@g3nomaly/core 0.2.0 → 0.3.1

package/dist/installer/marketplace.js

@@ -0,0 +1,64 @@
+// packages/core/src/installer/marketplace.ts
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+/** Folders a plugin or marketplace manifest may sit in, in the order they are tried. */
+export const MANIFEST_DIRS = [".claude-plugin", ".cursor-plugin"];
+const MARKETPLACE_FILE = "marketplace.json";
+const MarketplaceSchema = z.object({
+    plugins: z.array(z.object({
+        name: z.string().min(1),
+        source: z.unknown(),
+    })).default([]),
+});
+/**
+ * First existing `<dir>/.claude-plugin/<file>` or `<dir>/.cursor-plugin/<file>`.
+ *
+ * @returns absolute path, or `null` when neither exists
+ */
+export function manifestFile(dir, file) {
+    for (const manifestDir of MANIFEST_DIRS) {
+        const candidate = path.join(dir, manifestDir, file);
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+/**
+ * Resolves `rel` against `base` and rejects a result outside `root`.
+ *
+ * @param root - Absolute folder nothing may leave, e.g. a source checkout
+ * @throws when the path points outside `root`
+ */
+export function resolveInside(root, base, rel) {
+    const resolved = path.resolve(base, rel);
+    if (resolved !== root && !resolved.startsWith(root + path.sep)) {
+        throw new Error(`manifest path "${rel}" points outside the source`);
+    }
+    return resolved;
+}
+/**
+ * The plugins a source's `marketplace.json` lists. Plugins whose `source` is
+ * not a relative path (a git or npm reference) are skipped with a warning.
+ *
+ * @param root - Absolute root of the source
+ * @returns `null` when the source has no marketplace
+ * @throws when the marketplace is not valid JSON, or a plugin path leaves the source
+ */
+export function readMarketplace(root) {
+    const file = manifestFile(root, MARKETPLACE_FILE);
+    if (file === null)
+        return null;
+    const marketplace = MarketplaceSchema.parse(JSON.parse(fs.readFileSync(file, "utf8")));
+    const plugins = [];
+    const warnings = [];
+    for (const plugin of marketplace.plugins) {
+        if (typeof plugin.source !== "string") {
+            warnings.push(`${plugin.name}: marketplace source is not a relative path, skipped`);
+            continue;
+        }
+        plugins.push({ name: plugin.name, dir: resolveInside(root, root, plugin.source) });
+    }
+    return { plugins, warnings };
+}
+//# sourceMappingURL=marketplace.js.map

package/dist/installer/marketplace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace.js","sourceRoot":"","sources":["../../src/installer/marketplace.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,wFAAwF;AACxF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;AAEjE,MAAM,gBAAgB,GAAG,kBAAkB,CAAA;AAE3C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,IAAI,EAAI,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;KACpB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAA;AASF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY;IACpD,KAAK,MAAM,WAAW,IAAI,aAAa,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;QACnD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;IAChD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,GAAW;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,6BAA6B,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAA;IACjD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE9B,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IACtF,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,sDAAsD,CAAC,CAAA;YACnF,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC"}

package/dist/installer/origin.d.ts

@@ -0,0 +1,43 @@
+import { z } from "zod";
+/**
+ * Where an entry came from: the registered source, the folder its file paths
+ * resolve against, and the revision the source was read at.
+ */
+export declare const EntryOriginSchema: z.ZodObject<{
+    source: z.ZodString;
+    dir: z.ZodString;
+    commit: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type EntryOrigin = z.infer<typeof EntryOriginSchema>;
+/** A registry entry read from a source: the base fields plus its origin. */
+export declare const OriginEntrySchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    group: z.ZodOptional<z.ZodString>;
+    registryDependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        type: z.ZodString;
+        hash: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    origin: z.ZodObject<{
+        source: z.ZodString;
+        dir: z.ZodString;
+        commit: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type OriginEntry = z.infer<typeof OriginEntrySchema>;
+/** What a source's reader passes to the function that reads one entry folder. */
+export interface ReadContext {
+    /** Origin recorded on the entry */
+    origin: EntryOrigin;
+    /** Group the entry is listed under, e.g. the plugin it ships in */
+    group: string;
+    /** Version to record when the entry's own manifest has none */
+    version?: string;
+}
+//# sourceMappingURL=origin.d.ts.map

