@happyvertical/smrt-cli 0.55.10 → 0.55.11

package/dist/apply-BNDIdixP.js

@@ -0,0 +1,947 @@
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFileSync, spawnSync } from "node:child_process";
+import { homedir, tmpdir } from "node:os";
+import { createHash } from "node:crypto";
+import { Readable } from "node:stream";
+import { extract } from "tar";
+import { parseCookbookText } from "@happyvertical/smrt-core/cookbook";
+//#region src/commands/cookbook/apply.ts
+/**
+* `smrt cookbook apply` engine (#3748): create or update a project from a
+* validated cookbook. Writes configuration only (package.json dependencies,
+* `smrt.cookbook.json`, and the project name for a new project); never sample
+* data and never anything else in the project.
+*/
+var COOKBOOK_CONFIG_FILE = "smrt.cookbook.json";
+var DEP_SECTIONS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
+var ApplyError = class extends Error {};
+function detectIndent(text) {
+	return /^( +|\t)"/m.exec(text)?.[1] ?? 2;
+}
+function readPackageJson(dir) {
+	const file = join(dir, "package.json");
+	if (!existsSync(file)) throw new ApplyError(`No package.json in ${dir}`);
+	const raw = readFileSync(file, "utf-8");
+	try {
+		return {
+			json: JSON.parse(raw),
+			raw
+		};
+	} catch {
+		throw new ApplyError(`${file} is not valid JSON`);
+	}
+}
+function declaredRange(json, name) {
+	for (const section of DEP_SECTIONS) {
+		const value = json[section]?.[name];
+		if (typeof value === "string") return value;
+	}
+}
+/**
+* Range for packages the project does not declare yet: the framework line the
+* project already uses (smrt packages release as one fixed group), else this
+* CLI's own release line.
+*/
+function chooseRange(json, cliVersion) {
+	const core = declaredRange(json, "@happyvertical/smrt-core");
+	if (core?.startsWith("workspace:")) return "workspace:*";
+	if (core && /^[\^~]?\d/.test(core)) return core;
+	return `^${cliVersion}`;
+}
+var slug = (value) => value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+/** A valid unscoped npm package name from free text, or undefined when nothing usable remains. */
+function npmNameFromText(value) {
+	return slug(value).slice(0, 214).replace(/-+$/, "") || void 0;
+}
+/** Parse `github:owner/repo#ref`, a git URL, or a local path. */
+function parseTemplateSpec(spec) {
+	const [head, ref] = (() => {
+		const hash = spec.indexOf("#");
+		return hash === -1 ? [spec, void 0] : [spec.slice(0, hash), spec.slice(hash + 1)];
+	})();
+	const github = /^github:([\w.-]+\/[\w.-]+)$/.exec(head);
+	if (github) return {
+		kind: "git",
+		url: `https://github.com/${github[1]}.git`,
+		ref
+	};
+	if (/^(https?|ssh|git):\/\//.test(head) || /^git@/.test(head)) return {
+		kind: "git",
+		url: head,
+		ref
+	};
+	return {
+		kind: "local",
+		path: resolve(spec)
+	};
+}
+function git(args, cwd) {
+	return execFileSync("git", args, {
+		cwd,
+		encoding: "utf-8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		env: {
+			...process.env,
+			GIT_TERMINAL_PROMPT: "0",
+			GIT_ASKPASS: "false"
+		},
+		timeout: 12e4
+	}).trim();
+}
+/**
+* Files a local git checkout contributes to a new project: everything tracked
+* plus untracked files that are not git-ignored (`git ls-files -co
+* --exclude-standard`). A working checkout carries git-ignored generated
+* output (build products, a stale `src/routes/api/notes`) that must not leak
+* into a new project, while uncommitted edits to the template still apply, so
+* `git archive HEAD` (which would drop them) is not used. Returns undefined
+* when `dir` is not inside a git work tree or git is unavailable.
