@g3nomaly/core 0.3.0 → 0.3.1

package/dist/sources/local.d.ts

@@ -0,0 +1,10 @@
+import type { LocalSourceSpec, SourceCheckout } from "./types";
+/**
+ * Resolves a local source to its folder. Nothing is copied, so `dispose` is a
+ * no-op and the version is the one in the folder's package.json, if any.
+ *
+ * @param projectRoot - Absolute path a relative `spec.path` is resolved against
+ * @throws when the folder does not exist
+ */
+export declare function checkoutLocal(name: string, spec: LocalSourceSpec, projectRoot: string): SourceCheckout;
+//# sourceMappingURL=local.d.ts.map

package/dist/sources/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/sources/local.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CAMtG"}

package/dist/sources/local.js

@@ -0,0 +1,20 @@
+// packages/core/src/sources/local.ts
+import fs from "node:fs";
+import path from "node:path";
+import { expandHome } from "./parse";
+import { readPackageVersion } from "./packageJson";
+/**
+ * Resolves a local source to its folder. Nothing is copied, so `dispose` is a
+ * no-op and the version is the one in the folder's package.json, if any.
+ *
+ * @param projectRoot - Absolute path a relative `spec.path` is resolved against
+ * @throws when the folder does not exist
+ */
+export function checkoutLocal(name, spec, projectRoot) {
+    const dir = path.resolve(projectRoot, expandHome(spec.path));
+    if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) {
+        throw new Error(`${dir} is not a folder`);
+    }
+    return { name, spec, dir, version: readPackageVersion(dir), dispose: () => { } };
+}
+//# sourceMappingURL=local.js.map

package/dist/sources/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/sources/local.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGnD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAqB,EAAE,WAAmB;IACpF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;AAClF,CAAC"}

package/dist/sources/npm.d.ts

@@ -0,0 +1,13 @@
+import type { NpmSourceSpec, SourceCheckout } from "./types";
+/**
+ * Resolves an npm source to a folder. A copy in `node_modules` at or above the
+ * project root is read in place when it satisfies `spec.version` (any copy
+ * does when no version is set). Otherwise the package tarball is downloaded
+ * from the registry in `npm_config_registry`, checked against its integrity
+ * hash and unpacked into a temporary folder.
+ *
+ * @param projectRoot - Absolute folder the `node_modules` lookup starts from
+ * @throws when the registry has no matching version or the download fails its integrity check
+ */
+export declare function checkoutNpm(name: string, spec: NpmSourceSpec, projectRoot: string): Promise<SourceCheckout>;
+//# sourceMappingURL=npm.d.ts.map

package/dist/sources/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/sources/npm.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAqB7D;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAMjH"}

