@microwiseai/snapshot 0.5.0 → 0.5.2

package/node_modules/@gitdot/clone-lib/dist/dotpath.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dotToTreePath = dotToTreePath;
+/**
+ * dotToTreePath — the pure identity->path function reused from SUBSET-MANIFEST.
+ * A gitdot dot-identity ("ist.tda", "microwiseai.skit") maps 1:1 to a tree path
+ * ("ist/tda", "microwiseai/skit"). Pure, deterministic, no I/O.
+ *
+ * @param id declared dot-identity
+ * @returns POSIX-style relative tree path
+ */
+function dotToTreePath(id) {
+    if (typeof id !== 'string' || id.length === 0) {
+        throw new Error('dotToTreePath: id must be a non-empty string');
+    }
+    // Segments are separated by dots. Reject empty segments (".."/leading/trailing dot)
+    // so a malformed id can never escape the workspace root.
+    const segments = id.split('.');
+    if (segments.some((s) => s.length === 0)) {
+        throw new Error(`dotToTreePath: malformed id "${id}" (empty segment)`);
+    }
+    if (segments.some((s) => s === '.' || s === '..' || s.includes('/') || s.includes('\\'))) {
+        throw new Error(`dotToTreePath: unsafe segment in id "${id}"`);
+    }
+    return segments.join('/');
+}
+//# sourceMappingURL=dotpath.js.map

package/node_modules/@gitdot/clone-lib/dist/dotpath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotpath.js","sourceRoot":"","sources":["../src/dotpath.ts"],"names":[],"mappings":";;AAQA,sCAcC;AAtBD;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,EAAU;IACtC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,oFAAoF;IACpF,yDAAyD;IACzD,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gCAAgC,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/node_modules/@gitdot/clone-lib/dist/git.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Git runner — the ONLY place that shells out to `git`. Injectable (DI) so the
+ * clone core can be unit-tested deterministically with an in-memory fake.
+ *
+ * clone()/checkout() classify failures into a `.kind`
+ * ('not-found' | 'no-access' | 'failed') so the core can route each member into
+ * the correct report bucket without re-parsing git stderr itself.
+ */
+import type { GitRunner, GitErrorKind } from './types';
+export declare class GitError extends Error {
+    kind: GitErrorKind;
+    constructor(message: string, kind: GitErrorKind);
+}
+/**
+ * Map raw git stderr to a structured kind. Heuristic but covers the common
+ * GitLab/https + ssh failure phrasings.
+ */
+export declare function classifyGitError(stderr: string): GitErrorKind;
+export interface GitRunnerOptions {
+    timeout?: number;
+}
+export declare function createGitRunner(opts?: GitRunnerOptions): GitRunner;
+//# sourceMappingURL=git.d.ts.map

package/node_modules/@gitdot/clone-lib/dist/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvD,qBAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,EAAE,YAAY,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY;CAKhD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAuB7D;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,gBAAqB,GAAG,SAAS,CAiDtE"}