+*/
+function listLocalTemplateFiles(dir) {
+	try {
+		if (git(["rev-parse", "--is-inside-work-tree"], dir) !== "true") return;
+		const out = execFileSync("git", [
+			"ls-files",
+			"-z",
+			"--cached",
+			"--others",
+			"--exclude-standard"
+		], {
+			cwd: dir,
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		return [...new Set(out.split("\0").filter(Boolean))].filter((file) => existsSync(join(dir, file)));
+	} catch {
+		return;
+	}
+}
+/** Resolve a template to a directory: a local path as-is, a git source shallow-fetched. */
+function acquireTemplate(spec) {
+	const parsed = parseTemplateSpec(spec);
+	if (parsed.kind === "local") {
+		if (!existsSync(join(parsed.path, "package.json"))) throw new ApplyError(`Template ${parsed.path} has no package.json (pass --template <path|github:owner/repo#ref>)`);
+		return {
+			root: parsed.path,
+			files: listLocalTemplateFiles(parsed.path),
+			cleanup() {}
+		};
+	}
+	const root = mkdtempSync(join(tmpdir(), "smrt-template-"));
+	const cleanup = () => rmSync(root, {
+		recursive: true,
+		force: true
+	});
+	try {
+		git(["init", "-q"], root);
+		if (parsed.ref?.startsWith("-") || parsed.url.startsWith("-")) throw new ApplyError(`Invalid template source ${spec}`);
+		git([
+			"fetch",
+			"-q",
+			"--depth",
+			"1",
+			"--",
+			parsed.url,
+			parsed.ref ?? "HEAD"
+		], root);
+		git([
+			"checkout",
+			"-q",
+			"FETCH_HEAD"
+		], root);
+		const revision = git(["rev-parse", "HEAD"], root);
+		rmSync(join(root, ".git"), {
+			recursive: true,
+			force: true
+		});
+		return {
+			root,
+			revision,
+			cleanup
+		};
+	} catch (error) {
+		cleanup();
+		throw new ApplyError(`Could not fetch template ${spec}: ${error instanceof Error ? (error.stderr || error.message).trim() : String(error)}`);
+	}
+}
+function isEmptyDir(dir) {
+	return readdirSync(dir).length === 0;
+}
+function renderJson(value, indent = 2) {
+	return `${JSON.stringify(value, null, indent)}\n`;
+}
+function packageManager(dir) {
+	if (existsSync(join(dir, "yarn.lock"))) return "yarn";
+	if (existsSync(join(dir, "package-lock.json"))) return "npm";
+	return "pnpm";
+}
+function nextSteps(dir, json, installed, cwd) {
+	const pm = packageManager(dir);
+	const run = pm === "npm" ? "npm run" : pm;
+	const scripts = json.scripts ?? {};
+	const steps = [];
+	if (resolve(dir) !== resolve(cwd)) {
+		const rel = relative(cwd, dir);
+		steps.push(`cd ${rel.startsWith("..") ? resolve(dir) : rel || "."}`);
+	}
+	if (!installed) steps.push(`${pm} install`);
+	steps.push(scripts["app:setup"] ? `${run} app:setup` : "npx smrt app setup", scripts["app:doctor"] ? `${run} app:doctor` : "npx smrt doctor");
+	return steps;
+}
+function copyTemplate(template, targetDir) {
+	const skip = (name) => name === ".git" || name === "node_modules";
+	const refuseLink = (src) => {
+		if (lstatSync(src).isSymbolicLink()) throw new ApplyError(`Template entry ${relative(template.root, src)} is a symbolic link; templates must not contain links`);
+		return true;
+	};
+	if (!template.files) {
+		cpSync(template.root, targetDir, {
+			recursive: true,
+			filter: (src) => !skip(basename(src)) && refuseLink(src)
+		});
+		return;
+	}
+	for (const file of template.files) {
+		if (file.split("/").some(skip)) continue;
+		const from = join(template.root, file);
+		refuseLink(from);
+		const to = join(targetDir, file);
+		mkdirSync(dirname(to), { recursive: true });
+		cpSync(from, to, {
+			recursive: true,
+			filter: (src) => refuseLink(src)
+		});
+	}
+}
+/** Plan and (unless dry-run) perform the apply. */
+function applyCookbook(options) {
+	const cwd = options.cwd ?? process.cwd();
+	const spec = options.template ?? "github:happyvertical/smrt-start";
+	const configText = renderJson(options.cookbook);
+	let mode;
+	let targetDir;
+	if (options.into) {
+		mode = "update";
+		targetDir = resolve(cwd, options.dir ?? ".");
+	} else {
+		const relative = options.dir ?? (options.cookbook.name ? slug(options.cookbook.name) : "");
+		if (!relative) throw new ApplyError("Give a directory for the new project (smrt cookbook apply <file> <dir>), or use --into for the current project");
+		targetDir = resolve(cwd, relative);
+		if (existsSync(targetDir) && !isEmptyDir(targetDir)) if (existsSync(join(targetDir, "smrt.cookbook.json")) && existsSync(join(targetDir, "package.json"))) mode = "update";
+		else throw new ApplyError(`${targetDir} is not empty and holds no ${COOKBOOK_CONFIG_FILE}; pick another directory, or pass --into to apply to an existing project`);