package/dist/sources/npm.js

@@ -0,0 +1,128 @@
+// packages/core/src/sources/npm.ts
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { readPackageVersion } from "./packageJson";
+import { createTempDir, removeDir, runCommand } from "./process";
+const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
+const RegistryEnvSchema = z.object({
+    npm_config_registry: z.url().optional(),
+    NPM_CONFIG_REGISTRY: z.url().optional(),
+});
+const PackumentSchema = z.object({
+    "dist-tags": z.record(z.string(), z.string()).default({}),
+    versions: z.record(z.string(), z.object({
+        dist: z.object({
+            tarball: z.url(),
+            integrity: z.string().optional(),
+        }),
+    })).default({}),
+});
+/**
+ * Resolves an npm source to a folder. A copy in `node_modules` at or above the
+ * project root is read in place when it satisfies `spec.version` (any copy
+ * does when no version is set). Otherwise the package tarball is downloaded
+ * from the registry in `npm_config_registry`, checked against its integrity
+ * hash and unpacked into a temporary folder.
+ *
+ * @param projectRoot - Absolute folder the `node_modules` lookup starts from
+ * @throws when the registry has no matching version or the download fails its integrity check
+ */
+export async function checkoutNpm(name, spec, projectRoot) {
+    const installed = findInstalled(projectRoot, spec.package);
+    if (installed !== null && accepts(installed.version, spec.version)) {
+        return { name, spec, dir: installed.dir, version: installed.version, dispose: () => { } };
+    }
+    return downloadFromRegistry(name, spec);
+}
+/** Real path and version of the nearest `node_modules/<pkg>` at or above `fromDir`, or `null`. */
+function findInstalled(fromDir, pkg) {
+    let dir = fromDir;
+    while (true) {
+        const candidate = path.join(dir, "node_modules", pkg);
+        if (fs.existsSync(path.join(candidate, "package.json"))) {
+            const real = fs.realpathSync(candidate);
+            return { dir: real, version: readPackageVersion(real) };
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/** Whether an installed version satisfies the requested range; no range accepts any copy. */
+function accepts(installed, requested) {
+    if (requested === undefined)
+        return true;
+    return installed !== undefined && Bun.semver.satisfies(installed, requested);
+}
+/** Registry base URL from `npm_config_registry`, with a trailing slash; npmjs.org when unset. */
+function registryUrl() {
+    const env = RegistryEnvSchema.parse(process.env);
+    const url = env.npm_config_registry ?? env.NPM_CONFIG_REGISTRY ?? DEFAULT_REGISTRY;
+    return url.endsWith("/") ? url : `${url}/`;
+}
+/**
+ * Downloads the version `spec` asks for, checks it against its integrity hash
+ * and unpacks it into a temporary folder that `dispose` removes.
+ *
+ * @throws when the registry has no matching version, a download fails or the hash does not match
+ */
+async function downloadFromRegistry(name, spec) {
+    const packumentUrl = registryUrl() + spec.package.replace("/", "%2f");
+    const response = await fetch(packumentUrl);
+    if (!response.ok)
+        throw new Error(`${spec.package} — registry answered ${response.status} for ${packumentUrl}`);
+    const packument = PackumentSchema.parse(await response.json());
+    const version = pickVersion(packument, spec.version);
+    if (version === undefined)
+        throw new Error(`${spec.package} has no version matching "${spec.version ?? "latest"}"`);
+    const dist = packument.versions[version]?.dist;
+    if (dist === undefined)
+        throw new Error(`${spec.package}@${version} is missing from the registry`);
+    const tarball = await fetch(dist.tarball);
+    if (!tarball.ok)
+        throw new Error(`${spec.package}@${version} — tarball download answered ${tarball.status}`);
+    const bytes = new Uint8Array(await tarball.arrayBuffer());
+    if (dist.integrity !== undefined)
+        verifyIntegrity(bytes, dist.integrity, `${spec.package}@${version}`);
+    const dir = createTempDir("npm");
+    try {
+        const archive = path.join(dir, "..", `${path.basename(dir)}.tgz`);
+        fs.writeFileSync(archive, bytes);
+        try {
+            await runCommand(["tar", "-xzf", archive, "-C", dir, "--strip-components=1"]);
+        }
+        finally {
+            fs.rmSync(archive, { force: true });
+        }
+        return { name, spec, dir, version, dispose: () => removeDir(dir) };
+    }
+    catch (error) {
+        removeDir(dir);
+        throw error;
+    }
+}
+/** The dist-tag, the exact version, or the highest version in the range; `latest` when nothing is asked. */
+function pickVersion(packument, requested) {
+    const wanted = requested ?? "latest";
+    const tagged = packument["dist-tags"][wanted];
+    if (tagged !== undefined)
+        return tagged;
+    if (packument.versions[wanted] !== undefined)
+        return wanted;
+    return Object.keys(packument.versions)
+        .filter((v) => Bun.semver.satisfies(v, wanted))
+        .sort((a, b) => Bun.semver.order(b, a))[0];
+}
+/** Checks an SRI string such as `sha512-<base64>` against the downloaded bytes. */
+function verifyIntegrity(bytes, integrity, label) {
+    const [algorithm, expected] = integrity.split(" ")[0]?.split("-", 2) ?? [];
+    if (algorithm !== "sha512" && algorithm !== "sha256" && algorithm !== "sha1") {
+        throw new Error(`${label} — unsupported integrity algorithm "${algorithm ?? ""}"`);
+    }
+    const actual = new Bun.CryptoHasher(algorithm).update(bytes).digest("base64");
+    if (actual !== expected)
+        throw new Error(`${label} — tarball does not match its integrity hash`);
+}
+//# sourceMappingURL=npm.js.map

