@endora-commerce/platform 0.100.0

package/dist/lifecycle/index.js

@@ -0,0 +1,189 @@
+/**
+ * `./lifecycle` — the platform's operator surface, and the third subpath that is
+ * **declared and not published** (`specs/115-lifecycle-container-move/`, D115-4;
+ * `contracts/operator-half.md` §5).
+ *
+ * ## Why it exists at all
+ *
+ * `_lifecycle` is one module whose sources sit in two artefacts. The manifest,
+ * the routes, the Commands, the orchestrator and eight services are in
+ * `packages/platform/src/lifecycle/`; the manifest registry, the divergence
+ * loader and the five `module:*` commands are still in the application. The
+ * application reaches the first half through twelve re-export shims, and each of
+ * those shims forwards to `../../../../packages/platform/dist/lifecycle/…` — a
+ * relative path into a sibling package's build output, which resolves in this
+ * checkout and in **no client instance**. `manifest-index.generated.ts` carries
+ * the same reach for `_lifecycle`'s manifest, which is the sharpest form of it:
+ * the artefact whose whole job is to register the modules a build ships cannot
+ * register `_lifecycle` anywhere but here.
+ *
+ * This barrel is the address those reaches are drained onto. It is one subpath
+ * for one surface, deliberately — a second, `./lifecycle/commands`, would be a
+ * second address for one thing, and a consumer that wants one symbol imports one
+ * symbol.
+ *
+ * ## The rule it carries: no module may name it, ever
+ *
+ * D-160.11 refused to make `_lifecycle` its own package on the ground that it
+ * would be *"a public API with one consumer forever"*. That is an argument
+ * against **publishing** a surface and not against giving it an address, which
+ * is the distinction this subpath is built on: it is declared by the `exports`
+ * map, so `node` and `tsc` resolve it for the host, its five entry points and
+ * the test kit, and it is carried by no *published* barrel, so
+ * `check:platform-surface` reports a module naming it as `host-internal-subpath`
+ * — with no change to that check, because `declaredSubpaths` is read off the
+ * manifest rather than written down.
+ *
+ * `PUBLISHED_SUBPATHS` therefore stays at five, and that is not an omission to
+ * be tidied later. `PlatformSurface.published` is keyed by target file with no
+ * subpath dimension, so a sixth entry there would publish
+ * `ModuleLifecycleOrchestrator` and `installGatingGraph` for a module's
+ * *relative* reach at those files too, and — the check reporting `violations=0`
+ * — would change nothing it prints. A blindness that arrives green.
+ *
+ * The rule the class encodes is one sentence: this surface **drives** the
+ * platform's own presence axis, so a module that could name it could install,
+ * uninstall, enable or disable its siblings. That is `./composition`'s reason
+ * with one noun changed.
+ *
+ * ## What is on it, and why exactly this
+ *
+ * Exactly the names a first-party source outside the platform imports through
+ * `@endora-commerce/platform/lifecycle`, and nothing else. It is a
+ * **consequence** rather than a ruling — unlike `./composition`, whose 27
+ * symbols D-160.14 names one by one — so writing the set down anywhere would be
+ * a derived fact copied into a second place (D-100).
+ * `test/unit/kernel/published-surface.test.ts` derives it from the consumers on
+ * every run and holds the two to each other in both directions: a name here
+ * that nobody imports is surface parked against a future need, and a name
+ * imported that is not here is a consumer that cannot compile.
+ *
+ * A symbol **graduates** to a public barrel in the merge request that first
+ * gives it a module-package production consumer, and leaves this one in the same
+ * merge request (§5, R5.5). Two homes would be two answers to "is this public
+ * API?". There is no such consumer today and none is anticipated.