+		else mode = "new";
+	}
+	let template;
+	try {
+		let baseJson;
+		let baseRaw;
+		if (mode === "new") {
+			template = acquireTemplate(spec);
+			({json: baseJson, raw: baseRaw} = readPackageJson(template.root));
+		} else ({json: baseJson, raw: baseRaw} = readPackageJson(targetDir));
+		const range = chooseRange(baseJson, options.cliVersion);
+		const addDependencies = {};
+		const keptDependencies = {};
+		for (const name of options.packages) {
+			const existing = declaredRange(baseJson, name);
+			if (existing !== void 0) keptDependencies[name] = existing;
+			else addDependencies[name] = range;
+		}
+		const configFile = join(targetDir, COOKBOOK_CONFIG_FILE);
+		const config = mode === "update" && existsSync(configFile) ? readFileSync(configFile, "utf-8") === configText ? "unchanged" : "update" : "create";
+		const projectName = mode === "new" ? npmNameFromText(options.cookbook.name ?? "") ?? npmNameFromText(basename(targetDir)) ?? "smrt-app" : void 0;
+		const plan = {
+			mode,
+			targetDir,
+			template: mode === "new" ? {
+				spec,
+				revision: template?.revision
+			} : void 0,
+			projectName,
+			addDependencies,
+			keptDependencies,
+			config
+		};
+		const nextJson = { ...baseJson };
+		if (projectName) nextJson.name = projectName;
+		if (Object.keys(addDependencies).length > 0) {
+			const section = "dependencies";
+			const merged = {
+				...nextJson[section] ?? {},
+				...addDependencies
+			};
+			nextJson[section] = Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
+		}
+		const wantInstall = options.install !== false;
+		if (options.dryRun) return {
+			plan,
+			dryRun: true,
+			written: [],
+			installed: false,
+			nextSteps: nextSteps(targetDir, nextJson, false, cwd)
+		};
+		const written = [];
+		if (mode === "new") {
+			mkdirSync(targetDir, { recursive: true });
+			copyTemplate(template, targetDir);
+			written.push(`${targetDir} (from template)`);
+		}
+		if (mode === "new" || Object.keys(addDependencies).length > 0 || Boolean(projectName)) {
+			const file = join(targetDir, "package.json");
+			const next = renderJson(nextJson, detectIndent(baseRaw));
+			if (mode === "new" || next !== baseRaw) {
+				writeFileSync(file, next);
+				written.push(file);
+			}
+		}
+		if (config !== "unchanged") {
+			writeFileSync(configFile, configText);
+			written.push(configFile);
+		}
+		let installed = false;
+		if (wantInstall) {
+			const pm = packageManager(targetDir);
+			if (spawnSync(pm, ["install"], {
+				cwd: targetDir,
+				stdio: options.installOutput === "stderr" ? [
+					"ignore",
+					2,
+					2
+				] : "inherit"
+			}).status !== 0) throw new ApplyError(`${pm} install failed in ${targetDir}; the cookbook is applied, fix the install error and re-run it`);
+			installed = true;
+		}
+		return {
+			plan,
+			dryRun: false,
+			written,
+			installed,
+			nextSteps: nextSteps(targetDir, nextJson, installed, cwd)
+		};
+	} finally {
+		template?.cleanup();
+	}
+}
+//#endregion
+//#region src/commands/cookbook/registry.ts
+/**
+* npm registry access shared by the cookbook recipe index (#3748) and
+* `smrt kitchen` (#3750): which registry owns a package's scope (the way npm
+* and pnpm pick it, auth token included), and fetching and extracting a
+* package tarball without installing it.
+*/
+function expandEnv(value) {
+	return value.replace(/\$\{([^}]+)\}/g, (_m, name) => process.env[name] ?? "");
+}
+/** Parse the `.npmrc` chain: project files up the tree first, then the user's. */
+function readNpmrcChain(dir) {
+	const files = [];
+	let current = resolve(dir);
+	while (true) {
+		files.push(join(current, ".npmrc"));
+		const parent = dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+	files.push(join(homedir(), ".npmrc"));
+	const values = /* @__PURE__ */ new Map();
+	for (const file of files) {
+		if (!existsSync(file)) continue;
+		for (const line of readFileSync(file, "utf-8").split(/\r?\n/)) {
+			const match = /^\s*([^#;=\s][^=]*?)\s*=\s*(.*?)\s*$/.exec(line);
+			if (match && !values.has(match[1])) values.set(match[1], expandEnv(match[2]));
+		}
+	}
+	return { values };
+}
+var trimSlash = (url) => url.replace(/\/+$/, "");
+/**
+* The registry for a package, the way npm and pnpm pick it: the scope's
+* `@scope:registry` (`.npmrc` chain, then `npm config`), then
+* `npm_config_registry`, then an unscoped `registry=`, then npmjs.