package/dist/installer/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/installer/origin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;iBAS5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;iBAE5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAI,WAAW,CAAA;IACrB,mEAAmE;IACnE,KAAK,EAAK,MAAM,CAAA;IAChB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB"}

package/dist/installer/origin.js

@@ -0,0 +1,22 @@
+// packages/core/src/installer/origin.ts
+import { z } from "zod";
+import { BaseRegistryEntrySchema } from "../registry/types";
+/**
+ * Where an entry came from: the registered source, the folder its file paths
+ * resolve against, and the revision the source was read at.
+ */
+export const EntryOriginSchema = z.object({
+    /** Name of the registered source, e.g. `g3n-skills` */
+    source: z.string().min(1),
+    /** Source-relative folder that `files[].path` resolves against, e.g. `skills/speech` or `dist/components` */
+    dir: z.string(),
+    /** Commit a git source resolved to */
+    commit: z.string().min(1).optional(),
+    /** Version an npm source resolved to, or the version in a local source's package.json */
+    version: z.string().min(1).optional(),
+});
+/** A registry entry read from a source: the base fields plus its origin. */
+export const OriginEntrySchema = BaseRegistryEntrySchema.extend({
+    origin: EntryOriginSchema,
+});
+//# sourceMappingURL=origin.js.map

package/dist/installer/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/installer/origin.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,uDAAuD;IACvD,MAAM,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,6GAA6G;IAC7G,GAAG,EAAM,CAAC,CAAC,MAAM,EAAE;IACnB,sCAAsC;IACtC,MAAM,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,yFAAyF;IACzF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAIF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAA"}

package/dist/installer/resolve.d.ts

@@ -0,0 +1,78 @@
+import type { OriginEntry } from "./origin";
+import type { SourceOffer } from "./sourceRegistry";
+/** An entry or group as named on the command line or in `registryDependencies`. */
+export interface EntryRequest {
+    name: string;
+    /** Registered source the name must come from, when given as `<name>@<source>` */
+    source?: string;
+}
+/** Entries a set of requests resolved to, and what could not be resolved. */
+export interface Resolution<T extends OriginEntry> {
+    /** Resolved entries by key, `registryDependencies` rewritten to the resolved keys */
+    entries: Map<string, SourceOffer<T>>;
+    /** Requests and dependencies no source offers, e.g. `ghost` or `ghost@mine` */
+    unknown: string[];
+    /** One message per name more than one source offers, naming the qualified forms to pick from */
+    ambiguous: string[];
+    /** Why an entry nobody named is in the set, e.g. `{ vocabulary: "dep of plan" }` */
+    notes: Record<string, string>;
+}
+/** One entry with its dependencies resolved across sources. */
+export interface ResolvedDependencies<T extends OriginEntry> {
+    /** The entry with `registryDependencies` rewritten to the resolved keys */
+    offer: SourceOffer<T>;
+    dependencies: SourceOffer<T>[];
+    /** Dependencies no source offers, e.g. `ghost (dep of plan)` */
+    unknown: string[];
+    ambiguous: string[];
+}
+/**
+ * Reads `emphasise` or `emphasise@g3n-skills`; names are matched in
+ * lowercase. A leading `@` belongs to the name, as in `@shadcn/button@shadcn`.
+ */
+export declare function parseRequest(token: string): EntryRequest;
+/** A request as it is typed, e.g. `emphasise@g3n-skills`. */
+export declare function formatRequest(request: EntryRequest): string;
+/**
+ * Resolves the `registryDependencies` of one entry against every offer. A
+ * dependency that cannot be resolved keeps its bare name in the rewritten
+ * list and is reported in `unknown` or `ambiguous`.
+ *
+ * @param preferred - Source to take a key from when several offer it: where it is installed, or where the request named it
+ */
+export declare function resolveDependencies<T extends OriginEntry>(offer: SourceOffer<T>, offers: readonly SourceOffer<T>[], preferred?: Record<string, string>): ResolvedDependencies<T>;
+/**
+ * Resolves entry and group names against every offer, with the dependency
+ * closure of each across sources. An entry named in the request settles which
+ * source its key comes from for every dependency. Two different entries
+ * wanted under one key are reported as ambiguous, since a target holds one
+ * folder per key.
+ *
+ * @param installed - Source each installed key came from
+ */
+export declare function resolveRequests<T extends OriginEntry>(tokens: readonly string[], offers: readonly SourceOffer<T>[], installed?: Record<string, string>): Resolution<T>;
+/**
+ * Resolves entry and group names against what a target has installed, with
+ * `<name>@<source>` keeping only entries installed from that source. Works
+ * from the install manifest alone, so no source needs to be reachable.
+ *
+ * @returns installed keys in the order named, and the names that match nothing installed
+ */
+export declare function resolveInstalled<T extends OriginEntry>(tokens: readonly string[], installed: Record<string, T>): {
+    keys: string[];
+    unknown: string[];
+};
+/** Source each installed key came from, across manifests; the first manifest wins on a clash. */
+export declare function installedOrigins<T extends OriginEntry>(installed: readonly Record<string, T>[]): Record<string, string>;
+/**
+ * The fresh offer for each installed key, from the source it was installed
+ * from and never another, with its dependencies resolved.
+ *
+ * @param preferred - Source each installed key came from, across targets
+ * @returns the offers found, and the keys whose source is gone or no longer offers them
+ */
+export declare function resolveUpdates<T extends OriginEntry>(keys: readonly string[], installed: Record<string, T>, offers: readonly SourceOffer<T>[], preferred?: Record<string, string>): {
+    offers: SourceOffer<T>[];
+    missing: string[];
+};
+//# sourceMappingURL=resolve.d.ts.map