package/node_modules/@gitdot/clone-lib/dist/git.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Git runner — the ONLY place that shells out to `git`. Injectable (DI) so the
+ * clone core can be unit-tested deterministically with an in-memory fake.
+ *
+ * clone()/checkout() classify failures into a `.kind`
+ * ('not-found' | 'no-access' | 'failed') so the core can route each member into
+ * the correct report bucket without re-parsing git stderr itself.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitError = void 0;
+exports.classifyGitError = classifyGitError;
+exports.createGitRunner = createGitRunner;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+class GitError extends Error {
+    kind;
+    constructor(message, kind) {
+        super(message);
+        this.name = 'GitError';
+        this.kind = kind;
+    }
+}
+exports.GitError = GitError;
+/**
+ * Map raw git stderr to a structured kind. Heuristic but covers the common
+ * GitLab/https + ssh failure phrasings.
+ */
+function classifyGitError(stderr) {
+    const s = String(stderr || '').toLowerCase();
+    if (s.includes('repository not found') ||
+        s.includes('not found') ||
+        s.includes('does not exist') ||
+        s.includes('404')) {
+        return 'not-found';
+    }
+    if (s.includes('authentication failed') ||
+        s.includes('access denied') ||
+        s.includes('permission denied') ||
+        s.includes('403') ||
+        s.includes('could not read username') ||
+        s.includes('could not read password') ||
+        s.includes('terminal prompts disabled') ||
+        s.includes('403 forbidden')) {
+        return 'no-access';
+    }
+    return 'failed';
+}
+function createGitRunner(opts = {}) {
+    const timeout = opts.timeout || 300000; // 5 min
+    const run = (args, cwd) => {
+        try {
+            return (0, child_process_1.execFileSync)('git', args, {
+                cwd,
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'pipe'],
+                timeout,
+                env: {
+                    ...process.env,
+                    // Never let git block on an interactive credential prompt: a missing
+                    // credential must surface as a deterministic no-access failure.
+                    GIT_TERMINAL_PROMPT: '0',
+                    GCM_INTERACTIVE: 'never',
+                },
+            }).trim();
+        }
+        catch (e) {
+            const err = e;
+            const stderr = err.stderr ? err.stderr.toString() : err.message || String(e);
+            throw new GitError(stderr.trim(), classifyGitError(stderr));
+        }
+    };
+    return {
+        exists(absPath) {
+            return fs.existsSync(absPath);
+        },
+        isRepo(absPath) {
+            if (!fs.existsSync(path.join(absPath, '.git')))
+                return false;
+            try {
+                run(['rev-parse', '--is-inside-work-tree'], absPath);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        clone(cloneUrl, absPath) {
+            fs.mkdirSync(path.dirname(absPath), { recursive: true });
+            run(['clone', '--quiet', cloneUrl, absPath]);
+        },
+        checkout(absPath, sha) {
+            run(['checkout', '--quiet', sha], absPath);
+        },
+        headSha(absPath) {
+            return run(['rev-parse', 'HEAD'], absPath);
+        },
+    };
+}
+//# sourceMappingURL=git.js.map

package/node_modules/@gitdot/clone-lib/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBH,4CAuBC;AAMD,0CAiDC;AAhGD,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAG7B,MAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,CAAe;IACnB,YAAY,OAAe,EAAE,IAAkB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,4BAOC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,IACE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAClC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACnC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3B,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAC/B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACrC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACrC,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QACvC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC3B,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAMD,SAAgB,eAAe,CAAC,OAAyB,EAAE;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,QAAQ;IAEhD,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,GAAY,EAAU,EAAE;QACnD,IAAI,CAAC;YACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/B,GAAG;gBACH,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,OAAO;gBACP,GAAG,EAAE;oBACH,GAAG,OAAO,CAAC,GAAG;oBACd,qEAAqE;oBACrE,gEAAgE;oBAChE,mBAAmB,EAAE,GAAG;oBACxB,eAAe,EAAE,OAAO;iBACzB;aACF,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAmD,CAAC;YAChE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7E,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,OAAe;YACpB,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,CAAC,OAAe;YACpB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7D,IAAI,CAAC;gBACH,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,OAAO,CAAC,CAAC;gBACrD,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAgB,EAAE,OAAe;YACrC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,QAAQ,CAAC,OAAe,EAAE,GAAW;YACnC,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,OAAe;YACrB,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@gitdot/clone-lib/dist/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @gitdot/clone-lib — shared resolved-lock resolve + clone library
+ * (RESOLVED-LOCK-SPEC S2/S3/S4). Dependency-free, deterministic, --json first.
+ *
+ * Public surface:
+ *   resolveLock          (B1) package-lock.json      -> resolved-lock
+ *   resolveFromManifest  (B2) snapshot.json manifest -> resolved-lock
+ *   cloneFromLock        (S3) resolved-lock          -> cloned closure + report
+ *   loadLock / writeLock (S2) filename-agnostic sidecar schema I/O
+ */
+export { cloneFromLock } from './clone';
+export { createGitRunner, GitError, classifyGitError } from './git';
+export { loadLock, writeLock, validateLock, KNOWN_SIDECARS } from './lock';
+export { resolveLock, resolveFromManifest, createGitLabApi } from './resolve/index';
+export { dotToTreePath } from './dotpath';
+export type { CloneMode, Visibility, Provenance, MemberType, GitErrorKind, RepoCoordinate, Ref, Member, LockSource, ResolvedLock, ClonedEntry, SkippedEntry, NoAccessEntry, BucketEntry, CloneReport, GitRunner, GitLabProject, GitLabTag, PackumentVersion, Packument, GitLabApi, RegistryMap, InstallBlock, Manifest, NpmDependencySpec, SkitManifest, CloneFromLockOptions, ReadInstalledManifest, ResolveLockOptions, ResolveFromManifestOptions, ResolveResult, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@gitdot/clone-lib/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAGpE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGpF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,cAAc,EACd,GAAG,EACH,MAAM,EACN,UAAU,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,SAAS,EACT,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,EAC1B,aAAa,GACd,MAAM,SAAS,CAAC"}