+ *
+ * ## The population it was derived from until Phase 7, and why that ended
+ *
+ * The consumer rule could not be the rule while the application reached this
+ * surface through fifteen re-export shims: nothing outside the platform named
+ * the specifier, so the ratchet would have been green over nothing — issue
+ * #113's shape. What stood in its place was a *ledger*-derived rule. Each shim
+ * spells `export * from '<target>'`, so the application holds that file's whole
+ * namespace, and a reach could retire onto this barrel only if every name it
+ * yielded were here; the expected set was therefore a function of
+ * `RELATIVE_HOST_REACHES` and the fourteen files it named.
+ *
+ * Phase 3 gave the subpath its first consumers, Phase 5 and Phase 6 added the
+ * five command bodies and the two generated artefacts, and Phase 7 re-pointed
+ * the 112 reaches in `backend/test/**` and deleted the last nine shims. So the
+ * ledger derivation has no population left — no ledgered reach names a platform
+ * lifecycle file, and none will again, because the address exists — and 28
+ * names left with it: symbols that were here only because some shim's
+ * `export *` yielded them and that nobody had ever asked for by name.
+ * `routes.storefront.ts` and `commands/activation.commands.ts` were absent for
+ * that same reason all along.
+ */
+// --- the five `module:*` command bodies, and the seam they take -----------
+// D115-1: the argv grammar, the exit-code table, the orchestrator wiring and
+// the operator's output moved here in Phase 5; five ~20-line entry points stay
+// at their application paths and build the runtime. They were the first names
+// here that no shim ever yielded — the host names them through this specifier —
+// and since Phase 7 that is the only way any name earns its place.
+export {} from './commands/operator-runtime.js';
+export { runInstallCommand } from './commands/install.js';
+export { runUninstallCommand } from './commands/uninstall.js';
+export { runEnableCommand } from './commands/enable.js';
+export { runDisableCommand } from './commands/disable.js';
+export { runStatusCommand } from './commands/status.js';
+// The entry point itself, since `fix/instance-wiring-operator-runtime`. An
+// instance's five files were five lines each over a **90-line** `runtime.ts`
+// that named nothing but platform symbols, and R1.4 bounds the wiring a client
+// maintains at 250 lines in total. What is genuinely the application's is the
+// directory holding `apps/` and its own `mikro-orm.config.js`; both are
+// parameters here, and the rendered file is fourteen lines.
+//
+// **One name, and it is the one the rendered tree imports.**
+// `instanceOperatorRuntime`, `instanceManifestEntries` and
+// `InstanceOperatorRuntimeOptions` were here in that same merge request and are
+// not any more: no consumer outside the platform names one of them.
+// `cli/dispatch.ts` wants the manifest set and reaches `operator-entry.js`
+// directly for it, which is what a file inside the platform does — a barrel
+// exists for the consumers that cannot. R5.4 is the rule: a host-internal
+// subpath is not a place to park surface against a future need, and the three
+// stay exported from their own file, one relative import away, for the merge
+// request that first gives one of them a consumer out here.
+export { runInstanceOperatorCommand } from './commands/operator-entry.js';
+// --- the module itself, as the generated artefacts name it ----------------
+// Phase 6 made this comment literally true: `composition.generated.ts` and
+// `manifest-index.generated.ts` name **this specifier** for `_lifecycle`, so
+// `backend.ts`, `manifest.ts` and `plugin.ts` are reached by nothing relative
+// any more and are here because a consumer asks for these three names.
+//
+// Which is why five names left in that same merge request. `LifecycleCradle`,
+// `lifecycleModule`, `LifecycleModule`, `LifecycleModuleDeps` and
+// `LifecycleModuleHandle` were here only because the ledger rule then in force
+// demanded **every** name a reached file exports, and with the reach gone
+// nobody asks for them: the generated composition reads `registerModule` off
+// its namespace import and `composition.ts` takes
+// `lifecycleModuleFromStaticEntries`, and that is the whole of it. Parking a
+// name against a future need is what R5.4 refuses, and
+// `published-surface.test.ts` is what said so — in the phase that changed the
+// specifier, not in the one that would later have wondered why they were here.
+// Phase 7 repeated the exercise across the whole barrel, for 28 more.