+* Also returns an auth token configured for that registry's host.
+*/
+function registryForPackage(packageName, dir = process.cwd()) {
+	const scope = packageName.startsWith("@") ? packageName.split("/")[0] : null;
+	const rc = readNpmrcChain(dir);
+	let url = scope ? rc.values.get(`${scope}:registry`) : void 0;
+	if (scope && !url) try {
+		const out = execFileSync("npm", [
+			"config",
+			"get",
+			`${scope}:registry`
+		], {
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 1e4
+		}).trim();
+		if (/^https?:\/\//.test(out)) url = out;
+	} catch {}
+	url ||= process.env.npm_config_registry || rc.values.get("registry") || "https://registry.npmjs.org/";
+	url = trimSlash(url);
+	const hostPath = url.replace(/^https?:/, "");
+	const token = rc.values.get(`${hostPath}/:_authToken`) ?? rc.values.get(`${hostPath.replace(/\/[^/]*$/, "")}/:_authToken`);
+	return {
+		url,
+		token: token || void 0
+	};
+}
+/** A package this CLI may fetch from a registry without installing it. */
+var SMRT_PACKAGE_NAME = /^@happyvertical\/smrt-[a-z0-9][a-z0-9-]*$/;
+/** A registry-supplied version is a path segment in the planner cache. */
+var SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+/**
+* Ask the registry that owns a package's scope which version to use, without
+* downloading anything. Tries `versionHint` first (when given), then `latest`.
+* Returns null when the package or version is unavailable.
+*/
+async function lookupPackage(packageName, options = {}) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const resolved = options.registryUrl ? {
+		url: trimSlash(options.registryUrl),
+		token: void 0
+	} : registryForPackage(packageName, options.dir);
+	const base = resolved.url;
+	const headers = resolved.token ? { authorization: `Bearer ${resolved.token}` } : {};
+	const encoded = packageName.replace("/", "%2F");
+	for (const version of [options.versionHint, "latest"]) {
+		if (!version) continue;
+		try {
+			const response = await fetchImpl(`${base}/${encoded}/${version}`, { headers });
+			if (!response.ok) continue;
+			const meta = await response.json();
+			const tarballUrl = meta.dist?.tarball;
+			if (!tarballUrl) return null;
+			if (meta.version !== void 0 && !SEMVER.test(meta.version)) return null;
+			let tarball;
+			let registry;
+			try {
+				tarball = new URL(tarballUrl);
+				registry = new URL(base);
+			} catch {
+				return null;
+			}
+			const sameOrigin = tarball.origin === registry.origin;
+			if (tarball.protocol !== "https:" && !sameOrigin) return null;
+			return {
+				version: meta.version,
+				registry: base,
+				tarballUrl,
+				headers: sameOrigin ? headers : {},
+				integrity: meta.dist?.integrity
+			};
+		} catch {
+			return null;
+		}
+	}
+	return null;
+}
+/** Download the tarball a {@link lookupPackage} found. Null when unavailable. */
+async function downloadPackage(found, fetchImpl = fetch) {
+	try {
+		const response = await fetchImpl(found.tarballUrl, { headers: found.headers });
+		if (!response.ok) return null;
+		const data = await response.arrayBuffer();
+		if (data.byteLength > 314572800) return null;
+		if (found.integrity?.startsWith("sha512-")) {
+			if (`sha512-${createHash("sha512").update(Buffer.from(data)).digest("base64")}` !== found.integrity) return null;
+		}
+		return {
+			version: found.version,
+			registry: found.registry,
+			data
+		};
+	} catch {
+		return null;
+	}
+}
+/** Look a package up and download its tarball. Null when unavailable. */
+async function fetchPackageTarball(packageName, options = {}) {
+	const found = await lookupPackage(packageName, options);
+	return found ? downloadPackage(found, options.fetchImpl) : null;
+}
+/**
+* Extract a tarball into `cwd` (entries keep their `package/` prefix). A
+* `filter` limits which entries are written.
+*/
+async function extractTarball(data, cwd, filter) {
+	await new Promise((done, fail) => {
+		const sink = extract({
+			cwd,
+			...filter ? { filter } : {}
+		});
+		sink.on("close", () => done());
+		sink.on("error", fail);
+		Readable.from(Buffer.from(data)).pipe(sink);
+	});
+}
+//#endregion
+//#region src/commands/cookbook/recipe-index.ts
+/**
+* Recipe index for `smrt cookbook validate|apply` (#3748).