package/node_modules/@gitdot/clone-lib/dist/index.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * @gitdot/clone-lib — shared resolved-lock resolve + clone library
+ * (RESOLVED-LOCK-SPEC S2/S3/S4). Dependency-free, deterministic, --json first.
+ *
+ * Public surface:
+ *   resolveLock          (B1) package-lock.json      -> resolved-lock
+ *   resolveFromManifest  (B2) snapshot.json manifest -> resolved-lock
+ *   cloneFromLock        (S3) resolved-lock          -> cloned closure + report
+ *   loadLock / writeLock (S2) filename-agnostic sidecar schema I/O
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dotToTreePath = exports.createGitLabApi = exports.resolveFromManifest = exports.resolveLock = exports.KNOWN_SIDECARS = exports.validateLock = exports.writeLock = exports.loadLock = exports.classifyGitError = exports.GitError = exports.createGitRunner = exports.cloneFromLock = void 0;
+// clone (S3)
+var clone_1 = require("./clone");
+Object.defineProperty(exports, "cloneFromLock", { enumerable: true, get: function () { return clone_1.cloneFromLock; } });
+var git_1 = require("./git");
+Object.defineProperty(exports, "createGitRunner", { enumerable: true, get: function () { return git_1.createGitRunner; } });
+Object.defineProperty(exports, "GitError", { enumerable: true, get: function () { return git_1.GitError; } });
+Object.defineProperty(exports, "classifyGitError", { enumerable: true, get: function () { return git_1.classifyGitError; } });
+// sidecar schema (S2)
+var lock_1 = require("./lock");
+Object.defineProperty(exports, "loadLock", { enumerable: true, get: function () { return lock_1.loadLock; } });
+Object.defineProperty(exports, "writeLock", { enumerable: true, get: function () { return lock_1.writeLock; } });
+Object.defineProperty(exports, "validateLock", { enumerable: true, get: function () { return lock_1.validateLock; } });
+Object.defineProperty(exports, "KNOWN_SIDECARS", { enumerable: true, get: function () { return lock_1.KNOWN_SIDECARS; } });
+// resolve (S4)
+var index_1 = require("./resolve/index");
+Object.defineProperty(exports, "resolveLock", { enumerable: true, get: function () { return index_1.resolveLock; } });
+Object.defineProperty(exports, "resolveFromManifest", { enumerable: true, get: function () { return index_1.resolveFromManifest; } });
+Object.defineProperty(exports, "createGitLabApi", { enumerable: true, get: function () { return index_1.createGitLabApi; } });
+// utilities
+var dotpath_1 = require("./dotpath");
+Object.defineProperty(exports, "dotToTreePath", { enumerable: true, get: function () { return dotpath_1.dotToTreePath; } });
+//# sourceMappingURL=index.js.map