package/dist/sources/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/sources/npm.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGjE,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAEvD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,QAAQ,EAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACb,OAAO,EAAI,CAAC,CAAC,GAAG,EAAE;YAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC,CAAC;KACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAmB,EAAE,WAAmB;IACtF,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,kGAAkG;AAClG,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW;IACjD,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,OAAO,CAAC,SAA6B,EAAE,SAA6B;IAC3E,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED,iGAAiG;AACjG,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,mBAAmB,IAAI,gBAAgB,CAAC;IACnF,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAmB;IACnE,MAAM,YAAY,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,wBAAwB,QAAQ,CAAC,MAAM,QAAQ,YAAY,EAAE,CAAC,CAAC;IAEhH,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAK,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,6BAA6B,IAAI,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,+BAA+B,CAAC,CAAC;IAEnG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,gCAAgC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7G,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;IAEvG,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAChF,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,SAAS,WAAW,CAAC,SAAoB,EAAE,SAA6B;IACtE,MAAM,MAAM,GAAG,SAAS,IAAI,QAAQ,CAAC;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,KAAiB,EAAE,SAAiB,EAAE,KAAa;IAC1E,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,SAAS,IAAI,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAC;AACnG,CAAC"}

package/dist/sources/packageJson.d.ts

@@ -0,0 +1,3 @@
+/** `version` from `<dir>/package.json`, or `undefined` when the file or the field is missing. */
+export declare function readPackageVersion(dir: string): string | undefined;
+//# sourceMappingURL=packageJson.d.ts.map

package/dist/sources/packageJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageJson.d.ts","sourceRoot":"","sources":["../../src/sources/packageJson.ts"],"names":[],"mappings":"AAOA,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIlE"}

package/dist/sources/packageJson.js

@@ -0,0 +1,13 @@
+// packages/core/src/sources/packageJson.ts
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+const PackageVersionSchema = z.object({ version: z.string().min(1).optional() });
+/** `version` from `<dir>/package.json`, or `undefined` when the file or the field is missing. */
+export function readPackageVersion(dir) {
+    const file = path.join(dir, "package.json");
+    if (!fs.existsSync(file))
+        return undefined;
+    return PackageVersionSchema.parse(JSON.parse(fs.readFileSync(file, "utf8"))).version;
+}
+//# sourceMappingURL=packageJson.js.map

package/dist/sources/packageJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageJson.js","sourceRoot":"","sources":["../../src/sources/packageJson.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEjF,iGAAiG;AACjG,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACvF,CAAC"}