package/dist/installer/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/installer/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEnD,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAK,MAAM,CAAA;IACf,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,WAAW;IAC/C,qFAAqF;IACrF,OAAO,EAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,+EAA+E;IAC/E,OAAO,EAAI,MAAM,EAAE,CAAA;IACnB,gGAAgG;IAChG,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,oFAAoF;IACpF,KAAK,EAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,WAAW;IACzD,2EAA2E;IAC3E,KAAK,EAAS,WAAW,CAAC,CAAC,CAAC,CAAA;IAC5B,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9B,gEAAgE;IAChE,OAAO,EAAO,MAAM,EAAE,CAAA;IACtB,SAAS,EAAK,MAAM,EAAE,CAAA;CACvB;AAID;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAKxD;AAED,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAE3D;AAqDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,WAAW,EACvD,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EACrB,MAAM,EAAE,SAAS,WAAW,CAAC,CAAC,CAAC,EAAE,EACjC,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACrC,oBAAoB,CAAC,CAAC,CAAC,CAiBzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,EACnD,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,MAAM,EAAE,SAAS,WAAW,CAAC,CAAC,CAAC,EAAE,EACjC,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACrC,UAAU,CAAC,CAAC,CAAC,CAuCf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,WAAW,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAYtJ;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,WAAW,EAAE,SAAS,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIvH;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,WAAW,EAClD,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EAC5B,MAAM,EAAE,SAAS,WAAW,CAAC,CAAC,CAAC,EAAE,EACjC,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CASjD"}