+export { registerModule } from './backend.js';
+export { manifest } from './manifest.js';
+export { lifecycleModuleFromStaticEntries } from './plugin.js';
+export { registerLifecycleAdminRoutes, } from './routes.admin.js';
+// --- the orchestrator, and the lock every write takes ---------------------
+export { LifecycleError, ModuleLifecycleOrchestrator, } from './services/orchestrator.js';
+// `acquireLifecycleLock` and `LifecycleLockError` left this barrel with
+// `specs/110-instance-repository/` T119a, for `dep-graph.ts`' three functions'
+// reason one population over: their one consumer outside the platform was
+// `test/unit/_lifecycle/lock.test.ts`, which is now `services/lock.test.ts`
+// inside the package and names the file directly. `LOCK_KEY` stays — the
+// application's `module:*` entry points still read it. R5.4.
+export { LOCK_KEY } from './services/lock.js';
+// --- the two graphs a presence decision is computed over ------------------
+//
+// The three free functions of `dep-graph.ts` left this barrel with
+// `specs/110-instance-repository/` T116: their one consumer outside the
+// platform was `migration-order.ts`, which is now inside it and names the file
+// directly. R5.4 — a name here that no first-party source outside the platform
+// imports is surface parked against a future need.
+export { ModuleDepGraph } from './services/dep-graph.js';
+export { acknowledgedPortEdgesFrom, gatingGraph, installGatingGraph, ModuleGatingGraph, nonBindingPortEdgesFrom, provideDefaultGatingManifests, } from './services/gating-graph.js';
+export { buildDeactivationLedger, deactivationConsequencesFor, } from './services/deactivation-ledger.js';
+// --- discovering manifests, and what a build ships ------------------------
+export { discoverManifests, folderNameFromPath, ManifestLoadError, } from './services/manifest-loader.js';
+// `module-origin.ts`'s shim had no importer left once Phase 6 re-pointed the
+// application, which cost it `OriginatedManifestEntry` — a name nothing outside
+// the platform asks for.
+export { deploymentShippedEntries, } from './services/module-origin.js';
+export { assertNoModuleIdCollisions, moduleIdCollisions, ModuleIdCollisionError, } from './services/module-id-claims.js';
+// `DiscoveredManifestEntry`, `OverlayModuleFound` and `PackageModuleFound` left
+// this barrel with T119a: `manifest-registry.test.ts` was the only first-party
+// source outside the platform naming them, and it is `lifecycle/manifest-registry.test.ts`
+// inside the package now. `ManifestSources` stays — `backend/src/lifecycle/`'s
+// registry binding is written against it.
+export { coreManifestEntries, ManifestPathMissingError, resolveManifestEntries, } from './manifest-registry.js';
+export { buildStaticRegistry } from './services/static-registry.js';
+// `MigrationOwnership` left this barrel with `specs/110-instance-repository/`
+// T116 for `dep-graph.ts`' three functions' reason: the merge that builds one is
+// `db/configured-migrations.ts`, which is inside the platform now, and the one
+// address a consumer outside it uses is `./db`. Two homes would be two answers
+// to which subpath owns the shape (R5.5).
+// --- what a deployment declares about differing from core -----------------
+// The shape half only. The locator is `backend/src/overlay/divergence-loader.ts`
+// and may not follow it here (D115-3): it composes a path in the tree that
+// installs the platform, and the platform receives the parsed value as a field
+// of `ComposeModulesOptions`, which is the seam it already had.
+export { emptyDivergenceDeclaration, parseDivergenceDeclaration, } from './divergence-declaration.js';
+// --- reading presence out of the registry at boot -------------------------
+export { assertLockedModulesPresent, 
+// The `BootConvergenceWarning` shape is deliberately **not** re-exported:
+// nothing outside the platform names it, and R5.4 refuses surface parked
+// against a future need. A consumer that needs it says
+// `ReturnType<typeof bootConvergenceWarnings>[number]`.