+*
+* Source of truth: each package's published manifest (its
+* `./manifest` export; `dist/manifest.json` or `dist/lib/manifest.json`), which carries `recipes[]` and the `objects` the
+* cookbook's policies and features point at. Manifests are read from, in
+* order: explicit `--manifests` paths, the SMRT workspace around the working
+* directory, the project's `node_modules`, and finally (opt-out with
+* `--no-registry`) the npm registry for packages that are not installed yet.
+*/
+var SMRT_SCOPE = "@happyvertical";
+var PACKAGE_PREFIX = "smrt-";
+function createRecipeIndex() {
+	return {
+		recipes: /* @__PURE__ */ new Map(),
+		packages: /* @__PURE__ */ new Map(),
+		missing: /* @__PURE__ */ new Set()
+	};
+}
+/** Add one parsed manifest to the index. Returns false when it names no package. */
+function addManifest(index, manifest, source) {
+	const packageName = manifest.packageName;
+	if (!packageName || index.packages.has(packageName)) return Boolean(packageName);
+	const objects = /* @__PURE__ */ new Map();
+	for (const [name, object] of Object.entries(manifest.objects ?? {})) {
+		const fields = object?.fields;
+		objects.set(name, new Set(Array.isArray(fields) ? fields.map((f) => typeof f === "string" ? f : String(f.name)) : Object.keys(fields ?? {})));
+	}
+	index.packages.set(packageName, {
+		packageName,
+		packageVersion: manifest.packageVersion,
+		source,
+		objects,
+		manifest
+	});
+	for (const recipe of manifest.recipes ?? []) {
+		if (!recipe.id || index.recipes.has(recipe.id)) continue;
+		index.recipes.set(recipe.id, {
+			id: recipe.id,
+			packageName,
+			packageVersion: manifest.packageVersion,
+			requires: recipe.requires ?? [],
+			requiresAny: recipe.requiresAny ?? [],
+			models: recipe.models ?? [],
+			hasOptions: Boolean(recipe.options && Object.keys(recipe.options).length > 0),
+			hasDemoSeed: recipe.demoSeed !== void 0
+		});
+	}
+	return true;
+}
+var MANIFEST_FALLBACKS = [
+	"dist/manifest.json",
+	"dist/lib/manifest.json",
+	"manifest.json"
+];
+function exportTarget(value) {
+	if (typeof value === "string") return value;
+	if (value && typeof value === "object") {
+		const record = value;
+		return exportTarget(record.default ?? record.import ?? record.require);
+	}
+}
+/**
+* A package directory's manifest file: its `exports['./manifest']` (or
+* `./manifest.json`) target, else the known locations. SvelteKit-library
+* packages publish at `dist/lib/manifest.json`, not `dist/manifest.json`.
+*/
+function manifestPathForPackageDir(dir) {
+	try {
+		const exports = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8")).exports;
+		const target = exportTarget(exports?.["./manifest"]) ?? exportTarget(exports?.["./manifest.json"]);
+		if (target?.endsWith(".json")) {
+			const file = resolve(dir, target);
+			if (existsSync(file)) return file;
+		}
+	} catch {}
+	for (const relative of MANIFEST_FALLBACKS) {
+		const file = join(dir, relative);
+		if (existsSync(file)) return file;
+	}
+	return null;
+}
+function readManifestFile(index, file, warn) {
+	try {
+		addManifest(index, JSON.parse(readFileSync(file, "utf-8")), file);
+	} catch (error) {
+		warn(`Skipped unreadable manifest ${file}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+/**
+* Read manifests from a path: a manifest file, a directory of `*.json`
+* manifests, or a directory of package directories (`<pkg>/dist/manifest.json`
+* or `<pkg>/manifest.json`).