package/dist/installer/resolve.js

@@ -0,0 +1,184 @@
+/**
+ * Reads `emphasise` or `emphasise@g3n-skills`; names are matched in
+ * lowercase. A leading `@` belongs to the name, as in `@shadcn/button@shadcn`.
+ */
+export function parseRequest(token) {
+    const at = token.indexOf("@", 1);
+    return at > 0
+        ? { name: token.slice(0, at).toLowerCase(), source: token.slice(at + 1) }
+        : { name: token.toLowerCase() };
+}
+/** A request as it is typed, e.g. `emphasise@g3n-skills`. */
+export function formatRequest(request) {
+    return request.source === undefined ? request.name : `${request.name}@${request.source}`;
+}
+/** Name of the source an offer comes from. */
+function sourceOf(offer) {
+    return offer.entry.origin.source;
+}
+/** Names of the sources the offers come from, each once, sorted. */
+function uniqueSources(offers) {
+    return [...new Set(offers.map(sourceOf))].sort();
+}
+/**
+ * Entries one request names. A group name expands to every entry in it and
+ * wins over an entry with the same key. A name offered by several sources is
+ * settled by the preferred source for it, and is ambiguous otherwise.
+ */
+function matchRequest(request, offers, preferred) {
+    const pool = request.source === undefined ? offers : offers.filter((o) => sourceOf(o) === request.source);
+    const group = pool.filter((o) => o.entry.group === request.name);
+    const matches = group.length > 0 ? group : pool.filter((o) => o.key === request.name);
+    if (matches.length === 0)
+        return null;
+    const sources = uniqueSources(matches);
+    if (sources.length === 1)
+        return matches;
+    const pinned = preferred[request.name];
+    if (pinned !== undefined && sources.includes(pinned))
+        return matches.filter((o) => sourceOf(o) === pinned);
+    return { ambiguous: `${request.name} is offered by ${sources.length} sources, name one: ${sources.map((s) => `${request.name}@${s}`).join(", ")}` };
+}
+/**
+ * The entry a dependency of `dependent` points at: the named source when the
+ * dependency is qualified, else the dependent's own source, else the source
+ * preferred for the key, else the only source offering it.
+ */
+function matchDependency(token, dependent, offers, preferred) {
+    const request = parseRequest(token);
+    const named = offers.filter((o) => o.key === request.name);
+    const from = (source) => named.find((o) => sourceOf(o) === source);
+    if (request.source !== undefined)
+        return from(request.source) ?? null;
+    const settled = from(sourceOf(dependent)) ?? from(preferred[request.name]);
+    if (settled !== undefined)
+        return settled;
+    if (named.length <= 1)
+        return named[0] ?? null;
+    return { ambiguous: `${dependent.key} depends on ${request.name}, offered by ${uniqueSources(named).join(", ")}; qualify it as ${request.name}@<source>` };
+}
+/**
+ * Resolves the `registryDependencies` of one entry against every offer. A
+ * dependency that cannot be resolved keeps its bare name in the rewritten
+ * list and is reported in `unknown` or `ambiguous`.
+ *
+ * @param preferred - Source to take a key from when several offer it: where it is installed, or where the request named it
+ */
+export function resolveDependencies(offer, offers, preferred = {}) {
+    const result = { offer, dependencies: [], unknown: [], ambiguous: [] };
+    const keys = (offer.entry.registryDependencies ?? []).map((token) => {
+        const match = matchDependency(token, offer, offers, preferred);
+        if (match === null) {
+            result.unknown.push(`${token} (dep of ${offer.key})`);
+            return parseRequest(token).name;
+        }
+        if ("ambiguous" in match) {
+            result.ambiguous.push(match.ambiguous);
+            return parseRequest(token).name;
+        }
+        result.dependencies.push(match);
+        return match.key;
+    });
+    result.offer = { ...offer, entry: { ...offer.entry, registryDependencies: keys.length > 0 ? keys : undefined } };
+    return result;
+}
+/**
+ * Resolves entry and group names against every offer, with the dependency
+ * closure of each across sources. An entry named in the request settles which
+ * source its key comes from for every dependency. Two different entries
+ * wanted under one key are reported as ambiguous, since a target holds one
+ * folder per key.
+ *
+ * @param installed - Source each installed key came from
+ */
+export function resolveRequests(tokens, offers, installed = {}) {
+    const preferred = { ...installed };
+    const result = { entries: new Map(), unknown: [], ambiguous: [], notes: {} };
+    const named = new Set();
+    const add = (offer, note) => {
+        const existing = result.entries.get(offer.key);
+        if (existing !== undefined) {
+            if (sourceOf(existing) !== sourceOf(offer)) {
+                result.ambiguous.push(`${offer.key} is wanted from both ${sourceOf(existing)} and ${sourceOf(offer)}`);
+            }
+            return;
+        }
+        const resolved = resolveDependencies(offer, offers, preferred);
+        result.entries.set(offer.key, resolved.offer);
+        result.unknown.push(...resolved.unknown);
+        result.ambiguous.push(...resolved.ambiguous);
+        if (note !== undefined && !named.has(offer.key))
+            result.notes[offer.key] = note;
+        for (const dependency of resolved.dependencies)
+            add(dependency, `dep of ${offer.key}`);
+    };
+    const requested = [];
+    for (const token of tokens) {
+        const request = parseRequest(token);
+        const match = matchRequest(request, offers, preferred);
+        if (match === null)
+            result.unknown.push(formatRequest(request));
+        else if ("ambiguous" in match)
+            result.ambiguous.push(match.ambiguous);
+        else
+            requested.push(...match);
+    }
+    for (const offer of requested) {
+        named.add(offer.key);
+        preferred[offer.key] = sourceOf(offer);
+    }
+    for (const offer of requested)
+        add(offer);
+    result.unknown = [...new Set(result.unknown)];
+    result.ambiguous = [...new Set(result.ambiguous)];
+    return result;
+}
+/**
+ * Resolves entry and group names against what a target has installed, with
+ * `<name>@<source>` keeping only entries installed from that source. Works
+ * from the install manifest alone, so no source needs to be reachable.
+ *
+ * @returns installed keys in the order named, and the names that match nothing installed