package/dist/sources/parse.d.ts

@@ -0,0 +1,34 @@
+import type { SourceSpec } from "./types";
+/**
+ * Reads a source as typed on the command line.
+ *
+ * `npm:<pkg>[@version]` and `@scope/pkg[@version]` are npm packages, git URLs
+ * are git repositories, `local:<path>` and paths starting with `.`, `/` or `~`
+ * are local folders, and `owner/repo` is a GitHub repository.
+ *
+ * @param input - e.g. `npm:@g3nomaly/g3n-skills@^1`, `git@github.com:me/skills.git`, `./my-skills`
+ * @param options - `ref` pins a git source to a branch or tag
+ * @throws when the input matches no form, or `ref` is given for a source that is not git
+ */
+export declare function parseSourceSpec(input: string, options?: {
+    ref?: string;
+}): SourceSpec;
+/**
+ * Name a source registers under when none is given: the repository name for
+ * git, the package name without its scope for npm, the folder name for local.
+ *
+ * @returns a valid source name, e.g. `skills` for `git@github.com:g3nomaly/skills.git`
+ */
+export declare function defaultSourceName(spec: SourceSpec): string;
+/** `~/x` with the home folder in place of `~`; any other path unchanged. */
+export declare function expandHome(localPath: string): string;
+/**
+ * Stores a local path the way it is read back: relative to the project root,
+ * or absolute when the manifest is shared by every project (a user scope).
+ * Other kinds are returned unchanged.
+ *
+ * @param cwd - Absolute folder the path was typed in
+ * @param projectRoot - Absolute project root, or `null` to store the path absolute
+ */
+export declare function anchorLocalSpec(spec: SourceSpec, cwd: string, projectRoot: string | null): SourceSpec;
+//# sourceMappingURL=parse.d.ts.map

package/dist/sources/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/sources/parse.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAM1C;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,UAAU,CAOzF;AA4BD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAW1D;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,UAAU,CAIrG"}

package/dist/sources/parse.js

@@ -0,0 +1,92 @@
+// packages/core/src/sources/parse.ts
+import os from "node:os";
+import path from "node:path";
+import { GIT_URL, GitSourceSpecSchema, LocalSourceSpecSchema, NpmSourceSpecSchema } from "./types";
+const NPM_PREFIX = "npm:";
+const LOCAL_PREFIX = "local:";
+const GITHUB_SHORTHAND = /^[\w.-]+\/[\w.-]+$/;
+/**
+ * Reads a source as typed on the command line.
+ *
+ * `npm:<pkg>[@version]` and `@scope/pkg[@version]` are npm packages, git URLs
+ * are git repositories, `local:<path>` and paths starting with `.`, `/` or `~`
+ * are local folders, and `owner/repo` is a GitHub repository.
+ *
+ * @param input - e.g. `npm:@g3nomaly/g3n-skills@^1`, `git@github.com:me/skills.git`, `./my-skills`
+ * @param options - `ref` pins a git source to a branch or tag
+ * @throws when the input matches no form, or `ref` is given for a source that is not git
+ */
+export function parseSourceSpec(input, options = {}) {
+    const value = input.trim();
+    const spec = specFor(value, options.ref);
+    if (options.ref !== undefined && spec.kind !== "git") {
+        throw new Error(`--ref applies to git sources only, "${value}" is ${spec.kind}`);
+    }
+    return spec;
+}
+/** The spec for one trimmed input, by the first form it matches; `ref` goes onto git specs. */
+function specFor(value, ref) {
+    if (value.startsWith(NPM_PREFIX))
+        return npmSpec(value.slice(NPM_PREFIX.length));
+    if (value.startsWith(LOCAL_PREFIX))
+        return LocalSourceSpecSchema.parse({ kind: "local", path: value.slice(LOCAL_PREFIX.length) });
+    if (GIT_URL.test(value))
+        return GitSourceSpecSchema.parse({ kind: "git", url: value, ref });
+    if (value.startsWith(".") || value.startsWith("~") || path.isAbsolute(value)) {
+        return LocalSourceSpecSchema.parse({ kind: "local", path: value });
+    }
+    if (value.startsWith("@"))
+        return npmSpec(value);
+    if (GITHUB_SHORTHAND.test(value)) {
+        return GitSourceSpecSchema.parse({ kind: "git", url: `https://github.com/${value.replace(/\.git$/, "")}.git`, ref });
+    }
+    throw new Error(`"${value}" is not a source: use a git URL, owner/repo, npm:<package>, @scope/package or a local path`);
+}
+/** `pkg`, `pkg@1.2.0`, `@scope/pkg@^1` — the version follows the last `@` that is not the scope's. */
+function npmSpec(value) {
+    const at = value.lastIndexOf("@");
+    const hasVersion = at > 0;
+    return NpmSourceSpecSchema.parse({
+        kind: "npm",
+        package: hasVersion ? value.slice(0, at) : value,
+        version: hasVersion ? value.slice(at + 1) : undefined,
+    });
+}
+/**
+ * Name a source registers under when none is given: the repository name for
+ * git, the package name without its scope for npm, the folder name for local.
+ *
+ * @returns a valid source name, e.g. `skills` for `git@github.com:g3nomaly/skills.git`
+ */
+export function defaultSourceName(spec) {
+    const raw = (() => {
+        switch (spec.kind) {
+            case "git": return spec.url.replace(/\/+$/, "").split(/[/:]/).pop()?.replace(/\.git$/, "") ?? "";
+            case "npm": return spec.package.split("/").pop() ?? spec.package;
+            case "local": return path.basename(path.resolve(spec.path));
+        }
+    })();
+    const name = raw.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[^a-z0-9]+/, "");
+    if (name === "")
+        throw new Error("could not derive a name for the source, pass one with --name");
+    return name;
+}
+/** `~/x` with the home folder in place of `~`; any other path unchanged. */
+export function expandHome(localPath) {
+    return localPath.startsWith("~") ? path.join(os.homedir(), localPath.slice(1)) : localPath;
+}
+/**
+ * Stores a local path the way it is read back: relative to the project root,
+ * or absolute when the manifest is shared by every project (a user scope).
+ * Other kinds are returned unchanged.
+ *
+ * @param cwd - Absolute folder the path was typed in
+ * @param projectRoot - Absolute project root, or `null` to store the path absolute
+ */
+export function anchorLocalSpec(spec, cwd, projectRoot) {
+    if (spec.kind !== "local")
+        return spec;
+    const absolute = path.resolve(cwd, expandHome(spec.path));
+    return { kind: "local", path: projectRoot === null ? absolute : path.relative(projectRoot, absolute) || "." };
+}
+//# sourceMappingURL=parse.js.map