+*/
+function loadManifestPath(index, path, warn = () => {}) {
+	const target = resolve(path);
+	if (!existsSync(target)) {
+		warn(`Manifest path not found: ${target}`);
+		return;
+	}
+	if (statSync(target).isFile()) {
+		readManifestFile(index, target, warn);
+		return;
+	}
+	const own = manifestPathForPackageDir(target);
+	if (own) {
+		readManifestFile(index, own, warn);
+		return;
+	}
+	for (const entry of readdirSync(target).sort()) {
+		const child = join(target, entry);
+		if (entry.endsWith(".json")) readManifestFile(index, child, warn);
+		else if (statSync(child).isDirectory()) {
+			const file = manifestPathForPackageDir(child);
+			if (file) readManifestFile(index, file, warn);
+		}
+	}
+}
+/** Walk up from `start` for the SMRT monorepo root (`packages/*` + workspace file). */
+function findSmrtWorkspace(start) {
+	let current = resolve(start);
+	while (true) {
+		if (existsSync(join(current, "pnpm-workspace.yaml")) && existsSync(join(current, "packages", "core", "package.json"))) return current;
+		const parent = dirname(current);
+		if (parent === current) return null;
+		current = parent;
+	}
+}
+/** Load workspace and installed manifests visible from `dir`. */
+function loadLocalManifests(index, dir, warn = () => {}) {
+	const workspace = findSmrtWorkspace(dir);
+	if (workspace) {
+		const packagesDir = join(workspace, "packages");
+		for (const entry of readdirSync(packagesDir).sort()) {
+			const manifest = manifestPathForPackageDir(join(packagesDir, entry));
+			if (manifest) readManifestFile(index, manifest, warn);
+		}
+	}
+	let current = resolve(dir);
+	while (true) {
+		const scope = join(current, "node_modules", SMRT_SCOPE);
+		if (existsSync(scope)) for (const entry of readdirSync(scope).sort()) {
+			if (!entry.startsWith(PACKAGE_PREFIX)) continue;
+			const manifest = manifestPathForPackageDir(join(scope, entry));
+			if (manifest) readManifestFile(index, manifest, warn);
+		}
+		const parent = dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+}
+/** Recipe id prefixes whose package name differs from `smrt-<prefix>`. */
+var PREFIX_PACKAGE_ALIASES = { integrations: "webhooks" };
+/** The package that conventionally owns a recipe id (`commerce.sales` -> smrt-commerce). */
+function candidatePackageForRecipe(id) {
+	const prefix = id.split(".")[0] ?? id;
+	return `${SMRT_SCOPE}/${PACKAGE_PREFIX}${PREFIX_PACKAGE_ALIASES[prefix] ?? prefix}`;
+}
+/** The package a qualified object (`@scope/pkg:Class`) belongs to, if qualified. */
+function packageOfQualifiedName(ref) {
+	const at = ref.lastIndexOf(":");
+	if (!ref.startsWith("@") || at <= 0) return null;
+	return ref.slice(0, at);
+}
+/**
+* Fetch a package's manifest from the registry that owns its scope, without
+* installing it. Returns false when the package or its manifest is missing.
+*/
+async function loadRegistryManifest(index, packageName, options = {}) {
+	if (!SMRT_PACKAGE_NAME.test(packageName)) return false;
+	const tarball = await fetchPackageTarball(packageName, options);
+	if (!tarball) return false;
+	const work = mkdtempSync(join(tmpdir(), "smrt-cookbook-"));
+	try {
+		await extractTarball(tarball.data, work, (path) => path === "package/package.json" || path.endsWith("manifest.json"));
+		const file = manifestPathForPackageDir(join(work, "package"));
+		if (!file) return false;
+		const manifest = JSON.parse(readFileSync(file, "utf-8"));
+		if (manifest.packageName !== packageName) return false;
+		return addManifest(index, manifest, `${tarball.registry}/${packageName.replace("/", "%2F")}@${tarball.version ?? "latest"}`);
+	} finally {
+		rmSync(work, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** What a cookbook needs resolved, for the registry-fill loop. */
+function neededPackages(index, cookbook) {
+	const packages = /* @__PURE__ */ new Set();
+	const queue = [...cookbook.recipes ?? []];
+	const seen = /* @__PURE__ */ new Set();
+	while (queue.length) {
+		const id = queue.shift();
+		if (seen.has(id)) continue;
+		seen.add(id);
+		const entry = index.recipes.get(id);
+		if (!entry) {
+			packages.add(candidatePackageForRecipe(id));
+			continue;
+		}
+		queue.push(...entry.requires, ...entry.requiresAny.flat());
+	}
+	for (const ref of [...cookbook.features ?? [], ...(cookbook.policies ?? []).map((p) => p.objectRef ?? "")]) {
+		const pkg = packageOfQualifiedName(ref);
+		if (pkg) packages.add(pkg);
+	}
+	return [...packages].filter((name) => !index.packages.has(name) && !index.missing.has(name));
+}
+/**
+* Build the index a cookbook needs: local sources first, then the registry
+* for packages still unresolved, repeating until no new package appears.
+*/
+async function resolveRecipeIndex(cookbook, options) {
+	const warn = options.warn ?? (() => {});
+	const index = createRecipeIndex();
+	for (const path of options.manifests ?? []) loadManifestPath(index, path, warn);
+	loadLocalManifests(index, options.dir, warn);
+	if (options.registry === false) return index;
+	for (let round = 0; round < 8; round += 1) {
+		const needed = neededPackages(index, cookbook);
+		if (needed.length === 0) break;
+		for (const name of needed) if (!await loadRegistryManifest(index, name, {
+			dir: options.dir,
+			...options.registryOptions
+		})) index.missing.add(name);
+	}
+	return index;
+}
+//#endregion
+//#region src/commands/cookbook/validate.ts
+/**
+* Cookbook validation against the recipe index (#3748): the structural check
+* lives in core (`validateCookbook`); this adds what needs manifests.