+ */
+export function resolveInstalled(tokens, installed) {
+    const keys = [];
+    const unknown = [];
+    for (const token of tokens) {
+        const request = parseRequest(token);
+        const pool = Object.entries(installed).filter(([, entry]) => request.source === undefined || entry.origin.source === request.source);
+        const group = pool.filter(([, entry]) => entry.group === request.name).map(([key]) => key);
+        const matches = group.length > 0 ? group : pool.filter(([key]) => key === request.name).map(([key]) => key);
+        if (matches.length === 0)
+            unknown.push(formatRequest(request));
+        keys.push(...matches);
+    }
+    return { keys: [...new Set(keys)], unknown };
+}
+/** Source each installed key came from, across manifests; the first manifest wins on a clash. */
+export function installedOrigins(installed) {
+    const origins = {};
+    for (const record of installed)
+        for (const [key, entry] of Object.entries(record))
+            origins[key] ??= entry.origin.source;
+    return origins;
+}
+/**
+ * The fresh offer for each installed key, from the source it was installed
+ * from and never another, with its dependencies resolved.
+ *
+ * @param preferred - Source each installed key came from, across targets
+ * @returns the offers found, and the keys whose source is gone or no longer offers them
+ */
+export function resolveUpdates(keys, installed, offers, preferred = {}) {
+    const found = [];
+    const missing = [];
+    for (const key of keys) {
+        const fresh = offers.find((o) => o.key === key && sourceOf(o) === installed[key]?.origin.source);
+        if (fresh === undefined)
+            missing.push(key);
+        else
+            found.push(resolveDependencies(fresh, offers, preferred).offer);
+    }
+    return { offers: found, missing };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/installer/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/installer/resolve.ts"],"names":[],"mappings":"AAmCA;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAChC,OAAO,EAAE,GAAG,CAAC;QACX,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACzE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAA;AACnC,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAA;AAC1F,CAAC;AAED,8CAA8C;AAC9C,SAAS,QAAQ,CAAwB,KAAqB;IAC5D,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAA;AAClC,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAwB,MAAiC;IAC7E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAwB,OAAqB,EAAE,MAAiC,EAAE,SAAiC;IACtI,MAAM,IAAI,GAAM,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5G,MAAM,KAAK,GAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAErC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAA;IAExC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;IAC1G,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,IAAI,kBAAkB,OAAO,CAAC,MAAM,uBAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAA;AACrJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,KAAa,EACb,SAAyB,EACzB,MAAiC,EACjC,SAAiC;IAEjC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,KAAK,GAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAM,CAAC,MAA0B,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;IAEzF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IACzC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IAC9C,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,GAAG,eAAe,OAAO,CAAC,IAAI,gBAAgB,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,IAAI,WAAW,EAAE,CAAA;AAC5J,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAqB,EACrB,MAAiC,EACjC,SAAS,GAA2B,EAAE;IAEtC,MAAM,MAAM,GAA4B,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAC/F,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QAC9D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,GAAG,GAAG,CAAC,CAAA;YACrD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAA;QACjC,CAAC;QACD,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;YACtC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAA;QACjC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,GAAG,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,oBAAoB,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAA;IAChH,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAyB,EACzB,MAAiC,EACjC,SAAS,GAA2B,EAAE;IAEtC,MAAM,SAAS,GAA2B,EAAE,GAAG,SAAS,EAAE,CAAA;IAC1D,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAE/B,MAAM,GAAG,GAAG,CAAC,KAAqB,EAAE,IAAa,EAAQ,EAAE;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,wBAAwB,QAAQ,CAAC,QAAQ,CAAC,QAAQ,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACxG,CAAC;YACD,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QAC9D,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;QACxC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QAC/E,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,YAAY;YAAE,GAAG,CAAC,UAAU,EAAE,UAAU,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IACxF,CAAC,CAAA;IAED,MAAM,SAAS,GAAqB,EAAE,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,KAAK,GAAK,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QACxD,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA;aAC1D,IAAI,WAAW,IAAI,KAAK;YAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;;YAChE,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;IAC/B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACpB,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS;QAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IAEzC,MAAM,CAAC,OAAO,GAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/C,MAAM,CAAC,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IACjD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAwB,MAAyB,EAAE,SAA4B;IAC7G,MAAM,IAAI,GAAgB,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,IAAI,GAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;QACvI,MAAM,KAAK,GAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;QAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;QAC3G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAA;AAC9C,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAwB,SAAuC;IAC7F,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,MAAM,IAAI,SAAS;QAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,CAAA;IACvH,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAuB,EACvB,SAA4B,EAC5B,MAAiC,EACjC,SAAS,GAA2B,EAAE;IAEtC,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QAChG,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;;YACrC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AACnC,CAAC"}