package/dist/sources/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/sources/parse.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAGnG,MAAM,UAAU,GAAK,MAAM,CAAC;AAC5B,MAAM,YAAY,GAAG,QAAQ,CAAC;AAC9B,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAO,GAAqB,EAAE;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAI,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAS,OAAO,CAAC,KAAa,EAAE,GAAuB;IACrD,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,mBAAmB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,6FAA6F,CAAC,CAAC;AAC1H,CAAC;AAED,sGAAsG;AACtG,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,OAAO,mBAAmB,CAAC,KAAK,CAAC;QAC/B,IAAI,EAAK,KAAK;QACd,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK;QAChD,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACtD,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAgB;IAChD,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE;QAChB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,KAAK,EAAI,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YACnG,KAAK,KAAK,EAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;YACnE,KAAK,OAAO,EAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACzF,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACjG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB,EAAE,GAAW,EAAE,WAA0B;IACvF,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;AAChH,CAAC"}

package/dist/sources/process.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Runs a command to completion and returns its trimmed stdout. Prompts are
+ * switched off for git, so a private repository fails instead of hanging.
+ *
+ * @throws with the command's stderr when it exits non-zero
+ */
+export declare function runCommand(argv: string[], cwd?: string): Promise<string>;
+/**
+ * Creates an empty temporary folder that is also removed at process exit, so
+ * a command that bails out early leaves nothing behind.
+ *
+ * @param label - Part of the folder name, e.g. `git` gives `/tmp/g3n-source-git-XXXXXX`
+ * @returns absolute path of the folder
+ */
+export declare function createTempDir(label: string): string;
+/** Deletes a folder and everything in it; a missing folder is not an error. */
+export declare function removeDir(dir: string): void;
+//# sourceMappingURL=process.d.ts.map

package/dist/sources/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/sources/process.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc9E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAInD;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAE3C"}