+*/
+var unresolvedHint = (index, packageName) => index.missing.has(packageName) ? ` (package ${packageName} could not be found; install it, pass --manifests, or check the registry)` : "";
+/** Validate cookbook text structurally and against the recipe index. */
+function validateCookbookText(text, index) {
+	const structural = parseCookbookText(text);
+	if (!structural.ok) return {
+		ok: false,
+		errors: structural.errors,
+		warnings: [],
+		packages: []
+	};
+	const cookbook = structural.cookbook;
+	const errors = [];
+	const warnings = [...structural.warnings];
+	const packages = /* @__PURE__ */ new Set();
+	const selected = new Set(cookbook.recipes);
+	for (const id of cookbook.recipes) {
+		const entry = index.recipes.get(id);
+		if (!entry) {
+			errors.push(`recipe "${id}" does not exist${unresolvedHint(index, candidatePackageForRecipe(id))}`);
+			continue;
+		}
+		packages.add(entry.packageName);
+		for (const required of entry.requires) if (!selected.has(required)) errors.push(`recipe "${id}" requires "${required}", which is missing`);
+		for (const group of entry.requiresAny) if (!group.some((alt) => selected.has(alt))) errors.push(`recipe "${id}" requires one of ${group.map((g) => `"${g}"`).join(", ")}, and none is present`);
+	}
+	const checkObject = (ref, at) => {
+		const pkg = packageOfQualifiedName(ref);
+		if (!pkg) {
+			errors.push(`${at}: "${ref}" is not a qualified name (@scope/pkg:Class)`);
+			return null;
+		}
+		const info = index.packages.get(pkg);
+		if (!info) {
+			errors.push(`${at}: package ${pkg} for "${ref}" is not resolvable${unresolvedHint(index, pkg)}`);
+			return null;
+		}
+		packages.add(pkg);
+		const fields = info.objects.get(ref);
+		if (!fields) {
+			errors.push(`${at}: object "${ref}" does not exist in ${pkg}`);
+			return null;
+		}
+		return fields;
+	};
+	(cookbook.features ?? []).forEach((ref, i) => {
+		checkObject(ref, `features[${i}]`);
+	});
+	(cookbook.policies ?? []).forEach((policy, i) => {
+		const at = `policies[${i}]`;
+		const fields = checkObject(policy.objectRef, at);
+		if (fields && !fields.has(policy.fieldName)) errors.push(`${at}: field "${policy.fieldName}" does not exist on ${policy.objectRef}`);
+	});
+	return {
+		ok: errors.length === 0,
+		errors,
+		warnings,
+		cookbook: errors.length === 0 ? cookbook : void 0,
+		packages: [...packages].sort()
+	};
+}
+/** Cookbook shape needed to plan resolution before validation. */
+function parseForResolution(text) {
+	try {
+		const raw = JSON.parse(text);
+		const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+		return {
+			recipes: strings(raw.recipes),
+			features: strings(raw.features),
+			policies: Array.isArray(raw.policies) ? raw.policies.filter((p) => typeof p === "object" && p !== null) : []
+		};
+	} catch {
+		return {
+			recipes: [],
+			features: [],
+			policies: []
+		};
+	}
+}
+//#endregion
+//#region src/commands/cookbook/shared.ts
+/**
+* Pieces of `smrt cookbook` that `smrt kitchen` (#3750) reuses: reading a
+* cookbook source, validating it against the recipe index, and printing an
+* apply result.