package/dist/installer/sourceRegistry.d.ts

@@ -0,0 +1,59 @@
+import { type RegistryStore } from "../registry/registry.store";
+import type { RegisteredSource, SourceCheckout } from "../sources/types";
+import type { EntrySource } from "../cli/types";
+import { type OriginEntry } from "./origin";
+/** What a package's reader found in one checked-out source. */
+export interface SourceEntries<T extends OriginEntry> {
+    /** Entries by key, each with its `origin` filled in */
+    entries: [string, T][];
+    warnings: string[];
+}
+/** Reads the entries one checked-out source offers; each installer supplies its own. */
+export type ReadSource<T extends OriginEntry> = (checkout: SourceCheckout) => Promise<SourceEntries<T>>;
+/** A source that could not be checked out or read, with the reason. */
+export interface FailedSource {
+    name: string;
+    error: string;
+}
+/**
+ * The entries a set of sources offers, one registry store per source, read
+ * from checkouts that stay on disk until `dispose` so the install can copy
+ * files out of them.
+ *
+ * Built by `loadSourceRegistry` in each installer's `add`, `update`, `ls` and
+ * `source add` commands. `offers` lists every entry for name resolution, and
+ * `entrySource` copies an entry's files from its checkout.
+ */
+export interface SourceRegistry<T extends OriginEntry> {
+    /** Entries by source name, in the order the sources were given */
+    sources: Map<string, RegistryStore<T>>;
+    checkouts: Map<string, SourceCheckout>;
+    warnings: string[];
+    failed: FailedSource[];
+    dispose: () => void;
+}
+/** One entry one source offers. */
+export interface SourceOffer<T extends OriginEntry> {
+    key: string;
+    entry: T;
+}
+/**
+ * Checks out each source and reads its entries with `readSource`, all
+ * sources at once. A source that cannot be checked out or read lands in
+ * `failed` instead of throwing, so one unreachable source does not stop the
+ * rest. A key offered twice by one source keeps the first, with a warning.
+ *
+ * @param projectRoot - Absolute root that local source paths and the `node_modules` lookup start from
+ */
+export declare function loadSourceRegistry<T extends OriginEntry>(sources: readonly RegisteredSource[], projectRoot: string, readSource: ReadSource<T>): Promise<SourceRegistry<T>>;
+/** Every entry of every source, sources in their given order and keys sorted within each. */
+export declare function offers<T extends OriginEntry>(registry: SourceRegistry<T>): SourceOffer<T>[];
+/**
+ * File source for the core install commands: a file at `files[].path` is
+ * copied from `<checkout>/<origin.dir>/<path>` in the checkout of the
+ * entry's source.
+ */
+export declare function entrySource<T extends OriginEntry>(registry: SourceRegistry<T>): EntrySource;
+/** Registry the core install commands take, keyed by entry key. */
+export declare function offerRegistry<T extends OriginEntry>(selected: Iterable<SourceOffer<T>>): Record<string, T>;
+//# sourceMappingURL=sourceRegistry.d.ts.map