+bootConvergenceWarnings, firstBootInsertPopulation, loadModulePresence, ReducedDeploymentError, } from './services/presence-load.js';
+//# sourceMappingURL=index.js.map

package/dist/lifecycle/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lifecycle/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,mEAAmE;AACnE,OAAO,EAGN,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,wEAAwE;AACxE,4DAA4D;AAC5D,EAAE;AACF,6DAA6D;AAC7D,2DAA2D;AAC3D,gFAAgF;AAChF,oEAAoE;AACpE,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,4DAA4D;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,8EAA8E;AAC9E,kEAAkE;AAClE,+EAA+E;AAC/E,0EAA0E;AAC1E,6EAA6E;AAC7E,kDAAkD;AAClD,6EAA6E;AAC7E,uDAAuD;AACvD,8EAA8E;AAC9E,+EAA+E;AAC/E,sEAAsE;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,6EAA6E;AAC7E,OAAO,EACL,cAAc,EACd,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,wEAAwE;AACxE,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,6DAA6D;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,6EAA6E;AAC7E,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,+EAA+E;AAC/E,+EAA+E;AAC/E,mDAAmD;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,6BAA6B,GAE9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAK5B,MAAM,mCAAmC,CAAC;AAE3C,6EAA6E;AAC7E,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,+BAA+B,CAAC;AACvC,6EAA6E;AAC7E,gFAAgF;AAChF,yBAAyB;AACzB,OAAO,EACL,wBAAwB,GAEzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,GAGvB,MAAM,gCAAgC,CAAC;AACxC,gFAAgF;AAChF,+EAA+E;AAC/E,2FAA2F;AAC3F,+EAA+E;AAC/E,0CAA0C;AAC1C,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GAGvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,8EAA8E;AAC9E,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,0CAA0C;AAE1C,6EAA6E;AAC7E,iFAAiF;AACjF,2EAA2E;AAC3E,+EAA+E;AAC/E,gEAAgE;AAChE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AAErC,6EAA6E;AAC7E,OAAO,EACL,0BAA0B;AAC1B,0EAA0E;AAC1E,yEAAyE;AACzE,uDAAuD;AACvD,wDAAwD;AACxD,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,6BAA6B,CAAC"}

package/dist/lifecycle/manifest-registry.d.ts

@@ -0,0 +1,244 @@
+/**
+ * The manifest registry's **derivation** — the core entries, the origin field,
+ * the path refusal, the collision assembly and the three-way merge
+ * (`specs/115-lifecycle-container-move/`, D115-2;
+ * `contracts/operator-half.md` §3).
+ *
+ * ## Why it is here and its input is not
+ *
+ * All of this lived in `backend/src/lifecycle/registered-manifests.ts`, because
+ * its **input** does: the generated manifest index is a fact about one
+ * repository's tree, is bare core under every value of `DEPLOYMENT` (D-104), and
+ * an instance's is a different file (D-160.3). But *"which modules exist, which
+ * of them claim the same id, and where did each entry come from"* is platform
+ * logic, and it sat in the application only because the artefact that answers
+ * the first clause is the application's.
+ *
+ * So the index is a **parameter**, never a reach: {@link coreManifestEntries}
+ * takes the discovered array and {@link resolveManifestEntries} takes
+ * {@link ManifestSources}. That is `specs/110-instance-repository/` FR-014
+ * stated as a mechanism, and the precedent is one directory over —
+ * `services/gating-graph.ts`'s `provideDefaultGatingManifests` is the host
+ * installing a supplier the platform refuses to default, with a comment saying
+ * exactly why the platform cannot read the registry itself. What that comment
+ * did not do is apply the reasoning to the derivation, which is what this file
+ * is.
+ *
+ * A parameter rather than a supplier slot, and the distinction is R3.2's: a slot
+ * is right for a *fallback* most processes never need and that must refuse
+ * rather than default. "Which modules exist" is answered at import,
+ * deterministically, by whoever built the binding; a slot would make *"did
+ * anyone supply it, and when?"* a runtime question in the one file whose job is
+ * to have the answer.