+*/
+/** Version of this CLI: the last-resort range for packages a cookbook adds. */
+function cliVersion() {
+	let current = dirname(fileURLToPath(import.meta.url));
+	while (true) {
+		try {
+			const pkg = JSON.parse(readFileSync(join(current, "package.json"), "utf-8"));
+			if (pkg.name === "@happyvertical/smrt-cli" && pkg.version) return pkg.version;
+		} catch {}
+		const parent = dirname(current);
+		if (parent === current) return "0.0.0";
+		current = parent;
+	}
+}
+/** A cookbook is a small JSON file; the kitchen accepts at most 2 MB too. */
+var MAX_COOKBOOK_CHARS = 2 * 1024 * 1024;
+/** Cookbook text from a file path or an http(s) URL. */
+async function readCookbookSource(source) {
+	if (/^https?:\/\//.test(source)) {
+		const response = await fetch(source);
+		if (!response.ok) throw new ApplyError(`Could not fetch ${source}: HTTP ${response.status}`);
+		const text = await response.text();
+		if (text.length > MAX_COOKBOOK_CHARS) throw new ApplyError(`${source} is larger than a cookbook can be.`);
+		return text;
+	}
+	try {
+		return readFileSync(resolve(source), "utf-8");
+	} catch {
+		throw new ApplyError(`Could not read cookbook file ${resolve(source)}`);
+	}
+}
+var asList = (value) => value === void 0 ? [] : Array.isArray(value) ? value : [value];
+/** Validate cookbook text structurally and against the resolved recipe index. */
+async function validateCookbookSource(text, options) {
+	const warnings = [];
+	const report = validateCookbookText(text, await resolveRecipeIndex(parseForResolution(text), {
+		dir: options.dir,
+		manifests: options.manifests ?? [],
+		registry: options.registry !== false,
+		warn: (message) => warnings.push(message)
+	}));
+	report.warnings.push(...warnings);
+	return report;
+}
+/** Print what an apply did (or, for a dry run, would do) and the next steps. */
+function printApplyResult(result, warnings, log = console.log, warn = console.warn) {
+	for (const warning of warnings) warn(`warning: ${warning}`);
+	const { plan } = result;
+	log(`${result.dryRun ? "Plan (dry run)" : "Applied"}: ${plan.mode === "new" ? "new project" : "update"} in ${plan.targetDir}`);
+	if (plan.template) log(`  template: ${plan.template.spec}${plan.template.revision ? ` @ ${plan.template.revision}` : ""}`);
+	if (plan.projectName) log(`  project name: ${plan.projectName}`);
+	for (const [name, range] of Object.entries(plan.addDependencies)) log(`  + ${name}@${range}`);
+	for (const [name, range] of Object.entries(plan.keptDependencies)) log(`  = ${name}@${range} (already declared)`);
+	log(`  smrt.cookbook.json: ${plan.config}`);
+	log("\nNext steps:");
+	for (const step of result.nextSteps) log(`  ${step}`);
+}
+//#endregion
+//#region src/commands/kitchen/apply.ts
+/**
+* Applying a cookbook the page sent to `smrt kitchen` (#3750): the same
+* validation and apply engine as `smrt cookbook apply`, wrapped as one call
+* that returns the HTTP-shaped outcome the planner shows to the visitor.
+*/
+function createCookbookApplier(options) {
+	const log = options.log ?? (() => {});
+	return async (text) => {
+		let cookbookText = text;
+		try {
+			cookbookText = JSON.stringify(JSON.parse(text));
+		} catch {
+			return {
+				ok: false,
+				status: 400,
+				errors: ["The body is not valid JSON."]
+			};
+		}
+		try {
+			log("Checking the cookbook against the recipe manifests…");
+			const report = options.index ? validateCookbookText(cookbookText, options.index) : await validateCookbookSource(cookbookText, {
+				dir: options.dir,
+				manifests: options.manifests,
+				registry: options.registry
+			});
+			for (const warning of report.warnings) log(`warning: ${warning}`);
+			if (!report.ok || !report.cookbook) return {
+				ok: false,
+				status: 422,
+				errors: report.errors
+			};
+			log(`Writing the project in ${options.dir}…`);
+			const result = applyCookbook({
+				cookbook: report.cookbook,
+				packages: report.packages,
+				dir: options.dir,
+				template: options.template,
+				install: options.install,
+				installOutput: options.installOutput,
+				dryRun: options.dryRun,
+				cliVersion: cliVersion()
+			});
+			return {
+				ok: true,
+				status: 200,
+				result,
+				body: {
+					ok: true,
+					dir: result.plan.targetDir,
+					mode: result.plan.mode,
+					installed: result.installed,
+					added: Object.keys(result.plan.addDependencies),
+					nextSteps: result.nextSteps
+				}
+			};
+		} catch (error) {
+			if (error instanceof ApplyError) return {
+				ok: false,
+				status: 409,
+				errors: [error.message]
+			};
+			return {
+				ok: false,
+				status: 500,
+				errors: [error instanceof Error ? error.message : String(error)]
+			};
+		}
+	};
+}
+//#endregion
+export { readCookbookSource as a, SMRT_SCOPE as c, downloadPackage as d, extractTarball as f, applyCookbook as g, COOKBOOK_CONFIG_FILE as h, printApplyResult as i, loadRegistryManifest as l, ApplyError as m, asList as n, validateCookbookSource as o, lookupPackage as p, cliVersion as r, validateCookbookText as s, createCookbookApplier as t, resolveRecipeIndex as u };