@justfortytwo/installer 1.0.0-0 → 1.0.0-10

package/dist/shim.d.ts

@@ -0,0 +1,52 @@
+/** Identifies a launcher we wrote, so we only ever replace our own file. */
+export declare const SHIM_MARKER = "fortytwo-shim";
+export declare const SHIM_SCRIPT = "#!/bin/sh\n# fortytwo \u2014 user-level launcher installed by @justfortytwo/installer (fortytwo-shim v2).\n# It holds no version and no project path. It finds the Fortytwo project you are\n# in (the nearest directory, from here upward, that contains .fortytwo/) and runs\n# that project's own CLI, node_modules/.bin/fortytwo, from the project root \u2014\n# only if both are owned by you.\n# Safe to delete: `npx @justfortytwo/installer init` puts it back.\nd=$(pwd -P) || exit 1\nwhile :; do\n  if [ -d \"$d/.fortytwo\" ]; then\n    if [ -x \"$d/node_modules/.bin/fortytwo\" ]; then\n      # Only run code you own: a .fortytwo/ or CLI planted by another user (e.g.\n      # in a shared /tmp above you) is refused, never executed.\n      if [ ! -O \"$d/.fortytwo\" ] || [ ! -O \"$d/node_modules/.bin/fortytwo\" ]; then\n        echo \"fortytwo: refusing to run $d/node_modules/.bin/fortytwo: it or $d/.fortytwo is not owned by you.\" >&2\n        exit 1\n      fi\n      cd \"$d\" && exec \"$d/node_modules/.bin/fortytwo\" \"$@\"\n    fi\n    echo \"fortytwo: $d is a Fortytwo project, but its CLI is not installed there.\" >&2\n    echo \"Install it with: (cd \\\"$d\\\" && npm install @justfortytwo/installer)\" >&2\n    exit 1\n  fi\n  [ \"$d\" = / ] && break\n  d=$(dirname \"$d\")\ndone\necho \"fortytwo: not inside a Fortytwo project (no .fortytwo/ here or in any parent directory).\" >&2\necho \"Create one with: npx @justfortytwo/installer init\" >&2\nexit 1\n";
+export type ShimResult = {
+    status: 'installed' | 'updated' | 'unchanged';
+    path: string;
+}
+/** A `fortytwo` we did not write is in the way (user file, global npm install): left alone. */
+ | {
+    status: 'foreign';
+    path: string;
+}
+/** No writable directory on PATH; nothing written. */
+ | {
+    status: 'no-dir';
+} | {
+    status: 'unsupported';
+    platform: string;
+};
+export interface ShimEnv {
+    home: string;
+    /** The user's PATH. */
+    pathEnv: string;
+    platform: NodeJS.Platform;
+    /** FORTYTWO_BIN_DIR: install into exactly this directory (created if needed). */
+    override?: string;
+    /** npm's global bin directory, if known (looked up lazily, last resort). */
+    npmGlobalBin?: () => string | null;
+}
+export declare function isOurShim(path: string): boolean;
+/**
+ * The user's own PATH entries. Entries npm adds while running a bin
+ * (node_modules/.bin of the project or of the npx cache) are not the user's
+ * PATH and vanish once the command exits, so they never count.
+ */
+export declare function userPathDirs(pathEnv: string): string[];
+/** The first executable `name` on the user's PATH, or null. */
+export declare function findOnPath(name: string, pathEnv: string): string | null;
+/**
+ * Where to put the launcher: the first of ~/.local/bin, ~/bin, npm's global bin
+ * directory that is already on PATH and writable. null if none is.
+ */
+export declare function chooseShimDir(env: ShimEnv): string | null;
+/**
+ * Install or refresh the launcher. Idempotent; never replaces a file it did not
+ * write. A launcher already on PATH (ours) is refreshed in place rather than
+ * duplicated elsewhere.
+ */
+export declare function installShim(env: ShimEnv): ShimResult;
+/** `npm prefix -g`/bin — where npm itself puts user commands (on PATH wherever npm works). */
+export declare function npmGlobalBin(): string | null;
+//# sourceMappingURL=shim.d.ts.map

package/dist/shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shim.d.ts","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":"AAmBA,4EAA4E;AAC5E,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAE3C,eAAO,MAAM,WAAW,i8CA6BvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACjE,+FAA+F;GAC7F;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrC,sDAAsD;GACpD;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM/C;AAMD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAItD;AAED,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQvE;AAYD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CA4BpD;AAED,8FAA8F;AAC9F,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAI5C"}