package/dist/installer/sourceRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceRegistry.d.ts","sourceRoot":"","sources":["../../src/installer/sourceRegistry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAIpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAExE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAE9D,+DAA+D;AAC/D,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,WAAW;IAClD,uDAAuD;IACvD,OAAO,EAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAA;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,wFAAwF;AACxF,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,WAAW,IAAI,CAAC,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;AAEvG,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAG,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,WAAW;IACnD,kEAAkE;IAClE,OAAO,EAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACtC,QAAQ,EAAG,MAAM,EAAE,CAAA;IACnB,MAAM,EAAK,YAAY,EAAE,CAAA;IACzB,OAAO,EAAI,MAAM,IAAI,CAAA;CACtB;AAED,mCAAmC;AACnC,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,WAAW;IAChD,GAAG,EAAI,MAAM,CAAA;IACb,KAAK,EAAE,CAAC,CAAA;CACT;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,SAAS,WAAW,EAC5D,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CA6B5B;AAED,6FAA6F;AAC7F,wBAAgB,MAAM,CAAC,CAAC,SAAS,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAG3F;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,WAAW,CAO3F;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,CAAC,SAAS,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAI1G"}

package/dist/installer/sourceRegistry.js

@@ -0,0 +1,71 @@
+// packages/core/src/installer/sourceRegistry.ts
+import path from "node:path";
+import { createRegistryStore } from "../registry/registry.store";
+import { register } from "../registry/registry.mutations";
+import { entries } from "../registry/registry.selectors";
+import { checkoutSource } from "../sources/checkout";
+import { errorMessage } from "../utils/errors";
+import { copySource } from "./install";
+import { OriginEntrySchema } from "./origin";
+/**
+ * Checks out each source and reads its entries with `readSource`, all
+ * sources at once. A source that cannot be checked out or read lands in
+ * `failed` instead of throwing, so one unreachable source does not stop the
+ * rest. A key offered twice by one source keeps the first, with a warning.
+ *
+ * @param projectRoot - Absolute root that local source paths and the `node_modules` lookup start from
+ */
+export async function loadSourceRegistry(sources, projectRoot, readSource) {
+    const registry = { sources: new Map(), checkouts: new Map(), warnings: [], failed: [], dispose: () => { } };
+    registry.dispose = () => { for (const checkout of registry.checkouts.values())
+        checkout.dispose(); };
+    const results = await Promise.allSettled(sources.map(async (source) => {
+        const checkout = await checkoutSource(source, projectRoot);
+        registry.checkouts.set(source.name, checkout);
+        return readSource(checkout);
+    }));
+    results.forEach((result, index) => {
+        const name = sources[index]?.name ?? "";
+        if (result.status === "rejected") {
+            registry.failed.push({ name, error: errorMessage(result.reason) });
+            return;
+        }
+        const store = createRegistryStore();
+        for (const [key, entry] of result.value.entries) {
+            if (store.store.state[key] !== undefined) {
+                registry.warnings.push(`${name}: "${key}" is offered twice, using the first`);
+                continue;
+            }
+            register(store, key, entry);
+        }
+        registry.sources.set(name, store);
+        registry.warnings.push(...result.value.warnings.map((warning) => `${name}: ${warning}`));
+    });
+    return registry;
+}
+/** Every entry of every source, sources in their given order and keys sorted within each. */
+export function offers(registry) {
+    return [...registry.sources.values()].flatMap((store) => Object.entries(entries(store)).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => ({ key, entry })));
+}
+/**
+ * File source for the core install commands: a file at `files[].path` is
+ * copied from `<checkout>/<origin.dir>/<path>` in the checkout of the
+ * entry's source.
+ */
+export function entrySource(registry) {
+    return (entry) => {
+        const { origin } = OriginEntrySchema.pick({ origin: true }).parse(entry);
+        const checkout = registry.checkouts.get(origin.source);
+        if (checkout === undefined)
+            throw new Error(`source ${origin.source} of "${entry.name}" is not checked out`);
+        return copySource((filePath) => path.join(checkout.dir, origin.dir, filePath));
+    };
+}
+/** Registry the core install commands take, keyed by entry key. */
+export function offerRegistry(selected) {
+    const registry = {};
+    for (const offer of selected)
+        registry[offer.key] = offer.entry;
+    return registry;
+}
+//# sourceMappingURL=sourceRegistry.js.map