+ *
+ * ## What is left in the application, and why it is twenty lines
+ *
+ * `backend/src/lifecycle/registered-manifests.ts` keeps its path and every name
+ * it exports, and binds three suppliers — the generated index, this deployment's
+ * overlay scan and this instance's installed packages. 121 files import that
+ * path; moving the *file* would be a 121-file rewrite whose entire content is a
+ * path, and moving the *derivation* is a one-file edit. An instance writes the
+ * same twenty lines against its own three answers, which it owns regardless.
+ */
+import type { ModuleManifest, ModuleManifestExports } from '@endora-commerce/contracts';
+import { type ModuleIdClaimOrigin } from './services/module-id-claims.js';
+/**
+ * One entry of the host's generated manifest index, as this derivation reads it.
+ *
+ * Declared here rather than imported, because the artefact that emits it is the
+ * host's (D-160.3) and the platform may not name a file in the tree that
+ * installs it (D-52/D-53). `tsc` is what holds the two shapes together: the
+ * generated interface is structurally assignable to this one at the call site,
+ * so a generator that dropped a field fails in the host's own type-check.
+ */
+export interface DiscoveredManifestEntry {
+    id: string;
+    manifest: ModuleManifest;
+    /**
+     * The real path of the file this entry's manifest was imported from —
+     * `<module>/manifest.ts` in an application tree, `<package>/package.json` for
+     * a packaged module. Every consumer takes `dirname` of it.
+     */
+    manifestPath: string;
+    installHook?: ModuleManifestExports['installHook'];
+    uninstallHook?: ModuleManifestExports['uninstallHook'];
+    lifecycleParticipant?: ModuleManifestExports['lifecycleParticipant'];
+    cliCommands?: ModuleManifestExports['cliCommands'];
+    recentActivity?: ModuleManifestExports['recentActivity'];
+}
+/**
+ * Each entry carries a real `filePath` so downstream reconcilers can locate the
+ * module's directory on disk — notably the i18n bundle loader
+ * (`_i18n/plugin.ts`) does `dirname(entry.filePath)` and joins `bundlesDir` to
+ * find each module's `i18n/<lang>.json` files. Without a real path,
+ * `dirname('<static>')` resolves to `.`, no bundle ever loads, and every action
+ * label renders as its raw i18n key.
+ */
+export interface RegisteredManifestEntry {
+    manifest: ModuleManifest;
+    filePath: string;
+    /**
+     * Where this entry came from — set where it is **constructed**, never derived
+     * from {@link RegisteredManifestEntry.filePath} (feature 080, T040b).
+     *
+     * D-157.6(b) read the origin off the path, on the ground that everything this
+     * build ships is under `backend/src`. That stopped being true with the first
+     * module package: `packages/modules/blog` is under neither root, so it read as
+     * `'package'`, and the two decisions resting on the answer — the first-boot
+     * `module_registrations` insert and the boot settings reconcile — silently
+     * skipped it. A module the build composes, whose migrations the committed
+     * registry runs, would have had no activation Setting and no registry row, so
+     * it would not have appeared on `/platform/modules` at all: Principle XVII
+     * defeated by a path test, with nothing raised.
+     *
+     * There is no containment test that could be right here, which is why this is
+     * a field. A workspace module package and an installed one are the same
+     * directory shape, and in a deployed build both sit under `node_modules`. What
+     * separates them is *which discovery produced the entry*, and that is known
+     * exactly once — at the three construction sites below.
+     */
+    origin: ModuleIdClaimOrigin;
+    installHook?: ModuleManifestExports['installHook'];
+    uninstallHook?: ModuleManifestExports['uninstallHook'];
+    /**
+     * This module's interest in every *other* module's install and hard
+     * uninstall — feature 080, T036a / D-159. Travels with the entry so that a
+     * `module:*` command, which composes nothing, gets the same reconcile the
+     * admin path does.