package/dist/shim.js

@@ -0,0 +1,163 @@
+// shim.ts — the user-level `fortytwo` command.
+//
+// `npx @justfortytwo/installer init` runs from npm's temporary exec cache, so
+// nothing it brings along survives the command. init therefore (a) installs the
+// CLI into the project itself (node_modules/.bin/fortytwo, pinned in
+// package-lock.json) and (b) drops this tiny POSIX launcher into a directory
+// that is ALREADY on the user's PATH. The launcher carries no version and no
+// project path: it finds the Fortytwo project the user is in (the nearest
+// directory, from cwd upward, containing .fortytwo/) and execs THAT project's
+// own CLI from the project root. One launcher serves any number of projects,
+// each running its own pinned CLI version.
+//
+// We never edit shell rc files or PATH. If no suitable directory is on PATH,
+// init says so and the project-local `npx fortytwo` keeps working.
+import { accessSync, chmodSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { delimiter, join, resolve } from 'node:path';
+/** Identifies a launcher we wrote, so we only ever replace our own file. */
+export const SHIM_MARKER = 'fortytwo-shim';
+export const SHIM_SCRIPT = `#!/bin/sh
+# fortytwo — user-level launcher installed by @justfortytwo/installer (${SHIM_MARKER} v2).
+# It holds no version and no project path. It finds the Fortytwo project you are
+# in (the nearest directory, from here upward, that contains .fortytwo/) and runs
+# that project's own CLI, node_modules/.bin/fortytwo, from the project root —
+# only if both are owned by you.
+# Safe to delete: \`npx @justfortytwo/installer init\` puts it back.
+d=$(pwd -P) || exit 1
+while :; do
+  if [ -d "$d/.fortytwo" ]; then
+    if [ -x "$d/node_modules/.bin/fortytwo" ]; then
+      # Only run code you own: a .fortytwo/ or CLI planted by another user (e.g.
+      # in a shared /tmp above you) is refused, never executed.
+      if [ ! -O "$d/.fortytwo" ] || [ ! -O "$d/node_modules/.bin/fortytwo" ]; then
+        echo "fortytwo: refusing to run $d/node_modules/.bin/fortytwo: it or $d/.fortytwo is not owned by you." >&2
+        exit 1
+      fi
+      cd "$d" && exec "$d/node_modules/.bin/fortytwo" "$@"
+    fi
+    echo "fortytwo: $d is a Fortytwo project, but its CLI is not installed there." >&2
+    echo "Install it with: (cd \\"$d\\" && npm install @justfortytwo/installer)" >&2
+    exit 1
+  fi
+  [ "$d" = / ] && break
+  d=$(dirname "$d")
+done
+echo "fortytwo: not inside a Fortytwo project (no .fortytwo/ here or in any parent directory)." >&2
+echo "Create one with: npx @justfortytwo/installer init" >&2
+exit 1
+`;
+export function isOurShim(path) {
+    try {
+        return readFileSync(path, 'utf8').slice(0, 512).includes(SHIM_MARKER);
+    }
+    catch {
+        return false;
+    }
+}
+function canonical(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+/**
+ * The user's own PATH entries. Entries npm adds while running a bin
+ * (node_modules/.bin of the project or of the npx cache) are not the user's
+ * PATH and vanish once the command exits, so they never count.
+ */
+export function userPathDirs(pathEnv) {
+    return pathEnv
+        .split(delimiter)
+        .filter((d) => d && !/[\\/]node_modules[\\/]\.bin[\\/]?$/.test(d) && !/[\\/]_npx[\\/]/.test(d));
+}
+/** The first executable `name` on the user's PATH, or null. */
+export function findOnPath(name, pathEnv) {
+    for (const dir of userPathDirs(pathEnv)) {
+        const p = join(dir, name);
+        try {
+            if (statSync(p).isFile()) {
+                accessSync(p, constants.X_OK);
+                return p;
+            }
+        }
+        catch { /* not here */ }
+    }
+    return null;
+}
+function writableDir(dir) {
+    try {
+        mkdirSync(dir, { recursive: true });
+        accessSync(dir, constants.W_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Where to put the launcher: the first of ~/.local/bin, ~/bin, npm's global bin
+ * directory that is already on PATH and writable. null if none is.
+ */
+export function chooseShimDir(env) {
+    const onPath = new Set(userPathDirs(env.pathEnv).map(canonical));
+    const candidates = [
+        () => join(env.home, '.local', 'bin'),
+        () => join(env.home, 'bin'),
+        () => env.npmGlobalBin?.() ?? null,
+    ];
+    for (const next of candidates) {
+        const dir = next();
+        if (dir && onPath.has(canonical(dir)) && writableDir(dir))
+            return dir;
+    }
+    return null;
+}
+/**
+ * Install or refresh the launcher. Idempotent; never replaces a file it did not
+ * write. A launcher already on PATH (ours) is refreshed in place rather than
+ * duplicated elsewhere.
+ */
+export function installShim(env) {
+    if (env.platform === 'win32')
+        return { status: 'unsupported', platform: env.platform };
+    let target;
+    if (env.override) {
+        if (!writableDir(env.override))
+            return { status: 'no-dir' };
+        target = join(env.override, 'fortytwo');
+    }
+    else {
+        const existing = findOnPath('fortytwo', env.pathEnv);
+        if (existing) {
+            if (!isOurShim(existing))
+                return { status: 'foreign', path: existing };
+            target = existing;
+        }
+        else {
+            const dir = chooseShimDir(env);
+            if (!dir)
+                return { status: 'no-dir' };
+            target = join(dir, 'fortytwo');
+        }
+    }
+    const present = existsSync(target);
+    if (present && !isOurShim(target))
+        return { status: 'foreign', path: target };
+    if (present && readFileSync(target, 'utf8') === SHIM_SCRIPT)
+        return { status: 'unchanged', path: target };
+    const tmp = `${target}.${process.pid}.tmp`;
+    writeFileSync(tmp, SHIM_SCRIPT, { encoding: 'utf8', mode: 0o755 });
+    chmodSync(tmp, 0o755);
+    renameSync(tmp, target);
+    return { status: present ? 'updated' : 'installed', path: target };
+}
+/** `npm prefix -g`/bin — where npm itself puts user commands (on PATH wherever npm works). */
+export function npmGlobalBin() {
+    const res = spawnSync('npm', ['prefix', '-g'], { encoding: 'utf8' });
+    const prefix = res.status === 0 ? res.stdout.trim() : '';
+    return prefix ? join(prefix, 'bin') : null;
+}
+//# sourceMappingURL=shim.js.map