package/dist/installer/sourceRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceRegistry.js","sourceRoot":"","sources":["../../src/installer/sourceRegistry.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,mBAAmB,EAAsB,MAAM,4BAA4B,CAAA;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,UAAU,CAAA;AA0C9D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAoC,EACpC,WAAmB,EACnB,UAAyB;IAEzB,MAAM,QAAQ,GAAsB,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAA;IAC7H,QAAQ,CAAC,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAA;IAEnG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACpE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC1D,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAC,CAAA;IAEH,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,EAAE,CAAA;QACvC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAClE,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,EAAK,CAAA;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,GAAG,qCAAqC,CAAC,CAAA;gBAC7E,SAAQ;YACV,CAAC;YACD,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACjC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,MAAM,CAAwB,QAA2B;IACvE,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACtD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AAClH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAwB,QAA2B;IAC5E,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,CAAC,MAAM,QAAQ,KAAK,CAAC,IAAI,sBAAsB,CAAC,CAAA;QAC5G,OAAO,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;IAChF,CAAC,CAAA;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAwB,QAAkC;IACrF,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,QAAQ;QAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAA;IAC/D,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/sources/checkout.d.ts

@@ -0,0 +1,14 @@
+import type { SourceCheckout, SourceSpec } from "./types";
+/**
+ * Resolves a source to a folder holding its files: a shallow clone for git,
+ * an installed or downloaded package for npm, the folder itself for local.
+ *
+ * @param projectRoot - Absolute project root; local paths and the `node_modules` lookup start there
+ */
+export declare function checkoutSource(source: {
+    name: string;
+    spec: SourceSpec;
+}, projectRoot: string): Promise<SourceCheckout>;
+/** One line naming where a source comes from, e.g. `git https://github.com/me/skills.git#main`. */
+export declare function describeSource(spec: SourceSpec): string;
+//# sourceMappingURL=checkout.d.ts.map

package/dist/sources/checkout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout.d.ts","sourceRoot":"","sources":["../../src/sources/checkout.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1D;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAO7H;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAMvD"}

package/dist/sources/checkout.js

@@ -0,0 +1,27 @@
+// packages/core/src/sources/checkout.ts
+import { checkoutGit } from "./git";
+import { checkoutLocal } from "./local";
+import { checkoutNpm } from "./npm";
+/**
+ * Resolves a source to a folder holding its files: a shallow clone for git,
+ * an installed or downloaded package for npm, the folder itself for local.
+ *
+ * @param projectRoot - Absolute project root; local paths and the `node_modules` lookup start there
+ */
+export async function checkoutSource(source, projectRoot) {
+    const { name, spec } = source;
+    switch (spec.kind) {
+        case "git": return checkoutGit(name, spec);
+        case "npm": return checkoutNpm(name, spec, projectRoot);
+        case "local": return checkoutLocal(name, spec, projectRoot);
+    }
+}
+/** One line naming where a source comes from, e.g. `git https://github.com/me/skills.git#main`. */
+export function describeSource(spec) {
+    switch (spec.kind) {
+        case "git": return `git ${spec.url}${spec.ref === undefined ? "" : `#${spec.ref}`}`;
+        case "npm": return `npm ${spec.package}${spec.version === undefined ? "" : `@${spec.version}`}`;
+        case "local": return `local ${spec.path}`;
+    }
+}
+//# sourceMappingURL=checkout.js.map

package/dist/sources/checkout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout.js","sourceRoot":"","sources":["../../src/sources/checkout.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAGpC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAA0C,EAAE,WAAmB;IAClG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC9B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK,EAAI,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7C,KAAK,KAAK,EAAI,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC1D,KAAK,OAAO,EAAE,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK,EAAI,OAAO,OAAO,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACtF,KAAK,KAAK,EAAI,OAAO,OAAO,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAClG,KAAK,OAAO,EAAE,OAAO,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/sources/git.d.ts

@@ -0,0 +1,9 @@
+import type { GitSourceSpec, SourceCheckout } from "./types";
+/**
+ * Shallow-clones a git source into a temporary folder, at its `ref` when set
+ * and at the default branch otherwise, and resolves the commit it landed on.
+ *
+ * @throws when the clone fails, e.g. an unknown ref or an unreachable host
+ */
+export declare function checkoutGit(name: string, spec: GitSourceSpec): Promise<SourceCheckout>;
+//# sourceMappingURL=git.d.ts.map

package/dist/sources/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/sources/git.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE7D;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAW5F"}