package/node_modules/@gitdot/clone-lib/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,aAAa;AACb,iCAAwC;AAA/B,sGAAA,aAAa,OAAA;AACtB,6BAAoE;AAA3D,sGAAA,eAAe,OAAA;AAAE,+FAAA,QAAQ,OAAA;AAAE,uGAAA,gBAAgB,OAAA;AAEpD,sBAAsB;AACtB,+BAA2E;AAAlE,gGAAA,QAAQ,OAAA;AAAE,iGAAA,SAAS,OAAA;AAAE,oGAAA,YAAY,OAAA;AAAE,sGAAA,cAAc,OAAA;AAE1D,eAAe;AACf,yCAAoF;AAA3E,oGAAA,WAAW,OAAA;AAAE,4GAAA,mBAAmB,OAAA;AAAE,wGAAA,eAAe,OAAA;AAE1D,YAAY;AACZ,qCAA0C;AAAjC,wGAAA,aAAa,OAAA"}

package/node_modules/@gitdot/clone-lib/dist/lock.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Sidecar lock schema (RESOLVED-LOCK-SPEC S2).
+ *
+ * skit.lock.json, snapshot.lock.json and glpkg.lock.json are ALL instances of
+ * the ONE resolved-lock schema — same file shape, differing only in the `source`
+ * block. Readers load them FILENAME-AGNOSTICALLY: the filename is a label, never
+ * a schema selector.
+ */
+import type { ResolvedLock } from './types';
+/** Distributions known to emit this schema; informational only (not a gate). */
+export declare const KNOWN_SIDECARS: readonly string[];
+/**
+ * Validate a parsed object against the resolved-lock schema. Returns it typed.
+ * @throws on a shape that clone/consumer code cannot safely read.
+ */
+export declare function validateLock(lock: unknown, label?: string): ResolvedLock;
+/**
+ * Load a resolved-lock from disk, filename-agnostically. The same function reads
+ * skit.lock.json / snapshot.lock.json / glpkg.lock.json — they are one schema.
+ */
+export declare function loadLock(lockPath: string): ResolvedLock;
+/** Write a resolved-lock deterministically (2-space indent + trailing newline). */
+export declare function writeLock(lockPath: string, lock: ResolvedLock): void;
+//# sourceMappingURL=lock.d.ts.map

package/node_modules/@gitdot/clone-lib/dist/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../src/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,gFAAgF;AAChF,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAI3C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,SAAS,GAAG,YAAY,CAexE;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAWvD;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAGpE"}