package/dist/sources/process.js

@@ -0,0 +1,43 @@
+// packages/core/src/sources/process.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/**
+ * Runs a command to completion and returns its trimmed stdout. Prompts are
+ * switched off for git, so a private repository fails instead of hanging.
+ *
+ * @throws with the command's stderr when it exits non-zero
+ */
+export async function runCommand(argv, cwd) {
+    const proc = Bun.spawn(argv, {
+        cwd,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
+        proc.exited,
+    ]);
+    if (exitCode !== 0)
+        throw new Error(stderr.trim() !== "" ? stderr.trim() : `${argv.slice(0, 2).join(" ")} exited with ${exitCode}`);
+    return stdout.trim();
+}
+/**
+ * Creates an empty temporary folder that is also removed at process exit, so
+ * a command that bails out early leaves nothing behind.
+ *
+ * @param label - Part of the folder name, e.g. `git` gives `/tmp/g3n-source-git-XXXXXX`
+ * @returns absolute path of the folder
+ */
+export function createTempDir(label) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), `g3n-source-${label}-`));
+    process.once("exit", () => removeDir(dir));
+    return dir;
+}
+/** Deletes a folder and everything in it; a missing folder is not an error. */
+export function removeDir(dir) {
+    fs.rmSync(dir, { recursive: true, force: true });
+}
+//# sourceMappingURL=process.js.map

package/dist/sources/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/sources/process.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAY;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QAC3B,GAAG;QACH,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE;KAClD,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QAChC,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;IACpI,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC;IAC3E,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/sources/register.d.ts

@@ -0,0 +1,16 @@
+import type { RegisteredSource, SourceRecord, SourceSpec } from "./types";
+/** Built-in sources first, then the registered ones, each group sorted by name. */
+export declare function listSources(record: SourceRecord, builtins: SourceRecord): RegisteredSource[];
+/**
+ * Returns `record` with `spec` registered under `name`.
+ *
+ * @throws when the name is invalid, belongs to a built-in source, or is already registered
+ */
+export declare function addSource(record: SourceRecord, name: string, spec: SourceSpec, builtins: SourceRecord): SourceRecord;
+/**
+ * Returns `record` without the source registered under `name`.
+ *
+ * @throws when `name` is a built-in source or is not registered
+ */
+export declare function removeSource(record: SourceRecord, name: string, builtins: SourceRecord): SourceRecord;
+//# sourceMappingURL=register.d.ts.map

package/dist/sources/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/sources/register.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1E,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAM5F;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,GAAG,YAAY,CAKpH;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,YAAY,CAKrG"}

package/dist/sources/register.js

@@ -0,0 +1,37 @@
+// packages/core/src/sources/register.ts
+import { SourceNameSchema, SourceSpecSchema } from "./types";
+/** Built-in sources first, then the registered ones, each group sorted by name. */
+export function listSources(record, builtins) {
+    const sorted = (r) => Object.entries(r).sort(([a], [b]) => a.localeCompare(b));
+    return [
+        ...sorted(builtins).map(([name, spec]) => ({ name, spec, builtin: true })),
+        ...sorted(record).filter(([name]) => builtins[name] === undefined).map(([name, spec]) => ({ name, spec, builtin: false })),
+    ];
+}
+/**
+ * Returns `record` with `spec` registered under `name`.
+ *
+ * @throws when the name is invalid, belongs to a built-in source, or is already registered
+ */
+export function addSource(record, name, spec, builtins) {
+    const valid = SourceNameSchema.parse(name);
+    if (builtins[valid] !== undefined)
+        throw new Error(`"${valid}" is a built-in source and is always registered`);
+    if (record[valid] !== undefined)
+        throw new Error(`a source named "${valid}" is already registered`);
+    return { ...record, [valid]: SourceSpecSchema.parse(spec) };
+}
+/**
+ * Returns `record` without the source registered under `name`.
+ *
+ * @throws when `name` is a built-in source or is not registered
+ */
+export function removeSource(record, name, builtins) {
+    if (builtins[name] !== undefined)
+        throw new Error(`"${name}" is a built-in source and cannot be removed`);
+    if (record[name] === undefined)
+        throw new Error(`no source named "${name}" is registered`);
+    const { [name]: _removed, ...rest } = record;
+    return rest;
+}
+//# sourceMappingURL=register.js.map