+     */
+    lifecycleParticipant?: ModuleManifestExports['lifecycleParticipant'];
+    /**
+     * The operator commands this module declares — feature 080, T042b / D-160.9.
+     * Travels with the entry for the same reason the hooks do: the host's CLI
+     * runner reads them off the resolved set, so a core module, an overlay module
+     * and an installed package are reachable by one path.
+     */
+    cliCommands?: ModuleManifestExports['cliCommands'];
+    /**
+     * This module's declaration that its activity is eligible for the dashboard's
+     * recent-activity card — feature 080, T042j / D-163.1. Travels with the entry
+     * for the reason the hooks do: the derivation that replaced four
+     * hand-maintained action tables reads it off the resolved set, so a core
+     * module, an overlay module and an installed package reach the card by one
+     * path.
+     */
+    recentActivity?: ModuleManifestExports['recentActivity'];
+}
+/**
+ * What an overlay scan yields for one of this deployment's own modules.
+ *
+ * Declared structurally for the reason {@link DiscoveredManifestEntry} is: the
+ * scan reads a directory in the deployment tree, which is the installing tree's,
+ * so the platform takes its **answer** and never its implementation.
+ */
+export interface OverlayModuleFound {
+    readonly id: string;
+    readonly manifest: ModuleManifest;
+    readonly filePath: string;
+    readonly installHook?: ModuleManifestExports['installHook'];
+    readonly uninstallHook?: ModuleManifestExports['uninstallHook'];
+    readonly lifecycleParticipant?: ModuleManifestExports['lifecycleParticipant'];
+    readonly cliCommands?: ModuleManifestExports['cliCommands'];
+    readonly recentActivity?: ModuleManifestExports['recentActivity'];
+}
+/** What a `node_modules` scan yields for one installed Endora module package. */
+export interface PackageModuleFound extends OverlayModuleFound {
+    /** The npm package name, for diagnostics. Never the platform's identity (D-142). */
+    readonly packageName: string;
+}
+/**
+ * The three answers a resolved registry is made of, supplied by whoever knows
+ * them (R3.1, R3.3).
+ *
+ * They stay three rather than collapsing into one supplier because they are
+ * three different questions about *the process* with three different answers —
+ * what this build ships, which deployment this is, and which packages an
+ * operator installed — and a single supplier would hide which one raised a
+ * collision.
+ */
+export interface ManifestSources {
+    /** Every module this build ships, already derived from the host's generated index. */
+    readonly core: readonly RegisteredManifestEntry[];
+    /** This deployment's overlay modules. Empty for a bare-core build. */
+    readonly overlay: () => Promise<readonly OverlayModuleFound[]>;
+    /** Every Endora module package installed in this instance. Empty for a bare-core build. */
+    readonly packages: () => Promise<readonly PackageModuleFound[]>;
+}
+/** Raised when an index entry carries no location for the manifest it imported. */
+export declare class ManifestPathMissingError extends Error {
+    readonly name = "ManifestPathMissingError";
+}
+/**
+ * The core registry: every discovered module, with the location the generator
+ * recorded for it.
+ *
+ * The index has no deployment entry to filter out any more (D-104). It is a
+ * walk of the shared core tree and nothing else, whatever `DEPLOYMENT` is set
+ * to when it is generated — which is what makes the committed artefact mean the
+ * same thing in every environment, and what makes a stale one detectable
+ * (FR-004, issue #120).
+ *
+ * **The path is read, not computed** (feature 080, T041a). It used to be
+ * `join(MODULES_ROOT, entry.id, 'manifest.ts')` — a convention, holding for as
+ * long as every module sits at `backend/src/modules/<id>/`, and giving a
+ * confident wrong answer the moment one does not. There is no reader of
+ * `filePath` that does not take `dirname` of it and join a directory: the
+ * `_i18n` boot reconciler joins `bundlesDir`, the orchestrator hands the same
+ * directory to the install-time bundle load, and both **skip** a directory that
+ * is absent. So a packaged module would have loaded no bundle, rendered every
+ * command-palette label as its raw key, and reported nothing anywhere.