package/node_modules/@gitdot/clone-lib/dist/lock.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * Sidecar lock schema (RESOLVED-LOCK-SPEC S2).
+ *
+ * skit.lock.json, snapshot.lock.json and glpkg.lock.json are ALL instances of
+ * the ONE resolved-lock schema — same file shape, differing only in the `source`
+ * block. Readers load them FILENAME-AGNOSTICALLY: the filename is a label, never
+ * a schema selector.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KNOWN_SIDECARS = void 0;
+exports.validateLock = validateLock;
+exports.loadLock = loadLock;
+exports.writeLock = writeLock;
+const fs = __importStar(require("fs"));
+/** Distributions known to emit this schema; informational only (not a gate). */
+exports.KNOWN_SIDECARS = [
+    'skit.lock.json',
+    'snapshot.lock.json',
+    'glpkg.lock.json',
+];
+/**
+ * Validate a parsed object against the resolved-lock schema. Returns it typed.
+ * @throws on a shape that clone/consumer code cannot safely read.
+ */
+function validateLock(lock, label = 'lock') {
+    if (!lock || typeof lock !== 'object') {
+        throw new Error(`${label}: not an object`);
+    }
+    const l = lock;
+    if (l.kind !== 'resolved-lock') {
+        throw new Error(`${label}: not a resolved-lock (kind=${JSON.stringify(l.kind)})`);
+    }
+    if (l.lockVersion !== 1) {
+        throw new Error(`${label}: unsupported lockVersion ${JSON.stringify(l.lockVersion)} (expected 1)`);
+    }
+    if (!Array.isArray(l.members)) {
+        throw new Error(`${label}: missing members[]`);
+    }
+    return lock;
+}
+/**
+ * Load a resolved-lock from disk, filename-agnostically. The same function reads
+ * skit.lock.json / snapshot.lock.json / glpkg.lock.json — they are one schema.
+ */
+function loadLock(lockPath) {
+    if (!fs.existsSync(lockPath)) {
+        throw new Error(`loadLock: lock not found: ${lockPath}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+    }
+    catch (e) {
+        throw new Error(`loadLock: invalid JSON in ${lockPath}: ${e.message}`);
+    }
+    return validateLock(parsed, lockPath);
+}
+/** Write a resolved-lock deterministically (2-space indent + trailing newline). */
+function writeLock(lockPath, lock) {
+    validateLock(lock, lockPath);
+    fs.writeFileSync(lockPath, JSON.stringify(lock, null, 2) + '\n');
+}
+//# sourceMappingURL=lock.js.map

package/node_modules/@gitdot/clone-lib/dist/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../src/lock.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBH,oCAeC;AAMD,4BAWC;AAGD,8BAGC;AApDD,uCAAyB;AAGzB,gFAAgF;AACnE,QAAA,cAAc,GAAsB;IAC/C,gBAAgB;IAChB,oBAAoB;IACpB,iBAAiB;CAClB,CAAC;AAEF;;;GAGG;AACH,SAAgB,YAAY,CAAC,IAAa,EAAE,KAAK,GAAG,MAAM;IACxD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,GAAG,IAA6B,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAoB,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,QAAgB;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,mFAAmF;AACnF,SAAgB,SAAS,CAAC,QAAgB,EAAE,IAAkB;IAC5D,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACnE,CAAC"}

package/node_modules/@gitdot/clone-lib/dist/resolve/gitlab.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Read-only GitLab API client for the resolve step (RESOLVED-LOCK-SPEC S4).
+ *
+ * Dependency-free (Node built-in https). Injectable at a higher level: the
+ * resolvers accept a {@link GitLabApi}, so unit tests pass a fake and never touch
+ * the network. Results are cached per key within one client.
+ */
+import type { GitLabApi } from '../types';
+export declare function httpsGetJson<T = unknown>(host: string, pathname: string, token?: string, timeout?: number): Promise<T>;
+export interface GitLabApiOptions {
+    token?: string | null;
+    host?: string;
+}
+export declare function createGitLabApi(opts?: GitLabApiOptions): GitLabApi;
+//# sourceMappingURL=gitlab.d.ts.map

package/node_modules/@gitdot/clone-lib/dist/resolve/gitlab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../src/resolve/gitlab.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAuC,MAAM,UAAU,CAAC;AAE/E,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,SAAQ,GACd,OAAO,CAAC,CAAC,CAAC,CAoCZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,gBAAqB,GAAG,SAAS,CA+CtE"}