package/dist/sources/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/sources/register.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAG7D,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,MAAoB,EAAE,QAAsB;IACtE,MAAM,MAAM,GAAG,CAAC,CAAe,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO;QACL,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;KAC3H,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAoB,EAAE,IAAY,EAAE,IAAgB,EAAE,QAAsB;IACpG,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,iDAAiD,CAAC,CAAC;IAC/G,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,CAAC;IACpG,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,IAAY,EAAE,QAAsB;IACrF,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,8CAA8C,CAAC,CAAC;IAC1G,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,iBAAiB,CAAC,CAAC;IAC3F,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sources/types.d.ts

@@ -0,0 +1,73 @@
+import { z } from "zod";
+/** Clone URLs `git` accepts without a prompt: https://, ssh://, git://, file:// or scp-style `git@host:path`. */
+export declare const GIT_URL: RegExp;
+/** npm package names, scoped or not, e.g. `@g3nomaly/g3n-skills`. */
+export declare const NPM_PACKAGE: RegExp;
+/** Name a source is registered under, e.g. `g3n-skills`. */
+export declare const SourceNameSchema: z.ZodString;
+export declare const GitSourceSpecSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"git">;
+    url: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const NpmSourceSpecSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"npm">;
+    package: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const LocalSourceSpecSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"local">;
+    path: z.ZodString;
+}, z.core.$strip>;
+/** Where a source's files come from. */
+export declare const SourceSpecSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"git">;
+    url: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"npm">;
+    package: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"local">;
+    path: z.ZodString;
+}, z.core.$strip>], "kind">;
+/** Registered sources by name, as an installer manifest stores them under its `sources` key. */
+export declare const SourceRecordSchema: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"git">;
+    url: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"npm">;
+    package: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"local">;
+    path: z.ZodString;
+}, z.core.$strip>], "kind">>;
+export type GitSourceSpec = z.infer<typeof GitSourceSpecSchema>;
+export type NpmSourceSpec = z.infer<typeof NpmSourceSpecSchema>;
+export type LocalSourceSpec = z.infer<typeof LocalSourceSpecSchema>;
+export type SourceSpec = z.infer<typeof SourceSpecSchema>;
+export type SourceRecord = z.infer<typeof SourceRecordSchema>;
+/** One source an installer can read from, either built into its code or registered by the user. */
+export interface RegisteredSource {
+    name: string;
+    spec: SourceSpec;
+    /** Built into the installer: always listed, never removable */
+    builtin: boolean;
+}
+/** A source resolved to a folder on disk. Call `dispose` once its files have been read. */
+export interface SourceCheckout {
+    name: string;
+    spec: SourceSpec;
+    /** Absolute root of the source's files */
+    dir: string;
+    /** Commit the git clone resolved to; absent for npm and local sources */
+    commit?: string;
+    /** Package version for npm sources, or the `version` in a local source's package.json */
+    version?: string;
+    /** Removes a temporary checkout; a no-op for folders the checkout did not create */
+    dispose: () => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/sources/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sources/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iHAAiH;AACjH,eAAO,MAAM,OAAO,QAAwD,CAAC;AAE7E,qEAAqE;AACrE,eAAO,MAAM,WAAW,QAAuD,CAAC;AAEhF,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,aAEyF,CAAC;AAEvH,eAAO,MAAM,mBAAmB;;;;iBAK9B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;iBAK9B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;iBAIhC,CAAC;AAEH,wCAAwC;AACxC,eAAO,MAAM,gBAAgB;;;;;;;;;;;2BAI3B,CAAC;AAEH,gGAAgG;AAChG,eAAO,MAAM,kBAAkB;;;;;;;;;;;4BAA+C,CAAC;AAE/E,MAAM,MAAM,aAAa,GAAK,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAClE,MAAM,MAAM,aAAa,GAAK,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,UAAU,GAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAM,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE,mGAAmG;AACnG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAK,MAAM,CAAC;IAChB,IAAI,EAAK,UAAU,CAAC;IACpB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAM,MAAM,CAAC;IACjB,IAAI,EAAM,UAAU,CAAC;IACrB,0CAA0C;IAC1C,GAAG,EAAO,MAAM,CAAC;IACjB,yEAAyE;IACzE,MAAM,CAAC,EAAG,MAAM,CAAC;IACjB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,OAAO,EAAG,MAAM,IAAI,CAAC;CACtB"}