+ *
+ * An entry with no path is therefore refused rather than defaulted. There is no
+ * honest fallback: the only candidate is the convention that just stopped
+ * holding, and a registry that answers with a directory nobody verified is the
+ * failure this replaces. The type makes the field required, which is what stops
+ * a *new* emitter from omitting it; this refusal is for the older artefact — a
+ * committed index generated before the field existed, or a hand-edited one —
+ * which the type cannot reach because it was compiled against a different shape.
+ */
+export declare function coreManifestEntries(discovered: ReadonlyArray<DiscoveredManifestEntry>): RegisteredManifestEntry[];
+/**
+ * The **instance-resolved** manifest set = the core registry, PLUS every
+ * overlay module the active deployment ships (feature 057, D-104), PLUS every
+ * Endora module package installed in this instance's `node_modules` (feature
+ * 080, D-119/D-155).
+ *
+ * All three arrive through {@link ManifestSources}, each from the one
+ * implementation that discovers it. There used to be two overlay
+ * implementations: this function merged the generated index's overlay entries,
+ * `composition.ts` merged the runtime scan's, and the one under test was not
+ * the one that ran.
+ *
+ * Runtime discovery is not an optimisation, it is the only correct answer, and
+ * D-104's predicate gives it for both: an artefact is committed when its
+ * content is a fact about *the tree*, and resolved at runtime when it is a fact
+ * about *the process*. Which deployment this process runs as is one; which
+ * packages an operator installed into this instance is the other. For a
+ * bare-core build with nothing installed — every developer checkout and every
+ * test run — both discoveries come back empty and this returns the core
+ * registry unchanged (FR-008).
+ *
+ * ## Collisions: one rule, whoever the claimants are
+ *
+ * A module id claimed twice is **refused**, naming every claimant's file
+ * (T030c, D-155.7; widened to the overlay by feature 103, FR-004).
+ *
+ * The overlay half used to be answered differently — dropped with a `continue`,
+ * on the reading that a deployment shadowing a module it authored is what the
+ * overlay mechanism is for. File shadowing is retired (D-201), so that reading
+ * has nothing left to refer to, and it was never the whole answer anyway: this
+ * function dropped the manifest while `overlayModuleEntriesUnder` composed the
+ * module, so the deployment ran a module the resolved registry did not know
+ * about — no `module_registrations` row, no permission-catalogue entry, and its
+ * routes gated on the effective state of somebody else's module of the same id.
+ * Principle XVII defeated in silence.
+ *
+ * The refusal an overlay claim reaches is raised **before** this function sees
+ * it, inside the overlay scan, so that the composition path reaches the same
+ * rule without depending on a composition root calling this function first.
+ * What is left here is the claim set no single scan can assemble: core, the
+ * overlay and every installed package at once, so an operator with two bad
+ * packages has to run this only once.
+ */
+export declare function resolveManifestEntries(sources: ManifestSources): Promise<RegisteredManifestEntry[]>;
+//# sourceMappingURL=manifest-registry.d.ts.map

package/dist/lifecycle/manifest-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-registry.d.ts","sourceRoot":"","sources":["../../src/lifecycle/manifest-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExF,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAGxC;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACnD,aAAa,CAAC,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACvD,oBAAoB,CAAC,EAAE,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,WAAW,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACnD,cAAc,CAAC,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,EAAE,mBAAmB,CAAC;IAC5B,WAAW,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACnD,aAAa,CAAC,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACvD;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACnD;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;CAC1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAC5D,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAChE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IAC9E,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;CACnE;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAClD,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IAC/D,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;CACjE;AA0CD,mFAAmF;AACnF,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,SAAkB,IAAI,8BAA8B;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,aAAa,CAAC,uBAAuB,CAAC,GACjD,uBAAuB,EAAE,CAc3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAqEpC"}