package/node_modules/@gitdot/clone-lib/dist/resolve/gitlab.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Read-only GitLab API client for the resolve step (RESOLVED-LOCK-SPEC S4).
+ *
+ * Dependency-free (Node built-in https). Injectable at a higher level: the
+ * resolvers accept a {@link GitLabApi}, so unit tests pass a fake and never touch
+ * the network. Results are cached per key within one client.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.httpsGetJson = httpsGetJson;
+exports.createGitLabApi = createGitLabApi;
+const https = __importStar(require("https"));
+function httpsGetJson(host, pathname, token, timeout = 30000) {
+    return new Promise((resolve, reject) => {
+        const req = https.request({
+            host,
+            path: pathname,
+            method: 'GET',
+            headers: token
+                ? { 'PRIVATE-TOKEN': token, Accept: 'application/json' }
+                : { Accept: 'application/json' },
+            timeout,
+        }, (res) => {
+            let body = '';
+            res.on('data', (d) => (body += d));
+            res.on('end', () => {
+                const status = res.statusCode || 0;
+                if (status === 404)
+                    return reject(Object.assign(new Error('not-found'), { status: 404 }));
+                if (status === 401 || status === 403) {
+                    return reject(Object.assign(new Error('no-access'), { status }));
+                }
+                if (status >= 400) {
+                    return reject(Object.assign(new Error(`http ${status}`), { status }));
+                }
+                try {
+                    resolve(JSON.parse(body));
+                }
+                catch (e) {
+                    reject(new Error(`bad JSON from ${pathname}: ${e.message}`));
+                }
+            });
+        });
+        req.on('timeout', () => req.destroy(new Error('timeout')));
+        req.on('error', reject);
+        req.end();
+    });
+}
+function createGitLabApi(opts = {}) {
+    const host = opts.host || 'gitlab.com';
+    const token = opts.token || undefined;
+    const projectCache = new Map();
+    const tagsCache = new Map();
+    const packumentCache = new Map();
+    return {
+        async getProject(projectId) {
+            const key = String(projectId);
+            const cached = projectCache.get(key);
+            if (cached)
+                return cached;
+            const p = await httpsGetJson(host, `/api/v4/projects/${encodeURIComponent(String(projectId))}`, token);
+            projectCache.set(key, p);
+            return p;
+        },
+        async getTags(projectId) {
+            const key = String(projectId);
+            const cached = tagsCache.get(key);
+            if (cached)
+                return cached;
+            // per_page=100: enough to find a released version tag for MVP scope.
+            const t = await httpsGetJson(host, `/api/v4/projects/${encodeURIComponent(String(projectId))}/repository/tags?per_page=100`, token);
+            tagsCache.set(key, t);
+            return t;
+        },
+        async getPackument(name, packOpts = {}) {
+            const key = `${packOpts.group || ''}::${name}`;
+            const cached = packumentCache.get(key);
+            if (cached)
+                return cached;
+            // npm metadata convention: encode only the scope slash as %2f, keep the leading @.
+            const enc = name.replace(/\//g, '%2f');
+            const pathname = packOpts.group
+                ? `/api/v4/groups/${encodeURIComponent(packOpts.group)}/-/packages/npm/${enc}`
+                : `/api/v4/packages/npm/${enc}`;
+            const p = await httpsGetJson(host, pathname, token);
+            packumentCache.set(key, p);
+            return p;
+        },
+    };
+}
+//# sourceMappingURL=gitlab.js.map

