 'dependencies' ? 'devDependencies' : 'dependencies'
+  if (current === version && manifestDependencies(manifest, other)[UI_PACKAGE] === undefined) return
+  setUiDependency(manifest, section, version)
   await writeJson(project.packageJsonPath, manifest)
   const result = await runner(project.manager, ['install'], project.root)
   if (result.code !== 0) {
@@ -663,6 +705,7 @@ export async function addUi(
     return addLocalTheme(localThemes[0]!, project, options)
   }
   const { lock, release } = await lockedRelease(project, dependencies.fetcher)
+  const dependencySection = uiDependencySection(project.packageJson)
   const items = addresses.map((address) => findItem(release, address))
   const themes = items.filter((item) => item.type === 'registry:theme')
   if (themes.length > 1) {
@@ -731,7 +774,12 @@ export async function addUi(
           throw new UiError('UI_TOOL_FAILED', 'The pinned shadcn operation omitted an item file.')
         }
       }
-      await pinUiDependency(project, lock.package.version, dependencies.runner ?? defaultUiRunner)
+      await pinUiDependency(
+        project,
+        lock.package.version,
+        dependencySection,
+        dependencies.runner ?? defaultUiRunner,
+      )
       const theme = themes[0]
       const themeTarget = theme?.files[0]?.target
       if (themeTarget) {
@@ -821,11 +869,24 @@ export async function doctorUi(
       detail: error instanceof Error ? error.message : String(error),
     })
   }
-  const dependencies = manifestDependencies(project.packageJson)
+  const runtimeVersion = manifestDependencies(project.packageJson)[UI_PACKAGE]
+  const developmentVersion = manifestDependencies(project.packageJson, 'devDependencies')[
+    UI_PACKAGE
+  ]
+  const declarations = [runtimeVersion, developmentVersion].filter(
+    (version): version is string => typeof version === 'string',
+  )
+  const packageVersion = declarations.length === 1 ? declarations[0] : undefined
   checks.push({
     check: 'package',
-    ok: typeof dependencies[UI_PACKAGE] === 'string',
-    detail: dependencies[UI_PACKAGE],
+    ok: declarations.length === 1 && (!lock || packageVersion === lock.package.version),
+    detail:
+      declarations.length > 1
+        ? 'declared in dependencies and devDependencies'
+        : packageVersion === undefined
+          ? 'missing'
+          : (runtimeVersion === packageVersion ? 'dependencies:' : 'devDependencies:') +
+            packageVersion,
   })
   const css = (await readOptional(project.cssPath)) ?? ''
   checks.push({ check: 'theme', ok: css.includes(UI_PACKAGE + '/theme.css') })

package/src/ui/release.ts

@@ -250,8 +250,14 @@ function isInstallableItem(item: unknown): item is UiRegistry['items'][number] {
     /^(?:pattern|block)-[a-z0-9-]+$/u.test(candidate.name) &&
     typeof address === 'string' &&
     /^(?:pattern|block)\/[a-z0-9-]+\/[a-z0-9-/]+$/u.test(address)
+  const isComponent =
+    candidate.type === 'registry:component' &&
+    typeof candidate.name === 'string' &&
+    /^component-[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u.test(candidate.name) &&
+    typeof address === 'string' &&
+    /^component\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u.test(address)
   return (
-    (isTheme || isComposition) &&
+    (isTheme || isComposition || isComponent) &&
     (candidate.dependencies === undefined ||
       (Array.isArray(candidate.dependencies) &&
         candidate.dependencies.every(
@@ -274,7 +280,8 @@ function isInstallableItem(item: unknown): item is UiRegistry['items'][number] {
           (candidate.files?.length === 1 &&
             file.type === 'registry:file' &&
             file.target ===
-              'components/astrale/theme/' + address!.slice('theme/'.length) + '.css')),
+              'components/astrale/theme/' + address!.slice('theme/'.length) + '.css')) &&
+        (!isComponent || file.target.startsWith('components/astrale/component/')),
     ) &&
     typeof address === 'string'
   )