package/dist/shim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shim.js","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,qEAAqE;AACrE,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,2CAA2C;AAC3C,EAAE;AACF,6EAA6E;AAC7E,mEAAmE;AAEnE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnJ,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAErD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAE3C,MAAM,CAAC,MAAM,WAAW,GAAG;yEAC8C,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BnF,CAAC;AAqBF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO;SACX,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IACtD,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,CAAC,CAAC;YAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,MAAM,UAAU,GAA4B;QAC1C,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC;QACrC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QAC3B,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,IAAI;KACnC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;QACnB,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAEvF,IAAI,MAAc,CAAC;IACnB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5D,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACvE,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACtC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9E,IAAI,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAE1G,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC3C,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACrE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@justfortytwo/installer",
-  "version": "1.0.0-0",
-  "description": "All-in-one installer and lifecycle CLI for fortytwo — scaffolds the persona surface and provisions the npm engine (memory MCP, safety gate, channel adapters, embedder).",
+  "version": "1.0.0-10",
+  "description": "All-in-one installer and lifecycle CLI for fortytwo \u2014 scaffolds the persona surface and provisions the npm engine (memory MCP, safety gate, channel adapters, embedder).",
   "license": "MIT",
   "author": {
     "name": "Enrico Deleo",
@@ -44,38 +44,14 @@
     "@types/node": "^20.0.0",
     "vitest": "^2.1.0"
   },
-  "peerDependencies": {
-    "@justfortytwo/memory": "^0.1.5",
-    "@justfortytwo/gate": "^0.1.0",
-    "@justfortytwo/persona": "^0.1.0",
-    "@justfortytwo/telegram": "1.0.0-0",
-    "@justfortytwo/scheduler": "^0.1.0"
-  },
-  "peerDependenciesMeta": {
-    "@justfortytwo/memory": {
-      "optional": true
-    },
-    "@justfortytwo/gate": {
-      "optional": true
-    },
-    "@justfortytwo/persona": {
-      "optional": true
-    },
-    "@justfortytwo/telegram": {
-      "optional": true
-    },
-    "@justfortytwo/scheduler": {
-      "optional": true
-    }
-  },
   "fortytwo": {
-    "comment": "Compatibility contract this CLI version was authored against. doctor cross-checks the *installed* sibling packages against these ranges; update/rollback record the resolved set into .fortytwo/state.json. TODO(wire): bump these as sibling contracts evolve.",
+    "comment": "Compatibility contract this CLI version was authored against \u2014 the SINGLE source of truth for engine sibling versions (deliberately not peerDependencies: npm would hard-fail installer upgrades with ERESOLVE whenever an installed sibling sits outside the new range). init installs these ranges, doctor cross-checks the *installed* siblings against them, update resolves latest-in-range and records the set into .fortytwo/state.json for rollback.",
     "compat": {
-      "@justfortytwo/memory": "^0.1.5",
+      "@justfortytwo/memory": "1.0.0-2",
       "@justfortytwo/gate": "^0.1.0",
-      "@justfortytwo/persona": "^0.1.0",
-      "@justfortytwo/telegram": "1.0.0-0",
-      "@justfortytwo/scheduler": "^0.1.0"
+      "@justfortytwo/persona": "1.0.0-2",
+      "@justfortytwo/telegram": "1.0.0-2",
+      "@justfortytwo/scheduler": "1.0.0-3"
     }
   },
   "publishConfig": {