package/node_modules/@gitdot/clone-lib/dist/resolve/gitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.js","sourceRoot":"","sources":["../../src/resolve/gitlab.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,oCAyCC;AAOD,0CA+CC;AAlGD,6CAA+B;AAG/B,SAAgB,YAAY,CAC1B,IAAY,EACZ,QAAgB,EAChB,KAAc,EACd,OAAO,GAAG,KAAK;IAEf,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CACvB;YACE,IAAI;YACJ,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;gBACZ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACxD,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAClC,OAAO;SACR,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBACnC,IAAI,MAAM,KAAK,GAAG;oBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC1F,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACrC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACnE,CAAC;gBACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;oBAClB,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC,CAAC;gBACjC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,QAAQ,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,SAAgB,eAAe,CAAC,OAAyB,EAAE;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqB,CAAC;IAEpD,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,SAAS;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,CAAC,GAAG,MAAM,YAAY,CAC1B,IAAI,EACJ,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAC3D,KAAK,CACN,CAAC;YACF,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAS;YACrB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,qEAAqE;YACrE,MAAM,CAAC,GAAG,MAAM,YAAY,CAC1B,IAAI,EACJ,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,+BAA+B,EACxF,KAAK,CACN,CAAC;YACF,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,EAAE;YACpC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,mFAAmF;YACnF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK;gBAC7B,CAAC,CAAC,kBAAkB,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE;gBAC9E,CAAC,CAAC,wBAAwB,GAAG,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,MAAM,YAAY,CAAY,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/D,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC;QACX,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@gitdot/clone-lib/dist/resolve/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * resolve/ — the resolve step (RESOLVED-LOCK-SPEC S4). Two resolvers over ONE
+ * shared member core (member.ts), both emitting the same resolved-lock:
+ *
+ *   B1  resolveLock(package-lock)   — from an installed project's package-lock.json
+ *   B2  resolveFromManifest(json)   — from a snapshot.json-like install manifest
+ */
+export { resolveLock, DEFAULT_SCOPES, npmNameFromKey } from './resolve';
+export { resolveFromManifest, flattenInstall, scopeOf, pickVersionEntry } from './manifest';
+export { resolveMember, projectIdFromResolved, repositoryToCloneUrl, projectPathFromUrl, idFromProjectPath, groupFromProjectPath, findCommitSha, } from './member';
+export { createGitLabApi, httpsGetJson } from './gitlab';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@gitdot/clone-lib/dist/resolve/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resolve/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC"}

package/node_modules/@gitdot/clone-lib/dist/resolve/index.js

@@ -0,0 +1,31 @@
+"use strict";
+/**
+ * resolve/ — the resolve step (RESOLVED-LOCK-SPEC S4). Two resolvers over ONE
+ * shared member core (member.ts), both emitting the same resolved-lock:
+ *
+ *   B1  resolveLock(package-lock)   — from an installed project's package-lock.json
+ *   B2  resolveFromManifest(json)   — from a snapshot.json-like install manifest
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.httpsGetJson = exports.createGitLabApi = exports.findCommitSha = exports.groupFromProjectPath = exports.idFromProjectPath = exports.projectPathFromUrl = exports.repositoryToCloneUrl = exports.projectIdFromResolved = exports.resolveMember = exports.pickVersionEntry = exports.scopeOf = exports.flattenInstall = exports.resolveFromManifest = exports.npmNameFromKey = exports.DEFAULT_SCOPES = exports.resolveLock = void 0;
+var resolve_1 = require("./resolve");
+Object.defineProperty(exports, "resolveLock", { enumerable: true, get: function () { return resolve_1.resolveLock; } });
+Object.defineProperty(exports, "DEFAULT_SCOPES", { enumerable: true, get: function () { return resolve_1.DEFAULT_SCOPES; } });
+Object.defineProperty(exports, "npmNameFromKey", { enumerable: true, get: function () { return resolve_1.npmNameFromKey; } });
+var manifest_1 = require("./manifest");
+Object.defineProperty(exports, "resolveFromManifest", { enumerable: true, get: function () { return manifest_1.resolveFromManifest; } });
+Object.defineProperty(exports, "flattenInstall", { enumerable: true, get: function () { return manifest_1.flattenInstall; } });
+Object.defineProperty(exports, "scopeOf", { enumerable: true, get: function () { return manifest_1.scopeOf; } });
+Object.defineProperty(exports, "pickVersionEntry", { enumerable: true, get: function () { return manifest_1.pickVersionEntry; } });
+var member_1 = require("./member");
+Object.defineProperty(exports, "resolveMember", { enumerable: true, get: function () { return member_1.resolveMember; } });
+Object.defineProperty(exports, "projectIdFromResolved", { enumerable: true, get: function () { return member_1.projectIdFromResolved; } });
+Object.defineProperty(exports, "repositoryToCloneUrl", { enumerable: true, get: function () { return member_1.repositoryToCloneUrl; } });
+Object.defineProperty(exports, "projectPathFromUrl", { enumerable: true, get: function () { return member_1.projectPathFromUrl; } });
+Object.defineProperty(exports, "idFromProjectPath", { enumerable: true, get: function () { return member_1.idFromProjectPath; } });
+Object.defineProperty(exports, "groupFromProjectPath", { enumerable: true, get: function () { return member_1.groupFromProjectPath; } });
+Object.defineProperty(exports, "findCommitSha", { enumerable: true, get: function () { return member_1.findCommitSha; } });
+var gitlab_1 = require("./gitlab");
+Object.defineProperty(exports, "createGitLabApi", { enumerable: true, get: function () { return gitlab_1.createGitLabApi; } });
+Object.defineProperty(exports, "httpsGetJson", { enumerable: true, get: function () { return gitlab_1.httpsGetJson; } });
+//# sourceMappingURL=index.js.map