package/dist/sources/types.js

@@ -0,0 +1,36 @@
+// packages/core/src/sources/types.ts
+import { z } from "zod";
+/** Clone URLs `git` accepts without a prompt: https://, ssh://, git://, file:// or scp-style `git@host:path`. */
+export const GIT_URL = /^(https?:\/\/|ssh:\/\/|git:\/\/|file:\/\/|git@)\S+$/;
+/** npm package names, scoped or not, e.g. `@g3nomaly/g3n-skills`. */
+export const NPM_PACKAGE = /^(@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+/** Name a source is registered under, e.g. `g3n-skills`. */
+export const SourceNameSchema = z
+    .string()
+    .regex(/^[a-z0-9][a-z0-9._-]*$/, "use lowercase letters, digits, `.`, `_` and `-`, starting with a letter or digit");
+export const GitSourceSpecSchema = z.object({
+    kind: z.literal("git"),
+    url: z.string().regex(GIT_URL, "is not a git URL (https://, ssh://, git://, file:// or git@)"),
+    /** Branch or tag to check out; the default branch when absent */
+    ref: z.string().min(1).optional(),
+});
+export const NpmSourceSpecSchema = z.object({
+    kind: z.literal("npm"),
+    package: z.string().regex(NPM_PACKAGE, "is not an npm package name"),
+    /** Exact version, semver range or dist-tag; absent accepts any installed copy, else `latest` */
+    version: z.string().min(1).optional(),
+});
+export const LocalSourceSpecSchema = z.object({
+    kind: z.literal("local"),
+    /** Folder holding the source, absolute or relative to the project root */
+    path: z.string().min(1),
+});
+/** Where a source's files come from. */
+export const SourceSpecSchema = z.discriminatedUnion("kind", [
+    GitSourceSpecSchema,
+    NpmSourceSpecSchema,
+    LocalSourceSpecSchema,
+]);
+/** Registered sources by name, as an installer manifest stores them under its `sources` key. */
+export const SourceRecordSchema = z.record(SourceNameSchema, SourceSpecSchema);
+//# sourceMappingURL=types.js.map

package/dist/sources/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sources/types.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iHAAiH;AACjH,MAAM,CAAC,MAAM,OAAO,GAAG,qDAAqD,CAAC;AAE7E,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,oDAAoD,CAAC;AAEhF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,KAAK,CAAC,wBAAwB,EAAE,kFAAkF,CAAC,CAAC;AAEvH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACtB,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,8DAA8D,CAAC;IAC/F,iEAAiE;IACjE,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,4BAA4B,CAAC;IACpE,gGAAgG;IAChG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,0EAA0E;IAC1E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,mBAAmB;IACnB,mBAAmB;IACnB,qBAAqB;CACtB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC"}

package/dist/utils/errors.d.ts

@@ -0,0 +1,3 @@
+/** The message of a thrown value, whether or not it is an `Error`. */
+export declare function errorMessage(error: unknown): string;
+//# sourceMappingURL=errors.d.ts.map