package/node_modules/@gitdot/clone-lib/dist/resolve/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resolve/index.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,qCAAwE;AAA/D,sGAAA,WAAW,OAAA;AAAE,yGAAA,cAAc,OAAA;AAAE,yGAAA,cAAc,OAAA;AACpD,uCAA4F;AAAnF,+GAAA,mBAAmB,OAAA;AAAE,0GAAA,cAAc,OAAA;AAAE,mGAAA,OAAO,OAAA;AAAE,4GAAA,gBAAgB,OAAA;AACvE,mCAQkB;AAPhB,uGAAA,aAAa,OAAA;AACb,+GAAA,qBAAqB,OAAA;AACrB,8GAAA,oBAAoB,OAAA;AACpB,4GAAA,kBAAkB,OAAA;AAClB,2GAAA,iBAAiB,OAAA;AACjB,8GAAA,oBAAoB,OAAA;AACpB,uGAAA,aAAa,OAAA;AAEf,mCAAyD;AAAhD,yGAAA,eAAe,OAAA;AAAE,sGAAA,YAAY,OAAA"}

package/node_modules/@gitdot/clone-lib/dist/resolve/manifest.d.ts

@@ -0,0 +1,32 @@
+/**
+ * resolveFromManifest (B2) — the manifest-driven resolver (RESOLVED-LOCK-SPEC S4).
+ *
+ * Input: a snapshot.json-like {@link Manifest} (install set + registry scope→group).
+ * B2 discovers each package's projectId by fetching the GitLab npm **packument**
+ * and mining the version's `dist.tarball` URL — the same coordinate signal B1
+ * mines from a package-lock `resolved` URL. From "npmName + version + projectId"
+ * onward it reuses the shared member core, so resolution is IDENTICAL to B1.
+ *
+ * Output: the SAME resolved-lock schema (S2); only `source.derivedFrom` differs.
+ * READ-ONLY: registry GETs only.
+ */
+import type { InstallBlock, Manifest, Packument, PackumentVersion, ResolveFromManifestOptions, ResolveResult } from '../types';
+export interface InstallEntry {
+    npmName: string;
+    version: string;
+    installer: string;
+}
+/** scope of an npm name: "@ist/tda" -> "@ist"; unscoped -> null. */
+export declare function scopeOf(name: string): string | null;
+/**
+ * Flatten an install block into entries. Accepts the channelled shape
+ * ({channel:{name:version}}) or a flat map. De-dups by npmName (first wins).
+ */
+export declare function flattenInstall(install: InstallBlock | undefined, doWarn: (msg: string) => void): InstallEntry[];
+/** Pick the packument version entry for an exact version, else dist-tags.latest. */
+export declare function pickVersionEntry(packument: Packument | undefined, version: string, doWarn: (msg: string) => void, npmName: string): {
+    entry: PackumentVersion | null;
+    version: string;
+};
+export declare function resolveFromManifest(manifestObj: Manifest, options: ResolveFromManifestOptions): Promise<ResolveResult>;
+//# sourceMappingURL=manifest.d.ts.map